@rhize/skill-forge 0.12.0 → 0.14.0

package/README.md

@@ -172,7 +172,20 @@ target skills root until you decide.
 | `-t, --target <dir>` | Skills root to promote into. Defaults to the config's `defaultTarget`, then `skillsRoots[0]`. |
 | `--json` | Prints the gate result (profile, safety findings, overlap) as JSON instead of the terminal report box. Implies non-interactive: the decision is made the same way `--yes` makes it (verdict decides promote/hold/reject), never an interactive prompt. |
 | `--ingest` | Pro (free during the 0.x beta). After a successful promote, hands off to a coding agent — see [Ingestion handoff](#ingestion-handoff---ingest). |
-| `--skill-map <path>` | Path to a generated `rhize-plugins` skill map (Phase 4 of that repo's skill-map-graph-substrate plan). When given, ranks the candidate's name/description against every `skill` node in the map — a near-duplicate of an already-shipped marketplace skill is folded into the safety findings as a `HIGH`-severity finding (escalates the verdict to `block`, so it's held rather than silently promoted); a moderate overlap is `MEDIUM` (`warn`). Free (not Pro-gated) — this enforces the marketplace's own curation rule ("close the gap, don't duplicate"), not a premium ranking feature. Missing/unreadable map: printed to stderr, never fatal. |
+| `--skill-map <path>` | Path to a generated `rhize-plugins` skill map (Phase 4 of that repo's skill-map-graph-substrate plan). When given, ranks the candidate's name/description against every `skill` node in the map — a near-duplicate of an already-shipped marketplace skill is folded into the safety findings as a `HIGH`-severity finding (escalates the verdict to `block`, so it's held rather than silently promoted); a moderate overlap is `MEDIUM` (`warn`). Free (not Pro-gated) — this enforces the marketplace's own curation rule ("close the gap, don't duplicate"), not a premium ranking feature. Missing/unreadable map: printed to stderr, never fatal. **Two map variants exist, with different coverage**: the **static** map (`rhize-plugins/generated/skill-map.static.json`) is first-party-only — it only knows about that marketplace's own skills, so it cannot catch a candidate that duplicates an *installed third-party plugin's* skill. The **resolved** map (`~/.claude/context-manager/skill-map.resolved.json`, produced by `rhize-context-manager`) additionally carries the full third-party ecosystem inventory. Point `--skill-map` at the resolved map when you want ecosystem-wide duplicate detection; the static map is enough only when you're curating a single first-party marketplace against itself. |
+
+**Observability (v0.14.0):** the `--skill-map` curation check now always reports that it ran. A below-threshold PASS previously left no trace at all — no line in the report, no field in `--json` — making "checked 45 skills, nothing crossed the threshold" indistinguishable from "the check never ran". That ambiguity caused a correct PASS to be written up as a broken gate. The report now carries a `Marketplace overlap` line (`checked N skills — closest "x" (score), none over threshold` / `skipped — <reason>`) and `--json` a `mapOverlap` object with `status`, `compared`, `topMatch`, and `matches`. `topMatch` is informational only: it is never graded and never produces a finding. **Scoring and both thresholds are unchanged.** Note the check is lexical, not semantic — two skills can claim the same invocation trigger in different words and score far below threshold (measured: 0.134), so competing `description:` triggers still need a human read. See `gate/mapOverlap.ts`'s module doc.
+
+**Bugfix (v0.13.0):** `--skill-map` previously matched nothing against either real map variant — the loader read a `type` field that the real generated artifact never sets (it uses `kind`), so every node was silently invisible to the overlap check. `loadSkillMap()` now normalizes `kind` → `type` at load time; regression coverage lives in `test/mapOverlap.realmap.test.ts` against vendored real-map snapshots. If you were relying on `--skill-map` before v0.13.0, it was a no-op — re-run `add`/`scan` on anything you're unsure about.
+
+**Extends-declared overlap exemption**: a candidate can declare `metadata.rhize.extends:
+["<skill-name>" | "<plugin>/<skill-name>"]` in its SKILL.md frontmatter to mark itself a
+deliberate specialization/layering of an existing map skill. When the top `--skill-map` match is
+a skill the candidate declares it extends, that finding is downgraded from a HOLD-level safety
+finding to an informational notice printed above the report — it never escalates the verdict.
+Overlap with any *other* skill (a different match, or a second candidate/skill pair) still holds
+at full severity: the exemption applies per declared pair, not globally, so declaring an
+extension of skill X never waives overlap with skill Y.
 
 A promoted skill gets a provenance entry appended to `<target>/SOURCES.md`, and every promote or
 hold decision is recorded to `~/.skill-forge/queue.json` (or `$SKILL_FORGE_HOME/queue.json`) — see
@@ -478,11 +491,41 @@ It is only ever printed, sanitized, as a suggestion for you (or an agent) to run
 **`--skill-map <path>` (Phase 4 of `rhize-plugins`' skill-map-graph-substrate plan)** additionally
 drift-checks every `fork-of` edge in a generated skill map: for each edge it resolves the local
 `skill` node's `path`/`contentHash` and the upstream (`external`) node's `url`/`path`, fetches or
-reads the upstream content, and compares content hashes. Each edge reports one of `in-sync`,
-`drifted`, `upstream-unreachable`, or `local-missing`. Same never-execute posture as the ledger
+reads the upstream content, and compares content hashes. Same never-execute posture as the ledger
 check above: nothing derived from the map — including a fork-of edge's own `driftCheck`
 metadata — is ever executed; only fetch/read/hash/compare. A missing/unreadable map is a warning,
-never fatal.
+never fatal. A node's repo-relative `path` (e.g. `rhize-context-manager/skills/x/SKILL.md`) is
+resolved against cwd, the map's own directory, and that directory's parent (in that order) — not
+cwd alone — so `watch --skill-map <path>` gives correct verdicts regardless of the directory you
+run it from.
+
+**Verdict**, per fork-of edge — three-way comparison, four verdict states when both hashes below
+are present on the map, else the older two-way fallback (`in-sync`/`drifted`, `contentHash` vs
+freshly-fetched upstream):
+
+| local-normalized vs baseline | upstream-now vs baseline | status | actionable |
+|---|---|---|---|
+| == | == | `in-sync` | no |
+| != | == | `local-only` | no (deliberate fork divergence, e.g. Rhize's added frontmatter) |
+| == | != | `upstream-moved` | yes |
+| != | != | `diverged` | yes |
+
+The three-way matrix fires only when the local `skill` node carries `contentHashNormalized` (a
+hash of the file with Rhize-injected frontmatter stripped, computed once by the rhize-plugins
+compiler) **and** the upstream `external` node carries `baselineHash` (the upstream content hash
+as of the last human review, recorded in `rhize-plugins`' SOURCES.md and copied onto the node by
+that compiler — skill-forge never computes or fetches it itself). Either field missing on a given
+edge falls back to the two-way compare for that edge, so older maps keep working. All four
+three-way verdicts — `in-sync`, `local-only`, `upstream-moved`, and `diverged` — carry
+`baselineHash`/`upstreamHash` in the JSON output; the two-way-fallback rows and
+`upstream-unreachable`/`local-missing` never do (no verdict without a successful fetch/read, so
+there is nothing to compare against a baseline). Every row also carries an `actionable` boolean
+(from `isActionable`), so callers don't have to re-derive "needs attention" from `status`/`detail`
+prose — it's `true` for `drifted`, `upstream-moved`, `diverged`, `upstream-unreachable`, and
+`local-missing`; `false` for `in-sync` and `local-only`. **Re-baselining**: after reviewing and
+adopting an `upstream-moved`/`diverged` change, re-run `rhize-plugins`' `scripts/baseline_upstreams.py`
+and commit the updated SOURCES.md — that's the "I reviewed upstream, accept its state" action that
+clears the row back to `in-sync`/`local-only`.
 
 ### `ingest` + `queue close` (v0.9, Pro)
 

package/dist/cli.js

@@ -3131,6 +3131,33 @@ function extractDescription(block) {
   }
   return stripQuotes(first);
 }
+function extractExtends(block) {
+  const lines = block.split("\n");
+  const idx = lines.findIndex((l) => /^\s*extends:\s*(.*)$/.test(l));
+  if (idx === -1) return void 0;
+  const inline = lines[idx].match(/^\s*extends:\s*(.*)$/)[1].trim();
+  if (inline.startsWith("[")) {
+    const inner = inline.replace(/^\[/, "").replace(/\]\s*$/, "");
+    const items = inner.split(",").map((s) => stripQuotes(s.trim())).filter(Boolean);
+    return items.length ? items : void 0;
+  }
+  if (inline === "") {
+    const items = [];
+    for (let i = idx + 1; i < lines.length; i++) {
+      const line = lines[i];
+      const m = line.match(/^\s*-\s*(.+)$/);
+      if (m) {
+        items.push(stripQuotes(m[1].trim()));
+      } else if (line.trim() === "") {
+        continue;
+      } else {
+        break;
+      }
+    }
+    return items.length ? items : void 0;
+  }
+  return [stripQuotes(inline)];
+}
 function parseFrontmatter(text) {
   if (!text.startsWith("---\n")) {
     return { validFrontmatter: false };
@@ -3141,7 +3168,8 @@ function parseFrontmatter(text) {
     name: extractSimpleField(block, "name"),
     version: extractSimpleField(block, "version"),
     license: extractSimpleField(block, "license"),
-    description: extractDescription(block)
+    description: extractDescription(block),
+    extends: extractExtends(block)
   };
 }
 function detectLicense(root, fm) {
@@ -3227,7 +3255,8 @@ function profileSkillDir(inputPath) {
       resources,
       mcpDependencies: mcpDeps,
       externalPythonDeps: externalDeps,
-      artifactType: detectArtifactType(root)
+      artifactType: detectArtifactType(root),
+      extends: fm.extends ?? []
     };
   } finally {
     cleanupTmp(tmpDir);
@@ -3407,9 +3436,13 @@ function loadSkillMap(path) {
   if (!Array.isArray(obj.nodes) || !Array.isArray(obj.edges)) {
     throw new Error(`skill map at ${resolved}: expected "nodes" and "edges" arrays`);
   }
+  const nodes = obj.nodes.map((n) => ({
+    ...n,
+    type: typeof n.type === "string" ? n.type : n.kind
+  }));
   return {
     schemaVersion: typeof obj.schemaVersion === "string" ? obj.schemaVersion : void 0,
-    nodes: obj.nodes,
+    nodes,
     edges: obj.edges
   };
 }
@@ -3472,18 +3505,23 @@ function nodeText(map, node) {
 }
 function scanMapOverlap(candidate, map) {
   const candidateTokens = tokenize2(`${candidate.name ?? ""} ${candidate.description ?? ""}`);
-  if (candidateTokens.size === 0) return { matches: [] };
+  if (candidateTokens.size === 0) return { matches: [], compared: 0 };
   const matches = [];
+  let compared = 0;
+  let topMatch;
   for (const node of map.nodes) {
     if (node.type !== "skill") continue;
+    compared += 1;
     const otherTokens = tokenize2(nodeText(map, node));
     const s = score3(candidateTokens, otherTokens);
+    const match = { skillId: node.id, name: node.name ?? node.id, score: s };
+    if (!topMatch || s > topMatch.score) topMatch = match;
     if (s >= REPORT_THRESHOLD) {
-      matches.push({ skillId: node.id, name: node.name ?? node.id, score: s });
+      matches.push(match);
     }
   }
   matches.sort((a, b) => b.score - a.score);
-  return { matches };
+  return { matches, compared, topMatch };
 }
 function mapOverlapFinding(result) {
   const top = result.matches[0];
@@ -3497,6 +3535,25 @@ function mapOverlapFinding(result) {
     context: top.skillId
   };
 }
+function isDeclaredExtension(match, extendsDeclarations) {
+  const qualifiedId = match.skillId.replace(/^[a-z]+:/, "");
+  const bareId = qualifiedId.split("/").pop() ?? qualifiedId;
+  return extendsDeclarations.some((raw) => {
+    const declared = raw.trim();
+    if (!declared) return false;
+    return declared === match.name || declared === bareId || declared === qualifiedId;
+  });
+}
+function mapOverlapDecision(result, extendsDeclarations = []) {
+  const top = result.matches[0];
+  if (!top) return {};
+  if (extendsDeclarations.length > 0 && isDeclaredExtension(top, extendsDeclarations)) {
+    return {
+      informational: `declared extension of "${top.name}" (score ${top.score}) \u2014 overlap expected; verify the layering claim in review`
+    };
+  }
+  return { finding: mapOverlapFinding(result) };
+}
 
 // src/report/render.ts
 var SAFETY_VERDICT_MAP = {
@@ -3556,6 +3613,17 @@ function renderCapabilitiesLine(profile) {
   );
   return `${padLabel("Capabilities")}: ${counts} (declaredConfidence: ${declaredConfidence})`;
 }
+function renderMapOverlapLines(report) {
+  if (!report || report.status === "not-requested") return [];
+  if (report.status === "skipped") {
+    return [`${padLabel("Marketplace overlap")}: skipped \u2014 ${report.reason ?? "map unavailable"}`];
+  }
+  const top = report.topMatch;
+  const flagged = report.matches?.length ?? 0;
+  const closest = top ? `closest "${top.name}" (${top.score})` : "no comparable skills";
+  const verdict = flagged > 0 ? `${flagged} at/over threshold` : "none over threshold";
+  return [`${padLabel("Marketplace overlap")}: checked ${report.compared ?? 0} skills \u2014 ${closest}, ${verdict}`];
+}
 function renderReport(result) {
   const { profile, overlap, overlapLocked, safety, worthTaking, leaveBehind } = result;
   const { name, version, license } = profileHeaderFields(profile);
@@ -3570,6 +3638,7 @@ function renderReport(result) {
     `${padLabel("Artifact type")}: ${profile.artifactType}`,
     ...profile.kind === "mcp" ? [renderCapabilitiesLine(profile)] : [],
     ...overlapLines,
+    ...renderMapOverlapLines(result.mapOverlap),
     renderListField("What's worth taking", worthTaking, "(pending \u2014 not yet determined)"),
     renderListField("What to leave behind", leaveBehind, "(pending \u2014 not yet determined)"),
     `${padLabel("Safety verdict")}: ${renderSafetyLine(safety)}`,
@@ -3623,14 +3692,24 @@ function tryMcpOverlap(profile, mcpTargets) {
     return void 0;
   }
 }
-function tryMapOverlapFinding(skillMapPath, candidate) {
-  if (!skillMapPath) return void 0;
+function tryMapOverlapDecision(skillMapPath, candidate, extendsDeclarations) {
+  if (!skillMapPath) return { report: { status: "not-requested" } };
   try {
     const map = loadSkillMap(skillMapPath);
-    return mapOverlapFinding(scanMapOverlap(candidate, map));
+    const result = scanMapOverlap(candidate, map);
+    return {
+      decision: mapOverlapDecision(result, extendsDeclarations),
+      report: {
+        status: "checked",
+        compared: result.compared,
+        topMatch: result.topMatch,
+        matches: result.matches
+      }
+    };
   } catch (err) {
-    console.error(`[skill-forge] skill-map overlap check skipped: ${err.message}`);
-    return void 0;
+    const reason = err.message;
+    console.error(`[skill-forge] skill-map overlap check skipped: ${reason}`);
+    return { report: { status: "skipped", reason } };
   }
 }
 function resolveMcpCandidatePath(entry) {
@@ -3653,20 +3732,31 @@ async function runGate(candidatePath, skillsRoot, {
   const proStatus = proFeatureStatus(proFeatureLabel);
   const safety = artifact === "mcp" ? await mcpScan(candidatePath, strictness) : await scanSafety(candidatePath, strictness);
   const overlap = !proStatus.enabled ? void 0 : artifact === "mcp" ? tryMcpOverlap(profile, mcpTargets) : tryOverlap(candidatePath, skillsRoot);
-  const mapFinding = artifact === "mcp" ? void 0 : tryMapOverlapFinding(skillMapPath, {
-    name: "name" in profile ? profile.name : void 0,
-    description: "description" in profile ? profile.description : void 0
-  });
+  const mapOutcome = artifact === "mcp" ? { decision: void 0, report: { status: "not-requested" } } : tryMapOverlapDecision(
+    skillMapPath,
+    {
+      name: "name" in profile ? profile.name : void 0,
+      description: "description" in profile ? profile.description : void 0
+    },
+    profile.kind === "skill" ? profile.extends : []
+  );
+  const mapDecision = mapOutcome.decision;
+  const mapFinding = mapDecision?.finding;
   const combinedSafety = mapFinding ? { verdict: verdictFor([...safety.findings, mapFinding], strictness), findings: [...safety.findings, mapFinding] } : safety;
   const advisory = formatAuditAdvisory(readAuditState(), {
     targetRoot: skillsRoot || void 0,
     candidateName: "name" in profile ? profile.name : void 0
   });
+  const notices = [
+    ...proStatus.notice ? [proStatus.notice] : [],
+    ...mapDecision?.informational ? [mapDecision.informational] : []
+  ];
   const gateResult = {
     profile,
     overlap,
     overlapLocked: !proStatus.enabled,
-    notices: proStatus.notice ? [proStatus.notice] : void 0,
+    notices: notices.length > 0 ? notices : void 0,
+    mapOverlap: mapOutcome.report,
     safety: {
       verdict: SAFETY_VERDICT_MAP[combinedSafety.verdict],
       findings: mapSafetyFindings(combinedSafety.findings)
@@ -6406,12 +6496,52 @@ import { join as join26, resolve as resolvePath8 } from "path";
 // src/gate/skillMapDrift.ts
 import { createHash as createHash4 } from "crypto";
 import { readFileSync as readFileSync18, existsSync as existsSync23 } from "fs";
-import { resolve as resolve7 } from "path";
+import { dirname as dirname10, isAbsolute as isAbsolute2, resolve as resolve7 } from "path";
 function sha256(text) {
   return createHash4("sha256").update(text, "utf-8").digest("hex");
 }
-function defaultReadLocalFile(path) {
-  const resolved = resolve7(expandHome(path));
+function shortHash(hash) {
+  return hash.slice(0, 12);
+}
+var ACTIONABLE_STATUSES = /* @__PURE__ */ new Set([
+  "upstream-moved",
+  "diverged",
+  "drifted",
+  "upstream-unreachable",
+  "local-missing"
+]);
+function isActionable(status2) {
+  return ACTIONABLE_STATUSES.has(status2);
+}
+function threeWayVerdict(localNormalized, upstreamHash, baselineHash) {
+  const localMatchesBaseline = localNormalized === baselineHash;
+  const upstreamMatchesBaseline = upstreamHash === baselineHash;
+  const hashSuffix = `baseline=${shortHash(baselineHash)}\u2026, local-normalized=${shortHash(localNormalized)}\u2026, upstream=${shortHash(upstreamHash)}\u2026`;
+  const TABLE = {
+    TT: { status: "in-sync", detail: `local and upstream both match the recorded baseline (${hashSuffix})` },
+    TF: { status: "upstream-moved", detail: `only upstream changed since baseline \u2014 review for adoption (${hashSuffix})` },
+    FT: { status: "local-only", detail: `only local content changed since baseline \u2014 deliberate fork divergence (${hashSuffix})` },
+    FF: { status: "diverged", detail: `both local and upstream changed since baseline \u2014 review for adoption (${hashSuffix})` }
+  };
+  const key = `${localMatchesBaseline ? "T" : "F"}${upstreamMatchesBaseline ? "T" : "F"}`;
+  const { status: status2, detail } = TABLE[key];
+  return { status: status2, detail, actionable: isActionable(status2) };
+}
+function resolveLocalPath(path, mapDir) {
+  const expanded = expandHome(path);
+  if (isAbsolute2(expanded)) return resolve7(expanded);
+  const candidates = [resolve7(expanded)];
+  if (mapDir) {
+    candidates.push(resolve7(mapDir, expanded));
+    candidates.push(resolve7(mapDir, "..", expanded));
+  }
+  for (const candidate of candidates) {
+    if (existsSync23(candidate)) return candidate;
+  }
+  return candidates[0];
+}
+function defaultReadLocalFile(path, mapDir) {
+  const resolved = resolveLocalPath(path, mapDir);
   if (!existsSync23(resolved)) return void 0;
   try {
     return readFileSync18(resolved, "utf-8");
@@ -6435,7 +6565,8 @@ function upstreamLabel(node, edge) {
   return node?.url ?? node?.path ?? node?.name ?? node?.id ?? edge.to;
 }
 async function computeMapDrift(map, deps = {}) {
-  const readLocalFile = deps.readLocalFile ?? defaultReadLocalFile;
+  const mapDir = deps.mapPath ? dirname10(resolve7(expandHome(deps.mapPath))) : void 0;
+  const readLocalFile = deps.readLocalFile ?? ((path) => defaultReadLocalFile(path, mapDir));
   const fetchUpstream = deps.fetchUpstream ?? defaultFetchUpstream;
   const rows = [];
   for (const edge of edgesOfType(map, "fork-of")) {
@@ -6448,13 +6579,20 @@ async function computeMapDrift(map, deps = {}) {
         skill: skillLabel,
         upstream,
         status: "local-missing",
-        detail: !localNode ? `fork-of edge "from" node not found in map: ${edge.from}` : 'local skill node missing "path" or "contentHash" \u2014 cannot compare'
+        detail: !localNode ? `fork-of edge "from" node not found in map: ${edge.from}` : 'local skill node missing "path" or "contentHash" \u2014 cannot compare',
+        actionable: isActionable("local-missing")
       });
       continue;
     }
-    const localResolved = resolve7(expandHome(localNode.path));
+    const localResolved = resolveLocalPath(localNode.path, mapDir);
     if (!existsSync23(localResolved)) {
-      rows.push({ skill: skillLabel, upstream, status: "local-missing", detail: `local path does not exist: ${localResolved}` });
+      rows.push({
+        skill: skillLabel,
+        upstream,
+        status: "local-missing",
+        detail: `local path does not exist: ${localResolved}`,
+        actionable: isActionable("local-missing")
+      });
       continue;
     }
     const upstreamLocation = upstreamNode?.url ?? upstreamNode?.path;
@@ -6463,24 +6601,45 @@ async function computeMapDrift(map, deps = {}) {
         skill: skillLabel,
         upstream,
         status: "upstream-unreachable",
-        detail: 'upstream node has no "url" or "path" to fetch/read'
+        detail: 'upstream node has no "url" or "path" to fetch/read',
+        actionable: isActionable("upstream-unreachable")
       });
       continue;
     }
     const upstreamText = isHttpUrl(upstreamLocation) ? await fetchUpstream(upstreamLocation) : readLocalFile(upstreamLocation);
     if (upstreamText === void 0) {
-      rows.push({ skill: skillLabel, upstream, status: "upstream-unreachable", detail: `could not fetch/read upstream: ${upstreamLocation}` });
+      rows.push({
+        skill: skillLabel,
+        upstream,
+        status: "upstream-unreachable",
+        detail: `could not fetch/read upstream: ${upstreamLocation}`,
+        actionable: isActionable("upstream-unreachable")
+      });
       continue;
     }
     const upstreamHash = sha256(upstreamText);
+    const baselineHash = upstreamNode?.baselineHash;
+    const localNormalized = localNode.contentHashNormalized;
+    if (baselineHash && localNormalized) {
+      const { status: status2, detail, actionable } = threeWayVerdict(localNormalized, upstreamHash, baselineHash);
+      rows.push({ skill: skillLabel, upstream, status: status2, detail, actionable, baselineHash, upstreamHash });
+      continue;
+    }
     if (upstreamHash === localNode.contentHash) {
-      rows.push({ skill: skillLabel, upstream, status: "in-sync", detail: `contentHash matches (${upstreamHash.slice(0, 12)}\u2026)` });
+      rows.push({
+        skill: skillLabel,
+        upstream,
+        status: "in-sync",
+        detail: `contentHash matches (${shortHash(upstreamHash)}\u2026)`,
+        actionable: isActionable("in-sync")
+      });
     } else {
       rows.push({
         skill: skillLabel,
         upstream,
         status: "drifted",
-        detail: `recorded ${localNode.contentHash.slice(0, 12)}\u2026, upstream now hashes to ${upstreamHash.slice(0, 12)}\u2026`
+        detail: `recorded ${shortHash(localNode.contentHash)}\u2026, upstream now hashes to ${shortHash(upstreamHash)}\u2026`,
+        actionable: isActionable("drifted")
       });
     }
   }
@@ -6593,10 +6752,10 @@ async function runWatch(config, options = {}, deps = {}) {
   if (options.skillMap) {
     try {
       const map = loadSkillMap(options.skillMap);
-      mapDrift = await computeMapDrift(
-        map,
-        options.offline ? { fetchUpstream: async () => void 0 } : void 0
-      );
+      mapDrift = await computeMapDrift(map, {
+        mapPath: options.skillMap,
+        ...options.offline ? { fetchUpstream: async () => void 0 } : {}
+      });
     } catch (err) {
       warnings.push(`skill map at ${options.skillMap}: ${err.message}`);
     }
@@ -6921,7 +7080,7 @@ async function routineCommand(options = {}) {
 
 // src/commands/ingest.ts
 import { realpathSync as realpathSync6 } from "fs";
-import { dirname as dirname11, isAbsolute as isAbsolute2, relative as relative2, resolve as resolvePath9 } from "path";
+import { dirname as dirname12, isAbsolute as isAbsolute3, relative as relative2, resolve as resolvePath9 } from "path";
 var PRO_FEATURE_LABEL7 = "the pending-ingestion queue";
 var VALID_STATUSES = ["ingested", "dismissed"];
 function requireProFeature() {
@@ -6969,12 +7128,12 @@ function realpathOrNull(p) {
 }
 function isUnderRoot(candidate, root) {
   const rel = relative2(root, candidate);
-  return rel === "" || !rel.startsWith("..") && !isAbsolute2(rel);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute3(rel);
 }
 function validatePendingEntries(entries, config) {
   const quarantineRoot = realpathOrNull(resolvePath9(config.quarantineDir));
   const skillsRoots = config.skillsRoots.map((r) => realpathOrNull(resolvePath9(r))).filter((r) => r !== null);
-  const mcpTargetDirs = (config.mcpTargets ?? []).map((f) => realpathOrNull(dirname11(resolvePath9(f)))).filter((r) => r !== null);
+  const mcpTargetDirs = (config.mcpTargets ?? []).map((f) => realpathOrNull(dirname12(resolvePath9(f)))).filter((r) => r !== null);
   const allowedRoots = [quarantineRoot, ...skillsRoots, ...mcpTargetDirs].filter((r) => r !== null);
   const valid = [];
   const excluded = [];
@@ -7048,12 +7207,12 @@ async function queueClose(id, options = {}) {
 // src/commands/refine.ts
 import { createHash as createHash6, randomUUID as randomUUID5 } from "crypto";
 import { chmodSync, existsSync as existsSync27, lstatSync as lstatSync4, mkdirSync as mkdirSync9, readFileSync as readFileSync20, realpathSync as realpathSync9, renameSync as renameSync6, rmSync as rmSync9, writeFileSync as writeFileSync9 } from "fs";
-import { dirname as dirname13, isAbsolute as isAbsolute4, join as join30, relative as relative4, resolve as resolvePath12, sep as sep4 } from "path";
+import { dirname as dirname14, isAbsolute as isAbsolute5, join as join30, relative as relative4, resolve as resolvePath12, sep as sep4 } from "path";
 import { createInterface as createInterface6 } from "readline/promises";
 
 // src/refine/context.ts
 import { existsSync as existsSync26, realpathSync as realpathSync8, statSync as statSync12 } from "fs";
-import { isAbsolute as isAbsolute3, join as join29, relative as relative3, resolve as resolvePath11 } from "path";
+import { isAbsolute as isAbsolute4, join as join29, relative as relative3, resolve as resolvePath11 } from "path";
 
 // src/refine/models.ts
 import { randomBytes } from "crypto";
@@ -7465,7 +7624,7 @@ function realpathOrNull2(p) {
 }
 function isUnderRoot2(candidate, root) {
   const rel = relative3(root, candidate);
-  return rel === "" || !rel.startsWith("..") && !isAbsolute3(rel);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute4(rel);
 }
 function resolveScopes(config, cwd, skill, userRootFlag) {
   assertPlainSkillName(skill);
@@ -7796,7 +7955,7 @@ function resolveConfiguredRoot3(root) {
 }
 function isUnderRoot3(candidate, root) {
   const rel = relative4(root, candidate);
-  return rel === "" || !rel.startsWith("..") && !isAbsolute4(rel);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute5(rel);
 }
 function sanitizeDiffForConsole(diff) {
   return diff.split("\n").map((line) => sanitizeForMarkdown(line)).join("\n");
@@ -7956,7 +8115,7 @@ function ensureScopeDirSafe(scopeDir, resolvedCwd) {
 function writeOverrideFile(scopeDir, relPath, content, resolvedCwd) {
   const realScopeDir = ensureScopeDirSafe(scopeDir, resolvedCwd);
   const destPath = join30(scopeDir, relPath);
-  const destDir = dirname13(destPath);
+  const destDir = dirname14(destPath);
   mkdirSync9(destDir, { recursive: true });
   const realDestDir = realpathSync9(destDir);
   if (!isUnderRoot3(realDestDir, realScopeDir)) {
@@ -8313,7 +8472,7 @@ function resolveTargetRealPath(path) {
       const remainder = relative4(lexicalAncestor, resolvePath12(path));
       return remainder === "" ? real : join30(real, remainder);
     } catch {
-      const parent = dirname13(lexicalAncestor);
+      const parent = dirname14(lexicalAncestor);
       if (parent === lexicalAncestor) return resolvePath12(path);
       lexicalAncestor = parent;
     }
@@ -8357,7 +8516,7 @@ function findLexicalRoot(filePath, config) {
   for (const root of config.skillsRoots) {
     const rootLexical = resolveConfiguredRoot3(root);
     const rel = relative4(rootLexical, lexicalTarget);
-    if (rel !== "" && (rel === ".." || rel.startsWith(`..${sep4}`) || isAbsolute4(rel))) continue;
+    if (rel !== "" && (rel === ".." || rel.startsWith(`..${sep4}`) || isAbsolute5(rel))) continue;
     let rootReal;
     try {
       rootReal = realpathSync9(rootLexical);