@rhize/skill-forge 0.7.1 → 0.8.0

package/dist/cli.js

@@ -5,7 +5,7 @@ import { Command } from "commander";
 import { createRequire } from "module";
 
 // src/commands/add.ts
-import { join as join16 } from "path";
+import { join as join18 } from "path";
 
 // src/config.ts
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
@@ -18,6 +18,16 @@ function getHomeDir() {
 function getConfigPath() {
   return join(getHomeDir(), "config.json");
 }
+function normalizeBusinessProfile(raw) {
+  if (!raw || typeof raw !== "object") return void 0;
+  const toStringArray = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string") : [];
+  return {
+    ...raw,
+    audiences: toStringArray(raw.audiences),
+    workflows: toStringArray(raw.workflows),
+    constraints: toStringArray(raw.constraints)
+  };
+}
 function defaultConfig() {
   const home = getHomeDir();
   return {
@@ -42,7 +52,9 @@ function loadConfig() {
     defaultTarget: parsed.defaultTarget ?? defaults.defaultTarget,
     agents: parsed.agents ?? defaults.agents,
     handoffCommand: parsed.handoffCommand ?? defaults.handoffCommand,
-    mcpTargets: parsed.mcpTargets ?? defaults.mcpTargets
+    mcpTargets: parsed.mcpTargets ?? defaults.mcpTargets,
+    businessProfile: normalizeBusinessProfile(parsed.businessProfile) ?? defaults.businessProfile,
+    foundationSkillPath: parsed.foundationSkillPath ?? defaults.foundationSkillPath
   };
 }
 function saveConfig(config) {
@@ -1308,6 +1320,7 @@ your you it its as at by from into via per also any all not no than then so if u
 skill skills user claude code based comprehensive enhanced practical including include includes
 `.split(/\s+/).filter(Boolean)
 );
+var DEFAULT_SET_THRESHOLD = 0.45;
 function splitLimited(text, sep2, maxSplit) {
   const parts = [];
   let rest = text;
@@ -1474,6 +1487,26 @@ function scanOverlap(candidatePath, skillsRoot) {
     ranking
   };
 }
+function scanOverlapPaths(skillMdPaths, threshold = DEFAULT_SET_THRESHOLD) {
+  const metas = skillMdPaths.map(readFrontmatter);
+  const pairs = [];
+  for (let i = 0; i < metas.length; i++) {
+    for (let j = i + 1; j < metas.length; j++) {
+      const sc = Math.max(score(metas[i], metas[j]), score(metas[j], metas[i]));
+      if (sc >= threshold) {
+        pairs.push({
+          a: metas[i].name,
+          b: metas[j].name,
+          aPath: skillMdPaths[i],
+          bPath: skillMdPaths[j],
+          score: round3(sc)
+        });
+      }
+    }
+  }
+  pairs.sort((a, b) => b.score - a.score);
+  return pairs;
+}
 
 // src/gate/mcpSafety.ts
 import { statSync as statSync6 } from "fs";
@@ -2032,11 +2065,11 @@ import { dirname as dirname5, join as join14 } from "path";
 import { fileURLToPath } from "url";
 var KNOWN_AGENT_BINARIES = ["claude", "codex", "cursor-agent", "windsurf", "opencode", "gemini"];
 var HANDOFF_INSTRUCTION = "Read {prompt} and follow its instructions for the skill installed at {path}";
-function resolvePromptPath() {
+function resolvePromptPath(assetName = "ingest-prompt.md") {
   const here = dirname5(fileURLToPath(import.meta.url));
-  const builtCandidate = join14(here, "ingest-prompt.md");
+  const builtCandidate = join14(here, assetName);
   if (existsSync12(builtCandidate)) return builtCandidate;
-  return join14(here, "..", "assets", "ingest-prompt.md");
+  return join14(here, "..", "assets", assetName);
 }
 function defaultIsOnPath(bin) {
   const finder = process.platform === "win32" ? "where" : "which";
@@ -2048,7 +2081,7 @@ function substitute(template, vars) {
 }
 function buildHandoffCommand(config, installedPath, deps = {}) {
   const isOnPath = deps.isOnPath ?? defaultIsOnPath;
-  const promptPath = resolvePromptPath();
+  const promptPath = resolvePromptPath(deps.promptAsset);
   const vars = { path: installedPath, prompt: promptPath };
   if (config.handoffCommand && config.handoffCommand.length > 0) {
     return { argv: substitute(config.handoffCommand, vars), source: "template" };
@@ -2060,8 +2093,8 @@ function buildHandoffCommand(config, installedPath, deps = {}) {
   }
   return { argv: [], source: "none" };
 }
-function printOnlyMessage(installedPath) {
-  const promptPath = resolvePromptPath();
+function printOnlyMessage(installedPath, promptAsset) {
+  const promptPath = resolvePromptPath(promptAsset);
   return `[skill-forge] no agent handoff available \u2014 run one yourself:
   Prompt:      ${promptPath}
   Skill path:  ${installedPath}`;
@@ -2069,18 +2102,19 @@ function printOnlyMessage(installedPath) {
 function runHandoff(config, installedPath, options = {}) {
   const command = buildHandoffCommand(config, installedPath, options);
   const spawn2 = options.spawn ?? spawnSync;
+  const log = options.log ?? console.log;
   if (command.source === "none" || command.argv.length === 0) {
-    const printed = printOnlyMessage(installedPath);
-    console.log(printed);
+    const printed = printOnlyMessage(installedPath, options.promptAsset);
+    log(printed);
     return { ran: false, command, printed };
   }
   const [bin, ...args] = command.argv;
   const result = spawn2(bin, args, { stdio: options.stdio ?? "inherit" });
   const error = result.error;
   if (error?.code === "ENOENT") {
-    const printed = printOnlyMessage(installedPath);
-    console.log(`[skill-forge] ${bin} not found on PATH \u2014 run this yourself:`);
-    console.log(printed);
+    const printed = printOnlyMessage(installedPath, options.promptAsset);
+    log(`[skill-forge] ${bin} not found on PATH \u2014 run this yourself:`);
+    log(printed);
     return { ran: false, command, printed, error: error.message };
   }
   if (error) {
@@ -2091,9 +2125,9 @@ function runHandoff(config, installedPath, options = {}) {
 }
 
 // src/commands/init.ts
-import { existsSync as existsSync13 } from "fs";
+import { existsSync as existsSync15 } from "fs";
 import { homedir as homedir4 } from "os";
-import { createInterface } from "readline/promises";
+import { createInterface as createInterface3 } from "readline/promises";
 
 // src/agents.ts
 import { statSync as statSync7 } from "fs";
@@ -2332,6 +2366,845 @@ var AGENTS = [
   { id: "adal", displayName: "AdaL", projectRoot: ".adal/skills", globalRoot: "~/.adal/skills" }
 ].map(makeAgent);
 
+// src/commands/audit.ts
+import { existsSync as existsSync14, mkdirSync as mkdirSync6, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname6, join as join17, resolve as resolvePath3 } from "path";
+import { createInterface as createInterface2 } from "readline/promises";
+
+// src/audit.ts
+import {
+  existsSync as existsSync13,
+  lstatSync,
+  mkdtempSync as mkdtempSync2,
+  readFileSync as readFileSync10,
+  readdirSync as readdirSync6,
+  realpathSync,
+  renameSync as renameSync2,
+  rmSync as rmSync3,
+  statSync as statSync8,
+  writeFileSync as writeFileSync5
+} from "fs";
+import { basename as basename6, extname as extname5, join as join16, resolve as resolvePath2 } from "path";
+var OVERSIZED_SKILL_EST_TOKENS = 5e3;
+function toAuditFindings(source) {
+  return source.map((f) => ({ severity: f.severity, rule: f.rule, target: f.file, detail: f.detail }));
+}
+function resolveConfiguredRoot(root) {
+  return resolvePath2(expandHome(root));
+}
+function safeStat(p) {
+  try {
+    return statSync8(p);
+  } catch {
+    return void 0;
+  }
+}
+function isDirFollowingSymlink(p) {
+  return safeStat(p)?.isDirectory() ?? false;
+}
+function listSubdirsFollowingSymlinks(dir) {
+  let entries;
+  try {
+    entries = readdirSync6(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const entry of entries) {
+    const full = join16(dir, entry.name);
+    if (entry.isDirectory() || entry.isSymbolicLink() && isDirFollowingSymlink(full)) {
+      out.push(full);
+    }
+  }
+  return out;
+}
+function listSubdirsNoSymlinks(dir) {
+  let entries;
+  try {
+    entries = readdirSync6(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  return entries.filter((e) => e.isDirectory()).map((e) => join16(dir, e.name));
+}
+function findSkillDirsUnderRoot(root) {
+  const found = /* @__PURE__ */ new Set();
+  const rootSubdirs = listSubdirsFollowingSymlinks(root);
+  for (const dir of rootSubdirs) {
+    if (existsSync13(join16(dir, "SKILL.md"))) found.add(dir);
+  }
+  for (const dir of listSubdirsFollowingSymlinks(join16(root, "skills"))) {
+    if (existsSync13(join16(dir, "SKILL.md"))) found.add(dir);
+  }
+  for (const topDir of rootSubdirs) {
+    for (const dir of listSubdirsNoSymlinks(join16(topDir, "skills"))) {
+      if (existsSync13(join16(dir, "SKILL.md"))) found.add(dir);
+    }
+  }
+  return Array.from(found).filter((p) => !p.includes("/.git/"));
+}
+function collectSkillCandidates(roots) {
+  const candidates = [];
+  const rootMeta = /* @__PURE__ */ new Map();
+  for (const root of roots) {
+    const resolvedRoot = resolveConfiguredRoot(root);
+    const exists = isDir(resolvedRoot);
+    let realPath;
+    if (exists) {
+      try {
+        realPath = realpathSync(resolvedRoot);
+      } catch {
+        realPath = void 0;
+      }
+    }
+    rootMeta.set(root, { exists, realPath });
+    if (!exists) continue;
+    for (const dir of findSkillDirsUnderRoot(resolvedRoot)) {
+      candidates.push({ configuredPath: dir, root });
+    }
+  }
+  return { candidates, rootMeta };
+}
+function dedupeSkillCandidates(candidates, findings) {
+  const byRealPath = /* @__PURE__ */ new Map();
+  const order = [];
+  for (const candidate of candidates) {
+    let realPath;
+    try {
+      realPath = realpathSync(candidate.configuredPath);
+    } catch (err) {
+      findings.push({
+        severity: "MEDIUM",
+        rule: "unreadable-skill",
+        target: candidate.configuredPath,
+        detail: `could not resolve skill directory (broken symlink or cycle): ${err.message}`
+      });
+      continue;
+    }
+    const existing = byRealPath.get(realPath);
+    if (existing) {
+      if (existing.canonicalPath !== candidate.configuredPath && !existing.aliasPaths.includes(candidate.configuredPath)) {
+        existing.aliasPaths.push(candidate.configuredPath);
+      }
+      continue;
+    }
+    byRealPath.set(realPath, { realPath, canonicalPath: candidate.configuredPath, root: candidate.root, aliasPaths: [] });
+    order.push(realPath);
+  }
+  return order.map((realPath) => byRealPath.get(realPath));
+}
+function parseStrictFrontmatter(text) {
+  if (!text.startsWith("---\n")) {
+    return { valid: false, errors: ['missing frontmatter fence (SKILL.md must start with "---")'] };
+  }
+  const afterOpen = text.slice(4);
+  const closeIdx = afterOpen.indexOf("\n---");
+  if (closeIdx === -1) {
+    return { valid: false, errors: ['unclosed frontmatter fence (no closing "---" found)'] };
+  }
+  const block = afterOpen.slice(0, closeIdx);
+  const errors = [];
+  const nameMatch = block.match(/^name:\s*(.+)$/m);
+  const name = nameMatch ? stripQuotes(nameMatch[1].trim()) : void 0;
+  if (!name) errors.push('missing required "name" field in frontmatter');
+  const descMatch = block.match(/^description:\s*(.*)$/m);
+  let description;
+  if (descMatch) {
+    const first = descMatch[1].trim();
+    if ([">", ">-", "|", "|-", ""].includes(first)) {
+      const lines = block.split(/\r\n|\r|\n/);
+      const idx = lines.findIndex((l) => /^description:/.test(l));
+      const buf = [];
+      if (idx !== -1) {
+        for (const l of lines.slice(idx + 1)) {
+          if (/^\s+\S/.test(l)) buf.push(l.trim());
+          else if (l.trim() === "") continue;
+          else break;
+        }
+      }
+      description = buf.join(" ").trim() || void 0;
+    } else {
+      description = stripQuotes(first);
+    }
+  }
+  if (!description) errors.push('missing required "description" field in frontmatter');
+  return { valid: errors.length === 0, name, description, errors };
+}
+function estimateTokens(text) {
+  return Math.ceil(Buffer.byteLength(text, "utf-8") / 4);
+}
+function profileAuditedSkill(group, findings, unreadableSkillMdPaths) {
+  const skillMdPath = join16(group.canonicalPath, "SKILL.md");
+  const base = {
+    path: group.canonicalPath,
+    skillMdPath,
+    root: group.root,
+    aliasPaths: group.aliasPaths
+  };
+  let text;
+  let sizeBytes;
+  try {
+    sizeBytes = statSync8(skillMdPath).size;
+    text = readFileSync10(skillMdPath, "utf-8");
+  } catch (err) {
+    findings.push({
+      severity: "MEDIUM",
+      rule: "unreadable-skill",
+      target: skillMdPath,
+      detail: `could not read SKILL.md: ${err.message}`
+    });
+    unreadableSkillMdPaths.add(skillMdPath);
+    return { ...base, name: basename6(group.canonicalPath), validFrontmatter: false, sizeBytes: 0, estTokens: 0 };
+  }
+  const fm = parseStrictFrontmatter(text);
+  if (!fm.valid) {
+    for (const error of fm.errors) {
+      findings.push({ severity: "MEDIUM", rule: "malformed-frontmatter", target: skillMdPath, detail: error });
+    }
+  }
+  return {
+    ...base,
+    name: fm.name ?? basename6(group.canonicalPath),
+    validFrontmatter: fm.valid,
+    description: fm.description,
+    sizeBytes,
+    estTokens: estimateTokens(text)
+  };
+}
+function hasRecognizedMcpShape(parsed) {
+  if (typeof parsed !== "object" || parsed === null) return false;
+  const obj = parsed;
+  const serversRaw = obj.mcpServers ?? obj.servers;
+  return typeof serversRaw === "object" && serversRaw !== null;
+}
+function enumerateMcpServers(parsed) {
+  if (!hasRecognizedMcpShape(parsed)) return [];
+  const obj = parsed;
+  const serversRaw = obj.mcpServers ?? obj.servers;
+  const out = [];
+  for (const [name, raw] of Object.entries(serversRaw)) {
+    if (typeof raw !== "object" || raw === null) continue;
+    const entry = raw;
+    const command = typeof entry.command === "string" ? entry.command : void 0;
+    const args = Array.isArray(entry.args) ? entry.args.filter((a) => typeof a === "string") : [];
+    const env = entry.env && typeof entry.env === "object" && !Array.isArray(entry.env) ? entry.env : {};
+    out.push({
+      name,
+      commandBasename: command ? basename6(command) : void 0,
+      packageSpec: command && isNpxCommand(command) ? collectNpxPackageSpecs(args).positionalSpec : void 0,
+      argCount: args.length,
+      envCount: Object.keys(env).length
+    });
+  }
+  return out;
+}
+function auditMcpTarget(targetPath, notices) {
+  const findings = [];
+  const isToml = extname5(targetPath).toLowerCase() === ".toml";
+  const format = isToml ? "toml" : "json";
+  if (!existsSync13(targetPath)) {
+    findings.push({
+      severity: "LOW",
+      rule: "missing-mcp-target",
+      target: targetPath,
+      detail: "configured MCP target file does not exist"
+    });
+    return { target: { path: targetPath, format, status: "missing", servers: [] }, findings };
+  }
+  try {
+    findings.push(...toAuditFindings(scanMcpFindings(targetPath)));
+  } catch (err) {
+    findings.push({
+      severity: "MEDIUM",
+      rule: "unreadable-mcp-target",
+      target: targetPath,
+      detail: `MCP safety scan failed: ${err.message}`
+    });
+  }
+  if (isToml) {
+    try {
+      readFileSync10(targetPath, "utf-8");
+    } catch (err) {
+      findings.push({
+        severity: "MEDIUM",
+        rule: "unreadable-mcp-target",
+        target: targetPath,
+        detail: `could not read: ${err.message}`
+      });
+      return { target: { path: targetPath, format, status: "unreadable", servers: [] }, findings };
+    }
+    notices.push(`MCP target ${targetPath}: TOML format \u2014 structured server enumeration unsupported (textual safety scan only)`);
+    return { target: { path: targetPath, format, status: "clean", servers: [] }, findings };
+  }
+  let raw;
+  try {
+    raw = readFileSync10(targetPath, "utf-8");
+  } catch (err) {
+    findings.push({
+      severity: "MEDIUM",
+      rule: "unreadable-mcp-target",
+      target: targetPath,
+      detail: `could not read: ${err.message}`
+    });
+    return { target: { path: targetPath, format, status: "unreadable", servers: [] }, findings };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    findings.push({
+      severity: "MEDIUM",
+      rule: "malformed-mcp-target",
+      target: targetPath,
+      detail: `invalid JSON: ${err.message}`
+    });
+    return { target: { path: targetPath, format, status: "malformed", servers: [] }, findings };
+  }
+  if (!hasRecognizedMcpShape(parsed)) {
+    findings.push({
+      severity: "LOW",
+      rule: "unrecognized-mcp-target-shape",
+      target: targetPath,
+      detail: 'valid JSON but no "mcpServers" or "servers" object was found \u2014 reporting 0 servers'
+    });
+  }
+  return { target: { path: targetPath, format, status: "clean", servers: enumerateMcpServers(parsed) }, findings };
+}
+function clusterOverlapPairs(pairs) {
+  const parent = /* @__PURE__ */ new Map();
+  function find(x) {
+    if (!parent.has(x)) parent.set(x, x);
+    let root = x;
+    while (parent.get(root) !== root) root = parent.get(root);
+    let cur = x;
+    while (parent.get(cur) !== root) {
+      const next = parent.get(cur);
+      parent.set(cur, root);
+      cur = next;
+    }
+    return root;
+  }
+  function union(a, b) {
+    const ra = find(a);
+    const rb = find(b);
+    if (ra !== rb) parent.set(ra, rb);
+  }
+  for (const pair of pairs) union(pair.aPath, pair.bPath);
+  const groups = /* @__PURE__ */ new Map();
+  for (const pair of pairs) {
+    const root = find(pair.aPath);
+    const group = groups.get(root) ?? { members: /* @__PURE__ */ new Set(), topScore: 0 };
+    group.members.add(pair.aPath);
+    group.members.add(pair.bPath);
+    group.topScore = Math.max(group.topScore, pair.score);
+    groups.set(root, group);
+  }
+  return Array.from(groups.values()).map((g) => ({ members: toClusterMembers(g.members), topScore: g.topScore, suggestedVerb: suggestVerbCode(g.topScore) })).sort((a, b) => b.topScore - a.topScore || a.members[0].localeCompare(b.members[0]));
+}
+function toClusterMembers(members) {
+  const sorted = Array.from(members).sort();
+  if (sorted.length < 2) {
+    throw new Error(`internal error: overlap cluster has fewer than 2 members (${sorted.length})`);
+  }
+  return sorted;
+}
+async function auditConfiguredSet(config, options = {}) {
+  const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  const oversizedThreshold = options.oversizedSkillTokens ?? OVERSIZED_SKILL_EST_TOKENS;
+  const findings = [];
+  const notices = [];
+  const { candidates, rootMeta } = collectSkillCandidates(config.skillsRoots);
+  const groups = dedupeSkillCandidates(candidates, findings);
+  const unreadableSkillMdPaths = /* @__PURE__ */ new Set();
+  const skills = groups.map((g) => profileAuditedSkill(g, findings, unreadableSkillMdPaths));
+  const skillRoots = config.skillsRoots.map((root) => {
+    const meta = rootMeta.get(root) ?? { exists: false };
+    if (!meta.exists) {
+      findings.push({ severity: "MEDIUM", rule: "missing-skills-root", target: root, detail: "configured skills root does not exist on disk" });
+    } else if (!meta.realPath) {
+      findings.push({
+        severity: "MEDIUM",
+        rule: "unreadable-skills-root",
+        target: root,
+        detail: "could not resolve skills root to a real path (broken symlink or cycle)"
+      });
+    }
+    return {
+      root,
+      realPath: meta.realPath ?? resolveConfiguredRoot(root),
+      exists: meta.exists,
+      skillCount: skills.filter((s) => s.root === root).length
+    };
+  });
+  const byName = /* @__PURE__ */ new Map();
+  for (const skill of skills) {
+    const arr = byName.get(skill.name) ?? [];
+    arr.push(skill);
+    byName.set(skill.name, arr);
+  }
+  for (const [name, group] of byName) {
+    if (group.length > 1) {
+      for (const skill of group) {
+        const otherPaths = group.filter((g) => g.path !== skill.path).map((g) => g.path);
+        findings.push({
+          severity: "MEDIUM",
+          rule: "duplicate-skill-name",
+          target: skill.path,
+          detail: `name "${name}" is duplicated \u2014 also found at ${otherPaths.join(", ")}`
+        });
+      }
+    }
+  }
+  for (const skill of skills) {
+    if (skill.estTokens > oversizedThreshold) {
+      findings.push({
+        severity: "LOW",
+        rule: "oversized-skill",
+        target: skill.skillMdPath,
+        detail: `est. ${skill.estTokens} tokens exceeds the ${oversizedThreshold}-token threshold \u2014 consider trimming or splitting`
+      });
+    }
+  }
+  const safetyVerdictBySkillPath = /* @__PURE__ */ new Map();
+  for (const skill of skills) {
+    try {
+      const result = await scanSafety(skill.path, config.strictness);
+      findings.push(...toAuditFindings(result.findings));
+      safetyVerdictBySkillPath.set(skill.path, result.verdict);
+    } catch (err) {
+      findings.push({
+        severity: "MEDIUM",
+        rule: "unreadable-skill",
+        target: skill.path,
+        detail: `safety scan failed: ${err.message}`
+      });
+      safetyVerdictBySkillPath.set(skill.path, "block");
+    }
+  }
+  const mcpTargetPaths = config.mcpTargets ?? [];
+  const mcpTargets = [];
+  for (const targetPath of mcpTargetPaths) {
+    const { target, findings: targetFindings } = auditMcpTarget(targetPath, notices);
+    mcpTargets.push(target);
+    findings.push(...targetFindings);
+  }
+  const overlapStatus = proFeatureStatus("installed-set overlap analysis");
+  let overlapClusters = [];
+  if (overlapStatus.enabled) {
+    if (overlapStatus.notice) notices.push(overlapStatus.notice);
+    try {
+      const readableSkillMdPaths = skills.map((s) => s.skillMdPath).filter((p) => !unreadableSkillMdPaths.has(p));
+      const pairs = scanOverlapPaths(readableSkillMdPaths, options.overlapThreshold);
+      overlapClusters = clusterOverlapPairs(pairs);
+    } catch (err) {
+      findings.push({
+        severity: "MEDIUM",
+        rule: "overlap-scan-failed",
+        target: "installed-set overlap analysis",
+        detail: `cross-root overlap scan failed: ${err.message}`
+      });
+      notices.push(`cross-root overlap scan failed \u2014 overlap clusters unavailable this run: ${err.message}`);
+      overlapClusters = [];
+    }
+  } else {
+    notices.push(overlapStatus.notice ?? "Pro feature (installed-set overlap analysis) locked.");
+  }
+  const evolveEligible = skills.filter((s) => s.validFrontmatter && safetyVerdictBySkillPath.get(s.path) === "pass").map((s) => ({ name: s.name, path: s.path }));
+  const foundation = config.foundationSkillPath ? {
+    available: false,
+    existingPath: config.foundationSkillPath,
+    message: `a business-foundation skill already exists at ${config.foundationSkillPath}`
+  } : {
+    available: true,
+    message: "no business-foundation skill yet \u2014 `skill-forge audit --foundation` can scaffold one to ground future skills in your business profile"
+  };
+  const findingCounts = { LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0 };
+  for (const f of findings) findingCounts[f.severity]++;
+  const summary = {
+    rootCount: skillRoots.length,
+    skillCount: skills.length,
+    mcpTargetCount: mcpTargets.length,
+    findingCounts,
+    overlapClusterCount: overlapClusters.length,
+    evolveEligibleCount: evolveEligible.length
+  };
+  return {
+    schemaVersion: 1,
+    generatedAt: now().toISOString(),
+    inventory: { skillRoots, skills, mcpTargets },
+    hygiene: findings,
+    opportunities: { overlapClusters, evolveEligible, foundation, overlapLocked: !overlapStatus.enabled },
+    notices,
+    summary
+  };
+}
+function bulletList(items, emptyPlaceholder) {
+  return items.length > 0 ? items.map((i) => `- ${i}`) : [`- ${emptyPlaceholder}`];
+}
+function sanitizeForMarkdown(s) {
+  return s.replace(/[\x00-\x1F\x7F-\x9F]/g, "");
+}
+function joinDefined(parts) {
+  return parts.filter((v) => Boolean(v)).join(", ");
+}
+function renderRootsSection(roots) {
+  return [
+    "### Skill roots",
+    "",
+    ...bulletList(
+      roots.map((r) => `${r.root}${r.exists ? "" : " (MISSING)"} \u2014 ${r.skillCount} skill${r.skillCount === 1 ? "" : "s"}`),
+      "(none configured)"
+    )
+  ];
+}
+function renderSkillsSection(skills) {
+  return [
+    "### Skills",
+    "",
+    ...bulletList(
+      skills.map((s) => {
+        const flags = joinDefined([
+          s.validFrontmatter ? void 0 : "INVALID FRONTMATTER",
+          s.aliasPaths.length > 0 ? `${s.aliasPaths.length} alias path(s)` : void 0
+        ]);
+        return `${sanitizeForMarkdown(s.name)} \u2014 ${s.path} (est. ${s.estTokens} tokens)${flags ? ` [${flags}]` : ""}`;
+      }),
+      "(none found)"
+    )
+  ];
+}
+function renderMcpTargetsSection(targets) {
+  const lines = ["### MCP targets", ""];
+  if (targets.length === 0) {
+    lines.push("- (none configured)");
+    return lines;
+  }
+  for (const t of targets) {
+    lines.push(`- ${t.path} \u2014 ${t.format}, ${t.status}`);
+    for (const server of t.servers) {
+      const detail = joinDefined([
+        server.commandBasename ? sanitizeForMarkdown(server.commandBasename) : void 0,
+        server.packageSpec ? sanitizeForMarkdown(server.packageSpec) : void 0,
+        `${server.argCount} arg${server.argCount === 1 ? "" : "s"}`,
+        `${server.envCount} env var${server.envCount === 1 ? "" : "s"}`
+      ]);
+      lines.push(`  - ${sanitizeForMarkdown(server.name)} (${detail})`);
+    }
+  }
+  return lines;
+}
+function renderFindingsSection(findings) {
+  return [
+    "## Hygiene findings",
+    "",
+    ...bulletList(
+      findings.map((f) => `[${f.severity}] ${f.rule} \u2014 ${sanitizeForMarkdown(f.target)}: ${sanitizeForMarkdown(f.detail)}`),
+      "(none \u2014 clean)"
+    )
+  ];
+}
+function renderOpportunitiesSection(report) {
+  const { overlapClusters, evolveEligible, foundation } = report.opportunities;
+  return [
+    "## Opportunities",
+    "",
+    "### Overlap clusters",
+    "",
+    ...bulletList(
+      overlapClusters.map((c) => `top score ${c.topScore} \u2014 ${c.suggestedVerb} \u2014 ${c.members.join(", ")}`),
+      "(none \u2014 either no cross-root overlap found, or the Pro feature is locked, see Notices)"
+    ),
+    "",
+    "### Evolve-eligible",
+    "",
+    ...bulletList(
+      evolveEligible.map((c) => `${sanitizeForMarkdown(c.name)} \u2014 ${c.path}`),
+      "(none)"
+    ),
+    "",
+    "### Foundation skill",
+    "",
+    `- ${foundation.message}`
+  ];
+}
+function renderAuditMarkdown(report) {
+  const { summary } = report;
+  const lines = [
+    `# skill-forge audit \u2014 ${report.generatedAt}`,
+    "",
+    "## Summary",
+    "",
+    `- Skill roots: ${summary.rootCount}`,
+    `- Skills: ${summary.skillCount}`,
+    `- MCP targets: ${summary.mcpTargetCount}`,
+    `- Findings: ${summary.findingCounts.CRITICAL} CRITICAL, ${summary.findingCounts.HIGH} HIGH, ${summary.findingCounts.MEDIUM} MEDIUM, ${summary.findingCounts.LOW} LOW`,
+    `- Overlap clusters: ${summary.overlapClusterCount}`,
+    `- Evolve-eligible skills: ${summary.evolveEligibleCount}`,
+    "",
+    "## Inventory",
+    "",
+    ...renderRootsSection(report.inventory.skillRoots),
+    "",
+    ...renderSkillsSection(report.inventory.skills),
+    "",
+    ...renderMcpTargetsSection(report.inventory.mcpTargets),
+    "",
+    ...renderFindingsSection(report.hygiene),
+    "",
+    ...renderOpportunitiesSection(report),
+    "",
+    "## Notices",
+    "",
+    ...bulletList(report.notices, "(none)")
+  ];
+  return lines.join("\n") + "\n";
+}
+function renderFoundationSkillMd(profile) {
+  const description = profile.businessName ? `Business-foundation context for ${profile.businessName} \u2014 grounds new and existing skills in its audiences, workflows, and constraints. Generated by skill-forge audit.` : "Business-foundation context for this business \u2014 grounds new and existing skills in its audiences, workflows, and constraints. Generated by skill-forge audit.";
+  const lines = [
+    "---",
+    "name: business-foundation",
+    `description: ${description}`,
+    "---",
+    "",
+    `# Business Foundation${profile.businessName ? `: ${profile.businessName}` : ""}`,
+    "",
+    profile.industry ? `**Industry:** ${profile.industry}` : void 0,
+    "",
+    "## Audiences",
+    "",
+    ...bulletList(profile.audiences, "(none captured yet)"),
+    "",
+    "## Workflows",
+    "",
+    ...bulletList(profile.workflows, "(none captured yet)"),
+    "",
+    "## Constraints",
+    "",
+    ...bulletList(profile.constraints, "(none captured yet)"),
+    "",
+    "## Integration guidance",
+    "",
+    "New and existing skills in this set should align with the business context above:",
+    "- Match the audiences, terminology, and tone described here.",
+    "- Respect the workflows and constraints listed above when proposing changes.",
+    "- When curating or evolving skills (`skill-forge evolve`, `skill-forge add`), treat this file as ground truth for what the business actually needs \u2014 update it by re-running `skill-forge audit` rather than editing it out of band, so it stays a single source of truth."
+  ];
+  return lines.filter((l) => l !== void 0).join("\n") + "\n";
+}
+async function scaffoldFoundationSkill(config, profile, targetRoot) {
+  const resolvedRoot = resolveConfiguredRoot(targetRoot);
+  const configuredRoots = config.skillsRoots.map(resolveConfiguredRoot);
+  if (!configuredRoots.includes(resolvedRoot)) {
+    throw new UserError(`refusing to scaffold a foundation skill under ${resolvedRoot}: not one of the configured skillsRoots`);
+  }
+  if (!isDir(resolvedRoot)) {
+    throw new UserError(`skills root does not exist: ${resolvedRoot}`);
+  }
+  const destDir = join16(resolvedRoot, "business-foundation");
+  let destLstat;
+  try {
+    destLstat = lstatSync(destDir);
+  } catch {
+    destLstat = void 0;
+  }
+  if (destLstat?.isSymbolicLink()) {
+    throw new UserError(`refusing to scaffold a foundation skill at ${destDir}: destination is a symlink`);
+  }
+  if (destLstat) {
+    throw new UserError(`refusing to scaffold a foundation skill at ${destDir}: already exists`);
+  }
+  const content = renderFoundationSkillMd(profile);
+  const tempDir = mkdtempSync2(join16(resolvedRoot, ".business-foundation-"));
+  try {
+    writeFileSync5(join16(tempDir, "SKILL.md"), content, { flag: "wx", mode: 384 });
+    const safety = await scanSafety(tempDir, config.strictness);
+    if (safety.verdict === "block") {
+      throw new UserError(
+        `refusing to scaffold a foundation skill: the generated SKILL.md was flagged by the safety scan (${safety.findings.map(formatSafetyFinding).join("; ")})`
+      );
+    }
+    renameSync2(tempDir, destDir);
+  } catch (err) {
+    rmSync3(tempDir, { recursive: true, force: true });
+    throw err;
+  }
+  try {
+    appendProvenance(
+      {
+        name: "business-foundation",
+        source: "skill-forge audit (business profile)",
+        verb: "DEFER",
+        target: destDir,
+        took: "scaffolded a new business-foundation skill from the captured business profile",
+        notes: "scaffolded by skill-forge audit"
+      },
+      resolvedRoot
+    );
+  } catch (err) {
+    throw new UserError(
+      `the business-foundation skill was created at ${destDir}, but recording the provenance entry failed: ${err.message}`
+    );
+  }
+  return destDir;
+}
+
+// src/decision.ts
+import { createInterface } from "readline/promises";
+function logOutcome(message, json) {
+  if (json) console.error(message);
+  else console.log(message);
+}
+function yesDecision(verdict) {
+  return verdict === "block" ? "reject" : "promote";
+}
+async function promptDecision(verdict, subject) {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  const defaultChoice = verdict === "block" ? "reject" : verdict === "warn" ? "hold" : "promote";
+  const prompt = `Promote, hold, or reject ${subject}? [promote/hold/reject] (default: ${defaultChoice}) `;
+  try {
+    process.stdout.write(prompt);
+    for await (const raw of rl) {
+      const answer = raw.trim().toLowerCase() || defaultChoice;
+      if (answer === "p" || answer === "promote") return "promote";
+      if (answer === "h" || answer === "hold") return "hold";
+      if (answer === "r" || answer === "reject") return "reject";
+      process.stdout.write(`Please answer promote, hold, or reject (or p/h/r).
+${prompt}`);
+    }
+    return defaultChoice;
+  } finally {
+    rl.close();
+  }
+}
+
+// src/commands/audit.ts
+var CURATION_PROMPT_ASSET = "curation-prompt.md";
+function splitCsv(s) {
+  return s.split(",").map((x) => x.trim()).filter(Boolean);
+}
+async function askAnswer(rl, prompt) {
+  return (await rl.question(prompt)).trim().toLowerCase();
+}
+async function captureBusinessProfile(rl, existing) {
+  console.log("\n[skill-forge] Business profile \u2014 grounds the business-foundation skill scaffold and the curation handoff prompt.");
+  console.log(
+    "[skill-forge] Do not enter credentials, API keys, tokens, or confidential customer data \u2014 this is stored in plain text in config.json."
+  );
+  if (existing) {
+    const keep = await askAnswer(rl, `Reuse the existing business profile (captured ${existing.updatedAt})? [Y/n] `);
+    if (keep === "" || keep === "y" || keep === "yes") return existing;
+  }
+  const businessName = (await rl.question("Business name (optional, Enter to skip): ")).trim() || void 0;
+  const industry = (await rl.question("Industry (optional, Enter to skip): ")).trim() || void 0;
+  const audiences = splitCsv(await rl.question("Audiences (comma-separated, optional): "));
+  const workflows = splitCsv(await rl.question("Workflows (comma-separated, optional): "));
+  const constraints = splitCsv(await rl.question("Constraints (comma-separated, optional): "));
+  const profile = { businessName, industry, audiences, workflows, constraints, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+  console.log("\n[skill-forge] Business profile summary:");
+  console.log(`  Business name: ${profile.businessName ?? "(none)"}`);
+  console.log(`  Industry:      ${profile.industry ?? "(none)"}`);
+  console.log(`  Audiences:     ${profile.audiences.join(", ") || "(none)"}`);
+  console.log(`  Workflows:     ${profile.workflows.join(", ") || "(none)"}`);
+  console.log(`  Constraints:   ${profile.constraints.join(", ") || "(none)"}`);
+  const confirm = await askAnswer(rl, "Save this business profile? [Y/n] ");
+  if (confirm === "n" || confirm === "no") return existing;
+  return profile;
+}
+function resolveReportPath(reportOption) {
+  if (reportOption) return resolvePath3(reportOption);
+  const iso = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  return join17(getHomeDir(), "reports", `audit-${iso}.md`);
+}
+function writeReport(reportPath, contents) {
+  mkdirSync6(dirname6(reportPath), { recursive: true });
+  try {
+    writeFileSync6(reportPath, contents, { flag: "wx", mode: 384 });
+  } catch (err) {
+    if (err.code === "EEXIST") {
+      throw new UserError(`report file already exists: ${reportPath} \u2014 pass a different --report path`);
+    }
+    throw err;
+  }
+}
+function printTerminalSummary(report, reportPath) {
+  const { summary } = report;
+  console.log("[skill-forge] audit complete");
+  console.log(`  skill roots: ${summary.rootCount}  skills: ${summary.skillCount}  MCP targets: ${summary.mcpTargetCount}`);
+  console.log(
+    `  findings: ${summary.findingCounts.CRITICAL} CRITICAL, ${summary.findingCounts.HIGH} HIGH, ${summary.findingCounts.MEDIUM} MEDIUM, ${summary.findingCounts.LOW} LOW`
+  );
+  console.log(`  overlap clusters: ${summary.overlapClusterCount}  evolve-eligible: ${summary.evolveEligibleCount}`);
+  console.log(`  report -> ${reportPath}`);
+  for (const notice of report.notices) console.log(`  [notice] ${notice}`);
+  console.log(
+    "  next steps: `skill-forge add <source>` to install something new; `skill-forge evolve <skill-dir>` to refine an evolve-eligible skill."
+  );
+}
+async function maybeScaffoldFoundation(config, report, options, rl) {
+  let wantFoundation = options.foundation ?? false;
+  if (!wantFoundation && rl && config.businessProfile && report.opportunities.foundation.available) {
+    const answer = await askAnswer(rl, "\nCreate a business-foundation skill now? [y/N] ");
+    wantFoundation = answer === "y" || answer === "yes";
+  }
+  if (!wantFoundation) return config;
+  if (!config.businessProfile) {
+    throw new UserError(
+      "--foundation requires a business profile \u2014 run `skill-forge audit` interactively first to capture one."
+    );
+  }
+  const targetRoot = config.defaultTarget ?? config.skillsRoots[0];
+  if (!targetRoot) {
+    throw new UserError("cannot scaffold a foundation skill: no skills root configured.");
+  }
+  const foundationPath = await scaffoldFoundationSkill(config, config.businessProfile, targetRoot);
+  const updated = { ...config, foundationSkillPath: foundationPath };
+  saveConfig(updated);
+  logOutcome(`[skill-forge] scaffolded business-foundation skill -> ${foundationPath}`, options.json);
+  return updated;
+}
+async function maybeHandoff(config, reportPath, options, rl) {
+  let wantHandoff = options.handoff ?? false;
+  if (!wantHandoff && rl) {
+    const answer = await askAnswer(rl, "\nHand the curation report to a coding agent now? [y/N] ");
+    wantHandoff = answer === "y" || answer === "yes";
+  }
+  if (!wantHandoff) return;
+  runHandoff(config, reportPath, { promptAsset: CURATION_PROMPT_ASSET, log: options.json ? console.error : console.log });
+}
+async function auditCommand(options = {}) {
+  await maybeOfferInit({ json: options.json, yes: options.yes, suppressAuditOffer: true });
+  if (!existsSync14(getConfigPath())) {
+    throw new UserError(
+      "no skill-forge config found \u2014 run `skill-forge init` first (audit requires a configured skill/MCP set; it never audits an invented default)."
+    );
+  }
+  let config = loadConfig();
+  const interactive = !options.json && !options.yes && Boolean(process.stdin.isTTY);
+  const rl = interactive ? createInterface2({ input: process.stdin, output: process.stdout }) : void 0;
+  try {
+    if (rl) {
+      const profile = await captureBusinessProfile(rl, config.businessProfile);
+      if (profile !== config.businessProfile) {
+        config = { ...config, businessProfile: profile };
+        saveConfig(config);
+      }
+    }
+    const report = await auditConfiguredSet(config);
+    const reportPath = resolveReportPath(options.report);
+    writeReport(reportPath, renderAuditMarkdown(report));
+    if (options.json) {
+      console.log(JSON.stringify(report, null, 2));
+    } else {
+      printTerminalSummary(report, reportPath);
+    }
+    config = await maybeScaffoldFoundation(config, report, options, rl);
+    await maybeHandoff(config, reportPath, options, rl);
+  } finally {
+    rl?.close();
+  }
+}
+
 // src/commands/init.ts
 function detectAgents(cwd, home) {
   const found = [];
@@ -2453,7 +3326,8 @@ async function promptHandoffAgent(rl, detected) {
   const idx = parseChoice(answer, detected.length);
   return idx === void 0 ? void 0 : detected[idx].agent;
 }
-async function init(options = {}) {
+async function init(options = {}, deps = {}) {
+  const runAudit = deps.runAudit ?? auditCommand;
   const cwd = options.cwd ?? process.cwd();
   const home = options.home ?? homedir4();
   const detected = detectAgents(cwd, home);
@@ -2472,6 +3346,7 @@ async function init(options = {}) {
     const config = buildConfig(detected, detected[0], void 0, detectedMcp);
     saveConfig(config);
     printSummary(config);
+    await runAudit({ yes: true });
     return;
   }
   if (!process.stdin.isTTY) {
@@ -2480,7 +3355,8 @@ async function init(options = {}) {
   }
   printDetectionResults(detected);
   printMcpDetectionResults(detectedMcp);
-  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  const rl = createInterface3({ input: process.stdin, output: process.stdout });
+  let runAuditNow = false;
   try {
     const selected = detected.length > 0 ? await promptMultiSelect(rl, detected) : [];
     const selectedMcp = detectedMcp.length > 0 ? await promptMcpMultiSelect(rl, detectedMcp) : [];
@@ -2493,15 +3369,24 @@ async function init(options = {}) {
     const config = buildConfig(selected, target, handoffAgent, selectedMcp);
     saveConfig(config);
     printSummary(config);
+    if (options.offerAudit !== false) {
+      const answer = (await rl.question("\nRun the skills & MCP audit now? [Y/n] ")).trim().toLowerCase();
+      runAuditNow = answer === "" || answer === "y" || answer === "yes";
+    }
   } finally {
     rl.close();
   }
+  if (runAuditNow) {
+    await runAudit();
+  }
 }
 async function maybeOfferInit(options = {}) {
   if (options.json || options.yes || !process.stdin.isTTY) return;
-  if (existsSync13(getConfigPath())) return;
-  console.log("[skill-forge] No config found \u2014 run `skill-forge init` to detect your agents and set gate targets.");
-  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  if (existsSync15(getConfigPath())) return;
+  console.log(
+    "[skill-forge] No config found \u2014 run `skill-forge init` to detect your agents and set gate targets (init finishes with a `skill-forge audit` health check over what it just configured)."
+  );
+  const rl = createInterface3({ input: process.stdin, output: process.stdout });
   let answer = "";
   try {
     answer = (await rl.question("Run `skill-forge init` now? [y/N] ")).trim().toLowerCase();
@@ -2509,36 +3394,7 @@ async function maybeOfferInit(options = {}) {
     rl.close();
   }
   if (answer === "y" || answer === "yes") {
-    await init();
-  }
-}
-
-// src/decision.ts
-import { createInterface as createInterface2 } from "readline/promises";
-function logOutcome(message, json) {
-  if (json) console.error(message);
-  else console.log(message);
-}
-function yesDecision(verdict) {
-  return verdict === "block" ? "reject" : "promote";
-}
-async function promptDecision(verdict, subject) {
-  const rl = createInterface2({ input: process.stdin, output: process.stdout });
-  const defaultChoice = verdict === "block" ? "reject" : verdict === "warn" ? "hold" : "promote";
-  const prompt = `Promote, hold, or reject ${subject}? [promote/hold/reject] (default: ${defaultChoice}) `;
-  try {
-    process.stdout.write(prompt);
-    for await (const raw of rl) {
-      const answer = raw.trim().toLowerCase() || defaultChoice;
-      if (answer === "p" || answer === "promote") return "promote";
-      if (answer === "h" || answer === "hold") return "hold";
-      if (answer === "r" || answer === "reject") return "reject";
-      process.stdout.write(`Please answer promote, hold, or reject (or p/h/r).
-${prompt}`);
-    }
-    return defaultChoice;
-  } finally {
-    rl.close();
+    await init(options.suppressAuditOffer ? { offerAudit: false } : {});
   }
 }
 
@@ -2669,7 +3525,7 @@ async function addMcp(source, config, options) {
       envVars: detail.env ? Object.keys(detail.env) : void 0,
       candidateEntry: detail.command ? { command: detail.command, args: detail.args, env: detail.env } : void 0
     };
-    const mcpTargetPath = options.mcpTarget ?? config.mcpTargets?.[0] ?? join16(process.cwd(), ".mcp.json");
+    const mcpTargetPath = options.mcpTarget ?? config.mcpTargets?.[0] ?? join18(process.cwd(), ".mcp.json");
     const result = promoteMcp(entry, serverProfile, mcpTargetPath, { force: options.force });
     reject(entry);
     logOutcome(`[skill-forge] promoted -> ${result.target} (server "${result.serverName}")`, options.json);
@@ -2764,7 +3620,7 @@ async function scan(source, options = {}) {
 }
 
 // src/commands/list.ts
-import { join as join17 } from "path";
+import { join as join19 } from "path";
 async function list() {
   await maybeOfferInit();
   const config = loadConfig();
@@ -2777,14 +3633,14 @@ async function list() {
   }
   console.log(`[skill-forge] ${ids.length} held in quarantine (${quarantineDir}):`);
   for (const id of ids) {
-    const skillDirs = findSkillDirs(join17(quarantineDir, id));
+    const skillDirs = findSkillDirs(join19(quarantineDir, id));
     if (skillDirs.length === 0) {
       console.log(`  ${id}  (no SKILL.md found)`);
       continue;
     }
     const names = skillDirs.map((dir) => {
       try {
-        return readFrontmatter(join17(dir, "SKILL.md")).name;
+        return readFrontmatter(join19(dir, "SKILL.md")).name;
       } catch {
         return dir;
       }
@@ -2806,19 +3662,19 @@ async function status() {
 }
 
 // src/evolve.ts
-import { createInterface as createInterface3 } from "readline/promises";
+import { createInterface as createInterface4 } from "readline/promises";
 import { createHash } from "crypto";
-import { cpSync as cpSync3, existsSync as existsSync14, lstatSync, mkdtempSync as mkdtempSync2, readFileSync as readFileSync10, rmSync as rmSync3 } from "fs";
+import { cpSync as cpSync3, existsSync as existsSync16, lstatSync as lstatSync2, mkdtempSync as mkdtempSync3, readFileSync as readFileSync11, rmSync as rmSync4 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { basename as basename6, dirname as dirname6, join as join18, resolve as resolvePath2, sep } from "path";
+import { basename as basename7, dirname as dirname7, join as join20, resolve as resolvePath4, sep } from "path";
 var SKILLOPT_BIN = "skillopt-sleep";
 var PRO_FEATURE_LABEL2 = "self-evolution via SkillOpt-Sleep (evolve) \u2014 re-gating, provenance, and the pending-ingestion queue";
 async function evolve(targetSkillDir, options = {}, deps = {}) {
   const exec = deps.exec ?? defaultExec;
   const json = options.json;
-  const resolvedTargetDir = resolvePath2(targetSkillDir);
-  const skillMdPath = join18(resolvedTargetDir, "SKILL.md");
-  if (!existsSync14(skillMdPath)) {
+  const resolvedTargetDir = resolvePath4(targetSkillDir);
+  const skillMdPath = join20(resolvedTargetDir, "SKILL.md");
+  if (!existsSync16(skillMdPath)) {
     throw new UserError(`no SKILL.md found at ${skillMdPath} \u2014 evolve requires an existing, installed skill directory`);
   }
   const proStatus = proFeatureStatus(PRO_FEATURE_LABEL2);
@@ -2845,7 +3701,7 @@ async function evolve(targetSkillDir, options = {}, deps = {}) {
   } else {
     notices.push('using the offline "mock" backend \u2014 deterministic, no network calls, no session data leaves this machine.');
   }
-  const project = resolvePath2(options.project ?? process.cwd());
+  const project = resolvePath4(options.project ?? process.cwd());
   const present = await detectSkillopt(exec, project);
   if (!present) {
     throw new UserError(
@@ -2876,40 +3732,40 @@ async function evolve(targetSkillDir, options = {}, deps = {}) {
     }
     return;
   }
-  const stagingRoot = join18(project, ".skillopt-sleep", "staging");
-  const stagingDir = resolvePath2(parsed.staging_dir);
+  const stagingRoot = join20(project, ".skillopt-sleep", "staging");
+  const stagingDir = resolvePath4(parsed.staging_dir);
   if (stagingDir !== stagingRoot && !stagingDir.startsWith(stagingRoot + sep)) {
     throw new UserError(
       `skillopt-sleep reported a staging_dir outside the expected sandbox (${stagingRoot}): ${stagingDir} \u2014 refusing to use it`
     );
   }
-  const proposedSkillMd = join18(stagingDir, "proposed_SKILL.md");
-  const proposedClaudeMd = join18(stagingDir, "proposed_CLAUDE.md");
-  const reportMdPath = join18(stagingDir, "report.md");
-  if (!existsSync14(proposedSkillMd)) {
+  const proposedSkillMd = join20(stagingDir, "proposed_SKILL.md");
+  const proposedClaudeMd = join20(stagingDir, "proposed_CLAUDE.md");
+  const reportMdPath = join20(stagingDir, "report.md");
+  if (!existsSync16(proposedSkillMd)) {
     throw new UserError(`skillopt-sleep reported an accepted proposal but ${proposedSkillMd} is missing`);
   }
-  if (existsSync14(reportMdPath)) {
+  if (existsSync16(reportMdPath)) {
     notices.push(`SkillOpt-Sleep's full report: ${reportMdPath}`);
   }
   assertNotSymlink(proposedSkillMd, "proposed_SKILL.md");
   assertNotSymlink(proposedClaudeMd, "proposed_CLAUDE.md");
   const scannedSkillHash = sha256File(proposedSkillMd);
   const scannedClaudeHash = sha256File(proposedClaudeMd);
-  const tempDir = mkdtempSync2(join18(tmpdir2(), "skill-forge-evolve-"));
+  const tempDir = mkdtempSync3(join20(tmpdir2(), "skill-forge-evolve-"));
   let profile;
   let safety;
   try {
-    cpSync3(proposedSkillMd, join18(tempDir, "SKILL.md"));
-    if (existsSync14(proposedClaudeMd)) {
-      cpSync3(proposedClaudeMd, join18(tempDir, "CLAUDE.md"));
+    cpSync3(proposedSkillMd, join20(tempDir, "SKILL.md"));
+    if (existsSync16(proposedClaudeMd)) {
+      cpSync3(proposedClaudeMd, join20(tempDir, "CLAUDE.md"));
     }
     profile = asSkillProfile(profileSkill(tempDir), "for the evolved proposal");
     const strictness = loadConfig().strictness;
     safety = await scanSafety(tempDir, strictness);
   } finally {
     try {
-      rmSync3(tempDir, { recursive: true, force: true });
+      rmSync4(tempDir, { recursive: true, force: true });
     } catch (err) {
       console.error(`[skill-forge] failed to clean up temp re-gate dir ${tempDir}: ${err.message}`);
     }
@@ -2944,12 +3800,12 @@ async function evolve(targetSkillDir, options = {}, deps = {}) {
       throw new UserError(`skillopt-sleep adopt failed (exit ${adoptResult.code}): ${tail(adoptResult.stderr || adoptResult.stdout)}`);
     }
     logOutcome(`[skill-forge] adopted -> ${resolvedTargetDir}`, json);
-    const skillsRootForProvenance = dirname6(resolvedTargetDir);
+    const skillsRootForProvenance = dirname7(resolvedTargetDir);
     let ledgerPath;
     try {
       ledgerPath = appendProvenance(
         {
-          name: profile.name ?? basename6(resolvedTargetDir),
+          name: profile.name ?? basename7(resolvedTargetDir),
           source: resolvedTargetDir,
           version: profile.version,
           license: profile.license,
@@ -2991,7 +3847,7 @@ async function evolve(targetSkillDir, options = {}, deps = {}) {
     logOutcome("[skill-forge] queued for ingestion review", json);
   } else if (decision === "reject") {
     try {
-      rmSync3(stagingDir, { recursive: true, force: true });
+      rmSync4(stagingDir, { recursive: true, force: true });
     } catch (err) {
       throw new UserError(
         `rejected the proposal, but removing the staging dir ${stagingDir} failed: ${err.message} \u2014 remove it manually.`
@@ -3001,13 +3857,13 @@ async function evolve(targetSkillDir, options = {}, deps = {}) {
     if (safetyVerdict === "block") process.exitCode = 1;
   } else {
     logOutcome(`[skill-forge] held \u2014 staging dir left in place -> ${stagingDir}`, json);
-    if (existsSync14(reportMdPath)) {
+    if (existsSync16(reportMdPath)) {
       logOutcome(`[skill-forge] see ${reportMdPath} for the full evidence report`, json);
     }
   }
 }
 async function defaultConfirm(question) {
-  const rl = createInterface3({ input: process.stdin, output: process.stdout });
+  const rl = createInterface4({ input: process.stdin, output: process.stdout });
   try {
     process.stdout.write(question);
     for await (const raw of rl) {
@@ -3043,10 +3899,10 @@ function validateRunOutput(raw) {
   return { accepted: Boolean(obj.accepted), staging_dir: stagingDirRaw ?? null };
 }
 function readManifest(stagingDir) {
-  const manifestPath = join18(stagingDir, "manifest.json");
+  const manifestPath = join20(stagingDir, "manifest.json");
   let raw;
   try {
-    raw = readFileSync10(manifestPath, "utf-8");
+    raw = readFileSync11(manifestPath, "utf-8");
   } catch (err) {
     throw new UserError(`could not read staging manifest ${manifestPath}: ${err.message}`);
   }
@@ -3080,18 +3936,18 @@ function validateManifest(raw, manifestPath) {
   };
 }
 function filesIdentical(a, b) {
-  if (!existsSync14(a) || !existsSync14(b)) return false;
-  return readFileSync10(a).equals(readFileSync10(b));
+  if (!existsSync16(a) || !existsSync16(b)) return false;
+  return readFileSync11(a).equals(readFileSync11(b));
 }
 function isAlreadyAdopted(stagingDir, manifest) {
-  const proposedSkillMd = join18(stagingDir, "proposed_SKILL.md");
-  const proposedClaudeMd = join18(stagingDir, "proposed_CLAUDE.md");
+  const proposedSkillMd = join20(stagingDir, "proposed_SKILL.md");
+  const proposedClaudeMd = join20(stagingDir, "proposed_CLAUDE.md");
   let sawComparison = false;
-  if (existsSync14(proposedSkillMd)) {
+  if (existsSync16(proposedSkillMd)) {
     sawComparison = true;
     if (!filesIdentical(proposedSkillMd, manifest.live_skill_path)) return false;
   }
-  if (existsSync14(proposedClaudeMd) && manifest.live_memory_path) {
+  if (existsSync16(proposedClaudeMd) && manifest.live_memory_path) {
     sawComparison = true;
     if (!filesIdentical(proposedClaudeMd, manifest.live_memory_path)) return false;
   }
@@ -3100,7 +3956,7 @@ function isAlreadyAdopted(stagingDir, manifest) {
 function assertNotSymlink(path, label) {
   let stat;
   try {
-    stat = lstatSync(path);
+    stat = lstatSync2(path);
   } catch {
     return;
   }
@@ -3109,8 +3965,8 @@ function assertNotSymlink(path, label) {
   }
 }
 function sha256File(path) {
-  if (!existsSync14(path)) return null;
-  return createHash("sha256").update(readFileSync10(path)).digest("hex");
+  if (!existsSync16(path)) return null;
+  return createHash("sha256").update(readFileSync11(path)).digest("hex");
 }
 
 // src/commands/evolve.ts
@@ -3144,6 +4000,7 @@ program.command("scan <source>").description("Run the safety gate against a skil
 program.command("list").description("List skills currently in quarantine").action(list);
 program.command("status").description("Show skill-forge configuration and quarantine status").action(status);
 program.command("evolve <target-skill-dir>").description("Self-evolve a skill via SkillOpt-Sleep, re-gate the proposal, then promote/hold/reject (Pro)").option("--project <dir>", "project dir passed to SkillOpt-Sleep as --project (defaults to cwd)").option("--dry-run", "SkillOpt-Sleep dry-run: report only, nothing staged").option("--backend <name>", "SkillOpt-Sleep backend (default: mock, offline \u2014 a real backend requires --yes or interactive confirmation)").option("--lookback-hours <n>", "hours of session history for SkillOpt-Sleep to harvest", parseLookbackHours).option("-y, --yes", "skip interactive prompts; honor the re-gate verdict automatically").option("--json", "print the re-gate result as JSON instead of the terminal report").option("--force", "allow re-adopting a staging dir whose proposed content already matches the live skill").action(evolveCommand);
+program.command("audit").alias("doctor").description("Doctor-style health check over the configured skill/MCP set: inventory, hygiene findings, and consolidation/refinement opportunities").option("--json", "print the audit report as JSON instead of the terminal summary (non-interactive: skips the business-profile prompt)").option("-y, --yes", "skip interactive prompts (business profile, foundation, handoff); never implies --foundation or --handoff").option("--report <file>", "write the report to this path instead of the default ~/.skill-forge/reports/audit-<timestamp>.md (refuses an existing path)").option("--foundation", "authorizes exactly one skills-root write: scaffold a business-foundation skill from the captured business profile").option("--handoff", "authorizes launching the configured agent with the bundled curation prompt against the written report").action(auditCommand);
 program.command("init").description("Detect installed agents and set gate targets, default promotion target, and handoff agent").option("--defaults", "non-interactive: use all detected agents as gate targets, the first as the default target").option("--list", "print detected agent skill roots and exit \u2014 no writes").action(init);
 try {
   await program.parseAsync();