@pieai/pro-gov 0.8.0 → 0.9.0

package/dist/cli.js

@@ -8,8 +8,8 @@ var packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));
 var sourceRoot = join(packageRoot, "..", "..");
 var packagedAssetsRoot = join(packageRoot, "assets");
 var assetRoots = ["starter", "profiles", "integrations", "docs/reference/adoption"];
-function listAssets() {
-  const root = existsSync(join(sourceRoot, "starter")) ? sourceRoot : packagedAssetsRoot;
+function listAssets(source = "auto") {
+  const root = source === "packaged" ? packagedAssetsRoot : source === "source" ? sourceRoot : existsSync(join(sourceRoot, "starter")) ? sourceRoot : packagedAssetsRoot;
   return assetRoots.flatMap((assetRoot) => {
     const absoluteRoot = join(root, assetRoot);
     if (!existsSync(absoluteRoot)) return [];
@@ -247,6 +247,7 @@ var supportedVisibilities = /* @__PURE__ */ new Set([
 var supportedSourceKinds = /* @__PURE__ */ new Set(["local", "local-pack", "npx"]);
 var supportedSkillPlacements = /* @__PURE__ */ new Set(["auto", "manual"]);
 var supportedSkillScopes = /* @__PURE__ */ new Set(["project", "user"]);
+var supportedDeliveries = /* @__PURE__ */ new Set(["symlink", "snapshot"]);
 var supportedHosts = /* @__PURE__ */ new Set([
   "codex",
   "claude-code",
@@ -254,12 +255,35 @@ var supportedHosts = /* @__PURE__ */ new Set([
   "antigravity"
 ]);
 var skillInstallNamePattern = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+var safeProjectTargetFilenamePattern = /^[^./\\][^/\\]*$/;
 function assetSkillInstallName(asset) {
   return asset.installName ?? posix.basename(asset.sourcePath);
 }
+function isValidAssetProjectTargetPath(kind, projectTargetPath) {
+  if (typeof projectTargetPath !== "string" || projectTargetPath.length === 0 || isAbsolute(projectTargetPath) || projectTargetPath.includes("\\")) {
+    return false;
+  }
+  const segments = projectTargetPath.split("/");
+  if (segments.some((segment) => segment.length === 0 || segment === "." || segment === "..")) {
+    return false;
+  }
+  const filename = segments.at(-1);
+  if (!filename || !safeProjectTargetFilenamePattern.test(filename)) return false;
+  if (kind === "rule") {
+    return segments.length === 4 && segments[0] === "docs" && segments[1] === "policy" && segments[2] === "shared-rules" && filename.endsWith(".md") || segments.length === 4 && segments[0] === ".pro-gov" && segments[1] === "agent-assets" && segments[2] === "rules";
+  }
+  if (kind === "command") {
+    return segments.length === 4 && segments[0] === ".pro-gov" && segments[1] === "agent-assets" && segments[2] === "commands";
+  }
+  return false;
+}
+function isValidSnapshotProjectTargetPath(projectTargetPath) {
+  return typeof projectTargetPath === "string" && projectTargetPath.startsWith("docs/policy/shared-rules/") && isValidAssetProjectTargetPath("rule", projectTargetPath);
+}
 function validateAssetRegistry(registry, options = {}) {
   const issues = [];
   const seenIds = /* @__PURE__ */ new Set();
+  const projectTargetOwners = /* @__PURE__ */ new Map();
   for (const asset of registry.assets) {
     if (seenIds.has(asset.id)) {
       issues.push({
@@ -311,6 +335,21 @@ function validateAssetRegistry(registry, options = {}) {
         message: `Unsupported asset source kind: ${asset.sourceKind}`
       });
     }
+    if (asset.delivery !== void 0 && !supportedDeliveries.has(asset.delivery)) {
+      issues.push({
+        type: "unsupported-enum",
+        id: asset.id,
+        message: `Unsupported asset delivery: ${asset.delivery}`
+      });
+    }
+    if (asset.delivery === "snapshot" && (asset.kind !== "rule" || !isValidSnapshotProjectTargetPath(asset.projectTargetPath))) {
+      issues.push({
+        type: "invalid-snapshot-delivery",
+        id: asset.id,
+        path: asset.projectTargetPath,
+        message: `Snapshot delivery is only allowed for rule assets targeting docs/policy/shared-rules/<name>.md: ${asset.id}`
+      });
+    }
     for (const host of asset.hosts) {
       if (!supportedHosts.has(host)) {
         issues.push({
@@ -349,6 +388,26 @@ function validateAssetRegistry(registry, options = {}) {
         message: `Asset source path escapes agent-assets: ${asset.sourcePath}`
       });
     }
+    if (asset.projectTargetPath !== void 0 && !isValidAssetProjectTargetPath(asset.kind, asset.projectTargetPath)) {
+      issues.push({
+        type: "invalid-project-target-path",
+        id: asset.id,
+        path: asset.projectTargetPath,
+        message: `Asset project target path is not allowed for ${asset.kind}: ${asset.projectTargetPath}`
+      });
+    } else if (asset.projectTargetPath !== void 0) {
+      const existingOwner = projectTargetOwners.get(asset.projectTargetPath);
+      if (existingOwner !== void 0 && existingOwner !== asset.id) {
+        issues.push({
+          type: "duplicate-project-target-path",
+          id: asset.id,
+          path: asset.projectTargetPath,
+          message: `Project target path is already owned by ${existingOwner}: ${asset.projectTargetPath}`
+        });
+      } else {
+        projectTargetOwners.set(asset.projectTargetPath, asset.id);
+      }
+    }
     if (asset.visibility !== "public" && asset.publishable) {
       issues.push({
         type: "non-public-publishable",
@@ -434,6 +493,23 @@ function pathExistsEvenIfDanglingSymlink(path) {
 }
 
 // src/asset-registry/loader.ts
+function createAgentAssetRegistryProvenance(registry, selectedAssetIds) {
+  const selectedIds = new Set(selectedAssetIds);
+  const selectedAssets = registry.assets.filter((asset) => selectedIds.has(asset.id));
+  const canonicalRegistry = canonicalizeValue({
+    schemaVersion: registry.schemaVersion,
+    assets: [...selectedAssets].sort(
+      (left, right) => left.id < right.id ? -1 : left.id > right.id ? 1 : 0
+    )
+  });
+  const hash = createHash2("sha256").update(JSON.stringify(canonicalRegistry)).digest("hex");
+  return {
+    schema: "agent-assets-registry",
+    version: registry.schemaVersion,
+    hash: `sha256:${hash}`,
+    assetCount: selectedAssets.length
+  };
+}
 function loadAgentAssetRegistry(options = {}) {
   const agentAssetsDir = options.agentAssetsDir ?? findDefaultAgentAssetsDir();
   const registryPath = join5(agentAssetsDir, "registry.json");
@@ -458,6 +534,7 @@ function createAgentAssetLockEntries(registry, agentAssetsDir, assetIds) {
   return registry.assets.filter((asset) => !wantedIds || wantedIds.has(asset.id)).map((asset) => ({
     id: asset.id,
     sourcePath: asset.sourcePath,
+    delivery: asset.delivery ?? "symlink",
     contentHash: hashAgentAssetContent(asset, agentAssetsDir)
   })).sort((a, b) => a.id.localeCompare(b.id));
 }
@@ -475,6 +552,15 @@ function hashAssetPathContent(sourceAbsolutePath) {
   }
   return `sha256:${hash.digest("hex")}`;
 }
+function canonicalizeValue(value) {
+  if (Array.isArray(value)) return value.map((item) => canonicalizeValue(item));
+  if (value !== null && typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value).filter(([, item]) => item !== void 0).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([key, item]) => [key, canonicalizeValue(item)])
+    );
+  }
+  return value;
+}
 function findDefaultAgentAssetsDir() {
   const packageRoot2 = findPackageRoot(dirname2(fileURLToPath2(import.meta.url)));
   const repoRoot = join5(packageRoot2, "..", "..");
@@ -620,6 +706,7 @@ function resolveSafePath(root, sourcePath) {
 }
 
 // src/asset-targets/apply.ts
+import { createHash as createHash3 } from "node:crypto";
 import {
   existsSync as existsSync8,
   lstatSync as lstatSync3,
@@ -633,7 +720,7 @@ import {
 import { dirname as dirname4, join as join8, relative as relative4, resolve as resolve2 } from "node:path";
 
 // src/asset-targets/install-plan.ts
-import { existsSync as existsSync7, lstatSync as lstatSync2, readFileSync as readFileSync4, readlinkSync, realpathSync } from "node:fs";
+import { existsSync as existsSync7, lstatSync as lstatSync2, readFileSync as readFileSync4, readlinkSync, realpathSync, statSync as statSync3 } from "node:fs";
 import { basename, dirname as dirname3, join as join7, resolve } from "node:path";
 function createAssetInstallPlan(options) {
   const placement = options.placement ?? "registry";
@@ -653,9 +740,9 @@ function createAssetInstallPlan(options) {
     options.agentAssetsDir,
     assetIds
   );
+  const registryProvenance = createAgentAssetRegistryProvenance(options.registry, assetIds);
   const managedLock = readManagedLock(options.targetDir);
   const managedEntries = managedLock.entries;
-  const managedTargets = new Set(managedEntries.map((entry) => entry.targetPath));
   const legacyAdoptions = createLegacyClaudeAdoptions({
     targetDir: options.targetDir,
     agentAssetsDir: options.agentAssetsDir,
@@ -671,7 +758,7 @@ function createAssetInstallPlan(options) {
       options.targetDir,
       options.host,
       placement,
-      managedTargets
+      managedEntries
     )
   );
   const manifest = {
@@ -686,6 +773,7 @@ function createAssetInstallPlan(options) {
     host: options.host,
     placement,
     bundleIds: [...options.bundleIds],
+    registryProvenance,
     assets: lockEntries.map((entry) => {
       const action = assetActions.find(
         (candidate) => "assetId" in candidate && candidate.assetId === entry.id
@@ -747,7 +835,7 @@ function resolveAssetIds(bundleIds, explicitAssetIds, bundlesById) {
   }
   return [...ids].sort();
 }
-function createAssetAction(asset, agentAssetsDir, targetDir, host, placement, managedTargets) {
+function createAssetAction(asset, agentAssetsDir, targetDir, host, placement, managedEntries) {
   if (asset.kind === "skill" && asset.defaultScope === "user") {
     throw new Error(
       `User-scoped asset ${asset.id} must be linked at the user level, not installed into a project target.`
@@ -757,9 +845,23 @@ function createAssetAction(asset, agentAssetsDir, targetDir, host, placement, ma
   const targetPath = resolveHostTargetPath(asset, host, placement);
   const targetAbsolutePath = join7(targetDir, targetPath);
   const targetExists = pathExistsEvenIfDanglingSymlink2(targetAbsolutePath);
+  const managedEntry = managedEntries.find(
+    (entry) => entry.id === asset.id && entry.targetPath === targetPath
+  );
+  if ((asset.delivery ?? "symlink") === "snapshot") {
+    return createSnapshotAction({
+      asset,
+      agentAssetsDir,
+      sourcePath,
+      targetPath,
+      targetAbsolutePath,
+      targetExists,
+      managedEntry
+    });
+  }
   if (targetExists) {
     const stats = lstatSync2(targetAbsolutePath);
-    if (stats.isSymbolicLink() && managedTargets.has(targetPath)) {
+    if (stats.isSymbolicLink() && managedEntry && (managedEntry.delivery ?? "symlink") === "symlink") {
       return {
         type: "update-symlink",
         assetId: asset.id,
@@ -767,6 +869,9 @@ function createAssetAction(asset, agentAssetsDir, targetDir, host, placement, ma
         targetPath
       };
     }
+    if (managedEntry && managedEntry.delivery === "snapshot") {
+      throw new Error(`Refusing to replace managed snapshot with a symlink: ${targetPath}`);
+    }
     if (stats.isSymbolicLink() && existsSync7(targetAbsolutePath) && realpathSync(targetAbsolutePath) === realpathSync(sourcePath)) {
       return {
         type: "adopt-existing-symlink",
@@ -784,7 +889,78 @@ function createAssetAction(asset, agentAssetsDir, targetDir, host, placement, ma
     targetPath
   };
 }
+function createSnapshotAction(options) {
+  if (options.asset.kind !== "rule" || !isValidSnapshotProjectTargetPath(options.asset.projectTargetPath)) {
+    throw new Error(
+      `Snapshot delivery requires a rule target under docs/policy/shared-rules/: ${options.asset.id}`
+    );
+  }
+  if (!statSync3(options.sourcePath).isFile()) {
+    throw new Error(`Snapshot source must be a regular file: ${options.asset.sourcePath}`);
+  }
+  const content = readFileSync4(options.sourcePath);
+  const contentBase64 = content.toString("base64");
+  const contentHash = hashAgentAssetContent(options.asset, options.agentAssetsDir);
+  const managedDelivery = options.managedEntry?.delivery ?? "symlink";
+  if (!options.targetExists) {
+    return {
+      type: "snapshot",
+      assetId: options.asset.id,
+      targetPath: options.targetPath,
+      contentBase64,
+      contentHash
+    };
+  }
+  const stats = lstatSync2(options.targetAbsolutePath);
+  if (stats.isSymbolicLink()) {
+    if (existsSync7(options.targetAbsolutePath) && realpathSync(options.targetAbsolutePath) === realpathSync(options.sourcePath) && hashAssetPathContent(options.targetAbsolutePath) === contentHash) {
+      return {
+        type: "migrate-symlink-to-snapshot",
+        assetId: options.asset.id,
+        sourcePath: options.sourcePath,
+        targetPath: options.targetPath,
+        contentBase64,
+        contentHash
+      };
+    }
+    throw new Error(`Refusing to overwrite unmanaged target: ${options.targetPath}`);
+  }
+  if (!stats.isFile()) {
+    throw new Error(`Refusing to overwrite unmanaged target: ${options.targetPath}`);
+  }
+  const currentTargetHash = hashAssetPathContent(options.targetAbsolutePath);
+  if (currentTargetHash === contentHash) {
+    return {
+      type: "adopt-snapshot",
+      assetId: options.asset.id,
+      targetPath: options.targetPath,
+      contentHash
+    };
+  }
+  if (managedDelivery === "snapshot" && options.managedEntry?.contentHash) {
+    if (currentTargetHash !== options.managedEntry.contentHash) {
+      throw new Error(`Refusing to overwrite locally drifted snapshot: ${options.targetPath}`);
+    }
+    return {
+      type: "update-snapshot",
+      assetId: options.asset.id,
+      targetPath: options.targetPath,
+      contentBase64,
+      contentHash,
+      expectedContentHash: options.managedEntry.contentHash
+    };
+  }
+  throw new Error(`Refusing to overwrite unmanaged target: ${options.targetPath}`);
+}
 function resolveHostTargetPath(asset, _host, placement) {
+  if (asset.projectTargetPath !== void 0) {
+    if (!isValidAssetProjectTargetPath(asset.kind, asset.projectTargetPath)) {
+      throw new Error(
+        `Invalid project target path for asset ${asset.id}: ${asset.projectTargetPath}`
+      );
+    }
+    return asset.projectTargetPath;
+  }
   if (asset.kind === "skill") {
     const effectivePlacement = resolveSkillPlacement(asset, placement);
     if (effectivePlacement === "manual") {
@@ -818,7 +994,7 @@ function readManagedLock(targetDir) {
     return {
       host: typeof lockfile.host === "string" ? lockfile.host : void 0,
       entries: (lockfile.assets ?? []).filter(
-        (entry) => typeof entry.id === "string" && typeof entry.sourcePath === "string" && typeof entry.targetPath === "string"
+        (entry) => typeof entry.id === "string" && typeof entry.sourcePath === "string" && typeof entry.targetPath === "string" && (entry.delivery === void 0 || entry.delivery === "symlink" || entry.delivery === "snapshot") && (entry.contentHash === void 0 || typeof entry.contentHash === "string")
       )
     };
   } catch {
@@ -900,6 +1076,29 @@ function createRemovalActions(targetDir, agentAssetsDir, managedEntries, expecte
     const targetAbsolutePath = join7(targetDir, entry.targetPath);
     if (!pathExistsEvenIfDanglingSymlink2(targetAbsolutePath)) continue;
     const stats = lstatSync2(targetAbsolutePath);
+    if ((entry.delivery ?? "symlink") === "snapshot") {
+      if (!isValidSnapshotProjectTargetPath(entry.targetPath)) {
+        throw new Error(
+          `Refusing to remove snapshot outside live shared rules: ${entry.targetPath}`
+        );
+      }
+      if (!stats.isFile() || !entry.contentHash) {
+        throw new Error(
+          `Refusing to remove managed snapshot without its locked file hash: ${entry.targetPath}`
+        );
+      }
+      const currentTargetHash = hashAssetPathContent(targetAbsolutePath);
+      if (currentTargetHash !== entry.contentHash) {
+        throw new Error(`Refusing to remove locally drifted managed snapshot: ${entry.targetPath}`);
+      }
+      actions.push({
+        type: "remove-snapshot",
+        assetId: entry.id,
+        targetPath: entry.targetPath,
+        expectedContentHash: entry.contentHash
+      });
+      continue;
+    }
     if (!stats.isSymbolicLink()) {
       throw new Error(
         `Refusing to remove path that is no longer a managed symlink: ${entry.targetPath}`
@@ -922,12 +1121,12 @@ function createRemovalActions(targetDir, agentAssetsDir, managedEntries, expecte
   return actions.sort((a, b) => a.targetPath.localeCompare(b.targetPath));
 }
 function isManagedAssetTargetPath(path) {
-  return /^(?:\.agents\/(?:skills|manual-skills)|\.pro-gov\/agent-assets\/(?:rules|commands))\/[^/.][^/]*$/.test(
+  return /^(?:(?:\.agents\/(?:skills|manual-skills)|\.pro-gov\/agent-assets\/(?:rules|commands))\/[^./\\][^/\\]*|docs\/policy\/shared-rules\/[^./\\][^/\\]*\.md)$/.test(
     path
   );
 }
 function isLegacyClaudeSkillTargetPath(path) {
-  return /^\.claude\/skills\/[^/.][^/]*$/.test(path);
+  return /^\.claude\/skills\/[^./\\][^/\\]*$/.test(path);
 }
 function pathExistsEvenIfDanglingSymlink2(path) {
   try {
@@ -944,6 +1143,9 @@ function applyAssetInstallPlan(plan) {
   for (const action of plan.actions) {
     if (action.type === "adopt-symlink") validateAdoptedSymlink(plan.targetDir, action);
     if (action.type === "adopt-existing-symlink") validateExistingSymlink(plan.targetDir, action);
+    if (action.type === "snapshot" || action.type === "update-snapshot" || action.type === "adopt-snapshot" || action.type === "migrate-symlink-to-snapshot" || action.type === "remove-snapshot") {
+      validateSnapshotAction(plan.targetDir, action);
+    }
   }
   for (const action of plan.actions) {
     applyAction(plan.targetDir, action);
@@ -958,6 +1160,10 @@ function applyAction(targetDir, action) {
     return;
   }
   if (action.type === "adopt-symlink" || action.type === "adopt-existing-symlink") return;
+  if (action.type === "snapshot" || action.type === "update-snapshot" || action.type === "adopt-snapshot" || action.type === "migrate-symlink-to-snapshot" || action.type === "remove-snapshot") {
+    applySnapshotAction(targetDir, action);
+    return;
+  }
   if (action.type === "create-dir") {
     mkdirSync2(targetAbsolutePath, { recursive: true });
     return;
@@ -997,6 +1203,67 @@ function validateExistingSymlink(targetDir, action) {
     throw new Error(`Existing skill symlink changed before apply: ${action.targetPath}`);
   }
 }
+function validateSnapshotAction(targetDir, action) {
+  if (!isValidSnapshotProjectTargetPath(action.targetPath)) {
+    throw new Error(`Refusing unsafe snapshot target: ${action.targetPath}`);
+  }
+  if ("contentBase64" in action && hashSnapshotBytes(Buffer.from(action.contentBase64, "base64")) !== action.contentHash) {
+    throw new Error(`Snapshot content hash is invalid: ${action.targetPath}`);
+  }
+  const targetAbsolutePath = join8(targetDir, action.targetPath);
+  if (action.type === "snapshot") {
+    if (pathExistsEvenIfDanglingSymlink3(targetAbsolutePath)) {
+      throw new Error(`Snapshot target changed before apply: ${action.targetPath}`);
+    }
+    return;
+  }
+  if (action.type === "update-snapshot") {
+    assertRegularSnapshotHash(targetAbsolutePath, action.expectedContentHash, action.targetPath);
+    return;
+  }
+  if (action.type === "adopt-snapshot") {
+    assertRegularSnapshotHash(targetAbsolutePath, action.contentHash, action.targetPath);
+    return;
+  }
+  if (action.type === "migrate-symlink-to-snapshot") {
+    if (!pathExistsEvenIfDanglingSymlink3(targetAbsolutePath) || !lstatSync3(targetAbsolutePath).isSymbolicLink() || !existsSync8(targetAbsolutePath) || realpathSync2(targetAbsolutePath) !== realpathSync2(action.sourcePath) || hashAssetPathContent(targetAbsolutePath) !== action.contentHash) {
+      throw new Error(`Snapshot symlink changed before apply: ${action.targetPath}`);
+    }
+    return;
+  }
+  assertRegularSnapshotHash(targetAbsolutePath, action.expectedContentHash, action.targetPath);
+}
+function applySnapshotAction(targetDir, action) {
+  const targetAbsolutePath = join8(targetDir, action.targetPath);
+  if (action.type === "adopt-snapshot") return;
+  if (action.type === "remove-snapshot") {
+    unlinkSync(targetAbsolutePath);
+    return;
+  }
+  if (action.type === "migrate-symlink-to-snapshot") unlinkSync(targetAbsolutePath);
+  mkdirSync2(dirname4(targetAbsolutePath), { recursive: true });
+  if (action.type === "snapshot" && pathExistsEvenIfDanglingSymlink3(targetAbsolutePath)) {
+    throw new Error(`Refusing to overwrite unmanaged target: ${action.targetPath}`);
+  }
+  writeFileSync(targetAbsolutePath, Buffer.from(action.contentBase64, "base64"));
+}
+function assertRegularSnapshotHash(targetAbsolutePath, expectedHash, targetPath) {
+  if (!pathExistsEvenIfDanglingSymlink3(targetAbsolutePath)) {
+    throw new Error(`Snapshot target changed before apply: ${targetPath}`);
+  }
+  const stats = lstatSync3(targetAbsolutePath);
+  if (!stats.isFile() || hashAssetPathContent(targetAbsolutePath) !== expectedHash) {
+    throw new Error(`Snapshot target hash changed before apply: ${targetPath}`);
+  }
+}
+function hashSnapshotBytes(content) {
+  const hash = createHash3("sha256");
+  hash.update("");
+  hash.update("\0");
+  hash.update(content);
+  hash.update("\0");
+  return `sha256:${hash.digest("hex")}`;
+}
 function validateAdoptedSymlink(targetDir, action) {
   if (!isManagedAssetTargetPath(action.targetPath) || !isLegacyClaudeSkillTargetPath(action.legacyTargetPath) || action.compatibilityRootPath !== ".claude/skills" || action.expectedCompatibilityRawTarget !== "../.agents/skills") {
     throw new Error(`Refusing unsafe legacy Claude adoption: ${action.legacyTargetPath}`);
@@ -1064,10 +1331,54 @@ function checkInstalledAssets(options) {
   const lockfile = JSON.parse(readFileSync5(lockfilePath, "utf8"));
   const issues = [];
   const strictRegistry = options.strictRegistry ?? false;
+  const selectedAssetIds = (lockfile.assets ?? []).map((entry) => entry.id);
+  const hasRegistryProvenance2 = Object.prototype.hasOwnProperty.call(
+    lockfile,
+    "registryProvenance"
+  );
+  const registryProvenanceMismatch = strictRegistry && hasRegistryProvenance2 && !matchesRegistryProvenance(
+    lockfile.registryProvenance,
+    createAgentAssetRegistryProvenance(options.registry, selectedAssetIds)
+  );
+  if (registryProvenanceMismatch) {
+    issues.push({
+      type: "registry-provenance-mismatch",
+      message: "Asset lock registry provenance does not match the registry available to this checker; registry-dependent checks were skipped."
+    });
+  }
   for (const entry of lockfile.assets ?? []) {
+    if (!isManagedAssetTargetPath(entry.targetPath) && !isLegacyClaudeSkillTargetPath(entry.targetPath)) {
+      issues.push({
+        type: "unsafe-target-path",
+        id: entry.id,
+        targetPath: entry.targetPath,
+        message: `Managed asset target is outside supported roots: ${entry.targetPath}`
+      });
+      continue;
+    }
     const asset = registryById.get(entry.id);
     const targetAbsolutePath = join9(options.targetDir, entry.targetPath);
-    if (!asset && strictRegistry) {
+    const delivery = entry.delivery ?? "symlink";
+    const portableDeferredSkill = delivery === "symlink" && !strictRegistry && isProjectSkillTarget(entry.targetPath);
+    if (delivery !== "symlink" && delivery !== "snapshot") {
+      issues.push({
+        type: "unsupported-delivery",
+        id: entry.id,
+        targetPath: entry.targetPath,
+        message: `Managed asset delivery is unsupported: ${delivery}`
+      });
+      continue;
+    }
+    if (delivery === "snapshot" && !isValidSnapshotProjectTargetPath(entry.targetPath)) {
+      issues.push({
+        type: "unsafe-target-path",
+        id: entry.id,
+        targetPath: entry.targetPath,
+        message: `Managed snapshot target is outside live shared rules: ${entry.targetPath}`
+      });
+      continue;
+    }
+    if (!asset && strictRegistry && !registryProvenanceMismatch) {
       issues.push({
         type: "unknown-asset",
         id: entry.id,
@@ -1075,7 +1386,7 @@ function checkInstalledAssets(options) {
         message: `Lockfile references unknown asset: ${entry.id}`
       });
     }
-    if (asset?.kind === "skill" && asset.defaultScope === "user") {
+    if (!registryProvenanceMismatch && asset?.kind === "skill" && asset.defaultScope === "user") {
       issues.push({
         type: "user-scoped-asset-in-project-lock",
         id: entry.id,
@@ -1083,7 +1394,7 @@ function checkInstalledAssets(options) {
         message: `User-scoped skill is still locked into this project; move it to the user skill roots: ${entry.id}`
       });
     }
-    if (asset) {
+    if (asset && !registryProvenanceMismatch) {
       const hostFolderIssue = checkHostFolder(
         lockfile.host,
         asset.kind,
@@ -1099,6 +1410,7 @@ function checkInstalledAssets(options) {
       }
     }
     if (!pathExistsEvenIfDanglingSymlink4(targetAbsolutePath)) {
+      if (portableDeferredSkill) continue;
       issues.push({
         type: "missing-target",
         id: entry.id,
@@ -1108,7 +1420,16 @@ function checkInstalledAssets(options) {
       continue;
     }
     const targetStats = lstatSync4(targetAbsolutePath);
-    if (!targetStats.isSymbolicLink()) {
+    if (delivery === "snapshot" && !targetStats.isFile()) {
+      issues.push({
+        type: "snapshot-not-regular-file",
+        id: entry.id,
+        targetPath: entry.targetPath,
+        message: `Managed snapshot is not a regular file: ${entry.targetPath}`
+      });
+      continue;
+    }
+    if (delivery === "symlink" && !targetStats.isSymbolicLink()) {
       issues.push({
         type: "unmanaged-conflict",
         id: entry.id,
@@ -1117,7 +1438,8 @@ function checkInstalledAssets(options) {
       });
       continue;
     }
-    if (!existsSync9(targetAbsolutePath)) {
+    if (delivery === "symlink" && !existsSync9(targetAbsolutePath)) {
+      if (portableDeferredSkill) continue;
       issues.push({
         type: "dangling-symlink",
         id: entry.id,
@@ -1136,7 +1458,7 @@ function checkInstalledAssets(options) {
         message: `Managed asset hash drifted: ${entry.id}`
       });
     }
-    if (!asset || !strictRegistry) continue;
+    if (!asset || !strictRegistry || registryProvenanceMismatch) continue;
     const sourceAbsolutePath = join9(options.agentAssetsDir, asset.sourcePath);
     if (!existsSync9(sourceAbsolutePath)) {
       issues.push({
@@ -1148,7 +1470,7 @@ function checkInstalledAssets(options) {
       continue;
     }
     const currentSourceHash = hashAgentAssetContent(asset, options.agentAssetsDir);
-    if (targetHashMatchesLock && currentSourceHash !== entry.contentHash) {
+    if ((delivery === "snapshot" || targetHashMatchesLock) && currentSourceHash !== entry.contentHash) {
       issues.push({
         type: "hash-drift",
         id: entry.id,
@@ -1157,9 +1479,16 @@ function checkInstalledAssets(options) {
       });
     }
   }
-  issues.push(...checkDuplicateSkillPlacements(options.targetDir, options.registry));
+  if (!registryProvenanceMismatch) {
+    issues.push(...checkDuplicateSkillPlacements(options.targetDir, options.registry));
+  }
   return { targetDir: options.targetDir, issues };
 }
+function matchesRegistryProvenance(value, expected) {
+  if (value === null || typeof value !== "object") return false;
+  const provenance = value;
+  return provenance.schema === expected.schema && provenance.version === expected.version && provenance.hash === expected.hash && provenance.assetCount === expected.assetCount;
+}
 function checkRegistryPlacement(lockfile, asset, targetPath) {
   if (lockfile.placement !== "registry") return void 0;
   if (asset.kind !== "skill") return void 0;
@@ -1235,6 +1564,9 @@ function pathExistsEvenIfDanglingSymlink4(path) {
     return false;
   }
 }
+function isProjectSkillTarget(targetPath) {
+  return targetPath.startsWith(".agents/skills/") || targetPath.startsWith(".agents/manual-skills/");
+}
 
 // src/asset-targets/recommend.ts
 import { existsSync as existsSync10, readdirSync as readdirSync6, readFileSync as readFileSync6 } from "node:fs";
@@ -1301,13 +1633,6 @@ function recommendBundlesForTarget(targetDir) {
       reasons: signals.frontendSignals.map((signal) => `frontend dependency: ${signal}`)
     });
   }
-  if (signals.researchSignals.length > 0) {
-    recommendations.push({
-      bundleId: "research-docs",
-      confidence: "high",
-      reasons: signals.researchSignals
-    });
-  }
   if (signals.writingSignals.length > 0) {
     recommendations.push({
       bundleId: "novel-writing",
@@ -1877,11 +2202,12 @@ var REQUIRED_ASSETS = [
   "profiles/doc-only/profile.md",
   "docs/reference/adoption/migration-v1.1.md"
 ];
-function runDoctor(_args) {
-  const assets = listAssets();
+function runPackageDoctor(_args, dependencies = {}) {
+  const assets = dependencies.assets ?? listAssets("packaged");
   const assetPaths = new Set(assets.map((asset) => asset.path));
   const missing = REQUIRED_ASSETS.filter((assetPath) => !assetPaths.has(assetPath));
-  console.log("pro-gov doctor");
+  const docGov = dependencies.docGov ?? checkDocGov();
+  console.log("pro-gov package-doctor");
   console.log(`assets: ${assets.length}`);
   if (missing.length > 0) {
     for (const assetPath of missing) {
@@ -1890,8 +2216,11 @@ function runDoctor(_args) {
   } else {
     console.log("assets: required project-governance assets found");
   }
-  console.log(checkDocGov());
-  return missing.length > 0 ? 1 : 0;
+  console.log(docGov.message);
+  return missing.length > 0 || !docGov.ok ? 1 : 0;
+}
+function runDoctor(args) {
+  return runPackageDoctor(args);
 }
 function checkDocGov() {
   const fromPath = spawnSync2("doc-gov", ["--help"], {
@@ -1899,20 +2228,26 @@ function checkDocGov() {
     stdio: "ignore"
   });
   if (!fromPath.error && fromPath.status === 0) {
-    return "doc-gov: available on PATH";
+    return { ok: true, message: "doc-gov: available on PATH" };
   }
   const dependencyCli = resolveDocGovDependencyCli();
   if (!dependencyCli) {
-    return "doc-gov: not found; install @pieai/doc-gov beside @pieai/pro-gov for validation.";
+    return {
+      ok: false,
+      message: "doc-gov: not found; install @pieai/doc-gov beside @pieai/pro-gov for validation."
+    };
   }
   const fromDependency = spawnSync2(process.execPath, [dependencyCli, "--help"], {
     encoding: "utf8",
     stdio: "ignore"
   });
   if (!fromDependency.error && fromDependency.status === 0) {
-    return "doc-gov: available via package dependency";
+    return { ok: true, message: "doc-gov: available via package dependency" };
   }
-  return `doc-gov: dependency found but returned status ${fromDependency.status ?? "unknown"}`;
+  return {
+    ok: false,
+    message: `doc-gov: dependency found but returned status ${fromDependency.status ?? "unknown"}`
+  };
 }
 function resolveDocGovDependencyCli() {
   try {
@@ -2077,7 +2412,7 @@ import {
   lstatSync as lstatSync6,
   mkdirSync as mkdirSync5,
   readdirSync as readdirSync7,
-  statSync as statSync3,
+  statSync as statSync4,
   writeFileSync as writeFileSync4
 } from "node:fs";
 import { homedir } from "node:os";
@@ -2504,7 +2839,7 @@ function fallbackMeasure(root) {
       if (entry.isDirectory()) pending.push(path);
       else if (entry.isFile()) {
         try {
-          bytes += statSync3(path).size;
+          bytes += statSync4(path).size;
         } catch {
         }
       }
@@ -4417,10 +4752,10 @@ function formatLink(link) {
 }
 
 // src/lens/scan.ts
-import { spawnSync as spawnSync3 } from "node:child_process";
-import { existsSync as existsSync20, readdirSync as readdirSync10, readFileSync as readFileSync13, statSync as statSync5 } from "node:fs";
+import { spawnSync as spawnSync4 } from "node:child_process";
+import { existsSync as existsSync21, readFileSync as readFileSync13, statSync as statSync6 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { join as join21, relative as relative8 } from "node:path";
+import { join as join22 } from "node:path";
 
 // src/host-ssot.ts
 import { lstatSync as lstatSync7, readlinkSync as readlinkSync3, realpathSync as realpathSync3 } from "node:fs";
@@ -4542,7 +4877,7 @@ function safeLstat2(path) {
 }
 
 // src/portfolio/redundancy.ts
-import { existsSync as existsSync18, readdirSync as readdirSync9, statSync as statSync4 } from "node:fs";
+import { existsSync as existsSync18, readdirSync as readdirSync9, statSync as statSync5 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
 import { join as join19 } from "node:path";
 var DEFAULT_CACHE_THRESHOLD_BYTES = 1e9;
@@ -4657,7 +4992,7 @@ function collectDirectoryStats(root) {
       } else if (entry.isFile()) {
         fileCount += 1;
         try {
-          bytes += statSync4(path).size;
+          bytes += statSync5(path).size;
         } catch {
         }
       }
@@ -4698,6 +5033,111 @@ function readPackageJson(path) {
   }
 }
 
+// src/repository-files.ts
+import { spawnSync as spawnSync3 } from "node:child_process";
+import { existsSync as existsSync20, readdirSync as readdirSync10 } from "node:fs";
+import { isAbsolute as isAbsolute5, join as join21, posix as posix3, relative as relative8 } from "node:path";
+var gitMaxBufferBytes = 64 * 1024 * 1024;
+var RepositoryFileDiscoveryError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "RepositoryFileDiscoveryError";
+  }
+};
+function discoverRepositoryFiles(root, options = {}) {
+  const probe = runGit(root, ["rev-parse", "--is-inside-work-tree"]);
+  if (!probe.ok) {
+    if (!probe.notRepository || existsSync20(join21(root, ".git"))) {
+      throw new RepositoryFileDiscoveryError(probe.message);
+    }
+    return {
+      source: "filesystem",
+      files: discoverFilesystemFiles(root, options)
+    };
+  }
+  if (probe.stdout.trim() !== "true") {
+    throw new RepositoryFileDiscoveryError(
+      "Git repository discovery failed: target is a Git repository without a worktree."
+    );
+  }
+  const gitFiles = runGit(root, [
+    "ls-files",
+    "--cached",
+    "--others",
+    "--exclude-standard",
+    "-z",
+    ...options.gitPathspecs?.length ? ["--", ...options.gitPathspecs] : []
+  ]);
+  if (!gitFiles.ok) throw new RepositoryFileDiscoveryError(gitFiles.message);
+  const files = /* @__PURE__ */ new Set();
+  for (const path of gitFiles.stdout.split("\0")) {
+    if (!path) continue;
+    const normalized = normalizeRepositoryRelativePath(path);
+    if (!isSafeRepositoryRelativePath(normalized)) {
+      throw new RepositoryFileDiscoveryError(
+        `Git returned a path outside the repository boundary: ${path}`
+      );
+    }
+    if (existsSync20(join21(root, normalized))) files.add(normalized);
+  }
+  return { source: "git", files: [...files].sort() };
+}
+function normalizeRepositoryRelativePath(path) {
+  return posix3.normalize(path.replaceAll("\\", "/").replace(/^\.\/+/, ""));
+}
+function discoverFilesystemFiles(root, options) {
+  const files = /* @__PURE__ */ new Set();
+  const maxDepth = options.fallbackMaxDepth ?? Number.POSITIVE_INFINITY;
+  const ignoredDirectories2 = options.fallbackIgnoredDirectories ?? /* @__PURE__ */ new Set();
+  const visit = (directory, depth) => {
+    if (depth > maxDepth || !existsSync20(directory)) return;
+    let entries;
+    try {
+      entries = readdirSync10(directory, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const absolutePath = join21(directory, entry.name);
+      if (entry.isDirectory()) {
+        if (!ignoredDirectories2.has(entry.name)) visit(absolutePath, depth + 1);
+        continue;
+      }
+      if (!entry.isFile()) continue;
+      const relativePath = normalizeRepositoryRelativePath(relative8(root, absolutePath));
+      if (isSafeRepositoryRelativePath(relativePath) && (options.fallbackIncludeFile?.(relativePath) ?? true)) {
+        files.add(relativePath);
+      }
+    }
+  };
+  visit(root, 0);
+  return [...files].sort();
+}
+function isSafeRepositoryRelativePath(path) {
+  return path !== "" && path !== "." && !isAbsolute5(path) && !/^[a-zA-Z]:\//.test(path) && path !== ".." && !path.startsWith("../");
+}
+function runGit(root, args) {
+  const result = spawnSync3("git", ["-C", root, ...args], {
+    encoding: "utf8",
+    maxBuffer: gitMaxBufferBytes,
+    env: { ...process.env, LANG: "C", LC_ALL: "C" }
+  });
+  if (result.error) {
+    return {
+      ok: false,
+      notRepository: false,
+      message: `Git repository discovery failed: ${result.error.message}`
+    };
+  }
+  if (result.status === 0) return { ok: true, stdout: result.stdout };
+  const stderr = result.stderr.trim();
+  return {
+    ok: false,
+    notRepository: /not a git repository/i.test(stderr),
+    message: `Git repository discovery failed (${result.status ?? "unknown status"}): ${stderr || "no diagnostic output"}`
+  };
+}
+
 // src/lens/scan.ts
 var ignoredDirectories = /* @__PURE__ */ new Set([".git", ".next", ".turbo", "dist", "node_modules", "coverage"]);
 function scanProjectLensTarget(targetDir, options = {}) {
@@ -4714,7 +5154,7 @@ function scanProjectLensTarget(targetDir, options = {}) {
       includedFileCount: files.length,
       excludedFileCount: candidateFiles.length - files.length
     },
-    aiEntryFiles: ["AGENTS.md", "CLAUDE.md"].filter((file) => existsSync20(join21(targetDir, file))),
+    aiEntryFiles: ["AGENTS.md", "CLAUDE.md"].filter((file) => existsSync21(join22(targetDir, file))),
     aiConfigFiles: [],
     hostSsot: inspectProjectHostSsot(targetDir),
     userHostSsot: inspectUserSkillsSsot(options.homeDir ?? process.env.HOME ?? homedir3()),
@@ -4725,17 +5165,17 @@ function scanProjectLensTarget(targetDir, options = {}) {
     }),
     packageJson,
     docs: {
-      hasDocsDirectory: existsSync20(join21(targetDir, "docs")),
+      hasDocsDirectory: existsSync21(join22(targetDir, "docs")),
       markdownFileCount: markdownFiles.length,
       governanceFiles: markdownFiles.filter((file) => file.startsWith("docs/governance/") || file.startsWith("docs/policy/")).sort()
     },
     git: readGitState(targetDir),
-    largeFiles: files.map((file) => ({ path: file, bytes: statSync5(join21(targetDir, file)).size })).filter((file) => file.bytes >= largeFileBytes).sort((a, b) => b.bytes - a.bytes || a.path.localeCompare(b.path)).slice(0, 25)
+    largeFiles: files.map((file) => ({ path: file, bytes: statSync6(join22(targetDir, file)).size })).filter((file) => file.bytes >= largeFileBytes).sort((a, b) => b.bytes - a.bytes || a.path.localeCompare(b.path)).slice(0, 25)
   };
 }
 function readPackageJson2(targetDir) {
-  const packageJsonPath = join21(targetDir, "package.json");
-  if (!existsSync20(packageJsonPath)) return void 0;
+  const packageJsonPath = join22(targetDir, "package.json");
+  if (!existsSync21(packageJsonPath)) return void 0;
   try {
     const packageJson = JSON.parse(readFileSync13(packageJsonPath, "utf8"));
     return {
@@ -4748,10 +5188,10 @@ function readPackageJson2(targetDir) {
   }
 }
 function readGitState(targetDir) {
-  const branch = runGit(targetDir, ["rev-parse", "--abbrev-ref", "HEAD"]);
+  const branch = runGit2(targetDir, ["rev-parse", "--abbrev-ref", "HEAD"]);
   if (!branch.ok) return { available: false };
-  const head = runGit(targetDir, ["log", "-1", "--format=%H %s"]);
-  const status = runGit(targetDir, ["status", "-sb"]);
+  const head = runGit2(targetDir, ["log", "-1", "--format=%H %s"]);
+  const status = runGit2(targetDir, ["status", "-sb"]);
   return {
     available: true,
     branch: branch.stdout,
@@ -4759,27 +5199,18 @@ function readGitState(targetDir) {
     statusShort: status.ok ? status.stdout : void 0
   };
 }
-function runGit(targetDir, args) {
-  const result = spawnSync3("git", ["-C", targetDir, ...args], {
-    encoding: "utf8"
+function runGit2(targetDir, args) {
+  const result = spawnSync4("git", ["-C", targetDir, ...args], {
+    encoding: "utf8",
+    maxBuffer: 64 * 1024 * 1024
   });
   if (result.status !== 0) return { ok: false };
   return { ok: true, stdout: result.stdout.trim() };
 }
 function listProjectFiles(targetDir) {
-  const gitFiles = runGit(targetDir, [
-    "ls-files",
-    "--cached",
-    "--others",
-    "--exclude-standard",
-    "-z"
-  ]);
-  if (gitFiles.ok) {
-    return gitFiles.stdout.split("\0").filter(Boolean).map(toUnixPath4).filter((file) => existsSync20(join21(targetDir, file))).sort();
-  }
-  const files = [];
-  collectFiles2(targetDir, targetDir, files);
-  return files.sort();
+  return discoverRepositoryFiles(targetDir, {
+    fallbackIgnoredDirectories: ignoredDirectories
+  }).files;
 }
 var excludedEvidencePrefixes = [
   ".agents/manual-skills/",
@@ -4792,20 +5223,6 @@ var excludedEvidencePrefixes = [
 function isFirstPartyEvidenceFile(file) {
   return !excludedEvidencePrefixes.some((prefix) => file.startsWith(prefix));
 }
-function collectFiles2(rootDir, currentDir, files) {
-  if (!existsSync20(currentDir)) return;
-  for (const entry of readdirSync10(currentDir, { withFileTypes: true })) {
-    if (entry.isDirectory()) {
-      if (ignoredDirectories.has(entry.name)) continue;
-      collectFiles2(rootDir, join21(currentDir, entry.name), files);
-    } else if (entry.isFile()) {
-      files.push(toUnixPath4(relative8(rootDir, join21(currentDir, entry.name))));
-    }
-  }
-}
-function toUnixPath4(path) {
-  return path.replaceAll("\\", "/");
-}
 
 // src/commands/lens.ts
 function runLens(args) {
@@ -4957,19 +5374,19 @@ function printUsage4() {
 }
 
 // src/commands/portfolio.ts
-import { existsSync as existsSync32, readFileSync as readFileSync18 } from "node:fs";
-import { join as join33 } from "node:path";
+import { existsSync as existsSync33, readFileSync as readFileSync18 } from "node:fs";
+import { join as join34 } from "node:path";
 
 // src/portfolio/doctor.ts
-import { spawnSync as spawnSync6 } from "node:child_process";
-import { existsSync as existsSync23, readFileSync as readFileSync16 } from "node:fs";
+import { spawnSync as spawnSync7 } from "node:child_process";
+import { existsSync as existsSync24, readFileSync as readFileSync16 } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
 import { homedir as homedir4 } from "node:os";
-import { dirname as dirname15, join as join24 } from "node:path";
+import { dirname as dirname15, join as join25 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 
 // src/host-tooling/inventory.ts
-import { spawnSync as spawnSync4 } from "node:child_process";
+import { spawnSync as spawnSync5 } from "node:child_process";
 function inspectHostTooling(requirements, runner = defaultRunner2) {
   const hosts = [];
   const issues = [];
@@ -5043,7 +5460,7 @@ function parseHostPlugins(host, value) {
   });
 }
 function defaultRunner2({ command: command2 }) {
-  const result = spawnSync4(command2[0] ?? "", command2.slice(1), {
+  const result = spawnSync5(command2[0] ?? "", command2.slice(1), {
     encoding: "utf8",
     timeout: 1e4
   });
@@ -5058,8 +5475,8 @@ function isRecord2(value) {
 }
 
 // src/portfolio/asset-state.ts
-import { existsSync as existsSync21, lstatSync as lstatSync8, readFileSync as readFileSync14 } from "node:fs";
-import { join as join22 } from "node:path";
+import { existsSync as existsSync22, lstatSync as lstatSync8, readFileSync as readFileSync14 } from "node:fs";
+import { join as join23 } from "node:path";
 function comparePortfolioAssetState(options) {
   const expectedManifest = readPlanDocument(
     options.expectedPlan,
@@ -5070,10 +5487,10 @@ function comparePortfolioAssetState(options) {
     ".pro-gov/assets.lock.json"
   );
   const currentManifest = readJsonFile(
-    join22(options.targetDir, ".pro-gov/assets.json")
+    join23(options.targetDir, ".pro-gov/assets.json")
   );
   const currentLock = readJsonFile(
-    join22(options.targetDir, ".pro-gov/assets.lock.json")
+    join23(options.targetDir, ".pro-gov/assets.lock.json")
   );
   const issues = [];
   if (!sameStrings(currentManifest?.bundleIds, expectedManifest?.bundleIds)) {
@@ -5101,7 +5518,7 @@ function comparePortfolioAssetState(options) {
       (action) => action.type === "adopt-symlink" && action.assetId === entry.id && action.legacyTargetPath === entry.targetPath
     ))
       continue;
-    const targetAbsolutePath = join22(options.targetDir, entry.targetPath);
+    const targetAbsolutePath = join23(options.targetDir, entry.targetPath);
     if (!pathIsSymlink(targetAbsolutePath)) continue;
     issues.push({
       type: "orphaned-managed-symlink",
@@ -5123,7 +5540,7 @@ function readPlanDocument(plan, targetPath) {
   }
 }
 function readJsonFile(path) {
-  if (!existsSync21(path)) return void 0;
+  if (!existsSync22(path)) return void 0;
   try {
     return JSON.parse(readFileSync14(path, "utf8"));
   } catch {
@@ -5134,7 +5551,12 @@ function sameStrings(left, right) {
   return JSON.stringify([...left ?? []].sort()) === JSON.stringify([...right ?? []].sort());
 }
 function sameLock(left, right) {
-  return JSON.stringify(normalizeLock(left)) === JSON.stringify(normalizeLock(right));
+  if (JSON.stringify(normalizeLock(left)) !== JSON.stringify(normalizeLock(right))) return false;
+  if (!hasRegistryProvenance(left) || !hasRegistryProvenance(right)) return true;
+  return JSON.stringify(left.registryProvenance) === JSON.stringify(right.registryProvenance);
+}
+function hasRegistryProvenance(lock) {
+  return lock !== void 0 && Object.prototype.hasOwnProperty.call(lock, "registryProvenance");
 }
 function normalizeLock(lock) {
   return {
@@ -5153,9 +5575,9 @@ function pathIsSymlink(path) {
 }
 
 // src/portfolio/version-policy.ts
-import { spawnSync as spawnSync5 } from "node:child_process";
-import { existsSync as existsSync22, readFileSync as readFileSync15, readdirSync as readdirSync11 } from "node:fs";
-import { dirname as dirname14, join as join23 } from "node:path";
+import { spawnSync as spawnSync6 } from "node:child_process";
+import { existsSync as existsSync23, lstatSync as lstatSync9, readFileSync as readFileSync15 } from "node:fs";
+import { dirname as dirname14, join as join24 } from "node:path";
 function inspectVersionPolicy(root, policy, projectType) {
   if (!policy) return { status: "compliant", packages: [], runtimes: [], attentionCount: 0 };
   const packageManifests = collectPackageManifests(root);
@@ -5245,7 +5667,7 @@ function inspectRuntime(expectedName, expectedVersion) {
 function readRuntimeVersion(name) {
   if (name === "node") return process.versions.node;
   if (name !== "deno") return void 0;
-  const result = spawnSync5("deno", ["--version"], { encoding: "utf8" });
+  const result = spawnSync6("deno", ["--version"], { encoding: "utf8" });
   if (result.status !== 0) return void 0;
   return /^deno\s+(\d+\.\d+\.\d+)/m.exec(result.stdout)?.[1];
 }
@@ -5264,7 +5686,7 @@ function findDeclaredVersion(packageJson, name) {
 function readInstalledVersion(root, name, fromDirectory = root) {
   let current = fromDirectory;
   while (true) {
-    const packageJson = readJson2(join23(current, "node_modules", name, "package.json"));
+    const packageJson = readJson2(join24(current, "node_modules", name, "package.json"));
     if (typeof packageJson?.version === "string") return packageJson.version;
     if (current === root) return void 0;
     const parent = dirname14(current);
@@ -5273,7 +5695,6 @@ function readInstalledVersion(root, name, fromDirectory = root) {
   }
 }
 function collectPackageManifests(root) {
-  const manifests = [];
   const ignored = /* @__PURE__ */ new Set([
     ".git",
     ".next",
@@ -5297,37 +5718,36 @@ function collectPackageManifests(root) {
     ".pnpm-store",
     ".tmp-repos"
   ]);
-  const visit = (directory, depth) => {
-    if (depth > 6) return;
-    let entries;
+  const manifests = /* @__PURE__ */ new Map();
+  const addManifest = (relativePath) => {
+    const directorySegments = relativePath.split("/").slice(0, -1);
+    if (relativePath.split("/").at(-1) !== "package.json" || directorySegments.length > 6 || directorySegments.some((segment) => ignored.has(segment))) {
+      return;
+    }
+    const path = join24(root, relativePath);
     try {
-      entries = readdirSync11(directory, { withFileTypes: true });
+      if (!lstatSync9(path).isFile()) return;
     } catch {
       return;
     }
-    for (const entry of entries) {
-      const path = join23(directory, entry.name);
-      if (entry.isFile() && entry.name === "package.json") {
-        const packageJson = readJson2(path);
-        if (packageJson)
-          manifests.push({
-            path: path.slice(root.length + 1) || "package.json",
-            directory,
-            packageJson
-          });
-      } else if (entry.isDirectory() && !ignored.has(entry.name)) {
-        visit(path, depth + 1);
-      }
-    }
+    const packageJson = readJson2(path);
+    if (!packageJson) return;
+    manifests.set(relativePath, { path: relativePath, directory: dirname14(path), packageJson });
   };
-  visit(root, 0);
-  return manifests.sort((a, b) => a.path.localeCompare(b.path));
+  const discovery = discoverRepositoryFiles(root, {
+    gitPathspecs: ["package.json", ":(glob)**/package.json"],
+    fallbackIgnoredDirectories: ignored,
+    fallbackMaxDepth: 6,
+    fallbackIncludeFile: (path) => path.split("/").at(-1) === "package.json"
+  });
+  for (const relativePath of discovery.files) addManifest(relativePath);
+  return [...manifests.values()].sort((a, b) => a.path.localeCompare(b.path));
 }
 function unique(values) {
   return [...new Set(values)];
 }
 function readJson2(path) {
-  if (!existsSync22(path)) return void 0;
+  if (!existsSync23(path)) return void 0;
   try {
     return JSON.parse(readFileSync15(path, "utf8"));
   } catch {
@@ -5362,12 +5782,12 @@ function inspectTarget(options) {
   const { target } = options;
   const hostSsot = inspectProjectHostSsot(target.path);
   const issues = [];
-  const packageJson = readJson3(join24(target.path, "package.json"));
+  const packageJson = readJson3(join25(target.path, "package.json"));
   const packages = {};
   for (const packageName of ["@pieai/pro-gov", "@pieai/doc-gov"]) {
     const declared = packageJson?.devDependencies?.[packageName] ?? packageJson?.dependencies?.[packageName];
     const installedPackage = readJson3(
-      join24(target.path, "node_modules", packageName, "package.json")
+      join25(target.path, "node_modules", packageName, "package.json")
     );
     const installed = installedPackage?.version;
     const expected = options.expectedPackageVersions[packageName];
@@ -5427,7 +5847,7 @@ function inspectTarget(options) {
       type: "asset-lock-drift",
       message: error instanceof Error ? error.message : String(error)
     });
-    if (!existsSync23(join24(target.path, ".pro-gov/assets.json"))) {
+    if (!existsSync24(join25(target.path, ".pro-gov/assets.json"))) {
       issues.push({ type: "bundle-drift", message: "Target asset manifest is missing." });
     }
   }
@@ -5445,15 +5865,15 @@ function inspectTarget(options) {
   };
 }
 function readTargetAssetHost(targetDir) {
-  const lockfile = readJson3(join24(targetDir, ".pro-gov/assets.lock.json"));
+  const lockfile = readJson3(join25(targetDir, ".pro-gov/assets.lock.json"));
   return isAssetRegistryHost(lockfile?.host) ? lockfile.host : void 0;
 }
 function isAssetRegistryHost(value) {
   return value === "codex" || value === "claude-code" || value === "gemini-cli" || value === "antigravity";
 }
 function runTargetChecks(target) {
-  const proGovCli = join24(target.path, "node_modules/@pieai/pro-gov/dist/cli.js");
-  const docGovCli = join24(target.path, "node_modules/@pieai/doc-gov/dist/cli.js");
+  const proGovCli = join25(target.path, "node_modules/@pieai/pro-gov/dist/cli.js");
+  const docGovCli = join25(target.path, "node_modules/@pieai/doc-gov/dist/cli.js");
   const commands = [
     {
       name: "pro-gov doctor",
@@ -5464,8 +5884,8 @@ function runTargetChecks(target) {
     { name: "doc-gov scan --check", cli: docGovCli, args: ["scan", "--check"] }
   ];
   return commands.map((command2) => {
-    if (!existsSync23(command2.cli)) return { name: command2.name, status: null };
-    const result = spawnSync6(process.execPath, [command2.cli, ...command2.args], {
+    if (!existsSync24(command2.cli)) return { name: command2.name, status: null };
+    const result = spawnSync7(process.execPath, [command2.cli, ...command2.args], {
       cwd: target.path,
       encoding: "utf8",
       timeout: 3e4
@@ -5474,13 +5894,13 @@ function runTargetChecks(target) {
   });
 }
 function inspectGit(path) {
-  const inside = spawnSync6("git", ["rev-parse", "--is-inside-work-tree"], {
+  const inside = spawnSync7("git", ["rev-parse", "--is-inside-work-tree"], {
     cwd: path,
     encoding: "utf8"
   });
   if (inside.status !== 0) return { isRepository: false, dirty: false };
-  const status = spawnSync6("git", ["status", "--porcelain"], { cwd: path, encoding: "utf8" });
-  const branch = spawnSync6("git", ["branch", "--show-current"], { cwd: path, encoding: "utf8" });
+  const status = spawnSync7("git", ["status", "--porcelain"], { cwd: path, encoding: "utf8" });
+  const branch = spawnSync7("git", ["branch", "--show-current"], { cwd: path, encoding: "utf8" });
   return {
     isRepository: true,
     dirty: status.stdout.trim().length > 0,
@@ -5505,14 +5925,14 @@ function getExpectedPackageVersions() {
 function findOwnPackageJson() {
   let current = dirname15(fileURLToPath4(import.meta.url));
   for (let depth = 0; depth < 5; depth += 1) {
-    const candidate = join24(current, "package.json");
-    if (existsSync23(candidate)) return candidate;
+    const candidate = join25(current, "package.json");
+    if (existsSync24(candidate)) return candidate;
     current = dirname15(current);
   }
   return "";
 }
 function readJson3(path) {
-  if (!path || !existsSync23(path)) return void 0;
+  if (!path || !existsSync24(path)) return void 0;
   try {
     return JSON.parse(readFileSync16(path, "utf8"));
   } catch {
@@ -5531,15 +5951,15 @@ function deduplicateIssues(issues) {
 
 // src/portfolio/ai-health/index.ts
 import { homedir as homedir5 } from "node:os";
-import { dirname as dirname17, join as join32, resolve as resolve9 } from "node:path";
+import { dirname as dirname17, join as join33, resolve as resolve9 } from "node:path";
 
 // src/portfolio/ai-health/entries.ts
-import { existsSync as existsSync25, lstatSync as lstatSync10, realpathSync as realpathSync5 } from "node:fs";
-import { join as join25 } from "node:path";
+import { existsSync as existsSync26, lstatSync as lstatSync11, realpathSync as realpathSync5 } from "node:fs";
+import { join as join26 } from "node:path";
 
 // src/portfolio/ai-health/shared.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { existsSync as existsSync24, lstatSync as lstatSync9, readFileSync as readFileSync17, readdirSync as readdirSync12, realpathSync as realpathSync4, statSync as statSync6 } from "node:fs";
+import { existsSync as existsSync25, lstatSync as lstatSync10, readFileSync as readFileSync17, readdirSync as readdirSync11, realpathSync as realpathSync4, statSync as statSync7 } from "node:fs";
 function safeRealpath(path) {
   try {
     return realpathSync4(path);
@@ -5569,7 +5989,7 @@ function jsonObjectKeys(path, key) {
   return Object.keys(value[key]).sort();
 }
 function tomlMcpNames(path) {
-  if (!existsSync24(path)) return [];
+  if (!existsSync25(path)) return [];
   const names = /* @__PURE__ */ new Set();
   for (const line of safeRead(path).split(/\r?\n/)) {
     const match = line.match(/^\s*\[mcp_servers\.(?:"([^"]+)"|([^.\]]+))\]\s*$/);
@@ -5594,21 +6014,21 @@ function safeRead(path) {
 }
 function safeReadDir(path) {
   try {
-    return readdirSync12(path).sort();
+    return readdirSync11(path).sort();
   } catch {
     return [];
   }
 }
 function safeIsDirectory(path) {
   try {
-    return statSync6(path).isDirectory();
+    return statSync7(path).isDirectory();
   } catch {
     return false;
   }
 }
 function pathLexists(path) {
   try {
-    lstatSync9(path);
+    lstatSync10(path);
     return true;
   } catch {
     return false;
@@ -5646,12 +6066,12 @@ function hasWorkflowReminderHooks(hooks) {
   );
 }
 function inspectEntries(root) {
-  const agentsPath = join25(root, "AGENTS.md");
-  const agents = !existsSync25(agentsPath) ? "missing" : safeRead(agentsPath).includes("PGS-ROUTER:BEGIN") ? "pgs-router" : "custom";
-  const claudePath = join25(root, "CLAUDE.md");
+  const agentsPath = join26(root, "AGENTS.md");
+  const agents = !existsSync26(agentsPath) ? "missing" : safeRead(agentsPath).includes("PGS-ROUTER:BEGIN") ? "pgs-router" : "custom";
+  const claudePath = join26(root, "CLAUDE.md");
   let claude = "missing";
   if (pathLexists(claudePath)) {
-    const info = lstatSync10(claudePath);
+    const info = lstatSync11(claudePath);
     if (info.isSymbolicLink()) {
       try {
         claude = realpathSync5(claudePath) === realpathSync5(agentsPath) ? "agents-symlink" : "custom";
@@ -5665,10 +6085,45 @@ function inspectEntries(root) {
   }
   return { agents, claude, gemini: inspectOptionalEntry(root, "GEMINI.md", agentsPath) };
 }
+var AGENT_LINK_ROOTS = [".agents/workflows", ".agents/commands", ".claude/commands"];
+function inspectAgentLinks(root) {
+  const entries = AGENT_LINK_ROOTS.flatMap((directory) => {
+    const directoryPath = join26(root, directory);
+    if (!pathLexists(directoryPath)) return [];
+    try {
+      if (!lstatSync11(directoryPath).isDirectory()) return [];
+    } catch {
+      return [];
+    }
+    return safeReadDir(directoryPath).filter((name) => !name.startsWith(".")).flatMap((name) => {
+      const relativePath = `${directory}/${name}`;
+      const path = join26(root, relativePath);
+      let stat;
+      try {
+        stat = lstatSync11(path);
+      } catch {
+        return [];
+      }
+      let kind = stat.isSymbolicLink() ? "symlink" : stat.isDirectory() ? "directory" : "file";
+      if (stat.isSymbolicLink()) {
+        try {
+          realpathSync5(path);
+        } catch {
+          kind = "dangling-symlink";
+        }
+      }
+      return [{ path: relativePath, kind, tracked: gitTracks(root, relativePath) }];
+    });
+  });
+  return {
+    entries,
+    trackedDangling: entries.filter((entry) => entry.tracked && entry.kind === "dangling-symlink").map((entry) => entry.path)
+  };
+}
 function inspectOptionalEntry(root, filename, agentsPath) {
-  const path = join25(root, filename);
+  const path = join26(root, filename);
   if (!pathLexists(path)) return "missing";
-  const info = lstatSync10(path);
+  const info = lstatSync11(path);
   if (info.isSymbolicLink()) {
     try {
       return realpathSync5(path) === realpathSync5(agentsPath) ? "agents-symlink" : "custom";
@@ -5706,7 +6161,7 @@ function inspectHooks(root) {
     { host: "codex", path: ".codex/hooks.json" }
   ];
   return configs.map((config) => {
-    const value = readJson4(join25(root, config.path));
+    const value = readJson4(join26(root, config.path));
     const counts = /* @__PURE__ */ new Map();
     collectHookEvents(value, counts);
     return {
@@ -5727,18 +6182,18 @@ function collectHookEvents(value, counts) {
   }
 }
 function inspectDocs(root, expected) {
-  const packageJson = readJson4(join25(root, "package.json"));
+  const packageJson = readJson4(join26(root, "package.json"));
   const dependencies = isRecord3(packageJson) ? { ...recordOrEmpty(packageJson.dependencies), ...recordOrEmpty(packageJson.devDependencies) } : {};
   const docGov = dependencyVersion(dependencies["@pieai/doc-gov"]);
   const proGov = dependencyVersion(dependencies["@pieai/pro-gov"]);
-  const routerMatch = safeRead(join25(root, "AGENTS.md")).match(/PGS-ROUTER:BEGIN\s+v([0-9.]+)/);
+  const routerMatch = safeRead(join26(root, "AGENTS.md")).match(/PGS-ROUTER:BEGIN\s+v([0-9.]+)/);
   const declared = [docGov, proGov].filter((value) => Boolean(value));
   return {
     routerVersion: routerMatch?.[1],
     expectedRouterVersion: CURRENT_ROUTER_VERSION,
     routerAligned: routerMatch?.[1] === CURRENT_ROUTER_VERSION,
-    manifest: existsSync25(join25(root, "docs/governance/MANIFEST.yml")),
-    currentWork: existsSync25(join25(root, "docs/reference/execution/current-work.md")),
+    manifest: existsSync26(join26(root, "docs/governance/MANIFEST.yml")),
+    currentWork: existsSync26(join26(root, "docs/reference/execution/current-work.md")),
     packages: {
       expected,
       docGov,
@@ -5801,18 +6256,18 @@ function inspectGit2(root) {
 
 // src/portfolio/ai-health/hosts.ts
 import { execFileSync as execFileSync5 } from "node:child_process";
-import { existsSync as existsSync27 } from "node:fs";
-import { join as join27, resolve as resolve8, sep as sep2 } from "node:path";
+import { existsSync as existsSync28 } from "node:fs";
+import { join as join28, resolve as resolve8, sep as sep2 } from "node:path";
 
 // src/portfolio/ai-health/devspace.ts
 import { execFileSync as execFileSync4 } from "node:child_process";
-import { existsSync as existsSync26, statSync as statSync7 } from "node:fs";
-import { join as join26, relative as relative9, resolve as resolve7, sep } from "node:path";
+import { existsSync as existsSync27, statSync as statSync8 } from "node:fs";
+import { join as join27, relative as relative9, resolve as resolve7, sep } from "node:path";
 function inspectDevSpaceHealth(options) {
   const run = options.run ?? runDevSpaceCommand;
-  const configDirectory = join26(options.homeDir, ".devspace");
-  const configPath = join26(configDirectory, "config.json");
-  const authPath = join26(configDirectory, "auth.json");
+  const configDirectory = join27(options.homeDir, ".devspace");
+  const configPath = join27(configDirectory, "config.json");
+  const authPath = join27(configDirectory, "auth.json");
   const installedResult = run("devspace", ["--version"], 3e3);
   const installedVersion = installedResult.ok ? installedResult.stdout.match(/\b\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?\b/)?.[0] : void 0;
   const latestResult = run(
@@ -5835,9 +6290,9 @@ function inspectDevSpaceHealth(options) {
     (repositoryPath) => allowedRoots.some((root) => isPathInside(repositoryPath, root))
   ) ? "complete" : "partial";
   const bind = configExists && typeof configValue.host === "string" ? isLoopbackHost(configValue.host) ? "loopback" : "non-loopback" : "unknown";
-  const directoryMode = existsSync26(configDirectory) ? modeString(statSync7(configDirectory).mode) : void 0;
-  const fileMode = existsSync26(configPath) ? modeString(statSync7(configPath).mode) : void 0;
-  const authMode = existsSync26(authPath) ? modeString(statSync7(authPath).mode) : void 0;
+  const directoryMode = existsSync27(configDirectory) ? modeString(statSync8(configDirectory).mode) : void 0;
+  const fileMode = existsSync27(configPath) ? modeString(statSync8(configPath).mode) : void 0;
+  const authMode = existsSync27(authPath) ? modeString(statSync8(authPath).mode) : void 0;
   const update = installedVersion && latestVersion ? installedVersion === latestVersion ? "current" : "available" : "unknown";
   const recommendations = [];
   let status = "healthy";
@@ -5851,7 +6306,7 @@ function inspectDevSpaceHealth(options) {
   };
   if (!installedResult.ok) unhealthy("\u672C\u673A\u672A\u53D1\u73B0 DevSpace\uFF1B\u65E0\u6CD5\u4F7F\u7528\u5BBF\u4E3B\u5DE5\u4F5C\u533A\u670D\u52A1\u3002");
   if (!configExists) unhealthy("\u7F3A\u5C11 ~/.devspace/config.json\u3002");
-  if (!existsSync26(authPath)) unhealthy("\u7F3A\u5C11 ~/.devspace/auth.json\u3002");
+  if (!existsSync27(authPath)) unhealthy("\u7F3A\u5C11 ~/.devspace/auth.json\u3002");
   if (directoryMode && directoryMode !== "700")
     unhealthy(`~/.devspace \u76EE\u5F55\u6743\u9650\u4E3A ${directoryMode}\uFF0C\u5E94\u6536\u7D27\u4E3A 700\u3002`);
   if (fileMode && fileMode !== "600") unhealthy(`DevSpace \u914D\u7F6E\u6587\u4EF6\u6743\u9650\u4E3A ${fileMode}\uFF0C\u5E94\u4E3A 600\u3002`);
@@ -5884,7 +6339,7 @@ function inspectDevSpaceHealth(options) {
       exists: configExists,
       ...directoryMode ? { directoryMode } : {},
       ...fileMode ? { fileMode } : {},
-      authExists: existsSync26(authPath),
+      authExists: existsSync27(authPath),
       ...authMode ? { authMode } : {},
       bind,
       portValid: configExists && typeof configValue.port === "number" && Number.isInteger(configValue.port) && configValue.port > 0 && configValue.port <= 65535,
@@ -5931,9 +6386,9 @@ var MCP_DISCOVERY_PATHS = {
   }
 };
 function inspectHostEnvironment(homeDir, grokVersion, repositoryPaths, devspaceSettings) {
-  const codexConfig = join27(homeDir, MCP_DISCOVERY_PATHS.user.codex);
-  const claudeConfig = join27(homeDir, MCP_DISCOVERY_PATHS.user.claudeCode);
-  const grokConfig = join27(homeDir, MCP_DISCOVERY_PATHS.user.grok);
+  const codexConfig = join28(homeDir, MCP_DISCOVERY_PATHS.user.codex);
+  const claudeConfig = join28(homeDir, MCP_DISCOVERY_PATHS.user.claudeCode);
+  const grokConfig = join28(homeDir, MCP_DISCOVERY_PATHS.user.grok);
   const hostEnvironment = {
     mcp: {
       codexUser: { path: codexConfig, names: tomlMcpNames(codexConfig) },
@@ -5941,11 +6396,11 @@ function inspectHostEnvironment(homeDir, grokVersion, repositoryPaths, devspaceS
       grokUser: { path: grokConfig, names: tomlMcpNames(grokConfig) }
     },
     skills: {
-      codexUser: inspectSkillRoot(join27(homeDir, ".agents/skills")),
-      claudeCodeUser: inspectSkillRoot(join27(homeDir, ".claude/skills")),
-      grokUser: inspectSkillRoot(join27(homeDir, ".grok/skills")),
-      grokAgentsCompatibility: inspectSkillRoot(join27(homeDir, ".agents/skills")),
-      grokClaudeCompatibility: inspectSkillRoot(join27(homeDir, ".claude/skills")),
+      codexUser: inspectSkillRoot(join28(homeDir, ".agents/skills")),
+      claudeCodeUser: inspectSkillRoot(join28(homeDir, ".claude/skills")),
+      grokUser: inspectSkillRoot(join28(homeDir, ".grok/skills")),
+      grokAgentsCompatibility: inspectSkillRoot(join28(homeDir, ".agents/skills")),
+      grokClaudeCompatibility: inspectSkillRoot(join28(homeDir, ".claude/skills")),
       ssot: inspectUserSkillsSsot(homeDir)
     },
     grok: {
@@ -5966,13 +6421,13 @@ function inspectHostEnvironment(homeDir, grokVersion, repositoryPaths, devspaceS
 function inspectSkillRoot(path) {
   const exists = pathLexists(path) && safeIsDirectory(path);
   const names = exists ? safeReadDir(path).filter(
-    (name) => !name.startsWith(".") && existsSync27(join27(path, name, "SKILL.md"))
+    (name) => !name.startsWith(".") && existsSync28(join28(path, name, "SKILL.md"))
   ) : [];
   return { path, exists, names };
 }
 function claudeProjectLocalMcpNames(homeDir, root) {
   if (!homeDir) return [];
-  const value = readJson4(join27(homeDir, MCP_DISCOVERY_PATHS.user.claudeCode));
+  const value = readJson4(join28(homeDir, MCP_DISCOVERY_PATHS.user.claudeCode));
   if (!isRecord3(value) || !isRecord3(value.projects)) return [];
   const candidates = new Set(
     [resolve8(root), safeRealpath(root)].filter((path) => Boolean(path))
@@ -6002,7 +6457,7 @@ function inspectGrokProject(root, homeDir, grokVersion) {
       execFileSync5("grok", ["inspect", "--json"], {
         cwd: root,
         encoding: "utf8",
-        env: { ...process.env, HOME: homeDir, GROK_HOME: join27(homeDir, ".grok") },
+        env: { ...process.env, HOME: homeDir, GROK_HOME: join28(homeDir, ".grok") },
         maxBuffer: 10 * 1024 * 1024,
         stdio: ["ignore", "pipe", "ignore"],
         timeout: 8e3
@@ -6010,7 +6465,7 @@ function inspectGrokProject(root, homeDir, grokVersion) {
     );
     if (!isRecord3(value)) return empty("failed");
     const userClaudeNames = new Set(
-      jsonObjectKeys(join27(homeDir, MCP_DISCOVERY_PATHS.user.claudeCode), "mcpServers")
+      jsonObjectKeys(join28(homeDir, MCP_DISCOVERY_PATHS.user.claudeCode), "mcpServers")
     );
     const localClaudeNames = new Set(claudeProjectLocalMcpNames(homeDir, root));
     const effectiveMcp = Array.isArray(value.mcpServers) ? value.mcpServers.flatMap((item) => {
@@ -6080,10 +6535,10 @@ function inferGrokMcpScope(name, sourceType, sourcePath, root, homeDir, userClau
   }
   const resolvedSource = safeRealpath(sourcePath) ?? resolve8(sourcePath);
   const resolvedRoot = safeRealpath(root) ?? resolve8(root);
-  if (resolvedSource === join27(resolvedRoot, MCP_DISCOVERY_PATHS.project.claudeCodeShared))
+  if (resolvedSource === join28(resolvedRoot, MCP_DISCOVERY_PATHS.project.claudeCodeShared))
     return "project-shared";
   if (resolvedSource.startsWith(resolvedRoot + sep2)) return "project";
-  if (homeDir && resolvedSource === join27(resolve8(homeDir), MCP_DISCOVERY_PATHS.user.claudeCode)) {
+  if (homeDir && resolvedSource === join28(resolve8(homeDir), MCP_DISCOVERY_PATHS.user.claudeCode)) {
     if (localClaudeNames.has(name)) return "project-local";
     if (userClaudeNames.has(name)) return "user";
   }
@@ -6093,10 +6548,10 @@ function inferGrokMcpScope(name, sourceType, sourcePath, root, homeDir, userClau
 }
 
 // src/portfolio/ai-health/secrets.ts
-import { existsSync as existsSync28, lstatSync as lstatSync11, readdirSync as readdirSync13, statSync as statSync8 } from "node:fs";
-import { join as join28, relative as relative10, sep as sep3 } from "node:path";
+import { existsSync as existsSync29, lstatSync as lstatSync12, readdirSync as readdirSync12, statSync as statSync9 } from "node:fs";
+import { join as join29, relative as relative10, sep as sep3 } from "node:path";
 function inspectRepositorySecrets(root, id, secretsRoot, isRepository, environmentPolicy) {
-  const centralPath = join28(secretsRoot, id);
+  const centralPath = join29(secretsRoot, id);
   const centralRealPath = safeRealpath(centralPath);
   const localOnlyReasons = new Map(
     (environmentPolicy?.localOnly ?? []).map((entry) => [entry.path, entry.reason])
@@ -6108,16 +6563,16 @@ function inspectRepositorySecrets(root, id, secretsRoot, isRepository, environme
       tracked: isRepository ? gitTracks(root, path) : false,
       template: isEnvironmentTemplate(path),
       fixture: isEnvironmentFixture(path),
-      symlink: lstatSync11(join28(root, path)).isSymbolicLink(),
-      centralized: pointsInside(join28(root, path), centralRealPath),
+      symlink: lstatSync12(join29(root, path)).isSymbolicLink(),
+      centralized: pointsInside(join29(root, path), centralRealPath),
       localOnly: localOnlyReason !== void 0,
       ...localOnlyReason !== void 0 ? { localOnlyReason } : {}
     };
   });
   return {
-    centralDirectory: existsSync28(centralPath) ? "present" : "absent",
-    centralMode: existsSync28(centralPath) ? modeString(statSync8(centralPath).mode) : void 0,
-    centralFiles: existsSync28(centralPath) ? collectCentralSecretFiles(centralPath) : [],
+    centralDirectory: existsSync29(centralPath) ? "present" : "absent",
+    centralMode: existsSync29(centralPath) ? modeString(statSync9(centralPath).mode) : void 0,
+    centralFiles: existsSync29(centralPath) ? collectCentralSecretFiles(centralPath) : [],
     repositoryEnvFiles: envFiles
   };
 }
@@ -6140,12 +6595,12 @@ function collectEnvironmentFiles(root, current = root, depth = 0) {
   if (depth > 5) return [];
   const found = [];
   try {
-    for (const entry of readdirSync13(current, { withFileTypes: true })) {
+    for (const entry of readdirSync12(current, { withFileTypes: true })) {
       if (entry.isDirectory()) {
         if (!SKIP_ENV_DIRECTORIES.has(entry.name))
-          found.push(...collectEnvironmentFiles(root, join28(current, entry.name), depth + 1));
+          found.push(...collectEnvironmentFiles(root, join29(current, entry.name), depth + 1));
       } else if (isEnvironmentFilename(entry.name) && !isProviderGeneratedEnvironmentFile(entry.name)) {
-        found.push(relative10(root, join28(current, entry.name)));
+        found.push(relative10(root, join29(current, entry.name)));
       }
     }
   } catch {
@@ -6157,10 +6612,10 @@ function collectCentralSecretFiles(root, current = root, depth = 0) {
   if (depth > 3) return [];
   const found = [];
   try {
-    for (const entry of readdirSync13(current, { withFileTypes: true })) {
-      const path = join28(current, entry.name);
+    for (const entry of readdirSync12(current, { withFileTypes: true })) {
+      const path = join29(current, entry.name);
       if (entry.isDirectory()) found.push(...collectCentralSecretFiles(root, path, depth + 1));
-      else found.push({ path: relative10(root, path), mode: modeString(lstatSync11(path).mode) });
+      else found.push({ path: relative10(root, path), mode: modeString(lstatSync12(path).mode) });
     }
   } catch {
     return found;
@@ -6184,7 +6639,7 @@ function isEnvironmentFixture(path) {
   return /(^|[\\/])(?:tests?|__tests__)[\\/]fixtures?[\\/]/i.test(path) || /(^|[\\/])__fixtures__[\\/]/i.test(path);
 }
 function pointsInside(path, expectedRoot) {
-  if (!expectedRoot || !lstatSync11(path).isSymbolicLink()) return false;
+  if (!expectedRoot || !lstatSync12(path).isSymbolicLink()) return false;
   const target = safeRealpath(path);
   if (!target) return false;
   const fromRoot = relative10(expectedRoot, target);
@@ -6194,20 +6649,20 @@ function hasUnsafeCentralSecretPermissions(secrets) {
   return secrets.centralDirectory === "present" && (secrets.centralMode !== "700" || secrets.centralFiles.some((file) => file.mode !== "600"));
 }
 function inspectSecretsRoot(path) {
-  return existsSync28(path) ? { path, exists: true, mode: modeString(statSync8(path).mode) } : { path, exists: false };
+  return existsSync29(path) ? { path, exists: true, mode: modeString(statSync9(path).mode) } : { path, exists: false };
 }
 
 // src/portfolio/ai-health/skills.ts
-import { existsSync as existsSync29, lstatSync as lstatSync12, realpathSync as realpathSync6 } from "node:fs";
-import { join as join29 } from "node:path";
+import { existsSync as existsSync30, lstatSync as lstatSync13, realpathSync as realpathSync6 } from "node:fs";
+import { join as join30 } from "node:path";
 function countAutomaticSkillsNeedingReview(skills) {
   return skills.automatic.filter(
     (item) => !item.managed || !item.registryId || item.expectedPlacement !== "auto" || item.expectedScope === "user"
   ).length;
 }
 function inspectSkills(root, grokInspection, registeredSkills, userSkills) {
-  const lock = readJson4(join29(root, ".pro-gov/assets.lock.json"));
-  const assetManifest = readJson4(join29(root, ".pro-gov/assets.json"));
+  const lock = readJson4(join30(root, ".pro-gov/assets.lock.json"));
+  const assetManifest = readJson4(join30(root, ".pro-gov/assets.json"));
   const managed = /* @__PURE__ */ new Set();
   const bundleIds = stringArray(isRecord3(lock) ? lock.bundleIds : void 0);
   if (isRecord3(lock) && Array.isArray(lock.assets)) {
@@ -6219,7 +6674,7 @@ function inspectSkills(root, grokInspection, registeredSkills, userSkills) {
   }
   const inspectPlacement = (placement) => {
     const directory = placement === "auto" ? "skills" : "manual-skills";
-    const skillRoot = join29(root, ".agents", directory);
+    const skillRoot = join30(root, ".agents", directory);
     if (!pathLexists(skillRoot) || !safeIsDirectory(skillRoot)) return [];
     return safeReadDir(skillRoot).filter((name) => !name.startsWith(".")).map((name) => inspectSkillItem(skillRoot, directory, name, managed, registeredSkills));
   };
@@ -6274,15 +6729,15 @@ function inspectSkills(root, grokInspection, registeredSkills, userSkills) {
     },
     hosts: {
       codexProject: automatic.filter((item) => item.kind !== "dangling-symlink").length,
-      claudeCodeProject: inspectSkillRoot(join29(root, ".claude/skills")).names.length,
-      grokNativeProject: inspectSkillRoot(join29(root, ".grok/skills")).names.length,
+      claudeCodeProject: inspectSkillRoot(join30(root, ".claude/skills")).names.length,
+      grokNativeProject: inspectSkillRoot(join30(root, ".grok/skills")).names.length,
       grokEffective: grokInspection.skills
     }
   };
 }
 function inspectSkillItem(skillRoot, directory, name, managed, registeredSkills) {
-  const path = join29(skillRoot, name);
-  const stat = lstatSync12(path);
+  const path = join30(skillRoot, name);
+  const stat = lstatSync13(path);
   let kind = stat.isSymbolicLink() ? "symlink" : stat.isDirectory() ? "directory" : "file";
   let realPath;
   try {
@@ -6291,7 +6746,7 @@ function inspectSkillItem(skillRoot, directory, name, managed, registeredSkills)
     if (stat.isSymbolicLink()) kind = "dangling-symlink";
   }
   const registered = realPath ? registeredSkills.find((skill) => skill.sourceRealPath === realPath) : void 0;
-  const classification = registered ? void 0 : realPath && isPluginPack(realPath) ? "plugin-pack" : kind === "directory" && existsSync29(join29(path, "SKILL.md")) ? "project-local" : void 0;
+  const classification = registered ? void 0 : realPath && isPluginPack(realPath) ? "plugin-pack" : kind === "directory" && existsSync30(join30(path, "SKILL.md")) ? "project-local" : void 0;
   return {
     name,
     kind,
@@ -6303,11 +6758,11 @@ function inspectSkillItem(skillRoot, directory, name, managed, registeredSkills)
   };
 }
 function isPluginPack(path) {
-  const skillsRoot = join29(path, "skills");
-  return existsSync29(join29(path, ".codex-plugin/plugin.json")) && safeIsDirectory(skillsRoot) && safeReadDir(skillsRoot).some((name) => existsSync29(join29(skillsRoot, name, "SKILL.md")));
+  const skillsRoot = join30(path, "skills");
+  return existsSync30(join30(path, ".codex-plugin/plugin.json")) && safeIsDirectory(skillsRoot) && safeReadDir(skillsRoot).some((name) => existsSync30(join30(skillsRoot, name, "SKILL.md")));
 }
 function inspectInvalidSkillEntries(root, directory) {
-  const skillRoot = join29(root, ".agents", directory);
+  const skillRoot = join30(root, ".agents", directory);
   if (!pathLexists(skillRoot) || !safeIsDirectory(skillRoot)) return [];
   return safeReadDir(skillRoot).flatMap((name) => {
     if (name === ".gitkeep") return [];
@@ -6315,14 +6770,14 @@ function inspectInvalidSkillEntries(root, directory) {
       return [{ path: `.agents/${directory}/${name}`, reason: "metadata-junk" }];
     if (name.startsWith("."))
       return [{ path: `.agents/${directory}/${name}`, reason: "unexpected-file" }];
-    const path = join29(skillRoot, name);
-    return !lstatSync12(path).isDirectory() && !lstatSync12(path).isSymbolicLink() ? [{ path: `.agents/${directory}/${name}`, reason: "unexpected-file" }] : [];
+    const path = join30(skillRoot, name);
+    return !lstatSync13(path).isDirectory() && !lstatSync13(path).isSymbolicLink() ? [{ path: `.agents/${directory}/${name}`, reason: "unexpected-file" }] : [];
   });
 }
 function skillDuplicatesUser(item, root, userSkills) {
   if (userSkills.names.has(item.name)) return true;
-  const automatic = join29(root, ".agents/skills", item.name);
-  const manual = join29(root, ".agents/manual-skills", item.name);
+  const automatic = join30(root, ".agents/skills", item.name);
+  const manual = join30(root, ".agents/manual-skills", item.name);
   const realPath = safeRealpath(pathLexists(automatic) ? automatic : manual);
   return realPath ? userSkills.realPaths.has(realPath) : false;
 }
@@ -6342,13 +6797,13 @@ function skillPlacementDrift(item, actualPlacement) {
   return [];
 }
 function inspectClaudeSkillRoot(root) {
-  const path = join29(root, ".claude/skills");
+  const path = join30(root, ".claude/skills");
   if (!pathLexists(path)) return "missing";
-  const stat = lstatSync12(path);
+  const stat = lstatSync13(path);
   if (stat.isSymbolicLink()) {
     try {
       const target = realpathSync6(path);
-      return target === realpathSync6(join29(root, ".agents/skills")) ? "shared-root" : "other";
+      return target === realpathSync6(join30(root, ".agents/skills")) ? "shared-root" : "other";
     } catch {
       return "dangling-symlink";
     }
@@ -6361,27 +6816,27 @@ function inspectSkillRegistry(executionEngineRoot) {
       health: { source: 0, registered: 0, bundled: 0, bundles: 0 },
       skills: []
     };
-  const agentAssetsRoot = join29(executionEngineRoot, "agent-assets");
-  const registry = readJson4(join29(agentAssetsRoot, "registry.json"));
+  const agentAssetsRoot = join30(executionEngineRoot, "agent-assets");
+  const registry = readJson4(join30(agentAssetsRoot, "registry.json"));
   const assets = isRecord3(registry) && Array.isArray(registry.assets) ? registry.assets : [];
   const registeredSkills = assets.filter((asset) => isRecord3(asset) && asset.kind === "skill");
-  const bundleRoot = join29(agentAssetsRoot, "bundles");
+  const bundleRoot = join30(agentAssetsRoot, "bundles");
   const bundleFiles = safeReadDir(bundleRoot).filter((file) => file.endsWith(".json"));
   const bundledIds = /* @__PURE__ */ new Set();
   for (const file of bundleFiles) {
-    const bundle = readJson4(join29(bundleRoot, file));
+    const bundle = readJson4(join30(bundleRoot, file));
     if (!isRecord3(bundle) || !Array.isArray(bundle.assets)) continue;
     for (const id of bundle.assets) if (typeof id === "string") bundledIds.add(id);
   }
   const sourceRoots = [
-    join29(agentAssetsRoot, "skills/pie-skills"),
-    join29(agentAssetsRoot, "skills/npx-skills/.agents/skills")
+    join30(agentAssetsRoot, "skills/pie-skills"),
+    join30(agentAssetsRoot, "skills/npx-skills/.agents/skills")
   ];
   const source = sourceRoots.reduce(
-    (count, root) => count + safeReadDir(root).filter((name) => existsSync29(join29(root, name, "SKILL.md"))).length,
+    (count, root) => count + safeReadDir(root).filter((name) => existsSync30(join30(root, name, "SKILL.md"))).length,
     0
   ) + registeredSkills.filter(
-    (asset) => isRecord3(asset) && asset.sourceKind === "local-pack" && typeof asset.sourcePath === "string" && isPluginPack(join29(agentAssetsRoot, asset.sourcePath))
+    (asset) => isRecord3(asset) && asset.sourceKind === "local-pack" && typeof asset.sourcePath === "string" && isPluginPack(join30(agentAssetsRoot, asset.sourcePath))
   ).length;
   return {
     health: {
@@ -6398,7 +6853,7 @@ function inspectSkillRegistry(executionEngineRoot) {
       return [
         {
           id: asset.id,
-          sourceRealPath: safeRealpath(join29(agentAssetsRoot, asset.sourcePath)),
+          sourceRealPath: safeRealpath(join30(agentAssetsRoot, asset.sourcePath)),
           defaultPlacement: asset.defaultPlacement,
           defaultScope: asset.defaultScope === "user" ? "user" : "project"
         }
@@ -6413,21 +6868,27 @@ function inspectUserSkillEvidence(root) {
   for (const name of safeReadDir(root)) {
     if (name.startsWith(".")) continue;
     names.add(name);
-    const realPath = safeRealpath(join29(root, name));
+    const realPath = safeRealpath(join30(root, name));
     if (realPath) realPaths.add(realPath);
   }
   return { names, realPaths };
 }
 
 // src/portfolio/ai-health/technology.ts
-import { existsSync as existsSync30, readdirSync as readdirSync14, statSync as statSync9 } from "node:fs";
-import { join as join30 } from "node:path";
+import { existsSync as existsSync31, readdirSync as readdirSync13, statSync as statSync10 } from "node:fs";
+import { join as join31 } from "node:path";
 function buildTechnologyMatrix(governance, repositories) {
-  if (!governance) return [];
+  if (!governance || governance.technologies.length === 0) return [];
   const policy = governance.versionPolicy;
+  const packageManifestsByRepository = /* @__PURE__ */ new Map();
+  for (const repository of repositories) {
+    if (!packageManifestsByRepository.has(repository.path)) {
+      packageManifestsByRepository.set(repository.path, collectPackageManifests(repository.path));
+    }
+  }
   return governance.technologies.map((technology) => {
     const projects = repositories.flatMap((repository) => {
-      const packageManifests = collectPackageManifests(repository.path);
+      const packageManifests = packageManifestsByRepository.get(repository.path) ?? [];
       const packageSignals = (technology.packages ?? []).map((name) => {
         const requirement = policy?.packages.find((item) => item.name === name);
         return packageManifests.map((manifest) => {
@@ -6442,8 +6903,8 @@ function buildTechnologyMatrix(governance, repositories) {
         }).filter((item) => item !== void 0);
       }).flat();
       const fileSignal = (technology.files ?? []).some(
-        (path) => hasUsableTechnologyFile(join30(repository.path, path)) || packageManifests.some(
-          (manifest) => hasUsableTechnologyFile(join30(manifest.directory, path))
+        (path) => hasUsableTechnologyFile(join31(repository.path, path)) || packageManifests.some(
+          (manifest) => hasUsableTechnologyFile(join31(manifest.directory, path))
         )
       );
       const modelSignal = [
@@ -6534,14 +6995,14 @@ function buildTechnologyMatrix(governance, repositories) {
   }).filter((technology) => technology.projectCount > 0);
 }
 function hasUsableTechnologyFile(path) {
-  if (!existsSync30(path)) return false;
+  if (!existsSync31(path)) return false;
   try {
-    const info = statSync9(path);
+    const info = statSync10(path);
     if (info.isFile()) return true;
     if (!info.isDirectory()) return false;
-    return readdirSync14(path, { withFileTypes: true }).some((entry) => {
+    return readdirSync13(path, { withFileTypes: true }).some((entry) => {
       if (entry.name.startsWith(".")) return false;
-      const child = join30(path, entry.name);
+      const child = join31(path, entry.name);
       if (entry.isDirectory()) return hasUsableTechnologyFile(child);
       return entry.name.toLowerCase() !== "readme.md";
     });
@@ -6553,7 +7014,7 @@ function inspectExclusiveOwnership(root, endpoint, governance) {
   const projectType = endpoint.projectType;
   return (governance?.exclusiveOwnership ?? []).flatMap((rule) => {
     if (projectType && rule.allowedProjectTypes.includes(projectType)) return [];
-    const paths = rule.paths.filter((path) => existsSync30(join30(root, path)));
+    const paths = rule.paths.filter((path) => existsSync31(join31(root, path)));
     return paths.length > 0 ? [{ rule, paths }] : [];
   });
 }
@@ -6568,7 +7029,7 @@ function inspectProjectModel(root, endpoint, governance) {
   const detection = (id) => {
     const technology = technologyById.get(id);
     const packageMatch = technology?.packages?.some((name) => packages.has(name)) ?? false;
-    const fileMatch = technology?.files?.some((path) => existsSync30(join30(root, path))) ?? false;
+    const fileMatch = technology?.files?.some((path) => existsSync31(join31(root, path))) ?? false;
     return { id, label: technology?.label ?? id, detected: packageMatch || fileMatch };
   };
   const selected = new Set(endpoint.capabilities ?? []);
@@ -6607,8 +7068,8 @@ function collectPackageNames(root) {
 }
 
 // src/portfolio/ai-health/report.ts
-import { cpSync as cpSync3, existsSync as existsSync31, mkdirSync as mkdirSync10, writeFileSync as writeFileSync9 } from "node:fs";
-import { dirname as dirname16, join as join31 } from "node:path";
+import { cpSync as cpSync3, existsSync as existsSync32, mkdirSync as mkdirSync10, writeFileSync as writeFileSync9 } from "node:fs";
+import { dirname as dirname16, join as join32 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 function mergePortfolioAiHealthReport(existing, latest, allRepositoryIds) {
   const repositoriesById = /* @__PURE__ */ new Map();
@@ -6652,16 +7113,16 @@ function writePortfolioAiHealthReport(report, outDir) {
   mkdirSync10(outDir, { recursive: true });
   const dashboardAssets = findDashboardAssets();
   for (const file of ["index.html", "app.js", "app.css"]) {
-    const source = join31(dashboardAssets, file);
-    if (!existsSync31(source)) throw new Error(`Portfolio dashboard asset is missing: ${source}`);
-    cpSync3(source, join31(outDir, file));
+    const source = join32(dashboardAssets, file);
+    if (!existsSync32(source)) throw new Error(`Portfolio dashboard asset is missing: ${source}`);
+    cpSync3(source, join32(outDir, file));
   }
-  const jsonPath = join31(outDir, "portfolio-ai-health.json");
-  const htmlPath = join31(outDir, "index.html");
+  const jsonPath = join32(outDir, "portfolio-ai-health.json");
+  const htmlPath = join32(outDir, "index.html");
   writeFileSync9(jsonPath, `${JSON.stringify(report, null, 2)}
 `);
   writeFileSync9(
-    join31(outDir, "data.js"),
+    join32(outDir, "data.js"),
     `window.__PORTFOLIO_AI_HEALTH__ = ${safeJavaScriptJson2(report)};
 `
   );
@@ -6671,14 +7132,14 @@ function findDashboardAssets() {
   const packageRoot2 = dirname16(dirname16(fileURLToPath5(import.meta.url)));
   const candidates = [
     process.env.PGS_DASHBOARD_ASSETS_DIR,
-    join31(packageRoot2, ".dashboard-build"),
-    join31(packageRoot2, "assets/portfolio-dashboard"),
-    join31(process.cwd(), ".dashboard-build"),
-    join31(process.cwd(), "assets/portfolio-dashboard"),
-    join31(process.cwd(), "packages/pro-gov/.dashboard-build"),
-    join31(process.cwd(), "packages/pro-gov/assets/portfolio-dashboard")
+    join32(packageRoot2, ".dashboard-build"),
+    join32(packageRoot2, "assets/portfolio-dashboard"),
+    join32(process.cwd(), ".dashboard-build"),
+    join32(process.cwd(), "assets/portfolio-dashboard"),
+    join32(process.cwd(), "packages/pro-gov/.dashboard-build"),
+    join32(process.cwd(), "packages/pro-gov/assets/portfolio-dashboard")
   ].filter((value) => Boolean(value));
-  const match = candidates.find((path) => existsSync31(join31(path, "index.html")));
+  const match = candidates.find((path) => existsSync32(join32(path, "index.html")));
   if (!match)
     throw new Error(
       "Portfolio dashboard assets were not built. Run pnpm --filter @pieai/pro-gov build."
@@ -6696,7 +7157,7 @@ function inspectPortfolioAiHealth(options) {
   if (options.targetId && options.targetId !== "all" && endpoints.length === 0) {
     throw new Error(`Unknown portfolio target: ${options.targetId}`);
   }
-  const secretsRoot = options.secretsRoot ?? join32(
+  const secretsRoot = options.secretsRoot ?? join33(
     dirname17(
       options.manifest.controlPlane?.path ?? allEndpoints[0]?.endpoint.path ?? process.cwd()
     ),
@@ -6706,9 +7167,9 @@ function inspectPortfolioAiHealth(options) {
   const grokVersion = commandVersion("grok");
   const executionEngineRoot = options.manifest.executionEngine?.path;
   const skillRegistry = inspectSkillRegistry(executionEngineRoot);
-  const userSkills = inspectUserSkillEvidence(join32(homeDir, ".agents/skills"));
+  const userSkills = inspectUserSkillEvidence(join33(homeDir, ".agents/skills"));
   const expectedPackageVersion = packageVersion(
-    join32(executionEngineRoot ?? "", "packages/pro-gov/package.json")
+    join33(executionEngineRoot ?? "", "packages/pro-gov/package.json")
   );
   const repositories = endpoints.map(
     ({ endpoint, role }) => inspectRepository(
@@ -6726,7 +7187,7 @@ function inspectPortfolioAiHealth(options) {
   const summary = { healthy: 0, attention: 0, unhealthy: 0 };
   for (const repository of repositories) summary[repository.status] += 1;
   return {
-    schemaVersion: 7,
+    schemaVersion: 8,
     portfolioId: options.manifest.portfolioId,
     generatedAt: options.generatedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
     coverage: {
@@ -6775,19 +7236,20 @@ function inspectRepository(endpoint, role, secretsRoot, homeDir, expectedPackage
   const root = endpoint.path;
   const git = inspectGit2(root);
   const entries = inspectEntries(root);
+  const agentLinks = inspectAgentLinks(root);
   const grokInspection = inspectGrokProject(root, homeDir, grokVersion);
   const skills = inspectSkills(root, grokInspection, registeredSkills, userSkills);
   const hostSsot = inspectProjectHostSsot(root);
   const hooks = inspectHooks(root);
   const docs = inspectDocs(root, role === "execution-engine" ? void 0 : expectedPackageVersion);
   const mcp = {
-    codexProject: tomlMcpNames(join32(root, MCP_DISCOVERY_PATHS.project.codex)),
+    codexProject: tomlMcpNames(join33(root, MCP_DISCOVERY_PATHS.project.codex)),
     claudeCodeProjectShared: jsonObjectKeys(
-      join32(root, MCP_DISCOVERY_PATHS.project.claudeCodeShared),
+      join33(root, MCP_DISCOVERY_PATHS.project.claudeCodeShared),
       "mcpServers"
     ),
     claudeCodeProjectLocal: claudeProjectLocalMcpNames(homeDir, root),
-    grokProject: tomlMcpNames(join32(root, MCP_DISCOVERY_PATHS.project.grok)),
+    grokProject: tomlMcpNames(join33(root, MCP_DISCOVERY_PATHS.project.grok)),
     grokEffective: grokInspection.effectiveMcp,
     grokInspection: grokInspection.inspection
   };
@@ -6855,6 +7317,10 @@ function inspectRepository(endpoint, role, secretsRoot, homeDir, expectedPackage
     recommendations.push("GEMINI.md \u662F\u65AD\u5F00\u7684\u94FE\u63A5\uFF1B\u9700\u8981\u91CD\u65B0\u6307\u5411 AGENTS.md\u3002");
   if ([...skills.automatic, ...skills.manual].some((skill) => skill.kind === "dangling-symlink"))
     recommendations.push("`.agents/skills` \u6216 `.agents/manual-skills` \u4E2D\u5B58\u5728\u65AD\u5F00\u7684\u6280\u80FD\u94FE\u63A5\u3002");
+  if (agentLinks.trackedDangling.length > 0)
+    recommendations.push(
+      `\u53D1\u73B0 ${agentLinks.trackedDangling.length} \u4E2A\u53D7 Git \u8DDF\u8E2A\u7684 agent workflow/command \u65AD\u5F00\u94FE\u63A5\uFF1A${agentLinks.trackedDangling.join("\u3001")}\uFF1B\u786E\u8BA4\u662F\u5426\u5E94\u5220\u9664\u65E7\u5165\u53E3\u6216\u6062\u590D canonical \u76EE\u6807\u3002`
+    );
   if (skills.invalidEntries.length > 0)
     recommendations.push(
       `\u6280\u80FD\u76EE\u5F55\u4E2D\u6709 ${skills.invalidEntries.length} \u4E2A\u5783\u573E\u6216\u975E\u6280\u80FD\u6587\u4EF6\uFF1A${skills.invalidEntries.map((entry) => entry.path).join("\u3001")}\u3002`
@@ -6967,6 +7433,7 @@ function inspectRepository(endpoint, role, secretsRoot, homeDir, expectedPackage
     status: deriveStatus(
       role,
       entries,
+      agentLinks,
       git,
       hooks,
       skills,
@@ -6983,6 +7450,7 @@ function inspectRepository(endpoint, role, secretsRoot, homeDir, expectedPackage
     recommendations,
     git,
     entries,
+    agentLinks,
     hooks,
     mcp,
     skills,
@@ -6995,8 +7463,8 @@ function inspectRepository(endpoint, role, secretsRoot, homeDir, expectedPackage
     redundancy
   };
 }
-function deriveStatus(role, entries, git, hooks, skills, hostSsot, secrets, docs, projectModel, exclusiveOwnershipViolations, technologyGovernanceConfigured, versions, verification, redundancy) {
-  if (!git.isRepository || entries.agents === "missing" || entries.claude === "dangling-symlink" || entries.gemini === "dangling-symlink" || [...skills.automatic, ...skills.manual].some((item) => item.kind === "dangling-symlink") || exclusiveOwnershipViolations.length > 0 || secrets.repositoryEnvFiles.some((file) => file.tracked && !file.template && !file.fixture) || hasUnsafeCentralSecretPermissions(secrets))
+function deriveStatus(role, entries, agentLinks, git, hooks, skills, hostSsot, secrets, docs, projectModel, exclusiveOwnershipViolations, technologyGovernanceConfigured, versions, verification, redundancy) {
+  if (!git.isRepository || entries.agents === "missing" || entries.claude === "dangling-symlink" || entries.gemini === "dangling-symlink" || agentLinks.trackedDangling.length > 0 || [...skills.automatic, ...skills.manual].some((item) => item.kind === "dangling-symlink") || exclusiveOwnershipViolations.length > 0 || secrets.repositoryEnvFiles.some((file) => file.tracked && !file.template && !file.fixture) || hasUnsafeCentralSecretPermissions(secrets))
     return "unhealthy";
   const missingBaseline = projectModel.baseline.some(
     (technology) => !technology.detected && !hasBaselineException(projectModel, technology.id)
@@ -7403,8 +7871,8 @@ function isHost2(value) {
   return value === "codex" || value === "claude-code" || value === "gemini-cli" || value === "antigravity";
 }
 function findPortfolioAgentAssetsDir(manifest) {
-  const agentAssetsDir = manifest?.executionEngine?.path ? join33(manifest.executionEngine.path, "agent-assets") : void 0;
-  return agentAssetsDir && existsSync32(join33(agentAssetsDir, "registry.json")) ? agentAssetsDir : void 0;
+  const agentAssetsDir = manifest?.executionEngine?.path ? join34(manifest.executionEngine.path, "agent-assets") : void 0;
+  return agentAssetsDir && existsSync33(join34(agentAssetsDir, "registry.json")) ? agentAssetsDir : void 0;
 }
 function printUsage5() {
   console.error("Usage:");
@@ -7420,8 +7888,8 @@ function printUsage5() {
 }
 function readExistingAiHealthReport(outDir, portfolioId) {
   if (!outDir) return void 0;
-  const path = join33(outDir, "portfolio-ai-health.json");
-  if (!existsSync32(path)) return void 0;
+  const path = join34(outDir, "portfolio-ai-health.json");
+  if (!existsSync33(path)) return void 0;
   try {
     const value = JSON.parse(readFileSync18(path, "utf8"));
     if (!value || typeof value !== "object" || value.portfolioId !== portfolioId || !Array.isArray(value.repositories))
@@ -7433,8 +7901,8 @@ function readExistingAiHealthReport(outDir, portfolioId) {
 }
 
 // src/commands/sync.ts
-import { existsSync as existsSync33, lstatSync as lstatSync13, readFileSync as readFileSync19, readlinkSync as readlinkSync4 } from "node:fs";
-import { join as join34 } from "node:path";
+import { existsSync as existsSync34, lstatSync as lstatSync14, readFileSync as readFileSync19, readlinkSync as readlinkSync4 } from "node:fs";
+import { join as join35 } from "node:path";
 function runSync(args) {
   const check = args.includes("--check");
   if (!check) {
@@ -7462,7 +7930,7 @@ function runSync(args) {
   console.log("pro-gov sync check");
   console.log(`profile: ${profile}`);
   for (const file of planStarterFiles(profile)) {
-    const targetPath = join34(process.cwd(), file.targetPath);
+    const targetPath = join35(process.cwd(), file.targetPath);
     const stat = safeLstat3(targetPath);
     if (!stat) {
       if (file.ownership === "optional-guardrail") continue;
@@ -7521,13 +7989,13 @@ function normalizeMarkdownTableCell(cell) {
 }
 function inferInstalledProfile(root) {
   const installed = ["engineering-runtime", "doc-only"].filter(
-    (profile) => existsSync33(join34(root, `docs/governance/agents-routing/${profile}-v1.1.md`))
+    (profile) => existsSync34(join35(root, `docs/governance/agents-routing/${profile}-v1.1.md`))
   );
   return installed.length === 1 ? installed[0] : void 0;
 }
 function safeLstat3(path) {
   try {
-    return lstatSync13(path);
+    return lstatSync14(path);
   } catch {
     return void 0;
   }
@@ -7565,7 +8033,8 @@ var COMMANDS = [
   "lens audit check --dir <path> [--json]",
   "init --profile <engineering-runtime|doc-only> <--dry-run|--apply>",
   "sync --check [--profile <engineering-runtime|doc-only>]",
-  "doctor"
+  "package-doctor",
+  "doctor (legacy alias for package-doctor)"
 ];
 var [command, subcommand] = process.argv.slice(2);
 process.exitCode = await main();
@@ -7581,6 +8050,7 @@ async function main() {
   if (command === "host-lens") return runHostLens(process.argv.slice(3));
   if (command === "init") return runInit(process.argv.slice(3));
   if (command === "sync") return runSync(process.argv.slice(3));
+  if (command === "package-doctor") return runPackageDoctor(process.argv.slice(3));
   if (command === "doctor") return runDoctor(process.argv.slice(3));
   console.error(`Unknown command: ${[command, subcommand].filter(Boolean).join(" ")}`);
   printHelp();