@rhize/skill-forge 0.7.1 → 0.9.0

package/dist/cli.js

@@ -5,7 +5,7 @@ import { Command } from "commander";
 import { createRequire } from "module";
 
 // src/commands/add.ts
-import { join as join16 } from "path";
+import { join as join18 } from "path";
 
 // src/config.ts
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
@@ -18,6 +18,16 @@ function getHomeDir() {
 function getConfigPath() {
   return join(getHomeDir(), "config.json");
 }
+function normalizeBusinessProfile(raw) {
+  if (!raw || typeof raw !== "object") return void 0;
+  const toStringArray = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string") : [];
+  return {
+    ...raw,
+    audiences: toStringArray(raw.audiences),
+    workflows: toStringArray(raw.workflows),
+    constraints: toStringArray(raw.constraints)
+  };
+}
 function defaultConfig() {
   const home = getHomeDir();
   return {
@@ -42,7 +52,9 @@ function loadConfig() {
     defaultTarget: parsed.defaultTarget ?? defaults.defaultTarget,
     agents: parsed.agents ?? defaults.agents,
     handoffCommand: parsed.handoffCommand ?? defaults.handoffCommand,
-    mcpTargets: parsed.mcpTargets ?? defaults.mcpTargets
+    mcpTargets: parsed.mcpTargets ?? defaults.mcpTargets,
+    businessProfile: normalizeBusinessProfile(parsed.businessProfile) ?? defaults.businessProfile,
+    foundationSkillPath: parsed.foundationSkillPath ?? defaults.foundationSkillPath
   };
 }
 function saveConfig(config) {
@@ -549,7 +561,7 @@ function resolveMcpCandidateDetail(profile) {
 }
 
 // src/provenance.ts
-import { appendFileSync, existsSync as existsSync6, statSync as statSync3, writeFileSync as writeFileSync3 } from "fs";
+import { appendFileSync, existsSync as existsSync6, readFileSync as readFileSync5, statSync as statSync3, writeFileSync as writeFileSync3 } from "fs";
 import { join as join7 } from "path";
 var FORGE_VERBS = ["DEFER", "ABSORB", "FORK", "REJECT", "WATCH"];
 var LEDGER_HEADER = "# Skill Forge \u2014 Provenance Ledger\n\nOne entry per external-skill ingestion decision.\n";
@@ -588,6 +600,55 @@ function appendProvenance(entry, skillsRoot) {
   appendFileSync(ledgerPath, block, "utf-8");
   return ledgerPath;
 }
+function extractField(block, label) {
+  const escaped = label.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const match = block.match(new RegExp(`\\*\\*${escaped}:\\*\\*\\s*(.*)`));
+  return match ? match[1].trim() : void 0;
+}
+function parseProvenanceLedger(text) {
+  const entries = [];
+  const warnings = [];
+  const blocks = text.split(/\n## /);
+  for (const block of blocks.slice(1)) {
+    const headerLine = block.split("\n", 1)[0] ?? "";
+    const [namePart, ...dateParts] = headerLine.split(" \u2014 ");
+    const name = namePart?.trim();
+    if (!name) {
+      warnings.push(`skipped malformed ledger block: missing "## <name> \u2014 <date>" header (saw "${headerLine.slice(0, 80)}")`);
+      continue;
+    }
+    const date = dateParts.join(" \u2014 ").trim();
+    const verbRaw = extractField(block, "Verb");
+    if (!verbRaw || !FORGE_VERBS.includes(verbRaw)) {
+      warnings.push(`skipped malformed ledger block for "${name}": missing or invalid Verb (saw "${verbRaw ?? ""}")`);
+      continue;
+    }
+    const driftCheckMatch = block.match(/\*\*Drift check:\*\*\s*`([^`]*)`/);
+    entries.push({
+      name,
+      date,
+      source: extractField(block, "Source") ?? "",
+      upstreamRef: extractField(block, "Upstream ref") ?? "",
+      license: extractField(block, "License") ?? "",
+      verb: verbRaw,
+      target: extractField(block, "Target") ?? "",
+      took: extractField(block, "Took") ?? "",
+      verified: extractField(block, "Verified") ?? "",
+      driftCheck: driftCheckMatch ? driftCheckMatch[1] : "",
+      notes: extractField(block, "Notes") ?? ""
+    });
+  }
+  return { entries, warnings };
+}
+function readProvenanceLedger(skillsRoot) {
+  const ledgerPath = join7(skillsRoot, "SOURCES.md");
+  if (!existsSync6(ledgerPath)) {
+    return { ledgerPath, exists: false, entries: [], warnings: [] };
+  }
+  const text = readFileSync5(ledgerPath, "utf-8");
+  const parsed = parseProvenanceLedger(text);
+  return { ledgerPath, exists: true, ...parsed };
+}
 
 // src/commands/gatePipeline.ts
 import { readdirSync as readdirSync5 } from "fs";
@@ -600,7 +661,7 @@ import {
   existsSync as existsSync8,
   mkdtempSync,
   openSync,
-  readFileSync as readFileSync6,
+  readFileSync as readFileSync7,
   readdirSync as readdirSync3,
   readSync,
   rmSync as rmSync2,
@@ -610,13 +671,13 @@ import { tmpdir } from "os";
 import { basename as basename3, dirname as dirname3, extname as extname3, join as join9, resolve as resolve2 } from "path";
 
 // src/gate/mcpCapabilities.ts
-import { existsSync as existsSync7, readFileSync as readFileSync5 } from "fs";
+import { existsSync as existsSync7, readFileSync as readFileSync6 } from "fs";
 import { extname as extname2, join as join8 } from "path";
 var SOURCE_EXT = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"]);
 var MAX_ITEMS_PER_CATEGORY = 200;
 function readJsonSafe(file) {
   try {
-    return JSON.parse(readFileSync5(file, "utf-8"));
+    return JSON.parse(readFileSync6(file, "utf-8"));
   } catch {
     return void 0;
   }
@@ -844,7 +905,7 @@ function readPackageJsonSafe(root) {
   const pkgPath = join9(root, "package.json");
   if (!existsSync8(pkgPath)) return void 0;
   try {
-    return JSON.parse(readFileSync6(pkgPath, "utf-8"));
+    return JSON.parse(readFileSync7(pkgPath, "utf-8"));
   } catch {
     return void 0;
   }
@@ -1004,7 +1065,7 @@ function detectLicense(root, fm) {
   for (const name of names) {
     const p = join9(root, name);
     if (existsSync8(p) && statSync4(p).isFile()) {
-      const head = readFileSync6(p, "utf-8").slice(0, 2e3).toLowerCase();
+      const head = readFileSync7(p, "utf-8").slice(0, 2e3).toLowerCase();
       for (const [hint, label] of Object.entries(SPDX_HINTS)) {
         if (head.includes(hint)) return label;
       }
@@ -1043,7 +1104,7 @@ function scanMcpAndImports(text, root) {
   if (isDir(scriptsDir)) {
     for (const f of walkFiles(scriptsDir)) {
       if (!f.endsWith(".py")) continue;
-      const ft = readFileSync6(f, "utf-8");
+      const ft = readFileSync7(f, "utf-8");
       for (const m2 of ft.match(mcpRefRe) ?? []) mcpRefs.add(m2);
       const importRe = /^\s*(?:import|from)\s+([a-zA-Z0-9_]+)/gm;
       let m;
@@ -1060,7 +1121,7 @@ function scanMcpAndImports(text, root) {
 function profileSkillDir(inputPath) {
   const { skillMd, root, tmpDir } = resolveSkillMd(inputPath);
   try {
-    const text = readFileSync6(skillMd, "utf-8");
+    const text = readFileSync7(skillMd, "utf-8");
     const fm = parseFrontmatter(text);
     const bodyLines = (text.match(/\n/g)?.length ?? 0) + 1;
     const headers = Array.from(text.matchAll(/^#{1,3}\s+(.+)$/gm)).map((m) => m[1]);
@@ -1091,7 +1152,7 @@ function profilePlugin(p) {
   const manifestPath = join9(p, ".claude-plugin", "plugin.json");
   let manifest;
   try {
-    manifest = JSON.parse(readFileSync6(manifestPath, "utf-8"));
+    manifest = JSON.parse(readFileSync7(manifestPath, "utf-8"));
   } catch (err) {
     throw new Error(`could not parse plugin.json under ${p}: ${err.message}`);
   }
@@ -1122,7 +1183,7 @@ function profileMcp(p) {
   if (explicitConfig) {
     let cfg;
     try {
-      cfg = JSON.parse(readFileSync6(explicitConfig, "utf-8"));
+      cfg = JSON.parse(readFileSync7(explicitConfig, "utf-8"));
     } catch (err) {
       throw new Error(`could not parse MCP config ${explicitConfig}: ${err.message}`);
     }
@@ -1141,7 +1202,7 @@ function profileMcp(p) {
   const pkgPath = join9(p, "package.json");
   let pkg2;
   try {
-    pkg2 = JSON.parse(readFileSync6(pkgPath, "utf-8"));
+    pkg2 = JSON.parse(readFileSync7(pkgPath, "utf-8"));
   } catch (err) {
     throw new Error(`could not parse package.json ${pkgPath}: ${err.message}`);
   }
@@ -1299,7 +1360,7 @@ async function scanSafety(targetPath, strictness = DEFAULT_STRICTNESS) {
 }
 
 // src/gate/overlap.ts
-import { existsSync as existsSync9, readFileSync as readFileSync7, readdirSync as readdirSync4 } from "fs";
+import { existsSync as existsSync9, readFileSync as readFileSync8, readdirSync as readdirSync4 } from "fs";
 import { basename as basename4, dirname as dirname4, join as join11, resolve as resolve3 } from "path";
 var STOPWORDS = new Set(
   `
@@ -1308,6 +1369,7 @@ your you it its as at by from into via per also any all not no than then so if u
 skill skills user claude code based comprehensive enhanced practical including include includes
 `.split(/\s+/).filter(Boolean)
 );
+var DEFAULT_SET_THRESHOLD = 0.45;
 function splitLimited(text, sep2, maxSplit) {
   const parts = [];
   let rest = text;
@@ -1321,7 +1383,7 @@ function splitLimited(text, sep2, maxSplit) {
   return parts;
 }
 function readFrontmatter(skillMdPath) {
-  const text = readFileSync7(skillMdPath, "utf-8");
+  const text = readFileSync8(skillMdPath, "utf-8");
   const meta = { name: basename4(dirname4(skillMdPath)), description: "" };
   if (text.startsWith("---\n")) {
     const block = splitLimited(text, "---", 2)[1] ?? "";
@@ -1474,6 +1536,26 @@ function scanOverlap(candidatePath, skillsRoot) {
     ranking
   };
 }
+function scanOverlapPaths(skillMdPaths, threshold = DEFAULT_SET_THRESHOLD) {
+  const metas = skillMdPaths.map(readFrontmatter);
+  const pairs = [];
+  for (let i = 0; i < metas.length; i++) {
+    for (let j = i + 1; j < metas.length; j++) {
+      const sc = Math.max(score(metas[i], metas[j]), score(metas[j], metas[i]));
+      if (sc >= threshold) {
+        pairs.push({
+          a: metas[i].name,
+          b: metas[j].name,
+          aPath: skillMdPaths[i],
+          bPath: skillMdPaths[j],
+          score: round3(sc)
+        });
+      }
+    }
+  }
+  pairs.sort((a, b) => b.score - a.score);
+  return pairs;
+}
 
 // src/gate/mcpSafety.ts
 import { statSync as statSync6 } from "fs";
@@ -1672,14 +1754,14 @@ async function mcpScan(targetPath, strictness = DEFAULT_STRICTNESS) {
 }
 
 // src/gate/mcpOverlap.ts
-import { existsSync as existsSync10, readFileSync as readFileSync8 } from "fs";
+import { existsSync as existsSync10, readFileSync as readFileSync9 } from "fs";
 import { resolve as resolve4 } from "path";
 function readTargetServers(targetPath) {
   const path = resolve4(expandHome(targetPath));
   if (!existsSync10(path)) return [];
   let cfg;
   try {
-    cfg = JSON.parse(readFileSync8(path, "utf-8"));
+    cfg = JSON.parse(readFileSync9(path, "utf-8"));
   } catch {
     return [];
   }
@@ -1987,7 +2069,7 @@ async function runGate(candidatePath, skillsRoot, {
 
 // src/queue.ts
 import { randomUUID as randomUUID2 } from "crypto";
-import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync9, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync10, renameSync as renameSync2, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
 import { join as join13 } from "path";
 function getQueuePath() {
   return join13(getHomeDir(), "queue.json");
@@ -1997,26 +2079,46 @@ function readQueue() {
   if (!existsSync11(path)) {
     return { version: 1, entries: [] };
   }
-  const raw = readFileSync9(path, "utf-8");
+  const raw = readFileSync10(path, "utf-8");
   const parsed = JSON.parse(raw);
   return { version: 1, entries: parsed.entries ?? [] };
 }
-function writeQueue(queue) {
-  mkdirSync5(getHomeDir(), { recursive: true });
-  writeFileSync4(getQueuePath(), JSON.stringify(queue, null, 2) + "\n", "utf-8");
+function writeQueue(queue2) {
+  const home = getHomeDir();
+  mkdirSync5(home, { recursive: true });
+  const finalPath = getQueuePath();
+  const tempPath = join13(home, `.queue.json.tmp-${randomUUID2()}`);
+  try {
+    writeFileSync4(tempPath, JSON.stringify(queue2, null, 2) + "\n", "utf-8");
+    renameSync2(tempPath, finalPath);
+  } catch (err) {
+    rmSync3(tempPath, { force: true });
+    throw err;
+  }
 }
 function appendQueueEntry(entry) {
-  const queue = readQueue();
-  const existingIds = new Set(queue.entries.map((e) => e.id));
+  const queue2 = readQueue();
+  const existingIds = new Set(queue2.entries.map((e) => e.id));
   const full = {
     ...entry,
     id: generateId(existingIds),
     createdAt: (/* @__PURE__ */ new Date()).toISOString()
   };
-  queue.entries.push(full);
-  writeQueue(queue);
+  queue2.entries.push(full);
+  writeQueue(queue2);
   return full;
 }
+function updateQueueEntry(id, patch) {
+  const queue2 = readQueue();
+  const index = queue2.entries.findIndex((e) => e.id === id);
+  if (index === -1) {
+    throw new Error(`no queue entry with id: ${id}`);
+  }
+  const updated = { ...queue2.entries[index], ...patch };
+  queue2.entries[index] = updated;
+  writeQueue(queue2);
+  return updated;
+}
 function generateId(existingIds) {
   let id;
   do {
@@ -2032,11 +2134,11 @@ import { dirname as dirname5, join as join14 } from "path";
 import { fileURLToPath } from "url";
 var KNOWN_AGENT_BINARIES = ["claude", "codex", "cursor-agent", "windsurf", "opencode", "gemini"];
 var HANDOFF_INSTRUCTION = "Read {prompt} and follow its instructions for the skill installed at {path}";
-function resolvePromptPath() {
+function resolvePromptPath(assetName = "ingest-prompt.md") {
   const here = dirname5(fileURLToPath(import.meta.url));
-  const builtCandidate = join14(here, "ingest-prompt.md");
+  const builtCandidate = join14(here, assetName);
   if (existsSync12(builtCandidate)) return builtCandidate;
-  return join14(here, "..", "assets", "ingest-prompt.md");
+  return join14(here, "..", "assets", assetName);
 }
 function defaultIsOnPath(bin) {
   const finder = process.platform === "win32" ? "where" : "which";
@@ -2048,7 +2150,7 @@ function substitute(template, vars) {
 }
 function buildHandoffCommand(config, installedPath, deps = {}) {
   const isOnPath = deps.isOnPath ?? defaultIsOnPath;
-  const promptPath = resolvePromptPath();
+  const promptPath = resolvePromptPath(deps.promptAsset);
   const vars = { path: installedPath, prompt: promptPath };
   if (config.handoffCommand && config.handoffCommand.length > 0) {
     return { argv: substitute(config.handoffCommand, vars), source: "template" };
@@ -2060,8 +2162,8 @@ function buildHandoffCommand(config, installedPath, deps = {}) {
   }
   return { argv: [], source: "none" };
 }
-function printOnlyMessage(installedPath) {
-  const promptPath = resolvePromptPath();
+function printOnlyMessage(installedPath, promptAsset) {
+  const promptPath = resolvePromptPath(promptAsset);
   return `[skill-forge] no agent handoff available \u2014 run one yourself:
   Prompt:      ${promptPath}
   Skill path:  ${installedPath}`;
@@ -2069,18 +2171,19 @@ function printOnlyMessage(installedPath) {
 function runHandoff(config, installedPath, options = {}) {
   const command = buildHandoffCommand(config, installedPath, options);
   const spawn2 = options.spawn ?? spawnSync;
+  const log = options.log ?? console.log;
   if (command.source === "none" || command.argv.length === 0) {
-    const printed = printOnlyMessage(installedPath);
-    console.log(printed);
+    const printed = printOnlyMessage(installedPath, options.promptAsset);
+    log(printed);
     return { ran: false, command, printed };
   }
   const [bin, ...args] = command.argv;
   const result = spawn2(bin, args, { stdio: options.stdio ?? "inherit" });
   const error = result.error;
   if (error?.code === "ENOENT") {
-    const printed = printOnlyMessage(installedPath);
-    console.log(`[skill-forge] ${bin} not found on PATH \u2014 run this yourself:`);
-    console.log(printed);
+    const printed = printOnlyMessage(installedPath, options.promptAsset);
+    log(`[skill-forge] ${bin} not found on PATH \u2014 run this yourself:`);
+    log(printed);
     return { ran: false, command, printed, error: error.message };
   }
   if (error) {
@@ -2091,9 +2194,9 @@ function runHandoff(config, installedPath, options = {}) {
 }
 
 // src/commands/init.ts
-import { existsSync as existsSync13 } from "fs";
+import { existsSync as existsSync15 } from "fs";
 import { homedir as homedir4 } from "os";
-import { createInterface } from "readline/promises";
+import { createInterface as createInterface3 } from "readline/promises";
 
 // src/agents.ts
 import { statSync as statSync7 } from "fs";
@@ -2332,189 +2435,756 @@ var AGENTS = [
   { id: "adal", displayName: "AdaL", projectRoot: ".adal/skills", globalRoot: "~/.adal/skills" }
 ].map(makeAgent);
 
-// src/commands/init.ts
-function detectAgents(cwd, home) {
-  const found = [];
-  for (const agent of AGENTS) {
-    const hit = detectAgentRoot(agent, cwd, home);
-    if (hit) found.push({ agent, ...hit });
-  }
-  return found;
+// src/commands/audit.ts
+import { existsSync as existsSync14, mkdirSync as mkdirSync6, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname6, join as join17, resolve as resolvePath3 } from "path";
+import { createInterface as createInterface2 } from "readline/promises";
+
+// src/audit.ts
+import {
+  existsSync as existsSync13,
+  lstatSync,
+  mkdtempSync as mkdtempSync2,
+  readFileSync as readFileSync11,
+  readdirSync as readdirSync6,
+  realpathSync,
+  renameSync as renameSync3,
+  rmSync as rmSync4,
+  statSync as statSync8,
+  writeFileSync as writeFileSync5
+} from "fs";
+import { basename as basename6, delimiter as delimiter2, extname as extname5, join as join16, resolve as resolvePath2 } from "path";
+var OVERSIZED_SKILL_EST_TOKENS = 5e3;
+function toAuditFindings(source) {
+  return source.map((f) => ({ severity: f.severity, rule: f.rule, target: f.file, detail: f.detail }));
 }
-function detectMcpTargets(cwd, home) {
-  const found = [];
-  for (const agent of AGENTS) {
-    for (const hit of detectMcpConfigFiles(agent, cwd, home)) {
-      found.push({ agent, ...hit });
-    }
+function resolveConfiguredRoot(root) {
+  return resolvePath2(expandHome(root));
+}
+function safeStat(p) {
+  try {
+    return statSync8(p);
+  } catch {
+    return void 0;
   }
-  return found;
 }
-function printDetectionResults(detected) {
-  console.log(`[skill-forge] init \u2014 agent detection (${AGENTS.length} known agents)`);
-  if (detected.length === 0) {
-    console.log("  none detected");
-    return;
+function isDirFollowingSymlink(p) {
+  return safeStat(p)?.isDirectory() ?? false;
+}
+function listSubdirsFollowingSymlinks(dir) {
+  let entries;
+  try {
+    entries = readdirSync6(dir, { withFileTypes: true });
+  } catch {
+    return [];
   }
-  for (const d of detected) {
-    console.log(`  ${d.agent.displayName} (${d.agent.id}) \u2014 ${d.scope}: ${d.root}`);
+  const out = [];
+  for (const entry of entries) {
+    const full = join16(dir, entry.name);
+    if (entry.isDirectory() || entry.isSymbolicLink() && isDirFollowingSymlink(full)) {
+      out.push(full);
+    }
   }
+  return out;
 }
-function printMcpDetectionResults(detectedMcp) {
-  if (detectedMcp.length === 0) return;
-  console.log("\n[skill-forge] init \u2014 MCP config detection");
-  for (const d of detectedMcp) {
-    console.log(`  ${d.agent.displayName} (${d.agent.id}) \u2014 ${d.scope}: ${d.path}`);
+function listSubdirsNoSymlinks(dir) {
+  let entries;
+  try {
+    entries = readdirSync6(dir, { withFileTypes: true });
+  } catch {
+    return [];
   }
+  return entries.filter((e) => e.isDirectory()).map((e) => join16(dir, e.name));
 }
-function handoffTemplateFor(agent) {
-  return agent.defaultHandoffTemplate ?? [agent.id, "-p", HANDOFF_INSTRUCTION];
-}
-function buildConfig(selected, defaultTargetEntry, handoffAgent, selectedMcp = []) {
-  const existing = loadConfig();
-  return {
-    ...existing,
-    // Skill-root selections are only overwritten when this run actually offered a choice —
-    // an mcp-only run (no skill roots detected) must not blank out an existing skillsRoots/agents.
-    skillsRoots: selected.length > 0 ? selected.map((s) => s.root) : existing.skillsRoots,
-    agents: selected.length > 0 ? selected.map((s) => ({ id: s.agent.id, skillsRoot: s.root })) : existing.agents,
-    defaultTarget: defaultTargetEntry?.root ?? existing.defaultTarget,
-    handoffCommand: handoffAgent ? handoffTemplateFor(handoffAgent) : existing.handoffCommand,
-    mcpTargets: selectedMcp.length > 0 ? selectedMcp.map((m) => m.path) : existing.mcpTargets
-  };
+function findSkillDirsUnderRoot(root) {
+  const found = /* @__PURE__ */ new Set();
+  const rootSubdirs = listSubdirsFollowingSymlinks(root);
+  for (const dir of rootSubdirs) {
+    if (existsSync13(join16(dir, "SKILL.md"))) found.add(dir);
+  }
+  for (const dir of listSubdirsFollowingSymlinks(join16(root, "skills"))) {
+    if (existsSync13(join16(dir, "SKILL.md"))) found.add(dir);
+  }
+  for (const topDir of rootSubdirs) {
+    for (const dir of listSubdirsNoSymlinks(join16(topDir, "skills"))) {
+      if (existsSync13(join16(dir, "SKILL.md"))) found.add(dir);
+    }
+  }
+  return Array.from(found).filter((p) => !p.includes("/.git/"));
 }
-function printSummary(config) {
-  console.log(`
-[skill-forge] wrote config to ${getConfigPath()}`);
-  console.log(`  gate targets: ${config.skillsRoots.join(", ")}`);
-  if (config.defaultTarget) console.log(`  default target: ${config.defaultTarget}`);
-  if (config.handoffCommand?.length) console.log(`  handoff command: ${config.handoffCommand.join(" ")}`);
-  if (config.mcpTargets?.length) console.log(`  mcp targets: ${config.mcpTargets.join(", ")}`);
+function collectSkillCandidates(roots) {
+  const candidates = [];
+  const rootMeta = /* @__PURE__ */ new Map();
+  for (const root of roots) {
+    const resolvedRoot = resolveConfiguredRoot(root);
+    const exists = isDir(resolvedRoot);
+    let realPath;
+    if (exists) {
+      try {
+        realPath = realpathSync(resolvedRoot);
+      } catch {
+        realPath = void 0;
+      }
+    }
+    rootMeta.set(root, { exists, realPath });
+    if (!exists) continue;
+    for (const dir of findSkillDirsUnderRoot(resolvedRoot)) {
+      candidates.push({ configuredPath: dir, root });
+    }
+  }
+  return { candidates, rootMeta };
 }
-function parseChoice(answer, max) {
-  const n = Number(answer);
-  return Number.isInteger(n) && n >= 1 && n <= max ? n - 1 : void 0;
+function dedupeSkillCandidates(candidates, findings) {
+  const byRealPath = /* @__PURE__ */ new Map();
+  const order = [];
+  for (const candidate of candidates) {
+    let realPath;
+    try {
+      realPath = realpathSync(candidate.configuredPath);
+    } catch (err) {
+      findings.push({
+        severity: "MEDIUM",
+        rule: "unreadable-skill",
+        target: candidate.configuredPath,
+        detail: `could not resolve skill directory (broken symlink or cycle): ${err.message}`
+      });
+      continue;
+    }
+    const existing = byRealPath.get(realPath);
+    if (existing) {
+      if (existing.canonicalPath !== candidate.configuredPath && !existing.aliasPaths.includes(candidate.configuredPath)) {
+        existing.aliasPaths.push(candidate.configuredPath);
+      }
+      continue;
+    }
+    byRealPath.set(realPath, { realPath, canonicalPath: candidate.configuredPath, root: candidate.root, aliasPaths: [] });
+    order.push(realPath);
+  }
+  return order.map((realPath) => byRealPath.get(realPath));
 }
-async function promptMultiSelect(rl, detected) {
-  const chosen = new Set(detected.map((_, i) => i));
-  for (; ; ) {
-    console.log("\nGate targets (all detected roots pre-selected \u2014 type a number to toggle, Enter to confirm):");
-    detected.forEach((d, i) => {
-      const mark = chosen.has(i) ? "[x]" : "[ ]";
-      console.log(`  ${mark} ${i + 1}. ${d.agent.displayName} (${d.scope}) \u2014 ${d.root}`);
-    });
-    const answer = (await rl.question("> ")).trim();
-    if (answer === "") break;
-    const idx = parseChoice(answer, detected.length);
-    if (idx !== void 0) {
-      if (chosen.has(idx)) chosen.delete(idx);
-      else chosen.add(idx);
+function parseStrictFrontmatter(text) {
+  if (!text.startsWith("---\n")) {
+    return { valid: false, errors: ['missing frontmatter fence (SKILL.md must start with "---")'] };
+  }
+  const afterOpen = text.slice(4);
+  const closeIdx = afterOpen.indexOf("\n---");
+  if (closeIdx === -1) {
+    return { valid: false, errors: ['unclosed frontmatter fence (no closing "---" found)'] };
+  }
+  const block = afterOpen.slice(0, closeIdx);
+  const errors = [];
+  const nameMatch = block.match(/^name:\s*(.+)$/m);
+  const name = nameMatch ? stripQuotes(nameMatch[1].trim()) : void 0;
+  if (!name) errors.push('missing required "name" field in frontmatter');
+  const descMatch = block.match(/^description:\s*(.*)$/m);
+  let description;
+  if (descMatch) {
+    const first = descMatch[1].trim();
+    if ([">", ">-", "|", "|-", ""].includes(first)) {
+      const lines = block.split(/\r\n|\r|\n/);
+      const idx = lines.findIndex((l) => /^description:/.test(l));
+      const buf = [];
+      if (idx !== -1) {
+        for (const l of lines.slice(idx + 1)) {
+          if (/^\s+\S/.test(l)) buf.push(l.trim());
+          else if (l.trim() === "") continue;
+          else break;
+        }
+      }
+      description = buf.join(" ").trim() || void 0;
     } else {
-      console.log("  (invalid selection \u2014 enter a listed number, or press Enter to confirm)");
+      description = stripQuotes(first);
     }
   }
-  return detected.filter((_, i) => chosen.has(i));
+  if (!description) errors.push('missing required "description" field in frontmatter');
+  return { valid: errors.length === 0, name, description, errors };
 }
-async function promptMcpMultiSelect(rl, detectedMcp) {
-  const chosen = new Set(detectedMcp.map((_, i) => i));
-  for (; ; ) {
-    console.log("\nMCP targets (all detected config files pre-selected \u2014 type a number to toggle, Enter to confirm):");
-    detectedMcp.forEach((d, i) => {
-      const mark = chosen.has(i) ? "[x]" : "[ ]";
-      console.log(`  ${mark} ${i + 1}. ${d.agent.displayName} (${d.scope}) \u2014 ${d.path}`);
+function estimateTokens(text) {
+  return Math.ceil(Buffer.byteLength(text, "utf-8") / 4);
+}
+function profileAuditedSkill(group, findings, unreadableSkillMdPaths) {
+  const skillMdPath = join16(group.canonicalPath, "SKILL.md");
+  const base = {
+    path: group.canonicalPath,
+    skillMdPath,
+    root: group.root,
+    aliasPaths: group.aliasPaths
+  };
+  let text;
+  let sizeBytes;
+  try {
+    sizeBytes = statSync8(skillMdPath).size;
+    text = readFileSync11(skillMdPath, "utf-8");
+  } catch (err) {
+    findings.push({
+      severity: "MEDIUM",
+      rule: "unreadable-skill",
+      target: skillMdPath,
+      detail: `could not read SKILL.md: ${err.message}`
     });
-    const answer = (await rl.question("> ")).trim();
-    if (answer === "") break;
-    const idx = parseChoice(answer, detectedMcp.length);
-    if (idx !== void 0) {
-      if (chosen.has(idx)) chosen.delete(idx);
-      else chosen.add(idx);
-    } else {
-      console.log("  (invalid selection \u2014 enter a listed number, or press Enter to confirm)");
+    unreadableSkillMdPaths.add(skillMdPath);
+    return { ...base, name: basename6(group.canonicalPath), validFrontmatter: false, sizeBytes: 0, estTokens: 0 };
+  }
+  const fm = parseStrictFrontmatter(text);
+  if (!fm.valid) {
+    for (const error of fm.errors) {
+      findings.push({ severity: "MEDIUM", rule: "malformed-frontmatter", target: skillMdPath, detail: error });
     }
   }
-  return detectedMcp.filter((_, i) => chosen.has(i));
-}
-async function promptDefaultTarget(rl, selected) {
-  console.log("\nDefault promotion target:");
-  selected.forEach((d, i) => console.log(`  ${i + 1}. ${d.agent.displayName} \u2014 ${d.root}`));
-  const answer = (await rl.question(`Choose [1-${selected.length}] (default 1): `)).trim();
-  const idx = answer === "" ? 0 : parseChoice(answer, selected.length) ?? 0;
-  return selected[idx];
+  return {
+    ...base,
+    name: fm.name ?? basename6(group.canonicalPath),
+    validFrontmatter: fm.valid,
+    description: fm.description,
+    sizeBytes,
+    estTokens: estimateTokens(text)
+  };
 }
-async function promptHandoffAgent(rl, detected) {
-  console.log("\nHandoff agent (used to hand off follow-up prompts after promotion; optional):");
-  detected.forEach((d, i) => {
-    const note = d.agent.defaultHandoffTemplate ? "" : " (no confirmed CLI \u2014 best-effort)";
-    console.log(`  ${i + 1}. ${d.agent.displayName}${note}`);
-  });
-  const answer = (await rl.question(`Choose [1-${detected.length}] or Enter to skip: `)).trim();
-  if (answer === "") return void 0;
-  const idx = parseChoice(answer, detected.length);
-  return idx === void 0 ? void 0 : detected[idx].agent;
+function hasRecognizedMcpShape(parsed) {
+  if (typeof parsed !== "object" || parsed === null) return false;
+  const obj = parsed;
+  const serversRaw = obj.mcpServers ?? obj.servers;
+  return typeof serversRaw === "object" && serversRaw !== null;
 }
-async function init(options = {}) {
-  const cwd = options.cwd ?? process.cwd();
-  const home = options.home ?? homedir4();
-  const detected = detectAgents(cwd, home);
-  const detectedMcp = detectMcpTargets(cwd, home);
-  if (options.list) {
-    printDetectionResults(detected);
-    printMcpDetectionResults(detectedMcp);
-    return;
+function enumerateMcpServers(parsed) {
+  if (!hasRecognizedMcpShape(parsed)) return [];
+  const obj = parsed;
+  const serversRaw = obj.mcpServers ?? obj.servers;
+  const out = [];
+  for (const [name, raw] of Object.entries(serversRaw)) {
+    if (typeof raw !== "object" || raw === null) continue;
+    const entry = raw;
+    const command = typeof entry.command === "string" ? entry.command : void 0;
+    const args = Array.isArray(entry.args) ? entry.args.filter((a) => typeof a === "string") : [];
+    const env = entry.env && typeof entry.env === "object" && !Array.isArray(entry.env) ? entry.env : {};
+    out.push({
+      name,
+      commandBasename: command ? basename6(command) : void 0,
+      packageSpec: command && isNpxCommand(command) ? collectNpxPackageSpecs(args).positionalSpec : void 0,
+      argCount: args.length,
+      envCount: Object.keys(env).length
+    });
   }
-  if (detected.length === 0 && detectedMcp.length === 0) {
-    console.log("[skill-forge] No known agent skill directories or MCP config files were found.");
-    console.log("  Install a coding agent (Claude Code, Codex, Cursor, ...) or create a skills root, then re-run `skill-forge init`.");
-    return;
+  return out;
+}
+function auditMcpTarget(targetPath, notices) {
+  const findings = [];
+  const isToml = extname5(targetPath).toLowerCase() === ".toml";
+  const format = isToml ? "toml" : "json";
+  if (!existsSync13(targetPath)) {
+    findings.push({
+      severity: "LOW",
+      rule: "missing-mcp-target",
+      target: targetPath,
+      detail: "configured MCP target file does not exist"
+    });
+    return { target: { path: targetPath, format, status: "missing", servers: [] }, findings };
   }
-  if (options.defaults) {
-    const config = buildConfig(detected, detected[0], void 0, detectedMcp);
-    saveConfig(config);
-    printSummary(config);
-    return;
+  try {
+    findings.push(...toAuditFindings(scanMcpFindings(targetPath)));
+  } catch (err) {
+    findings.push({
+      severity: "MEDIUM",
+      rule: "unreadable-mcp-target",
+      target: targetPath,
+      detail: `MCP safety scan failed: ${err.message}`
+    });
   }
-  if (!process.stdin.isTTY) {
-    console.log("[skill-forge] Not an interactive terminal \u2014 run with --defaults for non-interactive setup.");
-    return;
+  if (isToml) {
+    try {
+      readFileSync11(targetPath, "utf-8");
+    } catch (err) {
+      findings.push({
+        severity: "MEDIUM",
+        rule: "unreadable-mcp-target",
+        target: targetPath,
+        detail: `could not read: ${err.message}`
+      });
+      return { target: { path: targetPath, format, status: "unreadable", servers: [] }, findings };
+    }
+    notices.push(`MCP target ${targetPath}: TOML format \u2014 structured server enumeration unsupported (textual safety scan only)`);
+    return { target: { path: targetPath, format, status: "clean", servers: [] }, findings };
   }
-  printDetectionResults(detected);
-  printMcpDetectionResults(detectedMcp);
-  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  let raw;
   try {
-    const selected = detected.length > 0 ? await promptMultiSelect(rl, detected) : [];
-    const selectedMcp = detectedMcp.length > 0 ? await promptMcpMultiSelect(rl, detectedMcp) : [];
-    if (selected.length === 0 && selectedMcp.length === 0) {
-      console.log("[skill-forge] No targets selected \u2014 aborting, nothing written.");
-      return;
-    }
-    const target = selected.length > 0 ? await promptDefaultTarget(rl, selected) : void 0;
-    const handoffAgent = detected.length > 0 ? await promptHandoffAgent(rl, detected) : void 0;
-    const config = buildConfig(selected, target, handoffAgent, selectedMcp);
-    saveConfig(config);
-    printSummary(config);
-  } finally {
-    rl.close();
+    raw = readFileSync11(targetPath, "utf-8");
+  } catch (err) {
+    findings.push({
+      severity: "MEDIUM",
+      rule: "unreadable-mcp-target",
+      target: targetPath,
+      detail: `could not read: ${err.message}`
+    });
+    return { target: { path: targetPath, format, status: "unreadable", servers: [] }, findings };
   }
-}
-async function maybeOfferInit(options = {}) {
-  if (options.json || options.yes || !process.stdin.isTTY) return;
-  if (existsSync13(getConfigPath())) return;
-  console.log("[skill-forge] No config found \u2014 run `skill-forge init` to detect your agents and set gate targets.");
-  const rl = createInterface({ input: process.stdin, output: process.stdout });
-  let answer = "";
+  let parsed;
   try {
-    answer = (await rl.question("Run `skill-forge init` now? [y/N] ")).trim().toLowerCase();
-  } finally {
-    rl.close();
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    findings.push({
+      severity: "MEDIUM",
+      rule: "malformed-mcp-target",
+      target: targetPath,
+      detail: `invalid JSON: ${err.message}`
+    });
+    return { target: { path: targetPath, format, status: "malformed", servers: [] }, findings };
   }
-  if (answer === "y" || answer === "yes") {
-    await init();
+  if (!hasRecognizedMcpShape(parsed)) {
+    findings.push({
+      severity: "LOW",
+      rule: "unrecognized-mcp-target-shape",
+      target: targetPath,
+      detail: 'valid JSON but no "mcpServers" or "servers" object was found \u2014 reporting 0 servers'
+    });
   }
+  return { target: { path: targetPath, format, status: "clean", servers: enumerateMcpServers(parsed) }, findings };
+}
+function clusterOverlapPairs(pairs) {
+  const parent = /* @__PURE__ */ new Map();
+  function find2(x) {
+    if (!parent.has(x)) parent.set(x, x);
+    let root = x;
+    while (parent.get(root) !== root) root = parent.get(root);
+    let cur = x;
+    while (parent.get(cur) !== root) {
+      const next = parent.get(cur);
+      parent.set(cur, root);
+      cur = next;
+    }
+    return root;
+  }
+  function union(a, b) {
+    const ra = find2(a);
+    const rb = find2(b);
+    if (ra !== rb) parent.set(ra, rb);
+  }
+  for (const pair of pairs) union(pair.aPath, pair.bPath);
+  const groups = /* @__PURE__ */ new Map();
+  for (const pair of pairs) {
+    const root = find2(pair.aPath);
+    const group = groups.get(root) ?? { members: /* @__PURE__ */ new Set(), topScore: 0 };
+    group.members.add(pair.aPath);
+    group.members.add(pair.bPath);
+    group.topScore = Math.max(group.topScore, pair.score);
+    groups.set(root, group);
+  }
+  return Array.from(groups.values()).map((g) => ({ members: toClusterMembers(g.members), topScore: g.topScore, suggestedVerb: suggestVerbCode(g.topScore) })).sort((a, b) => b.topScore - a.topScore || a.members[0].localeCompare(b.members[0]));
+}
+function toClusterMembers(members) {
+  const sorted = Array.from(members).sort();
+  if (sorted.length < 2) {
+    throw new Error(`internal error: overlap cluster has fewer than 2 members (${sorted.length})`);
+  }
+  return sorted;
+}
+function defaultWhich(cmd) {
+  const pathEnv = process.env.PATH ?? "";
+  const dirs = pathEnv.split(delimiter2).filter(Boolean);
+  const exts = process.platform === "win32" ? (process.env.PATHEXT ?? ".EXE;.CMD;.BAT").split(";") : [""];
+  for (const dir of dirs) {
+    for (const ext of exts) {
+      const candidate = join16(dir, cmd + ext);
+      try {
+        if (statSync8(candidate).isFile()) return candidate;
+      } catch {
+      }
+    }
+  }
+  return void 0;
+}
+var SKILLSPECTOR_PROVIDER_KEYMAP = {
+  openai: "OPENAI_API_KEY",
+  anthropic: "ANTHROPIC_API_KEY",
+  nv_build: "NVIDIA_INFERENCE_KEY"
+};
+function checkTooling(which2, env) {
+  const skillspectorPath = which2("skillspector");
+  const skillspector = skillspectorPath ? { installed: true } : {
+    installed: false,
+    hint: "NOT installed \u2014 github.com/NVIDIA/skillspector (git clone + make install; Python 3.12+)"
+  };
+  const tokenPresent = Boolean(env.VERCEL_OIDC_TOKEN);
+  const skillsShToken = tokenPresent ? { present: true } : {
+    present: false,
+    hint: "missing \u2014 enable OIDC Federation on your Vercel project, then `vercel link && vercel env pull`"
+  };
+  const provider = env.SKILLSPECTOR_PROVIDER;
+  const providerKeyEnv = provider ? SKILLSPECTOR_PROVIDER_KEYMAP[provider] : void 0;
+  const skillspectorLlm = {
+    configured: Boolean(provider && providerKeyEnv && env[providerKeyEnv]),
+    provider: provider || void 0
+  };
+  return { skillspector, skillsShToken, skillspectorLlm };
+}
+async function auditConfiguredSet(config, options = {}) {
+  const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  const oversizedThreshold = options.oversizedSkillTokens ?? OVERSIZED_SKILL_EST_TOKENS;
+  const findings = [];
+  const notices = [];
+  const { candidates, rootMeta } = collectSkillCandidates(config.skillsRoots);
+  const groups = dedupeSkillCandidates(candidates, findings);
+  const unreadableSkillMdPaths = /* @__PURE__ */ new Set();
+  const skills = groups.map((g) => profileAuditedSkill(g, findings, unreadableSkillMdPaths));
+  const skillRoots = config.skillsRoots.map((root) => {
+    const meta = rootMeta.get(root) ?? { exists: false };
+    if (!meta.exists) {
+      findings.push({ severity: "MEDIUM", rule: "missing-skills-root", target: root, detail: "configured skills root does not exist on disk" });
+    } else if (!meta.realPath) {
+      findings.push({
+        severity: "MEDIUM",
+        rule: "unreadable-skills-root",
+        target: root,
+        detail: "could not resolve skills root to a real path (broken symlink or cycle)"
+      });
+    }
+    return {
+      root,
+      realPath: meta.realPath ?? resolveConfiguredRoot(root),
+      exists: meta.exists,
+      skillCount: skills.filter((s) => s.root === root).length
+    };
+  });
+  const byName = /* @__PURE__ */ new Map();
+  for (const skill of skills) {
+    const arr = byName.get(skill.name) ?? [];
+    arr.push(skill);
+    byName.set(skill.name, arr);
+  }
+  for (const [name, group] of byName) {
+    if (group.length > 1) {
+      for (const skill of group) {
+        const otherPaths = group.filter((g) => g.path !== skill.path).map((g) => g.path);
+        findings.push({
+          severity: "MEDIUM",
+          rule: "duplicate-skill-name",
+          target: skill.path,
+          detail: `name "${name}" is duplicated \u2014 also found at ${otherPaths.join(", ")}`
+        });
+      }
+    }
+  }
+  for (const skill of skills) {
+    if (skill.estTokens > oversizedThreshold) {
+      findings.push({
+        severity: "LOW",
+        rule: "oversized-skill",
+        target: skill.skillMdPath,
+        detail: `est. ${skill.estTokens} tokens exceeds the ${oversizedThreshold}-token threshold \u2014 consider trimming or splitting`
+      });
+    }
+  }
+  const safetyVerdictBySkillPath = /* @__PURE__ */ new Map();
+  for (const skill of skills) {
+    try {
+      const result = await scanSafety(skill.path, config.strictness);
+      findings.push(...toAuditFindings(result.findings));
+      safetyVerdictBySkillPath.set(skill.path, result.verdict);
+    } catch (err) {
+      findings.push({
+        severity: "MEDIUM",
+        rule: "unreadable-skill",
+        target: skill.path,
+        detail: `safety scan failed: ${err.message}`
+      });
+      safetyVerdictBySkillPath.set(skill.path, "block");
+    }
+  }
+  const mcpTargetPaths = config.mcpTargets ?? [];
+  const mcpTargets = [];
+  for (const targetPath of mcpTargetPaths) {
+    const { target, findings: targetFindings } = auditMcpTarget(targetPath, notices);
+    mcpTargets.push(target);
+    findings.push(...targetFindings);
+  }
+  const overlapStatus = proFeatureStatus("installed-set overlap analysis");
+  let overlapClusters = [];
+  if (overlapStatus.enabled) {
+    if (overlapStatus.notice) notices.push(overlapStatus.notice);
+    try {
+      const readableSkillMdPaths = skills.map((s) => s.skillMdPath).filter((p) => !unreadableSkillMdPaths.has(p));
+      const pairs = scanOverlapPaths(readableSkillMdPaths, options.overlapThreshold);
+      overlapClusters = clusterOverlapPairs(pairs);
+    } catch (err) {
+      findings.push({
+        severity: "MEDIUM",
+        rule: "overlap-scan-failed",
+        target: "installed-set overlap analysis",
+        detail: `cross-root overlap scan failed: ${err.message}`
+      });
+      notices.push(`cross-root overlap scan failed \u2014 overlap clusters unavailable this run: ${err.message}`);
+      overlapClusters = [];
+    }
+  } else {
+    notices.push(overlapStatus.notice ?? "Pro feature (installed-set overlap analysis) locked.");
+  }
+  const evolveEligible = skills.filter((s) => s.validFrontmatter && safetyVerdictBySkillPath.get(s.path) === "pass").map((s) => ({ name: s.name, path: s.path }));
+  const foundation = config.foundationSkillPath ? {
+    available: false,
+    existingPath: config.foundationSkillPath,
+    message: `a business-foundation skill already exists at ${config.foundationSkillPath}`
+  } : {
+    available: true,
+    message: "no business-foundation skill yet \u2014 `skill-forge audit --foundation` can scaffold one to ground future skills in your business profile"
+  };
+  const findingCounts = { LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0 };
+  for (const f of findings) findingCounts[f.severity]++;
+  const summary = {
+    rootCount: skillRoots.length,
+    skillCount: skills.length,
+    mcpTargetCount: mcpTargets.length,
+    findingCounts,
+    overlapClusterCount: overlapClusters.length,
+    evolveEligibleCount: evolveEligible.length
+  };
+  const tooling = checkTooling(options.which ?? defaultWhich, options.env ?? process.env);
+  return {
+    schemaVersion: 1,
+    generatedAt: now().toISOString(),
+    inventory: { skillRoots, skills, mcpTargets },
+    hygiene: findings,
+    opportunities: { overlapClusters, evolveEligible, foundation, overlapLocked: !overlapStatus.enabled },
+    tooling,
+    notices,
+    summary
+  };
+}
+function bulletList(items, emptyPlaceholder) {
+  return items.length > 0 ? items.map((i) => `- ${i}`) : [`- ${emptyPlaceholder}`];
+}
+function sanitizeForMarkdown(s) {
+  return s.replace(/[\x00-\x1F\x7F-\x9F]/g, "");
+}
+function joinDefined(parts) {
+  return parts.filter((v) => Boolean(v)).join(", ");
+}
+function renderRootsSection(roots) {
+  return [
+    "### Skill roots",
+    "",
+    ...bulletList(
+      roots.map((r) => `${r.root}${r.exists ? "" : " (MISSING)"} \u2014 ${r.skillCount} skill${r.skillCount === 1 ? "" : "s"}`),
+      "(none configured)"
+    )
+  ];
+}
+function renderSkillsSection(skills) {
+  return [
+    "### Skills",
+    "",
+    ...bulletList(
+      skills.map((s) => {
+        const flags = joinDefined([
+          s.validFrontmatter ? void 0 : "INVALID FRONTMATTER",
+          s.aliasPaths.length > 0 ? `${s.aliasPaths.length} alias path(s)` : void 0
+        ]);
+        return `${sanitizeForMarkdown(s.name)} \u2014 ${s.path} (est. ${s.estTokens} tokens)${flags ? ` [${flags}]` : ""}`;
+      }),
+      "(none found)"
+    )
+  ];
+}
+function renderMcpTargetsSection(targets) {
+  const lines = ["### MCP targets", ""];
+  if (targets.length === 0) {
+    lines.push("- (none configured)");
+    return lines;
+  }
+  for (const t of targets) {
+    lines.push(`- ${t.path} \u2014 ${t.format}, ${t.status}`);
+    for (const server of t.servers) {
+      const detail = joinDefined([
+        server.commandBasename ? sanitizeForMarkdown(server.commandBasename) : void 0,
+        server.packageSpec ? sanitizeForMarkdown(server.packageSpec) : void 0,
+        `${server.argCount} arg${server.argCount === 1 ? "" : "s"}`,
+        `${server.envCount} env var${server.envCount === 1 ? "" : "s"}`
+      ]);
+      lines.push(`  - ${sanitizeForMarkdown(server.name)} (${detail})`);
+    }
+  }
+  return lines;
+}
+function renderFindingsSection(findings) {
+  return [
+    "## Hygiene findings",
+    "",
+    ...bulletList(
+      findings.map((f) => `[${f.severity}] ${f.rule} \u2014 ${sanitizeForMarkdown(f.target)}: ${sanitizeForMarkdown(f.detail)}`),
+      "(none \u2014 clean)"
+    )
+  ];
+}
+function renderOpportunitiesSection(report) {
+  const { overlapClusters, evolveEligible, foundation } = report.opportunities;
+  return [
+    "## Opportunities",
+    "",
+    "### Overlap clusters",
+    "",
+    ...bulletList(
+      overlapClusters.map((c) => `top score ${c.topScore} \u2014 ${c.suggestedVerb} \u2014 ${c.members.join(", ")}`),
+      "(none \u2014 either no cross-root overlap found, or the Pro feature is locked, see Notices)"
+    ),
+    "",
+    "### Evolve-eligible",
+    "",
+    ...bulletList(
+      evolveEligible.map((c) => `${sanitizeForMarkdown(c.name)} \u2014 ${c.path}`),
+      "(none)"
+    ),
+    "",
+    "### Foundation skill",
+    "",
+    `- ${foundation.message}`
+  ];
+}
+function renderToolingSection(tooling) {
+  const lines = ["## Tooling", ""];
+  if (!tooling) {
+    lines.push("- (not available in this report)");
+    return lines;
+  }
+  lines.push(`- SkillSpector CLI: ${tooling.skillspector.installed ? "installed" : "NOT installed"}`);
+  if (tooling.skillspector.hint) lines.push(`  - ${tooling.skillspector.hint}`);
+  lines.push(`- skills.sh auth (VERCEL_OIDC_TOKEN): ${tooling.skillsShToken.present ? "present" : "missing"}`);
+  if (tooling.skillsShToken.hint) lines.push(`  - ${tooling.skillsShToken.hint}`);
+  const llm = tooling.skillspectorLlm;
+  if (llm.configured) {
+    lines.push(`- SkillSpector LLM stage (optional): configured (provider: ${sanitizeForMarkdown(llm.provider ?? "")})`);
+  } else if (llm.provider) {
+    lines.push(`- SkillSpector LLM stage (optional): not configured \u2014 SKILLSPECTOR_PROVIDER is "${sanitizeForMarkdown(llm.provider)}" but its API key env var is not set`);
+  } else {
+    lines.push(
+      "- SkillSpector LLM stage (optional): not set \u2014 static scan works without it (use --no-llm); set SKILLSPECTOR_PROVIDER + its API key for semantic analysis"
+    );
+  }
+  return lines;
+}
+function renderAuditMarkdown(report) {
+  const { summary } = report;
+  const lines = [
+    `# skill-forge audit \u2014 ${report.generatedAt}`,
+    "",
+    "## Summary",
+    "",
+    `- Skill roots: ${summary.rootCount}`,
+    `- Skills: ${summary.skillCount}`,
+    `- MCP targets: ${summary.mcpTargetCount}`,
+    `- Findings: ${summary.findingCounts.CRITICAL} CRITICAL, ${summary.findingCounts.HIGH} HIGH, ${summary.findingCounts.MEDIUM} MEDIUM, ${summary.findingCounts.LOW} LOW`,
+    `- Overlap clusters: ${summary.overlapClusterCount}`,
+    `- Evolve-eligible skills: ${summary.evolveEligibleCount}`,
+    "",
+    "## Inventory",
+    "",
+    ...renderRootsSection(report.inventory.skillRoots),
+    "",
+    ...renderSkillsSection(report.inventory.skills),
+    "",
+    ...renderMcpTargetsSection(report.inventory.mcpTargets),
+    "",
+    ...renderFindingsSection(report.hygiene),
+    "",
+    ...renderOpportunitiesSection(report),
+    "",
+    ...renderToolingSection(report.tooling),
+    "",
+    "## Notices",
+    "",
+    ...bulletList(report.notices, "(none)")
+  ];
+  return lines.join("\n") + "\n";
+}
+function renderFoundationSkillMd(profile) {
+  const description = profile.businessName ? `Business-foundation context for ${profile.businessName} \u2014 grounds new and existing skills in its audiences, workflows, and constraints. Generated by skill-forge audit.` : "Business-foundation context for this business \u2014 grounds new and existing skills in its audiences, workflows, and constraints. Generated by skill-forge audit.";
+  const lines = [
+    "---",
+    "name: business-foundation",
+    `description: ${description}`,
+    "---",
+    "",
+    `# Business Foundation${profile.businessName ? `: ${profile.businessName}` : ""}`,
+    "",
+    profile.industry ? `**Industry:** ${profile.industry}` : void 0,
+    "",
+    "## Audiences",
+    "",
+    ...bulletList(profile.audiences, "(none captured yet)"),
+    "",
+    "## Workflows",
+    "",
+    ...bulletList(profile.workflows, "(none captured yet)"),
+    "",
+    "## Constraints",
+    "",
+    ...bulletList(profile.constraints, "(none captured yet)"),
+    "",
+    "## Integration guidance",
+    "",
+    "New and existing skills in this set should align with the business context above:",
+    "- Match the audiences, terminology, and tone described here.",
+    "- Respect the workflows and constraints listed above when proposing changes.",
+    "- When curating or evolving skills (`skill-forge evolve`, `skill-forge add`), treat this file as ground truth for what the business actually needs \u2014 update it by re-running `skill-forge audit` rather than editing it out of band, so it stays a single source of truth."
+  ];
+  return lines.filter((l) => l !== void 0).join("\n") + "\n";
+}
+async function scaffoldFoundationSkill(config, profile, targetRoot) {
+  const resolvedRoot = resolveConfiguredRoot(targetRoot);
+  const configuredRoots = config.skillsRoots.map(resolveConfiguredRoot);
+  if (!configuredRoots.includes(resolvedRoot)) {
+    throw new UserError(`refusing to scaffold a foundation skill under ${resolvedRoot}: not one of the configured skillsRoots`);
+  }
+  if (!isDir(resolvedRoot)) {
+    throw new UserError(`skills root does not exist: ${resolvedRoot}`);
+  }
+  const destDir = join16(resolvedRoot, "business-foundation");
+  let destLstat;
+  try {
+    destLstat = lstatSync(destDir);
+  } catch {
+    destLstat = void 0;
+  }
+  if (destLstat?.isSymbolicLink()) {
+    throw new UserError(`refusing to scaffold a foundation skill at ${destDir}: destination is a symlink`);
+  }
+  if (destLstat) {
+    throw new UserError(`refusing to scaffold a foundation skill at ${destDir}: already exists`);
+  }
+  const content = renderFoundationSkillMd(profile);
+  const tempDir = mkdtempSync2(join16(resolvedRoot, ".business-foundation-"));
+  try {
+    writeFileSync5(join16(tempDir, "SKILL.md"), content, { flag: "wx", mode: 384 });
+    const safety = await scanSafety(tempDir, config.strictness);
+    if (safety.verdict === "block") {
+      throw new UserError(
+        `refusing to scaffold a foundation skill: the generated SKILL.md was flagged by the safety scan (${safety.findings.map(formatSafetyFinding).join("; ")})`
+      );
+    }
+    renameSync3(tempDir, destDir);
+  } catch (err) {
+    rmSync4(tempDir, { recursive: true, force: true });
+    throw err;
+  }
+  try {
+    appendProvenance(
+      {
+        name: "business-foundation",
+        source: "skill-forge audit (business profile)",
+        verb: "DEFER",
+        target: destDir,
+        took: "scaffolded a new business-foundation skill from the captured business profile",
+        notes: "scaffolded by skill-forge audit"
+      },
+      resolvedRoot
+    );
+  } catch (err) {
+    throw new UserError(
+      `the business-foundation skill was created at ${destDir}, but recording the provenance entry failed: ${err.message}`
+    );
+  }
+  return destDir;
 }
 
 // src/decision.ts
-import { createInterface as createInterface2 } from "readline/promises";
+import { createInterface } from "readline/promises";
 function logOutcome(message, json) {
   if (json) console.error(message);
   else console.log(message);
@@ -2523,7 +3193,7 @@ function yesDecision(verdict) {
   return verdict === "block" ? "reject" : "promote";
 }
 async function promptDecision(verdict, subject) {
-  const rl = createInterface2({ input: process.stdin, output: process.stdout });
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
   const defaultChoice = verdict === "block" ? "reject" : verdict === "warn" ? "hold" : "promote";
   const prompt = `Promote, hold, or reject ${subject}? [promote/hold/reject] (default: ${defaultChoice}) `;
   try {
@@ -2542,6 +3212,326 @@ ${prompt}`);
   }
 }
 
+// src/commands/audit.ts
+var CURATION_PROMPT_ASSET = "curation-prompt.md";
+function splitCsv(s) {
+  return s.split(",").map((x) => x.trim()).filter(Boolean);
+}
+async function askAnswer(rl, prompt) {
+  return (await rl.question(prompt)).trim().toLowerCase();
+}
+async function captureBusinessProfile(rl, existing) {
+  console.log("\n[skill-forge] Business profile \u2014 grounds the business-foundation skill scaffold and the curation handoff prompt.");
+  console.log(
+    "[skill-forge] Do not enter credentials, API keys, tokens, or confidential customer data \u2014 this is stored in plain text in config.json."
+  );
+  if (existing) {
+    const keep = await askAnswer(rl, `Reuse the existing business profile (captured ${existing.updatedAt})? [Y/n] `);
+    if (keep === "" || keep === "y" || keep === "yes") return existing;
+  }
+  const businessName = (await rl.question("Business name (optional, Enter to skip): ")).trim() || void 0;
+  const industry = (await rl.question("Industry (optional, Enter to skip): ")).trim() || void 0;
+  const audiences = splitCsv(await rl.question("Audiences (comma-separated, optional): "));
+  const workflows = splitCsv(await rl.question("Workflows (comma-separated, optional): "));
+  const constraints = splitCsv(await rl.question("Constraints (comma-separated, optional): "));
+  const profile = { businessName, industry, audiences, workflows, constraints, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+  console.log("\n[skill-forge] Business profile summary:");
+  console.log(`  Business name: ${profile.businessName ?? "(none)"}`);
+  console.log(`  Industry:      ${profile.industry ?? "(none)"}`);
+  console.log(`  Audiences:     ${profile.audiences.join(", ") || "(none)"}`);
+  console.log(`  Workflows:     ${profile.workflows.join(", ") || "(none)"}`);
+  console.log(`  Constraints:   ${profile.constraints.join(", ") || "(none)"}`);
+  const confirm = await askAnswer(rl, "Save this business profile? [Y/n] ");
+  if (confirm === "n" || confirm === "no") return existing;
+  return profile;
+}
+function resolveReportPath(reportOption) {
+  if (reportOption) return resolvePath3(reportOption);
+  const iso = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  return join17(getHomeDir(), "reports", `audit-${iso}.md`);
+}
+function writeReport(reportPath, contents) {
+  mkdirSync6(dirname6(reportPath), { recursive: true });
+  try {
+    writeFileSync6(reportPath, contents, { flag: "wx", mode: 384 });
+  } catch (err) {
+    if (err.code === "EEXIST") {
+      throw new UserError(`report file already exists: ${reportPath} \u2014 pass a different --report path`);
+    }
+    throw err;
+  }
+}
+function printTerminalSummary(report, reportPath) {
+  const { summary } = report;
+  console.log("[skill-forge] audit complete");
+  console.log(`  skill roots: ${summary.rootCount}  skills: ${summary.skillCount}  MCP targets: ${summary.mcpTargetCount}`);
+  console.log(
+    `  findings: ${summary.findingCounts.CRITICAL} CRITICAL, ${summary.findingCounts.HIGH} HIGH, ${summary.findingCounts.MEDIUM} MEDIUM, ${summary.findingCounts.LOW} LOW`
+  );
+  console.log(`  overlap clusters: ${summary.overlapClusterCount}  evolve-eligible: ${summary.evolveEligibleCount}`);
+  console.log(`  report -> ${reportPath}`);
+  for (const notice of report.notices) console.log(`  [notice] ${notice}`);
+  console.log(
+    "  next steps: `skill-forge add <source>` to install something new; `skill-forge evolve <skill-dir>` to refine an evolve-eligible skill."
+  );
+}
+async function maybeScaffoldFoundation(config, report, options, rl) {
+  let wantFoundation = options.foundation ?? false;
+  if (!wantFoundation && rl && config.businessProfile && report.opportunities.foundation.available) {
+    const answer = await askAnswer(rl, "\nCreate a business-foundation skill now? [y/N] ");
+    wantFoundation = answer === "y" || answer === "yes";
+  }
+  if (!wantFoundation) return config;
+  if (!config.businessProfile) {
+    throw new UserError(
+      "--foundation requires a business profile \u2014 run `skill-forge audit` interactively first to capture one."
+    );
+  }
+  const targetRoot = config.defaultTarget ?? config.skillsRoots[0];
+  if (!targetRoot) {
+    throw new UserError("cannot scaffold a foundation skill: no skills root configured.");
+  }
+  const foundationPath = await scaffoldFoundationSkill(config, config.businessProfile, targetRoot);
+  const updated = { ...config, foundationSkillPath: foundationPath };
+  saveConfig(updated);
+  logOutcome(`[skill-forge] scaffolded business-foundation skill -> ${foundationPath}`, options.json);
+  return updated;
+}
+async function maybeHandoff(config, reportPath, options, rl) {
+  let wantHandoff = options.handoff ?? false;
+  if (!wantHandoff && rl) {
+    const answer = await askAnswer(rl, "\nHand the curation report to a coding agent now? [y/N] ");
+    wantHandoff = answer === "y" || answer === "yes";
+  }
+  if (!wantHandoff) return;
+  runHandoff(config, reportPath, { promptAsset: CURATION_PROMPT_ASSET, log: options.json ? console.error : console.log });
+}
+async function auditCommand(options = {}) {
+  await maybeOfferInit({ json: options.json, yes: options.yes, suppressAuditOffer: true });
+  if (!existsSync14(getConfigPath())) {
+    throw new UserError(
+      "no skill-forge config found \u2014 run `skill-forge init` first (audit requires a configured skill/MCP set; it never audits an invented default)."
+    );
+  }
+  let config = loadConfig();
+  const interactive = !options.json && !options.yes && Boolean(process.stdin.isTTY);
+  const rl = interactive ? createInterface2({ input: process.stdin, output: process.stdout }) : void 0;
+  try {
+    if (rl) {
+      const profile = await captureBusinessProfile(rl, config.businessProfile);
+      if (profile !== config.businessProfile) {
+        config = { ...config, businessProfile: profile };
+        saveConfig(config);
+      }
+    }
+    const report = await auditConfiguredSet(config);
+    const reportPath = resolveReportPath(options.report);
+    writeReport(reportPath, renderAuditMarkdown(report));
+    if (options.json) {
+      console.log(JSON.stringify(report, null, 2));
+    } else {
+      printTerminalSummary(report, reportPath);
+    }
+    config = await maybeScaffoldFoundation(config, report, options, rl);
+    await maybeHandoff(config, reportPath, options, rl);
+  } finally {
+    rl?.close();
+  }
+}
+
+// src/commands/init.ts
+function detectAgents(cwd, home) {
+  const found = [];
+  for (const agent of AGENTS) {
+    const hit = detectAgentRoot(agent, cwd, home);
+    if (hit) found.push({ agent, ...hit });
+  }
+  return found;
+}
+function detectMcpTargets(cwd, home) {
+  const found = [];
+  for (const agent of AGENTS) {
+    for (const hit of detectMcpConfigFiles(agent, cwd, home)) {
+      found.push({ agent, ...hit });
+    }
+  }
+  return found;
+}
+function printDetectionResults(detected) {
+  console.log(`[skill-forge] init \u2014 agent detection (${AGENTS.length} known agents)`);
+  if (detected.length === 0) {
+    console.log("  none detected");
+    return;
+  }
+  for (const d of detected) {
+    console.log(`  ${d.agent.displayName} (${d.agent.id}) \u2014 ${d.scope}: ${d.root}`);
+  }
+}
+function printMcpDetectionResults(detectedMcp) {
+  if (detectedMcp.length === 0) return;
+  console.log("\n[skill-forge] init \u2014 MCP config detection");
+  for (const d of detectedMcp) {
+    console.log(`  ${d.agent.displayName} (${d.agent.id}) \u2014 ${d.scope}: ${d.path}`);
+  }
+}
+function handoffTemplateFor(agent) {
+  return agent.defaultHandoffTemplate ?? [agent.id, "-p", HANDOFF_INSTRUCTION];
+}
+function buildConfig(selected, defaultTargetEntry, handoffAgent, selectedMcp = []) {
+  const existing = loadConfig();
+  return {
+    ...existing,
+    // Skill-root selections are only overwritten when this run actually offered a choice —
+    // an mcp-only run (no skill roots detected) must not blank out an existing skillsRoots/agents.
+    skillsRoots: selected.length > 0 ? selected.map((s) => s.root) : existing.skillsRoots,
+    agents: selected.length > 0 ? selected.map((s) => ({ id: s.agent.id, skillsRoot: s.root })) : existing.agents,
+    defaultTarget: defaultTargetEntry?.root ?? existing.defaultTarget,
+    handoffCommand: handoffAgent ? handoffTemplateFor(handoffAgent) : existing.handoffCommand,
+    mcpTargets: selectedMcp.length > 0 ? selectedMcp.map((m) => m.path) : existing.mcpTargets
+  };
+}
+function printSummary(config) {
+  console.log(`
+[skill-forge] wrote config to ${getConfigPath()}`);
+  console.log(`  gate targets: ${config.skillsRoots.join(", ")}`);
+  if (config.defaultTarget) console.log(`  default target: ${config.defaultTarget}`);
+  if (config.handoffCommand?.length) console.log(`  handoff command: ${config.handoffCommand.join(" ")}`);
+  if (config.mcpTargets?.length) console.log(`  mcp targets: ${config.mcpTargets.join(", ")}`);
+}
+function parseChoice(answer, max) {
+  const n = Number(answer);
+  return Number.isInteger(n) && n >= 1 && n <= max ? n - 1 : void 0;
+}
+async function promptMultiSelect(rl, detected) {
+  const chosen = new Set(detected.map((_, i) => i));
+  for (; ; ) {
+    console.log("\nGate targets (all detected roots pre-selected \u2014 type a number to toggle, Enter to confirm):");
+    detected.forEach((d, i) => {
+      const mark = chosen.has(i) ? "[x]" : "[ ]";
+      console.log(`  ${mark} ${i + 1}. ${d.agent.displayName} (${d.scope}) \u2014 ${d.root}`);
+    });
+    const answer = (await rl.question("> ")).trim();
+    if (answer === "") break;
+    const idx = parseChoice(answer, detected.length);
+    if (idx !== void 0) {
+      if (chosen.has(idx)) chosen.delete(idx);
+      else chosen.add(idx);
+    } else {
+      console.log("  (invalid selection \u2014 enter a listed number, or press Enter to confirm)");
+    }
+  }
+  return detected.filter((_, i) => chosen.has(i));
+}
+async function promptMcpMultiSelect(rl, detectedMcp) {
+  const chosen = new Set(detectedMcp.map((_, i) => i));
+  for (; ; ) {
+    console.log("\nMCP targets (all detected config files pre-selected \u2014 type a number to toggle, Enter to confirm):");
+    detectedMcp.forEach((d, i) => {
+      const mark = chosen.has(i) ? "[x]" : "[ ]";
+      console.log(`  ${mark} ${i + 1}. ${d.agent.displayName} (${d.scope}) \u2014 ${d.path}`);
+    });
+    const answer = (await rl.question("> ")).trim();
+    if (answer === "") break;
+    const idx = parseChoice(answer, detectedMcp.length);
+    if (idx !== void 0) {
+      if (chosen.has(idx)) chosen.delete(idx);
+      else chosen.add(idx);
+    } else {
+      console.log("  (invalid selection \u2014 enter a listed number, or press Enter to confirm)");
+    }
+  }
+  return detectedMcp.filter((_, i) => chosen.has(i));
+}
+async function promptDefaultTarget(rl, selected) {
+  console.log("\nDefault promotion target:");
+  selected.forEach((d, i) => console.log(`  ${i + 1}. ${d.agent.displayName} \u2014 ${d.root}`));
+  const answer = (await rl.question(`Choose [1-${selected.length}] (default 1): `)).trim();
+  const idx = answer === "" ? 0 : parseChoice(answer, selected.length) ?? 0;
+  return selected[idx];
+}
+async function promptHandoffAgent(rl, detected) {
+  console.log("\nHandoff agent (used to hand off follow-up prompts after promotion; optional):");
+  detected.forEach((d, i) => {
+    const note = d.agent.defaultHandoffTemplate ? "" : " (no confirmed CLI \u2014 best-effort)";
+    console.log(`  ${i + 1}. ${d.agent.displayName}${note}`);
+  });
+  const answer = (await rl.question(`Choose [1-${detected.length}] or Enter to skip: `)).trim();
+  if (answer === "") return void 0;
+  const idx = parseChoice(answer, detected.length);
+  return idx === void 0 ? void 0 : detected[idx].agent;
+}
+async function init(options = {}, deps = {}) {
+  const runAudit = deps.runAudit ?? auditCommand;
+  const cwd = options.cwd ?? process.cwd();
+  const home = options.home ?? homedir4();
+  const detected = detectAgents(cwd, home);
+  const detectedMcp = detectMcpTargets(cwd, home);
+  if (options.list) {
+    printDetectionResults(detected);
+    printMcpDetectionResults(detectedMcp);
+    return;
+  }
+  if (detected.length === 0 && detectedMcp.length === 0) {
+    console.log("[skill-forge] No known agent skill directories or MCP config files were found.");
+    console.log("  Install a coding agent (Claude Code, Codex, Cursor, ...) or create a skills root, then re-run `skill-forge init`.");
+    return;
+  }
+  if (options.defaults) {
+    const config = buildConfig(detected, detected[0], void 0, detectedMcp);
+    saveConfig(config);
+    printSummary(config);
+    await runAudit({ yes: true });
+    return;
+  }
+  if (!process.stdin.isTTY) {
+    console.log("[skill-forge] Not an interactive terminal \u2014 run with --defaults for non-interactive setup.");
+    return;
+  }
+  printDetectionResults(detected);
+  printMcpDetectionResults(detectedMcp);
+  const rl = createInterface3({ input: process.stdin, output: process.stdout });
+  let runAuditNow = false;
+  try {
+    const selected = detected.length > 0 ? await promptMultiSelect(rl, detected) : [];
+    const selectedMcp = detectedMcp.length > 0 ? await promptMcpMultiSelect(rl, detectedMcp) : [];
+    if (selected.length === 0 && selectedMcp.length === 0) {
+      console.log("[skill-forge] No targets selected \u2014 aborting, nothing written.");
+      return;
+    }
+    const target = selected.length > 0 ? await promptDefaultTarget(rl, selected) : void 0;
+    const handoffAgent = detected.length > 0 ? await promptHandoffAgent(rl, detected) : void 0;
+    const config = buildConfig(selected, target, handoffAgent, selectedMcp);
+    saveConfig(config);
+    printSummary(config);
+    if (options.offerAudit !== false) {
+      const answer = (await rl.question("\nRun the skills & MCP audit now? [Y/n] ")).trim().toLowerCase();
+      runAuditNow = answer === "" || answer === "y" || answer === "yes";
+    }
+  } finally {
+    rl.close();
+  }
+  if (runAuditNow) {
+    await runAudit();
+  }
+}
+async function maybeOfferInit(options = {}) {
+  if (options.json || options.yes || !process.stdin.isTTY) return;
+  if (existsSync15(getConfigPath())) return;
+  console.log(
+    "[skill-forge] No config found \u2014 run `skill-forge init` to detect your agents and set gate targets (init finishes with a `skill-forge audit` health check over what it just configured)."
+  );
+  const rl = createInterface3({ input: process.stdin, output: process.stdout });
+  let answer = "";
+  try {
+    answer = (await rl.question("Run `skill-forge init` now? [y/N] ")).trim().toLowerCase();
+  } finally {
+    rl.close();
+  }
+  if (answer === "y" || answer === "yes") {
+    await init(options.suppressAuditOffer ? { offerAudit: false } : {});
+  }
+}
+
 // src/commands/add.ts
 var PRO_FEATURE_LABEL = "overlap analysis, the provenance ledger, and the pending-ingestion queue";
 var MCP_PRO_FEATURE_LABEL = "overlap analysis and the pending-ingestion queue";
@@ -2669,7 +3659,7 @@ async function addMcp(source, config, options) {
       envVars: detail.env ? Object.keys(detail.env) : void 0,
       candidateEntry: detail.command ? { command: detail.command, args: detail.args, env: detail.env } : void 0
     };
-    const mcpTargetPath = options.mcpTarget ?? config.mcpTargets?.[0] ?? join16(process.cwd(), ".mcp.json");
+    const mcpTargetPath = options.mcpTarget ?? config.mcpTargets?.[0] ?? join18(process.cwd(), ".mcp.json");
     const result = promoteMcp(entry, serverProfile, mcpTargetPath, { force: options.force });
     reject(entry);
     logOutcome(`[skill-forge] promoted -> ${result.target} (server "${result.serverName}")`, options.json);
@@ -2764,7 +3754,7 @@ async function scan(source, options = {}) {
 }
 
 // src/commands/list.ts
-import { join as join17 } from "path";
+import { join as join19 } from "path";
 async function list() {
   await maybeOfferInit();
   const config = loadConfig();
@@ -2777,14 +3767,14 @@ async function list() {
   }
   console.log(`[skill-forge] ${ids.length} held in quarantine (${quarantineDir}):`);
   for (const id of ids) {
-    const skillDirs = findSkillDirs(join17(quarantineDir, id));
+    const skillDirs = findSkillDirs(join19(quarantineDir, id));
     if (skillDirs.length === 0) {
       console.log(`  ${id}  (no SKILL.md found)`);
       continue;
     }
     const names = skillDirs.map((dir) => {
       try {
-        return readFrontmatter(join17(dir, "SKILL.md")).name;
+        return readFrontmatter(join19(dir, "SKILL.md")).name;
       } catch {
         return dir;
       }
@@ -2806,19 +3796,19 @@ async function status() {
 }
 
 // src/evolve.ts
-import { createInterface as createInterface3 } from "readline/promises";
+import { createInterface as createInterface4 } from "readline/promises";
 import { createHash } from "crypto";
-import { cpSync as cpSync3, existsSync as existsSync14, lstatSync, mkdtempSync as mkdtempSync2, readFileSync as readFileSync10, rmSync as rmSync3 } from "fs";
+import { cpSync as cpSync3, existsSync as existsSync16, lstatSync as lstatSync2, mkdtempSync as mkdtempSync3, readFileSync as readFileSync12, rmSync as rmSync5 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { basename as basename6, dirname as dirname6, join as join18, resolve as resolvePath2, sep } from "path";
+import { basename as basename7, dirname as dirname7, join as join20, resolve as resolvePath4, sep } from "path";
 var SKILLOPT_BIN = "skillopt-sleep";
 var PRO_FEATURE_LABEL2 = "self-evolution via SkillOpt-Sleep (evolve) \u2014 re-gating, provenance, and the pending-ingestion queue";
 async function evolve(targetSkillDir, options = {}, deps = {}) {
   const exec = deps.exec ?? defaultExec;
   const json = options.json;
-  const resolvedTargetDir = resolvePath2(targetSkillDir);
-  const skillMdPath = join18(resolvedTargetDir, "SKILL.md");
-  if (!existsSync14(skillMdPath)) {
+  const resolvedTargetDir = resolvePath4(targetSkillDir);
+  const skillMdPath = join20(resolvedTargetDir, "SKILL.md");
+  if (!existsSync16(skillMdPath)) {
     throw new UserError(`no SKILL.md found at ${skillMdPath} \u2014 evolve requires an existing, installed skill directory`);
   }
   const proStatus = proFeatureStatus(PRO_FEATURE_LABEL2);
@@ -2845,7 +3835,7 @@ async function evolve(targetSkillDir, options = {}, deps = {}) {
   } else {
     notices.push('using the offline "mock" backend \u2014 deterministic, no network calls, no session data leaves this machine.');
   }
-  const project = resolvePath2(options.project ?? process.cwd());
+  const project = resolvePath4(options.project ?? process.cwd());
   const present = await detectSkillopt(exec, project);
   if (!present) {
     throw new UserError(
@@ -2876,40 +3866,40 @@ async function evolve(targetSkillDir, options = {}, deps = {}) {
     }
     return;
   }
-  const stagingRoot = join18(project, ".skillopt-sleep", "staging");
-  const stagingDir = resolvePath2(parsed.staging_dir);
+  const stagingRoot = join20(project, ".skillopt-sleep", "staging");
+  const stagingDir = resolvePath4(parsed.staging_dir);
   if (stagingDir !== stagingRoot && !stagingDir.startsWith(stagingRoot + sep)) {
     throw new UserError(
       `skillopt-sleep reported a staging_dir outside the expected sandbox (${stagingRoot}): ${stagingDir} \u2014 refusing to use it`
     );
   }
-  const proposedSkillMd = join18(stagingDir, "proposed_SKILL.md");
-  const proposedClaudeMd = join18(stagingDir, "proposed_CLAUDE.md");
-  const reportMdPath = join18(stagingDir, "report.md");
-  if (!existsSync14(proposedSkillMd)) {
+  const proposedSkillMd = join20(stagingDir, "proposed_SKILL.md");
+  const proposedClaudeMd = join20(stagingDir, "proposed_CLAUDE.md");
+  const reportMdPath = join20(stagingDir, "report.md");
+  if (!existsSync16(proposedSkillMd)) {
     throw new UserError(`skillopt-sleep reported an accepted proposal but ${proposedSkillMd} is missing`);
   }
-  if (existsSync14(reportMdPath)) {
+  if (existsSync16(reportMdPath)) {
     notices.push(`SkillOpt-Sleep's full report: ${reportMdPath}`);
   }
   assertNotSymlink(proposedSkillMd, "proposed_SKILL.md");
   assertNotSymlink(proposedClaudeMd, "proposed_CLAUDE.md");
   const scannedSkillHash = sha256File(proposedSkillMd);
   const scannedClaudeHash = sha256File(proposedClaudeMd);
-  const tempDir = mkdtempSync2(join18(tmpdir2(), "skill-forge-evolve-"));
+  const tempDir = mkdtempSync3(join20(tmpdir2(), "skill-forge-evolve-"));
   let profile;
   let safety;
   try {
-    cpSync3(proposedSkillMd, join18(tempDir, "SKILL.md"));
-    if (existsSync14(proposedClaudeMd)) {
-      cpSync3(proposedClaudeMd, join18(tempDir, "CLAUDE.md"));
+    cpSync3(proposedSkillMd, join20(tempDir, "SKILL.md"));
+    if (existsSync16(proposedClaudeMd)) {
+      cpSync3(proposedClaudeMd, join20(tempDir, "CLAUDE.md"));
     }
     profile = asSkillProfile(profileSkill(tempDir), "for the evolved proposal");
     const strictness = loadConfig().strictness;
     safety = await scanSafety(tempDir, strictness);
   } finally {
     try {
-      rmSync3(tempDir, { recursive: true, force: true });
+      rmSync5(tempDir, { recursive: true, force: true });
     } catch (err) {
       console.error(`[skill-forge] failed to clean up temp re-gate dir ${tempDir}: ${err.message}`);
     }
@@ -2944,12 +3934,12 @@ async function evolve(targetSkillDir, options = {}, deps = {}) {
       throw new UserError(`skillopt-sleep adopt failed (exit ${adoptResult.code}): ${tail(adoptResult.stderr || adoptResult.stdout)}`);
     }
     logOutcome(`[skill-forge] adopted -> ${resolvedTargetDir}`, json);
-    const skillsRootForProvenance = dirname6(resolvedTargetDir);
+    const skillsRootForProvenance = dirname7(resolvedTargetDir);
     let ledgerPath;
     try {
       ledgerPath = appendProvenance(
         {
-          name: profile.name ?? basename6(resolvedTargetDir),
+          name: profile.name ?? basename7(resolvedTargetDir),
           source: resolvedTargetDir,
           version: profile.version,
           license: profile.license,
@@ -2984,138 +3974,1052 @@ async function evolve(targetSkillDir, options = {}, deps = {}) {
         origin: "evolve"
       });
     } catch (err) {
-      throw new UserError(
-        `adopt succeeded and the live skill at ${resolvedTargetDir} has already changed (provenance was recorded), but appending the pending-ingestion queue entry failed: ${err.message}`
-      );
+      throw new UserError(
+        `adopt succeeded and the live skill at ${resolvedTargetDir} has already changed (provenance was recorded), but appending the pending-ingestion queue entry failed: ${err.message}`
+      );
+    }
+    logOutcome("[skill-forge] queued for ingestion review", json);
+  } else if (decision === "reject") {
+    try {
+      rmSync5(stagingDir, { recursive: true, force: true });
+    } catch (err) {
+      throw new UserError(
+        `rejected the proposal, but removing the staging dir ${stagingDir} failed: ${err.message} \u2014 remove it manually.`
+      );
+    }
+    logOutcome("[skill-forge] rejected \u2014 staging dir removed", json);
+    if (safetyVerdict === "block") process.exitCode = 1;
+  } else {
+    logOutcome(`[skill-forge] held \u2014 staging dir left in place -> ${stagingDir}`, json);
+    if (existsSync16(reportMdPath)) {
+      logOutcome(`[skill-forge] see ${reportMdPath} for the full evidence report`, json);
+    }
+  }
+}
+async function defaultConfirm(question) {
+  const rl = createInterface4({ input: process.stdin, output: process.stdout });
+  try {
+    process.stdout.write(question);
+    for await (const raw of rl) {
+      return /^y(es)?$/i.test(raw.trim());
+    }
+    return false;
+  } finally {
+    rl.close();
+  }
+}
+async function detectSkillopt(exec, cwd) {
+  try {
+    const result = await exec(SKILLOPT_BIN, ["--help"], { cwd });
+    return result.code === 0;
+  } catch {
+    return false;
+  }
+}
+function tail(text, maxLines = 20) {
+  return text.trim().split("\n").slice(-maxLines).join("\n");
+}
+function validateRunOutput(raw) {
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    throw new UserError(`skillopt-sleep produced unexpected JSON output (expected an object): ${JSON.stringify(raw)}`);
+  }
+  const obj = raw;
+  const stagingDirRaw = obj.staging_dir;
+  if (stagingDirRaw !== null && stagingDirRaw !== void 0 && typeof stagingDirRaw !== "string") {
+    throw new UserError(
+      `skillopt-sleep produced an unexpected "staging_dir" (expected a string or null): ${JSON.stringify(stagingDirRaw)}`
+    );
+  }
+  return { accepted: Boolean(obj.accepted), staging_dir: stagingDirRaw ?? null };
+}
+function readManifest(stagingDir) {
+  const manifestPath = join20(stagingDir, "manifest.json");
+  let raw;
+  try {
+    raw = readFileSync12(manifestPath, "utf-8");
+  } catch (err) {
+    throw new UserError(`could not read staging manifest ${manifestPath}: ${err.message}`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new UserError(`could not parse staging manifest ${manifestPath}: ${err.message}`);
+  }
+  return validateManifest(parsed, manifestPath);
+}
+function validateManifest(raw, manifestPath) {
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    throw new UserError(`staging manifest ${manifestPath} has an unexpected shape (expected an object)`);
+  }
+  const obj = raw;
+  if (typeof obj.live_skill_path !== "string") {
+    throw new UserError(`staging manifest ${manifestPath} is missing a valid "live_skill_path" string`);
+  }
+  if (obj.live_memory_path !== void 0 && obj.live_memory_path !== null && typeof obj.live_memory_path !== "string") {
+    throw new UserError(`staging manifest ${manifestPath} has an unexpected "live_memory_path" (expected a string or null)`);
+  }
+  if (typeof obj.has_skill !== "boolean" || typeof obj.has_memory !== "boolean") {
+    throw new UserError(`staging manifest ${manifestPath} is missing valid "has_skill"/"has_memory" booleans`);
+  }
+  return {
+    live_skill_path: obj.live_skill_path,
+    live_memory_path: obj.live_memory_path ?? null,
+    has_skill: obj.has_skill,
+    has_memory: obj.has_memory
+  };
+}
+function filesIdentical(a, b) {
+  if (!existsSync16(a) || !existsSync16(b)) return false;
+  return readFileSync12(a).equals(readFileSync12(b));
+}
+function isAlreadyAdopted(stagingDir, manifest) {
+  const proposedSkillMd = join20(stagingDir, "proposed_SKILL.md");
+  const proposedClaudeMd = join20(stagingDir, "proposed_CLAUDE.md");
+  let sawComparison = false;
+  if (existsSync16(proposedSkillMd)) {
+    sawComparison = true;
+    if (!filesIdentical(proposedSkillMd, manifest.live_skill_path)) return false;
+  }
+  if (existsSync16(proposedClaudeMd) && manifest.live_memory_path) {
+    sawComparison = true;
+    if (!filesIdentical(proposedClaudeMd, manifest.live_memory_path)) return false;
+  }
+  return sawComparison;
+}
+function assertNotSymlink(path, label) {
+  let stat;
+  try {
+    stat = lstatSync2(path);
+  } catch {
+    return;
+  }
+  if (stat.isSymbolicLink()) {
+    throw new UserError(`refusing to re-gate ${label}: ${path} is a symlink (a staged proposal must be a plain file)`);
+  }
+}
+function sha256File(path) {
+  if (!existsSync16(path)) return null;
+  return createHash("sha256").update(readFileSync12(path)).digest("hex");
+}
+
+// src/commands/evolve.ts
+async function evolveCommand(targetSkillDir, options = {}) {
+  await evolve(targetSkillDir, options);
+}
+
+// src/commands/organize.ts
+import { mkdirSync as mkdirSync7, writeFileSync as writeFileSync7 } from "fs";
+import { dirname as dirname8, resolve as resolvePath6 } from "path";
+
+// src/organize.ts
+import { existsSync as existsSync17, readFileSync as readFileSync13, readdirSync as readdirSync7, realpathSync as realpathSync2, statSync as statSync9 } from "fs";
+import { basename as basename8, join as join21, resolve as resolvePath5 } from "path";
+var PRO_FEATURE_LABEL3 = "set-level organizer reports";
+var TIERS = /* @__PURE__ */ new Set(["resource", "custom"]);
+var MATURITIES = /* @__PURE__ */ new Set(["seedling", "stable", "deprecated"]);
+function listSubdirs2(dir) {
+  let entries;
+  try {
+    entries = readdirSync7(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const entry of entries) {
+    const full = join21(dir, entry.name);
+    if (entry.isDirectory()) {
+      out.push(full);
+      continue;
+    }
+    if (entry.isSymbolicLink()) {
+      try {
+        if (statSync9(full).isDirectory()) out.push(full);
+      } catch {
+      }
+    }
+  }
+  return out;
+}
+function findSkillDirsUnderRoot2(root) {
+  const found = /* @__PURE__ */ new Set();
+  const topDirs = listSubdirs2(root);
+  for (const dir of topDirs) {
+    if (existsSync17(join21(dir, "SKILL.md"))) found.add(dir);
+  }
+  for (const dir of listSubdirs2(join21(root, "skills"))) {
+    if (existsSync17(join21(dir, "SKILL.md"))) found.add(dir);
+  }
+  for (const topDir of topDirs) {
+    for (const dir of listSubdirs2(join21(topDir, "skills"))) {
+      if (existsSync17(join21(dir, "SKILL.md"))) found.add(dir);
+    }
+  }
+  return Array.from(found).filter((p) => !p.includes("/.git/"));
+}
+function collectCandidates(roots) {
+  const out = [];
+  for (const root of roots) {
+    const resolvedRoot = resolvePath5(expandHome(root));
+    if (!isDir(resolvedRoot)) continue;
+    for (const dirPath of findSkillDirsUnderRoot2(resolvedRoot)) {
+      out.push({ dirPath, root });
+    }
+  }
+  return out;
+}
+function parseYamlList(block, key) {
+  const inlineMatch = block.match(new RegExp(`^${key}:\\s*\\[(.*?)\\]\\s*$`, "m"));
+  if (inlineMatch) {
+    return inlineMatch[1].split(",").map((x) => stripQuotes(x.trim())).filter(Boolean);
+  }
+  if (!new RegExp(`^${key}:\\s*$`, "m").test(block)) return [];
+  const lines = block.split(/\r\n|\r|\n/);
+  const startIdx = lines.findIndex((l) => new RegExp(`^${key}:\\s*$`).test(l));
+  if (startIdx === -1) return [];
+  const out = [];
+  for (const line of lines.slice(startIdx + 1)) {
+    const itemMatch = line.match(/^\s*-\s*(.+)$/);
+    if (itemMatch) {
+      out.push(stripQuotes(itemMatch[1].trim()));
+    } else if (line.trim() === "") {
+      continue;
+    } else {
+      break;
+    }
+  }
+  return out;
+}
+function extractFrontmatterBlock(text) {
+  if (!text.startsWith("---\n")) return null;
+  const afterOpen = text.slice(4);
+  const closeIdx = afterOpen.indexOf("\n---");
+  if (closeIdx === -1) return null;
+  return afterOpen.slice(0, closeIdx);
+}
+function parseCapabilityFrontmatter(text, fallbackName) {
+  const block = extractFrontmatterBlock(text);
+  if (block === null) {
+    return { name: fallbackName, consumes: [], validFrontmatter: false };
+  }
+  const fields = {};
+  for (const key of ["name", "tier", "domain", "provenance", "maturity"]) {
+    const m = block.match(new RegExp(`^${key}:\\s*(.+)$`, "m"));
+    if (m) fields[key] = stripQuotes(m[1].trim());
+  }
+  return {
+    name: fields.name ?? fallbackName,
+    tier: fields.tier,
+    domain: fields.domain,
+    provenance: fields.provenance,
+    maturity: fields.maturity,
+    consumes: parseYamlList(block, "consumes"),
+    validFrontmatter: true
+  };
+}
+function loadUsageSnapshot(snapshotPath) {
+  const resolvedPath = resolvePath5(expandHome(snapshotPath));
+  let raw;
+  try {
+    raw = readFileSync13(resolvedPath, "utf-8");
+  } catch (err) {
+    return { usage: /* @__PURE__ */ new Map(), warning: `could not read usage snapshot (${err.message}); proceeding without usage` };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    return { usage: /* @__PURE__ */ new Map(), warning: `could not parse usage snapshot (${err.message}); proceeding without usage` };
+  }
+  const usage = /* @__PURE__ */ new Map();
+  const outer = parsed;
+  const report = outer && typeof outer === "object" ? outer.report : void 0;
+  const topSkills = report && typeof report === "object" ? report.top_skills : void 0;
+  if (Array.isArray(topSkills)) {
+    for (const row of topSkills) {
+      if (Array.isArray(row) && row.length === 2 && typeof row[0] === "string" && typeof row[1] === "number") {
+        const [name, count] = row;
+        usage.set(name, count);
+        if (name.includes(":")) {
+          const bare = name.split(":").pop();
+          if (!usage.has(bare)) usage.set(bare, count);
+        }
+      }
+    }
+  }
+  return { usage };
+}
+var WHITE = 0;
+var GRAY = 1;
+var BLACK = 2;
+function findCycles(adjacency) {
+  const color = /* @__PURE__ */ new Map();
+  for (const id of adjacency.keys()) color.set(id, WHITE);
+  const stack = [];
+  const cycles = [];
+  function dfs(u) {
+    color.set(u, GRAY);
+    stack.push(u);
+    for (const v of adjacency.get(u) ?? []) {
+      if (!color.has(v)) continue;
+      if (color.get(v) === GRAY && stack.includes(v)) {
+        const idx = stack.indexOf(v);
+        cycles.push([...stack.slice(idx), v]);
+      } else if (color.get(v) === WHITE) {
+        dfs(v);
+      }
+    }
+    color.set(u, BLACK);
+    stack.pop();
+  }
+  for (const id of adjacency.keys()) {
+    if (color.get(id) === WHITE) dfs(id);
+  }
+  return cycles;
+}
+function buildGraph(entries, nameToIds) {
+  const nodes = entries.map((e) => ({ id: e.id, name: e.name, tier: e.tier, domain: e.domain }));
+  const edges = [];
+  const dangling = [];
+  const ambiguous = [];
+  const incoming = new Map(entries.map((e) => [e.id, 0]));
+  const adjacency = new Map(entries.map((e) => [e.id, []]));
+  for (const e of entries) {
+    for (const target of e.consumes) {
+      const matches = nameToIds.get(target) ?? [];
+      edges.push({ from: e.id, to: target, resolvedIds: matches });
+      if (matches.length === 0) {
+        dangling.push({ from: e.id, to: target });
+      } else if (matches.length === 1) {
+        incoming.set(matches[0], (incoming.get(matches[0]) ?? 0) + 1);
+        adjacency.get(e.id).push(matches[0]);
+      } else {
+        ambiguous.push({ from: e.id, to: target, matches });
+      }
+    }
+  }
+  const orphans = entries.filter((e) => e.tier === "custom" && e.consumes.length === 0).map((e) => e.id);
+  const byId = new Map(entries.map((e) => [e.id, e]));
+  const hotResources = Array.from(incoming.entries()).filter(([, count]) => count > 0).map(([id, count]) => ({ id, name: byId.get(id).name, consumedBy: count })).sort((a, b) => b.consumedBy - a.consumedBy);
+  const cycles = findCycles(adjacency);
+  return {
+    nodeCount: nodes.length,
+    edgeCount: edges.length,
+    nodes,
+    edges,
+    orphans,
+    hotResources,
+    danglingEdges: dangling,
+    ambiguousConsumesTargets: ambiguous,
+    cycles
+  };
+}
+function buildRegistryEntries(candidates, warnings) {
+  const entries = [];
+  const seenRealPaths = /* @__PURE__ */ new Set();
+  for (const candidate of candidates) {
+    let realPath;
+    try {
+      realPath = realpathSync2(candidate.dirPath);
+    } catch (err) {
+      warnings.push(`could not resolve skill directory ${candidate.dirPath}: ${err.message}`);
+      continue;
     }
-    logOutcome("[skill-forge] queued for ingestion review", json);
-  } else if (decision === "reject") {
+    if (seenRealPaths.has(realPath)) continue;
+    seenRealPaths.add(realPath);
+    const skillMdPath = join21(realPath, "SKILL.md");
+    let text;
     try {
-      rmSync3(stagingDir, { recursive: true, force: true });
+      text = readFileSync13(skillMdPath, "utf-8");
     } catch (err) {
-      throw new UserError(
-        `rejected the proposal, but removing the staging dir ${stagingDir} failed: ${err.message} \u2014 remove it manually.`
-      );
+      warnings.push(`could not read ${skillMdPath}: ${err.message}`);
+      continue;
     }
-    logOutcome("[skill-forge] rejected \u2014 staging dir removed", json);
-    if (safetyVerdict === "block") process.exitCode = 1;
-  } else {
-    logOutcome(`[skill-forge] held \u2014 staging dir left in place -> ${stagingDir}`, json);
-    if (existsSync14(reportMdPath)) {
-      logOutcome(`[skill-forge] see ${reportMdPath} for the full evidence report`, json);
+    const fm = parseCapabilityFrontmatter(text, basename8(realPath));
+    const name = fm.name ?? basename8(realPath);
+    if (fm.tier && !TIERS.has(fm.tier)) {
+      warnings.push(`${name}: tier '${fm.tier}' not in ${JSON.stringify(Array.from(TIERS).sort())}`);
+    }
+    if (fm.maturity && !MATURITIES.has(fm.maturity)) {
+      warnings.push(`${name}: maturity '${fm.maturity}' not in ${JSON.stringify(Array.from(MATURITIES).sort())}`);
     }
+    entries.push({
+      id: realPath,
+      name,
+      path: realPath,
+      root: candidate.root,
+      tier: fm.tier,
+      domain: fm.domain,
+      consumes: fm.consumes,
+      provenance: fm.provenance,
+      maturity: fm.maturity,
+      validFrontmatter: fm.validFrontmatter
+    });
   }
+  return entries;
 }
-async function defaultConfirm(question) {
-  const rl = createInterface3({ input: process.stdin, output: process.stdout });
+function joinUsageSnapshot(entries, snapshotPath, warnings) {
+  const { usage, warning } = loadUsageSnapshot(snapshotPath);
+  if (warning) warnings.push(warning);
+  if (usage.size === 0) return false;
+  for (const entry of entries) {
+    const count = usage.get(entry.name);
+    if (count !== void 0) entry.usage = count;
+  }
+  if (!entries.some((e) => e.usage !== void 0)) {
+    warnings.push(
+      "usage snapshot loaded but 0 skills matched by name \u2014 registry `name:` vs telemetry key mismatch; the usage column will be empty"
+    );
+  }
+  return true;
+}
+function buildNameToIds(entries, warnings) {
+  const nameToIds = /* @__PURE__ */ new Map();
+  for (const e of entries) {
+    const ids = nameToIds.get(e.name) ?? [];
+    ids.push(e.id);
+    nameToIds.set(e.name, ids);
+  }
+  for (const [name, ids] of nameToIds) {
+    if (ids.length > 1) {
+      warnings.push(`duplicate skill name "${name}" across ${ids.length} locations: ${ids.join(", ")}`);
+    }
+  }
+  return nameToIds;
+}
+function findUntagged(entries) {
+  return entries.filter((e) => !e.tier || !e.domain).map((e) => ({
+    id: e.id,
+    name: e.name,
+    missing: [!e.tier ? "tier" : void 0, !e.domain ? "domain" : void 0].filter((v) => Boolean(v))
+  }));
+}
+function countByTierAndDomain(entries) {
+  const byTier = {};
+  const byDomain = {};
+  for (const e of entries) {
+    byTier[e.tier ?? "untagged"] = (byTier[e.tier ?? "untagged"] ?? 0) + 1;
+    byDomain[e.domain ?? "untagged"] = (byDomain[e.domain ?? "untagged"] ?? 0) + 1;
+  }
+  return { byTier, byDomain };
+}
+function buildOrganizeReport(config, options = {}) {
+  const proStatus = proFeatureStatus(PRO_FEATURE_LABEL3);
+  if (!proStatus.enabled) {
+    throw new UserError(proStatus.notice ?? upgradeNotice(PRO_FEATURE_LABEL3));
+  }
+  const notices = proStatus.notice ? [proStatus.notice] : [];
+  const warnings = [];
+  const candidates = collectCandidates(config.skillsRoots);
+  if (candidates.length === 0) {
+    throw new UserError(
+      `no SKILL.md found under any configured skills root (${config.skillsRoots.join(", ") || "(none configured)"})`
+    );
+  }
+  const entries = buildRegistryEntries(candidates, warnings);
+  const usageJoined = options.usageSnapshot ? joinUsageSnapshot(entries, options.usageSnapshot, warnings) : false;
+  const nameToIds = buildNameToIds(entries, warnings);
+  const untagged = findUntagged(entries);
+  const { byTier, byDomain } = countByTierAndDomain(entries);
+  const registry = {
+    skillsRoots: [...config.skillsRoots],
+    count: entries.length,
+    byTier,
+    byDomain,
+    untagged,
+    warnings,
+    usageJoined,
+    skills: entries
+  };
+  const graph = buildGraph(entries, nameToIds);
+  return {
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    registry,
+    graph,
+    notices
+  };
+}
+
+// src/commands/organize.ts
+function writeReport2(outPath, contents) {
+  const resolved = resolvePath6(outPath);
+  mkdirSync7(dirname8(resolved), { recursive: true });
   try {
-    process.stdout.write(question);
-    for await (const raw of rl) {
-      return /^y(es)?$/i.test(raw.trim());
+    writeFileSync7(resolved, contents, { flag: "wx", mode: 384 });
+  } catch (err) {
+    if (err.code === "EEXIST") {
+      throw new UserError(`output file already exists: ${resolved} \u2014 pass a different --out path`);
     }
-    return false;
-  } finally {
-    rl.close();
+    throw err;
+  }
+  return resolved;
+}
+function renderSummary(report) {
+  const { registry, graph } = report;
+  const lines = [];
+  lines.push(`[skill-forge] organize: ${registry.count} skill(s) across ${registry.skillsRoots.length} root(s)`);
+  lines.push(`  by tier:   ${JSON.stringify(registry.byTier)}`);
+  lines.push(`  by domain: ${JSON.stringify(registry.byDomain)}`);
+  lines.push(`  usage joined: ${registry.usageJoined}`);
+  lines.push(`  untagged (missing tier/domain): ${registry.untagged.length}`);
+  for (const u of registry.untagged.slice(0, 30)) {
+    lines.push(`    - ${sanitizeForMarkdown(u.name)}: missing ${u.missing.join(", ")}`);
+  }
+  if (registry.warnings.length > 0) {
+    lines.push("  warnings:");
+    for (const w of registry.warnings) lines.push(`    ! ${sanitizeForMarkdown(w)}`);
+  }
+  lines.push("");
+  lines.push(`  graph: ${graph.nodeCount} nodes, ${graph.edgeCount} edges`);
+  if (graph.hotResources.length > 0) {
+    lines.push("  hot resources (consumed by N customs):");
+    for (const h of graph.hotResources) lines.push(`    ${h.consumedBy}x  ${sanitizeForMarkdown(h.name)}`);
+  }
+  if (graph.danglingEdges.length > 0) {
+    lines.push("  dangling edges (consumes a target not in the set):");
+    for (const d of graph.danglingEdges) lines.push(`    ${sanitizeForMarkdown(d.from)}  ->  ${sanitizeForMarkdown(d.to)}  (missing)`);
+  }
+  if (graph.ambiguousConsumesTargets.length > 0) {
+    lines.push("  ambiguous consumes targets (name matched multiple skills):");
+    for (const a of graph.ambiguousConsumesTargets) {
+      lines.push(
+        `    ${sanitizeForMarkdown(a.from)}  ->  ${sanitizeForMarkdown(a.to)}  (matches: ${a.matches.map(sanitizeForMarkdown).join(", ")})`
+      );
+    }
+  }
+  if (graph.cycles.length > 0) {
+    lines.push("  cycles (consumes should be acyclic):");
+    for (const c of graph.cycles) lines.push(`    ${c.map(sanitizeForMarkdown).join(" -> ")}`);
+  }
+  if (graph.orphans.length > 0) {
+    lines.push(`  custom skills with no declared consumes (${graph.orphans.length}):`);
+    for (const o of graph.orphans.slice(0, 30)) lines.push(`    - ${sanitizeForMarkdown(o)}`);
   }
+  for (const n of report.notices) lines.push(`  [notice] ${sanitizeForMarkdown(n)}`);
+  return lines;
 }
-async function detectSkillopt(exec, cwd) {
+async function organizeCommand(options = {}) {
+  const config = loadConfig();
+  const report = buildOrganizeReport(config, { usageSnapshot: options.usageSnapshot });
+  let outPath;
+  if (options.out) {
+    outPath = writeReport2(options.out, JSON.stringify(report, null, 2) + "\n");
+  }
+  if (options.json) {
+    for (const n of report.notices) console.error(`[skill-forge] ${n}`);
+    console.log(JSON.stringify(report, null, 2));
+    return;
+  }
+  for (const line of renderSummary(report)) console.log(line);
+  if (outPath) console.log(`  report -> ${outPath}`);
+}
+
+// src/gate/skillsShApi.ts
+var SKILLS_SH_ORIGIN = "https://skills.sh";
+var SKILLS_SH_API_BASE = "/api/v1";
+var MAX_RESPONSE_BYTES = 2 * 1024 * 1024;
+var REQUEST_TIMEOUT_MS = 15e3;
+var ID_PATTERN = /^[A-Za-z0-9._/-]+$/;
+var TOKEN_HINT = "No VERCEL_OIDC_TOKEN found. skills.sh authenticates with a short-lived Vercel OIDC token:\n  1. Vercel dashboard -> your project -> Settings -> OIDC Federation -> enable.\n  2. npm i -g vercel && vercel link && vercel env pull   (writes VERCEL_OIDC_TOKEN to .env.local)\n  3. export VERCEL_OIDC_TOKEN from .env.local into your shell before running this command\n  (or set it directly: export VERCEL_OIDC_TOKEN=...)   -   docs: https://skills.sh/docs/api";
+var SkillsShError = class extends Error {
+  exitCode;
+  constructor(message, exitCode) {
+    super(message);
+    this.name = "SkillsShError";
+    this.exitCode = exitCode;
+  }
+};
+var RISK_ORDER = { NONE: 0, LOW: 1, MEDIUM: 2, HIGH: 3, CRITICAL: 4 };
+function getToken(env = process.env) {
+  const tok = env.VERCEL_OIDC_TOKEN;
+  return tok ? tok : void 0;
+}
+function assertValidId(id) {
+  if (id.length === 0 || !ID_PATTERN.test(id)) {
+    throw new SkillsShError(`invalid skills.sh id: ${JSON.stringify(id)}`, 1);
+  }
+}
+function validatedIdSegments(id) {
+  assertValidId(id);
+  const segments = id.split("/");
+  if (segments.some((s) => s === "" || s === "." || s === "..")) {
+    throw new SkillsShError(`invalid skills.sh id: ${JSON.stringify(id)}`, 1);
+  }
+  return segments;
+}
+function buildUrl(pathSegments, params) {
+  const url = new URL(SKILLS_SH_API_BASE + "/" + pathSegments.map((s) => encodeURIComponent(s)).join("/"), SKILLS_SH_ORIGIN);
+  if (params) {
+    const search2 = new URLSearchParams();
+    for (const [k, v] of Object.entries(params)) search2.set(k, String(v));
+    url.search = search2.toString();
+  }
+  return url;
+}
+async function readCappedText(res) {
+  const text = await res.text();
+  if (new TextEncoder().encode(text).length > MAX_RESPONSE_BYTES) {
+    throw new SkillsShError("skills.sh response exceeded the 2 MB size cap", 1);
+  }
+  return text;
+}
+async function call(pathSegments, params, options = {}) {
+  const env = options.env ?? process.env;
+  const token = getToken(env);
+  if (!token) {
+    throw new SkillsShError(TOKEN_HINT, 3);
+  }
+  const url = buildUrl(pathSegments, params);
+  const fetchImpl = options.fetchImpl ?? fetch;
+  let res;
   try {
-    const result = await exec(SKILLOPT_BIN, ["--help"], { cwd });
-    return result.code === 0;
+    res = await fetchImpl(url, {
+      headers: { Authorization: `Bearer ${token}` },
+      redirect: "error",
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+    });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    throw new SkillsShError(`skills.sh request failed: ${message}`, 1);
+  }
+  if (res.status === 404) {
+    return void 0;
+  }
+  if (!res.ok) {
+    if (res.status === 401) {
+      throw new SkillsShError("skills.sh HTTP 401: unauthorized \u2014 the VERCEL_OIDC_TOKEN was rejected (expired or invalid)", 3);
+    }
+    let snippet = "";
+    try {
+      snippet = (await readCappedText(res)).slice(0, 300);
+    } catch {
+    }
+    throw new SkillsShError(`skills.sh HTTP ${res.status}${snippet ? `: ${snippet}` : ""}`, 1);
+  }
+  const text = await readCappedText(res);
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
   } catch {
-    return false;
+    throw new SkillsShError("skills.sh returned malformed JSON", 1);
   }
+  return parsed;
 }
-function tail(text, maxLines = 20) {
-  return text.trim().split("\n").slice(-maxLines).join("\n");
+function isRecord(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
 }
-function validateRunOutput(raw) {
-  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
-    throw new UserError(`skillopt-sleep produced unexpected JSON output (expected an object): ${JSON.stringify(raw)}`);
+async function search(query, limit, options = {}) {
+  const data = await call(["skills", "search"], { q: query, limit }, options);
+  if (!isRecord(data) || !Array.isArray(data.data)) {
+    throw new SkillsShError("skills.sh search response had an unexpected shape", 1);
   }
-  const obj = raw;
-  const stagingDirRaw = obj.staging_dir;
-  if (stagingDirRaw !== null && stagingDirRaw !== void 0 && typeof stagingDirRaw !== "string") {
-    throw new UserError(
-      `skillopt-sleep produced an unexpected "staging_dir" (expected a string or null): ${JSON.stringify(stagingDirRaw)}`
-    );
+  return data;
+}
+async function audit(id, options = {}) {
+  const data = await call(["skills", "audit", ...validatedIdSegments(id)], void 0, options);
+  if (data === void 0) return void 0;
+  if (!isRecord(data) || !Array.isArray(data.audits)) {
+    throw new SkillsShError("skills.sh audit response had an unexpected shape", 1);
   }
-  return { accepted: Boolean(obj.accepted), staging_dir: stagingDirRaw ?? null };
+  return data;
 }
-function readManifest(stagingDir) {
-  const manifestPath = join18(stagingDir, "manifest.json");
-  let raw;
+async function get(id, options = {}) {
+  return call(["skills", ...validatedIdSegments(id)], void 0, options);
+}
+async function curated(options = {}) {
+  return call(["skills", "curated"], void 0, options);
+}
+function auditVerdict(data) {
+  const audits = data.audits ?? [];
+  const statuses = new Set(audits.map((a) => a.status));
+  let worst = "NONE";
+  let worstRank = 0;
+  for (const a of audits) {
+    const rl = a.riskLevel ?? "NONE";
+    const rank = RISK_ORDER[rl] ?? 0;
+    if (rank > worstRank) {
+      worstRank = rank;
+      worst = rl;
+    }
+  }
+  const verdict = statuses.has("fail") ? "fail" : statuses.has("warn") ? "warn" : audits.length > 0 ? "pass" : "none";
+  return { verdict, risk: worst, audits };
+}
+
+// src/commands/find.ts
+var INSTALL_HINT_NOTE = "Results are unvetted \u2014 `skill-forge add <id>` runs the full quarantine + safety gate; `skill-forge find --audit <id>` shows partner audit verdicts.";
+function isRecordWithDataArray(v) {
+  return typeof v === "object" && v !== null && Array.isArray(v.data);
+}
+function printJson(data) {
+  console.log(JSON.stringify(data, null, 2));
+}
+function printSearchResults(data, query) {
+  const items = data.data;
+  const count = data.count ?? items.length;
+  const searchType = data.searchType ? ` (${sanitizeForMarkdown(data.searchType)})` : "";
+  console.log(`skills.sh \u2014 ${count} matches for ${JSON.stringify(query)}${searchType}:`);
+  for (const item of items) {
+    const name = sanitizeForMarkdown(String(item.name ?? item.id));
+    const id = sanitizeForMarkdown(String(item.id));
+    const installs = item.installs ?? "?";
+    console.log(`  - ${name}  [${id}]  ${installs} installs  [unvetted]`);
+    console.log(`      install: skill-forge add ${id}`);
+  }
+  console.log("");
+  console.log(INSTALL_HINT_NOTE);
+}
+async function find(query, options = {}, deps = {}) {
+  const modes = [query !== void 0, options.audit !== void 0, options.get !== void 0, Boolean(options.curated)];
+  const activeCount = modes.filter(Boolean).length;
+  if (activeCount === 0) {
+    throw new UserError("skill-forge find: provide a search query, or exactly one of --audit <id>, --get <id>, --curated");
+  }
+  if (activeCount > 1) {
+    throw new UserError("skill-forge find: exactly one mode per invocation \u2014 a search query, or exactly one of --audit <id>, --get <id>, --curated");
+  }
+  const callOptions = { fetchImpl: deps.fetchImpl, env: deps.env };
   try {
-    raw = readFileSync10(manifestPath, "utf-8");
+    if (query !== void 0) {
+      if (query.trim().length < 2) {
+        throw new UserError("skill-forge find: query must be at least 2 characters");
+      }
+      const limit = options.limit ?? 10;
+      const data2 = await search(query, limit, callOptions);
+      if (options.json) {
+        printJson(data2);
+        return;
+      }
+      printSearchResults(data2, query);
+      return;
+    }
+    if (options.audit !== void 0) {
+      const id = options.audit;
+      const data2 = await audit(id, callOptions);
+      if (!data2) {
+        console.log(`no partner audits yet for ${sanitizeForMarkdown(id)} (generated after first install).`);
+        return;
+      }
+      if (options.json) {
+        printJson(data2);
+        return;
+      }
+      const { verdict, risk, audits } = auditVerdict(data2);
+      console.log(
+        `skills.sh audit for ${sanitizeForMarkdown(id)}: ${verdict.toUpperCase()} (max risk ${sanitizeForMarkdown(risk)}) \u2014 ${audits.length} partner(s)`
+      );
+      for (const entry of audits) {
+        const provider = sanitizeForMarkdown(String(entry.provider ?? "unknown"));
+        const status2 = sanitizeForMarkdown(String(entry.status ?? "unknown"));
+        const riskLevel = entry.riskLevel ? ` \xB7 ${sanitizeForMarkdown(String(entry.riskLevel))}` : "";
+        const summary = entry.summary ? ` \u2014 ${sanitizeForMarkdown(String(entry.summary))}` : "";
+        console.log(`  - ${provider}: ${status2}${riskLevel}${summary}`);
+      }
+      return;
+    }
+    if (options.get !== void 0) {
+      const data2 = await get(options.get, callOptions);
+      printJson(data2);
+      return;
+    }
+    const data = await curated(callOptions);
+    if (options.json) {
+      printJson(data);
+      return;
+    }
+    if (isRecordWithDataArray(data)) {
+      printSearchResults(data, "(curated)");
+      return;
+    }
+    printJson(data);
   } catch (err) {
-    throw new UserError(`could not read staging manifest ${manifestPath}: ${err.message}`);
+    if (err instanceof SkillsShError) {
+      console.error(err.message);
+      process.exitCode = err.exitCode;
+      return;
+    }
+    throw err;
   }
-  let parsed;
+}
+
+// src/commands/watch.ts
+import { realpathSync as realpathSync3 } from "fs";
+import { join as join22, resolve as resolvePath7 } from "path";
+var PRO_FEATURE_LABEL4 = "provenance drift watch (watch)";
+function isGitUrl(source) {
+  const s = source.trim();
+  return /^https?:\/\/\S+$/i.test(s) || /^git@[\w.-]+:\S+$/i.test(s);
+}
+function looksLikeGitRef(ref) {
+  const r = ref.trim();
+  return /^[0-9a-fA-F]{7,40}$/.test(r);
+}
+function firstNonEmptyLine(text) {
+  return text.split("\n").find((l) => l.trim().length > 0)?.trim() ?? "(no output)";
+}
+async function checkGitDrift(exec, url, ref) {
+  let result;
   try {
-    parsed = JSON.parse(raw);
+    result = await exec("git", ["ls-remote", "--", url, ref], { cwd: process.cwd() });
   } catch (err) {
-    throw new UserError(`could not parse staging manifest ${manifestPath}: ${err.message}`);
+    return { status: "unreachable", detail: `git ls-remote failed to run: ${err.message}` };
   }
-  return validateManifest(parsed, manifestPath);
+  if (result.code !== 0) {
+    return { status: "unreachable", detail: `git ls-remote exited ${result.code}: ${firstNonEmptyLine(result.stderr || result.stdout)}` };
+  }
+  const shas = result.stdout.split("\n").map((l) => l.trim()).filter((l) => l.length > 0).map((l) => l.split(/\s+/)[0] ?? "").filter((sha) => sha.length > 0);
+  if (shas.length === 0) {
+    return { status: "unreachable", detail: `no ref matching "${ref}" found on remote` };
+  }
+  const recorded = ref.trim().toLowerCase();
+  if (shas.some((sha) => sha.toLowerCase() === recorded)) {
+    return { status: "unchanged", detail: `current: ${recorded}` };
+  }
+  return { status: "moved", detail: `recorded ${ref}, remote now resolves to ${shas[0]}` };
 }
-function validateManifest(raw, manifestPath) {
-  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
-    throw new UserError(`staging manifest ${manifestPath} has an unexpected shape (expected an object)`);
+async function runWatch(config, options = {}, deps = {}) {
+  const proStatus = proFeatureStatus(PRO_FEATURE_LABEL4);
+  if (!proStatus.enabled) {
+    return { roots: [], rows: [], warnings: [], notices: [proStatus.notice ?? "Pro feature (watch) locked."] };
   }
-  const obj = raw;
-  if (typeof obj.live_skill_path !== "string") {
-    throw new UserError(`staging manifest ${manifestPath} is missing a valid "live_skill_path" string`);
+  const notices = proStatus.notice ? [proStatus.notice] : [];
+  const exec = deps.exec ?? defaultExec;
+  const roots = [];
+  const rows = [];
+  const warnings = [];
+  const seenRealPaths = /* @__PURE__ */ new Set();
+  for (const root of config.skillsRoots) {
+    const resolvedRoot = resolvePath7(expandHome(root));
+    const exists = isDir(resolvedRoot);
+    let realPath = resolvedRoot;
+    if (exists) {
+      try {
+        realPath = realpathSync3(resolvedRoot);
+      } catch {
+        realPath = resolvedRoot;
+      }
+    }
+    if (seenRealPaths.has(realPath)) continue;
+    seenRealPaths.add(realPath);
+    let ledger;
+    try {
+      ledger = readProvenanceLedger(resolvedRoot);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      const ledgerPath = join22(resolvedRoot, "SOURCES.md");
+      roots.push({ root, realPath, exists, ledgerPath, ledgerExists: false });
+      warnings.push(`${ledgerPath}: could not read ledger: ${message}`);
+      continue;
+    }
+    roots.push({ root, realPath, exists, ledgerPath: ledger.ledgerPath, ledgerExists: ledger.exists });
+    warnings.push(...ledger.warnings.map((w) => `${ledger.ledgerPath}: ${w}`));
+    for (const entry of ledger.entries) {
+      if (entry.verb === "REJECT") continue;
+      const rowBase = {
+        root,
+        ledgerPath: ledger.ledgerPath,
+        name: entry.name,
+        verb: entry.verb,
+        source: entry.source,
+        upstreamRef: entry.upstreamRef,
+        driftCheckCommand: entry.driftCheck
+      };
+      if (!(isGitUrl(entry.source) && looksLikeGitRef(entry.upstreamRef))) {
+        rows.push({
+          ...rowBase,
+          checkMethod: "manual",
+          driftStatus: "not-checked",
+          detail: "source is not a recognized git URL + ref pin \u2014 check manually"
+        });
+        continue;
+      }
+      if (options.offline) {
+        rows.push({
+          ...rowBase,
+          checkMethod: "git-ls-remote",
+          driftStatus: "not-checked",
+          detail: "--offline: network check skipped"
+        });
+        continue;
+      }
+      const { status: status2, detail } = await checkGitDrift(exec, entry.source, entry.upstreamRef);
+      rows.push({ ...rowBase, checkMethod: "git-ls-remote", driftStatus: status2, detail });
+    }
   }
-  if (obj.live_memory_path !== void 0 && obj.live_memory_path !== null && typeof obj.live_memory_path !== "string") {
-    throw new UserError(`staging manifest ${manifestPath} has an unexpected "live_memory_path" (expected a string or null)`);
+  return { roots, rows, warnings, notices };
+}
+function printWatchTerminal(report) {
+  console.log("[skill-forge] watch \u2014 provenance drift check");
+  for (const notice of report.notices) console.log(`[notice] ${notice}`);
+  if (report.roots.length === 0) {
+    console.log("\nNo configured skills roots.");
   }
-  if (typeof obj.has_skill !== "boolean" || typeof obj.has_memory !== "boolean") {
-    throw new UserError(`staging manifest ${manifestPath} is missing valid "has_skill"/"has_memory" booleans`);
+  for (const root of report.roots) {
+    console.log(`
+${sanitizeForMarkdown(root.root)} (${sanitizeForMarkdown(root.realPath)})`);
+    if (!root.exists) {
+      console.log("  root does not exist on disk");
+      continue;
+    }
+    if (!root.ledgerExists) {
+      console.log(`  no ledger at ${sanitizeForMarkdown(root.ledgerPath)}`);
+      continue;
+    }
+    console.log(`  ledger: ${sanitizeForMarkdown(root.ledgerPath)}`);
+    const rowsForRoot = report.rows.filter((r) => r.root === root.root);
+    if (rowsForRoot.length === 0) {
+      console.log("  (no tracked, non-REJECT sources)");
+      continue;
+    }
+    for (const row of rowsForRoot) {
+      console.log(`  \u2022 ${sanitizeForMarkdown(row.name)}  [${sanitizeForMarkdown(row.verb)}]  ref=${sanitizeForMarkdown(row.upstreamRef)}`);
+      if (row.checkMethod === "git-ls-remote") {
+        console.log(`      drift: ${row.driftStatus} \u2014 ${sanitizeForMarkdown(row.detail)}`);
+      } else {
+        console.log(`      manual check \u2014 stored drift-check command (data, NOT executed): ${sanitizeForMarkdown(row.driftCheckCommand)}`);
+      }
+    }
+  }
+  if (report.warnings.length > 0) {
+    console.log("\nWarnings:");
+    for (const w of report.warnings) console.log(`  - ${sanitizeForMarkdown(w)}`);
+  }
+  console.log("\nCompare each stored ref to current upstream; re-run ingestion on any that moved.");
+}
+async function watchCommand(options = {}) {
+  const report = await runWatch(loadConfig(), options);
+  if (options.json) {
+    console.log(JSON.stringify(report, null, 2));
+    for (const notice of report.notices) console.error(`[skill-forge] ${notice}`);
+    return;
+  }
+  printWatchTerminal(report);
+}
+
+// src/commands/ingest.ts
+import { realpathSync as realpathSync4 } from "fs";
+import { dirname as dirname9, isAbsolute, relative, resolve as resolvePath8 } from "path";
+var PRO_FEATURE_LABEL5 = "the pending-ingestion queue";
+var VALID_STATUSES = ["ingested", "dismissed"];
+function requireProFeature() {
+  const status2 = proFeatureStatus(PRO_FEATURE_LABEL5);
+  if (!status2.enabled) {
+    throw new UserError(
+      status2.notice ?? "ingest is a Pro feature \u2014 set SKILL_FORGE_LICENSE or config.licenseKey to a valid license to unlock."
+    );
   }
+  if (status2.notice) console.error(`[skill-forge] ${status2.notice}`);
+}
+function pluralizeEntries(count) {
+  return `entr${count === 1 ? "y" : "ies"}`;
+}
+function toListRow(entry) {
   return {
-    live_skill_path: obj.live_skill_path,
-    live_memory_path: obj.live_memory_path ?? null,
-    has_skill: obj.has_skill,
-    has_memory: obj.has_memory
+    id: entry.id,
+    source: entry.source,
+    artifactType: entry.artifactType ?? "skill",
+    safetyVerdict: entry.gate.safetyVerdict,
+    createdAt: entry.createdAt
   };
 }
-function filesIdentical(a, b) {
-  if (!existsSync14(a) || !existsSync14(b)) return false;
-  return readFileSync10(a).equals(readFileSync10(b));
-}
-function isAlreadyAdopted(stagingDir, manifest) {
-  const proposedSkillMd = join18(stagingDir, "proposed_SKILL.md");
-  const proposedClaudeMd = join18(stagingDir, "proposed_CLAUDE.md");
-  let sawComparison = false;
-  if (existsSync14(proposedSkillMd)) {
-    sawComparison = true;
-    if (!filesIdentical(proposedSkillMd, manifest.live_skill_path)) return false;
+function printPendingList(pending, json) {
+  if (json) {
+    console.log(JSON.stringify({ entries: pending.map(toListRow) }, null, 2));
+    return;
   }
-  if (existsSync14(proposedClaudeMd) && manifest.live_memory_path) {
-    sawComparison = true;
-    if (!filesIdentical(proposedClaudeMd, manifest.live_memory_path)) return false;
+  if (pending.length === 0) {
+    console.log("[skill-forge] no pending queue entries.");
+    return;
+  }
+  console.log(`[skill-forge] ${pending.length} pending ${pluralizeEntries(pending.length)}:`);
+  for (const entry of pending) {
+    const row = toListRow(entry);
+    console.log(`  ${row.id}  ${row.source}  (${row.artifactType})  verdict=${row.safetyVerdict}  created=${row.createdAt}`);
   }
-  return sawComparison;
 }
-function assertNotSymlink(path, label) {
-  let stat;
+function realpathOrNull(p) {
   try {
-    stat = lstatSync(path);
+    return realpathSync4(p);
   } catch {
-    return;
+    return null;
   }
-  if (stat.isSymbolicLink()) {
-    throw new UserError(`refusing to re-gate ${label}: ${path} is a symlink (a staged proposal must be a plain file)`);
+}
+function isUnderRoot(candidate, root) {
+  const rel = relative(root, candidate);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+}
+function validatePendingEntries(entries, config) {
+  const quarantineRoot = realpathOrNull(resolvePath8(config.quarantineDir));
+  const skillsRoots = config.skillsRoots.map((r) => realpathOrNull(resolvePath8(r))).filter((r) => r !== null);
+  const mcpTargetDirs = (config.mcpTargets ?? []).map((f) => realpathOrNull(dirname9(resolvePath8(f)))).filter((r) => r !== null);
+  const allowedRoots = [quarantineRoot, ...skillsRoots, ...mcpTargetDirs].filter((r) => r !== null);
+  const valid = [];
+  const excluded = [];
+  for (const entry of entries) {
+    const effectivePath = entry.installedPath ?? entry.quarantinePath;
+    if (!effectivePath) {
+      excluded.push({ entry, reason: "no installedPath or quarantinePath recorded on the entry" });
+      continue;
+    }
+    const real = realpathOrNull(resolvePath8(effectivePath));
+    if (!real) {
+      excluded.push({ entry, reason: `path does not exist or could not be resolved: ${effectivePath}` });
+      continue;
+    }
+    if (allowedRoots.length === 0 || !allowedRoots.some((root) => isUnderRoot(real, root))) {
+      excluded.push({ entry, reason: `path escapes every configured root (quarantineDir/skillsRoots/mcpTargets): ${effectivePath}` });
+      continue;
+    }
+    valid.push(entry);
   }
+  return { valid, excluded };
 }
-function sha256File(path) {
-  if (!existsSync14(path)) return null;
-  return createHash("sha256").update(readFileSync10(path)).digest("hex");
+async function ingest(options = {}) {
+  requireProFeature();
+  const queue2 = readQueue();
+  const pending = queue2.entries.filter((e) => e.status === "pending");
+  if (options.list) {
+    printPendingList(pending, options.json);
+    return;
+  }
+  if (pending.length === 0) {
+    console.log("[skill-forge] no pending queue entries to ingest.");
+    return;
+  }
+  const config = loadConfig();
+  const { valid, excluded } = validatePendingEntries(pending, config);
+  if (excluded.length > 0) {
+    console.error(`[skill-forge] excluded ${excluded.length} pending ${pluralizeEntries(excluded.length)} that failed path validation:`);
+    for (const { entry, reason } of excluded) {
+      console.error(`  - ${entry.id} (${entry.source}): ${reason}`);
+    }
+    console.error(
+      "[skill-forge] excluded entries stay in the queue \u2014 review each, then dismiss with: skill-forge queue close <id> --status dismissed"
+    );
+  }
+  if (valid.length === 0) {
+    console.log("[skill-forge] no pending entries passed path validation \u2014 nothing to hand off.");
+    return;
+  }
+  console.log(`[skill-forge] ${valid.length} pending ${pluralizeEntries(valid.length)} ready for ingest:`);
+  for (const entry of valid) {
+    console.log(`  - ${entry.id}  ${entry.source}  (${entry.artifactType ?? "skill"})`);
+  }
+  runHandoff(config, getQueuePath(), { promptAsset: "ingest-prompt.md" });
 }
-
-// src/commands/evolve.ts
-async function evolveCommand(targetSkillDir, options = {}) {
-  await evolve(targetSkillDir, options);
+async function queueClose(id, options = {}) {
+  requireProFeature();
+  const status2 = options.status;
+  if (!status2 || !VALID_STATUSES.includes(status2)) {
+    throw new UserError(`--status must be one of: ${VALID_STATUSES.join(", ")} (got ${status2 ? JSON.stringify(status2) : "nothing"})`);
+  }
+  let updated;
+  try {
+    updated = updateQueueEntry(id, { status: status2 });
+  } catch (err) {
+    throw new UserError(err instanceof Error ? err.message : String(err));
+  }
+  console.log(`[skill-forge] queue entry ${updated.id} closed -> status: ${updated.status}`);
 }
 
 // src/cli.ts
@@ -3134,6 +5038,13 @@ function parseLookbackHours(value) {
   }
   return n;
 }
+function parseLimit(value) {
+  const n = Number(value);
+  if (value.trim() === "" || !Number.isInteger(n) || n < 1 || n > 50) {
+    throw new UserError(`--limit must be an integer between 1 and 50 (got "${value}")`);
+  }
+  return n;
+}
 var program = new Command();
 program.name("skill-forge").description("The supply-chain gate for agent skills").version(pkg.version);
 program.command("add <source>").description("Quarantine-install a skill and run it through the safety gate").option("-y, --yes", "skip the interactive prompt; honor the gate verdict automatically").option("-t, --target <dir>", "skills root to promote into (defaults to config defaultTarget, then skillsRoots[0])").option("--json", "print the gate result as JSON instead of the terminal report").option("--ingest", "after a successful promote, hand off the bundled ingest prompt to a coding agent").option("--artifact <type>", 'gate as a "skill" or an "mcp" server (default: skill)', parseArtifact).option(
@@ -3144,6 +5055,15 @@ program.command("scan <source>").description("Run the safety gate against a skil
 program.command("list").description("List skills currently in quarantine").action(list);
 program.command("status").description("Show skill-forge configuration and quarantine status").action(status);
 program.command("evolve <target-skill-dir>").description("Self-evolve a skill via SkillOpt-Sleep, re-gate the proposal, then promote/hold/reject (Pro)").option("--project <dir>", "project dir passed to SkillOpt-Sleep as --project (defaults to cwd)").option("--dry-run", "SkillOpt-Sleep dry-run: report only, nothing staged").option("--backend <name>", "SkillOpt-Sleep backend (default: mock, offline \u2014 a real backend requires --yes or interactive confirmation)").option("--lookback-hours <n>", "hours of session history for SkillOpt-Sleep to harvest", parseLookbackHours).option("-y, --yes", "skip interactive prompts; honor the re-gate verdict automatically").option("--json", "print the re-gate result as JSON instead of the terminal report").option("--force", "allow re-adopting a staging dir whose proposed content already matches the live skill").action(evolveCommand);
+program.command("audit").alias("doctor").description("Doctor-style health check over the configured skill/MCP set: inventory, hygiene findings, and consolidation/refinement opportunities").option("--json", "print the audit report as JSON instead of the terminal summary (non-interactive: skips the business-profile prompt)").option("-y, --yes", "skip interactive prompts (business profile, foundation, handoff); never implies --foundation or --handoff").option("--report <file>", "write the report to this path instead of the default ~/.skill-forge/reports/audit-<timestamp>.md (refuses an existing path)").option("--foundation", "authorizes exactly one skills-root write: scaffold a business-foundation skill from the captured business profile").option("--handoff", "authorizes launching the configured agent with the bundled curation prompt against the written report").action(auditCommand);
+program.command("organize").description("Build the set-level capability registry + dependency graph across configured skills roots (Pro)").option("--json", "print the registry+graph report as JSON instead of the terminal summary").option("--out <file>", "write the full report JSON to this path (refuses an existing path)").option("--usage-snapshot <file>", "join per-skill usage counts from a skill-monitor snapshot JSON").action(organizeCommand);
+program.command("find [query]").description("Discover skills via skills.sh and check partner security audits (requires VERCEL_OIDC_TOKEN)").option("--limit <n>", "max search results (default 10)", parseLimit).option("--audit <id>", "show partner audit verdicts (Socket/Snyk/\u2026) for a skills.sh id").option("--get <id>", "show detail + file tree for a skills.sh id").option("--curated", "list skills.sh curated skills").option("--json", "print the raw API payload as JSON").action(find);
+program.command("watch").description("Drift check across every SOURCES.md provenance ledger: which ingested upstreams have moved (Pro)").option("--offline", "skip all network checks; list entries for manual comparison only").option("--json", "print the drift report as JSON instead of the terminal summary").action(watchCommand);
+program.command("ingest").description(
+  "Hand the pending-ingestion queue to the configured coding agent for the decide/absorb pass (Pro). For a single new source, use `skill-forge add <source> --ingest` instead."
+).option("--list", "print pending queue entries and exit \u2014 no handoff").option("--json", "with --list: print pending entries as JSON").action(ingest);
+var queue = program.command("queue").description("Manage the pending-ingestion queue (Pro)");
+queue.command("close <id>").description("Close a queue entry after the decide pass \u2014 agents use this instead of hand-editing queue.json").requiredOption("--status <status>", 'final status: "ingested" or "dismissed"').action(queueClose);
 program.command("init").description("Detect installed agents and set gate targets, default promotion target, and handoff agent").option("--defaults", "non-interactive: use all detected agents as gate targets, the first as the default target").option("--list", "print detected agent skill roots and exit \u2014 no writes").action(init);
 try {
   await program.parseAsync();