@rhize/skill-forge 0.1.0

package/dist/cli.js

@@ -0,0 +1,1341 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { Command } from "commander";
+import { createRequire } from "module";
+
+// src/commands/add.ts
+import { createInterface } from "readline/promises";
+import { spawnSync } from "child_process";
+
+// src/config.ts
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+function getHomeDir() {
+  return process.env.SKILL_FORGE_HOME ?? join(homedir(), ".skill-forge");
+}
+function getConfigPath() {
+  return join(getHomeDir(), "config.json");
+}
+function defaultConfig() {
+  const home = getHomeDir();
+  return {
+    skillsRoots: [join(process.cwd(), ".claude", "skills")],
+    quarantineDir: join(home, "quarantine"),
+    strictness: "block-high"
+  };
+}
+function loadConfig() {
+  const configPath = getConfigPath();
+  const defaults = defaultConfig();
+  if (!existsSync(configPath)) {
+    return defaults;
+  }
+  const raw = readFileSync(configPath, "utf-8");
+  const parsed = JSON.parse(raw);
+  return {
+    skillsRoots: parsed.skillsRoots ?? defaults.skillsRoots,
+    quarantineDir: parsed.quarantineDir ?? defaults.quarantineDir,
+    strictness: parsed.strictness ?? defaults.strictness,
+    licenseKey: parsed.licenseKey ?? defaults.licenseKey
+  };
+}
+
+// src/install/resolve.ts
+import { existsSync as existsSync2 } from "fs";
+var GIT_URL_PATTERN = /^(git@|https?:\/\/|ssh:\/\/)/;
+function resolve(source) {
+  const value = source.trim();
+  if (GIT_URL_PATTERN.test(value) || value.endsWith(".git")) {
+    return { type: "git", value };
+  }
+  if (existsSync2(value)) {
+    return { type: "local", value };
+  }
+  return { type: "skills.sh", value };
+}
+
+// src/install/quarantine.ts
+import { randomUUID } from "crypto";
+import { spawn } from "child_process";
+import { cpSync, existsSync as existsSync3, mkdirSync as mkdirSync2, readdirSync } from "fs";
+import { basename, join as join2, resolve as resolvePath } from "path";
+var SKILL_MANIFEST = "SKILL.md";
+var SKIP_DIRS = /* @__PURE__ */ new Set([".git", "node_modules"]);
+async function quarantine(source, quarantineDir, deps = {}) {
+  const exec = deps.exec ?? defaultExec;
+  const id = randomUUID();
+  const quarantinePath = join2(quarantineDir, id);
+  mkdirSync2(quarantinePath, { recursive: true });
+  switch (source.type) {
+    case "skills.sh": {
+      const result = await exec("npx", ["-y", "skills@latest", "add", source.value], {
+        cwd: quarantinePath
+      });
+      if (result.code !== 0) {
+        throw new Error(
+          `skills.sh install failed for "${source.value}" (exit ${result.code}): ${result.stderr || result.stdout}`
+        );
+      }
+      break;
+    }
+    case "git": {
+      const clonePath = join2(quarantinePath, deriveGitDirName(source.value));
+      const result = await exec("git", ["clone", "--depth", "1", source.value, clonePath], {
+        cwd: quarantinePath
+      });
+      if (result.code !== 0) {
+        throw new Error(
+          `git clone failed for "${source.value}" (exit ${result.code}): ${result.stderr || result.stdout}`
+        );
+      }
+      break;
+    }
+    case "local": {
+      const dirName = basename(resolvePath(source.value));
+      cpSync(source.value, join2(quarantinePath, dirName), { recursive: true });
+      break;
+    }
+  }
+  return { id, quarantinePath, skillDirs: findSkillDirs(quarantinePath), source };
+}
+function listQuarantineIds(quarantineDir) {
+  if (!existsSync3(quarantineDir)) return [];
+  return readdirSync(quarantineDir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+}
+function findSkillDirs(root) {
+  const found = [];
+  function walk2(dir) {
+    let entries;
+    try {
+      entries = readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    if (entries.some((entry) => entry.isFile() && entry.name === SKILL_MANIFEST)) {
+      found.push(dir);
+    }
+    for (const entry of entries) {
+      if (entry.isDirectory() && !SKIP_DIRS.has(entry.name)) {
+        walk2(join2(dir, entry.name));
+      }
+    }
+  }
+  walk2(root);
+  return found;
+}
+function deriveGitDirName(url) {
+  const stripped = url.replace(/\.git$/, "");
+  const segments = stripped.split(/[/:]/).filter(Boolean);
+  return segments[segments.length - 1] || "repo";
+}
+function defaultExec(command, args, options) {
+  return new Promise((resolvePromise, reject2) => {
+    const child = spawn(command, args, { cwd: options.cwd });
+    let stdout = "";
+    let stderr = "";
+    child.stdout?.on("data", (chunk) => stdout += chunk.toString());
+    child.stderr?.on("data", (chunk) => stderr += chunk.toString());
+    child.on("error", reject2);
+    child.on("close", (code) => resolvePromise({ stdout, stderr, code: code ?? 1 }));
+  });
+}
+
+// src/install/promote.ts
+import { cpSync as cpSync2, existsSync as existsSync4, mkdirSync as mkdirSync3, renameSync, rmSync } from "fs";
+import { basename as basename2, join as join3 } from "path";
+function promote(entry, targetSkillsRoot, options = {}) {
+  const force = options.force ?? false;
+  for (const skillDir of entry.skillDirs) {
+    const dest = join3(targetSkillsRoot, basename2(skillDir));
+    if (existsSync4(dest) && !force) {
+      throw new Error(`Refusing to overwrite existing skill dir: ${dest} (pass force to override)`);
+    }
+  }
+  mkdirSync3(targetSkillsRoot, { recursive: true });
+  const promoted = [];
+  for (const skillDir of entry.skillDirs) {
+    const dest = join3(targetSkillsRoot, basename2(skillDir));
+    if (existsSync4(dest)) {
+      rmSync(dest, { recursive: true, force: true });
+    }
+    moveDir(skillDir, dest);
+    promoted.push(dest);
+  }
+  rmSync(entry.quarantinePath, { recursive: true, force: true });
+  return { promoted };
+}
+function reject(entry) {
+  rmSync(entry.quarantinePath, { recursive: true, force: true });
+}
+function hold(_entry) {
+}
+function moveDir(src, dest) {
+  try {
+    renameSync(src, dest);
+  } catch (err) {
+    if (err.code === "EXDEV") {
+      cpSync2(src, dest, { recursive: true });
+      rmSync(src, { recursive: true, force: true });
+    } else {
+      throw err;
+    }
+  }
+}
+
+// src/license.ts
+import { verify as cryptoVerify } from "crypto";
+var LICENSE_PREFIX = "skf1";
+var PUBLIC_KEY_PEM = `-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEAWSVbcX9u70IsN1O5zS5z+AYtAUVz7ExT7h+1gT9x+wQ=
+-----END PUBLIC KEY-----
+`;
+function readLicenseKey() {
+  const fromEnv = process.env.SKILL_FORGE_LICENSE?.trim();
+  if (fromEnv) return fromEnv;
+  return loadConfig().licenseKey?.trim() || void 0;
+}
+function isLicensePayload(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const p = value;
+  return typeof p.name === "string" && typeof p.email === "string" && typeof p.seats === "number" && typeof p.exp === "string";
+}
+function checkLicense(rawKey = readLicenseKey()) {
+  if (!rawKey) {
+    return { valid: false, reason: "missing" };
+  }
+  const parts = rawKey.trim().split(".");
+  if (parts.length !== 3 || parts[0] !== LICENSE_PREFIX) {
+    return { valid: false, reason: "malformed" };
+  }
+  const [, payloadPart, signaturePart] = parts;
+  const payloadBuffer = Buffer.from(payloadPart, "base64url");
+  const signature = Buffer.from(signaturePart, "base64url");
+  let payload;
+  try {
+    payload = JSON.parse(payloadBuffer.toString("utf-8"));
+  } catch {
+    return { valid: false, reason: "malformed" };
+  }
+  if (!isLicensePayload(payload)) {
+    return { valid: false, reason: "malformed" };
+  }
+  let signatureValid;
+  try {
+    signatureValid = cryptoVerify(null, payloadBuffer, PUBLIC_KEY_PEM, signature);
+  } catch {
+    return { valid: false, reason: "malformed" };
+  }
+  if (!signatureValid) {
+    return { valid: false, reason: "signature" };
+  }
+  const expMs = new Date(payload.exp).getTime();
+  if (Number.isNaN(expMs) || expMs < Date.now()) {
+    return { valid: false, reason: "expired" };
+  }
+  return { valid: true, payload };
+}
+function hasProLicense() {
+  return checkLicense().valid;
+}
+function upgradeNotice(feature) {
+  return `[skill-forge] Pro feature (${feature}) \u2014 set SKILL_FORGE_LICENSE or config.licenseKey to a valid license to unlock.`;
+}
+
+// src/report/render.ts
+var BORDER = "\u2501".repeat(55);
+var LABEL_WIDTH = 20;
+function padLabel(text) {
+  return text.padEnd(LABEL_WIDTH);
+}
+function renderListField(labelText, items, placeholder) {
+  const head = `${padLabel(labelText)}: `;
+  if (!items || items.length === 0) {
+    return `${head}${placeholder}`;
+  }
+  const bullets = items.map((item) => `  - ${item}`).join("\n");
+  return `${head.trimEnd()}
+${bullets}`;
+}
+function renderSafetyLine(safety) {
+  const detail = [safety.severity, safety.score !== void 0 ? `score ${safety.score}` : void 0].filter((v) => Boolean(v)).join(", ");
+  const withDetail = detail ? `${safety.verdict} (${detail})` : safety.verdict;
+  return safety.recommendation ? `${withDetail} \u2014 ${safety.recommendation}` : withDetail;
+}
+function renderReport(result) {
+  const { profile, overlap, overlapLocked, safety, worthTaking, leaveBehind } = result;
+  const name = profile.name ?? "unknown";
+  const version = profile.version ?? "unknown";
+  const license = profile.license ?? "UNKNOWN";
+  const overlapLines = overlapLocked ? [`${padLabel("Overlap analysis")}: ${upgradeNotice("overlap analysis")}`] : overlap ? [
+    `${padLabel("Nearest Rhize skill")}: ${overlap.nearest}  (overlap ${overlap.nearestScore})`,
+    `${padLabel("Recommended verb")}: ${overlap.suggestedVerb}`
+  ] : [`${padLabel("Nearest Rhize skill")}: n/a \u2014 no skills root configured`, `${padLabel("Recommended verb")}: n/a`];
+  const lines = [
+    BORDER,
+    `\u{1F528} Forge: ${name}  (v${version}, ${license})`,
+    BORDER,
+    ...overlapLines,
+    renderListField("What's worth taking", worthTaking, "(pending \u2014 not yet determined)"),
+    renderListField("What to leave behind", leaveBehind, "(pending \u2014 not yet determined)"),
+    `${padLabel("Safety verdict")}: ${renderSafetyLine(safety)}`,
+    BORDER
+  ];
+  return lines.join("\n");
+}
+function renderJson(result) {
+  return JSON.stringify(result, null, 2);
+}
+
+// src/provenance.ts
+import { appendFileSync, existsSync as existsSync5, statSync, writeFileSync as writeFileSync2 } from "fs";
+import { join as join4 } from "path";
+var FORGE_VERBS = ["DEFER", "ABSORB", "FORK", "REJECT", "WATCH"];
+var LEDGER_HEADER = "# Rhize Skill Forge \u2014 Provenance Ledger\n\nOne entry per external-skill ingestion decision.\n";
+function todayLocalIsoDate() {
+  const d = /* @__PURE__ */ new Date();
+  const year = d.getFullYear();
+  const month = String(d.getMonth() + 1).padStart(2, "0");
+  const day = String(d.getDate()).padStart(2, "0");
+  return `${year}-${month}-${day}`;
+}
+function appendProvenance(entry, skillsRoot) {
+  if (!FORGE_VERBS.includes(entry.verb)) {
+    throw new Error(`verb must be one of ${FORGE_VERBS.join(", ")}`);
+  }
+  if (!existsSync5(skillsRoot) || !statSync(skillsRoot).isDirectory()) {
+    throw new Error(`skills-root not a directory: ${skillsRoot}`);
+  }
+  const today = todayLocalIsoDate();
+  const driftCheck = entry.driftCheck ?? `# define how to detect upstream change for ${entry.name}`;
+  const block = `
+## ${entry.name} \u2014 ${today}
+- **Source:** ${entry.source}
+- **Upstream ref:** ${entry.version ?? "n/a"}
+- **License:** ${entry.license ?? "UNKNOWN"}
+- **Verb:** ${entry.verb}
+- **Target:** ${entry.target ?? "n/a"}
+- **Took:** ${entry.took ?? "nothing"}
+- **Verified:** ${entry.verified ?? "n/a"}
+- **Drift check:** \`${driftCheck}\`
+- **Notes:** ${entry.notes ?? ""}
+`;
+  const ledgerPath = join4(skillsRoot, "SOURCES.md");
+  if (!existsSync5(ledgerPath)) {
+    writeFileSync2(ledgerPath, LEDGER_HEADER, "utf-8");
+  }
+  appendFileSync(ledgerPath, block, "utf-8");
+  return ledgerPath;
+}
+
+// src/gate/profile.ts
+import { execFileSync } from "child_process";
+import {
+  closeSync,
+  existsSync as existsSync6,
+  mkdtempSync,
+  openSync,
+  readFileSync as readFileSync2,
+  readdirSync as readdirSync2,
+  readSync,
+  rmSync as rmSync2,
+  statSync as statSync3
+} from "fs";
+import { tmpdir } from "os";
+import { basename as basename3, dirname, extname, join as join6, resolve as resolve2 } from "path";
+
+// src/util.ts
+import { statSync as statSync2 } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join5 } from "path";
+function expandHome(p) {
+  if (p === "~") return homedir2();
+  if (p.startsWith("~/")) return join5(homedir2(), p.slice(2));
+  return p;
+}
+function stripQuotes(s) {
+  return s.replace(/^['"]+/, "").replace(/['"]+$/, "");
+}
+function isDir(p) {
+  try {
+    return statSync2(p).isDirectory();
+  } catch {
+    return false;
+  }
+}
+
+// src/gate/profile.ts
+var SPDX_HINTS = {
+  mit: "MIT (permissive)",
+  apache: "Apache-2.0 (permissive)",
+  bsd: "BSD (permissive)",
+  isc: "ISC (permissive)",
+  unlicense: "Unlicense (public domain)",
+  cc0: "CC0 (public domain)",
+  "mozilla public license": "MPL (weak copyleft)",
+  "gnu general public": "GPL (copyleft)",
+  "gnu affero": "AGPL (copyleft)",
+  "creative commons attribution-sharealike": "CC-BY-SA (copyleft)",
+  "creative commons attribution": "CC-BY (attribution)",
+  "all rights reserved": "All rights reserved (restrictive)"
+};
+var RESOURCE_DIRS = ["scripts", "references", "reference", "commands", "hooks", "assets", "templates", "sub-skills"];
+var PYTHON_STDLIB = /* @__PURE__ */ new Set([
+  "os",
+  "sys",
+  "re",
+  "json",
+  "argparse",
+  "pathlib",
+  "tempfile",
+  "zipfile",
+  "subprocess",
+  "collections",
+  "datetime",
+  "math",
+  "itertools",
+  "typing",
+  "shutil",
+  "glob",
+  "hashlib",
+  "urllib",
+  "csv",
+  "io",
+  "functools",
+  "__future__"
+]);
+function profileSkill(inputPath) {
+  const p = resolve2(expandHome(inputPath));
+  if (!existsSync6(p)) {
+    throw new Error(`path does not exist: ${p}`);
+  }
+  const stat = statSync3(p);
+  const kind = stat.isDirectory() ? classifyInput(p) : "skill";
+  if (kind === "plugin") {
+    return profilePlugin(p);
+  }
+  if (kind === "mcp") {
+    return profileMcp(p);
+  }
+  return profileSkillDir(p);
+}
+function classifyInput(p) {
+  if (existsSync6(join6(p, ".claude-plugin", "plugin.json"))) return "plugin";
+  if (existsSync6(join6(p, ".mcp.json")) || existsSync6(join6(p, "mcp.json"))) return "mcp";
+  return "skill";
+}
+function resolveSkillMd(inputPath) {
+  let currentPath = inputPath;
+  let tmpDir;
+  const initialStat = statSync3(currentPath);
+  if (extname(currentPath) === ".skill" || initialStat.isFile() && isZipFile(currentPath)) {
+    tmpDir = mkdtempSync(join6(tmpdir(), "forge_"));
+    extractZip(currentPath, tmpDir);
+    currentPath = tmpDir;
+  }
+  const stat = statSync3(currentPath);
+  if (stat.isFile() && basename3(currentPath) === "SKILL.md") {
+    return { skillMd: currentPath, root: dirname(currentPath), tmpDir };
+  }
+  if (stat.isDirectory()) {
+    const direct = join6(currentPath, "SKILL.md");
+    if (existsSync6(direct)) {
+      return { skillMd: direct, root: currentPath, tmpDir };
+    }
+    const matches = findSkillMdOneLevelDown(currentPath);
+    if (matches.length === 1) {
+      return { skillMd: matches[0], root: dirname(matches[0]), tmpDir };
+    }
+    if (matches.length > 1) {
+      cleanupTmp(tmpDir);
+      throw new Error(
+        `multiple SKILL.md found under ${currentPath}; point at a single skill dir:
+  ${matches.join("\n  ")}`
+      );
+    }
+  }
+  cleanupTmp(tmpDir);
+  throw new Error(`no SKILL.md found at ${currentPath}`);
+}
+function cleanupTmp(tmpDir) {
+  if (tmpDir) rmSync2(tmpDir, { recursive: true, force: true });
+}
+function findSkillMdOneLevelDown(dir) {
+  const matches = /* @__PURE__ */ new Set();
+  for (const entry of readdirSync2(dir, { withFileTypes: true })) {
+    if (entry.isDirectory()) {
+      const candidate = join6(dir, entry.name, "SKILL.md");
+      if (existsSync6(candidate)) matches.add(candidate);
+    }
+  }
+  const skillsDir = join6(dir, "skills");
+  if (isDir(skillsDir)) {
+    for (const entry of readdirSync2(skillsDir, { withFileTypes: true })) {
+      if (entry.isDirectory()) {
+        const candidate = join6(skillsDir, entry.name, "SKILL.md");
+        if (existsSync6(candidate)) matches.add(candidate);
+      }
+    }
+  }
+  return Array.from(matches);
+}
+function isZipFile(p) {
+  try {
+    const fd = openSync(p, "r");
+    const buf = Buffer.alloc(4);
+    const bytesRead = readSync(fd, buf, 0, 4, 0);
+    closeSync(fd);
+    if (bytesRead < 4) return false;
+    return buf[0] === 80 && buf[1] === 75 && (buf[2] === 3 || buf[2] === 5 || buf[2] === 7);
+  } catch {
+    return false;
+  }
+}
+function extractZip(zipPath, destDir) {
+  try {
+    execFileSync("unzip", ["-q", "-o", zipPath, "-d", destDir], { stdio: ["ignore", "ignore", "pipe"] });
+  } catch (err) {
+    const e = err;
+    if (e.code === "ENOENT") {
+      throw new Error(
+        "unsupported without unzip: .skill archives require the system `unzip` binary, which was not found on PATH. Install unzip, or extract the archive yourself and point profileSkill at the resulting directory."
+      );
+    }
+    throw new Error(`failed to extract ${zipPath}: ${e.message ?? String(err)}`);
+  }
+}
+function frontmatterBlock(text) {
+  const first = text.indexOf("---");
+  const rest = text.slice(first + 3);
+  const second = rest.indexOf("---");
+  return second === -1 ? rest : rest.slice(0, second);
+}
+function extractSimpleField(block, key) {
+  const re = new RegExp(`^${key}:\\s*(.+)$`, "m");
+  const m = block.match(re);
+  if (!m) return void 0;
+  return stripQuotes(m[1].trim());
+}
+function extractDescription(block) {
+  const m = block.match(/^description:\s*(.*)$/m);
+  if (!m) return void 0;
+  const first = m[1].trim();
+  if ([">", ">-", "|", "|-", ""].includes(first)) {
+    const lines = block.split("\n");
+    const idx = lines.findIndex((l) => /^description:/.test(l));
+    if (idx === -1) return void 0;
+    const buf = [];
+    for (let i = idx + 1; i < lines.length; i++) {
+      const l = lines[i];
+      if (/^\s+\S/.test(l)) {
+        buf.push(l.trim());
+      } else if (l.trim() === "") {
+        continue;
+      } else {
+        break;
+      }
+    }
+    return buf.join(" ").trim();
+  }
+  return stripQuotes(first);
+}
+function parseFrontmatter(text) {
+  if (!text.startsWith("---\n")) {
+    return { validFrontmatter: false };
+  }
+  const block = frontmatterBlock(text);
+  return {
+    validFrontmatter: true,
+    name: extractSimpleField(block, "name"),
+    version: extractSimpleField(block, "version"),
+    license: extractSimpleField(block, "license"),
+    description: extractDescription(block)
+  };
+}
+function detectLicense(root, fm) {
+  if (fm.license) return fm.license;
+  const names = ["LICENSE", "LICENSE.md", "LICENSE.txt", "COPYING", "license"];
+  for (const name of names) {
+    const p = join6(root, name);
+    if (existsSync6(p) && statSync3(p).isFile()) {
+      const head = readFileSync2(p, "utf-8").slice(0, 2e3).toLowerCase();
+      for (const [hint, label] of Object.entries(SPDX_HINTS)) {
+        if (head.includes(hint)) return label;
+      }
+      return "present but unrecognized";
+    }
+  }
+  return "NONE STATED";
+}
+function walkFiles(dir) {
+  const out = [];
+  for (const entry of readdirSync2(dir, { withFileTypes: true })) {
+    const full = join6(dir, entry.name);
+    if (entry.isDirectory()) {
+      out.push(...walkFiles(full));
+    } else if (entry.isFile()) {
+      out.push(full);
+    }
+  }
+  return out;
+}
+function countResources(root) {
+  const resources = {};
+  for (const d of RESOURCE_DIRS) {
+    const dp = join6(root, d);
+    if (isDir(dp)) {
+      resources[d] = walkFiles(dp).length;
+    }
+  }
+  return resources;
+}
+function scanMcpAndImports(text, root) {
+  const mcpRefRe = /mcp__[a-zA-Z0-9_]+/g;
+  const mcpRefs = new Set(text.match(mcpRefRe) ?? []);
+  const imports = /* @__PURE__ */ new Set();
+  const scriptsDir = join6(root, "scripts");
+  if (isDir(scriptsDir)) {
+    for (const f of walkFiles(scriptsDir)) {
+      if (!f.endsWith(".py")) continue;
+      const ft = readFileSync2(f, "utf-8");
+      for (const m2 of ft.match(mcpRefRe) ?? []) mcpRefs.add(m2);
+      const importRe = /^\s*(?:import|from)\s+([a-zA-Z0-9_]+)/gm;
+      let m;
+      while ((m = importRe.exec(ft)) !== null) {
+        imports.add(m[1]);
+      }
+    }
+  }
+  return {
+    mcpDeps: Array.from(mcpRefs).sort(),
+    externalDeps: Array.from(imports).filter((i) => !PYTHON_STDLIB.has(i)).sort()
+  };
+}
+function profileSkillDir(inputPath) {
+  const { skillMd, root, tmpDir } = resolveSkillMd(inputPath);
+  try {
+    const text = readFileSync2(skillMd, "utf-8");
+    const fm = parseFrontmatter(text);
+    const bodyLines = (text.match(/\n/g)?.length ?? 0) + 1;
+    const headers = Array.from(text.matchAll(/^#{1,3}\s+(.+)$/gm)).map((m) => m[1]);
+    const resources = countResources(root);
+    const { mcpDeps, externalDeps } = scanMcpAndImports(text, root);
+    return {
+      kind: "skill",
+      inputPath,
+      skillMd,
+      name: fm.name,
+      version: fm.version,
+      validFrontmatter: fm.validFrontmatter,
+      description: fm.description,
+      license: detectLicense(root, fm),
+      bodyLines,
+      headerCount: headers.length,
+      topHeaders: headers.slice(0, 12),
+      resources,
+      mcpDependencies: mcpDeps,
+      externalPythonDeps: externalDeps
+    };
+  } finally {
+    cleanupTmp(tmpDir);
+  }
+}
+function profilePlugin(p) {
+  const manifestPath = join6(p, ".claude-plugin", "plugin.json");
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync2(manifestPath, "utf-8"));
+  } catch (err) {
+    throw new Error(`could not parse plugin.json under ${p}: ${err.message}`);
+  }
+  const skillsDir = join6(p, "skills");
+  let skills = [];
+  if (isDir(skillsDir)) {
+    skills = readdirSync2(skillsDir, { withFileTypes: true }).filter((d) => d.isDirectory() && existsSync6(join6(skillsDir, d.name, "SKILL.md"))).map((d) => d.name).sort();
+  }
+  const commandsDir = join6(p, "commands");
+  const commands = isDir(commandsDir) ? readdirSync2(commandsDir).filter((f) => f.endsWith(".md")).length : 0;
+  const mc = manifest.mcpServers ?? manifest.mcp_servers ?? {};
+  const mcpServers = typeof mc === "object" && mc !== null ? Object.keys(mc).sort() : [];
+  return {
+    kind: "plugin",
+    inputPath: p,
+    name: manifest.name,
+    version: manifest.version,
+    description: manifest.description,
+    skills,
+    skillCount: skills.length,
+    commands,
+    mcpServers
+  };
+}
+function profileMcp(p) {
+  const cfgPath = existsSync6(join6(p, ".mcp.json")) ? join6(p, ".mcp.json") : join6(p, "mcp.json");
+  let cfg;
+  try {
+    cfg = JSON.parse(readFileSync2(cfgPath, "utf-8"));
+  } catch (err) {
+    throw new Error(`could not parse MCP config ${cfgPath}: ${err.message}`);
+  }
+  const servers = cfg.mcpServers ?? cfg.servers ?? {};
+  const names = typeof servers === "object" && servers !== null ? Object.keys(servers).sort() : [];
+  return {
+    kind: "mcp",
+    inputPath: p,
+    config: cfgPath,
+    servers: names,
+    serverCount: names.length
+  };
+}
+
+// src/gate/safety.ts
+import { readFileSync as readFileSync3, readdirSync as readdirSync3, statSync as statSync4 } from "fs";
+import { execFile } from "child_process";
+import { delimiter, extname as extname2, join as join7 } from "path";
+import { promisify } from "util";
+var execFileAsync = promisify(execFile);
+var BLOCK_SEVERITIES = /* @__PURE__ */ new Set(["HIGH", "CRITICAL"]);
+var DENY_RULES = [
+  {
+    rule: "curl-pipe-shell",
+    severity: "CRITICAL",
+    pattern: /\b(curl|wget)\b[^\n|]*\|\s*(sudo\s+)?(bash|sh|zsh)\b/i,
+    message: "downloads a remote script and pipes it directly into a shell"
+  },
+  {
+    rule: "base64-obfuscated-exec",
+    severity: "CRITICAL",
+    pattern: /(base64\s+(-d|--decode)\b[^\n|]*\|\s*(bash|sh|zsh|python3?)\b)|(\bexec\s*\(\s*(base64\.)?b64decode\()|(\beval\s*\(\s*Buffer\.from\([^)]*['"]base64['"])/i,
+    message: "decodes a base64 payload and executes it (obfuscated execution)"
+  },
+  {
+    rule: "reverse-shell",
+    severity: "CRITICAL",
+    pattern: /(\/dev\/tcp\/\S+\/\d+)|(\bnc\s+-e\s+\/bin\/(ba)?sh\b)|(bash\s+-i\s*>&\s*\/dev\/tcp)/i,
+    message: "opens a reverse shell back to a remote host"
+  },
+  {
+    rule: "destructive-rm-rf",
+    severity: "HIGH",
+    pattern: /\brm\s+-[a-z]*r[a-z]*f[a-z]*\b|\brm\s+-[a-z]*f[a-z]*r[a-z]*\b/i,
+    message: "recursive force-delete (rm -rf) \u2014 verify the target path is scoped"
+  },
+  {
+    rule: "credential-file-access",
+    severity: "HIGH",
+    pattern: /(~|\$HOME)?\/\.(ssh\/id_(rsa|ed25519|ecdsa)|aws\/credentials|npmrc|netrc|gnupg|docker\/config\.json)\b|\bid_rsa\b|\.env\b.*\bcat\b|\bcat\b.*\.env\b/i,
+    message: "reads a credential/secrets file (SSH keys, cloud credentials, .env)"
+  },
+  {
+    rule: "credential-exfil",
+    severity: "HIGH",
+    pattern: /\b(curl|wget|fetch)\b[^\n]*(--data|--data-binary|-F|-d)\b[^\n]*(\.ssh|\.aws|\.env|credentials|id_rsa)/i,
+    message: "uploads credential/secret file contents to a remote endpoint"
+  },
+  {
+    rule: "dynamic-eval",
+    severity: "MEDIUM",
+    pattern: /\beval\s*\(|\bexec\s*\(\s*compile\s*\(|\bnew\s+Function\s*\(/,
+    message: "evaluates dynamically constructed code"
+  },
+  {
+    rule: "shell-true-subprocess",
+    severity: "MEDIUM",
+    pattern: /subprocess\.(Popen|run|call)\([^)]*shell\s*=\s*True/,
+    message: "runs a subprocess with shell=True (shell-injection risk)"
+  },
+  {
+    rule: "persistence-cron-rc",
+    severity: "MEDIUM",
+    pattern: />>\s*~?\/?\.(bashrc|zshrc|bash_profile|profile)\b|\bcrontab\s+-/i,
+    message: "modifies shell startup files or crontab (persistence)"
+  },
+  {
+    rule: "sudo-usage",
+    severity: "LOW",
+    pattern: /\bsudo\s+/,
+    message: "invokes sudo \u2014 review for unnecessary privilege escalation"
+  }
+];
+var SKIP_DIRS2 = /* @__PURE__ */ new Set([".git", "node_modules", "dist", "build", "__pycache__", ".venv", "venv"]);
+var BINARY_EXT = /* @__PURE__ */ new Set([
+  ".png",
+  ".jpg",
+  ".jpeg",
+  ".gif",
+  ".webp",
+  ".ico",
+  ".pdf",
+  ".zip",
+  ".tar",
+  ".gz",
+  ".woff",
+  ".woff2",
+  ".ttf",
+  ".eot",
+  ".mp4",
+  ".mp3",
+  ".wasm",
+  ".bin",
+  ".exe"
+]);
+var MAX_FILE_BYTES = 2 * 1024 * 1024;
+function* walk(dir) {
+  let entries;
+  try {
+    entries = readdirSync3(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    const full = join7(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (SKIP_DIRS2.has(entry.name)) continue;
+      yield* walk(full);
+    } else if (entry.isFile()) {
+      yield full;
+    }
+  }
+}
+function readTextFile(file) {
+  if (BINARY_EXT.has(extname2(file).toLowerCase())) return void 0;
+  try {
+    if (statSync4(file).size > MAX_FILE_BYTES) return void 0;
+    const content = readFileSync3(file, "utf-8");
+    if (content.slice(0, 512).includes("\0")) return void 0;
+    return content;
+  } catch {
+    return void 0;
+  }
+}
+function scanStaticRules(targetPath) {
+  const findings = [];
+  let root;
+  try {
+    root = statSync4(targetPath);
+  } catch {
+    return findings;
+  }
+  const files = root.isDirectory() ? Array.from(walk(targetPath)) : [targetPath];
+  for (const file of files) {
+    const content = readTextFile(file);
+    if (content === void 0) continue;
+    const lines = content.split("\n");
+    for (const rule of DENY_RULES) {
+      for (let i = 0; i < lines.length; i++) {
+        if (rule.pattern.test(lines[i])) {
+          findings.push({
+            severity: rule.severity,
+            rule: rule.rule,
+            file,
+            detail: `line ${i + 1}: ${rule.message}`
+          });
+        }
+      }
+    }
+  }
+  return findings;
+}
+function which(cmd) {
+  const pathEnv = process.env.PATH ?? "";
+  const dirs = pathEnv.split(delimiter).filter(Boolean);
+  const exts = process.platform === "win32" ? (process.env.PATHEXT ?? ".EXE;.CMD;.BAT").split(";") : [""];
+  for (const dir of dirs) {
+    for (const ext of exts) {
+      const candidate = join7(dir, cmd + ext);
+      try {
+        if (statSync4(candidate).isFile()) return candidate;
+      } catch {
+      }
+    }
+  }
+  return void 0;
+}
+function normalizeSeverity(sev) {
+  const s = (sev ?? "").toUpperCase();
+  if (s === "LOW" || s === "MEDIUM" || s === "HIGH" || s === "CRITICAL") return s;
+  return "MEDIUM";
+}
+async function scanWithSkillSpector(targetPath) {
+  const bin = which("skillspector");
+  if (!bin) return [];
+  try {
+    const { stdout } = await execFileAsync(bin, ["scan", targetPath, "--format", "json", "--no-llm"], {
+      timeout: 6e4,
+      maxBuffer: 10 * 1024 * 1024
+    });
+    const parsed = JSON.parse(stdout);
+    const raw = parsed.filtered_findings ?? parsed.findings ?? [];
+    return raw.map((f) => ({
+      severity: normalizeSeverity(f.severity),
+      rule: f.rule_id ?? "skillspector",
+      file: targetPath,
+      detail: f.message ?? ""
+    }));
+  } catch {
+    return [];
+  }
+}
+function verdictFor(findings) {
+  if (findings.some((f) => BLOCK_SEVERITIES.has(f.severity))) return "block";
+  if (findings.length > 0) return "warn";
+  return "pass";
+}
+async function scanSafety(targetPath) {
+  const findings = [...scanStaticRules(targetPath), ...await scanWithSkillSpector(targetPath)];
+  return { findings, verdict: verdictFor(findings) };
+}
+
+// src/gate/overlap.ts
+import { existsSync as existsSync7, readFileSync as readFileSync4, readdirSync as readdirSync4 } from "fs";
+import { basename as basename4, dirname as dirname2, join as join8, resolve as resolve3 } from "path";
+var STOPWORDS = new Set(
+  `
+a an the and or of to for in on with use used using when whether this that these those is are be
+your you it its as at by from into via per also any all not no than then so if up out via about
+skill skills user claude code based comprehensive enhanced practical including include includes
+`.split(/\s+/).filter(Boolean)
+);
+function splitLimited(text, sep, maxSplit) {
+  const parts = [];
+  let rest = text;
+  for (let i = 0; i < maxSplit; i++) {
+    const idx = rest.indexOf(sep);
+    if (idx === -1) break;
+    parts.push(rest.slice(0, idx));
+    rest = rest.slice(idx + sep.length);
+  }
+  parts.push(rest);
+  return parts;
+}
+function readFrontmatter(skillMdPath) {
+  const text = readFileSync4(skillMdPath, "utf-8");
+  const meta = { name: basename4(dirname2(skillMdPath)), description: "" };
+  if (text.startsWith("---\n")) {
+    const block = splitLimited(text, "---", 2)[1] ?? "";
+    const nameMatch = block.match(/^name:\s*(.+)$/m);
+    if (nameMatch) {
+      meta.name = stripQuotes(nameMatch[1].trim());
+    }
+    const descMatch = block.match(/^description:\s*(.*)$/m);
+    if (descMatch) {
+      const first = descMatch[1].trim();
+      if ([">", ">-", "|", "|-", ""].includes(first)) {
+        const lines = block.split(/\r\n|\r|\n/);
+        const idx = lines.findIndex((l) => /^description:/.test(l));
+        const buf = [];
+        if (idx !== -1) {
+          for (const l of lines.slice(idx + 1)) {
+            if (/^\s+\S/.test(l)) {
+              buf.push(l.trim());
+            } else if (l.trim() === "") {
+              continue;
+            } else {
+              break;
+            }
+          }
+        }
+        meta.description = buf.join(" ");
+      } else {
+        meta.description = stripQuotes(first);
+      }
+    }
+  } else {
+    const heads = Array.from(text.matchAll(/^#\s+(.+)$/gm)).map((m) => m[1]);
+    meta.description = `${heads[0] ?? ""} ${text.slice(0, 400)}`;
+  }
+  return meta;
+}
+function tokenize(text) {
+  const matches = text.toLowerCase().match(/[a-z][a-z0-9+.-]{2,}/g) ?? [];
+  return new Set(matches.filter((t) => !STOPWORDS.has(t)));
+}
+function intersectSize(a, b) {
+  let n = 0;
+  for (const x of a) if (b.has(x)) n += 1;
+  return n;
+}
+function unionSize(a, b) {
+  const u = new Set(a);
+  for (const x of b) u.add(x);
+  return u.size;
+}
+function isSubset(sub, sup) {
+  for (const x of sub) if (!sup.has(x)) return false;
+  return true;
+}
+function round3(n) {
+  return Math.round(n * 1e3) / 1e3;
+}
+function score(cand, other) {
+  const a = tokenize(`${cand.name} ${cand.description}`);
+  const b = tokenize(`${other.name} ${other.description}`);
+  if (a.size === 0) return 0;
+  const inter = intersectSize(a, b);
+  const union = unionSize(a, b);
+  const jaccard = union ? inter / union : 0;
+  const containment = inter / a.size;
+  const phrases = /* @__PURE__ */ new Set();
+  for (const m of cand.description.matchAll(/"([^"]{2,40})"/g)) phrases.add(m[1]);
+  for (const m of cand.description.matchAll(/'([^']{2,40})'/g)) phrases.add(m[1]);
+  let pscore = 0;
+  if (phrases.size > 0) {
+    let hits = 0;
+    for (const p of phrases) {
+      const pw = tokenize(p);
+      if (pw.size > 0 && isSubset(pw, b)) hits += 1;
+    }
+    pscore = hits / phrases.size;
+  }
+  return round3(0.3 * jaccard + 0.5 * containment + 0.2 * pscore);
+}
+var VERB_TIERS = [
+  { min: 0.45, verb: "ABSORB", prose: "ABSORB (or REJECT if ours is already better)" },
+  { min: 0.2, verb: "FORK", prose: "FORK (re-skin), or ABSORB one piece" },
+  { min: -Infinity, verb: "DEFER", prose: "DEFER / new FORK (little overlap)" }
+];
+function verbTier(topScore) {
+  return VERB_TIERS.find((t) => topScore >= t.min) ?? VERB_TIERS[VERB_TIERS.length - 1];
+}
+function suggestVerb(topScore) {
+  return verbTier(topScore).prose;
+}
+function suggestVerbCode(topScore) {
+  return verbTier(topScore).verb;
+}
+function listSubdirs(dir) {
+  if (!existsSync7(dir)) return [];
+  let entries;
+  try {
+    entries = readdirSync4(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  return entries.filter((e) => e.isDirectory()).map((e) => join8(dir, e.name));
+}
+function findSkillMdFiles(root) {
+  const found = /* @__PURE__ */ new Set();
+  for (const dir of listSubdirs(root)) {
+    const candidate = join8(dir, "SKILL.md");
+    if (existsSync7(candidate)) found.add(resolve3(candidate));
+  }
+  for (const dir of listSubdirs(join8(root, "skills"))) {
+    const candidate = join8(dir, "SKILL.md");
+    if (existsSync7(candidate)) found.add(resolve3(candidate));
+  }
+  for (const topDir of listSubdirs(root)) {
+    for (const dir of listSubdirs(join8(topDir, "skills"))) {
+      const candidate = join8(dir, "SKILL.md");
+      if (existsSync7(candidate)) found.add(resolve3(candidate));
+    }
+  }
+  return Array.from(found).filter((p) => !p.includes("/.git/")).sort();
+}
+function scanOverlap(candidatePath, skillsRoot) {
+  const root = resolve3(expandHome(skillsRoot));
+  if (!isDir(root)) {
+    throw new Error(`skills-root not a directory: ${root}`);
+  }
+  let cpath = resolve3(expandHome(candidatePath));
+  if (isDir(cpath)) {
+    cpath = join8(cpath, "SKILL.md");
+  }
+  if (!existsSync7(cpath)) {
+    throw new Error(`candidate SKILL.md not found: ${cpath}`);
+  }
+  const cand = readFrontmatter(cpath);
+  const existing = findSkillMdFiles(root).filter((p) => p !== resolve3(cpath));
+  if (existing.length === 0) {
+    throw new Error(`no existing skills found under ${root}`);
+  }
+  const ranking = existing.map((p) => {
+    const other = readFrontmatter(p);
+    return { skill: other.name, path: p, score: score(cand, other) };
+  });
+  ranking.sort((a, b) => b.score - a.score);
+  const top = ranking[0];
+  return {
+    candidate: cand.name,
+    nearest: top.skill,
+    nearestScore: top.score,
+    suggestedVerb: suggestVerb(top.score),
+    ranking
+  };
+}
+
+// src/commands/gatePipeline.ts
+var SAFETY_VERDICT_MAP = {
+  pass: "ALLOW",
+  warn: "CAUTION",
+  block: "BLOCK"
+};
+function asSkillProfile(candidatePath) {
+  const profile = profileSkill(candidatePath);
+  if (profile.kind !== "skill") {
+    throw new Error(`expected a skill candidate at ${candidatePath}, found a ${profile.kind}`);
+  }
+  return profile;
+}
+function tryOverlap(candidatePath, skillsRoot) {
+  try {
+    return scanOverlap(candidatePath, skillsRoot);
+  } catch (err) {
+    console.error(`[skill-forge] overlap scan skipped: ${err.message}`);
+    return void 0;
+  }
+}
+async function runGate(candidatePath, skillsRoot) {
+  const profile = asSkillProfile(candidatePath);
+  const safety = await scanSafety(candidatePath);
+  const pro = hasProLicense();
+  const overlap = pro ? tryOverlap(candidatePath, skillsRoot) : void 0;
+  const gateResult = {
+    profile,
+    overlap,
+    overlapLocked: !pro,
+    safety: {
+      verdict: SAFETY_VERDICT_MAP[safety.verdict],
+      findings: safety.findings.map((f) => ({
+        severity: f.severity,
+        rule: f.rule,
+        message: `${f.file}: ${f.detail}`
+      }))
+    }
+  };
+  return { safety, gateResult, pro };
+}
+
+// src/queue.ts
+import { randomUUID as randomUUID2 } from "crypto";
+import { existsSync as existsSync8, mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
+import { join as join9 } from "path";
+function getQueuePath() {
+  return join9(getHomeDir(), "queue.json");
+}
+function readQueue() {
+  const path = getQueuePath();
+  if (!existsSync8(path)) {
+    return { version: 1, entries: [] };
+  }
+  const raw = readFileSync5(path, "utf-8");
+  const parsed = JSON.parse(raw);
+  return { version: 1, entries: parsed.entries ?? [] };
+}
+function writeQueue(queue) {
+  mkdirSync4(getHomeDir(), { recursive: true });
+  writeFileSync3(getQueuePath(), JSON.stringify(queue, null, 2) + "\n", "utf-8");
+}
+function appendQueueEntry(entry) {
+  const queue = readQueue();
+  const existingIds = new Set(queue.entries.map((e) => e.id));
+  const full = {
+    ...entry,
+    id: generateId(existingIds),
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  queue.entries.push(full);
+  writeQueue(queue);
+  return full;
+}
+function generateId(existingIds) {
+  let id;
+  do {
+    id = randomUUID2().split("-")[0];
+  } while (existingIds.has(id));
+  return id;
+}
+
+// src/commands/add.ts
+async function add(source, options = {}) {
+  const config = loadConfig();
+  const targetRoot = options.target ?? config.skillsRoots[0];
+  if (!targetRoot) {
+    throw new Error("no target skills root configured; pass --target <dir> or set skillsRoots in the config");
+  }
+  const resolved = resolve(source);
+  const entry = await quarantine(resolved, config.quarantineDir);
+  if (entry.skillDirs.length === 0) {
+    console.error(`[skill-forge] no SKILL.md found in installed source: ${source}`);
+    reject(entry);
+    process.exitCode = 1;
+    return;
+  }
+  if (entry.skillDirs.length > 1) {
+    console.error(
+      `[skill-forge] ${entry.skillDirs.length} skills found in ${source}; gating the first \u2014 the whole quarantine entry is promoted/rejected together:
+` + entry.skillDirs.map((d) => `  - ${d}`).join("\n")
+    );
+  }
+  const { safety, gateResult, pro } = await runGate(entry.skillDirs[0], targetRoot);
+  const { profile, overlap } = gateResult;
+  console.log(options.json ? renderJson(gateResult) : renderReport(gateResult));
+  const decision = options.yes ? yesDecision(safety.verdict) : await promptDecision(safety.verdict);
+  let installedPath = null;
+  if (decision === "promote") {
+    const result = promote(entry, targetRoot);
+    console.log(`[skill-forge] promoted -> ${result.promoted.join(", ")}`);
+    if (pro) {
+      const ledgerPath = appendProvenance(
+        {
+          name: profile.name ?? entry.id,
+          source,
+          version: profile.version,
+          license: profile.license,
+          verb: "DEFER",
+          target: targetRoot,
+          took: `installed as-is (${result.promoted.length} skill dir${result.promoted.length === 1 ? "" : "s"})`,
+          notes: `gate: safety=${safety.verdict}` + (overlap ? `, overlap nearest=${overlap.nearest} (${overlap.nearestScore})` : "")
+        },
+        targetRoot
+      );
+      console.log(`[skill-forge] provenance recorded -> ${ledgerPath}`);
+    }
+    installedPath = result.promoted[0] ?? null;
+  } else if (decision === "reject") {
+    reject(entry);
+    console.log("[skill-forge] rejected \u2014 quarantine sandbox removed");
+    if (safety.verdict === "block") process.exitCode = 1;
+    return;
+  } else {
+    hold(entry);
+    console.log(`[skill-forge] held in quarantine -> ${entry.quarantinePath}`);
+  }
+  if (pro) {
+    appendQueueEntry({
+      source,
+      sourceType: resolved.type,
+      installedPath,
+      quarantinePath: entry.quarantinePath,
+      gate: {
+        license: profile.license ?? null,
+        safetyVerdict: safety.verdict,
+        safetyFindings: safety.findings.map((f) => `${f.severity} [${f.rule}] ${f.file}: ${f.detail}`),
+        overlapTop: overlap ? overlap.ranking.slice(0, 3).map((r) => ({ skill: r.skill, score: r.score })) : [],
+        suggestedVerb: overlap ? suggestVerbCode(overlap.nearestScore) : null
+      },
+      status: "pending"
+    });
+    if (options.ingest && installedPath) {
+      handoffToClaude(installedPath);
+    }
+  } else {
+    console.log(upgradeNotice("provenance ledger, pending-ingestion queue, and --ingest handoff"));
+  }
+}
+function handoffToClaude(installedPath) {
+  const command = `/rhize-meta:forge-ingest ${installedPath}`;
+  const result = spawnSync("claude", ["-p", command], { stdio: "inherit" });
+  const error = result.error;
+  if (error?.code === "ENOENT") {
+    console.log("[skill-forge] claude not found on PATH \u2014 run this yourself:");
+    console.log(`  claude -p "${command}"`);
+  } else if (error) {
+    console.error(`[skill-forge] failed to launch claude: ${error.message}`);
+  }
+}
+function yesDecision(verdict) {
+  return verdict === "block" ? "reject" : "promote";
+}
+async function promptDecision(verdict) {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  const defaultChoice = verdict === "block" ? "reject" : verdict === "warn" ? "hold" : "promote";
+  const prompt = `Promote, hold, or reject this skill? [promote/hold/reject] (default: ${defaultChoice}) `;
+  try {
+    process.stdout.write(prompt);
+    for await (const raw of rl) {
+      const answer = raw.trim().toLowerCase() || defaultChoice;
+      if (answer === "p" || answer === "promote") return "promote";
+      if (answer === "h" || answer === "hold") return "hold";
+      if (answer === "r" || answer === "reject") return "reject";
+      process.stdout.write(`Please answer promote, hold, or reject (or p/h/r).
+${prompt}`);
+    }
+    return defaultChoice;
+  } finally {
+    rl.close();
+  }
+}
+
+// src/commands/scan.ts
+async function scan(source) {
+  const config = loadConfig();
+  const skillsRoot = config.skillsRoots[0];
+  if (!skillsRoot) {
+    throw new Error("no skills root configured; set skillsRoots in the config");
+  }
+  const resolved = resolve(source);
+  const entry = await quarantine(resolved, config.quarantineDir);
+  try {
+    if (entry.skillDirs.length === 0) {
+      console.error(`[skill-forge] no SKILL.md found in installed source: ${source}`);
+      process.exitCode = 1;
+      return;
+    }
+    if (entry.skillDirs.length > 1) {
+      console.error(
+        `[skill-forge] ${entry.skillDirs.length} skills found in ${source}; scanning the first:
+` + entry.skillDirs.map((d) => `  - ${d}`).join("\n")
+      );
+    }
+    const { safety, gateResult } = await runGate(entry.skillDirs[0], skillsRoot);
+    console.log(renderReport(gateResult));
+    if (safety.verdict === "block") {
+      process.exitCode = 1;
+    }
+  } finally {
+    reject(entry);
+  }
+}
+
+// src/commands/list.ts
+import { join as join10 } from "path";
+async function list() {
+  const config = loadConfig();
+  const { quarantineDir } = config;
+  const ids = listQuarantineIds(quarantineDir);
+  if (ids.length === 0) {
+    console.log(`[skill-forge] quarantine dir: ${quarantineDir}`);
+    console.log("  (empty \u2014 nothing held)");
+    return;
+  }
+  console.log(`[skill-forge] ${ids.length} held in quarantine (${quarantineDir}):`);
+  for (const id of ids) {
+    const skillDirs = findSkillDirs(join10(quarantineDir, id));
+    if (skillDirs.length === 0) {
+      console.log(`  ${id}  (no SKILL.md found)`);
+      continue;
+    }
+    const names = skillDirs.map((dir) => {
+      try {
+        return readFrontmatter(join10(dir, "SKILL.md")).name;
+      } catch {
+        return dir;
+      }
+    });
+    console.log(`  ${id}  ->  ${names.join(", ")}`);
+  }
+}
+
+// src/commands/status.ts
+async function status() {
+  const config = loadConfig();
+  const heldCount = listQuarantineIds(config.quarantineDir).length;
+  console.log("[skill-forge] status");
+  console.log(`  skillsRoots: ${config.skillsRoots.join(", ")}`);
+  console.log(`  quarantineDir: ${config.quarantineDir}`);
+  console.log(`  strictness: ${config.strictness}`);
+  console.log(`  held in quarantine: ${heldCount}`);
+}
+
+// src/cli.ts
+var require2 = createRequire(import.meta.url);
+var pkg = require2("../package.json");
+var program = new Command();
+program.name("skill-forge").description("The supply-chain gate for agent skills").version(pkg.version);
+program.command("add <source>").description("Quarantine-install a skill and run it through the safety gate").option("-y, --yes", "skip the interactive prompt; honor the gate verdict automatically").option("-t, --target <dir>", "skills root to promote into (defaults to config skillsRoots[0])").option("--json", "print the gate result as JSON instead of the terminal report").option("--ingest", "after a successful promote, hand off to Claude via /rhize-meta:forge-ingest").action(add);
+program.command("scan <source>").description("Run the safety gate against a skill without installing it").action(scan);
+program.command("list").description("List skills currently in quarantine").action(list);
+program.command("status").description("Show skill-forge configuration and quarantine status").action(status);
+await program.parseAsync();
+//# sourceMappingURL=cli.js.map