@rhize/skill-forge 0.20.1 → 0.21.0

package/dist/cli.js

@@ -659,7 +659,7 @@ import { Command } from "commander";
 import { createRequire } from "module";
 
 // src/commands/add.ts
-import { join as join26 } from "path";
+import { join as join27 } from "path";
 
 // src/install/resolve.ts
 import { existsSync as existsSync3 } from "fs";
@@ -4669,7 +4669,7 @@ function runHandoff(config, installedPath, options = {}) {
 // src/commands/init.ts
 import { existsSync as existsSync19 } from "fs";
 import { homedir as homedir5 } from "os";
-import { join as join25 } from "path";
+import { join as join26 } from "path";
 import { createInterface as createInterface3 } from "readline/promises";
 
 // src/agents.ts
@@ -5093,7 +5093,7 @@ function readPluginInventory(path) {
 
 // src/commands/audit.ts
 import { existsSync as existsSync18 } from "fs";
-import { join as join24, resolve as resolvePath5 } from "path";
+import { join as join25, resolve as resolvePath5 } from "path";
 import { createInterface as createInterface2 } from "readline/promises";
 
 // src/decision.ts
@@ -5459,6 +5459,129 @@ function loadUsageSnapshot(pathOrDir, opts = {}) {
   return toSnapshot(parsed, resolved);
 }
 
+// src/typedFindingTriage.ts
+import { createHash as createHash3, randomUUID as randomUUID4 } from "crypto";
+import { closeSync as closeSync3, constants as constants2, lstatSync as lstatSync4, mkdirSync as mkdirSync7, openSync as openSync3, writeFileSync as writeFileSync7 } from "fs";
+import { join as join24 } from "path";
+import { performance } from "perf_hooks";
+function digest(value) {
+  return createHash3("sha256").update(JSON.stringify(value)).digest("hex");
+}
+function localEndpoint(baseUrl) {
+  const url = new URL(baseUrl);
+  if (url.protocol !== "http:" || !["localhost", "127.0.0.1", "[::1]"].includes(url.hostname) || url.username || url.password || url.search || url.hash || url.pathname !== "/") {
+    throw new Error("local_endpoint_required");
+  }
+  return new URL("/v1/systemone", url);
+}
+async function rankFindingMetadata(findings, baseUrl = "http://127.0.0.1:8000", fetchImpl = fetch) {
+  const metadata = findings.map((finding2) => ({
+    fingerprint: finding2.fingerprint ?? "",
+    severity: finding2.severity,
+    rule: finding2.rule,
+    classification: finding2.classification ?? "none"
+  }));
+  const sourceSha256 = digest(metadata);
+  const candidates = metadata.filter((row) => /^[0-9a-f]{64}$/.test(row.fingerprint) && /^[a-z0-9-]{1,64}$/.test(row.rule)).slice(0, 8);
+  const base = {
+    schema: "skill-forge-typed-triage-v1",
+    sourceSha256,
+    evaluated: candidates.length,
+    deferred: findings.length - candidates.length,
+    gateChanged: false
+  };
+  if (!candidates.length) return { ...base, status: "not_applicable", variant: "A_incumbent" };
+  const questions = Object.fromEntries(candidates.map((row, index) => [
+    `c${index}`,
+    { type: "noul", instructions: `Would reviewing finding ${row.fingerprint.slice(0, 16)} first improve triage? Do not downgrade or accept it.` }
+  ]));
+  const request = { model: "typed-decisions", state: { findings: candidates.map((row) => ({
+    id: row.fingerprint.slice(0, 16),
+    severity: row.severity,
+    rule: row.rule,
+    classification: row.classification
+  })) }, questions };
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 8e3);
+  const start = performance.now();
+  try {
+    const response = await fetchImpl(localEndpoint(baseUrl), {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(request),
+      signal: controller.signal
+    });
+    if (!response.ok) throw new Error("provider_http_error");
+    if (!response.body) throw new Error("empty_response");
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    let raw = "";
+    let total = 0;
+    for (; ; ) {
+      const chunk = await reader.read();
+      if (chunk.done) break;
+      total += chunk.value.byteLength;
+      if (total > 262144) {
+        await reader.cancel();
+        throw new Error("oversized_response");
+      }
+      raw += decoder.decode(chunk.value, { stream: true });
+    }
+    raw += decoder.decode();
+    const data = JSON.parse(raw);
+    const routing = data.routing;
+    const answers = data.answers;
+    const usage = data.usage;
+    if (routing?.model !== request.model || !answers || Object.keys(answers).sort().join() !== Object.keys(questions).sort().join()) {
+      throw new Error("route_or_answer_mismatch");
+    }
+    if (!usage || !Number.isSafeInteger(usage.input_tokens) || !Number.isSafeInteger(usage.output_tokens) || Number(usage.input_tokens) < 0 || Number(usage.output_tokens) < 0) throw new Error("invalid_usage");
+    const ranking = candidates.map((row, index) => {
+      const answer = answers[`c${index}`];
+      const score4 = answer?.type === "noul" ? answer.noul : void 0;
+      if (typeof score4 !== "number" || !Number.isFinite(score4) || score4 < 0 || score4 > 1) throw new Error("invalid_score");
+      return { fingerprint: row.fingerprint, severity: row.severity, score: score4 };
+    }).sort((a, b) => b.score - a.score || a.fingerprint.localeCompare(b.fingerprint));
+    return {
+      ...base,
+      status: "shadow",
+      variant: "B_local_laya",
+      ranking,
+      routedModel: String(routing.model),
+      latencyMs: Math.round((performance.now() - start) * 1e3) / 1e3,
+      usage: { input_tokens: Number(usage.input_tokens), output_tokens: Number(usage.output_tokens) }
+    };
+  } catch (error) {
+    const known = /* @__PURE__ */ new Set([
+      "local_endpoint_required",
+      "provider_http_error",
+      "empty_response",
+      "oversized_response",
+      "route_or_answer_mismatch",
+      "invalid_usage",
+      "invalid_score"
+    ]);
+    const reasonCode = error instanceof Error && known.has(error.message) ? error.message : "provider_unavailable";
+    return { ...base, status: "unavailable", variant: "A_incumbent", reasonCode };
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+function writeTypedTriageReceipt(home, result) {
+  const dir = join24(home, "typed-finding-triage");
+  mkdirSync7(dir, { recursive: true, mode: 448 });
+  if (lstatSync4(dir).isSymbolicLink()) throw new Error("receipt_root_symlink");
+  const data = JSON.stringify(result) + "\n";
+  const path = join24(dir, `${randomUUID4()}.json`);
+  const fd = openSync3(path, constants2.O_WRONLY | constants2.O_CREAT | constants2.O_EXCL | (constants2.O_NOFOLLOW ?? 0), 384);
+  try {
+    writeFileSync7(fd, data);
+  } finally {
+    closeSync3(fd);
+  }
+  return createHash3("sha256").update(data).digest("hex");
+}
+
 // src/commands/audit.ts
 var CURATION_PROMPT_ASSET = "curation-prompt.md";
 function resolvePluginAndUsageContext(config, options, deps = {}) {
@@ -5515,7 +5638,7 @@ async function captureBusinessProfile(rl, existing) {
 function resolveReportPath(reportOption) {
   if (reportOption) return resolvePath5(reportOption);
   const iso = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-  return join24(getHomeDir(), "reports", `audit-${iso}.md`);
+  return join25(getHomeDir(), "reports", `audit-${iso}.md`);
 }
 function summarizePluginRecommendations(plugins2) {
   const counts = { keep: 0, review: 0, unobserved: 0, unknown: 0 };
@@ -5603,6 +5726,18 @@ async function auditCommand(options = {}, deps = {}) {
     const extraNotices = [...storeNotices, ...pluginUsageNotices];
     if (extraNotices.length > 0) report.notices = [...report.notices, ...extraNotices];
     if (options.compare) report.comparison = loadAuditComparison(report, options.compare);
+    if (options.layaShadow) {
+      const triage = await rankFindingMetadata(report.hygiene, options.layaBaseUrl);
+      try {
+        triage.receiptSha256 = writeTypedTriageReceipt(getHomeDir(), triage);
+      } catch {
+        triage.status = "unavailable";
+        triage.variant = "A_incumbent";
+        triage.reasonCode = "receipt_unavailable";
+        delete triage.ranking;
+      }
+      report.typedFindingTriage = triage;
+    }
     const reportPath = resolveReportPath(options.report);
     writeNewFile(reportPath, renderAuditMarkdown(report), "--report");
     try {
@@ -5931,7 +6066,7 @@ async function init(options = {}, deps = {}) {
       "[skill-forge] No detected agent CLI was found on PATH \u2014 keeping every detected target selected."
     );
   }
-  const installedPluginsPath = options.installedPluginsPath ?? join25(home, ".claude", "plugins", "installed_plugins.json");
+  const installedPluginsPath = options.installedPluginsPath ?? join26(home, ".claude", "plugins", "installed_plugins.json");
   const claudePluginsRegistryExists = existsSync19(installedPluginsPath);
   if (options.defaults) {
     const selectedRoots = narrow ? rootGroups.filter(hasInstalledMember) : rootGroups;
@@ -6142,7 +6277,7 @@ async function addMcp(source, config, options) {
       envVars: detail.env ? Object.keys(detail.env) : void 0,
       candidateEntry: detail.command ? { command: detail.command, args: detail.args, env: detail.env } : void 0
     };
-    const mcpTargetPath = options.mcpTarget ?? config.mcpTargets?.[0] ?? join26(process.cwd(), ".mcp.json");
+    const mcpTargetPath = options.mcpTarget ?? config.mcpTargets?.[0] ?? join27(process.cwd(), ".mcp.json");
     const result = promoteMcp(entry, serverProfile, mcpTargetPath, { force: options.force });
     reject(entry);
     logOutcome(`[skill-forge] promoted -> ${result.target} (server "${result.serverName}")`, options.json);
@@ -6238,7 +6373,7 @@ async function scan(source, options = {}) {
 }
 
 // src/commands/list.ts
-import { join as join27 } from "path";
+import { join as join28 } from "path";
 async function list() {
   await maybeOfferInit();
   const config = loadConfig();
@@ -6251,14 +6386,14 @@ async function list() {
   }
   console.log(`[skill-forge] ${ids.length} held in quarantine (${quarantineDir}):`);
   for (const id of ids) {
-    const skillDirs = findSkillDirs(join27(quarantineDir, id));
+    const skillDirs = findSkillDirs(join28(quarantineDir, id));
     if (skillDirs.length === 0) {
       console.log(`  ${id}  (no SKILL.md found)`);
       continue;
     }
     const names = skillDirs.map((dir) => {
       try {
-        return readFrontmatter(join27(dir, "SKILL.md")).name;
+        return readFrontmatter(join28(dir, "SKILL.md")).name;
       } catch {
         return dir;
       }
@@ -6272,13 +6407,13 @@ import { existsSync as existsSync21 } from "fs";
 
 // src/commands/held.ts
 import { existsSync as existsSync20, realpathSync as realpathSync6 } from "fs";
-import { basename as basename9, join as join28, resolve as resolvePath6, sep as sep7 } from "path";
+import { basename as basename9, join as join29, resolve as resolvePath6, sep as sep7 } from "path";
 var PRO_FEATURE_LABEL2 = "overlap analysis, the provenance ledger, and the pending-ingestion queue";
 function resolveHeldPath(quarantineDir, id) {
   if (id === "" || id !== basename9(id) || id === "." || id === "..") {
     throw new UserError(`invalid quarantine id "${id}" \u2014 pass a single id exactly as printed by \`skill-forge list\``);
   }
-  const candidate = join28(quarantineDir, id);
+  const candidate = join29(quarantineDir, id);
   if (!existsSync20(candidate)) {
     throw new UserError(`no held entry with id "${id}" \u2014 run \`skill-forge list\` to see what is in quarantine`);
   }
@@ -6307,7 +6442,7 @@ function resolveTargetRoot(config, target) {
 function heldSkillNames(skillDirs) {
   return skillDirs.map((dir) => {
     try {
-      return readFrontmatter(join28(dir, "SKILL.md")).name;
+      return readFrontmatter(join29(dir, "SKILL.md")).name;
     } catch {
       return basename9(dir);
     }
@@ -6315,7 +6450,7 @@ function heldSkillNames(skillDirs) {
 }
 function looksLikeMcpSandbox(quarantinePath) {
   const candidate = resolveMcpCandidatePath({ quarantinePath });
-  return [".mcp.json", "mcp.json", "package.json"].some((f) => existsSync20(join28(candidate, f)));
+  return [".mcp.json", "mcp.json", "package.json"].some((f) => existsSync20(join29(candidate, f)));
 }
 async function promoteHeldMcp(id, entry, config, options) {
   const candidatePath = resolveMcpCandidatePath(entry);
@@ -6349,7 +6484,7 @@ async function promoteHeldMcp(id, entry, config, options) {
     envVars: detail.env ? Object.keys(detail.env) : void 0,
     candidateEntry: detail.command ? { command: detail.command, args: detail.args, env: detail.env } : void 0
   };
-  const mcpTargetPath = options.mcpTarget ?? config.mcpTargets?.[0] ?? join28(process.cwd(), ".mcp.json");
+  const mcpTargetPath = options.mcpTarget ?? config.mcpTargets?.[0] ?? join29(process.cwd(), ".mcp.json");
   const result = promoteMcp(entry, serverProfile, mcpTargetPath, { force: options.force });
   reject(entry);
   logOutcome(`[skill-forge] promoted -> ${result.target} (server "${result.serverName}")`, options.json);
@@ -6827,17 +6962,17 @@ async function status() {
 
 // src/evolve.ts
 import { createInterface as createInterface5 } from "readline/promises";
-import { createHash as createHash3 } from "crypto";
-import { cpSync as cpSync3, existsSync as existsSync22, lstatSync as lstatSync4, mkdtempSync as mkdtempSync3, readFileSync as readFileSync21, rmSync as rmSync6 } from "fs";
+import { createHash as createHash4 } from "crypto";
+import { cpSync as cpSync3, existsSync as existsSync22, lstatSync as lstatSync5, mkdtempSync as mkdtempSync3, readFileSync as readFileSync21, rmSync as rmSync6 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { basename as basename10, dirname as dirname9, join as join29, resolve as resolvePath7, sep as sep8 } from "path";
+import { basename as basename10, dirname as dirname9, join as join30, resolve as resolvePath7, sep as sep8 } from "path";
 var SKILLOPT_BIN = "skillopt-sleep";
 var PRO_FEATURE_LABEL3 = "self-evolution via SkillOpt-Sleep (evolve) \u2014 re-gating, provenance, and the pending-ingestion queue";
 async function evolve(targetSkillDir, options = {}, deps = {}) {
   const exec = deps.exec ?? defaultExec;
   const json = options.json;
   const resolvedTargetDir = resolvePath7(targetSkillDir);
-  const skillMdPath = join29(resolvedTargetDir, "SKILL.md");
+  const skillMdPath = join30(resolvedTargetDir, "SKILL.md");
   if (!existsSync22(skillMdPath)) {
     throw new UserError(`no SKILL.md found at ${skillMdPath} \u2014 evolve requires an existing, installed skill directory`);
   }
@@ -6896,16 +7031,16 @@ async function evolve(targetSkillDir, options = {}, deps = {}) {
     }
     return;
   }
-  const stagingRoot = join29(project, ".skillopt-sleep", "staging");
+  const stagingRoot = join30(project, ".skillopt-sleep", "staging");
   const stagingDir = resolvePath7(parsed.staging_dir);
   if (stagingDir !== stagingRoot && !stagingDir.startsWith(stagingRoot + sep8)) {
     throw new UserError(
       `skillopt-sleep reported a staging_dir outside the expected sandbox (${stagingRoot}): ${stagingDir} \u2014 refusing to use it`
     );
   }
-  const proposedSkillMd = join29(stagingDir, "proposed_SKILL.md");
-  const proposedClaudeMd = join29(stagingDir, "proposed_CLAUDE.md");
-  const reportMdPath = join29(stagingDir, "report.md");
+  const proposedSkillMd = join30(stagingDir, "proposed_SKILL.md");
+  const proposedClaudeMd = join30(stagingDir, "proposed_CLAUDE.md");
+  const reportMdPath = join30(stagingDir, "report.md");
   if (!existsSync22(proposedSkillMd)) {
     throw new UserError(`skillopt-sleep reported an accepted proposal but ${proposedSkillMd} is missing`);
   }
@@ -6916,13 +7051,13 @@ async function evolve(targetSkillDir, options = {}, deps = {}) {
   assertNotSymlink(proposedClaudeMd, "proposed_CLAUDE.md");
   const scannedSkillHash = sha256File(proposedSkillMd);
   const scannedClaudeHash = sha256File(proposedClaudeMd);
-  const tempDir = mkdtempSync3(join29(tmpdir2(), "skill-forge-evolve-"));
+  const tempDir = mkdtempSync3(join30(tmpdir2(), "skill-forge-evolve-"));
   let profile;
   let safety;
   try {
-    cpSync3(proposedSkillMd, join29(tempDir, "SKILL.md"));
+    cpSync3(proposedSkillMd, join30(tempDir, "SKILL.md"));
     if (existsSync22(proposedClaudeMd)) {
-      cpSync3(proposedClaudeMd, join29(tempDir, "CLAUDE.md"));
+      cpSync3(proposedClaudeMd, join30(tempDir, "CLAUDE.md"));
     }
     profile = asSkillProfile(profileSkill(tempDir), "for the evolved proposal");
     const strictness = loadConfig().strictness;
@@ -7063,7 +7198,7 @@ function validateRunOutput(raw) {
   return { accepted: Boolean(obj.accepted), staging_dir: stagingDirRaw ?? null };
 }
 function readManifest(stagingDir) {
-  const manifestPath = join29(stagingDir, "manifest.json");
+  const manifestPath = join30(stagingDir, "manifest.json");
   let raw;
   try {
     raw = readFileSync21(manifestPath, "utf-8");
@@ -7104,8 +7239,8 @@ function filesIdentical(a, b) {
   return readFileSync21(a).equals(readFileSync21(b));
 }
 function isAlreadyAdopted(stagingDir, manifest) {
-  const proposedSkillMd = join29(stagingDir, "proposed_SKILL.md");
-  const proposedClaudeMd = join29(stagingDir, "proposed_CLAUDE.md");
+  const proposedSkillMd = join30(stagingDir, "proposed_SKILL.md");
+  const proposedClaudeMd = join30(stagingDir, "proposed_CLAUDE.md");
   let sawComparison = false;
   if (existsSync22(proposedSkillMd)) {
     sawComparison = true;
@@ -7120,7 +7255,7 @@ function isAlreadyAdopted(stagingDir, manifest) {
 function assertNotSymlink(path, label2) {
   let stat;
   try {
-    stat = lstatSync4(path);
+    stat = lstatSync5(path);
   } catch {
     return;
   }
@@ -7130,7 +7265,7 @@ function assertNotSymlink(path, label2) {
 }
 function sha256File(path) {
   if (!existsSync22(path)) return null;
-  return createHash3("sha256").update(readFileSync21(path)).digest("hex");
+  return createHash4("sha256").update(readFileSync21(path)).digest("hex");
 }
 
 // src/commands/evolve.ts
@@ -7249,7 +7384,7 @@ import { resolve as resolvePath9 } from "path";
 
 // src/organize.ts
 import { existsSync as existsSync24, readFileSync as readFileSync22, readdirSync as readdirSync10, realpathSync as realpathSync7, statSync as statSync10 } from "fs";
-import { basename as basename11, join as join30, resolve as resolvePath8 } from "path";
+import { basename as basename11, join as join31, resolve as resolvePath8 } from "path";
 var PRO_FEATURE_LABEL4 = "set-level organizer reports";
 var TIERS = /* @__PURE__ */ new Set(["resource", "custom"]);
 var MATURITIES = /* @__PURE__ */ new Set(["seedling", "stable", "deprecated", "experimental"]);
@@ -7262,7 +7397,7 @@ function listSubdirs2(dir) {
   }
   const out = [];
   for (const entry of entries) {
-    const full = join30(dir, entry.name);
+    const full = join31(dir, entry.name);
     if (entry.isDirectory()) {
       out.push(full);
       continue;
@@ -7280,14 +7415,14 @@ function findSkillDirsUnderRoot2(root) {
   const found = /* @__PURE__ */ new Set();
   const topDirs = listSubdirs2(root);
   for (const dir of topDirs) {
-    if (existsSync24(join30(dir, "SKILL.md"))) found.add(dir);
+    if (existsSync24(join31(dir, "SKILL.md"))) found.add(dir);
   }
-  for (const dir of listSubdirs2(join30(root, "skills"))) {
-    if (existsSync24(join30(dir, "SKILL.md"))) found.add(dir);
+  for (const dir of listSubdirs2(join31(root, "skills"))) {
+    if (existsSync24(join31(dir, "SKILL.md"))) found.add(dir);
   }
   for (const topDir of topDirs) {
-    for (const dir of listSubdirs2(join30(topDir, "skills"))) {
-      if (existsSync24(join30(dir, "SKILL.md"))) found.add(dir);
+    for (const dir of listSubdirs2(join31(topDir, "skills"))) {
+      if (existsSync24(join31(dir, "SKILL.md"))) found.add(dir);
     }
   }
   return Array.from(found).filter((p) => !p.includes("/.git/"));
@@ -7490,7 +7625,7 @@ function buildRegistryEntries(candidates, warnings) {
     }
     if (seenRealPaths.has(realPath)) continue;
     seenRealPaths.add(realPath);
-    const skillMdPath = join30(realPath, "SKILL.md");
+    const skillMdPath = join31(realPath, "SKILL.md");
     let text;
     try {
       text = readFileSync22(skillMdPath, "utf-8");
@@ -7900,14 +8035,14 @@ async function find(query, options = {}, deps = {}) {
 
 // src/commands/watch.ts
 import { realpathSync as realpathSync8 } from "fs";
-import { join as join31, resolve as resolvePath10 } from "path";
+import { join as join32, resolve as resolvePath10 } from "path";
 
 // src/gate/skillMapDrift.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 import { readFileSync as readFileSync23, existsSync as existsSync25 } from "fs";
 import { dirname as dirname10, isAbsolute as isAbsolute6, resolve as resolve8 } from "path";
 function sha256(text) {
-  return createHash4("sha256").update(text, "utf-8").digest("hex");
+  return createHash5("sha256").update(text, "utf-8").digest("hex");
 }
 function shortHash(hash) {
   return hash.slice(0, 12);
@@ -8117,7 +8252,7 @@ async function runWatch(config, options = {}, deps = {}) {
       ledger = readProvenanceLedger(resolvedRoot);
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
-      const ledgerPath = join31(resolvedRoot, "SOURCES.md");
+      const ledgerPath = join32(resolvedRoot, "SOURCES.md");
       roots.push({ root, realPath, exists, ledgerPath, ledgerExists: false });
       warnings.push(`${ledgerPath}: could not read ledger: ${message}`);
       continue;
@@ -8228,7 +8363,7 @@ async function watchCommand(options = {}) {
 
 // src/commands/routine.ts
 import { existsSync as existsSync26, rmSync as rmSync7, statSync as statSync11 } from "fs";
-import { join as join32 } from "path";
+import { join as join33 } from "path";
 var PRO_FEATURE_LABEL6 = "the scheduled maintenance routine";
 var SEVERITY_ORDER = ["LOW", "MEDIUM", "HIGH", "CRITICAL"];
 function parseFailOnFloor(failOn) {
@@ -8249,7 +8384,7 @@ function exceedsFloor(findings, failOn) {
 }
 function resolveReportPath2(override, generatedAt) {
   if (override) return override;
-  return join32(getHomeDir(), "reports", `routine-${generatedAt.replace(/[:.]/g, "-")}.md`);
+  return join33(getHomeDir(), "reports", `routine-${generatedAt.replace(/[:.]/g, "-")}.md`);
 }
 function runHousekeeping(config, options) {
   const actions = [];
@@ -8258,7 +8393,7 @@ function runHousekeeping(config, options) {
   const pruneDays = options.pruneDays ?? 30;
   const cutoff = Date.now() - pruneDays * 864e5;
   for (const id of listQuarantineIds(config.quarantineDir)) {
-    const path = join32(config.quarantineDir, id);
+    const path = join33(config.quarantineDir, id);
     let mtime;
     try {
       mtime = statSync11(path).mtimeMs;
@@ -8644,20 +8779,20 @@ async function queueClose(id, options = {}) {
 import { createInterface as createInterface6 } from "readline/promises";
 import {
   chmodSync as chmodSync3,
-  lstatSync as lstatSync6,
-  mkdirSync as mkdirSync9,
+  lstatSync as lstatSync7,
+  mkdirSync as mkdirSync10,
   readFileSync as readFileSync27,
   readSync as readSync3,
-  writeFileSync as writeFileSync8
+  writeFileSync as writeFileSync9
 } from "fs";
-import { dirname as dirname13, isAbsolute as isAbsolute9, join as join37, relative as relative8, resolve as resolvePath12 } from "path";
+import { dirname as dirname13, isAbsolute as isAbsolute9, join as join38, relative as relative8, resolve as resolvePath12 } from "path";
 
 // src/insights/inventory.ts
 import { readFileSync as readFileSync24 } from "fs";
-import { join as join33 } from "path";
+import { join as join34 } from "path";
 
 // src/insights/models.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 var INSIGHT_SCHEMA_VERSION = 1;
 var MAX_EVIDENCE_EXCERPT_CHARS = 500;
 var SOURCE_TYPES = ["url", "file", "directory", "connector", "stdin"];
@@ -8709,7 +8844,7 @@ function canonicalJson(value) {
   return JSON.stringify(normalize(value));
 }
 function stableHash(value) {
-  return createHash5("sha256").update(canonicalJson(value)).digest("hex");
+  return createHash6("sha256").update(canonicalJson(value)).digest("hex");
 }
 function stableId(prefix, value, length = 16) {
   if (!/^[A-Z][A-Z0-9-]*$/.test(prefix)) {
@@ -8768,7 +8903,7 @@ function declaredMapCoverage(path, claim) {
 }
 function fingerprintInstalledSkill(path) {
   try {
-    return { fingerprint: stableHash(readFileSync24(join33(path, "SKILL.md"), "utf-8")) };
+    return { fingerprint: stableHash(readFileSync24(join34(path, "SKILL.md"), "utf-8")) };
   } catch (error) {
     return { reason: `could not fingerprint SKILL.md: ${error.message}` };
   }
@@ -8919,26 +9054,26 @@ function buildInsightInventory(config, options = {}) {
 
 // src/insights/jira.ts
 import { existsSync as existsSync28, readFileSync as readFileSync26 } from "fs";
-import { join as join36 } from "path";
+import { join as join37 } from "path";
 
 // src/insights/store.ts
-import { chmodSync as chmodSync2, existsSync as existsSync27, mkdirSync as mkdirSync8, readFileSync as readFileSync25 } from "fs";
-import { join as join35 } from "path";
+import { chmodSync as chmodSync2, existsSync as existsSync27, mkdirSync as mkdirSync9, readFileSync as readFileSync25 } from "fs";
+import { join as join36 } from "path";
 
 // src/insights/sources.ts
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 import {
-  closeSync as closeSync3,
-  constants as constants2,
+  closeSync as closeSync4,
+  constants as constants3,
   fstatSync as fstatSync2,
-  lstatSync as lstatSync5,
-  openSync as openSync3,
+  lstatSync as lstatSync6,
+  openSync as openSync4,
   readSync as readSync2,
   readdirSync as readdirSync11,
   realpathSync as realpathSync10,
   statSync as statSync12
 } from "fs";
-import { basename as basename12, extname as extname8, isAbsolute as isAbsolute8, join as join34, relative as relative7, resolve as resolve9, sep as sep9 } from "path";
+import { basename as basename12, extname as extname8, isAbsolute as isAbsolute8, join as join35, relative as relative7, resolve as resolve9, sep as sep9 } from "path";
 var DEFAULT_MAX_SOURCE_FILE_BYTES = 5 * 1024 * 1024;
 var DEFAULT_MAX_SOURCE_TOTAL_BYTES = 25 * 1024 * 1024;
 var SKIP_DIRS4 = /* @__PURE__ */ new Set([".git", "node_modules", "dist", "build", "coverage", ".next", "out", "__pycache__", ".venv", "venv"]);
@@ -9037,12 +9172,12 @@ function observeFile(path, relativePath, declaredMediaType, maxFileBytes, remain
   }
   const mediaType = mediaTypeFor(path, declaredMediaType);
   if (!mediaType) return { path: relativePath, reason: "unsupported-media-type" };
-  const noFollow = typeof constants2.O_NOFOLLOW === "number" ? constants2.O_NOFOLLOW : 0;
+  const noFollow = typeof constants3.O_NOFOLLOW === "number" ? constants3.O_NOFOLLOW : 0;
   let descriptor;
   let bytes;
   let descriptorStat;
   try {
-    descriptor = openSync3(path, constants2.O_RDONLY | noFollow);
+    descriptor = openSync4(path, constants3.O_RDONLY | noFollow);
     descriptorStat = fstatSync2(descriptor);
     if (!descriptorStat.isFile()) return { path: relativePath, reason: "unsupported-media-type" };
     if (descriptorStat.size > maxFileBytes) {
@@ -9069,7 +9204,7 @@ function observeFile(path, relativePath, declaredMediaType, maxFileBytes, remain
   } catch (error) {
     throw new UserError(`unable to read source file ${relativePath}: ${error.message}`);
   } finally {
-    if (descriptor !== void 0) closeSync3(descriptor);
+    if (descriptor !== void 0) closeSync4(descriptor);
   }
   if (!bytes || !descriptorStat) throw new UserError(`source file could not be observed: ${relativePath}`);
   let realPath;
@@ -9089,7 +9224,7 @@ function observeFile(path, relativePath, declaredMediaType, maxFileBytes, remain
     realPath,
     relativePath,
     byteLength: bytes.byteLength,
-    sha256: createHash6("sha256").update(bytes).digest("hex"),
+    sha256: createHash7("sha256").update(bytes).digest("hex"),
     mediaType,
     suspiciousInstructionFlags: suspiciousInstructionFlags(bytes, mediaType),
     bytes
@@ -9173,7 +9308,7 @@ function normalizeStdin(input, retrievedAt, maxFileBytes, remainingBytes) {
   const bytes = Buffer.from(input.content);
   if (bytes.byteLength > maxFileBytes) throw new UserError(`stdin source exceeds the per-source byte limit (${maxFileBytes})`);
   if (bytes.byteLength > remainingBytes) throw new UserError(`stdin source exceeds the total source byte limit`);
-  const contentSha256 = createHash6("sha256").update(bytes).digest("hex");
+  const contentSha256 = createHash7("sha256").update(bytes).digest("hex");
   const mediaType = input.mediaType ?? "text/plain";
   const fingerprint = stableHash({ type: input.type, contentSha256, mediaType });
   const common = normalizedCommon(input, retrievedAt);
@@ -9199,7 +9334,7 @@ function normalizeFile(input, retrievedAt, maxFileBytes, remainingBytes) {
   const resolved = resolve9(input.path);
   let lexicalStat;
   try {
-    lexicalStat = lstatSync5(resolved);
+    lexicalStat = lstatSync6(resolved);
   } catch (err) {
     throw new UserError(`unable to read source file ${resolved}: ${err.message}`);
   }
@@ -9250,7 +9385,7 @@ function normalizeDirectory(input, retrievedAt, maxFileBytes, remainingBytes) {
   const resolved = resolve9(input.path);
   let lexicalStat;
   try {
-    lexicalStat = lstatSync5(resolved);
+    lexicalStat = lstatSync6(resolved);
   } catch (err) {
     throw new UserError(`unable to read source directory ${resolved}: ${err.message}`);
   }
@@ -9270,7 +9405,7 @@ function normalizeDirectory(input, retrievedAt, maxFileBytes, remainingBytes) {
       throw new UserError(`unable to enumerate source directory ${dir}: ${err.message}`);
     }
     for (const entry of entries) {
-      const full = join34(dir, entry.name);
+      const full = join35(dir, entry.name);
       const logicalPath = logicalDir ? `${logicalDir}/${entry.name}` : entry.name;
       if (entry.isDirectory() && SKIP_DIRS4.has(entry.name)) {
         skipped.push({ path: logicalPath, reason: "ignored-directory" });
@@ -9336,7 +9471,7 @@ function normalizeDirectory(input, retrievedAt, maxFileBytes, remainingBytes) {
   walk2(realRoot, "");
   observations.sort((a, b) => compareStrings2(a.relativePath, b.relativePath));
   skipped.sort((a, b) => compareStrings2(a.path, b.path) || compareStrings2(a.reason, b.reason));
-  const contentSha256 = createHash6("sha256");
+  const contentSha256 = createHash7("sha256");
   for (const file of observations) contentSha256.update(`${file.relativePath}\0${file.sha256}
 `);
   const aggregateHash = contentSha256.digest("hex");
@@ -9422,17 +9557,17 @@ function normalizeSources(inputs, options = {}) {
 // src/insights/store.ts
 var STUDY_ID = /^STUDY-[0-9a-f]{16}$/;
 function getInsightsDir() {
-  return join35(getHomeDir(), "insights");
+  return join36(getHomeDir(), "insights");
 }
 function getStudyDir(studyId) {
   assertStudyId(studyId);
-  return join35(getInsightsDir(), studyId);
+  return join36(getInsightsDir(), studyId);
 }
 function getStudyPath(studyId) {
-  return join35(getStudyDir(studyId), "study.json");
+  return join36(getStudyDir(studyId), "study.json");
 }
 function getStudyEventsPath(studyId) {
-  return join35(getStudyDir(studyId), "events.jsonl");
+  return join36(getStudyDir(studyId), "events.jsonl");
 }
 function createStudyId(sourceInventoryHash, createdAt) {
   return stableId("STUDY", { sourceInventoryHash, createdAt });
@@ -9441,7 +9576,7 @@ function assertStudyId(studyId) {
   if (!STUDY_ID.test(studyId)) throw new UserError(`invalid insight study id: ${studyId}`);
 }
 function ensurePrivateDir(path) {
-  mkdirSync8(path, { recursive: true, mode: 448 });
+  mkdirSync9(path, { recursive: true, mode: 448 });
   chmodSync2(path, 448);
 }
 function isRecord2(value) {
@@ -10365,7 +10500,7 @@ function buildJiraManifest(study, projectKey, options = {}) {
   return manifest;
 }
 function getJiraReceiptsPath(studyId) {
-  return join36(getStudyDir(studyId), "jira-receipts.jsonl");
+  return join37(getStudyDir(studyId), "jira-receipts.jsonl");
 }
 function assertCurrentJiraManifest(study, value) {
   if (study.status !== "jira-manifested" || !study.jira) {
@@ -10771,7 +10906,7 @@ function positionalSource(value) {
   const resolved = resolvePath12(value);
   let stat;
   try {
-    stat = lstatSync6(resolved);
+    stat = lstatSync7(resolved);
   } catch (error) {
     throw new UserError(`unable to read source ${resolved}: ${error.message}`);
   }
@@ -10787,10 +10922,10 @@ function collectSourceInputs(sourceArgs, options) {
   return inputs;
 }
 function contextPath(studyId) {
-  return join37(getStudyDir(studyId), CONTEXT_FILENAME);
+  return join38(getStudyDir(studyId), CONTEXT_FILENAME);
 }
 function inventoryPath(studyId) {
-  return join37(getStudyDir(studyId), INVENTORY_FILENAME);
+  return join38(getStudyDir(studyId), INVENTORY_FILENAME);
 }
 function writeCommandContext(studyId, skillMapPath, skillMapCoverage, inventory) {
   const context = {
@@ -10834,17 +10969,17 @@ function retainedPath(root, relativePath) {
 }
 function retainObservedSources(study, observedFiles) {
   if (observedFiles.length === 0) return study;
-  const root = join37(getStudyDir(study.studyId), "retained-sources");
-  mkdirSync9(root, { recursive: true, mode: 448 });
+  const root = join38(getStudyDir(study.studyId), "retained-sources");
+  mkdirSync10(root, { recursive: true, mode: 448 });
   chmodSync3(root, 448);
   const retainedSourceIds = /* @__PURE__ */ new Set();
   for (const file of observedFiles) {
-    const sourceRoot = join37(root, file.sourceId);
-    mkdirSync9(sourceRoot, { recursive: true, mode: 448 });
+    const sourceRoot = join38(root, file.sourceId);
+    mkdirSync10(sourceRoot, { recursive: true, mode: 448 });
     chmodSync3(sourceRoot, 448);
     const destination = retainedPath(sourceRoot, file.relativePath);
-    mkdirSync9(dirname13(destination), { recursive: true, mode: 448 });
-    writeFileSync8(destination, file.bytes, { flag: "wx", mode: 384 });
+    mkdirSync10(dirname13(destination), { recursive: true, mode: 448 });
+    writeFileSync9(destination, file.bytes, { flag: "wx", mode: 384 });
     chmodSync3(destination, 384);
     retainedSourceIds.add(file.sourceId);
   }
@@ -11077,7 +11212,7 @@ async function insightJira(studyId, options) {
     throw new UserError(`study ${studyId} cannot generate a Jira manifest: ${validation.blockers.map((issue) => issue.message).join("; ")}`);
   }
   if (localMode) {
-    const privatePath2 = join37(getStudyDir(studyId), JIRA_MANIFEST_FILENAME);
+    const privatePath2 = join38(getStudyDir(studyId), JIRA_MANIFEST_FILENAME);
     const manifest2 = assertCurrentJiraManifest(study, parseJsonFile(privatePath2, "stored Jira manifest"));
     const receipt = options.receipt === void 0 ? void 0 : appendJiraReceipt(studyId, manifest2, parseJiraReceiptInput(parseJsonFile(options.receipt, "Jira receipt import")));
     const resume = buildJiraResumeState(manifest2, readJiraReceipts(studyId, manifest2));
@@ -11089,7 +11224,7 @@ async function insightJira(studyId, options) {
     return;
   }
   const manifest = buildJiraManifest(study, projectKey);
-  const privatePath = join37(getStudyDir(studyId), JIRA_MANIFEST_FILENAME);
+  const privatePath = join38(getStudyDir(studyId), JIRA_MANIFEST_FILENAME);
   writeJsonAtomic(privatePath, manifest);
   if (options.out) {
     writeNewFile(resolvePath12(options.out), `${JSON.stringify(manifest, null, 2)}
@@ -11163,8 +11298,8 @@ async function insightClose(studyId, options) {
 import { tmpdir as tmpdir3 } from "os";
 
 // src/refine/activation.ts
-import { lstatSync as lstatSync7, readFileSync as readFileSync28, readdirSync as readdirSync12, realpathSync as realpathSync11 } from "fs";
-import { join as join38 } from "path";
+import { lstatSync as lstatSync8, readFileSync as readFileSync28, readdirSync as readdirSync12, realpathSync as realpathSync11 } from "fs";
+import { join as join39 } from "path";
 
 // src/refine/models.ts
 import { randomBytes } from "crypto";
@@ -11527,8 +11662,8 @@ function activationFiles(baseDir, overrideDir, name) {
   function walk2(dir, prefix = "") {
     for (const entry of readdirSync12(dir).sort()) {
       if (entry === ".git" || entry === "node_modules") continue;
-      const path = join38(dir, entry), relativePath = prefix ? `${prefix}/${entry}` : entry;
-      const stat = lstatSync7(path);
+      const path = join39(dir, entry), relativePath = prefix ? `${prefix}/${entry}` : entry;
+      const stat = lstatSync8(path);
       if (stat.isSymbolicLink()) throw new UserError(`Activation refuses symlinks: ${path}`);
       if (stat.isDirectory()) {
         walk2(path, relativePath);
@@ -11553,8 +11688,8 @@ function activationFiles(baseDir, overrideDir, name) {
   }
   let content = skill.bytes.toString("utf8");
   for (const artifact of artifacts) {
-    const path = join38(overrideDir, artifact);
-    const stat = lstatSync7(path);
+    const path = join39(overrideDir, artifact);
+    const stat = lstatSync8(path);
     if (!stat.isFile() || stat.isSymbolicLink()) throw new UserError("Override artifact must be a regular file, not a symlink.");
     if (stat.size > 2 * 1024 * 1024) throw new UserError("Override artifact exceeds 2 MiB.");
     const text = readFileSync28(path, "utf8");
@@ -11584,32 +11719,32 @@ ${content.slice(frontmatter[0].length)}`;
 }
 
 // src/commands/refine.ts
-import { createHash as createHash8, randomUUID as randomUUID5 } from "crypto";
-import { chmodSync as chmodSync4, existsSync as existsSync31, lstatSync as lstatSync8, mkdirSync as mkdirSync11, mkdtempSync as mkdtempSync4, rmdirSync, readFileSync as readFileSync30, realpathSync as realpathSync14, renameSync as renameSync6, rmSync as rmSync9, writeFileSync as writeFileSync10 } from "fs";
-import { dirname as dirname15, isAbsolute as isAbsolute11, join as join41, relative as relative10, resolve as resolvePath15, sep as sep10 } from "path";
+import { createHash as createHash9, randomUUID as randomUUID6 } from "crypto";
+import { chmodSync as chmodSync4, existsSync as existsSync31, lstatSync as lstatSync9, mkdirSync as mkdirSync12, mkdtempSync as mkdtempSync4, rmdirSync, readFileSync as readFileSync30, realpathSync as realpathSync14, renameSync as renameSync6, rmSync as rmSync9, writeFileSync as writeFileSync11 } from "fs";
+import { dirname as dirname15, isAbsolute as isAbsolute11, join as join42, relative as relative10, resolve as resolvePath15, sep as sep10 } from "path";
 import { createInterface as createInterface7 } from "readline/promises";
 
 // src/refine/context.ts
 import { existsSync as existsSync30, realpathSync as realpathSync13, statSync as statSync14 } from "fs";
-import { isAbsolute as isAbsolute10, join as join40, relative as relative9, resolve as resolvePath14 } from "path";
+import { isAbsolute as isAbsolute10, join as join41, relative as relative9, resolve as resolvePath14 } from "path";
 
 // src/refine/store.ts
-import { createHash as createHash7 } from "crypto";
+import { createHash as createHash8 } from "crypto";
 import { existsSync as existsSync29, readFileSync as readFileSync29, statSync as statSync13, realpathSync as realpathSync12 } from "fs";
-import { join as join39, resolve as resolvePath13 } from "path";
+import { join as join40, resolve as resolvePath13 } from "path";
 var SIMILARITY_JOIN_THRESHOLD = 0.7;
 var READY_THRESHOLD = 2;
 function getRefinementsDir() {
-  return join39(getHomeDir(), "refinements");
+  return join40(getHomeDir(), "refinements");
 }
 function getRefinementsPath() {
-  return join39(getRefinementsDir(), "refinements.json");
+  return join40(getRefinementsDir(), "refinements.json");
 }
 function getPatternsPath() {
-  return join39(getRefinementsDir(), "patterns.json");
+  return join40(getRefinementsDir(), "patterns.json");
 }
 function getBackupsDir() {
-  return join39(getRefinementsDir(), "backups");
+  return join40(getRefinementsDir(), "backups");
 }
 function readJsonFile(path, label2) {
   let raw;
@@ -11854,11 +11989,11 @@ function createBackup(filePaths, deps = {}) {
     }
     const bytes = readFileSync29(path);
     const mode = statSync13(path).mode & 511;
-    const sha2562 = createHash7("sha256").update(bytes).digest("hex");
+    const sha2562 = createHash8("sha256").update(bytes).digest("hex");
     return { path, existed: true, sha256: sha2562, mode, contentBase64: bytes.toString("base64") };
   });
   const manifest = { id, createdAt: now.toISOString(), files };
-  writeJsonAtomic(join39(getBackupsDir(), id, "manifest.json"), manifest);
+  writeJsonAtomic(join40(getBackupsDir(), id, "manifest.json"), manifest);
   return manifest;
 }
 function validateBackupManifestShape(value, path) {
@@ -11907,7 +12042,7 @@ function readBackupManifest(id) {
   if (!isValidBackupId(id)) {
     throw new UserError(`invalid backup id "${id}" \u2014 expected the format produced by \`skill-forge refine promote\` (e.g. 20260720T142305Z-a1b2)`);
   }
-  const manifestPath = join39(getBackupsDir(), id, "manifest.json");
+  const manifestPath = join40(getBackupsDir(), id, "manifest.json");
   if (!existsSync29(manifestPath)) {
     throw new UserError(`no backup with id: ${id}`);
   }
@@ -11942,8 +12077,8 @@ function isUnderRoot2(candidate, root) {
 function resolveScopes(config, cwd, skill, userRootFlag) {
   assertPlainSkillName(skill);
   const resolvedCwd = resolvePath14(cwd);
-  const localDir = join40(resolvedCwd, ".claude", "skills", skill);
-  const sharedDir = join40(resolvedCwd, "skills", skill);
+  const localDir = join41(resolvedCwd, ".claude", "skills", skill);
+  const sharedDir = join41(resolvedCwd, "skills", skill);
   const local = { scope: "local", dir: localDir, exists: existsSync30(localDir) };
   const shared = { scope: "shared", dir: sharedDir, exists: existsSync30(sharedDir) };
   const user = resolveUserScope(config, resolvedCwd, skill, userRootFlag);
@@ -11952,10 +12087,10 @@ function resolveScopes(config, cwd, skill, userRootFlag) {
 function resolveUserScope(config, resolvedCwd, skill, userRootFlag) {
   if (userRootFlag) {
     const root = resolvePath14(userRootFlag);
-    return { resolved: true, dir: join40(root, skill), root: userRootFlag, reason: "flag" };
+    return { resolved: true, dir: join41(root, skill), root: userRootFlag, reason: "flag" };
   }
   const cwdReal = realpathOrNull2(resolvedCwd) ?? resolvedCwd;
-  const candidates = config.skillsRoots.map((root) => ({ root, dir: join40(resolveConfiguredRoot2(root), skill) }));
+  const candidates = config.skillsRoots.map((root) => ({ root, dir: join41(resolveConfiguredRoot2(root), skill) }));
   for (const candidate of candidates) {
     const skillReal = realpathOrNull2(candidate.dir);
     if (skillReal) {
@@ -11990,12 +12125,12 @@ function inventoryScopeDir(scope2, dir) {
     scope: scope2,
     dir,
     dirExists: isDirectory(dir),
-    skillMd: isFile2(join40(dir, "SKILL.md")),
-    patchMd: isFile2(join40(dir, "SKILL.patch.md")),
-    extendMd: isFile2(join40(dir, "SKILL.extend.md")),
-    configJson: isFile2(join40(dir, "skill-config.json")),
-    hooksDir: isDirectory(join40(dir, "hooks")),
-    scriptsDir: isDirectory(join40(dir, "scripts"))
+    skillMd: isFile2(join41(dir, "SKILL.md")),
+    patchMd: isFile2(join41(dir, "SKILL.patch.md")),
+    extendMd: isFile2(join41(dir, "SKILL.extend.md")),
+    configJson: isFile2(join41(dir, "skill-config.json")),
+    hooksDir: isDirectory(join41(dir, "hooks")),
+    scriptsDir: isDirectory(join41(dir, "scripts"))
   };
 }
 function inventoryAllScopes(resolution) {
@@ -12181,14 +12316,14 @@ ${rendered}` : rendered;
 function ensureScopeDirSafe(scopeDir, resolvedCwd) {
   let lst;
   try {
-    lst = lstatSync8(scopeDir);
+    lst = lstatSync9(scopeDir);
   } catch {
     lst = void 0;
   }
   if (lst?.isSymbolicLink()) {
     throw new UserError(`refusing to write under ${scopeDir}: scope directory is a symlink`);
   }
-  mkdirSync11(scopeDir, { recursive: true });
+  mkdirSync12(scopeDir, { recursive: true });
   const real = resolveConfiguredRoot3(scopeDir);
   const lexical = resolvePath15(scopeDir);
   let realResolved;
@@ -12207,23 +12342,23 @@ function ensureScopeDirSafe(scopeDir, resolvedCwd) {
 }
 function writeOverrideFile(scopeDir, relPath, content, resolvedCwd) {
   const realScopeDir = ensureScopeDirSafe(scopeDir, resolvedCwd);
-  const destPath = join41(scopeDir, relPath);
+  const destPath = join42(scopeDir, relPath);
   const destDir = dirname15(destPath);
-  mkdirSync11(destDir, { recursive: true });
+  mkdirSync12(destDir, { recursive: true });
   const realDestDir = realpathSync14(destDir);
   if (!isUnderRoot3(realDestDir, realScopeDir)) {
     throw new UserError(`refusing to write ${destPath}: resolves outside scope directory ${scopeDir}`);
   }
   let destLst;
   try {
-    destLst = lstatSync8(destPath);
+    destLst = lstatSync9(destPath);
   } catch {
     destLst = void 0;
   }
   if (destLst?.isSymbolicLink()) {
     throw new UserError(`refusing to write ${destPath}: destination is a symlink`);
   }
-  writeFileSync10(destPath, content, { mode: 384 });
+  writeFileSync11(destPath, content, { mode: 384 });
   chmodSync4(destPath, 384);
   return destPath;
 }
@@ -12303,11 +12438,11 @@ Write ${preview.destPath}? [y/N] `);
 }
 function renderCaptureArtifactPreview(opts, content, refinementId, generatedAt, scopeDir) {
   const probeRelPath = opts.overrideType === "patch" ? "SKILL.patch.md" : opts.overrideType === "extend" || opts.overrideType === "new" ? "SKILL.extend.md" : void 0;
-  const probePath = probeRelPath ? join41(scopeDir, probeRelPath) : void 0;
+  const probePath = probeRelPath ? join42(scopeDir, probeRelPath) : void 0;
   const existingContent = probePath && existsSync31(probePath) ? readFileSync30(probePath, "utf-8") : "";
   const rendered = renderCaptureArtifact(opts, content, refinementId, generatedAt, existingContent);
   const relPath = rendered.relPath;
-  const destPath = join41(scopeDir, relPath);
+  const destPath = join42(scopeDir, relPath);
   const before = existsSync31(destPath) ? readFileSync30(destPath, "utf-8") : "";
   const diff = previewDiff(before, rendered.content, destPath);
   return { relPath, content: rendered.content, destPath, diff };
@@ -12323,8 +12458,8 @@ async function refineActivateCommand(options) {
   const scopes = resolveScopes(loadConfig(), cwd, options.skill);
   const overrideDir = options.scope === "shared" ? scopes.shared.dir : scopes.local.dir;
   if (realpathSync14(overrideDir) !== overrideDir) throw new UserError("Activation refuses a symlinked override directory.");
-  const hostRoot = join41(cwd, PROJECT_SKILL_ROOTS[options.host]);
-  const destination = join41(hostRoot, options.as);
+  const hostRoot = join42(cwd, PROJECT_SKILL_ROOTS[options.host]);
+  const destination = join42(hostRoot, options.as);
   if (existsSync31(destination) || resolveTargetRealPath(destination) !== destination) throw new UserError("Activation destination already exists or contains a symlink; choose a new --as name.");
   const files = activationFiles(options.base, overrideDir, options.as);
   const receiptName = ".skill-forge-activation.json";
@@ -12335,7 +12470,7 @@ async function refineActivateCommand(options) {
     skill: options.as,
     capture: options.skill,
     source: realpathSync14(options.base),
-    sourceSha256: createHash8("sha256").update(readFileSync30(join41(options.base, "SKILL.md"))).digest("hex"),
+    sourceSha256: createHash9("sha256").update(readFileSync30(join42(options.base, "SKILL.md"))).digest("hex"),
     generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
     runtimeVerified: false
   };
@@ -12343,15 +12478,15 @@ async function refineActivateCommand(options) {
   if (files.length > 1e3 || files.some((f) => f.bytes.length > 2 * 1024 * 1024) || files.reduce((n, f) => n + f.bytes.length, 0) > 16 * 1024 * 1024) {
     throw new UserError("Composed activation exceeds file or total size limits.");
   }
-  const stage = mkdtempSync4(join41(tmpdir3(), "skill-forge-activate-"));
+  const stage = mkdtempSync4(join42(tmpdir3(), "skill-forge-activate-"));
   try {
     for (const file of files) {
-      const path = join41(stage, file.relativePath);
-      mkdirSync11(dirname15(path), { recursive: true });
-      writeFileSync10(path, file.bytes, { mode: file.mode });
+      const path = join42(stage, file.relativePath);
+      mkdirSync12(dirname15(path), { recursive: true });
+      writeFileSync11(path, file.bytes, { mode: file.mode });
     }
-    const safety = await scanSafety(stage, "block-high", files.map((f) => ({ file: join41(stage, f.relativePath), content: f.bytes.toString("utf8") })));
-    safety.findings = safety.findings.map((f) => ({ ...f, file: join41(destination, relative10(stage, f.file)) }));
+    const safety = await scanSafety(stage, "block-high", files.map((f) => ({ file: join42(stage, f.relativePath), content: f.bytes.toString("utf8") })));
+    safety.findings = safety.findings.map((f) => ({ ...f, file: join42(destination, relative10(stage, f.file)) }));
     const preview = {
       destination,
       provenance,
@@ -12360,7 +12495,7 @@ async function refineActivateCommand(options) {
       source: realpathSync14(options.base),
       files: files.map((f) => f.relativePath),
       safety,
-      diff: previewDiff(readFileSync30(join41(options.base, "SKILL.md"), "utf8"), files.find((f) => f.relativePath === "SKILL.md").bytes.toString("utf8"), join41(destination, "SKILL.md"))
+      diff: previewDiff(readFileSync30(join42(options.base, "SKILL.md"), "utf8"), files.find((f) => f.relativePath === "SKILL.md").bytes.toString("utf8"), join42(destination, "SKILL.md"))
     };
     if (options.dryRun) {
       emit2(options.json, { ...preview, dryRun: true, activated: false }, () => console.log(JSON.stringify(preview, null, 2)));
@@ -12374,15 +12509,15 @@ async function refineActivateCommand(options) {
     }
     if (resolveTargetRealPath(destination) !== destination) throw new UserError("Activation destination became symlinked.");
     ensureScopeDirSafe(hostRoot, cwd);
-    mkdirSync11(destination);
-    const backup = createBackup(files.map((f) => join41(destination, f.relativePath)));
-    const hashes = files.map((f) => ({ path: join41(destination, f.relativePath), sha256: createHash8("sha256").update(f.bytes).digest("hex") }));
+    mkdirSync12(destination);
+    const backup = createBackup(files.map((f) => join42(destination, f.relativePath)));
+    const hashes = files.map((f) => ({ path: join42(destination, f.relativePath), sha256: createHash9("sha256").update(f.bytes).digest("hex") }));
     writePostWriteSidecar(backup.id, hashes);
     const projectConfig = { ...loadConfig(), skillsRoots: [hostRoot] };
     try {
-      for (const file of files) safeRestoreWrite(join41(destination, file.relativePath), file.bytes, file.mode, projectConfig);
+      for (const file of files) safeRestoreWrite(join42(destination, file.relativePath), file.bytes, file.mode, projectConfig);
       for (const file of hashes) {
-        if (createHash8("sha256").update(readFileSync30(file.path)).digest("hex") !== file.sha256) throw new UserError("Activation read-back hash mismatch.");
+        if (createHash9("sha256").update(readFileSync30(file.path)).digest("hex") !== file.sha256) throw new UserError("Activation read-back hash mismatch.");
       }
     } catch (error) {
       throw new UserError(`Activation write failed; backup ${backup.id} records recovery paths. Inspect before using rollback --project --force: ${error.message}`);
@@ -12392,7 +12527,7 @@ async function refineActivateCommand(options) {
       activated: true,
       backupId: backup.id,
       runtimeVerified: false,
-      verification: `Open a fresh ${options.host} task in this project, invoke ${preview.invocation}, and verify it reads ${join41(destination, "SKILL.md")}.`,
+      verification: `Open a fresh ${options.host} task in this project, invoke ${preview.invocation}, and verify it reads ${join42(destination, "SKILL.md")}.`,
       rollback: `skill-forge refine rollback ${backup.id} --project --yes`
     }, () => {
       console.log(`Activated ${destination}. Invoke ${preview.invocation} in a fresh ${options.host} task and verify the loaded file; runtime use is not yet observed.`);
@@ -12495,12 +12630,12 @@ async function refineWhichCommand(skill, options = {}) {
 }
 function writePostWriteSidecar(backupId, files) {
   const sidecar = { schemaVersion: 1, files };
-  const dir = join41(getBackupsDir(), backupId);
-  mkdirSync11(dir, { recursive: true });
-  writeFileSync10(join41(dir, "post.json"), JSON.stringify(sidecar, null, 2) + "\n", { mode: 384 });
+  const dir = join42(getBackupsDir(), backupId);
+  mkdirSync12(dir, { recursive: true });
+  writeFileSync11(join42(dir, "post.json"), JSON.stringify(sidecar, null, 2) + "\n", { mode: 384 });
 }
 function readPostWriteSidecar(backupId) {
-  const path = join41(getBackupsDir(), backupId, "post.json");
+  const path = join42(getBackupsDir(), backupId, "post.json");
   if (!existsSync31(path)) return { hashes: /* @__PURE__ */ new Map(), status: "missing" };
   let raw;
   try {
@@ -12562,7 +12697,7 @@ async function refinePromoteCommand(patternId, options = {}) {
   if (!isUnderRoot3(realSkillDir, realUserRoot)) {
     throw new UserError(`refusing to promote: resolved skill directory ${skillDir} is outside the configured user scope root ${scopes.user.root}`);
   }
-  const skillMdPath = join41(skillDir, "SKILL.md");
+  const skillMdPath = join42(skillDir, "SKILL.md");
   if (!existsSync31(skillMdPath)) {
     throw new UserError(`user-scope SKILL.md not found at ${skillMdPath} \u2014 refusing to promote against a missing base skill.`);
   }
@@ -12603,16 +12738,16 @@ Promote pattern ${patternId} into ${skillMdPath}? [y/N] `);
     return;
   }
   const backup = createBackup([skillMdPath]);
-  const tempPath = `${skillMdPath}.tmp-${randomUUID5()}`;
+  const tempPath = `${skillMdPath}.tmp-${randomUUID6()}`;
   try {
-    writeFileSync10(tempPath, after, "utf-8");
+    writeFileSync11(tempPath, after, "utf-8");
     renameSync6(tempPath, skillMdPath);
   } catch (err) {
     rmSync9(tempPath, { force: true });
     throw err;
   }
   try {
-    const postSha256 = createHash8("sha256").update(readFileSync30(skillMdPath)).digest("hex");
+    const postSha256 = createHash9("sha256").update(readFileSync30(skillMdPath)).digest("hex");
     writePostWriteSidecar(backup.id, [{ path: skillMdPath, sha256: postSha256 }]);
     markGeneralized(patternId, backup.id);
     const skillsRoot = resolveConfiguredRoot3(scopes.user.root);
@@ -12640,7 +12775,7 @@ function assertBackupDirContained(backupId) {
   const backupsDir = getBackupsDir();
   if (!existsSync31(backupsDir)) return;
   const realBackupsDir = realpathSync14(backupsDir);
-  const backupDir = join41(backupsDir, backupId);
+  const backupDir = join42(backupsDir, backupId);
   if (!existsSync31(backupDir)) return;
   const realBackupDir = realpathSync14(backupDir);
   if (!isUnderRoot3(realBackupDir, realBackupsDir)) {
@@ -12653,7 +12788,7 @@ function resolveTargetRealPath(path) {
     try {
       const real = realpathSync14(lexicalAncestor);
       const remainder = relative10(lexicalAncestor, resolvePath15(path));
-      return remainder === "" ? real : join41(real, remainder);
+      return remainder === "" ? real : join42(real, remainder);
     } catch {
       const parent = dirname15(lexicalAncestor);
       if (parent === lexicalAncestor) return resolvePath15(path);
@@ -12685,7 +12820,7 @@ function assertNoSymlinkLeaves(manifest) {
   for (const file of manifest.files) {
     let lst;
     try {
-      lst = lstatSync8(file.path);
+      lst = lstatSync9(file.path);
     } catch {
       lst = void 0;
     }
@@ -12722,10 +12857,10 @@ function walkRealComponents(filePath, config, createMissing) {
   let current = rootReal;
   for (const component of dirComponents) {
     if (current === void 0) break;
-    const next = join41(current, component);
+    const next = join42(current, component);
     let lst;
     try {
-      lst = lstatSync8(next);
+      lst = lstatSync9(next);
     } catch {
       lst = void 0;
     }
@@ -12734,7 +12869,7 @@ function walkRealComponents(filePath, config, createMissing) {
         current = void 0;
         continue;
       }
-      mkdirSync11(next);
+      mkdirSync12(next);
       current = next;
       continue;
     }
@@ -12753,22 +12888,22 @@ function safeRestoreWrite(filePath, contentBuffer, mode, config) {
   if (parentReal === void 0) {
     throw new UserError(`refusing to restore ${filePath}: could not establish a real parent directory`);
   }
-  const finalPath = join41(parentReal, leafComponent);
+  const finalPath = join42(parentReal, leafComponent);
   if (!isUnderRoot3(finalPath, rootReal)) {
     throw new UserError(`refusing to restore ${filePath}: resolves outside root ${rootReal}`);
   }
   let leafLst;
   try {
-    leafLst = lstatSync8(finalPath);
+    leafLst = lstatSync9(finalPath);
   } catch {
     leafLst = void 0;
   }
   if (leafLst?.isSymbolicLink()) {
     throw new UserError(`refusing to restore ${filePath}: it is now a symlink \u2014 refusing to follow or overwrite it.`);
   }
-  const tempPath = `${finalPath}.tmp-${randomUUID5()}`;
+  const tempPath = `${finalPath}.tmp-${randomUUID6()}`;
   try {
-    writeFileSync10(tempPath, contentBuffer);
+    writeFileSync11(tempPath, contentBuffer);
     chmodSync4(tempPath, mode);
     renameSync6(tempPath, finalPath);
   } catch (err) {
@@ -12779,13 +12914,13 @@ function safeRestoreWrite(filePath, contentBuffer, mode, config) {
 function safeDeleteTombstone(filePath, config) {
   const { parentReal, leafComponent, rootReal } = walkRealComponents(filePath, config, false);
   if (parentReal === void 0) return;
-  const finalPath = join41(parentReal, leafComponent);
+  const finalPath = join42(parentReal, leafComponent);
   if (!isUnderRoot3(finalPath, rootReal)) {
     throw new UserError(`refusing to delete ${filePath}: resolves outside root ${rootReal}`);
   }
   let leafLst;
   try {
-    leafLst = lstatSync8(finalPath);
+    leafLst = lstatSync9(finalPath);
   } catch {
     leafLst = void 0;
   }
@@ -12804,7 +12939,7 @@ async function refineRollbackCommand(backupId, options = {}) {
   assertBackupDirContained(backupId);
   const manifest = readBackupManifest(backupId);
   const config = loadConfig();
-  if (options.project) config.skillsRoots = Object.values(PROJECT_SKILL_ROOTS).map((p) => join41(realpathSync14(process.cwd()), p));
+  if (options.project) config.skillsRoots = Object.values(PROJECT_SKILL_ROOTS).map((p) => join42(realpathSync14(process.cwd()), p));
   const assertProjectRoots = () => {
     if (options.project && config.skillsRoots.some((root) => resolveTargetRealPath(root) !== root)) {
       throw new UserError("refusing project rollback: a project skill root or its ancestor is symlinked.");
@@ -12831,7 +12966,7 @@ async function refineRollbackCommand(backupId, options = {}) {
   for (const file of manifest.files) {
     const expected = sidecar.hashes.get(file.path);
     if (expected === void 0) continue;
-    const currentSha256 = existsSync31(file.path) ? createHash8("sha256").update(readFileSync30(file.path)).digest("hex") : null;
+    const currentSha256 = existsSync31(file.path) ? createHash9("sha256").update(readFileSync30(file.path)).digest("hex") : null;
     if (currentSha256 !== expected) mismatches.push(file.path);
   }
   if (mismatches.length > 0 && !options.force) {
@@ -12989,7 +13124,7 @@ configCmd.command("propose <key> <value>").description("Queue a preference for r
 configCmd.command("review").description("Review pending agent-proposed preferences one at a time").option("--accept-all", "accept every pending proposal without prompting").option("--reject-all", "reject every pending proposal without prompting").action(configReview);
 program.command("guide [topic]").description("What this tool does, what state you are in, and the next command to run").action(guide);
 program.command("evolve <target-skill-dir>").description("Self-evolve a skill via SkillOpt-Sleep, re-gate the proposal, then promote/hold/reject (Pro)").option("--project <dir>", "project dir passed to SkillOpt-Sleep as --project (defaults to cwd)").option("--dry-run", "SkillOpt-Sleep dry-run: report only, nothing staged").option("--backend <name>", "SkillOpt-Sleep backend (default: mock, offline \u2014 a real backend requires --yes or interactive confirmation)").option("--lookback-hours <n>", "hours of session history for SkillOpt-Sleep to harvest", parseLookbackHours).option("-y, --yes", "skip interactive prompts; honor the re-gate verdict automatically").option("--json", "print the re-gate result as JSON instead of the terminal report").option("--force", "allow re-adopting a staging dir whose proposed content already matches the live skill").action(evolveCommand);
-program.command("audit").option("--compare <file>", "compare with a prior full audit JSON; preserve all current findings").alias("doctor").description("Doctor-style health check over the configured skill/MCP set: inventory, hygiene findings, and consolidation/refinement opportunities").option("--json", "print the audit report as JSON instead of the terminal summary (non-interactive: skips the business-profile prompt)").option("-y, --yes", "skip interactive prompts (business profile, foundation, handoff); never implies --foundation or --handoff").option("--report <file>", "write the report to this path instead of the default ~/.skill-forge/reports/audit-<timestamp>.md (refuses an existing path)").option("--foundation", "authorizes exactly one skills-root write: scaffold a business-foundation skill from the captured business profile").option("--handoff", "authorizes launching the configured agent with the bundled curation prompt against the written report").option("--plugin-inventory <file>", "import a static host inventory JSON; audit one host at a time").option("--claude-plugins", "include enabled Claude Code plugins' declared skills in this audit (default: config.claudePlugins, else off)").option("--no-claude-plugins", "exclude enabled Claude Code plugins from this audit even when config.claudePlugins is on").option("--usage-snapshot <file>", "join per-skill usage counts from a skill-monitor snapshot JSON file or a directory of them (default: config.usageSnapshotPath)").option("--usage-window <days>", "restrict directory-input usage-snapshot selection to a snapshot with this window_days (integer)", parseUsageWindow).action(auditCommand);
+program.command("audit").option("--compare <file>", "compare with a prior full audit JSON; preserve all current findings").alias("doctor").description("Doctor-style health check over the configured skill/MCP set: inventory, hygiene findings, and consolidation/refinement opportunities").option("--json", "print the audit report as JSON instead of the terminal summary (non-interactive: skips the business-profile prompt)").option("--laya-shadow", "score current finding metadata with local Laya in shadow; never changes a gate").option("--laya-base-url <url>", "loopback Laya endpoint for --laya-shadow (default http://127.0.0.1:8000)").option("-y, --yes", "skip interactive prompts (business profile, foundation, handoff); never implies --foundation or --handoff").option("--report <file>", "write the report to this path instead of the default ~/.skill-forge/reports/audit-<timestamp>.md (refuses an existing path)").option("--foundation", "authorizes exactly one skills-root write: scaffold a business-foundation skill from the captured business profile").option("--handoff", "authorizes launching the configured agent with the bundled curation prompt against the written report").option("--plugin-inventory <file>", "import a static host inventory JSON; audit one host at a time").option("--claude-plugins", "include enabled Claude Code plugins' declared skills in this audit (default: config.claudePlugins, else off)").option("--no-claude-plugins", "exclude enabled Claude Code plugins from this audit even when config.claudePlugins is on").option("--usage-snapshot <file>", "join per-skill usage counts from a skill-monitor snapshot JSON file or a directory of them (default: config.usageSnapshotPath)").option("--usage-window <days>", "restrict directory-input usage-snapshot selection to a snapshot with this window_days (integer)", parseUsageWindow).action(auditCommand);
 var finding = program.command("finding").description("Review and acknowledge audit findings \u2014 human-only, never a gate input (see docs/accepted-findings-schema.md)");
 finding.command("accept <fingerprint-prefix>").description("Accept a currently-active LOW/MEDIUM finding (no override for HIGH/CRITICAL); re-runs the audit engine to resolve it").requiredOption("--reason <text>", "why this finding is accepted (mandatory, 1-200 chars, no control characters)").option("--json", "print the accepted record as JSON").action(findingAcceptCommand);
 finding.command("revoke <fingerprint-prefix>").description("Remove a stored acceptance so the finding reports again").option("--json", "print the removed record as JSON").action(findingRevokeCommand);