@rosthq/cli 0.7.141 → 0.7.143

package/dist/index.js

@@ -31855,7 +31855,25 @@ var commandViolationSchema = external_exports.object({
   /** Advisory human text. Do not parse. */
   message: external_exports.string().min(1),
   /** The violated bound, when the issue carries one (`max`/`min` on arrays, strings, numbers). */
-  limit: external_exports.number().optional()
+  limit: external_exports.number().optional(),
+  /**
+   * Schema vocabulary describing what was expected — a type name, a declared enum
+   * value set, a format identifier, or a bound direction, FOR EVERY IN-REPO
+   * SCHEMA. It is not structurally guaranteed to stay that way: a `superRefine`
+   * can forge `issue.expected` / `issue.format` from caller data, so the value is
+   * sanitized, capped, and secret-gated (`gateExpected`) before it can reach here
+   * rather than trusted outright. It is never the caller's own parsed VALUE,
+   * which is what `received` describes.
+   */
+  expected: external_exports.string().optional(),
+  /**
+   * A type descriptor of the caller's own submitted value at the resolved path:
+   * `missing`/`null`/`string`/`number`/`boolean`/`array`/`object`, with counts for
+   * size violations — or, for `unrecognized_keys`, the caller's own unexpected key
+   * NAMES (proven against the payload, secret-gated, capped). NEVER the value
+   * itself (invariant #5).
+   */
+  received: external_exports.string().optional()
 }).strict();
 
 // ../../packages/protocol/src/command-introspection.ts
@@ -53026,7 +53044,7 @@ When operating through CLI or MCP, create fewer seats first and ask for confirma
     order: 30,
     title: "Charter design playbook",
     summary: "How to draft strong Charters that work for human, agent, and hybrid seats.",
-    version: "2026-07-29.1",
+    version: "2026-07-31.2",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["charter_design", "staffing"],
@@ -53081,7 +53099,7 @@ List and read first, then draft, then leave activation to a human.
 
 - List: \`{{cli}} command charter.list --json '{}'\` or \`rost_list_charters\` (scope: tenant). Read one with \`charter.get\` / \`rost_get_charter\`.
 - Draft one: \`{{cli}} command charter.draft --json '{"seat_id":"<seat-id>"}'\` (scope: seat or tenant-admin); draft every eligible seat with \`charter.draft_all\` / \`rost_draft_all_charters\`. Draft commands are not gated \u2014 they produce a draft \`charter_version_id\`. \`charter.draft_all\` drafts every **active or vacant** non-reserved seat \u2014 a vacant seat can receive a conservative draft Charter before it is staffed, since Charters attach to seats, not people, and drafting is not activation: **Charter activation stays a separate, human-gated step** (\`charter.approve\`) whether or not the seat is staffed. Reserved system paths (e.g. \`system.ops\`, Forge role seats) are excluded entirely, before both drafting and skip accounting \u2014 they never appear in \`drafted\`, \`skipped\`, or \`skipped_seats\`. It returns the real result: \`{ drafted, skipped, draft_ids, skipped_seats: [{ seat_id, reason }], effect }\` where \`reason\` is \`seat_not_active\` (the seat is still a graph-authoring draft, not yet active or vacant) or \`charter_exists\` (it already has a draft/active Charter). Read \`skipped_seats\` to see why a freshly-built graph drafted fewer Charters than it has seats \u2014 among non-reserved seats.
-- **Never read a governed command's success as "it changed something."** Every converted mutating command carries an \`effect\` block \u2014 \`{ attempted, applied, skipped, outcome, skips: [{ target_kind, target_id, reason }], skips_omitted }\`, where \`outcome\` is \`applied\`, \`partial\`, or \`none\`, and \`skips.length + skips_omitted\` always equals \`skipped\` (\`skips\` is capped at 50 entries, so a very large sweep itemises the first 50 and counts the rest \u2014 the arithmetic still adds up) \u2014 so you can branch on it without knowing any one command's field names. **Read it where your surface actually delivers it:** \`response.output.effect\` over HTTP, and \`effect\` on the unwrapped command output in CLI and MCP. (The executor also carries a copy on its internal result envelope, but the HTTP adapter does not re-emit it, so \`response.effect\` is \`undefined\` \u2014 do not read it there.) \`outcome: "none"\` means the call succeeded and changed nothing; \`skips\` tells you why, per target, as stable codes you can branch on rather than prose. Check it and self-correct in the same run instead of reporting a build that did nothing: a second \`charter.draft_all\` over a graph whose seats already have a draft or active Charter returns \`outcome: "none"\` with one \`charter_exists\` skip per seat, and a graph whose seats are still graph-authoring \`draft\` seats returns \`outcome: "none"\` with one \`seat_not_active\` skip per seat. (A freshly built graph of **vacant** seats is not one of these cases \u2014 vacant seats are eligible and do get drafted, per the bullet above.) A **converted** command that skipped work without naming a reason fails its own output validation, so a silent zero-effect success is not a shape *those* commands can return. **This is not yet an API-wide guarantee** \u2014 most mutating commands are not converted yet, and an unconverted bulk or sweep command still returns a bare success that changed nothing: \`confirmation.dismiss_stale\` with no expired confirmations returns \`{ dismissed_count: 0, dismissed_ids: [] }\` with no \`effect\` at all. Treat a missing \`effect\` as "this command cannot tell you", never as "it worked" \u2014 for those, verify against live state before reporting the step done. Input that violates a schema is reported the same way rather than swallowed, naming the offending field path, the stable issue \`code\`, and the violated \`limit\` \u2014 e.g. a 6-principle Compass against \`max(5)\` gives \`{ path: "doc.principles", code: "too_big", limit: 5 }\`. **The field sits at a different place on each surface:** CLI and HTTP callers read it at \`error.details.violations\` (alongside the legacy \`fieldErrors\`), while MCP tool callers read \`violations\` at the **top level** of the error result, next to \`code\` and \`help\` \u2014 MCP results have no \`details\` envelope, so \`details.violations\` is \`undefined\` there. A path segment shown as \`*\` is one the server would not prove safe to echo \u2014 most often a caller-supplied key (e.g. inside a \`capabilities\` or \`headers\` map), but also any segment whose structure it could not establish: tuple and intersection members, **every** array position (a genuine positional index and caller text smuggled in by a refinement are indistinguishable once the issue is built, so no array position is echoed \u2014 \`xs[3].on\` reports as \`xs.*.on\`), and every segment when the schema is unavailable. So read \`*\` as **"withheld, unproven"**, not as "this was your key" \u2014 the declared field names around it are still exact, and the \`code\` still tells you which constraint failed. \`limit\` is likewise only present when the schema itself declares that bound, so its absence means "not proven", not "no bound".
+- **Never read a governed command's success as "it changed something."** Every converted mutating command carries an \`effect\` block \u2014 \`{ attempted, applied, skipped, outcome, skips: [{ target_kind, target_id, reason }], skips_omitted }\`, where \`outcome\` is \`applied\`, \`partial\`, or \`none\`, and \`skips.length + skips_omitted\` always equals \`skipped\` (\`skips\` is capped at 50 entries, so a very large sweep itemises the first 50 and counts the rest \u2014 the arithmetic still adds up) \u2014 so you can branch on it without knowing any one command's field names. **Read it where your surface actually delivers it:** \`response.output.effect\` over HTTP, and \`effect\` on the unwrapped command output in CLI and MCP. (The executor also carries a copy on its internal result envelope, but the HTTP adapter does not re-emit it, so \`response.effect\` is \`undefined\` \u2014 do not read it there.) \`outcome: "none"\` means the call succeeded and changed nothing; \`skips\` tells you why, per target, as stable codes you can branch on rather than prose. Check it and self-correct in the same run instead of reporting a build that did nothing: a second \`charter.draft_all\` over a graph whose seats already have a draft or active Charter returns \`outcome: "none"\` with one \`charter_exists\` skip per seat, and a graph whose seats are still graph-authoring \`draft\` seats returns \`outcome: "none"\` with one \`seat_not_active\` skip per seat. (A freshly built graph of **vacant** seats is not one of these cases \u2014 vacant seats are eligible and do get drafted, per the bullet above.) A **converted** command that skipped work without naming a reason fails its own output validation, so a silent zero-effect success is not a shape *those* commands can return. **This is not yet an API-wide guarantee** \u2014 most mutating commands are not converted yet, and an unconverted bulk or sweep command still returns a bare success that changed nothing: \`confirmation.dismiss_stale\` with no expired confirmations returns \`{ dismissed_count: 0, dismissed_ids: [] }\` with no \`effect\` at all. Treat a missing \`effect\` as "this command cannot tell you", never as "it worked" \u2014 for those, verify against live state before reporting the step done. Input that violates a schema is reported the same way rather than swallowed, naming the offending field path, the stable issue \`code\`, and the violated \`limit\` \u2014 e.g. a 6-principle Compass against \`max(5)\` gives \`{ path: "doc.principles", code: "too_big", limit: 5, expected: "<= 5", received: "array (6 items)" }\`. Each violation also carries \`expected\` (what the schema declares at that spot \u2014 a type, format, allowed values, or bound; for a cross-field or business-rule check it is the fixed marker \`a value satisfying the schema's custom check (see message)\`, telling you to read \`message\` for the authored specifics) and \`received\` (the KIND of value you sent \u2014 \`string\`, \`number\`, \`array (6 items)\`, \`missing\` \u2014 or, for undeclared extra keys, their proven, secret-gated names \u2014 never the value itself). **The field sits at a different place on each surface:** CLI and HTTP callers read it at \`error.details.violations\` (alongside the legacy \`fieldErrors\`), while MCP tool callers read \`violations\` at the **top level** of the error result, next to \`code\` and \`help\` \u2014 MCP results have no \`details\` envelope, so \`details.violations\` is \`undefined\` there. Paths are real JSON paths into YOUR OWN submitted payload: a caller-supplied key (e.g. inside a \`capabilities\` or \`headers\` map) is echoed exactly, and an array position reports as \`xs[3].on\`, because a path into input you supplied tells you nothing you do not already hold. A segment shows as \`*\` only when the server could not prove it walks your payload \u2014 a segment no schema declares and your payload does not contain (a refinement can report a path that was never in your input) \u2014 or when the segment name is itself credential-shaped and withheld as secret material. So read \`*\` as **"withheld, unproven"**, not as "this was your key" \u2014 the field names around it are still exact, and the \`code\` still tells you which constraint failed. \`limit\` is likewise only present when the schema itself declares that bound, so its absence means "not proven", not "no bound". The error envelope's \`help\` names the exact next step \u2014 \`rost command schema <id>\` prints the full input contract, and when the payload came from \`--input-file\`, fix the file and re-run it.
 - Edit a draft: \`charter.update_draft\` / \`rost_update_charter_draft\` with the \`charter_version_id\` and the new \`doc\`.
 
 In the app, \`/charters\` is both a drafting queue and a governance library. It shows active Charters, draft amendments, seats missing Charters, unsigned manifests, and steward-review gaps. \`/charters/builder\` is the seat picker for Charter Builder: start there when you need to draft a missing Charter, continue an amendment, or review which seats are still missing operating contracts. Opening a live Charter is a review mode: read the active version, inspect its governance state, and open an amendment draft when the job needs to change. Active Charter content is never silently edited in place. Both \`charter.draft_all\` triggers on this page \u2014 the "Draft missing Charters" empty-queue card and the "Draft gaps" header CTA \u2014 render the run's \`effect\` distinctly rather than a bare success: a full run (\`outcome: "applied"\`) shows an ordinary "Done" state, a run that skipped some seats (\`"partial"\`) shows "Partial effect" plus how many seats were skipped and why (the app aggregates them into product copy \u2014 "17 skipped: seat not active" \u2014 while CLI and MCP callers still get the per-target \`target_id\`/\`reason\` values from the contract), and a run that drafted nothing (\`"none"\`) shows "No effect" the same way \u2014 so a human running this from the UI gets the same self-correction signal the effect contract gives a CLI/MCP/HTTP caller, above.
@@ -53711,7 +53729,7 @@ External connectors are being rolled out provider by provider, conservatively (r
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-07-31.2",
+    version: "2026-07-31.3",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -54351,7 +54369,7 @@ Skills wrapper help:
 {{cli}} skills publish (--slug <slug>|--skill-version-id <id>) [--allow-warnings] [--json]
 \`\`\`
 
-\`{{cli}} skills install\` writes into the client Skills directory and records \`.rost-skill.json\` with \`skill_version_id\`, \`content_sha256\`, source, client, and \`installed_from: "rost_api"\`. Set \`ROST_SKILL_INSTALL_ROOT\` to override the local root in CI or a sandbox. Use \`install\` for one Skill and \`sync\` as the default local-agent command because it installs every approved Skill assigned to the Seat and skips unchanged local copies by hash. Entitlement failures mean the tenant cannot access that {{brand}} catalog tier yet; stale local copies are fixed by rerunning \`sync\`; private catalog access is always served by {{brand}} APIs, not by giving the agent a private GitHub credential.
+\`{{cli}} skills install\` writes into the client Skills directory and records \`.rost-skill.json\` with \`skill_version_id\`, \`content_sha256\`, source, client, and \`installed_from: "rost_api"\`. Set \`ROST_SKILL_INSTALL_ROOT\` to override the local root in CI or a sandbox. Use \`install\` for one Skill and \`sync\` as the default local-agent command because it installs every approved Skill assigned to the Seat and skips a local copy only when its recorded hash matches and the installed file's own sha256 and byte size verify against the package the server returned; an edited or truncated local file is reinstalled instead of being reported unchanged. For \`--client claude-code\` the root is \`$CLAUDE_CONFIG_DIR/skills\` \u2014 \`CLAUDE_CONFIG_DIR\` is the variable Claude Code itself reads \u2014 otherwise \`~/.claude/skills\`; \`CLAUDE_HOME\` set on its own is a usage error with a migration instruction, and \`CLAUDE_HOME\` set alongside a different \`CLAUDE_CONFIG_DIR\` prints a notice that \`CLAUDE_HOME\` is ignored. For \`--client codex\` the root is \`$CODEX_HOME/skills\`, otherwise \`~/.codex/skills\`. For \`--client cursor\` the root is \`~/.cursor/skills\`. Catalog Skills land under \`<skills root>/rost/<slug>\`, except under \`ROST_SKILL_INSTALL_ROOT\`, where they land under \`<override root>/<client>/<slug>\`. A whitespace-only value for any of these variables is rejected rather than resolving somewhere unintended; an empty value means unset (the shell's \`FOO= cmd\` idiom for turning an inherited variable off) and falls back to the default root above. Entitlement failures mean the tenant cannot access that {{brand}} catalog tier yet; stale local copies are fixed by rerunning \`sync\`; private catalog access is always served by {{brand}} APIs, not by giving the agent a private GitHub credential.
 
 {{brand}}-maintained catalog entries are seeded from first-party Skill packages with stable content hashes, application descriptors, and declared required or optional tool dependencies. Catalog seed validation is fail-closed: a package with parser warnings is not published. Enabling a catalog Skill copies the current immutable version into the company library; later catalog refreshes update the global catalog row but do not silently rewrite already-enabled tenant Skill versions.
 
@@ -61936,7 +61954,6 @@ function ensureTrailingSlash2(value) {
 
 // src/skills.ts
 import { existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync4, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "node:fs";
-import os2 from "node:os";
 import path5 from "node:path";
 
 // src/skill-install.ts
@@ -62455,7 +62472,7 @@ async function runInstallImplementation(context, args) {
     parsed = parseFlags2(args);
     client = parseClient2(optionalValue2(parsed, "client") ?? "codex");
     tag = optionalValue2(parsed, "tag") ?? DEFAULT_RELEASE_TAG;
-    installRoot(client, context.env);
+    resolveSkillInstallRoot(client, context.env);
   } catch (error51) {
     if (error51 instanceof UsageError2) {
       writeErrorLine(context.io, error51.message);
@@ -62622,7 +62639,7 @@ async function installRelease(context, plan, testOverrides = {}) {
   let legacyNotice;
   let viaOverride;
   try {
-    ({ root, legacyNotice, viaOverride } = installRoot(plan.client, context.env));
+    ({ root, legacyNotice, viaOverride } = resolveSkillInstallRoot(plan.client, context.env));
   } catch (error51) {
     if (error51 instanceof UsageError2) {
       writeErrorLine(context.io, error51.message);
@@ -62753,7 +62770,7 @@ function writeMarker(dir, input) {
   writeFileSync(path4.join(dir, SKILL_MARKER_FILE), `${JSON.stringify(marker, null, 2)}
 `, "utf8");
 }
-function listInstalledFiles(dir) {
+function listInstalledFiles(dir, markerFile) {
   const files = [];
   const walk = (current, prefix) => {
     for (const name of readdirSync(current)) {
@@ -62767,7 +62784,7 @@ function listInstalledFiles(dir) {
         walk(absolute, relative);
         continue;
       }
-      if (relative === SKILL_MARKER_FILE) {
+      if (relative === markerFile) {
         continue;
       }
       files.push({ path: relative, absolute, dev: stats.dev, ino: stats.ino });
@@ -62776,26 +62793,32 @@ function listInstalledFiles(dir) {
   walk(dir, "");
   return files;
 }
-function verifyInstalledTree(dir, manifest) {
+function verifyInstalledTree(dir, manifest, options = {}) {
+  const markerFile = options.markerFile ?? SKILL_MARKER_FILE;
   let present;
   try {
-    present = listInstalledFiles(dir);
+    present = listInstalledFiles(dir, markerFile);
   } catch (error51) {
     return { ok: false, reason: error51 instanceof Error ? error51.message : "install directory is unreadable" };
   }
-  const manifestPaths = new Set(manifest.files.map((file2) => file2.path));
-  const unexpected = present.find((file2) => !manifestPaths.has(file2.path));
+  const manifestByPath = new Map(manifest.files.map((file2) => [file2.path, file2]));
+  const unexpected = present.find((file2) => !manifestByPath.has(file2.path));
   if (unexpected !== void 0) {
-    return { ok: false, reason: "an installed file is not listed in the signed manifest" };
+    return { ok: false, reason: "an installed file is not listed in the package" };
   }
-  if (present.length !== manifestPaths.size) {
-    return { ok: false, reason: "the installed tree is missing files listed in the signed manifest" };
+  if (present.length !== manifestByPath.size) {
+    return { ok: false, reason: "the installed tree is missing files listed in the package" };
   }
   for (const file2 of present) {
     try {
-      if (statSync(file2.absolute).size > MAX_RESPONSE_BYTES) {
+      const size = statSync(file2.absolute).size;
+      if (size > MAX_RESPONSE_BYTES) {
         return { ok: false, reason: `an installed file exceeds the ${MAX_RESPONSE_BYTES}-byte verification cap: ${file2.path}` };
       }
+      const declaredSize = manifestByPath.get(file2.path)?.sizeBytes;
+      if (declaredSize !== void 0 && size !== declaredSize) {
+        return { ok: false, reason: `an installed file's size does not match the declared size: ${file2.path}` };
+      }
     } catch (error51) {
       return { ok: false, reason: error51 instanceof Error ? error51.message : "an installed file is unreadable" };
     }
@@ -62893,7 +62916,7 @@ function resolveCodexSkillsRoot(env) {
   const codexHome = requireNonBlank("CODEX_HOME", env.CODEX_HOME);
   return path4.resolve(path4.join(codexHome ?? path4.join(resolveHome(env), ".codex"), "skills"));
 }
-function installRoot(client, env) {
+function resolveSkillInstallRoot(client, env) {
   const override = requireNonBlank("ROST_SKILL_INSTALL_ROOT", env.ROST_SKILL_INSTALL_ROOT);
   if (override !== null) {
     return { root: path4.resolve(override, client), legacyNotice: null, viaOverride: true };
@@ -62948,6 +62971,7 @@ function parseClient2(value) {
 }
 
 // src/skills.ts
+var CATALOG_SKILL_MARKER_FILE = ".rost-skill.json";
 var UsageError3 = class extends Error {
 };
 var CLIENTS2 = /* @__PURE__ */ new Set(["claude-code", "codex", "cursor"]);
@@ -63077,7 +63101,7 @@ async function installOne(context, args, env) {
   });
   const options = seatId ? { targetSeatId: seatId } : {};
   const output = await executeInstallCommand(context, body, options);
-  const summary = applyLocalSkillChanges(output, client, env, { removeRevoked: false });
+  const summary = applyLocalSkillChanges(context.io, output, client, env, { removeRevoked: false });
   const outputRecord = asRecord4(output);
   context.io.stdout.write(parsed.json ? `${JSON.stringify({ ...outputRecord, local: summary }, null, 2)}
 ` : `${formatLocalSummary(summary)}
@@ -63092,7 +63116,7 @@ async function syncAssigned(context, args, env) {
     seat_id: seatId,
     client
   }, { targetSeatId: seatId });
-  const summary = applyLocalSkillChanges(output, client, env, { removeRevoked: true });
+  const summary = applyLocalSkillChanges(context.io, output, client, env, { removeRevoked: true });
   const outputRecord = asRecord4(output);
   context.io.stdout.write(parsed.json ? `${JSON.stringify({ ...outputRecord, local: summary }, null, 2)}
 ` : `${formatLocalSummary(summary)}
@@ -63128,15 +63152,19 @@ async function executeSkillCommand(context, commandId, body, options = {}) {
     throw error51;
   }
 }
-function applyLocalSkillChanges(output, client, env, options) {
-  const root = installRoot2(client, env);
-  const changes = writeInstalls(output, root);
+function applyLocalSkillChanges(io, output, client, env, options) {
+  const { root, legacyNotice } = installRoot(client, env);
+  if (legacyNotice !== null) {
+    io.stderr.write(`${legacyNotice}
+`);
+  }
+  const changes = writeInstalls(io, output, root);
   if (options.removeRevoked) {
     changes.push(...removeRevokedInstalls(output, root));
   }
   return changes;
 }
-function writeInstalls(output, root) {
+function writeInstalls(io, output, root) {
   const installs = asArray2(asRecord4(output).installs);
   return installs.map((entry) => {
     const install = asRecord4(entry);
@@ -63144,10 +63172,27 @@ function writeInstalls(output, root) {
     const metadata = asRecord4(install.metadata);
     const files = asArray2(install.files).map(asRecord4);
     const dir = path5.join(root, slug2);
-    const metadataPath = path5.join(dir, ".rost-skill.json");
+    const metadataPath = path5.join(dir, CATALOG_SKILL_MARKER_FILE);
     const expectedHash = String(metadata.content_sha256 ?? "");
     if (existingHash(metadataPath) === expectedHash) {
-      return { slug: slug2, dir, status: "unchanged", files: files.length };
+      const expected = files.map((file2) => {
+        const declaredHash = file2.content_sha256;
+        const sha256 = typeof declaredHash === "string" ? declaredHash : "";
+        const sizeBytes = typeof file2.size_bytes === "number" ? file2.size_bytes : void 0;
+        return {
+          path: safeRelativePath2(String(file2.path ?? "")),
+          sha256,
+          ...sizeBytes === void 0 ? {} : { sizeBytes }
+        };
+      });
+      const verified = verifyInstalledTree(dir, { files: expected }, { markerFile: CATALOG_SKILL_MARKER_FILE });
+      if (verified.ok) {
+        return { slug: slug2, dir, status: "unchanged", files: files.length };
+      }
+      io.stderr.write(
+        `NOTICE: the installed Skill ${slug2} does not match the server package (${verified.reason}); reinstalling.
+`
+      );
     }
     rmSync2(dir, { recursive: true, force: true });
     mkdirSync2(dir, { recursive: true });
@@ -63184,32 +63229,29 @@ function removeRevokedInstalls(output, root) {
   }
   return changes;
 }
-function installRoot2(client, env) {
-  const override = env.ROST_SKILL_INSTALL_ROOT;
-  if (override && override.length > 0) {
-    return path5.resolve(override, client);
-  }
-  if (client === "codex") {
-    try {
-      return path5.join(resolveCodexSkillsRoot(env), "rost");
-    } catch (error51) {
-      if (error51 instanceof UsageError2) {
-        throw new UsageError3(error51.message);
-      }
-      throw error51;
+function installRoot(client, env) {
+  let resolved;
+  try {
+    resolved = resolveSkillInstallRoot(client, env);
+  } catch (error51) {
+    if (error51 instanceof UsageError2) {
+      throw new UsageError3(error51.message);
     }
+    throw error51;
   }
-  if (client === "claude-code") {
-    return path5.join(env.CLAUDE_HOME ?? path5.join(os2.homedir(), ".claude"), "skills", "rost");
-  }
-  return path5.join(os2.homedir(), ".cursor", "skills", "rost");
+  const root = resolved.viaOverride ? resolved.root : path5.join(resolved.root, "rost");
+  return { root, legacyNotice: resolved.legacyNotice };
 }
 function safeRelativePath2(value) {
   const normalized = value.trim().replaceAll("\\", "/").replace(/^\.\/+/, "");
   if (!normalized || normalized.startsWith("/") || normalized.includes("//") || normalized.split("/").includes("..")) {
     throw new UsageError3("Server returned an invalid skill file path.");
   }
-  return normalized;
+  const collapsed = normalized.split("/").filter((segment) => segment !== ".").join("/");
+  if (!collapsed) {
+    throw new UsageError3("Server returned an invalid skill file path.");
+  }
+  return collapsed;
 }
 function safeLocalSlug(value) {
   if (!/^[a-z0-9][a-z0-9-]{1,80}$/.test(value)) {
@@ -64643,7 +64685,7 @@ import { execFile as execFileCallback4 } from "node:child_process";
 import { createHash as createHash3, randomBytes } from "node:crypto";
 import { constants as fsConstants3 } from "node:fs";
 import { chmod, link, lstat, mkdir as mkdir5, mkdtemp, open, readdir as readdir3, readFile as readFile8, realpath, rename, rm as rm5, stat as stat4, writeFile as writeFile5 } from "node:fs/promises";
-import os3 from "node:os";
+import os2 from "node:os";
 import path8 from "node:path";
 import { setTimeout as sleep2 } from "node:timers/promises";
 import { promisify as promisify4 } from "node:util";
@@ -64746,7 +64788,7 @@ function resolveSourceClaudeConfigDir(base) {
     return explicit;
   }
   const home = base.HOME;
-  const homeDir = typeof home === "string" && home.length > 0 ? home : os3.homedir();
+  const homeDir = typeof home === "string" && home.length > 0 ? home : os2.homedir();
   return path8.join(homeDir, ".claude");
 }
 async function provisionIsolatedClaudeConfigDir(base, configDir, onRepair) {
@@ -64769,7 +64811,7 @@ function resolveSourceCodexHomeDir(base) {
     return explicit;
   }
   const home = base.HOME;
-  const homeDir = typeof home === "string" && home.length > 0 ? home : os3.homedir();
+  const homeDir = typeof home === "string" && home.length > 0 ? home : os2.homedir();
   return path8.join(homeDir, ".codex");
 }
 var CODEX_HOME_TMP_PREFIX = ".rost-tmp-";