@pieai/pro-gov 0.9.2 → 0.9.4

package/dist/cli.js

@@ -43,8 +43,8 @@ function isPlatformMetadata(name) {
 }
 
 // src/commands/assets.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname5, join as join11 } from "node:path";
+import { existsSync as existsSync12, mkdirSync as mkdirSync4, readFileSync as readFileSync8, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname6, join as join12 } from "node:path";
 
 // src/asset-bundles/bundles.ts
 import { existsSync as existsSync2, readdirSync as readdirSync2, readFileSync } from "node:fs";
@@ -58,27 +58,1001 @@ function loadAgentAssetBundles(agentAssetsDir) {
   }).sort((a, b) => a.id.localeCompare(b.id));
 }
 
-// src/asset-npx/maintenance.ts
+// src/asset-catalog/catalog.ts
 import { createHash } from "node:crypto";
-import { spawnSync } from "node:child_process";
 import {
-  cpSync,
   existsSync as existsSync3,
+  lstatSync,
   mkdirSync,
   mkdtempSync,
-  readdirSync as readdirSync3,
   readFileSync as readFileSync2,
-  statSync
+  readdirSync as readdirSync3,
+  renameSync,
+  rmSync,
+  statSync,
+  symlinkSync,
+  writeFileSync
 } from "node:fs";
-import { join as join3, relative as relative2 } from "node:path";
+import { basename, dirname as dirname2, extname, isAbsolute, join as join3, relative as relative2, resolve } from "node:path";
+var portableManifestName = ".asset-catalog-manifest.json";
+var localLinksManifestName = ".asset-catalog-local-links.json";
+var legacyManagedSentinel = ".managed-by-pro-gov-asset-catalog";
+var legacyManagedDirectoryNames = ["generated", "native-links"];
+var manifestGenerator = "@pieai/pro-gov asset-catalog";
+var ignoredTraversalNames = /* @__PURE__ */ new Set([
+  ".DS_Store",
+  "Thumbs.db",
+  "__pycache__",
+  ".cache",
+  ".pytest_cache",
+  ".mypy_cache",
+  "node_modules",
+  "dist",
+  "build"
+]);
+var selectorFields = /* @__PURE__ */ new Set([
+  "id",
+  "title",
+  "family",
+  "kind",
+  "domain",
+  "tag",
+  "visibility",
+  "origin",
+  "sourcePath"
+]);
+var slugPattern = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function loadAssetCatalogConfig(catalogRoot) {
+  const configPath = join3(catalogRoot, "catalog.config.json");
+  if (!existsSync3(configPath)) {
+    throw new Error(`Missing asset catalog config: ${configPath}`);
+  }
+  const config = JSON.parse(readFileSync2(configPath, "utf8"));
+  const issues = validateAssetCatalogConfig(config);
+  if (issues.length > 0) {
+    throw new Error(
+      `Invalid asset catalog config:
+${issues.map((issue) => `- ${issue}`).join("\n")}`
+    );
+  }
+  return config;
+}
+function buildAssetCatalog(options) {
+  const snapshot = createAssetCatalogSnapshot(options);
+  const warnings = [...writePortableCatalog(options.catalogRoot, snapshot.files)];
+  let nativeLinksRoot;
+  let nativeLinkCount = 0;
+  if (options.nativeLinks) {
+    nativeLinksRoot = join3(options.catalogRoot, "by-topic");
+    const nativeResult = writeNativeLinks({
+      agentAssetsDir: options.agentAssetsDir,
+      catalogRoot: options.catalogRoot,
+      entries: snapshot.entries,
+      platform: options.platform ?? process.platform
+    });
+    nativeLinkCount = nativeResult.linkCount;
+    warnings.push(...nativeResult.warnings);
+  }
+  return {
+    catalogRoot: options.catalogRoot,
+    nativeLinksRoot,
+    assetCount: snapshot.document.assetCount,
+    topicCount: snapshot.document.topicCount,
+    portableFileCount: snapshot.files.size + 1,
+    nativeLinkCount,
+    warnings
+  };
+}
+function checkAssetCatalog(options) {
+  const snapshot = createAssetCatalogSnapshot(options);
+  const expected = new Map(snapshot.files);
+  expected.set(portableManifestName, renderPortableManifest(snapshot.files));
+  const issues = [];
+  for (const [relativePath, expectedContent] of expected) {
+    const targetPath = join3(options.catalogRoot, ...relativePath.split("/"));
+    if (!existsSync3(targetPath)) {
+      issues.push(`missing generated file: ${relativePath}`);
+      continue;
+    }
+    const stats = lstatSync(targetPath);
+    if (!stats.isFile() || stats.isSymbolicLink()) {
+      issues.push(`generated path is not a regular file: ${relativePath}`);
+    } else if (readFileSync2(targetPath, "utf8") !== expectedContent) {
+      issues.push(`stale generated file: ${relativePath}`);
+    }
+  }
+  try {
+    const manifest = readPortableManifest(options.catalogRoot);
+    if (manifest) {
+      for (const relativePath of manifest.portableFiles) {
+        if (!snapshot.files.has(relativePath)) {
+          issues.push(`unexpected managed file: ${relativePath}`);
+        }
+      }
+    }
+  } catch (error) {
+    issues.push(error instanceof Error ? error.message : String(error));
+  }
+  for (const name of legacyManagedDirectoryNames) {
+    if (existsSync3(join3(options.catalogRoot, name))) {
+      issues.push(`legacy catalog directory remains: ${name}`);
+    }
+  }
+  return {
+    catalogRoot: options.catalogRoot,
+    assetCount: snapshot.document.assetCount,
+    issues: issues.sort()
+  };
+}
+function nativeLinkStrategy(platform, sourceType) {
+  if (platform !== "win32") return "relative-symlink";
+  return sourceType === "directory" ? "junction" : "file-symlink";
+}
+function createAssetCatalogSnapshot(options) {
+  const config = loadAssetCatalogConfig(options.catalogRoot);
+  const agentAssetsDir = resolve(options.agentAssetsDir);
+  const registryRaw = readFileSync2(join3(agentAssetsDir, "registry.json"), "utf8");
+  const configRaw = readFileSync2(join3(options.catalogRoot, "catalog.config.json"), "utf8");
+  const topicIds = new Set(config.topics.map((topic) => topic.id));
+  const bundleMembership = createBundleMembership(options.bundles);
+  const entries = [
+    ...options.registry.assets.map(
+      (asset) => createRegisteredEntry(asset, agentAssetsDir, config, topicIds, bundleMembership)
+    ),
+    ...config.extraEntries.map(
+      (asset) => createExtraEntry(asset, agentAssetsDir, topicIds, bundleMembership)
+    )
+  ].sort(compareCatalogEntries);
+  assertUniqueEntries(entries);
+  const uncategorized = entries.filter((entry) => entry.topics.length === 0);
+  if (uncategorized.length > 0) {
+    throw new Error(
+      `Uncategorized catalog assets:
+${uncategorized.map((entry) => `- ${entry.id}`).join("\n")}`
+    );
+  }
+  const uncovered = findUncoveredSourcePaths(
+    agentAssetsDir,
+    entries,
+    config.ignoredSourcePaths ?? []
+  );
+  if (uncovered.length > 0) {
+    throw new Error(
+      `Agent asset sources are not represented in the catalog:
+${uncovered.map((path) => `- ${path}`).join("\n")}`
+    );
+  }
+  const usedBundleIds = new Set(entries.flatMap((entry) => entry.bundles));
+  const document = {
+    schemaVersion: 1,
+    title: config.title,
+    description: config.description,
+    registryAssetCount: options.registry.assets.length,
+    extraEntryCount: config.extraEntries.length,
+    assetCount: entries.length,
+    topicCount: config.topics.length,
+    bundleCount: usedBundleIds.size,
+    registryDigest: sha256(registryRaw),
+    configDigest: sha256(configRaw),
+    topics: config.topics.map((topic) => ({
+      id: topic.id,
+      title: topic.title,
+      description: topic.description,
+      assetCount: entries.filter((entry) => entry.topics.includes(topic.id)).length
+    })),
+    entries
+  };
+  return {
+    document,
+    entries,
+    files: renderPortableCatalog(document, config, options.catalogRoot, agentAssetsDir)
+  };
+}
+function createRegisteredEntry(asset, agentAssetsDir, config, topicIds, bundleMembership) {
+  const sourceAbsolutePath = resolveSafeSourcePath(agentAssetsDir, asset.sourcePath, asset.id);
+  const sourceType = statSync(sourceAbsolutePath).isDirectory() ? "directory" : "file";
+  const draft = {
+    id: asset.id,
+    title: asset.title,
+    description: readAssetDescription(sourceAbsolutePath, sourceType, asset.title),
+    family: asset.family,
+    kind: asset.kind,
+    domain: asset.domain,
+    visibility: asset.visibility,
+    sourceKind: asset.sourceKind,
+    sourcePath: normalizeRelativePath(asset.sourcePath),
+    sourceType,
+    tags: [...asset.tags],
+    bundles: [...bundleMembership.get(asset.id) ?? []],
+    origin: asset.origin,
+    registered: true
+  };
+  const topics = config.topics.filter((topic) => matchesTopic(draft, topic)).map((topic) => topic.id);
+  assertKnownTopics(asset.id, topics, topicIds);
+  return { ...draft, topics };
+}
+function createExtraEntry(asset, agentAssetsDir, topicIds, bundleMembership) {
+  const sourceAbsolutePath = resolveSafeSourcePath(agentAssetsDir, asset.sourcePath, asset.id);
+  const sourceType = statSync(sourceAbsolutePath).isDirectory() ? "directory" : "file";
+  assertKnownTopics(asset.id, asset.topics, topicIds);
+  return {
+    id: asset.id,
+    title: asset.title,
+    description: asset.description,
+    family: asset.family,
+    kind: asset.kind,
+    visibility: "private",
+    sourceKind: "local",
+    sourcePath: normalizeRelativePath(asset.sourcePath),
+    sourceType,
+    tags: [...asset.tags],
+    topics: [...new Set(asset.topics)].sort(),
+    bundles: [...bundleMembership.get(asset.id) ?? []],
+    origin: asset.origin,
+    registered: false
+  };
+}
+function validateAssetCatalogConfig(config) {
+  const issues = [];
+  if (config.schemaVersion !== 1) issues.push("schemaVersion must be 1");
+  if (!config.title?.trim()) issues.push("title is required");
+  if (!config.description?.trim()) issues.push("description is required");
+  if (!Array.isArray(config.topics) || config.topics.length === 0) {
+    issues.push("topics must be a non-empty array");
+  }
+  if (!Array.isArray(config.extraEntries)) issues.push("extraEntries must be an array");
+  const topicIds = /* @__PURE__ */ new Set();
+  for (const topic of config.topics ?? []) {
+    if (!slugPattern.test(topic.id)) issues.push(`invalid topic id: ${topic.id}`);
+    if (topicIds.has(topic.id)) issues.push(`duplicate topic id: ${topic.id}`);
+    topicIds.add(topic.id);
+    if (!topic.title?.trim()) issues.push(`topic ${topic.id} is missing title`);
+    if (!topic.description?.trim()) issues.push(`topic ${topic.id} is missing description`);
+    if (!Array.isArray(topic.selectors))
+      issues.push(`topic ${topic.id} selectors must be an array`);
+    for (const selector of [...topic.selectors ?? [], ...topic.excludeSelectors ?? []]) {
+      const separator = selector.indexOf(":");
+      const field = separator > 0 ? selector.slice(0, separator) : "";
+      const pattern = separator > 0 ? selector.slice(separator + 1) : "";
+      if (!selectorFields.has(field) || !pattern) {
+        issues.push(`invalid selector in ${topic.id}: ${selector}`);
+      }
+    }
+  }
+  const extraIds = /* @__PURE__ */ new Set();
+  for (const entry of config.extraEntries ?? []) {
+    if (!entry.id?.includes("/")) issues.push(`invalid extra entry id: ${entry.id}`);
+    if (extraIds.has(entry.id)) issues.push(`duplicate extra entry id: ${entry.id}`);
+    extraIds.add(entry.id);
+    if (!entry.title?.trim()) issues.push(`extra entry ${entry.id} is missing title`);
+    if (!entry.family?.trim()) issues.push(`extra entry ${entry.id} is missing family`);
+    if (!entry.kind?.trim()) issues.push(`extra entry ${entry.id} is missing kind`);
+    if (!entry.description?.trim()) issues.push(`extra entry ${entry.id} is missing description`);
+    if (!Array.isArray(entry.tags)) issues.push(`extra entry ${entry.id} tags must be an array`);
+    if (!Array.isArray(entry.topics) || entry.topics.length === 0) {
+      issues.push(`extra entry ${entry.id} must name at least one topic`);
+    }
+    for (const topic of entry.topics ?? []) {
+      if (!topicIds.has(topic)) issues.push(`extra entry ${entry.id} has unknown topic: ${topic}`);
+    }
+    if (!isSafeSourcePath(entry.sourcePath)) {
+      issues.push(`extra entry ${entry.id} has unsafe sourcePath: ${entry.sourcePath}`);
+    }
+  }
+  for (const path of config.ignoredSourcePaths ?? []) {
+    if (!isSafeSourcePath(path)) issues.push(`unsafe ignoredSourcePath: ${path}`);
+  }
+  return issues;
+}
+function matchesTopic(entry, topic) {
+  if (topic.excludeSelectors?.some((selector) => matchesSelector(entry, selector))) return false;
+  return topic.selectors.some((selector) => matchesSelector(entry, selector));
+}
+function matchesSelector(entry, selector) {
+  const separator = selector.indexOf(":");
+  const field = selector.slice(0, separator);
+  const pattern = selector.slice(separator + 1);
+  const values = field === "tag" ? entry.tags : [String(entry[field] ?? "")];
+  return values.some((value) => wildcardMatches(value, pattern));
+}
+function wildcardMatches(value, pattern) {
+  const expression = pattern.split("*").map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join(".*");
+  return new RegExp(`^${expression}$`, "iu").test(value);
+}
+function renderPortableCatalog(document, config, catalogRoot, agentAssetsDir) {
+  const files = /* @__PURE__ */ new Map();
+  files.set("catalog.json", `${JSON.stringify(document, null, 2)}
+`);
+  files.set("INDEX.md", renderMainIndex(document));
+  files.set("index.html", renderHtmlCatalog(document, catalogRoot, agentAssetsDir));
+  for (const topic of config.topics) {
+    const entries = document.entries.filter((entry) => entry.topics.includes(topic.id));
+    const indexPath = join3(catalogRoot, "by-topic", topic.id, "README.md");
+    files.set(
+      `by-topic/${topic.id}/README.md`,
+      renderGroupIndex(topic.title, topic.description, entries, indexPath, agentAssetsDir)
+    );
+  }
+  return files;
+}
+function renderHtmlCatalog(document, catalogRoot, agentAssetsDir) {
+  const viewEntries = document.entries.map((entry) => ({
+    ...entry,
+    sourceHref: encodeRelativeHref(
+      relative2(catalogRoot, join3(agentAssetsDir, ...entry.sourcePath.split("/")))
+    )
+  }));
+  const data = JSON.stringify({ ...document, entries: viewEntries }).replaceAll("<", "\\u003c");
+  return `<!doctype html>
+<html lang="zh-CN">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>${escapeHtml(document.title)}</title>
+  <style>
+    :root { color-scheme: light; --ink:#17202a; --muted:#607080; --line:#dbe3ea; --paper:#fff; --wash:#f4f7fa; --accent:#1769aa; --chip:#eaf3fb; }
+    * { box-sizing:border-box; }
+    body { margin:0; background:var(--wash); color:var(--ink); font:15px/1.55 -apple-system,BlinkMacSystemFont,"Segoe UI","PingFang SC","Microsoft YaHei",sans-serif; }
+    header { padding:38px clamp(20px,5vw,72px) 28px; color:#fff; background:linear-gradient(125deg,#10283d,#1769aa 70%,#1e8b8a); }
+    header h1 { margin:0 0 8px; font-size:clamp(28px,4vw,44px); letter-spacing:-.03em; }
+    header p { max-width:800px; margin:0; opacity:.88; }
+    main { max-width:1440px; margin:auto; padding:24px clamp(16px,4vw,56px) 60px; }
+    .toolbar { position:sticky; top:0; z-index:2; display:grid; grid-template-columns:minmax(240px,2fr) repeat(3,minmax(150px,1fr)); gap:10px; padding:14px 0; background:color-mix(in srgb,var(--wash) 92%,transparent); backdrop-filter:blur(12px); }
+    input,select { width:100%; border:1px solid var(--line); border-radius:10px; background:var(--paper); padding:11px 12px; color:var(--ink); font:inherit; }
+    .summary { display:flex; justify-content:space-between; gap:16px; align-items:center; margin:10px 0 18px; color:var(--muted); }
+    .grid { display:grid; grid-template-columns:repeat(auto-fill,minmax(310px,1fr)); gap:14px; }
+    article { min-width:0; padding:18px; border:1px solid var(--line); border-radius:14px; background:var(--paper); box-shadow:0 4px 18px rgba(28,55,75,.05); }
+    article h2 { margin:0 0 5px; font-size:18px; line-height:1.3; }
+    article p { min-height:3.1em; margin:8px 0 12px; color:#405160; }
+    .meta { color:var(--muted); font-size:13px; overflow-wrap:anywhere; }
+    .chips { display:flex; flex-wrap:wrap; gap:6px; margin:12px 0; }
+    .chip { padding:3px 8px; border-radius:999px; background:var(--chip); color:#155582; font-size:12px; }
+    .actions { display:flex; gap:12px; margin-top:13px; }
+    a { color:var(--accent); text-decoration:none; font-weight:600; }
+    a:hover { text-decoration:underline; }
+    .empty { padding:44px; text-align:center; color:var(--muted); border:1px dashed var(--line); border-radius:14px; background:var(--paper); }
+    @media (max-width:850px) { .toolbar { grid-template-columns:1fr 1fr; } }
+    @media (max-width:540px) { .toolbar { position:static; grid-template-columns:1fr; } }
+  </style>
+</head>
+<body>
+  <header>
+    <h1>${escapeHtml(document.title)}</h1>
+    <p>${escapeHtml(document.description)} \u5F53\u524D\u5171 ${document.assetCount} \u9879\uFF1B\u540C\u4E00\u8D44\u4EA7\u53EF\u4EE5\u5C5E\u4E8E\u591A\u4E2A\u4E3B\u9898\u3002</p>
+  </header>
+  <main>
+    <section class="toolbar" aria-label="\u76EE\u5F55\u7B5B\u9009">
+      <input id="query" type="search" placeholder="\u641C\u7D22\u540D\u79F0\u3001\u7528\u9014\u3001\u6807\u7B7E\u3001\u4F5C\u8005\u6216\u8DEF\u5F84\u2026" autofocus>
+      <select id="topic" aria-label="\u6309\u4E3B\u9898\u7B5B\u9009"><option value="">\u5168\u90E8\u4E3B\u9898</option></select>
+      <select id="family" aria-label="\u6309\u6765\u6E90\u7B5B\u9009"><option value="">\u5168\u90E8\u6765\u6E90</option></select>
+      <select id="kind" aria-label="\u6309\u7C7B\u578B\u7B5B\u9009"><option value="">\u5168\u90E8\u7C7B\u578B</option></select>
+    </section>
+    <div class="summary"><span id="count"></span><a href="INDEX.md">\u6253\u5F00 Markdown \u76EE\u5F55</a></div>
+    <section id="grid" class="grid"></section>
+  </main>
+  <script id="catalog-data" type="application/json">${data}</script>
+  <script>
+    const data = JSON.parse(document.getElementById('catalog-data').textContent);
+    const byId = (id) => document.getElementById(id);
+    const query = byId('query');
+    const topic = byId('topic');
+    const family = byId('family');
+    const kind = byId('kind');
+    const grid = byId('grid');
+    const count = byId('count');
+    const esc = (value) => String(value).replace(/[&<>"']/g, (char) => ({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'}[char]));
+    const options = (select, values, labels = {}) => {
+      for (const value of [...new Set(values)].sort((a,b) => a.localeCompare(b))) {
+        const option = document.createElement('option'); option.value = value; option.textContent = labels[value] || value; select.append(option);
+      }
+    };
+    options(topic, data.topics.map((item) => item.id), Object.fromEntries(data.topics.map((item) => [item.id, item.title])));
+    options(family, data.entries.map((item) => item.family));
+    options(kind, data.entries.map((item) => item.kind));
+    const render = () => {
+      const needle = query.value.trim().toLocaleLowerCase();
+      const matches = data.entries.filter((entry) => {
+        const haystack = [entry.title,entry.id,entry.description,entry.family,entry.kind,entry.origin,entry.sourceKind,entry.visibility,entry.sourcePath,...entry.tags,...entry.topics,...entry.bundles].join(' ').toLocaleLowerCase();
+        return (!needle || haystack.includes(needle)) && (!topic.value || entry.topics.includes(topic.value)) && (!family.value || entry.family === family.value) && (!kind.value || entry.kind === kind.value);
+      });
+      count.textContent = '\u663E\u793A ' + matches.length + ' / ' + data.entries.length + ' \u9879';
+      grid.innerHTML = matches.length ? matches.map((entry) => '<article><h2>' + esc(entry.title) + '</h2><div class="meta">' + esc(entry.id) + ' \xB7 ' + esc(entry.kind) + ' \xB7 ' + esc(entry.family) + '</div><p>' + esc(entry.description) + '</p><div class="chips">' + entry.topics.map((item) => '<span class="chip">' + esc(item) + '</span>').join('') + '</div><div class="meta">' + esc(entry.origin) + '</div><div class="actions"><a href="' + esc(entry.sourceHref) + '">\u6253\u5F00\u539F\u59CB\u8D44\u4EA7</a></div></article>').join('') : '<div class="empty">\u6CA1\u6709\u5339\u914D\u9879\u3002\u8BD5\u8BD5\u66F4\u77ED\u7684\u5173\u952E\u8BCD\uFF0C\u6216\u6E05\u7A7A\u4E00\u4E2A\u7B5B\u9009\u6761\u4EF6\u3002</div>';
+    };
+    for (const control of [query,topic,family,kind]) control.addEventListener('input', render);
+    render();
+  </script>
+</body>
+</html>
+`;
+}
+function renderMainIndex(document) {
+  const lines = [
+    `# ${document.title}`,
+    "",
+    document.description,
+    "",
+    `\u5F53\u524D\u6536\u5F55 **${document.assetCount}** \u9879\uFF1A\u6CE8\u518C\u8868\u8D44\u4EA7 ${document.registryAssetCount} \u9879\uFF0C\u8865\u5145\u96C6\u5408 ${document.extraEntryCount} \u9879\u3002`,
+    "",
+    "## \u6309\u4E3B\u9898\u627E",
+    "",
+    "| \u4E3B\u9898 | \u6570\u91CF | \u9002\u7528\u8303\u56F4 |",
+    "| --- | ---: | --- |"
+  ];
+  for (const topic of document.topics) {
+    lines.push(
+      `| [${escapeTable(topic.title)}](<by-topic/${topic.id}/README.md>) | ${topic.assetCount} | ${escapeTable(topic.description)} |`
+    );
+  }
+  lines.push(
+    "",
+    "## \u600E\u4E48\u7528",
+    "",
+    "- \u53CC\u51FB [\u672C\u5730\u641C\u7D22\u9875](<index.html>)\uFF0C\u53EF\u6309\u5173\u952E\u8BCD\u3001\u4E3B\u9898\u3001\u6765\u6E90\u548C\u7C7B\u578B\u7B5B\u9009\u3002",
+    "- \u76F4\u63A5\u8FDB\u5165 `by-topic/`\uFF0C\u6309\u7528\u9014\u6D4F\u89C8\uFF1B\u6BCF\u4E2A\u4E3B\u9898\u7684 README \u90FD\u76F4\u63A5\u94FE\u63A5\u539F\u59CB\u8D44\u4EA7\u3002",
+    "- \u6765\u6E90\u3001\u4F5C\u8005\u3001\u7C7B\u578B\u548C Bundle \u662F\u8D44\u4EA7\u5C5E\u6027\uFF0C\u53EA\u4FDD\u7559\u5728\u641C\u7D22\u4E0E\u6570\u636E\u4E2D\uFF0C\u4E0D\u518D\u590D\u5236\u6210\u591A\u5957\u6587\u4EF6\u5939\u3002",
+    "",
+    "\u672C\u673A\u6267\u884C\u5E26 `--native-links` \u7684\u6784\u5EFA\u540E\uFF0C\u5FEB\u6377\u94FE\u63A5\u4F1A\u76F4\u63A5\u51FA\u73B0\u5728\u5404\u4E3B\u9898\u6587\u4EF6\u5939\u4E2D\uFF0C\u5E76\u4EE5 `.asset-link` \u7ED3\u5C3E\u3002\u94FE\u63A5\u662F\u53EF\u5220\u9664\u3001\u53EF\u91CD\u5EFA\u7684\u672C\u673A\u7F13\u5B58\uFF1BREADME\u3001HTML \u548C JSON \u624D\u662F\u8DE8\u5E73\u53F0\u4E8B\u5B9E\u5C42\u3002",
+    ""
+  );
+  return lines.join("\n");
+}
+function renderGroupIndex(title, description, entries, indexAbsolutePath, agentAssetsDir) {
+  const lines = [
+    `# ${title}`,
+    "",
+    description,
+    "",
+    `\u5171 ${entries.length} \u9879\u3002`,
+    "",
+    "| \u540D\u79F0 | \u7C7B\u578B | \u6765\u6E90 | \u8BF4\u660E |",
+    "| --- | --- | --- | --- |"
+  ];
+  for (const entry of entries) {
+    const sourcePath = normalizeRelativePath(
+      relative2(dirname2(indexAbsolutePath), join3(agentAssetsDir, ...entry.sourcePath.split("/")))
+    );
+    lines.push(
+      `| [${escapeTable(entry.title)}](<${sourcePath}>) | ${escapeTable(entry.kind)} | ${escapeTable(entry.family)} | ${escapeTable(entry.description)} |`
+    );
+  }
+  lines.push(
+    "",
+    "\u672C\u673A\u5FEB\u6377\u94FE\u63A5\uFF08\u5982\u5DF2\u751F\u6210\uFF09\u5C31\u5728\u672C\u76EE\u5F55\uFF0C\u6587\u4EF6\u540D\u4EE5 `.asset-link` \u7ED3\u5C3E\uFF1B\u6CA1\u6709\u94FE\u63A5\u65F6\uFF0C\u4E0A\u8868\u4ECD\u53EF\u76F4\u63A5\u6253\u5F00\u539F\u59CB\u8D44\u4EA7\u3002",
+    "",
+    "[\u8FD4\u56DE\u603B\u7D22\u5F15](<../../INDEX.md>)",
+    ""
+  );
+  return lines.join("\n");
+}
+function writeNativeLinks(options) {
+  const specs = createNativeLinkSpecs(options.agentAssetsDir, options.entries);
+  const previous = readLocalLinksManifest(options.catalogRoot);
+  const previousLinks = new Set(previous?.links ?? []);
+  for (const relativePath of previousLinks) {
+    assertManagedLocalLinkPath(relativePath);
+    const linkPath = resolveCatalogPath(options.catalogRoot, relativePath);
+    if (pathEntryExists(linkPath) && !lstatSync(linkPath).isSymbolicLink()) {
+      throw new Error(
+        `Refusing to replace a managed link that is no longer a symlink: ${relativePath}`
+      );
+    }
+  }
+  for (const spec of specs) {
+    assertManagedLocalLinkPath(spec.relativePath);
+    assertCatalogPathParents(options.catalogRoot, spec.relativePath);
+    const linkPath = resolveCatalogPath(options.catalogRoot, spec.relativePath);
+    if (pathEntryExists(linkPath) && !previousLinks.has(spec.relativePath)) {
+      throw new Error(`Refusing to replace unmanaged catalog path: ${spec.relativePath}`);
+    }
+  }
+  const warnings = [];
+  const stagedLinks = [];
+  const stageRoot = mkdtempSync(join3(dirname2(options.catalogRoot), ".asset-catalog-links-stage-"));
+  const backupRoot = mkdtempSync(
+    join3(dirname2(options.catalogRoot), ".asset-catalog-links-backup-")
+  );
+  const installed = [];
+  const backedUp = [];
+  try {
+    for (const spec of specs) {
+      const stagedPath = resolveCatalogPath(stageRoot, spec.relativePath);
+      const finalPath = resolveCatalogPath(options.catalogRoot, spec.relativePath);
+      mkdirSync(dirname2(stagedPath), { recursive: true });
+      const strategy = nativeLinkStrategy(options.platform, spec.sourceType);
+      try {
+        if (strategy === "relative-symlink") {
+          const target = relative2(dirname2(finalPath), spec.sourceAbsolutePath);
+          symlinkSync(target, stagedPath, spec.sourceType === "directory" ? "dir" : "file");
+        } else if (strategy === "junction") {
+          symlinkSync(spec.sourceAbsolutePath, stagedPath, "junction");
+        } else {
+          symlinkSync(spec.sourceAbsolutePath, stagedPath, "file");
+        }
+        stagedLinks.push(spec.relativePath);
+      } catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        warnings.push(`native link skipped (${spec.relativePath}): ${reason}`);
+      }
+    }
+    const localManifest = renderLocalLinksManifest(stagedLinks);
+    writeFileSync(join3(stageRoot, localLinksManifestName), localManifest);
+    for (const relativePath of [...previousLinks, localLinksManifestName]) {
+      const sourcePath = resolveCatalogPath(options.catalogRoot, relativePath);
+      if (!pathEntryExists(sourcePath)) continue;
+      const backupPath = resolveCatalogPath(backupRoot, relativePath);
+      mkdirSync(dirname2(backupPath), { recursive: true });
+      renameSync(sourcePath, backupPath);
+      backedUp.push(relativePath);
+    }
+    for (const relativePath of [...stagedLinks, localLinksManifestName]) {
+      const sourcePath = resolveCatalogPath(stageRoot, relativePath);
+      const targetPath = resolveCatalogPath(options.catalogRoot, relativePath);
+      mkdirSync(dirname2(targetPath), { recursive: true });
+      renameSync(sourcePath, targetPath);
+      installed.push(relativePath);
+    }
+    for (const relativePath of previousLinks) {
+      pruneEmptyCatalogParents(options.catalogRoot, dirname2(relativePath));
+    }
+  } catch (error) {
+    for (const relativePath of installed.reverse()) {
+      const targetPath = resolveCatalogPath(options.catalogRoot, relativePath);
+      if (pathEntryExists(targetPath)) rmSync(targetPath, { recursive: true, force: true });
+    }
+    for (const relativePath of backedUp.reverse()) {
+      const backupPath = resolveCatalogPath(backupRoot, relativePath);
+      const targetPath = resolveCatalogPath(options.catalogRoot, relativePath);
+      if (!pathEntryExists(backupPath)) continue;
+      mkdirSync(dirname2(targetPath), { recursive: true });
+      renameSync(backupPath, targetPath);
+    }
+    throw error;
+  } finally {
+    removeTemporaryTree(stageRoot, warnings);
+    removeTemporaryTree(backupRoot, warnings);
+  }
+  return { linkCount: stagedLinks.length, warnings };
+}
+function createNativeLinkSpecs(agentAssetsDir, entries) {
+  const specs = [];
+  const add = (topic, entry) => {
+    specs.push({
+      relativePath: `by-topic/${safePathSegment(topic)}/${nativeLinkName(entry)}`,
+      sourceAbsolutePath: join3(agentAssetsDir, ...entry.sourcePath.split("/")),
+      sourceType: entry.sourceType
+    });
+  };
+  for (const entry of entries) {
+    for (const topic of entry.topics) add(topic, entry);
+  }
+  const sorted = specs.sort((left, right) => left.relativePath.localeCompare(right.relativePath));
+  for (let index = 1; index < sorted.length; index += 1) {
+    if (sorted[index - 1].relativePath === sorted[index].relativePath) {
+      throw new Error(`Duplicate native catalog link path: ${sorted[index].relativePath}`);
+    }
+  }
+  return sorted;
+}
+function writePortableCatalog(catalogRoot, files) {
+  mkdirSync(catalogRoot, { recursive: true });
+  const warnings = [];
+  const previous = readPortableManifest(catalogRoot);
+  const previousFiles = new Set(previous?.portableFiles ?? []);
+  const expectedFiles = [...files.keys()].sort();
+  for (const relativePath of previousFiles) {
+    assertManagedPortablePath(relativePath);
+    const targetPath = resolveCatalogPath(catalogRoot, relativePath);
+    if (pathEntryExists(targetPath)) {
+      const stats = lstatSync(targetPath);
+      if (!stats.isFile() || stats.isSymbolicLink()) {
+        throw new Error(
+          `Refusing to replace a managed file that is no longer regular: ${relativePath}`
+        );
+      }
+    }
+  }
+  for (const relativePath of expectedFiles) {
+    assertManagedPortablePath(relativePath);
+    assertCatalogPathParents(catalogRoot, relativePath);
+    const targetPath = resolveCatalogPath(catalogRoot, relativePath);
+    if (pathEntryExists(targetPath) && !previousFiles.has(relativePath)) {
+      throw new Error(`Refusing to replace unmanaged catalog path: ${relativePath}`);
+    }
+  }
+  const legacyDirectories = findLegacyManagedDirectories(catalogRoot);
+  const stageRoot = mkdtempSync(join3(dirname2(catalogRoot), ".asset-catalog-stage-"));
+  const backupRoot = mkdtempSync(join3(dirname2(catalogRoot), ".asset-catalog-backup-"));
+  const installed = [];
+  const backedUp = [];
+  const legacyBackedUp = [];
+  try {
+    for (const [relativePath, content] of files) {
+      const stagedPath = resolveCatalogPath(stageRoot, relativePath);
+      mkdirSync(dirname2(stagedPath), { recursive: true });
+      writeFileSync(stagedPath, content);
+    }
+    writeFileSync(join3(stageRoot, portableManifestName), renderPortableManifest(files));
+    for (const relativePath of [...previousFiles, portableManifestName]) {
+      const sourcePath = resolveCatalogPath(catalogRoot, relativePath);
+      if (!pathEntryExists(sourcePath)) continue;
+      const backupPath = resolveCatalogPath(backupRoot, `portable/${relativePath}`);
+      mkdirSync(dirname2(backupPath), { recursive: true });
+      renameSync(sourcePath, backupPath);
+      backedUp.push(relativePath);
+    }
+    for (const name of legacyDirectories) {
+      const sourcePath = join3(catalogRoot, name);
+      const backupPath = resolveCatalogPath(backupRoot, `legacy/${name}`);
+      mkdirSync(dirname2(backupPath), { recursive: true });
+      renameSync(sourcePath, backupPath);
+      legacyBackedUp.push(name);
+    }
+    for (const relativePath of [...expectedFiles, portableManifestName]) {
+      const sourcePath = resolveCatalogPath(stageRoot, relativePath);
+      const targetPath = resolveCatalogPath(catalogRoot, relativePath);
+      mkdirSync(dirname2(targetPath), { recursive: true });
+      renameSync(sourcePath, targetPath);
+      installed.push(relativePath);
+    }
+    for (const relativePath of previousFiles) {
+      pruneEmptyCatalogParents(catalogRoot, dirname2(relativePath));
+    }
+  } catch (error) {
+    for (const relativePath of installed.reverse()) {
+      const targetPath = resolveCatalogPath(catalogRoot, relativePath);
+      if (pathEntryExists(targetPath)) rmSync(targetPath, { recursive: true, force: true });
+    }
+    for (const relativePath of backedUp.reverse()) {
+      const backupPath = resolveCatalogPath(backupRoot, `portable/${relativePath}`);
+      const targetPath = resolveCatalogPath(catalogRoot, relativePath);
+      if (!pathEntryExists(backupPath)) continue;
+      mkdirSync(dirname2(targetPath), { recursive: true });
+      renameSync(backupPath, targetPath);
+    }
+    for (const name of legacyBackedUp.reverse()) {
+      const backupPath = resolveCatalogPath(backupRoot, `legacy/${name}`);
+      const targetPath = join3(catalogRoot, name);
+      if (pathEntryExists(backupPath)) renameSync(backupPath, targetPath);
+    }
+    throw error;
+  } finally {
+    removeTemporaryTree(stageRoot, warnings);
+    removeTemporaryTree(backupRoot, warnings);
+  }
+  return warnings;
+}
+function renderPortableManifest(files) {
+  const manifest = {
+    schemaVersion: 1,
+    generator: manifestGenerator,
+    portableFiles: [...files.keys()].sort()
+  };
+  return `${JSON.stringify(manifest, null, 2)}
+`;
+}
+function renderLocalLinksManifest(links) {
+  const manifest = {
+    schemaVersion: 1,
+    generator: manifestGenerator,
+    links: [...links].sort()
+  };
+  return `${JSON.stringify(manifest, null, 2)}
+`;
+}
+function readPortableManifest(catalogRoot) {
+  const path = join3(catalogRoot, portableManifestName);
+  if (!existsSync3(path)) return void 0;
+  const value = readManifest(path, "portableFiles");
+  for (const relativePath of value.items) assertManagedPortablePath(relativePath);
+  return {
+    schemaVersion: 1,
+    generator: manifestGenerator,
+    portableFiles: value.items
+  };
+}
+function readLocalLinksManifest(catalogRoot) {
+  const path = join3(catalogRoot, localLinksManifestName);
+  if (!existsSync3(path)) return void 0;
+  const value = readManifest(path, "links");
+  for (const relativePath of value.items) assertManagedLocalLinkPath(relativePath);
+  return { schemaVersion: 1, generator: manifestGenerator, links: value.items };
+}
+function readManifest(path, listKey) {
+  const stats = lstatSync(path);
+  if (!stats.isFile() || stats.isSymbolicLink()) {
+    throw new Error(`Invalid asset catalog manifest file: ${path}`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync2(path, "utf8"));
+  } catch {
+    throw new Error(`Invalid asset catalog manifest JSON: ${path}`);
+  }
+  const items = parsed[listKey];
+  if (parsed.schemaVersion !== 1 || parsed.generator !== manifestGenerator || !Array.isArray(items) || items.some((item) => typeof item !== "string") || new Set(items).size !== items.length) {
+    throw new Error(`Invalid asset catalog manifest shape: ${path}`);
+  }
+  return { items: [...items].sort() };
+}
+function findLegacyManagedDirectories(catalogRoot) {
+  const result = [];
+  for (const name of legacyManagedDirectoryNames) {
+    const root = join3(catalogRoot, name);
+    if (!existsSync3(root)) continue;
+    const stats = lstatSync(root);
+    if (!stats.isDirectory() || stats.isSymbolicLink()) {
+      throw new Error(`Refusing to migrate non-directory legacy catalog output: ${root}`);
+    }
+    const sentinel = join3(root, legacyManagedSentinel);
+    if (!existsSync3(sentinel) || !lstatSync(sentinel).isFile()) {
+      throw new Error(`Refusing to migrate unmanaged legacy catalog directory: ${root}`);
+    }
+    result.push(name);
+  }
+  return result;
+}
+function assertManagedPortablePath(relativePath) {
+  if (relativePath !== "INDEX.md" && relativePath !== "index.html" && relativePath !== "catalog.json" && !/^by-topic\/[a-z0-9]+(?:-[a-z0-9]+)*\/README\.md$/u.test(relativePath)) {
+    throw new Error(`Unsafe managed portable catalog path: ${relativePath}`);
+  }
+}
+function assertManagedLocalLinkPath(relativePath) {
+  if (!/^by-topic\/[a-z0-9]+(?:-[a-z0-9]+)*\/[a-z0-9][a-z0-9._-]*\.asset-link$/u.test(relativePath)) {
+    throw new Error(`Unsafe managed local catalog link path: ${relativePath}`);
+  }
+}
+function resolveCatalogPath(root, relativePath) {
+  const absoluteRoot = resolve(root);
+  const absolutePath = resolve(absoluteRoot, ...normalizeRelativePath(relativePath).split("/"));
+  const back = normalizeRelativePath(relative2(absoluteRoot, absolutePath));
+  if (back === ".." || back.startsWith("../") || isAbsolute(back)) {
+    throw new Error(`Catalog path escapes its managed root: ${relativePath}`);
+  }
+  return absolutePath;
+}
+function assertCatalogPathParents(catalogRoot, relativePath) {
+  const absoluteRoot = resolve(catalogRoot);
+  let current = dirname2(resolveCatalogPath(catalogRoot, relativePath));
+  while (current !== absoluteRoot) {
+    if (existsSync3(current)) {
+      const stats = lstatSync(current);
+      if (!stats.isDirectory() || stats.isSymbolicLink()) {
+        throw new Error(
+          `Refusing to write through a non-directory catalog parent: ${normalizeRelativePath(relative2(absoluteRoot, current))}`
+        );
+      }
+    }
+    const parent = dirname2(current);
+    if (parent === current) throw new Error(`Catalog parent escapes its root: ${relativePath}`);
+    current = parent;
+  }
+}
+function pruneEmptyCatalogParents(catalogRoot, relativeDirectory) {
+  const absoluteRoot = resolve(catalogRoot);
+  let current = resolveCatalogPath(catalogRoot, relativeDirectory);
+  while (current !== absoluteRoot && existsSync3(current)) {
+    const stats = lstatSync(current);
+    if (!stats.isDirectory() || stats.isSymbolicLink() || readdirSync3(current).length > 0) return;
+    rmSync(current, { recursive: true, force: true });
+    current = dirname2(current);
+  }
+}
+function pathEntryExists(path) {
+  try {
+    lstatSync(path);
+    return true;
+  } catch (error) {
+    if (error.code === "ENOENT") return false;
+    throw error;
+  }
+}
+function removeTemporaryTree(path, warnings) {
+  try {
+    rmSync(path, { recursive: true, force: true, maxRetries: 5, retryDelay: 50 });
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    warnings.push(`temporary catalog cleanup pending (${path}): ${reason}`);
+  }
+}
+function findUncoveredSourcePaths(agentAssetsDir, entries, ignoredSourcePaths) {
+  const candidates = /* @__PURE__ */ new Set();
+  for (const filePath of listFiles2(join3(agentAssetsDir, "skills"))) {
+    if (basename(filePath) === "SKILL.md") {
+      candidates.add(normalizeRelativePath(relative2(agentAssetsDir, dirname2(filePath))));
+    }
+  }
+  for (const root of ["rules", "commands", "prompts"]) {
+    for (const filePath of listFiles2(join3(agentAssetsDir, root))) {
+      if (extname(filePath).toLowerCase() === ".md") {
+        candidates.add(normalizeRelativePath(relative2(agentAssetsDir, filePath)));
+      }
+    }
+  }
+  for (const filePath of listFiles2(join3(agentAssetsDir, "tooling"))) {
+    candidates.add(normalizeRelativePath(relative2(agentAssetsDir, filePath)));
+  }
+  return [...candidates].filter((candidate) => !isCoveredByAnySource(candidate, entries, ignoredSourcePaths)).sort();
+}
+function isCoveredByAnySource(candidate, entries, ignoredSourcePaths) {
+  const covers = (sourcePath) => candidate === sourcePath || candidate.startsWith(`${sourcePath}/`);
+  return entries.some((entry) => covers(entry.sourcePath)) || ignoredSourcePaths.some(covers);
+}
+function listFiles2(root) {
+  if (!existsSync3(root)) return [];
+  const stats = lstatSync(root);
+  if (stats.isSymbolicLink()) return [];
+  if (stats.isFile()) return [root];
+  const files = [];
+  for (const entry of readdirSync3(root, { withFileTypes: true })) {
+    if (ignoredTraversalNames.has(entry.name) || entry.name.startsWith("._")) continue;
+    const path = join3(root, entry.name);
+    if (entry.isDirectory()) files.push(...listFiles2(path));
+    else if (entry.isFile()) files.push(path);
+  }
+  return files.sort();
+}
+function readAssetDescription(sourceAbsolutePath, sourceType, fallback) {
+  const documentPath = sourceType === "directory" ? join3(sourceAbsolutePath, "SKILL.md") : sourceAbsolutePath;
+  if (!existsSync3(documentPath)) return fallback;
+  const text = readFileSync2(documentPath, "utf8");
+  const frontmatter = text.match(/^---\r?\n([\s\S]*?)\r?\n---/u)?.[1] ?? "";
+  const description = extractFrontmatterDescription(frontmatter);
+  if (description) return compactDescription(description, fallback);
+  const withoutFrontmatter = text.replace(/^---\r?\n[\s\S]*?\r?\n---\s*/u, "");
+  const paragraph = withoutFrontmatter.split(/\r?\n\r?\n/u).map((part) => part.replace(/\r?\n/g, " ").trim()).find((part) => part && !part.startsWith("#") && !part.startsWith("```"));
+  return compactDescription(paragraph ?? fallback, fallback);
+}
+function extractFrontmatterDescription(frontmatter) {
+  const lines = frontmatter.split(/\r?\n/u);
+  const index = lines.findIndex((line) => /^description\s*:/u.test(line));
+  if (index < 0) return void 0;
+  const inlineValue = lines[index].replace(/^description\s*:\s*/u, "").trim();
+  if (!/^[|>][+-]?$/u.test(inlineValue)) {
+    return inlineValue ? stripWrappingQuotes(inlineValue) : void 0;
+  }
+  const block = [];
+  for (const line of lines.slice(index + 1)) {
+    if (line.trim() && !/^\s/u.test(line)) break;
+    block.push(line.replace(/^\s+/u, "").trim());
+  }
+  const separator = inlineValue.startsWith("|") ? "\n" : " ";
+  const value = block.join(separator).trim();
+  return value || void 0;
+}
+function compactDescription(value, fallback) {
+  const compact = value.replace(/\[([^\]]+)]\([^)]*\)/g, "$1").replace(/[`*_>#]/g, "").replace(/\s+/g, " ").trim();
+  if (!compact) return fallback;
+  return compact.length > 220 ? `${compact.slice(0, 217)}...` : compact;
+}
+function stripWrappingQuotes(value) {
+  if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+    return value.slice(1, -1);
+  }
+  return value;
+}
+function resolveSafeSourcePath(agentAssetsDir, sourcePath, id) {
+  if (!isSafeSourcePath(sourcePath)) throw new Error(`Unsafe sourcePath for ${id}: ${sourcePath}`);
+  const absolutePath = resolve(agentAssetsDir, ...normalizeRelativePath(sourcePath).split("/"));
+  const relativePath = normalizeRelativePath(relative2(resolve(agentAssetsDir), absolutePath));
+  if (relativePath === ".." || relativePath.startsWith("../") || isAbsolute(relativePath)) {
+    throw new Error(`Source path escapes agent-assets for ${id}: ${sourcePath}`);
+  }
+  if (!existsSync3(absolutePath)) throw new Error(`Missing catalog source for ${id}: ${sourcePath}`);
+  return absolutePath;
+}
+function isSafeSourcePath(sourcePath) {
+  if (!sourcePath || isAbsolute(sourcePath) || sourcePath.includes("\\")) return false;
+  const normalized = normalizeRelativePath(sourcePath);
+  return normalized !== "." && normalized !== ".." && !normalized.startsWith("../");
+}
+function createBundleMembership(bundles) {
+  const membership = /* @__PURE__ */ new Map();
+  for (const bundle of bundles) {
+    for (const assetId of bundle.assets) {
+      membership.set(assetId, [...membership.get(assetId) ?? [], bundle.id]);
+    }
+  }
+  for (const [id, bundleIds] of membership) membership.set(id, uniqueSorted(bundleIds));
+  return membership;
+}
+function assertUniqueEntries(entries) {
+  const ids = /* @__PURE__ */ new Set();
+  for (const entry of entries) {
+    if (ids.has(entry.id)) throw new Error(`Duplicate catalog entry id: ${entry.id}`);
+    ids.add(entry.id);
+  }
+}
+function assertKnownTopics(id, topics, topicIds) {
+  for (const topic of topics) {
+    if (!topicIds.has(topic)) throw new Error(`Unknown topic ${topic} on catalog entry ${id}`);
+  }
+}
+function nativeLinkName(entry) {
+  const base = safePathSegment(entry.id.replace("/", "--"));
+  return `${base}.asset-link`;
+}
+function safePathSegment(value) {
+  const safe = value.normalize("NFKD").replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "").toLowerCase();
+  if (!safe || safe === "." || safe === "..")
+    throw new Error(`Unsafe catalog path segment: ${value}`);
+  return safe;
+}
+function normalizeRelativePath(path) {
+  return path.replaceAll("\\", "/");
+}
+function encodeRelativeHref(path) {
+  return normalizeRelativePath(path).split("/").map((part) => part === "." || part === ".." ? part : encodeURIComponent(part)).join("/");
+}
+function uniqueSorted(values) {
+  return [...new Set(values)].sort((left, right) => left.localeCompare(right));
+}
+function compareCatalogEntries(left, right) {
+  return `${left.family}:${left.title}:${left.id}`.localeCompare(
+    `${right.family}:${right.title}:${right.id}`
+  );
+}
+function escapeTable(value) {
+  return value.replaceAll("|", "\\|").replace(/\r?\n/g, " ");
+}
+function escapeHtml(value) {
+  return value.replace(/[&<>"']/g, (character) => {
+    const entities = {
+      "&": "&amp;",
+      "<": "&lt;",
+      ">": "&gt;",
+      '"': "&quot;",
+      "'": "&#39;"
+    };
+    return entities[character] ?? character;
+  });
+}
+function sha256(value) {
+  return `sha256:${createHash("sha256").update(value).digest("hex")}`;
+}
+
+// src/asset-npx/maintenance.ts
+import { createHash as createHash2 } from "node:crypto";
+import {
+  cpSync,
+  existsSync as existsSync4,
+  mkdirSync as mkdirSync2,
+  mkdtempSync as mkdtempSync2,
+  readdirSync as readdirSync4,
+  readFileSync as readFileSync3,
+  statSync as statSync2
+} from "node:fs";
+import { join as join4, relative as relative3 } from "node:path";
 import { tmpdir } from "node:os";
+
+// src/command-runner.ts
+import {
+  spawnSync
+} from "node:child_process";
+function spawnPlatformSync(command2, args, options) {
+  if (process.platform !== "win32") return spawnSync(command2, args, options);
+  const commandLine = [command2, ...args].map(quoteWindowsArgument).join(" ");
+  return spawnSync(process.env.ComSpec ?? "cmd.exe", ["/d", "/s", "/c", `"${commandLine}"`], {
+    ...options,
+    // The command line above is intentionally assembled for cmd.exe. Without
+    // this flag Node escapes its quotes before cmd.exe can parse them.
+    windowsVerbatimArguments: true
+  });
+}
+function quoteWindowsArgument(value) {
+  if (value.length === 0 || /[\s"&|<>^]/.test(value)) {
+    return `"${value.replace(/(\\*)"/g, '$1$1\\"').replace(/(\\*)$/, "$1$1")}"`;
+  }
+  return value;
+}
+
+// src/asset-npx/maintenance.ts
 function createNpxSkillsMaintenancePlan(options) {
   assertNativeNpxRoot(options.npxRoot);
   if (options.operation === "add" && !options.source) {
     throw new Error("npx skills add requires a source.");
   }
   const before = snapshotFiles(options.npxRoot);
-  const tempRoot = mkdtempSync(join3(tmpdir(), "pro-gov-npx-skills-"));
+  const tempRoot = mkdtempSync2(join4(tmpdir(), "pro-gov-npx-skills-"));
   cpSync(options.npxRoot, tempRoot, { recursive: true, dereference: false });
   const command2 = buildNpxCommand(options);
   const runner = options.runner ?? defaultRunner;
@@ -122,10 +1096,10 @@ ${stderr}`.replace(ansiEscape, "");
   }
 }
 function assertNativeNpxRoot(npxRoot) {
-  if (!existsSync3(join3(npxRoot, "skills-lock.json"))) {
+  if (!existsSync4(join4(npxRoot, "skills-lock.json"))) {
     throw new Error(`npx skills root is missing skills-lock.json: ${npxRoot}`);
   }
-  if (!existsSync3(join3(npxRoot, ".agents/skills"))) {
+  if (!existsSync4(join4(npxRoot, ".agents/skills"))) {
     throw new Error(`npx skills root is missing .agents/skills: ${npxRoot}`);
   }
 }
@@ -140,7 +1114,8 @@ function buildNpxCommand(options) {
   return command2;
 }
 function defaultRunner({ command: command2, cwd, timeoutMs }) {
-  const result = spawnSync(command2[0] ?? "npx", command2.slice(1), {
+  const commandName = command2[0] ?? "npx";
+  const result = spawnPlatformSync(commandName, command2.slice(1), {
     cwd,
     encoding: "utf8",
     timeout: timeoutMs
@@ -155,21 +1130,21 @@ function defaultRunner({ command: command2, cwd, timeoutMs }) {
 }
 function snapshotFiles(root) {
   const snapshot = /* @__PURE__ */ new Map();
-  for (const filePath of listFiles2(root)) {
-    const relativePath = toUnixPath2(relative2(root, filePath));
+  for (const filePath of listFiles3(root)) {
+    const relativePath = toUnixPath2(relative3(root, filePath));
     snapshot.set(relativePath, hashFile(filePath));
   }
   return snapshot;
 }
-function listFiles2(root) {
+function listFiles3(root) {
   const files = [];
   collectFiles(root, root, files);
   return files.sort();
 }
 function collectFiles(root, current, files) {
-  mkdirSync(root, { recursive: true });
-  for (const entry of readdirSync3(current, { withFileTypes: true })) {
-    const entryPath = join3(current, entry.name);
+  mkdirSync2(root, { recursive: true });
+  for (const entry of readdirSync4(current, { withFileTypes: true })) {
+    const entryPath = join4(current, entry.name);
     if (entry.isDirectory()) {
       collectFiles(root, entryPath, files);
     } else if (entry.isFile()) {
@@ -178,11 +1153,11 @@ function collectFiles(root, current, files) {
   }
 }
 function hashFile(path) {
-  const hash = createHash("sha256");
-  const stats = statSync(path);
+  const hash = createHash2("sha256");
+  const stats = statSync2(path);
   hash.update(String(stats.size));
   hash.update("\0");
-  hash.update(readFileSync2(path));
+  hash.update(readFileSync3(path));
   return hash.digest("hex");
 }
 function diffSnapshots(before, after) {
@@ -209,14 +1184,14 @@ function toUnixPath2(path) {
 }
 
 // src/asset-registry/loader.ts
-import { createHash as createHash2 } from "node:crypto";
-import { existsSync as existsSync5, readdirSync as readdirSync5, readFileSync as readFileSync3, statSync as statSync2 } from "node:fs";
-import { dirname as dirname2, join as join5, relative as relative4 } from "node:path";
+import { createHash as createHash3 } from "node:crypto";
+import { existsSync as existsSync6, readdirSync as readdirSync6, readFileSync as readFileSync4, statSync as statSync3 } from "node:fs";
+import { dirname as dirname3, join as join6, relative as relative5 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/asset-registry/registry.ts
-import { existsSync as existsSync4, lstatSync, readdirSync as readdirSync4, realpathSync } from "node:fs";
-import { isAbsolute, join as join4, posix, relative as relative3, sep } from "node:path";
+import { existsSync as existsSync5, lstatSync as lstatSync2, readdirSync as readdirSync5, realpathSync } from "node:fs";
+import { isAbsolute as isAbsolute2, join as join5, posix, relative as relative4, sep } from "node:path";
 var supportedFamilies = /* @__PURE__ */ new Set([
   "pie-skills",
   "npx-skills",
@@ -260,7 +1235,7 @@ function assetSkillInstallName(asset) {
   return asset.installName ?? posix.basename(asset.sourcePath);
 }
 function isValidAssetProjectTargetPath(kind, projectTargetPath) {
-  if (typeof projectTargetPath !== "string" || projectTargetPath.length === 0 || isAbsolute(projectTargetPath) || projectTargetPath.includes("\\")) {
+  if (typeof projectTargetPath !== "string" || projectTargetPath.length === 0 || isAbsolute2(projectTargetPath) || projectTargetPath.includes("\\")) {
     return false;
   }
   const segments = projectTargetPath.split("/");
@@ -416,11 +1391,11 @@ function validateAssetRegistry(registry, options = {}) {
       });
     }
     if (options.agentAssetsDir && isSafeRegistrySourcePath(asset.sourcePath)) {
-      const sourceAbsolutePath = join4(
+      const sourceAbsolutePath = join5(
         options.agentAssetsDir,
         normalizeRegistrySourcePath(asset.sourcePath)
       );
-      if (!existsSync4(sourceAbsolutePath)) {
+      if (!existsSync5(sourceAbsolutePath)) {
         issues.push({
           type: "missing-source-path",
           id: asset.id,
@@ -444,7 +1419,7 @@ function validateAssetRegistry(registry, options = {}) {
               message: `Local skill pack must contain .codex-plugin/plugin.json and at least one skills/*/SKILL.md: ${asset.sourcePath}`
             });
           }
-        } else if (!existsSync4(join4(sourceAbsolutePath, "SKILL.md"))) {
+        } else if (!existsSync5(join5(sourceAbsolutePath, "SKILL.md"))) {
           issues.push({
             type: "missing-skill-file",
             id: asset.id,
@@ -456,7 +1431,7 @@ function validateAssetRegistry(registry, options = {}) {
     }
   }
   if (options.agentAssetsDir) {
-    const npxCompatibilityLayer = join4(options.agentAssetsDir, "skills/npx-skills/skills");
+    const npxCompatibilityLayer = join5(options.agentAssetsDir, "skills/npx-skills/skills");
     if (pathExistsEvenIfDanglingSymlink(npxCompatibilityLayer)) {
       issues.push({
         type: "internal-npx-compatibility-layer",
@@ -469,20 +1444,20 @@ function validateAssetRegistry(registry, options = {}) {
   return issues;
 }
 function isLocalSkillPack(sourceAbsolutePath) {
-  const skillsRoot = join4(sourceAbsolutePath, "skills");
-  if (!existsSync4(join4(sourceAbsolutePath, ".codex-plugin/plugin.json")) || !existsSync4(skillsRoot)) {
+  const skillsRoot = join5(sourceAbsolutePath, "skills");
+  if (!existsSync5(join5(sourceAbsolutePath, ".codex-plugin/plugin.json")) || !existsSync5(skillsRoot)) {
     return false;
   }
   try {
-    return lstatSync(skillsRoot).isDirectory() && readdirSync4(skillsRoot, { withFileTypes: true }).some(
-      (entry) => entry.isDirectory() && existsSync4(join4(skillsRoot, entry.name, "SKILL.md"))
+    return lstatSync2(skillsRoot).isDirectory() && readdirSync5(skillsRoot, { withFileTypes: true }).some(
+      (entry) => entry.isDirectory() && existsSync5(join5(skillsRoot, entry.name, "SKILL.md"))
     );
   } catch {
     return false;
   }
 }
 function isSafeRegistrySourcePath(sourcePath) {
-  if (!sourcePath || isAbsolute(sourcePath) || sourcePath.startsWith("/")) return false;
+  if (!sourcePath || isAbsolute2(sourcePath) || sourcePath.startsWith("/")) return false;
   const normalized = normalizeRegistrySourcePath(sourcePath);
   if (normalized === "." || normalized.startsWith("../") || normalized === "..") return false;
   return !normalized.split("/").includes("..");
@@ -494,15 +1469,15 @@ function isWithinAgentAssetsDir(agentAssetsDir, sourceAbsolutePath) {
   try {
     const agentAssetsRealPath = realpathSync(agentAssetsDir);
     const sourceRealPath = realpathSync(sourceAbsolutePath);
-    const relativePath = relative3(agentAssetsRealPath, sourceRealPath);
-    return relativePath === "" || relativePath !== ".." && !relativePath.startsWith(`..${sep}`) && !isAbsolute(relativePath);
+    const relativePath = relative4(agentAssetsRealPath, sourceRealPath);
+    return relativePath === "" || relativePath !== ".." && !relativePath.startsWith(`..${sep}`) && !isAbsolute2(relativePath);
   } catch {
     return false;
   }
 }
 function pathExistsEvenIfDanglingSymlink(path) {
   try {
-    lstatSync(path);
+    lstatSync2(path);
     return true;
   } catch {
     return false;
@@ -519,7 +1494,7 @@ function createAgentAssetRegistryProvenance(registry, selectedAssetIds) {
       (left, right) => left.id < right.id ? -1 : left.id > right.id ? 1 : 0
     )
   });
-  const hash = createHash2("sha256").update(JSON.stringify(canonicalRegistry)).digest("hex");
+  const hash = createHash3("sha256").update(JSON.stringify(canonicalRegistry)).digest("hex");
   return {
     schema: "agent-assets-registry",
     version: registry.schemaVersion,
@@ -529,8 +1504,8 @@ function createAgentAssetRegistryProvenance(registry, selectedAssetIds) {
 }
 function loadAgentAssetRegistry(options = {}) {
   const agentAssetsDir = options.agentAssetsDir ?? findDefaultAgentAssetsDir();
-  const registryPath = join5(agentAssetsDir, "registry.json");
-  if (!existsSync5(registryPath)) {
+  const registryPath = join6(agentAssetsDir, "registry.json");
+  if (!existsSync6(registryPath)) {
     return {
       registry: { schemaVersion: 1, assets: [] },
       agentAssetsDir,
@@ -538,7 +1513,7 @@ function loadAgentAssetRegistry(options = {}) {
       issues: []
     };
   }
-  const registry = JSON.parse(readFileSync3(registryPath, "utf8"));
+  const registry = JSON.parse(readFileSync4(registryPath, "utf8"));
   return {
     registry,
     agentAssetsDir,
@@ -556,15 +1531,15 @@ function createAgentAssetLockEntries(registry, agentAssetsDir, assetIds) {
   })).sort((a, b) => a.id.localeCompare(b.id));
 }
 function hashAgentAssetContent(asset, agentAssetsDir) {
-  return hashAssetPathContent(join5(agentAssetsDir, asset.sourcePath));
+  return hashAssetPathContent(join6(agentAssetsDir, asset.sourcePath));
 }
 function hashAssetPathContent(sourceAbsolutePath) {
-  const hash = createHash2("sha256");
-  for (const filePath of listFiles3(sourceAbsolutePath)) {
-    const relativePath = toUnixPath3(relative4(sourceAbsolutePath, filePath));
+  const hash = createHash3("sha256");
+  for (const filePath of listFiles4(sourceAbsolutePath)) {
+    const relativePath = toUnixPath3(relative5(sourceAbsolutePath, filePath));
     hash.update(relativePath);
     hash.update("\0");
-    hash.update(readFileSync3(filePath));
+    hash.update(readFileSync4(filePath));
     hash.update("\0");
   }
   return `sha256:${hash.digest("hex")}`;
@@ -579,40 +1554,40 @@ function canonicalizeValue(value) {
   return value;
 }
 function findDefaultAgentAssetsDir() {
-  const packageRoot2 = findPackageRoot(dirname2(fileURLToPath2(import.meta.url)));
-  const repoRoot = join5(packageRoot2, "..", "..");
+  const packageRoot2 = findPackageRoot(dirname3(fileURLToPath2(import.meta.url)));
+  const repoRoot = join6(packageRoot2, "..", "..");
   const candidates = [
-    join5(packageRoot2, "assets/agent-assets"),
-    join5(repoRoot, "agent-assets"),
-    join5(packageRoot2, "assets/public-agent-assets"),
-    join5(repoRoot, "public-agent-assets")
+    join6(packageRoot2, "assets/agent-assets"),
+    join6(repoRoot, "agent-assets"),
+    join6(packageRoot2, "assets/public-agent-assets"),
+    join6(repoRoot, "public-agent-assets")
   ];
-  return candidates.find((candidate) => existsSync5(join5(candidate, "registry.json"))) ?? candidates[0];
+  return candidates.find((candidate) => existsSync6(join6(candidate, "registry.json"))) ?? candidates[0];
 }
 function findPackageRoot(startDir) {
   let current = startDir;
-  while (current !== dirname2(current)) {
-    const packageJsonPath = join5(current, "package.json");
-    if (existsSync5(packageJsonPath)) {
+  while (current !== dirname3(current)) {
+    const packageJsonPath = join6(current, "package.json");
+    if (existsSync6(packageJsonPath)) {
       try {
-        const packageJson = JSON.parse(readFileSync3(packageJsonPath, "utf8"));
+        const packageJson = JSON.parse(readFileSync4(packageJsonPath, "utf8"));
         if (packageJson.name === "@pieai/pro-gov") return current;
       } catch {
       }
     }
-    current = dirname2(current);
+    current = dirname3(current);
   }
   return startDir;
 }
-function listFiles3(absolutePath) {
-  const stats = statSync2(absolutePath);
+function listFiles4(absolutePath) {
+  const stats = statSync3(absolutePath);
   if (stats.isFile()) return [absolutePath];
   const files = [];
-  for (const entry of readdirSync5(absolutePath, { withFileTypes: true })) {
+  for (const entry of readdirSync6(absolutePath, { withFileTypes: true })) {
     if (shouldIgnoreAssetHashEntry(entry.name)) continue;
-    const entryPath = join5(absolutePath, entry.name);
+    const entryPath = join6(absolutePath, entry.name);
     if (entry.isDirectory()) {
-      files.push(...listFiles3(entryPath));
+      files.push(...listFiles4(entryPath));
     } else if (entry.isFile()) {
       files.push(entryPath);
     }
@@ -627,8 +1602,8 @@ function toUnixPath3(path) {
 }
 
 // src/asset-registry/public-promotion.ts
-import { existsSync as existsSync6 } from "node:fs";
-import { isAbsolute as isAbsolute2, join as join6, posix as posix2 } from "node:path";
+import { existsSync as existsSync7 } from "node:fs";
+import { isAbsolute as isAbsolute3, join as join7, posix as posix2 } from "node:path";
 function checkPublicAssetPromotions(options) {
   const issues = [];
   let checked = 0;
@@ -666,7 +1641,7 @@ function checkPublicAssetPromotions(options) {
       });
       continue;
     }
-    if (!existsSync6(privatePathResult.path)) {
+    if (!existsSync7(privatePathResult.path)) {
       issues.push({
         type: "missing-private-source",
         id: asset.id,
@@ -686,7 +1661,7 @@ function checkPublicAssetPromotions(options) {
         });
       }
     }
-    if (!existsSync6(publicPathResult.path)) {
+    if (!existsSync7(publicPathResult.path)) {
       issues.push({
         type: "missing-public-source",
         id: asset.id,
@@ -713,32 +1688,39 @@ function needsPromotionCheck(asset) {
   return asset.visibility === "public" && asset.publishable;
 }
 function resolveSafePath(root, sourcePath) {
-  if (!sourcePath || isAbsolute2(sourcePath) || sourcePath.startsWith("/")) return { ok: false };
+  if (!sourcePath || isAbsolute3(sourcePath) || sourcePath.startsWith("/")) return { ok: false };
   const normalized = posix2.normalize(sourcePath.replaceAll("\\", "/"));
   if (normalized === "." || normalized === ".." || normalized.startsWith("../")) {
     return { ok: false };
   }
   if (normalized.split("/").includes("..")) return { ok: false };
-  return { ok: true, path: join6(root, normalized) };
+  return { ok: true, path: join7(root, normalized) };
 }
 
 // src/asset-targets/apply.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 import {
-  existsSync as existsSync8,
-  lstatSync as lstatSync3,
-  mkdirSync as mkdirSync2,
+  existsSync as existsSync9,
+  lstatSync as lstatSync4,
+  mkdirSync as mkdirSync3,
   readlinkSync as readlinkSync2,
   realpathSync as realpathSync3,
-  symlinkSync,
+  symlinkSync as symlinkSync2,
   unlinkSync,
-  writeFileSync
+  writeFileSync as writeFileSync2
 } from "node:fs";
-import { dirname as dirname4, join as join8, relative as relative5, resolve as resolve2 } from "node:path";
+import { dirname as dirname5, join as join9, relative as relative6, resolve as resolve3 } from "node:path";
+
+// src/asset-targets/install-plan.ts
+import { existsSync as existsSync8, lstatSync as lstatSync3, readFileSync as readFileSync5, readlinkSync, realpathSync as realpathSync2, statSync as statSync4 } from "node:fs";
+import { basename as basename2, dirname as dirname4, join as join8, resolve as resolve2 } from "node:path";
+
+// src/symlinks.ts
+function normalizeSymlinkTarget(target) {
+  return target.replaceAll("\\", "/");
+}
 
 // src/asset-targets/install-plan.ts
-import { existsSync as existsSync7, lstatSync as lstatSync2, readFileSync as readFileSync4, readlinkSync, realpathSync as realpathSync2, statSync as statSync3 } from "node:fs";
-import { basename, dirname as dirname3, join as join7, resolve } from "node:path";
 function createAssetInstallPlan(options) {
   const placement = options.placement ?? "registry";
   const assetsById = new Map(options.registry.assets.map((asset) => [asset.id, asset]));
@@ -858,9 +1840,9 @@ function createAssetAction(asset, agentAssetsDir, targetDir, host, placement, ma
       `User-scoped asset ${asset.id} must be linked at the user level, not installed into a project target.`
     );
   }
-  const sourcePath = join7(agentAssetsDir, asset.sourcePath);
+  const sourcePath = join8(agentAssetsDir, asset.sourcePath);
   const targetPath = resolveHostTargetPath(asset, host, placement);
-  const targetAbsolutePath = join7(targetDir, targetPath);
+  const targetAbsolutePath = join8(targetDir, targetPath);
   const targetExists = pathExistsEvenIfDanglingSymlink2(targetAbsolutePath);
   const managedEntry = managedEntries.find(
     (entry) => entry.id === asset.id && entry.targetPath === targetPath
@@ -877,7 +1859,7 @@ function createAssetAction(asset, agentAssetsDir, targetDir, host, placement, ma
     });
   }
   if (targetExists) {
-    const stats = lstatSync2(targetAbsolutePath);
+    const stats = lstatSync3(targetAbsolutePath);
     if (stats.isSymbolicLink() && managedEntry && (managedEntry.delivery ?? "symlink") === "symlink") {
       return {
         type: "update-symlink",
@@ -889,7 +1871,7 @@ function createAssetAction(asset, agentAssetsDir, targetDir, host, placement, ma
     if (managedEntry && managedEntry.delivery === "snapshot") {
       throw new Error(`Refusing to replace managed snapshot with a symlink: ${targetPath}`);
     }
-    if (stats.isSymbolicLink() && existsSync7(targetAbsolutePath) && realpathSync2(targetAbsolutePath) === realpathSync2(sourcePath)) {
+    if (stats.isSymbolicLink() && existsSync8(targetAbsolutePath) && realpathSync2(targetAbsolutePath) === realpathSync2(sourcePath)) {
       return {
         type: "adopt-existing-symlink",
         assetId: asset.id,
@@ -912,10 +1894,10 @@ function createSnapshotAction(options) {
       `Snapshot delivery requires a rule target under docs/policy/shared-rules/: ${options.asset.id}`
     );
   }
-  if (!statSync3(options.sourcePath).isFile()) {
+  if (!statSync4(options.sourcePath).isFile()) {
     throw new Error(`Snapshot source must be a regular file: ${options.asset.sourcePath}`);
   }
-  const content = readFileSync4(options.sourcePath);
+  const content = readFileSync5(options.sourcePath);
   const contentBase64 = content.toString("base64");
   const contentHash = hashAgentAssetContent(options.asset, options.agentAssetsDir);
   const managedDelivery = options.managedEntry?.delivery ?? "symlink";
@@ -928,9 +1910,9 @@ function createSnapshotAction(options) {
       contentHash
     };
   }
-  const stats = lstatSync2(options.targetAbsolutePath);
+  const stats = lstatSync3(options.targetAbsolutePath);
   if (stats.isSymbolicLink()) {
-    if (existsSync7(options.targetAbsolutePath) && realpathSync2(options.targetAbsolutePath) === realpathSync2(options.sourcePath) && hashAssetPathContent(options.targetAbsolutePath) === contentHash) {
+    if (existsSync8(options.targetAbsolutePath) && realpathSync2(options.targetAbsolutePath) === realpathSync2(options.sourcePath) && hashAssetPathContent(options.targetAbsolutePath) === contentHash) {
       return {
         type: "migrate-symlink-to-snapshot",
         assetId: options.asset.id,
@@ -986,9 +1968,9 @@ function resolveHostTargetPath(asset, _host, placement) {
     return `.agents/skills/${assetSkillInstallName(asset)}`;
   }
   if (asset.kind === "rule") {
-    return `.pro-gov/agent-assets/rules/${basename(asset.sourcePath)}`;
+    return `.pro-gov/agent-assets/rules/${basename2(asset.sourcePath)}`;
   }
-  return `.pro-gov/agent-assets/commands/${basename(asset.sourcePath)}`;
+  return `.pro-gov/agent-assets/commands/${basename2(asset.sourcePath)}`;
 }
 function resolveSkillPlacement(asset, placement) {
   if (placement !== "registry") return placement;
@@ -998,16 +1980,16 @@ function createDirectoryActions(actions) {
   const directories = /* @__PURE__ */ new Set();
   for (const action of actions) {
     if (action.type === "create-dir") continue;
-    const directory = dirname3(action.targetPath);
+    const directory = dirname4(action.targetPath);
     if (directory !== ".") directories.add(directory);
   }
   return [...directories].sort().map((targetPath) => ({ type: "create-dir", targetPath }));
 }
 function readManagedLock(targetDir) {
-  const lockfilePath = join7(targetDir, ".pro-gov/assets.lock.json");
-  if (!existsSync7(lockfilePath)) return { entries: [] };
+  const lockfilePath = join8(targetDir, ".pro-gov/assets.lock.json");
+  if (!existsSync8(lockfilePath)) return { entries: [] };
   try {
-    const lockfile = JSON.parse(readFileSync4(lockfilePath, "utf8"));
+    const lockfile = JSON.parse(readFileSync5(lockfilePath, "utf8"));
     return {
       host: typeof lockfile.host === "string" ? lockfile.host : void 0,
       entries: (lockfile.assets ?? []).filter(
@@ -1045,10 +2027,10 @@ function createLegacyClaudeAdoptions(options) {
       throw new Error(`Legacy Claude lock entry cannot be safely normalized: ${entry.targetPath}`);
     }
     const targetPath = `.agents/skills/${skillName}`;
-    const targetAbsolutePath = join7(options.targetDir, targetPath);
-    const compatibilityRootPath = join7(options.targetDir, ".claude/skills");
-    const canonicalRootPath = join7(options.targetDir, ".agents/skills");
-    if (!lstatSync2(canonicalRootPath).isDirectory() || !lstatSync2(compatibilityRootPath).isSymbolicLink() || readlinkSync(compatibilityRootPath) !== "../.agents/skills" || realpathSync2(compatibilityRootPath) !== realpathSync2(canonicalRootPath)) {
+    const targetAbsolutePath = join8(options.targetDir, targetPath);
+    const compatibilityRootPath = join8(options.targetDir, ".claude/skills");
+    const canonicalRootPath = join8(options.targetDir, ".agents/skills");
+    if (!lstatSync3(canonicalRootPath).isDirectory() || !lstatSync3(compatibilityRootPath).isSymbolicLink() || normalizeSymlinkTarget(readlinkSync(compatibilityRootPath)) !== "../.agents/skills" || realpathSync2(compatibilityRootPath) !== realpathSync2(canonicalRootPath)) {
       throw new Error(
         `Legacy Claude compatibility root is not the exact canonical alias for ${entry.id}.`
       );
@@ -1057,10 +2039,10 @@ function createLegacyClaudeAdoptions(options) {
       consumedTargetPaths.add(entry.targetPath);
       continue;
     }
-    const targetStat = lstatSync2(targetAbsolutePath);
-    const legacyAbsolutePath = join7(options.targetDir, entry.targetPath);
-    const legacyStat = lstatSync2(legacyAbsolutePath);
-    const expectedSourcePath = join7(options.agentAssetsDir, entry.sourcePath);
+    const targetStat = lstatSync3(targetAbsolutePath);
+    const legacyAbsolutePath = join8(options.targetDir, entry.targetPath);
+    const legacyStat = lstatSync3(legacyAbsolutePath);
+    const expectedSourcePath = join8(options.agentAssetsDir, entry.sourcePath);
     if (!targetStat.isSymbolicLink() || !legacyStat.isSymbolicLink() || targetStat.dev !== legacyStat.dev || targetStat.ino !== legacyStat.ino || realpathSync2(targetAbsolutePath) !== realpathSync2(expectedSourcePath)) {
       throw new Error(`Legacy Claude skill target cannot be safely adopted: ${entry.targetPath}`);
     }
@@ -1090,9 +2072,9 @@ function createRemovalActions(targetDir, agentAssetsDir, managedEntries, expecte
         `Refusing to remove managed asset outside supported roots: ${entry.targetPath}`
       );
     }
-    const targetAbsolutePath = join7(targetDir, entry.targetPath);
+    const targetAbsolutePath = join8(targetDir, entry.targetPath);
     if (!pathExistsEvenIfDanglingSymlink2(targetAbsolutePath)) continue;
-    const stats = lstatSync2(targetAbsolutePath);
+    const stats = lstatSync3(targetAbsolutePath);
     if ((entry.delivery ?? "symlink") === "snapshot") {
       if (!isValidSnapshotProjectTargetPath(entry.targetPath)) {
         throw new Error(
@@ -1121,9 +2103,9 @@ function createRemovalActions(targetDir, agentAssetsDir, managedEntries, expecte
         `Refusing to remove path that is no longer a managed symlink: ${entry.targetPath}`
       );
     }
-    const expectedSourcePath = join7(agentAssetsDir, entry.sourcePath);
-    const actualSourcePath = resolve(dirname3(targetAbsolutePath), readlinkSync(targetAbsolutePath));
-    if (actualSourcePath !== resolve(expectedSourcePath)) {
+    const expectedSourcePath = join8(agentAssetsDir, entry.sourcePath);
+    const actualSourcePath = resolve2(dirname4(targetAbsolutePath), readlinkSync(targetAbsolutePath));
+    if (actualSourcePath !== resolve2(expectedSourcePath)) {
       throw new Error(
         `Refusing to remove managed symlink with changed target: ${entry.targetPath}`
       );
@@ -1147,7 +2129,7 @@ function isLegacyClaudeSkillTargetPath(path) {
 }
 function pathExistsEvenIfDanglingSymlink2(path) {
   try {
-    lstatSync2(path);
+    lstatSync3(path);
     return true;
   } catch {
     return false;
@@ -1171,7 +2153,7 @@ function applyAssetInstallPlan(plan) {
   return { appliedActions };
 }
 function applyAction(targetDir, action) {
-  const targetAbsolutePath = join8(targetDir, action.targetPath);
+  const targetAbsolutePath = join9(targetDir, action.targetPath);
   if (action.type === "remove-symlink") {
     removeManagedSymlink(targetAbsolutePath, action);
     return;
@@ -1182,41 +2164,41 @@ function applyAction(targetDir, action) {
     return;
   }
   if (action.type === "create-dir") {
-    mkdirSync2(targetAbsolutePath, { recursive: true });
+    mkdirSync3(targetAbsolutePath, { recursive: true });
     return;
   }
   if (action.type === "write-file") {
-    mkdirSync2(dirname4(targetAbsolutePath), { recursive: true });
-    writeFileSync(targetAbsolutePath, action.content);
+    mkdirSync3(dirname5(targetAbsolutePath), { recursive: true });
+    writeFileSync2(targetAbsolutePath, action.content);
     return;
   }
-  mkdirSync2(dirname4(targetAbsolutePath), { recursive: true });
-  const sourceAbsolutePath = resolve2(action.sourcePath);
-  const symlinkTarget = relative5(realpathSync3(dirname4(targetAbsolutePath)), realpathSync3(sourceAbsolutePath)) || ".";
+  mkdirSync3(dirname5(targetAbsolutePath), { recursive: true });
+  const sourceAbsolutePath = resolve3(action.sourcePath);
+  const symlinkTarget = relative6(realpathSync3(dirname5(targetAbsolutePath)), realpathSync3(sourceAbsolutePath)) || ".";
   if (action.type === "symlink") {
     if (pathExistsEvenIfDanglingSymlink3(targetAbsolutePath)) {
       throw new Error(`Refusing to overwrite unmanaged target: ${action.targetPath}`);
     }
-    symlinkSync(symlinkTarget, targetAbsolutePath);
+    symlinkSync2(symlinkTarget, targetAbsolutePath);
     return;
   }
   if (!pathExistsEvenIfDanglingSymlink3(targetAbsolutePath)) {
-    symlinkSync(symlinkTarget, targetAbsolutePath);
+    symlinkSync2(symlinkTarget, targetAbsolutePath);
     return;
   }
-  const stats = lstatSync3(targetAbsolutePath);
+  const stats = lstatSync4(targetAbsolutePath);
   if (!stats.isSymbolicLink()) {
     throw new Error(`Refusing to overwrite unmanaged target: ${action.targetPath}`);
   }
   unlinkSync(targetAbsolutePath);
-  symlinkSync(symlinkTarget, targetAbsolutePath);
+  symlinkSync2(symlinkTarget, targetAbsolutePath);
 }
 function validateExistingSymlink(targetDir, action) {
   if (!isManagedAssetTargetPath(action.targetPath)) {
     throw new Error(`Refusing unsafe existing symlink adoption: ${action.targetPath}`);
   }
-  const targetAbsolutePath = join8(targetDir, action.targetPath);
-  if (!lstatSync3(targetAbsolutePath).isSymbolicLink() || realpathSync3(targetAbsolutePath) !== realpathSync3(action.sourcePath)) {
+  const targetAbsolutePath = join9(targetDir, action.targetPath);
+  if (!lstatSync4(targetAbsolutePath).isSymbolicLink() || realpathSync3(targetAbsolutePath) !== realpathSync3(action.sourcePath)) {
     throw new Error(`Existing skill symlink changed before apply: ${action.targetPath}`);
   }
 }
@@ -1227,7 +2209,7 @@ function validateSnapshotAction(targetDir, action) {
   if ("contentBase64" in action && hashSnapshotBytes(Buffer.from(action.contentBase64, "base64")) !== action.contentHash) {
     throw new Error(`Snapshot content hash is invalid: ${action.targetPath}`);
   }
-  const targetAbsolutePath = join8(targetDir, action.targetPath);
+  const targetAbsolutePath = join9(targetDir, action.targetPath);
   if (action.type === "snapshot") {
     if (pathExistsEvenIfDanglingSymlink3(targetAbsolutePath)) {
       throw new Error(`Snapshot target changed before apply: ${action.targetPath}`);
@@ -1243,7 +2225,7 @@ function validateSnapshotAction(targetDir, action) {
     return;
   }
   if (action.type === "migrate-symlink-to-snapshot") {
-    if (!pathExistsEvenIfDanglingSymlink3(targetAbsolutePath) || !lstatSync3(targetAbsolutePath).isSymbolicLink() || !existsSync8(targetAbsolutePath) || realpathSync3(targetAbsolutePath) !== realpathSync3(action.sourcePath) || hashAssetPathContent(targetAbsolutePath) !== action.contentHash) {
+    if (!pathExistsEvenIfDanglingSymlink3(targetAbsolutePath) || !lstatSync4(targetAbsolutePath).isSymbolicLink() || !existsSync9(targetAbsolutePath) || realpathSync3(targetAbsolutePath) !== realpathSync3(action.sourcePath) || hashAssetPathContent(targetAbsolutePath) !== action.contentHash) {
       throw new Error(`Snapshot symlink changed before apply: ${action.targetPath}`);
     }
     return;
@@ -1251,30 +2233,30 @@ function validateSnapshotAction(targetDir, action) {
   assertRegularSnapshotHash(targetAbsolutePath, action.expectedContentHash, action.targetPath);
 }
 function applySnapshotAction(targetDir, action) {
-  const targetAbsolutePath = join8(targetDir, action.targetPath);
+  const targetAbsolutePath = join9(targetDir, action.targetPath);
   if (action.type === "adopt-snapshot") return;
   if (action.type === "remove-snapshot") {
     unlinkSync(targetAbsolutePath);
     return;
   }
   if (action.type === "migrate-symlink-to-snapshot") unlinkSync(targetAbsolutePath);
-  mkdirSync2(dirname4(targetAbsolutePath), { recursive: true });
+  mkdirSync3(dirname5(targetAbsolutePath), { recursive: true });
   if (action.type === "snapshot" && pathExistsEvenIfDanglingSymlink3(targetAbsolutePath)) {
     throw new Error(`Refusing to overwrite unmanaged target: ${action.targetPath}`);
   }
-  writeFileSync(targetAbsolutePath, Buffer.from(action.contentBase64, "base64"));
+  writeFileSync2(targetAbsolutePath, Buffer.from(action.contentBase64, "base64"));
 }
 function assertRegularSnapshotHash(targetAbsolutePath, expectedHash, targetPath) {
   if (!pathExistsEvenIfDanglingSymlink3(targetAbsolutePath)) {
     throw new Error(`Snapshot target changed before apply: ${targetPath}`);
   }
-  const stats = lstatSync3(targetAbsolutePath);
+  const stats = lstatSync4(targetAbsolutePath);
   if (!stats.isFile() || hashAssetPathContent(targetAbsolutePath) !== expectedHash) {
     throw new Error(`Snapshot target hash changed before apply: ${targetPath}`);
   }
 }
 function hashSnapshotBytes(content) {
-  const hash = createHash3("sha256");
+  const hash = createHash4("sha256");
   hash.update("");
   hash.update("\0");
   hash.update(content);
@@ -1285,17 +2267,17 @@ function validateAdoptedSymlink(targetDir, action) {
   if (!isManagedAssetTargetPath(action.targetPath) || !isLegacyClaudeSkillTargetPath(action.legacyTargetPath) || action.compatibilityRootPath !== ".claude/skills" || action.expectedCompatibilityRawTarget !== "../.agents/skills") {
     throw new Error(`Refusing unsafe legacy Claude adoption: ${action.legacyTargetPath}`);
   }
-  const canonicalRootPath = join8(targetDir, ".agents/skills");
-  const compatibilityRootPath = join8(targetDir, action.compatibilityRootPath);
-  const targetAbsolutePath = join8(targetDir, action.targetPath);
-  const legacyAbsolutePath = join8(targetDir, action.legacyTargetPath);
-  if (!lstatSync3(canonicalRootPath).isDirectory() || !lstatSync3(compatibilityRootPath).isSymbolicLink() || readlinkSync2(compatibilityRootPath) !== action.expectedCompatibilityRawTarget || realpathSync3(compatibilityRootPath) !== realpathSync3(canonicalRootPath)) {
+  const canonicalRootPath = join9(targetDir, ".agents/skills");
+  const compatibilityRootPath = join9(targetDir, action.compatibilityRootPath);
+  const targetAbsolutePath = join9(targetDir, action.targetPath);
+  const legacyAbsolutePath = join9(targetDir, action.legacyTargetPath);
+  if (!lstatSync4(canonicalRootPath).isDirectory() || !lstatSync4(compatibilityRootPath).isSymbolicLink() || normalizeSymlinkTarget(readlinkSync2(compatibilityRootPath)) !== action.expectedCompatibilityRawTarget || realpathSync3(compatibilityRootPath) !== realpathSync3(canonicalRootPath)) {
     throw new Error(
       `Legacy Claude compatibility alias changed before apply: ${action.compatibilityRootPath}`
     );
   }
-  const targetStat = lstatSync3(targetAbsolutePath);
-  const legacyStat = lstatSync3(legacyAbsolutePath);
+  const targetStat = lstatSync4(targetAbsolutePath);
+  const legacyStat = lstatSync4(legacyAbsolutePath);
   if (!targetStat.isSymbolicLink() || !legacyStat.isSymbolicLink() || targetStat.dev !== legacyStat.dev || targetStat.ino !== legacyStat.ino || targetStat.dev !== action.expectedDevice || targetStat.ino !== action.expectedInode || realpathSync3(targetAbsolutePath) !== realpathSync3(action.sourcePath)) {
     throw new Error(`Legacy Claude skill target changed before apply: ${action.targetPath}`);
   }
@@ -1307,33 +2289,33 @@ function removeManagedSymlink(targetAbsolutePath, action) {
     );
   }
   if (!pathExistsEvenIfDanglingSymlink3(targetAbsolutePath)) return;
-  const stats = lstatSync3(targetAbsolutePath);
+  const stats = lstatSync4(targetAbsolutePath);
   if (!stats.isSymbolicLink()) {
     throw new Error(
       `Refusing to remove path that is no longer a managed symlink: ${action.targetPath}`
     );
   }
-  const actualSourcePath = resolve2(dirname4(targetAbsolutePath), readlinkSync2(targetAbsolutePath));
-  if (actualSourcePath !== resolve2(action.expectedSourcePath)) {
+  const actualSourcePath = resolve3(dirname5(targetAbsolutePath), readlinkSync2(targetAbsolutePath));
+  if (actualSourcePath !== resolve3(action.expectedSourcePath)) {
     throw new Error(`Refusing to remove managed symlink with changed target: ${action.targetPath}`);
   }
   unlinkSync(targetAbsolutePath);
 }
 function pathExistsEvenIfDanglingSymlink3(path) {
   try {
-    lstatSync3(path);
+    lstatSync4(path);
     return true;
   } catch {
-    return existsSync8(path);
+    return existsSync9(path);
   }
 }
 
 // src/asset-targets/check.ts
-import { existsSync as existsSync9, lstatSync as lstatSync4, readFileSync as readFileSync5, realpathSync as realpathSync4 } from "node:fs";
-import { join as join9 } from "node:path";
+import { existsSync as existsSync10, lstatSync as lstatSync5, readFileSync as readFileSync6, realpathSync as realpathSync4 } from "node:fs";
+import { join as join10 } from "node:path";
 function checkInstalledAssets(options) {
-  const lockfilePath = join9(options.targetDir, ".pro-gov/assets.lock.json");
-  if (!existsSync9(lockfilePath)) {
+  const lockfilePath = join10(options.targetDir, ".pro-gov/assets.lock.json");
+  if (!existsSync10(lockfilePath)) {
     return {
       targetDir: options.targetDir,
       issues: [
@@ -1345,7 +2327,7 @@ function checkInstalledAssets(options) {
     };
   }
   const registryById = new Map(options.registry.assets.map((asset) => [asset.id, asset]));
-  const lockfile = JSON.parse(readFileSync5(lockfilePath, "utf8"));
+  const lockfile = JSON.parse(readFileSync6(lockfilePath, "utf8"));
   const issues = [];
   const strictRegistry = options.strictRegistry ?? false;
   const selectedAssetIds = (lockfile.assets ?? []).map((entry) => entry.id);
@@ -1374,7 +2356,7 @@ function checkInstalledAssets(options) {
       continue;
     }
     const asset = registryById.get(entry.id);
-    const targetAbsolutePath = join9(options.targetDir, entry.targetPath);
+    const targetAbsolutePath = join10(options.targetDir, entry.targetPath);
     const delivery = entry.delivery ?? "symlink";
     const portableDeferredSkill = delivery === "symlink" && !strictRegistry && isProjectSkillTarget(entry.targetPath);
     if (delivery !== "symlink" && delivery !== "snapshot") {
@@ -1436,7 +2418,7 @@ function checkInstalledAssets(options) {
       });
       continue;
     }
-    const targetStats = lstatSync4(targetAbsolutePath);
+    const targetStats = lstatSync5(targetAbsolutePath);
     if (delivery === "snapshot" && !targetStats.isFile()) {
       issues.push({
         type: "snapshot-not-regular-file",
@@ -1455,7 +2437,7 @@ function checkInstalledAssets(options) {
       });
       continue;
     }
-    if (delivery === "symlink" && !existsSync9(targetAbsolutePath)) {
+    if (delivery === "symlink" && !existsSync10(targetAbsolutePath)) {
       if (portableDeferredSkill) continue;
       issues.push({
         type: "dangling-symlink",
@@ -1476,8 +2458,8 @@ function checkInstalledAssets(options) {
       });
     }
     if (!asset || !strictRegistry || registryProvenanceMismatch) continue;
-    const sourceAbsolutePath = join9(options.agentAssetsDir, asset.sourcePath);
-    if (!existsSync9(sourceAbsolutePath)) {
+    const sourceAbsolutePath = join10(options.agentAssetsDir, asset.sourcePath);
+    if (!existsSync10(sourceAbsolutePath)) {
       issues.push({
         type: "missing-source",
         id: entry.id,
@@ -1541,7 +2523,7 @@ function checkDuplicateSkillPlacements(targetDir, registry) {
     const skillName = assetSkillInstallName(asset);
     const autoPath = `.agents/skills/${skillName}`;
     const manualPath = `.agents/manual-skills/${skillName}`;
-    if (pathExistsEvenIfDanglingSymlink4(join9(targetDir, autoPath)) && pathExistsEvenIfDanglingSymlink4(join9(targetDir, manualPath))) {
+    if (pathExistsEvenIfDanglingSymlink4(join10(targetDir, autoPath)) && pathExistsEvenIfDanglingSymlink4(join10(targetDir, manualPath))) {
       issues.push({
         type: "duplicate-skill-placement",
         id: asset.id,
@@ -1587,7 +2569,7 @@ function expectedRegistrySkillTargetPath(host, skillName, placement) {
 }
 function pathExistsEvenIfDanglingSymlink4(path) {
   try {
-    lstatSync4(path);
+    lstatSync5(path);
     return true;
   } catch {
     return false;
@@ -1598,8 +2580,8 @@ function isProjectSkillTarget(targetPath) {
 }
 
 // src/asset-targets/recommend.ts
-import { existsSync as existsSync10, readdirSync as readdirSync6, readFileSync as readFileSync6 } from "node:fs";
-import { join as join10 } from "node:path";
+import { existsSync as existsSync11, readdirSync as readdirSync7, readFileSync as readFileSync7 } from "node:fs";
+import { join as join11 } from "node:path";
 var frontendPackages = /* @__PURE__ */ new Set([
   "@vitejs/plugin-react",
   "astro",
@@ -1613,21 +2595,21 @@ var frontendPackages = /* @__PURE__ */ new Set([
 ]);
 var agentEntryCandidates = ["AGENTS.md", "CLAUDE.md"];
 function discoverTargetSignals(targetDir) {
-  const packageJson = readJson(join10(targetDir, "package.json"));
+  const packageJson = readJson(join11(targetDir, "package.json"));
   const dependencyNames = packageJson ? Object.keys({ ...packageJson.dependencies, ...packageJson.devDependencies }) : [];
   const frontendSignals = dependencyNames.filter((name) => frontendPackages.has(name)).sort();
-  const hasAgentEntry = agentEntryCandidates.some((file) => existsSync10(join10(targetDir, file)));
+  const hasAgentEntry = agentEntryCandidates.some((file) => existsSync11(join11(targetDir, file)));
   const researchSignals = [
-    existsSync10(join10(targetDir, "docs/research")) ? "docs/research" : "",
-    existsSync10(join10(targetDir, "research")) ? "research" : "",
+    existsSync11(join11(targetDir, "docs/research")) ? "docs/research" : "",
+    existsSync11(join11(targetDir, "research")) ? "research" : "",
     hasBookChildDirectory(targetDir, "research") ? "books/*/research" : "",
-    textFileIncludes(join10(targetDir, "README.md"), ["research", "\u8C03\u7814"]) ? "README research" : ""
+    textFileIncludes(join11(targetDir, "README.md"), ["research", "\u8C03\u7814"]) ? "README research" : ""
   ].filter(Boolean);
   const writingSignals = [
-    existsSync10(join10(targetDir, "chapters")) ? "chapters" : "",
-    existsSync10(join10(targetDir, "src/chapters")) ? "src/chapters" : "",
+    existsSync11(join11(targetDir, "chapters")) ? "chapters" : "",
+    existsSync11(join11(targetDir, "src/chapters")) ? "src/chapters" : "",
     hasBookChildDirectory(targetDir, "chapters") ? "books/*/chapters" : "",
-    textFileIncludes(join10(targetDir, "AGENTS.md"), [
+    textFileIncludes(join11(targetDir, "AGENTS.md"), [
       "writing mode",
       "novel chapter",
       "book content"
@@ -1672,24 +2654,24 @@ function recommendBundlesForTarget(targetDir) {
   return recommendations;
 }
 function readJson(path) {
-  if (!existsSync10(path)) return void 0;
+  if (!existsSync11(path)) return void 0;
   try {
-    return JSON.parse(readFileSync6(path, "utf8"));
+    return JSON.parse(readFileSync7(path, "utf8"));
   } catch {
     return void 0;
   }
 }
 function textFileIncludes(path, needles) {
-  if (!existsSync10(path)) return false;
-  const contents = readFileSync6(path, "utf8").toLowerCase();
+  if (!existsSync11(path)) return false;
+  const contents = readFileSync7(path, "utf8").toLowerCase();
   return needles.some((needle) => contents.includes(needle.toLowerCase()));
 }
 function hasBookChildDirectory(targetDir, childName) {
-  const booksDir = join10(targetDir, "books");
-  if (!existsSync10(booksDir)) return false;
+  const booksDir = join11(targetDir, "books");
+  if (!existsSync11(booksDir)) return false;
   try {
-    return readdirSync6(booksDir, { withFileTypes: true }).some(
-      (entry) => entry.isDirectory() && existsSync10(join10(booksDir, entry.name, childName))
+    return readdirSync7(booksDir, { withFileTypes: true }).some(
+      (entry) => entry.isDirectory() && existsSync11(join11(booksDir, entry.name, childName))
     );
   } catch {
     return false;
@@ -1723,9 +2705,67 @@ function runAssets(args) {
   if (subcommand2 === "npx") {
     return runAssetsNpx(rest);
   }
+  if (subcommand2 === "catalog") {
+    return runAssetsCatalog(rest);
+  }
   printUsage();
   return 1;
 }
+function runAssetsCatalog(args) {
+  const [operation, ...rest] = args;
+  if (!operation || operation === "--help" || operation === "-h") {
+    printCatalogUsage();
+    return operation ? 0 : 1;
+  }
+  if (operation !== "build" && operation !== "check") {
+    printCatalogUsage();
+    return 1;
+  }
+  const options = parseCatalogOptions(operation, rest);
+  if (!options.ok) {
+    console.error(options.error);
+    printCatalogUsage();
+    return 1;
+  }
+  try {
+    const loaded = loadAgentAssetRegistry(
+      options.value.agentAssetsDir ? { agentAssetsDir: options.value.agentAssetsDir } : void 0
+    );
+    if (loaded.issues.length > 0) {
+      for (const issue of loaded.issues) console.error(`${issue.type}: ${issue.message}`);
+      return 1;
+    }
+    const catalogRoot = options.value.catalogRoot ?? join12(loaded.agentAssetsDir, "#catalogs");
+    const common = {
+      agentAssetsDir: loaded.agentAssetsDir,
+      catalogRoot,
+      registry: loaded.registry,
+      bundles: loadAgentAssetBundles(loaded.agentAssetsDir)
+    };
+    if (operation === "check") {
+      const result2 = checkAssetCatalog(common);
+      if (options.value.json) console.log(JSON.stringify(result2, null, 2));
+      else if (result2.issues.length === 0)
+        console.log(`asset catalog check passed (${result2.assetCount} assets)`);
+      else for (const issue of result2.issues) console.log(issue);
+      return result2.issues.length === 0 ? 0 : 1;
+    }
+    const result = buildAssetCatalog({ ...common, nativeLinks: options.value.nativeLinks });
+    if (options.value.json) console.log(JSON.stringify(result, null, 2));
+    else {
+      console.log(`catalog: ${result.catalogRoot}`);
+      console.log(`assets: ${result.assetCount}`);
+      console.log(`topics: ${result.topicCount}`);
+      console.log(`portable-files: ${result.portableFileCount}`);
+      console.log(`native-links: ${result.nativeLinkCount}`);
+      for (const warning of result.warnings) console.warn(`warning: ${warning}`);
+    }
+    return 0;
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    return 1;
+  }
+}
 function runAssetsPublicCheck(args) {
   const options = parsePublicCheckOptions(args);
   if (!options.ok) {
@@ -1805,7 +2845,7 @@ function runAssetsApply(args) {
     return 1;
   }
   try {
-    const plan = JSON.parse(readFileSync7(options.value.planPath, "utf8"));
+    const plan = JSON.parse(readFileSync8(options.value.planPath, "utf8"));
     const result = applyAssetInstallPlan(plan);
     console.log(`applied-actions: ${result.appliedActions.length}`);
     return 0;
@@ -1930,8 +2970,8 @@ function runAssetsPlan(args) {
       console.log("dry-run: true");
     }
     if (options.value.outPath) {
-      mkdirSync3(dirname5(options.value.outPath), { recursive: true });
-      writeFileSync2(options.value.outPath, `${JSON.stringify(plan, null, 2)}
+      mkdirSync4(dirname6(options.value.outPath), { recursive: true });
+      writeFileSync3(options.value.outPath, `${JSON.stringify(plan, null, 2)}
 `);
       if (!options.value.json) {
         console.log(`plan: ${options.value.outPath}`);
@@ -1943,6 +2983,33 @@ function runAssetsPlan(args) {
     return 1;
   }
 }
+function parseCatalogOptions(operation, args) {
+  const options = { nativeLinks: false, json: false };
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === "--agent-assets") {
+      const value = args[index + 1];
+      if (!value) return { ok: false, error: "Expected --agent-assets <path>" };
+      options.agentAssetsDir = value;
+      index += 1;
+    } else if (arg === "--catalog-root") {
+      const value = args[index + 1];
+      if (!value) return { ok: false, error: "Expected --catalog-root <path>" };
+      options.catalogRoot = value;
+      index += 1;
+    } else if (arg === "--native-links") {
+      if (operation !== "build") {
+        return { ok: false, error: "--native-links is only valid with assets catalog build" };
+      }
+      options.nativeLinks = true;
+    } else if (arg === "--json") {
+      options.json = true;
+    } else {
+      return { ok: false, error: `Unknown assets catalog option: ${arg}` };
+    }
+  }
+  return { ok: true, value: options };
+}
 function parseListOptions(args) {
   const options = {
     json: false,
@@ -2129,10 +3196,10 @@ function parsePublicCheckOptions(args) {
       return { ok: false, error: `Unknown assets public-check option: ${arg}` };
     }
   }
-  if (!existsSync11(options.publicRoot)) {
+  if (!existsSync12(options.publicRoot)) {
     return { ok: false, error: `Public agent assets root does not exist: ${options.publicRoot}` };
   }
-  if (!existsSync11(options.privateRoot)) {
+  if (!existsSync12(options.privateRoot)) {
     return { ok: false, error: `Private agent assets root does not exist: ${options.privateRoot}` };
   }
   return { ok: true, value: options };
@@ -2141,13 +3208,13 @@ function getDefaultPublicCheckRoots() {
   const defaultRegistryRoot = loadAgentAssetRegistry().agentAssetsDir;
   if (defaultRegistryRoot.endsWith("public-agent-assets")) {
     return {
-      privateRoot: join11(dirname5(defaultRegistryRoot), "agent-assets"),
+      privateRoot: join12(dirname6(defaultRegistryRoot), "agent-assets"),
       publicRoot: defaultRegistryRoot
     };
   }
   return {
     privateRoot: defaultRegistryRoot,
-    publicRoot: join11(dirname5(defaultRegistryRoot), "public-agent-assets")
+    publicRoot: join12(dirname6(defaultRegistryRoot), "public-agent-assets")
   };
 }
 function listRegistryAssets(options) {
@@ -2208,6 +3275,9 @@ function printUsage() {
   );
   console.error("  pro-gov assets npx add <source> [--skill <name>] --plan [--root <path>]");
   console.error("  pro-gov assets npx update [--skill <name>] --plan [--root <path>]");
+  console.error(
+    "  pro-gov assets catalog build|check [--agent-assets <path>] [--catalog-root <path>] [--native-links] [--json]"
+  );
 }
 function printNpxUsage() {
   console.log("Usage: pro-gov assets npx add <source> [--skill <name>] --plan [--root <path>]");
@@ -2215,12 +3285,19 @@ function printNpxUsage() {
   console.log("");
   console.log("Runs npx skills only in a temporary copy and prints a reviewable plan.");
 }
+function printCatalogUsage() {
+  console.log(
+    "Usage: pro-gov assets catalog build [--agent-assets <path>] [--catalog-root <path>] [--native-links] [--json]"
+  );
+  console.log(
+    "Usage: pro-gov assets catalog check [--agent-assets <path>] [--catalog-root <path>] [--json]"
+  );
+}
 
 // src/commands/doctor.ts
-import { spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync12 } from "node:fs";
+import { existsSync as existsSync13 } from "node:fs";
 import { createRequire } from "node:module";
-import { dirname as dirname6, join as join12 } from "node:path";
+import { dirname as dirname7, join as join13 } from "node:path";
 var REQUIRED_ASSETS = [
   "starter/.agents/skills/.gitkeep",
   "starter/AGENTS.template.md",
@@ -2252,10 +3329,12 @@ function runDoctor(args) {
   return runPackageDoctor(args);
 }
 function checkDocGov(options = {}) {
-  const run = options.run ?? ((command2, args) => spawnSync2(command2, args, {
-    encoding: "utf8",
-    stdio: "ignore"
-  }));
+  const run = options.run ?? ((command2, args) => {
+    return spawnPlatformSync(command2, args, {
+      encoding: "utf8",
+      stdio: "ignore"
+    });
+  });
   const dependencyCli = (options.resolveDependencyCli ?? resolveDocGovDependencyCli)();
   if (!dependencyCli) {
     const fromPath = run("doc-gov", ["--help"]);
@@ -2283,16 +3362,16 @@ function resolveDocGovDependencyCli() {
   try {
     const require2 = createRequire(import.meta.url);
     const packageJsonPath = require2.resolve("@pieai/doc-gov/package.json");
-    const cliPath = join12(dirname6(packageJsonPath), "dist/cli.js");
-    return existsSync12(cliPath) ? cliPath : null;
+    const cliPath = join13(dirname7(packageJsonPath), "dist/cli.js");
+    return existsSync13(cliPath) ? cliPath : null;
   } catch {
     return null;
   }
 }
 
 // src/commands/init.ts
-import { lstatSync as lstatSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync8, symlinkSync as symlinkSync2, writeFileSync as writeFileSync3 } from "node:fs";
-import { basename as basename2, dirname as dirname7, join as join13 } from "node:path";
+import { lstatSync as lstatSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync9, symlinkSync as symlinkSync3, writeFileSync as writeFileSync4 } from "node:fs";
+import { basename as basename3, dirname as dirname8, join as join14 } from "node:path";
 
 // src/commands/shared.ts
 function planStarterFiles(profile) {
@@ -2379,7 +3458,7 @@ function runInit(args) {
 function applyStarterFiles(files, profile) {
   const root = process.cwd();
   const conflicts = files.filter((file) => {
-    const targetPath = join13(root, file.targetPath);
+    const targetPath = join14(root, file.targetPath);
     const stat = safeLstat(targetPath);
     if (!stat) return false;
     return file.kind !== "directory" || !stat.isDirectory();
@@ -2391,19 +3470,19 @@ function applyStarterFiles(files, profile) {
     return 1;
   }
   for (const file of files) {
-    const targetPath = join13(root, file.targetPath);
-    mkdirSync4(dirname7(targetPath), { recursive: true });
+    const targetPath = join14(root, file.targetPath);
+    mkdirSync5(dirname8(targetPath), { recursive: true });
     if (file.kind === "directory") {
-      mkdirSync4(targetPath, { recursive: true });
+      mkdirSync5(targetPath, { recursive: true });
       continue;
     }
     if (file.kind === "symlink") {
-      symlinkSync2(file.linkTarget, targetPath);
+      symlinkSync3(file.linkTarget, targetPath);
       continue;
     }
-    const source = readFileSync8(file.absoluteSourcePath);
-    const content = file.targetPath === "AGENTS.md" ? renderAgentsTemplate(source.toString("utf8"), basename2(root), profile) : source;
-    writeFileSync3(targetPath, content);
+    const source = readFileSync9(file.absoluteSourcePath);
+    const content = file.targetPath === "AGENTS.md" ? renderAgentsTemplate(source.toString("utf8"), basename3(root), profile) : source;
+    writeFileSync4(targetPath, content);
   }
   console.log("pro-gov init APPLIED");
   console.log(`profile: ${profile}`);
@@ -2420,7 +3499,7 @@ function renderAgentsTemplate(template, projectName, profile) {
 }
 function safeLstat(path) {
   try {
-    return lstatSync5(path);
+    return lstatSync6(path);
   } catch {
     return void 0;
   }
@@ -2434,22 +3513,22 @@ function readFlag(args, flag) {
 }
 
 // src/commands/host-lens.ts
-import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync5 } from "node:fs";
-import { dirname as dirname10, resolve as resolve5 } from "node:path";
+import { mkdirSync as mkdirSync7, writeFileSync as writeFileSync6 } from "node:fs";
+import { dirname as dirname11, resolve as resolve6 } from "node:path";
 
 // src/host-lens.ts
 import { execFileSync } from "node:child_process";
 import {
   cpSync as cpSync2,
-  existsSync as existsSync13,
-  lstatSync as lstatSync6,
-  mkdirSync as mkdirSync5,
-  readdirSync as readdirSync7,
-  statSync as statSync4,
-  writeFileSync as writeFileSync4
+  existsSync as existsSync14,
+  lstatSync as lstatSync7,
+  mkdirSync as mkdirSync6,
+  readdirSync as readdirSync8,
+  statSync as statSync5,
+  writeFileSync as writeFileSync5
 } from "node:fs";
 import { homedir } from "node:os";
-import { dirname as dirname8, join as join14, relative as relative6, resolve as resolve3 } from "node:path";
+import { dirname as dirname9, join as join15, relative as relative7, resolve as resolve4 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 var ROOT_DEFINITIONS = [
   {
@@ -2504,36 +3583,36 @@ var ROOT_DEFINITIONS = [
   {
     id: "pnpm-store",
     label: "pnpm Store",
-    relativePath: "Library/pnpm/store",
+    relativePath: process.platform === "win32" ? "AppData/Local/pnpm/store" : "Library/pnpm/store",
     kind: "package-cache",
     note: "pnpm \u5185\u5BB9\u5BFB\u5740\u4ED3\u5E93\uFF1B\u6E05\u7406\u65F6\u53EA\u5EFA\u8BAE pnpm store prune\u3002"
   },
   {
     id: "playwright",
     label: "Playwright \u6D4F\u89C8\u5668",
-    relativePath: "Library/Caches/ms-playwright",
+    relativePath: process.platform === "win32" ? "AppData/Local/ms-playwright" : "Library/Caches/ms-playwright",
     kind: "browser-cache",
     note: "\u6D4B\u8BD5\u6D4F\u89C8\u5668\u4E8C\u8FDB\u5236\u7F13\u5B58\uFF1B\u7248\u672C\u5806\u79EF\u53EF\u80FD\u9020\u6210\u663E\u8457\u78C1\u76D8\u5360\u7528\u3002"
   },
   {
     id: "claude-desktop",
     label: "Claude Desktop",
-    relativePath: "Library/Application Support/Claude",
+    relativePath: process.platform === "win32" ? "AppData/Roaming/Claude" : "Library/Application Support/Claude",
     kind: "ai-host",
     note: "\u684C\u9762\u5E94\u7528\u8FD0\u884C\u6570\u636E\uFF0C\u9ED8\u8BA4\u53D7\u4FDD\u62A4\u3002"
   },
   {
     id: "cursor-desktop",
     label: "Cursor Desktop",
-    relativePath: "Library/Application Support/Cursor",
+    relativePath: process.platform === "win32" ? "AppData/Roaming/Cursor" : "Library/Application Support/Cursor",
     kind: "ai-host",
     note: "\u684C\u9762\u5E94\u7528\u8FD0\u884C\u6570\u636E\uFF0C\u9ED8\u8BA4\u53D7\u4FDD\u62A4\u3002"
   }
 ];
 function inspectHost(options = {}) {
-  const homePath = resolve3(options.homeDir ?? homedir());
+  const homePath = resolve4(options.homeDir ?? homedir());
   const now = options.now ?? /* @__PURE__ */ new Date();
-  const rootPaths = ROOT_DEFINITIONS.map((definition) => join14(homePath, definition.relativePath));
+  const rootPaths = ROOT_DEFINITIONS.map((definition) => join15(homePath, definition.relativePath));
   const rootSizes = measurePaths(rootPaths);
   const findings = inspectFindings(homePath);
   const rootFindingIds = /* @__PURE__ */ new Map();
@@ -2550,7 +3629,7 @@ function inspectHost(options = {}) {
       label: definition.label,
       path: displayPath(path, homePath),
       kind: definition.kind,
-      exists: existsSync13(path),
+      exists: existsSync14(path),
       bytes: rootSizes.get(path) ?? 0,
       status: rootFindings.length > 0 ? "attention" : "healthy",
       note: definition.note
@@ -2593,7 +3672,7 @@ function inspectHost(options = {}) {
 function inspectAgentBrowser(options) {
   const command2 = options.command ?? "agent-browser";
   try {
-    const output = execFileSync(command2, ["--version"], {
+    const result = spawnPlatformSync(command2, ["--version"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"],
       // Host scans can run alongside the full portfolio test matrix. Keep the
@@ -2601,7 +3680,9 @@ function inspectAgentBrowser(options) {
       // spawn the pinned CLI instead of misclassifying a slow start as an
       // unparseable version.
       timeout: 1e4
-    }).trim();
+    });
+    if (result.error || result.status !== 0) throw result.error ?? new Error("command failed");
+    const output = result.stdout.trim();
     const installedVersion = output.match(/(?:^|\s)(\d+\.\d+\.\d+)(?:\s|$)/)?.[1];
     if (!installedVersion) {
       return {
@@ -2655,25 +3736,25 @@ function createHostLensCleanupPlan(report) {
   };
 }
 function writeHostLensReport(report, outDir) {
-  mkdirSync5(outDir, { recursive: true });
+  mkdirSync6(outDir, { recursive: true });
   const assets = findHostDashboardAssets();
   for (const file of ["index.html", "app.js", "app.css"]) {
-    const source = join14(assets, file);
-    if (!existsSync13(source)) throw new Error(`HostLens dashboard asset is missing: ${source}`);
-    cpSync2(source, join14(outDir, file));
+    const source = join15(assets, file);
+    if (!existsSync14(source)) throw new Error(`HostLens dashboard asset is missing: ${source}`);
+    cpSync2(source, join15(outDir, file));
   }
-  const jsonPath = join14(outDir, "host-lens.json");
-  const htmlPath = join14(outDir, "index.html");
-  writeFileSync4(jsonPath, `${JSON.stringify(report, null, 2)}
+  const jsonPath = join15(outDir, "host-lens.json");
+  const htmlPath = join15(outDir, "index.html");
+  writeFileSync5(jsonPath, `${JSON.stringify(report, null, 2)}
 `);
-  writeFileSync4(join14(outDir, "data.js"), `window.__HOST_LENS__ = ${safeJavaScriptJson(report)};
+  writeFileSync5(join15(outDir, "data.js"), `window.__HOST_LENS__ = ${safeJavaScriptJson(report)};
 `);
   return { jsonPath, htmlPath };
 }
 function inspectFindings(homePath) {
   const candidates = [];
   const addGroup = (value) => {
-    const paths = value.paths.filter((path) => existsSync13(path));
+    const paths = value.paths.filter((path) => existsSync14(path));
     if (paths.length === 0) return;
     candidates.push({ ...value, paths: paths.map((path) => displayPath(path, homePath)) });
   };
@@ -2681,7 +3762,7 @@ function inspectFindings(homePath) {
     id: "codex-backups",
     rootId: "codex",
     label: "Codex \u5386\u53F2\u5907\u4EFD",
-    paths: matchingChildren(join14(homePath, ".codex"), (name) => /^backup-/i.test(name)),
+    paths: matchingChildren(join15(homePath, ".codex"), (name) => /^backup-/i.test(name)),
     category: "backup",
     confidence: "medium",
     disposition: "manual-review",
@@ -2692,7 +3773,7 @@ function inspectFindings(homePath) {
     id: "codex-cache",
     rootId: "codex",
     label: "Codex \u53EF\u518D\u751F\u6210\u7F13\u5B58",
-    paths: [join14(homePath, ".codex/cache")],
+    paths: [join15(homePath, ".codex/cache")],
     category: "cache",
     confidence: "high",
     disposition: "report-only",
@@ -2703,7 +3784,7 @@ function inspectFindings(homePath) {
     id: "claude-temporary",
     rootId: "claude-code",
     label: "Claude Code \u4E34\u65F6\u76EE\u5F55",
-    paths: matchingChildren(join14(homePath, ".claude"), (name) => /^(temp|tmp)[-_]/i.test(name)),
+    paths: matchingChildren(join15(homePath, ".claude"), (name) => /^(temp|tmp)[-_]/i.test(name)),
     category: "temporary",
     confidence: "high",
     disposition: "manual-review",
@@ -2714,7 +3795,7 @@ function inspectFindings(homePath) {
     id: "claude-cache",
     rootId: "claude-code",
     label: "Claude Code \u7F13\u5B58",
-    paths: [join14(homePath, ".claude/cache")],
+    paths: [join15(homePath, ".claude/cache")],
     category: "cache",
     confidence: "high",
     disposition: "report-only",
@@ -2725,7 +3806,7 @@ function inspectFindings(homePath) {
     id: "copilot-session-history",
     rootId: "copilot",
     label: "Copilot \u4F1A\u8BDD\u72B6\u6001",
-    paths: [join14(homePath, ".copilot/session-state")],
+    paths: [join15(homePath, ".copilot/session-state")],
     category: "session-history",
     confidence: "low",
     disposition: "manual-review",
@@ -2736,7 +3817,7 @@ function inspectFindings(homePath) {
     id: "npm-npx-cache",
     rootId: "npm-cache",
     label: "npx \u4E34\u65F6\u5B89\u88C5\u7F13\u5B58",
-    paths: [join14(homePath, ".npm/_npx")],
+    paths: [join15(homePath, ".npm/_npx")],
     category: "cache",
     confidence: "high",
     disposition: "native-tool",
@@ -2748,7 +3829,7 @@ function inspectFindings(homePath) {
     id: "npm-content-cache",
     rootId: "npm-cache",
     label: "npm \u5185\u5BB9\u7F13\u5B58",
-    paths: [join14(homePath, ".npm/_cacache")],
+    paths: [join15(homePath, ".npm/_cacache")],
     category: "cache",
     confidence: "high",
     disposition: "native-tool",
@@ -2760,7 +3841,12 @@ function inspectFindings(homePath) {
     id: "pnpm-store",
     rootId: "pnpm-store",
     label: "pnpm \u672A\u5F15\u7528\u5305\u5019\u9009",
-    paths: [join14(homePath, "Library/pnpm/store")],
+    paths: [
+      join15(
+        homePath,
+        process.platform === "win32" ? "AppData/Local/pnpm/store" : "Library/pnpm/store"
+      )
+    ],
     category: "cache",
     confidence: "high",
     disposition: "native-tool",
@@ -2772,7 +3858,13 @@ function inspectFindings(homePath) {
     id: "playwright-browsers",
     rootId: "playwright",
     label: "Playwright \u6D4F\u89C8\u5668\u7248\u672C",
-    paths: [join14(homePath, "Library/Caches/ms-playwright"), join14(homePath, ".cache/ms-playwright")],
+    paths: [
+      join15(
+        homePath,
+        process.platform === "win32" ? "AppData/Local/ms-playwright" : "Library/Caches/ms-playwright"
+      ),
+      join15(homePath, ".cache/ms-playwright")
+    ],
     category: "duplicate-runtime",
     confidence: "medium",
     disposition: "native-tool",
@@ -2794,6 +3886,8 @@ function inspectFindings(homePath) {
   });
 }
 function buildProtections(homePath) {
+  const claudeDesktopPath = process.platform === "win32" ? "~/AppData/Roaming/Claude" : "~/Library/Application Support/Claude";
+  const cursorDesktopPath = process.platform === "win32" ? "~/AppData/Roaming/Cursor" : "~/Library/Application Support/Cursor";
   return [
     {
       label: "\u914D\u7F6E\u4E0E\u8EAB\u4EFD\u8FB9\u754C",
@@ -2812,7 +3906,7 @@ function buildProtections(homePath) {
     },
     {
       label: "\u684C\u9762\u5BBF\u4E3B\u8FD0\u884C\u6570\u636E",
-      paths: ["~/Library/Application Support/Claude", "~/Library/Application Support/Cursor"],
+      paths: [claudeDesktopPath, cursorDesktopPath],
       reason: "\u5E94\u7528\u6570\u636E\u5E93\u4E0E\u8FD0\u884C\u72B6\u6001\u6DF7\u5728\u5176\u4E2D\uFF0C\u4E0D\u80FD\u628A\u6574\u4E2A\u76EE\u5F55\u5F53\u7F13\u5B58\u3002"
     }
   ].map((protection) => ({
@@ -2821,16 +3915,16 @@ function buildProtections(homePath) {
   }));
 }
 function matchingChildren(root, predicate) {
-  if (!existsSync13(root)) return [];
+  if (!existsSync14(root)) return [];
   try {
-    return readdirSync7(root, { withFileTypes: true }).filter((entry) => predicate(entry.name)).map((entry) => join14(root, entry.name));
+    return readdirSync8(root, { withFileTypes: true }).filter((entry) => predicate(entry.name)).map((entry) => join15(root, entry.name));
   } catch {
     return [];
   }
 }
 function measurePaths(paths) {
-  const uniquePaths = [...new Set(paths.map((path) => resolve3(path)))].filter(
-    (path) => existsSync13(path)
+  const uniquePaths = [...new Set(paths.map((path) => resolve4(path)))].filter(
+    (path) => existsSync14(path)
   );
   const result = /* @__PURE__ */ new Map();
   if (uniquePaths.length === 0) return result;
@@ -2843,7 +3937,7 @@ function measurePaths(paths) {
     for (const line of output.split(/\r?\n/)) {
       const match = line.match(/^(\d+)\s+(.+)$/);
       if (!match) continue;
-      result.set(resolve3(match[2]), Number(match[1]) * 1024);
+      result.set(resolve4(match[2]), Number(match[1]) * 1024);
     }
     return result;
   } catch {
@@ -2853,7 +3947,7 @@ function measurePaths(paths) {
 }
 function fallbackMeasure(root) {
   try {
-    const rootStats = lstatSync6(root);
+    const rootStats = lstatSync7(root);
     if (!rootStats.isDirectory()) return rootStats.size;
   } catch {
     return 0;
@@ -2866,17 +3960,17 @@ function fallbackMeasure(root) {
     if (!current) continue;
     let entries;
     try {
-      entries = readdirSync7(current, { withFileTypes: true });
+      entries = readdirSync8(current, { withFileTypes: true });
     } catch {
       continue;
     }
     for (const entry of entries) {
       visited += 1;
-      const path = join14(current, entry.name);
+      const path = join15(current, entry.name);
       if (entry.isDirectory()) pending.push(path);
       else if (entry.isFile()) {
         try {
-          bytes += statSync4(path).size;
+          bytes += statSync5(path).size;
         } catch {
         }
       }
@@ -2887,35 +3981,35 @@ function fallbackMeasure(root) {
 }
 function countImmediateEntries(path) {
   try {
-    return lstatSync6(path).isDirectory() ? readdirSync7(path).length : 1;
+    return lstatSync7(path).isDirectory() ? readdirSync8(path).length : 1;
   } catch {
     return 0;
   }
 }
 function displayPath(path, homePath) {
-  const absolute = resolve3(path);
-  const withinHome = relative6(homePath, absolute);
+  const absolute = resolve4(path);
+  const withinHome = relative7(homePath, absolute);
   if (withinHome === "") return "~";
-  if (!withinHome.startsWith("..")) return `~/${withinHome}`;
+  if (!withinHome.startsWith("..")) return `~/${withinHome.replaceAll("\\", "/")}`;
   return absolute;
 }
 function undisplayPath(path, homePath) {
   if (path === "~") return homePath;
-  if (path.startsWith("~/")) return join14(homePath, path.slice(2));
-  return resolve3(path);
+  if (path.startsWith("~/")) return join15(homePath, path.slice(2));
+  return resolve4(path);
 }
 function findHostDashboardAssets() {
-  const packageRoot2 = dirname8(dirname8(fileURLToPath3(import.meta.url)));
+  const packageRoot2 = dirname9(dirname9(fileURLToPath3(import.meta.url)));
   const candidates = [
     process.env.PGS_HOST_DASHBOARD_ASSETS_DIR,
-    join14(packageRoot2, ".host-dashboard-build"),
-    join14(packageRoot2, "assets/host-dashboard"),
-    join14(process.cwd(), ".host-dashboard-build"),
-    join14(process.cwd(), "assets/host-dashboard"),
-    join14(process.cwd(), "packages/pro-gov/.host-dashboard-build"),
-    join14(process.cwd(), "packages/pro-gov/assets/host-dashboard")
+    join15(packageRoot2, ".host-dashboard-build"),
+    join15(packageRoot2, "assets/host-dashboard"),
+    join15(process.cwd(), ".host-dashboard-build"),
+    join15(process.cwd(), "assets/host-dashboard"),
+    join15(process.cwd(), "packages/pro-gov/.host-dashboard-build"),
+    join15(process.cwd(), "packages/pro-gov/assets/host-dashboard")
   ].filter((value) => Boolean(value));
-  const match = candidates.find((path) => existsSync13(join14(path, "index.html")));
+  const match = candidates.find((path) => existsSync14(join15(path, "index.html")));
   if (!match)
     throw new Error(
       "HostLens dashboard assets were not built. Run pnpm --filter @pieai/pro-gov build."
@@ -2927,12 +4021,12 @@ function safeJavaScriptJson(value) {
 }
 
 // src/portfolio/manifest.ts
-import { existsSync as existsSync14, readFileSync as readFileSync9 } from "node:fs";
-import { dirname as dirname9, isAbsolute as isAbsolute3, resolve as resolve4 } from "node:path";
+import { existsSync as existsSync15, readFileSync as readFileSync10 } from "node:fs";
+import { dirname as dirname10, isAbsolute as isAbsolute4, resolve as resolve5 } from "node:path";
 function loadPortfolioManifest(configPath) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync9(configPath, "utf8"));
+    parsed = JSON.parse(readFileSync10(configPath, "utf8"));
   } catch (error) {
     return {
       configPath,
@@ -2944,7 +4038,7 @@ function loadPortfolioManifest(configPath) {
       ]
     };
   }
-  const normalized = resolveManifestPaths(parsed, dirname9(resolve4(configPath)));
+  const normalized = resolveManifestPaths(parsed, dirname10(resolve5(configPath)));
   const issues = validatePortfolioManifest(normalized);
   return {
     configPath,
@@ -2955,16 +4049,16 @@ function loadPortfolioManifest(configPath) {
 function resolveManifestPaths(value, configDir) {
   if (!isRecord(value)) return value;
   const resolveEndpoint = (endpoint) => {
-    if (!isRecord(endpoint) || typeof endpoint.path !== "string" || isAbsolute3(endpoint.path)) {
+    if (!isRecord(endpoint) || typeof endpoint.path !== "string" || isAbsolute4(endpoint.path)) {
       return endpoint;
     }
-    return { ...endpoint, path: resolve4(configDir, endpoint.path) };
+    return { ...endpoint, path: resolve5(configDir, endpoint.path) };
   };
   return {
     ...value,
-    technologyGovernance: isRecord(value.technologyGovernance) && typeof value.technologyGovernance.strategySource === "string" && !isAbsolute3(value.technologyGovernance.strategySource) ? {
+    technologyGovernance: isRecord(value.technologyGovernance) && typeof value.technologyGovernance.strategySource === "string" && !isAbsolute4(value.technologyGovernance.strategySource) ? {
       ...value.technologyGovernance,
-      strategySource: resolve4(configDir, value.technologyGovernance.strategySource)
+      strategySource: resolve5(configDir, value.technologyGovernance.strategySource)
     } : value.technologyGovernance,
     controlPlane: resolveEndpoint(value.controlPlane),
     executionEngine: resolveEndpoint(value.executionEngine),
@@ -3149,7 +4243,7 @@ function validateEndpoint(value, field, issues, technologyCatalog) {
     });
     return;
   }
-  if (!existsSync14(value.path)) {
+  if (!existsSync15(value.path)) {
     issues.push({
       type: "missing-path",
       id: typeof value.id === "string" ? value.id : void 0,
@@ -3580,13 +4674,13 @@ function isExactVersion(value) {
   return /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(value);
 }
 function isRepositoryRelativePath(value) {
-  if (value.length === 0 || isAbsolute3(value)) return false;
+  if (value.length === 0 || isAbsolute4(value)) return false;
   const segments = value.replaceAll("\\", "/").split("/");
   return !segments.includes("..");
 }
 function isExactRepositoryRelativePath(value) {
   if (value.length === 0) return false;
-  if (isAbsolute3(value)) return false;
+  if (isAbsolute4(value)) return false;
   if (/^[A-Za-z]:[\\/]/.test(value) || value.startsWith("\\\\") || value.startsWith("//"))
     return false;
   if (value.includes("\\")) return false;
@@ -3884,7 +4978,7 @@ function runScan(options) {
   const inspection = resolveInspectionOptions(options);
   if (!inspection.ok) return reportConfigError(inspection.error);
   const report = inspectHost(inspection.value);
-  const written = writeHostLensReport(report, resolve5(options.outPath));
+  const written = writeHostLensReport(report, resolve6(options.outPath));
   if (options.json) {
     console.log(JSON.stringify({ ok: true, ...written, summary: report.summary }, null, 2));
   } else {
@@ -3904,9 +4998,9 @@ function runPlan(options) {
   if (!inspection.ok) return reportConfigError(inspection.error);
   const report = inspectHost(inspection.value);
   const plan = createHostLensCleanupPlan(report);
-  const outPath = resolve5(options.outPath);
-  mkdirSync6(dirname10(outPath), { recursive: true });
-  writeFileSync5(outPath, `${JSON.stringify(plan, null, 2)}
+  const outPath = resolve6(options.outPath);
+  mkdirSync7(dirname11(outPath), { recursive: true });
+  writeFileSync6(outPath, `${JSON.stringify(plan, null, 2)}
 `);
   if (options.json)
     console.log(JSON.stringify({ ok: true, outPath, actions: plan.actions.length }, null, 2));
@@ -3979,7 +5073,7 @@ function parseOptions(args) {
     if (arg === "--home") {
       const value = args[index + 1];
       if (!value) return { ok: false, error: "Expected value after --home" };
-      options.homeDir = resolve5(value);
+      options.homeDir = resolve6(value);
       index += 1;
       continue;
     }
@@ -3993,7 +5087,7 @@ function parseOptions(args) {
     if (arg === "--config") {
       const value = args[index + 1];
       if (!value) return { ok: false, error: "Expected value after --config" };
-      options.configPath = resolve5(value);
+      options.configPath = resolve6(value);
       index += 1;
       continue;
     }
@@ -4019,8 +5113,8 @@ function printUsage2() {
 }
 
 // src/learning/recall.ts
-import { existsSync as existsSync15, readdirSync as readdirSync8, readFileSync as readFileSync10 } from "node:fs";
-import { basename as basename3, join as join15, relative as relative7 } from "node:path";
+import { existsSync as existsSync16, readdirSync as readdirSync9, readFileSync as readFileSync11 } from "node:fs";
+import { basename as basename4, join as join16, relative as relative8 } from "node:path";
 function recallLearnings(root, options) {
   const query = options.query.trim();
   const terms = tokenize(query);
@@ -4043,16 +5137,16 @@ function recallLearnings(root, options) {
 function loadLearningRecords(root) {
   const recordsByTitle = /* @__PURE__ */ new Map();
   for (const relativeDir of ["docs/reference/learnings", "docs/solutions"]) {
-    const learningDir = join15(root, relativeDir);
-    if (!existsSync15(learningDir)) continue;
+    const learningDir = join16(root, relativeDir);
+    if (!existsSync16(learningDir)) continue;
     for (const path of listMarkdownFiles(learningDir)) {
       const record = readLearningRecord(root, path);
       const key = record.title.trim().toLowerCase();
       if (!recordsByTitle.has(key)) recordsByTitle.set(key, record);
     }
   }
-  const conceptsPath = join15(root, "CONCEPTS.md");
-  if (existsSync15(conceptsPath)) {
+  const conceptsPath = join16(root, "CONCEPTS.md");
+  if (existsSync16(conceptsPath)) {
     const record = readLearningRecord(root, conceptsPath);
     recordsByTitle.set(`concepts:${record.title.toLowerCase()}`, record);
   }
@@ -4060,8 +5154,8 @@ function loadLearningRecords(root) {
 }
 function listMarkdownFiles(dir) {
   const files = [];
-  for (const entry of readdirSync8(dir, { withFileTypes: true })) {
-    const absolutePath = join15(dir, entry.name);
+  for (const entry of readdirSync9(dir, { withFileTypes: true })) {
+    const absolutePath = join16(dir, entry.name);
     if (entry.isDirectory()) {
       files.push(...listMarkdownFiles(absolutePath));
     } else if (entry.isFile() && entry.name.endsWith(".md")) {
@@ -4071,11 +5165,11 @@ function listMarkdownFiles(dir) {
   return files.sort();
 }
 function readLearningRecord(root, absolutePath) {
-  const content = readFileSync10(absolutePath, "utf8");
+  const content = readFileSync11(absolutePath, "utf8");
   const parsed = splitFrontmatter(content);
   const body = parsed.body;
   return {
-    relativePath: normalizePath(relative7(root, absolutePath)),
+    relativePath: normalizePath(relative8(root, absolutePath)),
     title: findTitle(parsed.frontmatter, body) ?? titleFromPath(absolutePath),
     metadata: parsed.frontmatter,
     body
@@ -4103,7 +5197,7 @@ function findTitle(frontmatter, body) {
   return heading ? heading.slice(2).trim() : void 0;
 }
 function titleFromPath(path) {
-  return basename3(path, ".md").split(/[-_]/).filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
+  return basename4(path, ".md").split(/[-_]/).filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
 }
 function scoreRecord(record, terms) {
   const title = record.title.toLowerCase();
@@ -4156,8 +5250,8 @@ function cleanMarkdownLine(input) {
 }
 
 // src/learning/capture.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync7, writeFileSync as writeFileSync6 } from "node:fs";
-import { basename as basename4, join as join16, relative as relative8 } from "node:path";
+import { existsSync as existsSync17, mkdirSync as mkdirSync8, writeFileSync as writeFileSync7 } from "node:fs";
+import { basename as basename5, join as join17, relative as relative9 } from "node:path";
 function captureLearning(root, options) {
   const title = options.title.trim();
   const summary = options.summary.trim();
@@ -4165,13 +5259,13 @@ function captureLearning(root, options) {
   if (!summary) throw new Error("summary is required");
   const category = slugify(options.category ?? "workflow-issues") || "workflow-issues";
   const moduleName = options.module?.trim() || "PGS learning capture";
-  const dir = join16(root, "docs/reference/learnings", category);
-  mkdirSync7(dir, { recursive: true });
+  const dir = join17(root, "docs/reference/learnings", category);
+  mkdirSync8(dir, { recursive: true });
   const path = uniquePath(dir, slugify(title) || "learning");
-  const idSlug = basename4(path, ".md");
-  writeFileSync6(path, renderLearning({ title, summary, category, moduleName, idSlug }));
+  const idSlug = basename5(path, ".md");
+  writeFileSync7(path, renderLearning({ title, summary, category, moduleName, idSlug }));
   return {
-    relativePath: normalizePath2(relative8(root, path)),
+    relativePath: normalizePath2(relative9(root, path)),
     title,
     captureMode: "pgs-native"
   };
@@ -4213,10 +5307,10 @@ function renderLearning(options) {
 }
 function uniquePath(dir, slug) {
   let index = 1;
-  let candidate = join16(dir, `${slug}.md`);
-  while (existsSync16(candidate)) {
+  let candidate = join17(dir, `${slug}.md`);
+  while (existsSync17(candidate)) {
     index += 1;
-    candidate = join16(dir, `${slug}-${index}.md`);
+    candidate = join17(dir, `${slug}-${index}.md`);
   }
   return candidate;
 }
@@ -4401,12 +5495,12 @@ function printUsage3() {
 }
 
 // src/commands/lens.ts
-import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync8 } from "node:fs";
-import { dirname as dirname13 } from "node:path";
+import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync9 } from "node:fs";
+import { dirname as dirname14 } from "node:path";
 
 // src/lens/audit.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync8, readFileSync as readFileSync11, writeFileSync as writeFileSync7 } from "node:fs";
-import { basename as basename5, dirname as dirname11, join as join17 } from "node:path";
+import { existsSync as existsSync18, mkdirSync as mkdirSync9, readFileSync as readFileSync12, writeFileSync as writeFileSync8 } from "node:fs";
+import { basename as basename6, dirname as dirname12, join as join18 } from "node:path";
 var REQUIRED_ARTIFACTS = [
   "manifest.md",
   "raw/project-lens/architecture-lens.md",
@@ -4424,20 +5518,20 @@ function createProjectLensAuditPackage(targetDir, auditDir) {
     version: 1,
     target: {
       path: targetDir,
-      name: basename5(targetDir) || "target"
+      name: basename6(targetDir) || "target"
     },
     requiredArtifacts: [...REQUIRED_ARTIFACTS]
   };
-  mkdirSync8(auditDir, { recursive: true });
-  writeJson(join17(auditDir, "audit.contract.json"), contract);
+  mkdirSync9(auditDir, { recursive: true });
+  writeJson(join18(auditDir, "audit.contract.json"), contract);
   for (const artifactPath of REQUIRED_ARTIFACTS) {
-    writeTemplate(join17(auditDir, artifactPath), renderArtifactTemplate(artifactPath, contract));
+    writeTemplate(join18(auditDir, artifactPath), renderArtifactTemplate(artifactPath, contract));
   }
   return contract;
 }
 function checkProjectLensAuditPackage(auditDir, options = {}) {
-  const contractPath = join17(auditDir, "audit.contract.json");
-  if (!existsSync17(contractPath)) {
+  const contractPath = join18(auditDir, "audit.contract.json");
+  if (!existsSync18(contractPath)) {
     return {
       ok: false,
       auditDir,
@@ -4451,7 +5545,7 @@ function checkProjectLensAuditPackage(auditDir, options = {}) {
   }
   let contract;
   try {
-    contract = JSON.parse(readFileSync11(contractPath, "utf8"));
+    contract = JSON.parse(readFileSync12(contractPath, "utf8"));
   } catch (error) {
     return {
       ok: false,
@@ -4484,12 +5578,12 @@ function checkProjectLensAuditPackage(auditDir, options = {}) {
     }
   }
   for (const artifactPath of REQUIRED_ARTIFACTS) {
-    const absolutePath = join17(auditDir, artifactPath);
-    if (!existsSync17(absolutePath)) {
+    const absolutePath = join18(auditDir, artifactPath);
+    if (!existsSync18(absolutePath)) {
       issues.push({ type: "missing-required-artifact", path: artifactPath });
       continue;
     }
-    const content = readFileSync11(absolutePath, "utf8");
+    const content = readFileSync12(absolutePath, "utf8");
     if (isPendingArtifact(content)) {
       issues.push({ type: "artifact-not-complete", path: artifactPath });
     } else if (hasTemplateBody(content)) {
@@ -4505,13 +5599,13 @@ function checkProjectLensAuditPackage(auditDir, options = {}) {
   };
 }
 function writeJson(path, value) {
-  mkdirSync8(dirname11(path), { recursive: true });
-  writeFileSync7(path, `${JSON.stringify(value, null, 2)}
+  mkdirSync9(dirname12(path), { recursive: true });
+  writeFileSync8(path, `${JSON.stringify(value, null, 2)}
 `);
 }
 function writeTemplate(path, content) {
-  mkdirSync8(dirname11(path), { recursive: true });
-  writeFileSync7(path, content);
+  mkdirSync9(dirname12(path), { recursive: true });
+  writeFileSync8(path, content);
 }
 function renderArtifactTemplate(artifactPath, contract) {
   const title = artifactPath.replace(/\.md$/, "").split("/").map((part) => part.replaceAll("-", " ")).join(" / ");
@@ -4789,14 +5883,14 @@ function formatLink(link) {
 }
 
 // src/lens/scan.ts
-import { spawnSync as spawnSync4 } from "node:child_process";
-import { existsSync as existsSync21, readFileSync as readFileSync13, statSync as statSync6 } from "node:fs";
+import { spawnSync as spawnSync3 } from "node:child_process";
+import { existsSync as existsSync22, readFileSync as readFileSync14, statSync as statSync7 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { join as join22 } from "node:path";
+import { join as join23 } from "node:path";
 
 // src/host-ssot.ts
-import { lstatSync as lstatSync7, readlinkSync as readlinkSync3, realpathSync as realpathSync5 } from "node:fs";
-import { dirname as dirname12, isAbsolute as isAbsolute4, join as join18, resolve as resolve6 } from "node:path";
+import { lstatSync as lstatSync8, readlinkSync as readlinkSync3, realpathSync as realpathSync5 } from "node:fs";
+import { dirname as dirname13, isAbsolute as isAbsolute5, join as join19, resolve as resolve7 } from "node:path";
 function inspectProjectHostSsot(root) {
   const agentsEntry = inspectCanonicalPath(root, "AGENTS.md");
   const canonicalSkills = inspectCanonicalPath(root, ".agents/skills");
@@ -4840,7 +5934,7 @@ function inspectUserSkillsSsot(homeDir) {
   };
 }
 function inspectCanonicalPath(root, path) {
-  const absolutePath = join18(root, path);
+  const absolutePath = join19(root, path);
   const stat = safeLstat2(absolutePath);
   if (!stat) return { path, status: "missing" };
   if (stat.isSymbolicLink()) {
@@ -4856,7 +5950,7 @@ function inspectCanonicalPath(root, path) {
   return { path, status: "other" };
 }
 function inspectCompatibilityLink(root, path, expectedRawTarget) {
-  const absolutePath = join18(root, path);
+  const absolutePath = join19(root, path);
   const stat = safeLstat2(absolutePath);
   const base = { path, expectedRawTarget, compliant: false };
   if (!stat) return { ...base, status: "missing" };
@@ -4865,9 +5959,9 @@ function inspectCompatibilityLink(root, path, expectedRawTarget) {
     if (stat.isDirectory()) return { ...base, status: "directory" };
     return { ...base, status: "other" };
   }
-  const rawTarget = readlinkSync3(absolutePath);
-  const resolvedTarget = resolve6(dirname12(absolutePath), rawTarget);
-  const expectedPath = resolve6(dirname12(absolutePath), expectedRawTarget);
+  const rawTarget = normalizeSymlinkTarget(readlinkSync3(absolutePath));
+  const resolvedTarget = resolve7(dirname13(absolutePath), rawTarget);
+  const expectedPath = resolve7(dirname13(absolutePath), expectedRawTarget);
   const targetStat = safeLstat2(resolvedTarget);
   if (!targetStat) {
     return {
@@ -4886,7 +5980,7 @@ function inspectCompatibilityLink(root, path, expectedRawTarget) {
   if (!targetMatches) {
     return { ...base, rawTarget, resolvedTarget, status: "wrong-target" };
   }
-  if (isAbsolute4(rawTarget)) {
+  if (isAbsolute5(rawTarget)) {
     return { ...base, rawTarget, resolvedTarget, status: "absolute-symlink" };
   }
   if (rawTarget !== expectedRawTarget) {
@@ -4907,16 +6001,16 @@ function inspectCompatibilityLink(root, path, expectedRawTarget) {
 }
 function safeLstat2(path) {
   try {
-    return lstatSync7(path);
+    return lstatSync8(path);
   } catch {
     return void 0;
   }
 }
 
 // src/portfolio/redundancy.ts
-import { existsSync as existsSync18, readdirSync as readdirSync9, statSync as statSync5 } from "node:fs";
+import { existsSync as existsSync19, readdirSync as readdirSync10, statSync as statSync6 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { join as join19 } from "node:path";
+import { join as join20 } from "node:path";
 var DEFAULT_CACHE_THRESHOLD_BYTES = 1e9;
 var MAX_CACHE_ENTRIES = 2e4;
 function inspectHostRedundancy(options = {}) {
@@ -4947,8 +6041,8 @@ function inspectProjectRedundancy(root, options = {}) {
 }
 function inspectLegacyDirectories(root) {
   const relativePath = ".agent";
-  const path = join19(root, relativePath);
-  if (!existsSync18(path)) return [];
+  const path = join20(root, relativePath);
+  if (!existsSync19(path)) return [];
   const stats = collectDirectoryStats(path);
   return [
     {
@@ -4963,16 +6057,16 @@ function inspectLegacyDirectories(root) {
 function getPlaywrightCachePaths(homeDir, configuredPath) {
   const candidates = [
     configuredPath && configuredPath !== "0" ? configuredPath : void 0,
-    join19(homeDir, "Library/Caches/ms-playwright"),
-    join19(homeDir, ".cache/ms-playwright"),
-    join19(homeDir, "AppData/Local/ms-playwright")
+    join20(homeDir, "Library/Caches/ms-playwright"),
+    join20(homeDir, ".cache/ms-playwright"),
+    join20(homeDir, "AppData/Local/ms-playwright")
   ].filter((path) => Boolean(path));
   return [...new Set(candidates)];
 }
 function inspectPlaywrightCache(path, cache) {
   const cached = cache?.get(path);
   if (cached) return cached;
-  if (!existsSync18(path)) {
+  if (!existsSync19(path)) {
     const missing = {
       path,
       exists: false,
@@ -4987,7 +6081,7 @@ function inspectPlaywrightCache(path, cache) {
   const stats = collectDirectoryStats(path);
   let revisionCount = 0;
   try {
-    revisionCount = readdirSync9(path, { withFileTypes: true }).filter(
+    revisionCount = readdirSync10(path, { withFileTypes: true }).filter(
       (entry) => entry.isDirectory()
     ).length;
   } catch {
@@ -5014,7 +6108,7 @@ function collectDirectoryStats(root) {
     if (!current) continue;
     let entries;
     try {
-      entries = readdirSync9(current, { withFileTypes: true });
+      entries = readdirSync10(current, { withFileTypes: true });
     } catch {
       continue;
     }
@@ -5023,13 +6117,13 @@ function collectDirectoryStats(root) {
         truncated = true;
         break;
       }
-      const path = join19(current, entry.name);
+      const path = join20(current, entry.name);
       if (entry.isDirectory()) {
         pending.push(path);
       } else if (entry.isFile()) {
         fileCount += 1;
         try {
-          bytes += statSync5(path).size;
+          bytes += statSync6(path).size;
         } catch {
         }
       }
@@ -5040,11 +6134,11 @@ function collectDirectoryStats(root) {
 }
 
 // src/portfolio/verification.ts
-import { existsSync as existsSync19, readFileSync as readFileSync12 } from "node:fs";
-import { join as join20 } from "node:path";
+import { existsSync as existsSync20, readFileSync as readFileSync13 } from "node:fs";
+import { join as join21 } from "node:path";
 var REQUIRED_PROJECT_SCRIPTS = ["typecheck", "lint", "format:check", "verify"];
 function inspectProjectVerification(root) {
-  const packageJson = readPackageJson(join20(root, "package.json"));
+  const packageJson = readPackageJson(join21(root, "package.json"));
   const scripts = Object.fromEntries(
     REQUIRED_PROJECT_SCRIPTS.map((name) => [
       name,
@@ -5062,18 +6156,18 @@ function inspectProjectVerification(root) {
   };
 }
 function readPackageJson(path) {
-  if (!existsSync19(path)) return void 0;
+  if (!existsSync20(path)) return void 0;
   try {
-    return JSON.parse(readFileSync12(path, "utf8"));
+    return JSON.parse(readFileSync13(path, "utf8"));
   } catch {
     return void 0;
   }
 }
 
 // src/repository-files.ts
-import { spawnSync as spawnSync3 } from "node:child_process";
-import { existsSync as existsSync20, readdirSync as readdirSync10 } from "node:fs";
-import { isAbsolute as isAbsolute5, join as join21, posix as posix3, relative as relative9 } from "node:path";
+import { spawnSync as spawnSync2 } from "node:child_process";
+import { existsSync as existsSync21, readdirSync as readdirSync11 } from "node:fs";
+import { isAbsolute as isAbsolute6, join as join22, posix as posix3, relative as relative10 } from "node:path";
 var gitMaxBufferBytes = 64 * 1024 * 1024;
 var RepositoryFileDiscoveryError = class extends Error {
   constructor(message) {
@@ -5084,7 +6178,7 @@ var RepositoryFileDiscoveryError = class extends Error {
 function discoverRepositoryFiles(root, options = {}) {
   const probe = runGit(root, ["rev-parse", "--is-inside-work-tree"]);
   if (!probe.ok) {
-    if (!probe.notRepository || existsSync20(join21(root, ".git"))) {
+    if (!probe.notRepository || existsSync21(join22(root, ".git"))) {
       throw new RepositoryFileDiscoveryError(probe.message);
     }
     return {
@@ -5115,7 +6209,7 @@ function discoverRepositoryFiles(root, options = {}) {
         `Git returned a path outside the repository boundary: ${path}`
       );
     }
-    if (existsSync20(join21(root, normalized))) files.add(normalized);
+    if (existsSync21(join22(root, normalized))) files.add(normalized);
   }
   return { source: "git", files: [...files].sort() };
 }
@@ -5127,21 +6221,21 @@ function discoverFilesystemFiles(root, options) {
   const maxDepth = options.fallbackMaxDepth ?? Number.POSITIVE_INFINITY;
   const ignoredDirectories2 = options.fallbackIgnoredDirectories ?? /* @__PURE__ */ new Set();
   const visit = (directory, depth) => {
-    if (depth > maxDepth || !existsSync20(directory)) return;
+    if (depth > maxDepth || !existsSync21(directory)) return;
     let entries;
     try {
-      entries = readdirSync10(directory, { withFileTypes: true });
+      entries = readdirSync11(directory, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
-      const absolutePath = join21(directory, entry.name);
+      const absolutePath = join22(directory, entry.name);
       if (entry.isDirectory()) {
         if (!ignoredDirectories2.has(entry.name)) visit(absolutePath, depth + 1);
         continue;
       }
       if (!entry.isFile()) continue;
-      const relativePath = normalizeRepositoryRelativePath(relative9(root, absolutePath));
+      const relativePath = normalizeRepositoryRelativePath(relative10(root, absolutePath));
       if (isSafeRepositoryRelativePath(relativePath) && (options.fallbackIncludeFile?.(relativePath) ?? true)) {
         files.add(relativePath);
       }
@@ -5151,10 +6245,10 @@ function discoverFilesystemFiles(root, options) {
   return [...files].sort();
 }
 function isSafeRepositoryRelativePath(path) {
-  return path !== "" && path !== "." && !isAbsolute5(path) && !/^[a-zA-Z]:\//.test(path) && path !== ".." && !path.startsWith("../");
+  return path !== "" && path !== "." && !isAbsolute6(path) && !/^[a-zA-Z]:\//.test(path) && path !== ".." && !path.startsWith("../");
 }
 function runGit(root, args) {
-  const result = spawnSync3("git", ["-C", root, ...args], {
+  const result = spawnSync2("git", ["-C", root, ...args], {
     encoding: "utf8",
     maxBuffer: gitMaxBufferBytes,
     env: { ...process.env, LANG: "C", LC_ALL: "C" }
@@ -5191,7 +6285,7 @@ function scanProjectLensTarget(targetDir, options = {}) {
       includedFileCount: files.length,
       excludedFileCount: candidateFiles.length - files.length
     },
-    aiEntryFiles: ["AGENTS.md", "CLAUDE.md"].filter((file) => existsSync21(join22(targetDir, file))),
+    aiEntryFiles: ["AGENTS.md", "CLAUDE.md"].filter((file) => existsSync22(join23(targetDir, file))),
     aiConfigFiles: [],
     hostSsot: inspectProjectHostSsot(targetDir),
     userHostSsot: inspectUserSkillsSsot(options.homeDir ?? process.env.HOME ?? homedir3()),
@@ -5202,19 +6296,19 @@ function scanProjectLensTarget(targetDir, options = {}) {
     }),
     packageJson,
     docs: {
-      hasDocsDirectory: existsSync21(join22(targetDir, "docs")),
+      hasDocsDirectory: existsSync22(join23(targetDir, "docs")),
       markdownFileCount: markdownFiles.length,
       governanceFiles: markdownFiles.filter((file) => file.startsWith("docs/governance/") || file.startsWith("docs/policy/")).sort()
     },
     git: readGitState(targetDir),
-    largeFiles: files.map((file) => ({ path: file, bytes: statSync6(join22(targetDir, file)).size })).filter((file) => file.bytes >= largeFileBytes).sort((a, b) => b.bytes - a.bytes || a.path.localeCompare(b.path)).slice(0, 25)
+    largeFiles: files.map((file) => ({ path: file, bytes: statSync7(join23(targetDir, file)).size })).filter((file) => file.bytes >= largeFileBytes).sort((a, b) => b.bytes - a.bytes || a.path.localeCompare(b.path)).slice(0, 25)
   };
 }
 function readPackageJson2(targetDir) {
-  const packageJsonPath = join22(targetDir, "package.json");
-  if (!existsSync21(packageJsonPath)) return void 0;
+  const packageJsonPath = join23(targetDir, "package.json");
+  if (!existsSync22(packageJsonPath)) return void 0;
   try {
-    const packageJson = JSON.parse(readFileSync13(packageJsonPath, "utf8"));
+    const packageJson = JSON.parse(readFileSync14(packageJsonPath, "utf8"));
     return {
       scripts: Object.keys(packageJson.scripts ?? {}).sort(),
       dependencies: Object.keys(packageJson.dependencies ?? {}).sort(),
@@ -5237,7 +6331,7 @@ function readGitState(targetDir) {
   };
 }
 function runGit2(targetDir, args) {
-  const result = spawnSync4("git", ["-C", targetDir, ...args], {
+  const result = spawnSync3("git", ["-C", targetDir, ...args], {
     encoding: "utf8",
     maxBuffer: 64 * 1024 * 1024
   });
@@ -5305,8 +6399,8 @@ function runLensReport(args) {
   }
   const report = scanProjectLensTarget(options.value.targetDir);
   const markdown = renderProjectLensMarkdownReport(report);
-  mkdirSync9(dirname13(options.value.outPath), { recursive: true });
-  writeFileSync8(options.value.outPath, markdown);
+  mkdirSync10(dirname14(options.value.outPath), { recursive: true });
+  writeFileSync9(options.value.outPath, markdown);
   console.log(`report: ${options.value.outPath}`);
   return 0;
 }
@@ -5411,19 +6505,18 @@ function printUsage4() {
 }
 
 // src/commands/portfolio.ts
-import { existsSync as existsSync33, readFileSync as readFileSync18 } from "node:fs";
-import { join as join34 } from "node:path";
+import { existsSync as existsSync34, readFileSync as readFileSync19 } from "node:fs";
+import { join as join35 } from "node:path";
 
 // src/portfolio/doctor.ts
-import { spawnSync as spawnSync7 } from "node:child_process";
-import { existsSync as existsSync24, readFileSync as readFileSync16 } from "node:fs";
+import { spawnSync as spawnSync5 } from "node:child_process";
+import { existsSync as existsSync25, readFileSync as readFileSync17 } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
 import { homedir as homedir4 } from "node:os";
-import { dirname as dirname15, join as join25 } from "node:path";
+import { dirname as dirname16, join as join26 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 
 // src/host-tooling/inventory.ts
-import { spawnSync as spawnSync5 } from "node:child_process";
 function inspectHostTooling(requirements, runner = defaultRunner2) {
   const hosts = [];
   const issues = [];
@@ -5497,7 +6590,7 @@ function parseHostPlugins(host, value) {
   });
 }
 function defaultRunner2({ command: command2 }) {
-  const result = spawnSync5(command2[0] ?? "", command2.slice(1), {
+  const result = spawnPlatformSync(command2[0] ?? "", command2.slice(1), {
     encoding: "utf8",
     timeout: 1e4
   });
@@ -5512,8 +6605,8 @@ function isRecord2(value) {
 }
 
 // src/portfolio/asset-state.ts
-import { existsSync as existsSync22, lstatSync as lstatSync8, readFileSync as readFileSync14 } from "node:fs";
-import { join as join23 } from "node:path";
+import { existsSync as existsSync23, lstatSync as lstatSync9, readFileSync as readFileSync15 } from "node:fs";
+import { join as join24 } from "node:path";
 function comparePortfolioAssetState(options) {
   const expectedManifest = readPlanDocument(
     options.expectedPlan,
@@ -5524,10 +6617,10 @@ function comparePortfolioAssetState(options) {
     ".pro-gov/assets.lock.json"
   );
   const currentManifest = readJsonFile(
-    join23(options.targetDir, ".pro-gov/assets.json")
+    join24(options.targetDir, ".pro-gov/assets.json")
   );
   const currentLock = readJsonFile(
-    join23(options.targetDir, ".pro-gov/assets.lock.json")
+    join24(options.targetDir, ".pro-gov/assets.lock.json")
   );
   const issues = [];
   if (!sameStrings(currentManifest?.bundleIds, expectedManifest?.bundleIds)) {
@@ -5555,7 +6648,7 @@ function comparePortfolioAssetState(options) {
       (action) => action.type === "adopt-symlink" && action.assetId === entry.id && action.legacyTargetPath === entry.targetPath
     ))
       continue;
-    const targetAbsolutePath = join23(options.targetDir, entry.targetPath);
+    const targetAbsolutePath = join24(options.targetDir, entry.targetPath);
     if (!pathIsSymlink(targetAbsolutePath)) continue;
     issues.push({
       type: "orphaned-managed-symlink",
@@ -5577,9 +6670,9 @@ function readPlanDocument(plan, targetPath) {
   }
 }
 function readJsonFile(path) {
-  if (!existsSync22(path)) return void 0;
+  if (!existsSync23(path)) return void 0;
   try {
-    return JSON.parse(readFileSync14(path, "utf8"));
+    return JSON.parse(readFileSync15(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -5605,16 +6698,16 @@ function normalizeLock(lock) {
 }
 function pathIsSymlink(path) {
   try {
-    return lstatSync8(path).isSymbolicLink();
+    return lstatSync9(path).isSymbolicLink();
   } catch {
     return false;
   }
 }
 
 // src/portfolio/version-policy.ts
-import { spawnSync as spawnSync6 } from "node:child_process";
-import { existsSync as existsSync23, lstatSync as lstatSync9, readFileSync as readFileSync15 } from "node:fs";
-import { dirname as dirname14, join as join24 } from "node:path";
+import { spawnSync as spawnSync4 } from "node:child_process";
+import { existsSync as existsSync24, lstatSync as lstatSync10, readFileSync as readFileSync16 } from "node:fs";
+import { dirname as dirname15, join as join25 } from "node:path";
 function inspectVersionPolicy(root, policy, projectType) {
   if (!policy) return { status: "compliant", packages: [], runtimes: [], attentionCount: 0 };
   const packageManifests = collectPackageManifests(root);
@@ -5704,7 +6797,7 @@ function inspectRuntime(expectedName, expectedVersion) {
 function readRuntimeVersion(name) {
   if (name === "node") return process.versions.node;
   if (name !== "deno") return void 0;
-  const result = spawnSync6("deno", ["--version"], { encoding: "utf8" });
+  const result = spawnSync4("deno", ["--version"], { encoding: "utf8" });
   if (result.status !== 0) return void 0;
   return /^deno\s+(\d+\.\d+\.\d+)/m.exec(result.stdout)?.[1];
 }
@@ -5723,10 +6816,10 @@ function findDeclaredVersion(packageJson, name) {
 function readInstalledVersion(root, name, fromDirectory = root) {
   let current = fromDirectory;
   while (true) {
-    const packageJson = readJson2(join24(current, "node_modules", name, "package.json"));
+    const packageJson = readJson2(join25(current, "node_modules", name, "package.json"));
     if (typeof packageJson?.version === "string") return packageJson.version;
     if (current === root) return void 0;
-    const parent = dirname14(current);
+    const parent = dirname15(current);
     if (parent === current) return void 0;
     current = parent;
   }
@@ -5761,15 +6854,15 @@ function collectPackageManifests(root) {
     if (relativePath.split("/").at(-1) !== "package.json" || directorySegments.length > 6 || directorySegments.some((segment) => ignored.has(segment))) {
       return;
     }
-    const path = join24(root, relativePath);
+    const path = join25(root, relativePath);
     try {
-      if (!lstatSync9(path).isFile()) return;
+      if (!lstatSync10(path).isFile()) return;
     } catch {
       return;
     }
     const packageJson = readJson2(path);
     if (!packageJson) return;
-    manifests.set(relativePath, { path: relativePath, directory: dirname14(path), packageJson });
+    manifests.set(relativePath, { path: relativePath, directory: dirname15(path), packageJson });
   };
   const discovery = discoverRepositoryFiles(root, {
     gitPathspecs: ["package.json", ":(glob)**/package.json"],
@@ -5784,9 +6877,9 @@ function unique(values) {
   return [...new Set(values)];
 }
 function readJson2(path) {
-  if (!existsSync23(path)) return void 0;
+  if (!existsSync24(path)) return void 0;
   try {
-    return JSON.parse(readFileSync15(path, "utf8"));
+    return JSON.parse(readFileSync16(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -5819,12 +6912,12 @@ function inspectTarget(options) {
   const { target } = options;
   const hostSsot = inspectProjectHostSsot(target.path);
   const issues = [];
-  const packageJson = readJson3(join25(target.path, "package.json"));
+  const packageJson = readJson3(join26(target.path, "package.json"));
   const packages = {};
   for (const packageName of ["@pieai/pro-gov", "@pieai/doc-gov"]) {
     const declared = packageJson?.devDependencies?.[packageName] ?? packageJson?.dependencies?.[packageName];
     const installedPackage = readJson3(
-      join25(target.path, "node_modules", packageName, "package.json")
+      join26(target.path, "node_modules", packageName, "package.json")
     );
     const installed = installedPackage?.version;
     const expected = options.expectedPackageVersions[packageName];
@@ -5884,7 +6977,7 @@ function inspectTarget(options) {
       type: "asset-lock-drift",
       message: error instanceof Error ? error.message : String(error)
     });
-    if (!existsSync24(join25(target.path, ".pro-gov/assets.json"))) {
+    if (!existsSync25(join26(target.path, ".pro-gov/assets.json"))) {
       issues.push({ type: "bundle-drift", message: "Target asset manifest is missing." });
     }
   }
@@ -5902,15 +6995,15 @@ function inspectTarget(options) {
   };
 }
 function readTargetAssetHost(targetDir) {
-  const lockfile = readJson3(join25(targetDir, ".pro-gov/assets.lock.json"));
+  const lockfile = readJson3(join26(targetDir, ".pro-gov/assets.lock.json"));
   return isAssetRegistryHost(lockfile?.host) ? lockfile.host : void 0;
 }
 function isAssetRegistryHost(value) {
   return value === "codex" || value === "claude-code" || value === "gemini-cli" || value === "antigravity";
 }
 function runTargetChecks(target) {
-  const proGovCli = join25(target.path, "node_modules/@pieai/pro-gov/dist/cli.js");
-  const docGovCli = join25(target.path, "node_modules/@pieai/doc-gov/dist/cli.js");
+  const proGovCli = join26(target.path, "node_modules/@pieai/pro-gov/dist/cli.js");
+  const docGovCli = join26(target.path, "node_modules/@pieai/doc-gov/dist/cli.js");
   const commands = [
     {
       name: "pro-gov doctor",
@@ -5921,8 +7014,8 @@ function runTargetChecks(target) {
     { name: "doc-gov scan --check", cli: docGovCli, args: ["scan", "--check"] }
   ];
   return commands.map((command2) => {
-    if (!existsSync24(command2.cli)) return { name: command2.name, status: null };
-    const result = spawnSync7(process.execPath, [command2.cli, ...command2.args], {
+    if (!existsSync25(command2.cli)) return { name: command2.name, status: null };
+    const result = spawnSync5(process.execPath, [command2.cli, ...command2.args], {
       cwd: target.path,
       encoding: "utf8",
       timeout: 3e4
@@ -5931,13 +7024,13 @@ function runTargetChecks(target) {
   });
 }
 function inspectGit(path) {
-  const inside = spawnSync7("git", ["rev-parse", "--is-inside-work-tree"], {
+  const inside = spawnSync5("git", ["rev-parse", "--is-inside-work-tree"], {
     cwd: path,
     encoding: "utf8"
   });
   if (inside.status !== 0) return { isRepository: false, dirty: false };
-  const status = spawnSync7("git", ["status", "--porcelain"], { cwd: path, encoding: "utf8" });
-  const branch = spawnSync7("git", ["branch", "--show-current"], { cwd: path, encoding: "utf8" });
+  const status = spawnSync5("git", ["status", "--porcelain"], { cwd: path, encoding: "utf8" });
+  const branch = spawnSync5("git", ["branch", "--show-current"], { cwd: path, encoding: "utf8" });
   return {
     isRepository: true,
     dirty: status.stdout.trim().length > 0,
@@ -5960,18 +7053,18 @@ function getExpectedPackageVersions() {
   };
 }
 function findOwnPackageJson() {
-  let current = dirname15(fileURLToPath4(import.meta.url));
+  let current = dirname16(fileURLToPath4(import.meta.url));
   for (let depth = 0; depth < 5; depth += 1) {
-    const candidate = join25(current, "package.json");
-    if (existsSync24(candidate)) return candidate;
-    current = dirname15(current);
+    const candidate = join26(current, "package.json");
+    if (existsSync25(candidate)) return candidate;
+    current = dirname16(current);
   }
   return "";
 }
 function readJson3(path) {
-  if (!path || !existsSync24(path)) return void 0;
+  if (!path || !existsSync25(path)) return void 0;
   try {
-    return JSON.parse(readFileSync16(path, "utf8"));
+    return JSON.parse(readFileSync17(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -5988,15 +7081,15 @@ function deduplicateIssues(issues) {
 
 // src/portfolio/ai-health/index.ts
 import { homedir as homedir5 } from "node:os";
-import { dirname as dirname17, join as join33, resolve as resolve9 } from "node:path";
+import { dirname as dirname18, join as join34, resolve as resolve10 } from "node:path";
 
 // src/portfolio/ai-health/entries.ts
-import { existsSync as existsSync26, lstatSync as lstatSync11, realpathSync as realpathSync7 } from "node:fs";
-import { join as join26 } from "node:path";
+import { existsSync as existsSync27, lstatSync as lstatSync12, realpathSync as realpathSync7 } from "node:fs";
+import { join as join27 } from "node:path";
 
 // src/portfolio/ai-health/shared.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { existsSync as existsSync25, lstatSync as lstatSync10, readFileSync as readFileSync17, readdirSync as readdirSync11, realpathSync as realpathSync6, statSync as statSync7 } from "node:fs";
+import { existsSync as existsSync26, lstatSync as lstatSync11, readFileSync as readFileSync18, readdirSync as readdirSync12, realpathSync as realpathSync6, statSync as statSync8 } from "node:fs";
 function safeRealpath(path) {
   try {
     return realpathSync6(path);
@@ -6006,12 +7099,13 @@ function safeRealpath(path) {
 }
 function commandVersion(command2) {
   try {
-    const output = execFileSync2(command2, ["version"], {
+    const result = spawnPlatformSync(command2, ["version"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"],
       timeout: 3e3
     });
-    return output.match(/\b\d+\.\d+\.\d+\b/)?.[0];
+    if (result.error || result.status !== 0) return void 0;
+    return result.stdout.match(/\b\d+\.\d+\.\d+\b/)?.[0];
   } catch {
     return void 0;
   }
@@ -6026,7 +7120,7 @@ function jsonObjectKeys(path, key) {
   return Object.keys(value[key]).sort();
 }
 function tomlMcpNames(path) {
-  if (!existsSync25(path)) return [];
+  if (!existsSync26(path)) return [];
   const names = /* @__PURE__ */ new Set();
   for (const line of safeRead(path).split(/\r?\n/)) {
     const match = line.match(/^\s*\[mcp_servers\.(?:"([^"]+)"|([^.\]]+))\]\s*$/);
@@ -6037,35 +7131,35 @@ function tomlMcpNames(path) {
 }
 function readJson4(path) {
   try {
-    return JSON.parse(readFileSync17(path, "utf8"));
+    return JSON.parse(readFileSync18(path, "utf8"));
   } catch {
     return void 0;
   }
 }
 function safeRead(path) {
   try {
-    return readFileSync17(path, "utf8");
+    return readFileSync18(path, "utf8");
   } catch {
     return "";
   }
 }
 function safeReadDir(path) {
   try {
-    return readdirSync11(path).sort();
+    return readdirSync12(path).sort();
   } catch {
     return [];
   }
 }
 function safeIsDirectory(path) {
   try {
-    return statSync7(path).isDirectory();
+    return statSync8(path).isDirectory();
   } catch {
     return false;
   }
 }
 function pathLexists(path) {
   try {
-    lstatSync10(path);
+    lstatSync11(path);
     return true;
   } catch {
     return false;
@@ -6103,12 +7197,12 @@ function hasWorkflowReminderHooks(hooks) {
   );
 }
 function inspectEntries(root) {
-  const agentsPath = join26(root, "AGENTS.md");
-  const agents = !existsSync26(agentsPath) ? "missing" : safeRead(agentsPath).includes("PGS-ROUTER:BEGIN") ? "pgs-router" : "custom";
-  const claudePath = join26(root, "CLAUDE.md");
+  const agentsPath = join27(root, "AGENTS.md");
+  const agents = !existsSync27(agentsPath) ? "missing" : safeRead(agentsPath).includes("PGS-ROUTER:BEGIN") ? "pgs-router" : "custom";
+  const claudePath = join27(root, "CLAUDE.md");
   let claude = "missing";
   if (pathLexists(claudePath)) {
-    const info = lstatSync11(claudePath);
+    const info = lstatSync12(claudePath);
     if (info.isSymbolicLink()) {
       try {
         claude = realpathSync7(claudePath) === realpathSync7(agentsPath) ? "agents-symlink" : "custom";
@@ -6125,19 +7219,19 @@ function inspectEntries(root) {
 var AGENT_LINK_ROOTS = [".agents/workflows", ".agents/commands", ".claude/commands"];
 function inspectAgentLinks(root) {
   const entries = AGENT_LINK_ROOTS.flatMap((directory) => {
-    const directoryPath = join26(root, directory);
+    const directoryPath = join27(root, directory);
     if (!pathLexists(directoryPath)) return [];
     try {
-      if (!lstatSync11(directoryPath).isDirectory()) return [];
+      if (!lstatSync12(directoryPath).isDirectory()) return [];
     } catch {
       return [];
     }
     return safeReadDir(directoryPath).filter((name) => !name.startsWith(".")).flatMap((name) => {
       const relativePath = `${directory}/${name}`;
-      const path = join26(root, relativePath);
+      const path = join27(root, relativePath);
       let stat;
       try {
-        stat = lstatSync11(path);
+        stat = lstatSync12(path);
       } catch {
         return [];
       }
@@ -6158,9 +7252,9 @@ function inspectAgentLinks(root) {
   };
 }
 function inspectOptionalEntry(root, filename, agentsPath) {
-  const path = join26(root, filename);
+  const path = join27(root, filename);
   if (!pathLexists(path)) return "missing";
-  const info = lstatSync11(path);
+  const info = lstatSync12(path);
   if (info.isSymbolicLink()) {
     try {
       return realpathSync7(path) === realpathSync7(agentsPath) ? "agents-symlink" : "custom";
@@ -6198,7 +7292,7 @@ function inspectHooks(root) {
     { host: "codex", path: ".codex/hooks.json" }
   ];
   return configs.map((config) => {
-    const value = readJson4(join26(root, config.path));
+    const value = readJson4(join27(root, config.path));
     const counts = /* @__PURE__ */ new Map();
     collectHookEvents(value, counts);
     return {
@@ -6219,18 +7313,18 @@ function collectHookEvents(value, counts) {
   }
 }
 function inspectDocs(root, expected) {
-  const packageJson = readJson4(join26(root, "package.json"));
+  const packageJson = readJson4(join27(root, "package.json"));
   const dependencies = isRecord3(packageJson) ? { ...recordOrEmpty(packageJson.dependencies), ...recordOrEmpty(packageJson.devDependencies) } : {};
   const docGov = dependencyVersion(dependencies["@pieai/doc-gov"]);
   const proGov = dependencyVersion(dependencies["@pieai/pro-gov"]);
-  const routerMatch = safeRead(join26(root, "AGENTS.md")).match(/PGS-ROUTER:BEGIN\s+v([0-9.]+)/);
+  const routerMatch = safeRead(join27(root, "AGENTS.md")).match(/PGS-ROUTER:BEGIN\s+v([0-9.]+)/);
   const declared = [docGov, proGov].filter((value) => Boolean(value));
   return {
     routerVersion: routerMatch?.[1],
     expectedRouterVersion: CURRENT_ROUTER_VERSION,
     routerAligned: routerMatch?.[1] === CURRENT_ROUTER_VERSION,
-    manifest: existsSync26(join26(root, "docs/governance/MANIFEST.yml")),
-    currentWork: existsSync26(join26(root, "docs/reference/execution/current-work.md")),
+    manifest: existsSync27(join27(root, "docs/governance/MANIFEST.yml")),
+    currentWork: existsSync27(join27(root, "docs/reference/execution/current-work.md")),
     packages: {
       expected,
       docGov,
@@ -6292,19 +7386,17 @@ function inspectGit2(root) {
 }
 
 // src/portfolio/ai-health/hosts.ts
-import { execFileSync as execFileSync5 } from "node:child_process";
-import { existsSync as existsSync28 } from "node:fs";
-import { join as join28, resolve as resolve8, sep as sep3 } from "node:path";
+import { existsSync as existsSync29 } from "node:fs";
+import { join as join29, resolve as resolve9, sep as sep3 } from "node:path";
 
 // src/portfolio/ai-health/devspace.ts
-import { execFileSync as execFileSync4 } from "node:child_process";
-import { existsSync as existsSync27, statSync as statSync8 } from "node:fs";
-import { join as join27, relative as relative10, resolve as resolve7, sep as sep2 } from "node:path";
+import { existsSync as existsSync28, statSync as statSync9 } from "node:fs";
+import { join as join28, relative as relative11, resolve as resolve8, sep as sep2 } from "node:path";
 function inspectDevSpaceHealth(options) {
   const run = options.run ?? runDevSpaceCommand;
-  const configDirectory = join27(options.homeDir, ".devspace");
-  const configPath = join27(configDirectory, "config.json");
-  const authPath = join27(configDirectory, "auth.json");
+  const configDirectory = join28(options.homeDir, ".devspace");
+  const configPath = join28(configDirectory, "config.json");
+  const authPath = join28(configDirectory, "auth.json");
   const installedResult = run("devspace", ["--version"], 3e3);
   const installedVersion = installedResult.ok ? installedResult.stdout.match(/\b\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?\b/)?.[0] : void 0;
   const latestResult = run(
@@ -6313,9 +7405,9 @@ function inspectDevSpaceHealth(options) {
     5e3
   );
   const latestVersion = latestResult.ok ? latestResult.stdout.match(/\b\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?\b/)?.[0] : void 0;
-  const processResult = run("pgrep", ["-f", "devspace serve"], 3e3);
-  const pid = processResult.ok ? processResult.stdout.match(/\b\d+\b/)?.[0] : void 0;
-  const processEnvironment = pid ? run("ps", ["eww", "-p", pid, "-o", "command="], 3e3) : void 0;
+  const processResult = process.platform === "win32" ? run("tasklist", ["/FI", "IMAGENAME eq devspace.exe", "/FO", "CSV", "/NH"], 3e3) : run("pgrep", ["-f", "devspace serve"], 3e3);
+  const pid = processResult.ok ? process.platform === "win32" ? processResult.stdout.match(/"devspace\.exe","(\d+)"/i)?.[1] : processResult.stdout.match(/\b\d+\b/)?.[0] : void 0;
+  const processEnvironment = process.platform !== "win32" && pid ? run("ps", ["eww", "-p", pid, "-o", "command="], 3e3) : void 0;
   const processToolMode = processEnvironment?.ok ? processEnvironment.stdout.match(
     /(?:^|\s)DEVSPACE_TOOL_MODE=(minimal|full|codex)(?:\s|$)/
   )?.[1] : void 0;
@@ -6327,9 +7419,9 @@ function inspectDevSpaceHealth(options) {
     (repositoryPath) => allowedRoots.some((root) => isPathInside(repositoryPath, root))
   ) ? "complete" : "partial";
   const bind = configExists && typeof configValue.host === "string" ? isLoopbackHost(configValue.host) ? "loopback" : "non-loopback" : "unknown";
-  const directoryMode = existsSync27(configDirectory) ? modeString(statSync8(configDirectory).mode) : void 0;
-  const fileMode = existsSync27(configPath) ? modeString(statSync8(configPath).mode) : void 0;
-  const authMode = existsSync27(authPath) ? modeString(statSync8(authPath).mode) : void 0;
+  const directoryMode = process.platform !== "win32" && existsSync28(configDirectory) ? modeString(statSync9(configDirectory).mode) : void 0;
+  const fileMode = process.platform !== "win32" && existsSync28(configPath) ? modeString(statSync9(configPath).mode) : void 0;
+  const authMode = process.platform !== "win32" && existsSync28(authPath) ? modeString(statSync9(authPath).mode) : void 0;
   const update = installedVersion && latestVersion ? installedVersion === latestVersion ? "current" : "available" : "unknown";
   const recommendations = [];
   let status = "healthy";
@@ -6343,7 +7435,7 @@ function inspectDevSpaceHealth(options) {
   };
   if (!installedResult.ok) unhealthy("\u672C\u673A\u672A\u53D1\u73B0 DevSpace\uFF1B\u65E0\u6CD5\u4F7F\u7528\u5BBF\u4E3B\u5DE5\u4F5C\u533A\u670D\u52A1\u3002");
   if (!configExists) unhealthy("\u7F3A\u5C11 ~/.devspace/config.json\u3002");
-  if (!existsSync27(authPath)) unhealthy("\u7F3A\u5C11 ~/.devspace/auth.json\u3002");
+  if (!existsSync28(authPath)) unhealthy("\u7F3A\u5C11 ~/.devspace/auth.json\u3002");
   if (directoryMode && directoryMode !== "700")
     unhealthy(`~/.devspace \u76EE\u5F55\u6743\u9650\u4E3A ${directoryMode}\uFF0C\u5E94\u6536\u7D27\u4E3A 700\u3002`);
   if (fileMode && fileMode !== "600") unhealthy(`DevSpace \u914D\u7F6E\u6587\u4EF6\u6743\u9650\u4E3A ${fileMode}\uFF0C\u5E94\u4E3A 600\u3002`);
@@ -6353,7 +7445,7 @@ function inspectDevSpaceHealth(options) {
   if (doctor === "failed") unhealthy("devspace doctor \u672A\u901A\u8FC7\u3002");
   if (portfolioCoverage === "partial") attention("DevSpace allowedRoots \u6CA1\u6709\u8986\u76D6\u5168\u90E8\u5DF2\u767B\u8BB0\u4ED3\u5E93\u3002");
   if (installedResult.ok && !pid) attention("DevSpace \u5DF2\u5B89\u88C5\u4F46\u5F53\u524D\u6CA1\u6709\u8FD0\u884C\u3002");
-  if (options.expectedToolMode && pid && processToolMode !== options.expectedToolMode) {
+  if (options.expectedToolMode && pid && processToolMode !== void 0 && processToolMode !== options.expectedToolMode) {
     attention(
       `\u8FD0\u884C\u4E2D\u7684 DevSpace \u5DE5\u5177\u6A21\u5F0F\u4E3A ${processToolMode ?? "unknown"}\uFF0C\u671F\u671B ${options.expectedToolMode}\u3002`
     );
@@ -6376,7 +7468,7 @@ function inspectDevSpaceHealth(options) {
       exists: configExists,
       ...directoryMode ? { directoryMode } : {},
       ...fileMode ? { fileMode } : {},
-      authExists: existsSync27(authPath),
+      authExists: existsSync28(authPath),
       ...authMode ? { authMode } : {},
       bind,
       portValid: configExists && typeof configValue.port === "number" && Number.isInteger(configValue.port) && configValue.port > 0 && configValue.port <= 65535,
@@ -6388,24 +7480,18 @@ function inspectDevSpaceHealth(options) {
   };
 }
 function runDevSpaceCommand(command2, args, timeout) {
-  try {
-    return {
-      ok: true,
-      stdout: execFileSync4(command2, args, {
-        encoding: "utf8",
-        stdio: ["ignore", "pipe", "ignore"],
-        timeout
-      })
-    };
-  } catch {
-    return { ok: false, stdout: "" };
-  }
+  const result = spawnPlatformSync(command2, args, {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "ignore"],
+    timeout
+  });
+  return result.error || result.status !== 0 ? { ok: false, stdout: "" } : { ok: true, stdout: result.stdout };
 }
 function isLoopbackHost(host) {
   return ["127.0.0.1", "localhost", "::1"].includes(host.trim().toLowerCase());
 }
 function isPathInside(path, root) {
-  const fromRoot = relative10(resolve7(root), resolve7(path));
+  const fromRoot = relative11(resolve8(root), resolve8(path));
   return fromRoot === "" || fromRoot !== ".." && !fromRoot.startsWith(`..${sep2}`);
 }
 
@@ -6423,9 +7509,9 @@ var MCP_DISCOVERY_PATHS = {
   }
 };
 function inspectHostEnvironment(homeDir, grokVersion, repositoryPaths, devspaceSettings) {
-  const codexConfig = join28(homeDir, MCP_DISCOVERY_PATHS.user.codex);
-  const claudeConfig = join28(homeDir, MCP_DISCOVERY_PATHS.user.claudeCode);
-  const grokConfig = join28(homeDir, MCP_DISCOVERY_PATHS.user.grok);
+  const codexConfig = join29(homeDir, MCP_DISCOVERY_PATHS.user.codex);
+  const claudeConfig = join29(homeDir, MCP_DISCOVERY_PATHS.user.claudeCode);
+  const grokConfig = join29(homeDir, MCP_DISCOVERY_PATHS.user.grok);
   const hostEnvironment = {
     mcp: {
       codexUser: { path: codexConfig, names: tomlMcpNames(codexConfig) },
@@ -6433,11 +7519,11 @@ function inspectHostEnvironment(homeDir, grokVersion, repositoryPaths, devspaceS
       grokUser: { path: grokConfig, names: tomlMcpNames(grokConfig) }
     },
     skills: {
-      codexUser: inspectSkillRoot(join28(homeDir, ".agents/skills")),
-      claudeCodeUser: inspectSkillRoot(join28(homeDir, ".claude/skills")),
-      grokUser: inspectSkillRoot(join28(homeDir, ".grok/skills")),
-      grokAgentsCompatibility: inspectSkillRoot(join28(homeDir, ".agents/skills")),
-      grokClaudeCompatibility: inspectSkillRoot(join28(homeDir, ".claude/skills")),
+      codexUser: inspectSkillRoot(join29(homeDir, ".agents/skills")),
+      claudeCodeUser: inspectSkillRoot(join29(homeDir, ".claude/skills")),
+      grokUser: inspectSkillRoot(join29(homeDir, ".grok/skills")),
+      grokAgentsCompatibility: inspectSkillRoot(join29(homeDir, ".agents/skills")),
+      grokClaudeCompatibility: inspectSkillRoot(join29(homeDir, ".claude/skills")),
       ssot: inspectUserSkillsSsot(homeDir)
     },
     grok: {
@@ -6458,20 +7544,20 @@ function inspectHostEnvironment(homeDir, grokVersion, repositoryPaths, devspaceS
 function inspectSkillRoot(path) {
   const exists = pathLexists(path) && safeIsDirectory(path);
   const names = exists ? safeReadDir(path).filter(
-    (name) => !name.startsWith(".") && existsSync28(join28(path, name, "SKILL.md"))
+    (name) => !name.startsWith(".") && existsSync29(join29(path, name, "SKILL.md"))
   ) : [];
   return { path, exists, names };
 }
 function claudeProjectLocalMcpNames(homeDir, root) {
   if (!homeDir) return [];
-  const value = readJson4(join28(homeDir, MCP_DISCOVERY_PATHS.user.claudeCode));
+  const value = readJson4(join29(homeDir, MCP_DISCOVERY_PATHS.user.claudeCode));
   if (!isRecord3(value) || !isRecord3(value.projects)) return [];
   const candidates = new Set(
-    [resolve8(root), safeRealpath(root)].filter((path) => Boolean(path))
+    [resolve9(root), safeRealpath(root)].filter((path) => Boolean(path))
   );
   const names = /* @__PURE__ */ new Set();
   for (const [path, project] of Object.entries(value.projects)) {
-    const projectPaths = [resolve8(path), safeRealpath(path)].filter(
+    const projectPaths = [resolve9(path), safeRealpath(path)].filter(
       (candidate) => Boolean(candidate)
     );
     if (!projectPaths.some((candidate) => candidates.has(candidate)) || !isRecord3(project) || !isRecord3(project.mcpServers))
@@ -6490,19 +7576,19 @@ function inspectGrokProject(root, homeDir, grokVersion) {
   });
   if (!grokVersion) return empty("unavailable");
   try {
-    const value = JSON.parse(
-      execFileSync5("grok", ["inspect", "--json"], {
-        cwd: root,
-        encoding: "utf8",
-        env: { ...process.env, HOME: homeDir, GROK_HOME: join28(homeDir, ".grok") },
-        maxBuffer: 10 * 1024 * 1024,
-        stdio: ["ignore", "pipe", "ignore"],
-        timeout: 8e3
-      })
-    );
+    const result = spawnPlatformSync("grok", ["inspect", "--json"], {
+      cwd: root,
+      encoding: "utf8",
+      env: { ...process.env, HOME: homeDir, GROK_HOME: join29(homeDir, ".grok") },
+      maxBuffer: 10 * 1024 * 1024,
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 8e3
+    });
+    if (result.error || result.status !== 0) return empty("failed");
+    const value = JSON.parse(result.stdout);
     if (!isRecord3(value)) return empty("failed");
     const userClaudeNames = new Set(
-      jsonObjectKeys(join28(homeDir, MCP_DISCOVERY_PATHS.user.claudeCode), "mcpServers")
+      jsonObjectKeys(join29(homeDir, MCP_DISCOVERY_PATHS.user.claudeCode), "mcpServers")
     );
     const localClaudeNames = new Set(claudeProjectLocalMcpNames(homeDir, root));
     const effectiveMcp = Array.isArray(value.mcpServers) ? value.mcpServers.flatMap((item) => {
@@ -6570,25 +7656,26 @@ function inferGrokMcpScope(name, sourceType, sourcePath, root, homeDir, userClau
     if (userClaudeNames.has(name)) return "user";
     return "unknown";
   }
-  const resolvedSource = safeRealpath(sourcePath) ?? resolve8(sourcePath);
-  const resolvedRoot = safeRealpath(root) ?? resolve8(root);
-  if (resolvedSource === join28(resolvedRoot, MCP_DISCOVERY_PATHS.project.claudeCodeShared))
+  const resolvedSource = safeRealpath(sourcePath) ?? resolve9(sourcePath);
+  const resolvedRoot = safeRealpath(root) ?? resolve9(root);
+  if (resolvedSource === join29(resolvedRoot, MCP_DISCOVERY_PATHS.project.claudeCodeShared))
     return "project-shared";
   if (resolvedSource.startsWith(resolvedRoot + sep3)) return "project";
-  if (homeDir && resolvedSource === join28(resolve8(homeDir), MCP_DISCOVERY_PATHS.user.claudeCode)) {
+  if (homeDir && resolvedSource === join29(resolve9(homeDir), MCP_DISCOVERY_PATHS.user.claudeCode)) {
     if (localClaudeNames.has(name)) return "project-local";
     if (userClaudeNames.has(name)) return "user";
   }
-  if (homeDir && resolvedSource.startsWith(resolve8(homeDir) + sep3)) return "user";
+  if (homeDir && resolvedSource.startsWith(resolve9(homeDir) + sep3)) return "user";
   if (sourceType === "project") return "project";
   return "unknown";
 }
 
 // src/portfolio/ai-health/secrets.ts
-import { existsSync as existsSync29, lstatSync as lstatSync12, readdirSync as readdirSync12, statSync as statSync9 } from "node:fs";
-import { join as join29, relative as relative11, sep as sep4 } from "node:path";
+import { existsSync as existsSync30, lstatSync as lstatSync13, readdirSync as readdirSync13, statSync as statSync10 } from "node:fs";
+import { join as join30, relative as relative12, sep as sep4 } from "node:path";
+var supportsPosixModes = process.platform !== "win32";
 function inspectRepositorySecrets(root, id, secretsRoot, isRepository, environmentPolicy) {
-  const centralPath = join29(secretsRoot, id);
+  const centralPath = join30(secretsRoot, id);
   const centralRealPath = safeRealpath(centralPath);
   const localOnlyReasons = new Map(
     (environmentPolicy?.localOnly ?? []).map((entry) => [entry.path, entry.reason])
@@ -6600,16 +7687,16 @@ function inspectRepositorySecrets(root, id, secretsRoot, isRepository, environme
       tracked: isRepository ? gitTracks(root, path) : false,
       template: isEnvironmentTemplate(path),
       fixture: isEnvironmentFixture(path),
-      symlink: lstatSync12(join29(root, path)).isSymbolicLink(),
-      centralized: pointsInside(join29(root, path), centralRealPath),
+      symlink: lstatSync13(join30(root, path)).isSymbolicLink(),
+      centralized: pointsInside(join30(root, path), centralRealPath),
       localOnly: localOnlyReason !== void 0,
       ...localOnlyReason !== void 0 ? { localOnlyReason } : {}
     };
   });
   return {
-    centralDirectory: existsSync29(centralPath) ? "present" : "absent",
-    centralMode: existsSync29(centralPath) ? modeString(statSync9(centralPath).mode) : void 0,
-    centralFiles: existsSync29(centralPath) ? collectCentralSecretFiles(centralPath) : [],
+    centralDirectory: existsSync30(centralPath) ? "present" : "absent",
+    centralMode: supportsPosixModes && existsSync30(centralPath) ? modeString(statSync10(centralPath).mode) : void 0,
+    centralFiles: existsSync30(centralPath) ? collectCentralSecretFiles(centralPath) : [],
     repositoryEnvFiles: envFiles
   };
 }
@@ -6632,12 +7719,12 @@ function collectEnvironmentFiles(root, current = root, depth = 0) {
   if (depth > 5) return [];
   const found = [];
   try {
-    for (const entry of readdirSync12(current, { withFileTypes: true })) {
+    for (const entry of readdirSync13(current, { withFileTypes: true })) {
       if (entry.isDirectory()) {
         if (!SKIP_ENV_DIRECTORIES.has(entry.name))
-          found.push(...collectEnvironmentFiles(root, join29(current, entry.name), depth + 1));
+          found.push(...collectEnvironmentFiles(root, join30(current, entry.name), depth + 1));
       } else if (isEnvironmentFilename(entry.name) && !isProviderGeneratedEnvironmentFile(entry.name)) {
-        found.push(relative11(root, join29(current, entry.name)));
+        found.push(relative12(root, join30(current, entry.name)).replaceAll("\\", "/"));
       }
     }
   } catch {
@@ -6649,10 +7736,14 @@ function collectCentralSecretFiles(root, current = root, depth = 0) {
   if (depth > 3) return [];
   const found = [];
   try {
-    for (const entry of readdirSync12(current, { withFileTypes: true })) {
-      const path = join29(current, entry.name);
+    for (const entry of readdirSync13(current, { withFileTypes: true })) {
+      const path = join30(current, entry.name);
       if (entry.isDirectory()) found.push(...collectCentralSecretFiles(root, path, depth + 1));
-      else found.push({ path: relative11(root, path), mode: modeString(lstatSync12(path).mode) });
+      else
+        found.push({
+          path: relative12(root, path).replaceAll("\\", "/"),
+          mode: supportsPosixModes ? modeString(lstatSync13(path).mode) : "unknown"
+        });
     }
   } catch {
     return found;
@@ -6676,30 +7767,35 @@ function isEnvironmentFixture(path) {
   return /(^|[\\/])(?:tests?|__tests__)[\\/]fixtures?[\\/]/i.test(path) || /(^|[\\/])__fixtures__[\\/]/i.test(path);
 }
 function pointsInside(path, expectedRoot) {
-  if (!expectedRoot || !lstatSync12(path).isSymbolicLink()) return false;
+  if (!expectedRoot || !lstatSync13(path).isSymbolicLink()) return false;
   const target = safeRealpath(path);
   if (!target) return false;
-  const fromRoot = relative11(expectedRoot, target);
+  const fromRoot = relative12(expectedRoot, target);
   return fromRoot === "" || fromRoot !== ".." && !fromRoot.startsWith(`..${sep4}`);
 }
 function hasUnsafeCentralSecretPermissions(secrets) {
+  if (!supportsPosixModes) return false;
   return secrets.centralDirectory === "present" && (secrets.centralMode !== "700" || secrets.centralFiles.some((file) => file.mode !== "600"));
 }
 function inspectSecretsRoot(path) {
-  return existsSync29(path) ? { path, exists: true, mode: modeString(statSync9(path).mode) } : { path, exists: false };
+  return existsSync30(path) ? {
+    path,
+    exists: true,
+    ...supportsPosixModes ? { mode: modeString(statSync10(path).mode) } : {}
+  } : { path, exists: false };
 }
 
 // src/portfolio/ai-health/skills.ts
-import { existsSync as existsSync30, lstatSync as lstatSync13, realpathSync as realpathSync8 } from "node:fs";
-import { join as join30 } from "node:path";
+import { existsSync as existsSync31, lstatSync as lstatSync14, realpathSync as realpathSync8 } from "node:fs";
+import { join as join31 } from "node:path";
 function countAutomaticSkillsNeedingReview(skills) {
   return skills.automatic.filter(
     (item) => !item.managed || !item.registryId || item.expectedPlacement !== "auto" || item.expectedScope === "user"
   ).length;
 }
 function inspectSkills(root, grokInspection, registeredSkills, userSkills) {
-  const lock = readJson4(join30(root, ".pro-gov/assets.lock.json"));
-  const assetManifest = readJson4(join30(root, ".pro-gov/assets.json"));
+  const lock = readJson4(join31(root, ".pro-gov/assets.lock.json"));
+  const assetManifest = readJson4(join31(root, ".pro-gov/assets.json"));
   const managed = /* @__PURE__ */ new Set();
   const bundleIds = stringArray(isRecord3(lock) ? lock.bundleIds : void 0);
   if (isRecord3(lock) && Array.isArray(lock.assets)) {
@@ -6711,7 +7807,7 @@ function inspectSkills(root, grokInspection, registeredSkills, userSkills) {
   }
   const inspectPlacement = (placement) => {
     const directory = placement === "auto" ? "skills" : "manual-skills";
-    const skillRoot = join30(root, ".agents", directory);
+    const skillRoot = join31(root, ".agents", directory);
     if (!pathLexists(skillRoot) || !safeIsDirectory(skillRoot)) return [];
     return safeReadDir(skillRoot).filter((name) => !name.startsWith(".")).map((name) => inspectSkillItem(skillRoot, directory, name, managed, registeredSkills));
   };
@@ -6766,15 +7862,15 @@ function inspectSkills(root, grokInspection, registeredSkills, userSkills) {
     },
     hosts: {
       codexProject: automatic.filter((item) => item.kind !== "dangling-symlink").length,
-      claudeCodeProject: inspectSkillRoot(join30(root, ".claude/skills")).names.length,
-      grokNativeProject: inspectSkillRoot(join30(root, ".grok/skills")).names.length,
+      claudeCodeProject: inspectSkillRoot(join31(root, ".claude/skills")).names.length,
+      grokNativeProject: inspectSkillRoot(join31(root, ".grok/skills")).names.length,
       grokEffective: grokInspection.skills
     }
   };
 }
 function inspectSkillItem(skillRoot, directory, name, managed, registeredSkills) {
-  const path = join30(skillRoot, name);
-  const stat = lstatSync13(path);
+  const path = join31(skillRoot, name);
+  const stat = lstatSync14(path);
   let kind = stat.isSymbolicLink() ? "symlink" : stat.isDirectory() ? "directory" : "file";
   let realPath;
   try {
@@ -6783,7 +7879,7 @@ function inspectSkillItem(skillRoot, directory, name, managed, registeredSkills)
     if (stat.isSymbolicLink()) kind = "dangling-symlink";
   }
   const registered = realPath ? registeredSkills.find((skill) => skill.sourceRealPath === realPath) : void 0;
-  const classification = registered ? void 0 : realPath && isPluginPack(realPath) ? "plugin-pack" : kind === "directory" && existsSync30(join30(path, "SKILL.md")) ? "project-local" : void 0;
+  const classification = registered ? void 0 : realPath && isPluginPack(realPath) ? "plugin-pack" : kind === "directory" && existsSync31(join31(path, "SKILL.md")) ? "project-local" : void 0;
   return {
     name,
     kind,
@@ -6795,11 +7891,11 @@ function inspectSkillItem(skillRoot, directory, name, managed, registeredSkills)
   };
 }
 function isPluginPack(path) {
-  const skillsRoot = join30(path, "skills");
-  return existsSync30(join30(path, ".codex-plugin/plugin.json")) && safeIsDirectory(skillsRoot) && safeReadDir(skillsRoot).some((name) => existsSync30(join30(skillsRoot, name, "SKILL.md")));
+  const skillsRoot = join31(path, "skills");
+  return existsSync31(join31(path, ".codex-plugin/plugin.json")) && safeIsDirectory(skillsRoot) && safeReadDir(skillsRoot).some((name) => existsSync31(join31(skillsRoot, name, "SKILL.md")));
 }
 function inspectInvalidSkillEntries(root, directory) {
-  const skillRoot = join30(root, ".agents", directory);
+  const skillRoot = join31(root, ".agents", directory);
   if (!pathLexists(skillRoot) || !safeIsDirectory(skillRoot)) return [];
   return safeReadDir(skillRoot).flatMap((name) => {
     if (name === ".gitkeep") return [];
@@ -6807,14 +7903,14 @@ function inspectInvalidSkillEntries(root, directory) {
       return [{ path: `.agents/${directory}/${name}`, reason: "metadata-junk" }];
     if (name.startsWith("."))
       return [{ path: `.agents/${directory}/${name}`, reason: "unexpected-file" }];
-    const path = join30(skillRoot, name);
-    return !lstatSync13(path).isDirectory() && !lstatSync13(path).isSymbolicLink() ? [{ path: `.agents/${directory}/${name}`, reason: "unexpected-file" }] : [];
+    const path = join31(skillRoot, name);
+    return !lstatSync14(path).isDirectory() && !lstatSync14(path).isSymbolicLink() ? [{ path: `.agents/${directory}/${name}`, reason: "unexpected-file" }] : [];
   });
 }
 function skillDuplicatesUser(item, root, userSkills) {
   if (userSkills.names.has(item.name)) return true;
-  const automatic = join30(root, ".agents/skills", item.name);
-  const manual = join30(root, ".agents/manual-skills", item.name);
+  const automatic = join31(root, ".agents/skills", item.name);
+  const manual = join31(root, ".agents/manual-skills", item.name);
   const realPath = safeRealpath(pathLexists(automatic) ? automatic : manual);
   return realPath ? userSkills.realPaths.has(realPath) : false;
 }
@@ -6834,13 +7930,13 @@ function skillPlacementDrift(item, actualPlacement) {
   return [];
 }
 function inspectClaudeSkillRoot(root) {
-  const path = join30(root, ".claude/skills");
+  const path = join31(root, ".claude/skills");
   if (!pathLexists(path)) return "missing";
-  const stat = lstatSync13(path);
+  const stat = lstatSync14(path);
   if (stat.isSymbolicLink()) {
     try {
       const target = realpathSync8(path);
-      return target === realpathSync8(join30(root, ".agents/skills")) ? "shared-root" : "other";
+      return target === realpathSync8(join31(root, ".agents/skills")) ? "shared-root" : "other";
     } catch {
       return "dangling-symlink";
     }
@@ -6853,27 +7949,27 @@ function inspectSkillRegistry(executionEngineRoot) {
       health: { source: 0, registered: 0, bundled: 0, bundles: 0 },
       skills: []
     };
-  const agentAssetsRoot = join30(executionEngineRoot, "agent-assets");
-  const registry = readJson4(join30(agentAssetsRoot, "registry.json"));
+  const agentAssetsRoot = join31(executionEngineRoot, "agent-assets");
+  const registry = readJson4(join31(agentAssetsRoot, "registry.json"));
   const assets = isRecord3(registry) && Array.isArray(registry.assets) ? registry.assets : [];
   const registeredSkills = assets.filter((asset) => isRecord3(asset) && asset.kind === "skill");
-  const bundleRoot = join30(agentAssetsRoot, "bundles");
+  const bundleRoot = join31(agentAssetsRoot, "bundles");
   const bundleFiles = safeReadDir(bundleRoot).filter((file) => file.endsWith(".json"));
   const bundledIds = /* @__PURE__ */ new Set();
   for (const file of bundleFiles) {
-    const bundle = readJson4(join30(bundleRoot, file));
+    const bundle = readJson4(join31(bundleRoot, file));
     if (!isRecord3(bundle) || !Array.isArray(bundle.assets)) continue;
     for (const id of bundle.assets) if (typeof id === "string") bundledIds.add(id);
   }
   const sourceRoots = [
-    join30(agentAssetsRoot, "skills/pie-skills"),
-    join30(agentAssetsRoot, "skills/npx-skills/.agents/skills")
+    join31(agentAssetsRoot, "skills/pie-skills"),
+    join31(agentAssetsRoot, "skills/npx-skills/.agents/skills")
   ];
   const source = sourceRoots.reduce(
-    (count, root) => count + safeReadDir(root).filter((name) => existsSync30(join30(root, name, "SKILL.md"))).length,
+    (count, root) => count + safeReadDir(root).filter((name) => existsSync31(join31(root, name, "SKILL.md"))).length,
     0
   ) + registeredSkills.filter(
-    (asset) => isRecord3(asset) && asset.sourceKind === "local-pack" && typeof asset.sourcePath === "string" && isPluginPack(join30(agentAssetsRoot, asset.sourcePath))
+    (asset) => isRecord3(asset) && asset.sourceKind === "local-pack" && typeof asset.sourcePath === "string" && isPluginPack(join31(agentAssetsRoot, asset.sourcePath))
   ).length;
   return {
     health: {
@@ -6890,7 +7986,7 @@ function inspectSkillRegistry(executionEngineRoot) {
       return [
         {
           id: asset.id,
-          sourceRealPath: safeRealpath(join30(agentAssetsRoot, asset.sourcePath)),
+          sourceRealPath: safeRealpath(join31(agentAssetsRoot, asset.sourcePath)),
           defaultPlacement: asset.defaultPlacement,
           defaultScope: asset.defaultScope === "user" ? "user" : "project"
         }
@@ -6905,15 +8001,15 @@ function inspectUserSkillEvidence(root) {
   for (const name of safeReadDir(root)) {
     if (name.startsWith(".")) continue;
     names.add(name);
-    const realPath = safeRealpath(join30(root, name));
+    const realPath = safeRealpath(join31(root, name));
     if (realPath) realPaths.add(realPath);
   }
   return { names, realPaths };
 }
 
 // src/portfolio/ai-health/technology.ts
-import { existsSync as existsSync31, readdirSync as readdirSync13, statSync as statSync10 } from "node:fs";
-import { join as join31 } from "node:path";
+import { existsSync as existsSync32, readdirSync as readdirSync14, statSync as statSync11 } from "node:fs";
+import { join as join32 } from "node:path";
 function buildTechnologyMatrix(governance, repositories) {
   if (!governance || governance.technologies.length === 0) return [];
   const policy = governance.versionPolicy;
@@ -6940,8 +8036,8 @@ function buildTechnologyMatrix(governance, repositories) {
         }).filter((item) => item !== void 0);
       }).flat();
       const fileSignal = (technology.files ?? []).some(
-        (path) => hasUsableTechnologyFile(join31(repository.path, path)) || packageManifests.some(
-          (manifest) => hasUsableTechnologyFile(join31(manifest.directory, path))
+        (path) => hasUsableTechnologyFile(join32(repository.path, path)) || packageManifests.some(
+          (manifest) => hasUsableTechnologyFile(join32(manifest.directory, path))
         )
       );
       const modelSignal = [
@@ -7032,14 +8128,14 @@ function buildTechnologyMatrix(governance, repositories) {
   }).filter((technology) => technology.projectCount > 0);
 }
 function hasUsableTechnologyFile(path) {
-  if (!existsSync31(path)) return false;
+  if (!existsSync32(path)) return false;
   try {
-    const info = statSync10(path);
+    const info = statSync11(path);
     if (info.isFile()) return true;
     if (!info.isDirectory()) return false;
-    return readdirSync13(path, { withFileTypes: true }).some((entry) => {
+    return readdirSync14(path, { withFileTypes: true }).some((entry) => {
       if (entry.name.startsWith(".")) return false;
-      const child = join31(path, entry.name);
+      const child = join32(path, entry.name);
       if (entry.isDirectory()) return hasUsableTechnologyFile(child);
       return entry.name.toLowerCase() !== "readme.md";
     });
@@ -7051,7 +8147,7 @@ function inspectExclusiveOwnership(root, endpoint, governance) {
   const projectType = endpoint.projectType;
   return (governance?.exclusiveOwnership ?? []).flatMap((rule) => {
     if (projectType && rule.allowedProjectTypes.includes(projectType)) return [];
-    const paths = rule.paths.filter((path) => existsSync31(join31(root, path)));
+    const paths = rule.paths.filter((path) => existsSync32(join32(root, path)));
     return paths.length > 0 ? [{ rule, paths }] : [];
   });
 }
@@ -7066,7 +8162,7 @@ function inspectProjectModel(root, endpoint, governance) {
   const detection = (id) => {
     const technology = technologyById.get(id);
     const packageMatch = technology?.packages?.some((name) => packages.has(name)) ?? false;
-    const fileMatch = technology?.files?.some((path) => existsSync31(join31(root, path))) ?? false;
+    const fileMatch = technology?.files?.some((path) => existsSync32(join32(root, path))) ?? false;
     return { id, label: technology?.label ?? id, detected: packageMatch || fileMatch };
   };
   const selected = new Set(endpoint.capabilities ?? []);
@@ -7105,8 +8201,8 @@ function collectPackageNames(root) {
 }
 
 // src/portfolio/ai-health/report.ts
-import { cpSync as cpSync3, existsSync as existsSync32, mkdirSync as mkdirSync10, writeFileSync as writeFileSync9 } from "node:fs";
-import { dirname as dirname16, join as join32 } from "node:path";
+import { cpSync as cpSync3, existsSync as existsSync33, mkdirSync as mkdirSync11, writeFileSync as writeFileSync10 } from "node:fs";
+import { dirname as dirname17, join as join33 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 function mergePortfolioAiHealthReport(existing, latest, allRepositoryIds) {
   const repositoriesById = /* @__PURE__ */ new Map();
@@ -7147,36 +8243,36 @@ function mergePortfolioAiHealthReport(existing, latest, allRepositoryIds) {
   };
 }
 function writePortfolioAiHealthReport(report, outDir) {
-  mkdirSync10(outDir, { recursive: true });
+  mkdirSync11(outDir, { recursive: true });
   const dashboardAssets = findDashboardAssets();
   for (const file of ["index.html", "app.js", "app.css"]) {
-    const source = join32(dashboardAssets, file);
-    if (!existsSync32(source)) throw new Error(`Portfolio dashboard asset is missing: ${source}`);
-    cpSync3(source, join32(outDir, file));
+    const source = join33(dashboardAssets, file);
+    if (!existsSync33(source)) throw new Error(`Portfolio dashboard asset is missing: ${source}`);
+    cpSync3(source, join33(outDir, file));
   }
-  const jsonPath = join32(outDir, "portfolio-ai-health.json");
-  const htmlPath = join32(outDir, "index.html");
-  writeFileSync9(jsonPath, `${JSON.stringify(report, null, 2)}
+  const jsonPath = join33(outDir, "portfolio-ai-health.json");
+  const htmlPath = join33(outDir, "index.html");
+  writeFileSync10(jsonPath, `${JSON.stringify(report, null, 2)}
 `);
-  writeFileSync9(
-    join32(outDir, "data.js"),
+  writeFileSync10(
+    join33(outDir, "data.js"),
     `window.__PORTFOLIO_AI_HEALTH__ = ${safeJavaScriptJson2(report)};
 `
   );
   return { jsonPath, htmlPath };
 }
 function findDashboardAssets() {
-  const packageRoot2 = dirname16(dirname16(fileURLToPath5(import.meta.url)));
+  const packageRoot2 = dirname17(dirname17(fileURLToPath5(import.meta.url)));
   const candidates = [
     process.env.PGS_DASHBOARD_ASSETS_DIR,
-    join32(packageRoot2, ".dashboard-build"),
-    join32(packageRoot2, "assets/portfolio-dashboard"),
-    join32(process.cwd(), ".dashboard-build"),
-    join32(process.cwd(), "assets/portfolio-dashboard"),
-    join32(process.cwd(), "packages/pro-gov/.dashboard-build"),
-    join32(process.cwd(), "packages/pro-gov/assets/portfolio-dashboard")
+    join33(packageRoot2, ".dashboard-build"),
+    join33(packageRoot2, "assets/portfolio-dashboard"),
+    join33(process.cwd(), ".dashboard-build"),
+    join33(process.cwd(), "assets/portfolio-dashboard"),
+    join33(process.cwd(), "packages/pro-gov/.dashboard-build"),
+    join33(process.cwd(), "packages/pro-gov/assets/portfolio-dashboard")
   ].filter((value) => Boolean(value));
-  const match = candidates.find((path) => existsSync32(join32(path, "index.html")));
+  const match = candidates.find((path) => existsSync33(join33(path, "index.html")));
   if (!match)
     throw new Error(
       "Portfolio dashboard assets were not built. Run pnpm --filter @pieai/pro-gov build."
@@ -7194,8 +8290,8 @@ function inspectPortfolioAiHealth(options) {
   if (options.targetId && options.targetId !== "all" && endpoints.length === 0) {
     throw new Error(`Unknown portfolio target: ${options.targetId}`);
   }
-  const secretsRoot = options.secretsRoot ?? join33(
-    dirname17(
+  const secretsRoot = options.secretsRoot ?? join34(
+    dirname18(
       options.manifest.controlPlane?.path ?? allEndpoints[0]?.endpoint.path ?? process.cwd()
     ),
     ".secrets"
@@ -7204,9 +8300,9 @@ function inspectPortfolioAiHealth(options) {
   const grokVersion = commandVersion("grok");
   const executionEngineRoot = options.manifest.executionEngine?.path;
   const skillRegistry = inspectSkillRegistry(executionEngineRoot);
-  const userSkills = inspectUserSkillEvidence(join33(homeDir, ".agents/skills"));
+  const userSkills = inspectUserSkillEvidence(join34(homeDir, ".agents/skills"));
   const expectedPackageVersion = packageVersion(
-    join33(executionEngineRoot ?? "", "packages/pro-gov/package.json")
+    join34(executionEngineRoot ?? "", "packages/pro-gov/package.json")
   );
   const repositories = endpoints.map(
     ({ endpoint, role }) => inspectRepository(
@@ -7263,7 +8359,7 @@ function collectEndpoints(manifest) {
   for (const target of manifest.targets) result.push({ endpoint: target, role: "target" });
   const seen = /* @__PURE__ */ new Set();
   return result.filter(({ endpoint }) => {
-    const key = resolve9(endpoint.path);
+    const key = resolve10(endpoint.path);
     if (seen.has(key)) return false;
     seen.add(key);
     return true;
@@ -7280,13 +8376,13 @@ function inspectRepository(endpoint, role, secretsRoot, homeDir, expectedPackage
   const hooks = inspectHooks(root);
   const docs = inspectDocs(root, role === "execution-engine" ? void 0 : expectedPackageVersion);
   const mcp = {
-    codexProject: tomlMcpNames(join33(root, MCP_DISCOVERY_PATHS.project.codex)),
+    codexProject: tomlMcpNames(join34(root, MCP_DISCOVERY_PATHS.project.codex)),
     claudeCodeProjectShared: jsonObjectKeys(
-      join33(root, MCP_DISCOVERY_PATHS.project.claudeCodeShared),
+      join34(root, MCP_DISCOVERY_PATHS.project.claudeCodeShared),
       "mcpServers"
     ),
     claudeCodeProjectLocal: claudeProjectLocalMcpNames(homeDir, root),
-    grokProject: tomlMcpNames(join33(root, MCP_DISCOVERY_PATHS.project.grok)),
+    grokProject: tomlMcpNames(join34(root, MCP_DISCOVERY_PATHS.project.grok)),
     grokEffective: grokInspection.effectiveMcp,
     grokInspection: grokInspection.inspection
   };
@@ -7920,14 +9016,15 @@ function isHost2(value) {
   return value === "codex" || value === "claude-code" || value === "gemini-cli" || value === "antigravity";
 }
 function findPortfolioAgentAssetsDir(manifest) {
-  const agentAssetsDir = manifest?.executionEngine?.path ? join34(manifest.executionEngine.path, "agent-assets") : void 0;
-  return agentAssetsDir && existsSync33(join34(agentAssetsDir, "registry.json")) ? agentAssetsDir : void 0;
+  const agentAssetsDir = manifest?.executionEngine?.path ? join35(manifest.executionEngine.path, "agent-assets") : void 0;
+  return agentAssetsDir && existsSync34(join35(agentAssetsDir, "registry.json")) ? agentAssetsDir : void 0;
 }
 function reportMissingPortfolioRegistry(loaded, json) {
-  const expectedPath = loaded.manifest?.executionEngine?.path ? join34(loaded.manifest.executionEngine.path, "agent-assets/registry.json") : "executionEngine.path/agent-assets/registry.json";
+  const expectedPath = loaded.manifest?.executionEngine?.path ? join35(loaded.manifest.executionEngine.path, "agent-assets/registry.json") : "executionEngine.path/agent-assets/registry.json";
+  const displayExpectedPath = expectedPath.replaceAll("\\", "/");
   const issue = {
     type: "missing-control-plane-registry",
-    message: `Portfolio control-plane registry is required at ${expectedPath}; refusing the package fallback registry.`
+    message: `Portfolio control-plane registry is required at ${displayExpectedPath}; refusing the package fallback registry.`
   };
   if (json) {
     console.log(
@@ -7962,10 +9059,10 @@ function printUsage5() {
 }
 function readExistingAiHealthReport(outDir, portfolioId) {
   if (!outDir) return void 0;
-  const path = join34(outDir, "portfolio-ai-health.json");
-  if (!existsSync33(path)) return void 0;
+  const path = join35(outDir, "portfolio-ai-health.json");
+  if (!existsSync34(path)) return void 0;
   try {
-    const value = JSON.parse(readFileSync18(path, "utf8"));
+    const value = JSON.parse(readFileSync19(path, "utf8"));
     if (!value || typeof value !== "object" || value.portfolioId !== portfolioId || !Array.isArray(value.repositories))
       return void 0;
     return value;
@@ -7975,8 +9072,8 @@ function readExistingAiHealthReport(outDir, portfolioId) {
 }
 
 // src/commands/sync.ts
-import { existsSync as existsSync34, lstatSync as lstatSync14, readFileSync as readFileSync19, readlinkSync as readlinkSync4 } from "node:fs";
-import { join as join35 } from "node:path";
+import { existsSync as existsSync35, lstatSync as lstatSync15, readFileSync as readFileSync20, readlinkSync as readlinkSync4 } from "node:fs";
+import { join as join36 } from "node:path";
 function runSync(args) {
   const check = args.includes("--check");
   if (!check) {
@@ -8004,7 +9101,7 @@ function runSync(args) {
   console.log("pro-gov sync check");
   console.log(`profile: ${profile}`);
   for (const file of planStarterFiles(profile)) {
-    const targetPath = join35(process.cwd(), file.targetPath);
+    const targetPath = join36(process.cwd(), file.targetPath);
     const stat = safeLstat3(targetPath);
     if (!stat) {
       if (file.ownership === "optional-guardrail") continue;
@@ -8022,14 +9119,14 @@ function runSync(args) {
       continue;
     }
     if (file.kind === "symlink") {
-      if (!stat.isSymbolicLink() || readlinkSync4(targetPath) !== file.linkTarget) {
+      if (!stat.isSymbolicLink() || normalizeSymlinkTarget(readlinkSync4(targetPath)) !== file.linkTarget) {
         console.log(`different: ${file.targetPath}`);
         differences += 1;
       }
       continue;
     }
-    const source = readFileSync19(file.absoluteSourcePath, "utf8");
-    const target = readFileSync19(targetPath, "utf8");
+    const source = readFileSync20(file.absoluteSourcePath, "utf8");
+    const target = readFileSync20(targetPath, "utf8");
     if (!matchesExpectedContent(file.targetPath, source, target)) {
       console.log(`different: ${file.targetPath}`);
       differences += 1;
@@ -8063,13 +9160,13 @@ function normalizeMarkdownTableCell(cell) {
 }
 function inferInstalledProfile(root) {
   const installed = ["engineering-runtime", "doc-only"].filter(
-    (profile) => existsSync34(join35(root, `docs/governance/agents-routing/${profile}-v1.1.md`))
+    (profile) => existsSync35(join36(root, `docs/governance/agents-routing/${profile}-v1.1.md`))
   );
   return installed.length === 1 ? installed[0] : void 0;
 }
 function safeLstat3(path) {
   try {
-    return lstatSync14(path);
+    return lstatSync15(path);
   } catch {
     return void 0;
   }
@@ -8090,6 +9187,7 @@ var COMMANDS = [
   "assets check [--target <path>] [--strict-registry] [--json]",
   "assets public-check [--public-root <path>] [--private-root <path>] [--json]",
   "assets npx add|update ... --plan",
+  "assets catalog build|check [--native-links] [--json]",
   "portfolio check --config <path> [--json]",
   "portfolio plan --config <path> [--target <id|all>] [--json]",
   "portfolio assets-check --config <path> [--target <id|all>] [--json]",