@serviceme/devtools-core 0.1.5 → 0.1.7

package/dist/index.mjs

@@ -5,10 +5,316 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
   throw Error('Dynamic require of "' + x + '" is not supported');
 });
 
+// src/agents/AgentCatalogClient.ts
+import { createServicemeError } from "@serviceme/devtools-protocol";
+var AgentCatalogClient = class {
+  constructor(options = {}) {
+    this.fetchImpl = options.fetchImpl ?? fetch;
+    this.baseUrl = options.baseUrl;
+  }
+  async getCatalog() {
+    if (!this.baseUrl) {
+      return {
+        agents: [],
+        fetchedAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+    }
+    const response = await this.fetchImpl(
+      `${this.baseUrl}/api/v1/marketplace/agents`
+    );
+    if (!response.ok) {
+      throw new Error(`Failed to fetch agents catalog: ${response.status}`);
+    }
+    const data = await response.json();
+    return {
+      agents: data.agents ?? [],
+      fetchedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+  }
+  async downloadAgent(remoteId) {
+    if (!this.baseUrl) {
+      throw createServicemeError(
+        "workspace_not_found",
+        "Agent catalog baseUrl is not configured."
+      );
+    }
+    const response = await this.fetchImpl(
+      `${this.baseUrl}/api/v1/marketplace/agents/download/${remoteId}`
+    );
+    if (!response.ok) {
+      if (response.status === 404) {
+        throw createServicemeError(
+          "not_found",
+          `Agent '${remoteId}' not found`
+        );
+      }
+      throw new Error(
+        `Failed to download agent ${remoteId}: ${response.status}`
+      );
+    }
+    const payload = await response.json();
+    return payload.data?.files ?? [];
+  }
+};
+
+// src/permissions/agent-permissions.ts
+var TOOL_RISK_MAP = {
+  shell: "high",
+  terminal: "high",
+  run_in_terminal: "high",
+  execution_subagent: "high",
+  filesystem: "medium",
+  fetch: "medium",
+  fetch_webpage: "medium",
+  create_file: "medium",
+  replace_string_in_file: "medium",
+  multi_replace_string_in_file: "medium",
+  read_file: "low",
+  search: "low",
+  grep_search: "low",
+  file_search: "low",
+  semantic_search: "low",
+  list_dir: "low"
+};
+var FRONTMATTER_REGEX = /^---\r?\n([\s\S]*?)\r?\n---/;
+var TOOLS_LINE_REGEX = /^tools:\s*$/m;
+var TOOLS_INLINE_REGEX = /^tools:\s*\[([^\]]*)\]/m;
+var LIST_ITEM_REGEX = /^\s*-\s+(.+)$/;
+function parseAgentToolPermissions(content) {
+  const fmMatch = content.match(FRONTMATTER_REGEX);
+  if (!fmMatch?.[1]) return [];
+  const frontmatter = fmMatch[1];
+  const inlineMatch = frontmatter.match(TOOLS_INLINE_REGEX);
+  if (inlineMatch?.[1] != null) {
+    const raw = inlineMatch[1];
+    return raw.split(",").map((t) => t.trim()).filter(Boolean).map((tool) => ({
+      tool,
+      riskLevel: TOOL_RISK_MAP[tool] ?? "medium"
+    }));
+  }
+  const blockMatch = frontmatter.match(TOOLS_LINE_REGEX);
+  if (!blockMatch?.[0]) return [];
+  const toolsStartIndex = frontmatter.indexOf(blockMatch[0]) + blockMatch[0].length;
+  const remaining = frontmatter.slice(toolsStartIndex);
+  const lines = remaining.split(/\r?\n/);
+  const tools = [];
+  for (const line of lines) {
+    const itemMatch = line.match(LIST_ITEM_REGEX);
+    if (itemMatch?.[1]) {
+      const tool = itemMatch[1].trim();
+      tools.push({ tool, riskLevel: TOOL_RISK_MAP[tool] ?? "medium" });
+    } else if (line.trim() !== "" && !line.startsWith(" ") && !line.startsWith("	")) {
+      break;
+    }
+  }
+  return tools;
+}
+
+// src/agents/AgentReconciler.ts
+var AgentReconciler = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  async mutate(request) {
+    if (request.targetScope !== "workspace" && request.targetScope !== "user") {
+      throw new Error(`Invalid target scope: ${String(request.targetScope)}`);
+    }
+    if (request.action === "uninstall" || request.action === "move" || request.action === "removeExternal") {
+      return {
+        status: "success",
+        changed: true,
+        message: `Agent ${request.action} completed.`
+      };
+    }
+    if (request.action !== "install") {
+      return {
+        status: "blocked",
+        changed: false,
+        message: `Agent action is not supported by bridge reconciler: ${request.action}`
+      };
+    }
+    const catalog = await this.deps.catalogClient.getCatalog();
+    const remoteAgent = catalog.agents.find(
+      (agent) => this.deps.agentStore.normalizeRemoteAgentId(agent.id) === request.agentId
+    );
+    if (!remoteAgent) {
+      return {
+        status: "blocked",
+        changed: false,
+        message: "Agent not found in catalog."
+      };
+    }
+    if (!request.confirmed && this.hasHighRiskTool(remoteAgent.tools)) {
+      return {
+        status: "requires_confirmation",
+        changed: false,
+        message: "This agent uses high-risk tools that require confirmation.",
+        tools: remoteAgent.tools
+      };
+    }
+    return {
+      status: "success",
+      changed: true,
+      message: "Agent installed."
+    };
+  }
+  getPermissionSummary(agentId, agentName, content) {
+    const tools = parseAgentToolPermissions(content);
+    return {
+      agentId,
+      agentName,
+      tools,
+      highRiskCount: tools.filter((tool) => tool.riskLevel === "high").length,
+      mediumRiskCount: tools.filter((tool) => tool.riskLevel === "medium").length,
+      lowRiskCount: tools.filter((tool) => tool.riskLevel === "low").length
+    };
+  }
+  hasHighRiskTool(tools) {
+    return tools.some((tool) => TOOL_RISK_MAP[tool] === "high");
+  }
+};
+
+// src/agents/AgentStore.ts
+import * as fs from "fs/promises";
+import * as path from "path";
+var WORKSPACE_AGENTS_ROOT_RELATIVE = ".github/agents";
+var WORKSPACE_AGENTS_STATE_RELATIVE = ".github/.ms-devtools-agents.yml";
+var SAFE_LOCAL_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+function assertSafeLocalAgentId(agentId) {
+  if (typeof agentId !== "string" || agentId.length === 0 || agentId === "." || agentId === ".." || agentId.includes("/") || agentId.includes("\\") || !SAFE_LOCAL_ID_PATTERN.test(agentId)) {
+    throw new Error(`Invalid agent id: ${agentId}`);
+  }
+  return agentId;
+}
+var AgentStore = class {
+  constructor(options) {
+    this.workspacePath = options.workspacePath;
+    this.userAgentsRoot = options.userAgentsRoot;
+    this.fileSystem = options.fileSystem ?? fs;
+    this.schemaVersion = options.schemaVersion ?? 1;
+  }
+  normalizeRemoteAgentId(remoteId) {
+    if (remoteId.startsWith("official/")) {
+      return assertSafeLocalAgentId(remoteId.slice("official/".length));
+    }
+    if (remoteId.startsWith("community/")) {
+      const lastSlash = remoteId.lastIndexOf("/");
+      return assertSafeLocalAgentId(remoteId.slice(lastSlash + 1));
+    }
+    return assertSafeLocalAgentId(remoteId);
+  }
+  getWorkspaceAgentsRootPath() {
+    return WORKSPACE_AGENTS_ROOT_RELATIVE;
+  }
+  getWorkspaceStateFilePath() {
+    return WORKSPACE_AGENTS_STATE_RELATIVE;
+  }
+  getUserAgentsRootPath() {
+    return this.userAgentsRoot;
+  }
+  async listWorkspaceAgentIds() {
+    return this.listAgentIds(
+      path.join(this.workspacePath, WORKSPACE_AGENTS_ROOT_RELATIVE)
+    );
+  }
+  async listUserAgentIds() {
+    return this.listAgentIds(this.userAgentsRoot);
+  }
+  async readState() {
+    try {
+      const raw = await this.fileSystem.readFile(
+        path.join(this.workspacePath, WORKSPACE_AGENTS_STATE_RELATIVE),
+        "utf-8"
+      );
+      const parsed = JSON.parse(raw);
+      if (typeof parsed.schemaVersion !== "number" || !Array.isArray(parsed.installedAgents)) {
+        return null;
+      }
+      return parsed;
+    } catch {
+      return null;
+    }
+  }
+  async writeState(state) {
+    const statePath = path.join(
+      this.workspacePath,
+      WORKSPACE_AGENTS_STATE_RELATIVE
+    );
+    await this.fileSystem.mkdir(path.dirname(statePath), { recursive: true });
+    await this.fileSystem.writeFile(
+      statePath,
+      JSON.stringify(state, null, 2),
+      "utf-8"
+    );
+  }
+  async addInstalledAgent(entry) {
+    const state = await this.readState() ?? {
+      schemaVersion: this.schemaVersion,
+      installedAgents: []
+    };
+    state.installedAgents = state.installedAgents.filter(
+      (agent) => agent.id !== entry.id
+    );
+    state.installedAgents.push(entry);
+    await this.writeState(state);
+  }
+  async removeInstalledAgent(agentId) {
+    const state = await this.readState();
+    if (!state) {
+      return;
+    }
+    state.installedAgents = state.installedAgents.filter(
+      (agent) => agent.id !== agentId
+    );
+    await this.writeState(state);
+  }
+  async writeAgentFiles(agentId, scope, files) {
+    const root = scope === "workspace" ? path.join(this.workspacePath, WORKSPACE_AGENTS_ROOT_RELATIVE) : this.userAgentsRoot;
+    const firstFile = files[0];
+    const isSingleFlatFile = files.length === 1 && firstFile !== void 0 && firstFile.path === `${agentId}.agent.md` && !firstFile.path.includes("/");
+    const targetDir = isSingleFlatFile ? root : path.join(root, agentId);
+    await this.fileSystem.mkdir(targetDir, { recursive: true });
+    for (const file of files) {
+      const filePath = path.join(targetDir, file.path);
+      await this.fileSystem.mkdir(path.dirname(filePath), { recursive: true });
+      await this.fileSystem.writeFile(filePath, file.content, "utf-8");
+      if (file.executable) {
+        try {
+          await this.fileSystem.chmod(filePath, 493);
+        } catch {
+        }
+      }
+    }
+  }
+  async listAgentIds(dir) {
+    try {
+      const entries = await this.fileSystem.readdir(dir, {
+        withFileTypes: true
+      });
+      const ids = [];
+      for (const entry of entries) {
+        if (entry.name.startsWith(".")) {
+          continue;
+        }
+        if (entry.isDirectory()) {
+          ids.push(entry.name);
+          continue;
+        }
+        if (entry.isFile() && entry.name.endsWith(".agent.md")) {
+          ids.push(entry.name.replace(/\.agent\.md$/, ""));
+        }
+      }
+      return ids.sort();
+    } catch {
+      return [];
+    }
+  }
+};
+
 // src/copilot/doctor.ts
 import {
   COPILOT_ERROR_CODES,
-  createServicemeError
+  createServicemeError as createServicemeError2
 } from "@serviceme/devtools-protocol";
 
 // src/process/runCommand.ts
@@ -153,13 +459,13 @@ async function copilotDoctor() {
   return { installed: true, version, authenticated };
 }
 function createCopilotNotInstalledError() {
-  return createServicemeError(
+  return createServicemeError2(
     COPILOT_ERROR_CODES.NOT_INSTALLED,
     "GitHub Copilot CLI is not installed. Visit https://docs.github.com/en/copilot/using-github-copilot/using-github-copilot-in-the-command-line to install."
   );
 }
 function createCopilotAuthRequiredError() {
-  return createServicemeError(
+  return createServicemeError2(
     COPILOT_ERROR_CODES.AUTH_REQUIRED,
     "GitHub Copilot CLI requires authentication. Run `copilot auth login` to sign in."
   );
@@ -168,7 +474,7 @@ function createCopilotAuthRequiredError() {
 // src/copilot/prompt.ts
 import {
   COPILOT_ERROR_CODES as COPILOT_ERROR_CODES2,
-  createServicemeError as createServicemeError2
+  createServicemeError as createServicemeError3
 } from "@serviceme/devtools-protocol";
 var COPILOT_COMMAND2 = "copilot";
 var DEFAULT_TIMEOUT_MS = 12e4;
@@ -203,7 +509,7 @@ async function copilotPrompt(options) {
     });
     const output = stripAnsi(result.stdout);
     if (output.includes("I'm sorry, but I cannot assist") && result.stderr?.includes("Stream completed without a response")) {
-      throw createServicemeError2(
+      throw createServicemeError3(
         COPILOT_ERROR_CODES2.AUTH_REQUIRED,
         "Copilot CLI returned a refusal response. This typically indicates an expired authentication token. Run `gh auth login` to re-authenticate.",
         { exitCode: 0, output, stderr: result.stderr }
@@ -213,7 +519,7 @@ async function copilotPrompt(options) {
   } catch (error) {
     const err = error;
     if (err.code === "ETIMEDOUT") {
-      throw createServicemeError2(
+      throw createServicemeError3(
         COPILOT_ERROR_CODES2.TIMEOUT,
         `Copilot prompt timed out after ${String(timeout)}ms.`
       );
@@ -222,7 +528,7 @@ async function copilotPrompt(options) {
     const output = stripAnsi(err.stdout ?? "");
     const stderr = err.stderr ?? err.message ?? "";
     if (output.includes("I'm sorry, but I cannot assist") || stderr.includes("Stream completed without a response")) {
-      throw createServicemeError2(
+      throw createServicemeError3(
         COPILOT_ERROR_CODES2.AUTH_REQUIRED,
         "Copilot CLI returned a refusal response. This typically indicates an expired authentication token. Run `gh auth login` to re-authenticate.",
         { exitCode, output, stderr }
@@ -231,7 +537,7 @@ async function copilotPrompt(options) {
     if (exitCode !== 0 && output) {
       return { output, exitCode };
     }
-    throw createServicemeError2(
+    throw createServicemeError3(
       COPILOT_ERROR_CODES2.EXECUTION_FAILED,
       stderr || `Copilot exited with code ${String(exitCode)}.`,
       { exitCode, stderr }
@@ -241,14 +547,20 @@ async function copilotPrompt(options) {
 
 // src/env/environmentInspector.ts
 import {
-  createServicemeError as createServicemeError3,
+  createServicemeError as createServicemeError4,
   KNOWN_ENVIRONMENT_TOOLS
 } from "@serviceme/devtools-protocol";
 var DEFAULT_TOOL_CHECK_TIMEOUT_MS = 5e3;
 var TOOL_CHECK_TIMEOUT_MS = {
   nuget: 12e3,
   nvm: 8e3,
-  dotnet: 8e3
+  dotnet: 8e3,
+  // nvm4w/npm shims and globally-installed .cmd tools (pnpm, nrm) are slow to
+  // resolve on cold PATHs. Give them extra headroom so the version probe
+  // doesn't fall through to the generic 5s default.
+  npm: 15e3,
+  pnpm: 15e3,
+  nrm: 15e3
 };
 var ERROR_CODE_NOT_FOUND = 127;
 var ERROR_CODE_TIMEOUT = "ETIMEDOUT";
@@ -263,7 +575,7 @@ var EnvironmentInspector = class {
   }
   async checkTool(toolName) {
     if (!/^[a-zA-Z0-9-]+$/.test(toolName)) {
-      throw createServicemeError3("invalid_params", "Invalid tool name.");
+      throw createServicemeError4("invalid_params", "Invalid tool name.");
     }
     try {
       if (toolName === "nvm") {
@@ -295,8 +607,29 @@ var EnvironmentInspector = class {
       return void 0;
     }
   }
+  /**
+   * On Windows, prefer the `.cmd` shim for npm/pnpm/nrm. nvm4w registers
+   * BOTH an extensionless entry (pointing to node.exe) and a `<tool>.cmd`
+   * wrapper; `where` returns them in that order, and the extensionless one
+   * would just print node's own version.
+   */
+  async getToolShimPath(toolName) {
+    try {
+      const result = await runCommand("where", {
+        args: [toolName],
+        timeoutMs: this.getToolTimeout(toolName)
+      });
+      const candidates = result.stdout.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.length > 0);
+      const cmdShim = candidates.find(
+        (line) => line.toLowerCase().endsWith(".cmd")
+      );
+      return cmdShim ?? candidates[0];
+    } catch {
+      return void 0;
+    }
+  }
   async getToolVersion(toolName) {
-    const invocation = this.getVersionInvocation(toolName);
+    const invocation = await this.getVersionInvocation(toolName);
     const result = await runCommand(invocation.command, {
       args: invocation.args,
       timeoutMs: this.getToolTimeout(toolName)
@@ -371,12 +704,19 @@ var EnvironmentInspector = class {
       return this.handleToolCheckError(error);
     }
   }
-  getVersionInvocation(toolName) {
+  async getVersionInvocation(toolName) {
     const isWindows = process.platform === "win32";
     if (isWindows && ["npm", "pnpm", "nrm"].includes(toolName)) {
+      const shim = await this.getToolShimPath(toolName);
+      if (shim) {
+        return {
+          command: "cmd.exe",
+          args: ["/c", shim, "--version"]
+        };
+      }
       return {
         command: "cmd.exe",
-        args: ["/d", "/s", "/c", `${toolName} --version`]
+        args: ["/c", toolName, "--version"]
       };
     }
     const commands = {
@@ -419,7 +759,7 @@ var EnvironmentInspector = class {
     const execError = error;
     const message = execError.message || String(error);
     const code = execError.code;
-    const isNotFound = message.includes("command not found") || message.includes("not recognized") || message.includes("ENOENT") || code === "ENOENT" || code === ERROR_CODE_NOT_FOUND;
+    const isNotFound = message.includes("command not found") || message.includes("not recognized") || message.includes("ENOENT") || message.includes("EACCES") || code === "ENOENT" || code === "EACCES" || code === ERROR_CODE_NOT_FOUND;
     const isTimeout = code === ERROR_CODE_TIMEOUT || message.toLowerCase().includes("timed out");
     return {
       installed: false,
@@ -429,10 +769,10 @@ var EnvironmentInspector = class {
 };
 
 // src/image/imageTools.ts
-import * as fs from "fs/promises";
-import * as path from "path";
+import * as fs2 from "fs/promises";
+import * as path2 from "path";
 import {
-  createServicemeError as createServicemeError4
+  createServicemeError as createServicemeError5
 } from "@serviceme/devtools-protocol";
 var SUPPORTED_FORMATS = [
   ".jpg",
@@ -453,7 +793,7 @@ var ImageTools = class {
       if (!await this.pathExists(filePath)) {
         return { valid: false };
       }
-      if (!SUPPORTED_FORMATS.includes(path.extname(filePath).toLowerCase())) {
+      if (!SUPPORTED_FORMATS.includes(path2.extname(filePath).toLowerCase())) {
         return { valid: false };
       }
       await this.getInfo(filePath, sharpModulePath);
@@ -465,7 +805,7 @@ var ImageTools = class {
   async getInfo(imagePath, sharpModulePath) {
     const sharp = this.loadSharp(sharpModulePath);
     const metadata = await sharp(imagePath).metadata();
-    const stats = await fs.stat(imagePath);
+    const stats = await fs2.stat(imagePath);
     return {
       width: metadata.width ?? 0,
       height: metadata.height ?? 0,
@@ -477,12 +817,12 @@ var ImageTools = class {
   async compress(imagePath, options) {
     const validation = await this.validate(imagePath, options.sharpModulePath);
     if (!validation.valid) {
-      throw createServicemeError4(
+      throw createServicemeError5(
         "invalid_params",
         `Invalid image file: ${imagePath}`
       );
     }
-    const originalStats = await fs.stat(imagePath);
+    const originalStats = await fs2.stat(imagePath);
     const originalSize = originalStats.size;
     const outputPath = this.getOutputPath(imagePath, options);
     const compressedBuffer = await this.compressWithSharp(imagePath, options);
@@ -497,7 +837,7 @@ var ImageTools = class {
         outputPath: imagePath
       };
     }
-    await fs.writeFile(outputPath, compressedBuffer);
+    await fs2.writeFile(outputPath, compressedBuffer);
     return {
       originalSize,
       compressedSize,
@@ -508,7 +848,7 @@ var ImageTools = class {
   async compressWithSharp(imagePath, options) {
     const sharp = this.loadSharp(options.sharpModulePath);
     let pipeline = sharp(imagePath);
-    switch (options.format ?? path.extname(imagePath).toLowerCase().slice(1)) {
+    switch (options.format ?? path2.extname(imagePath).toLowerCase().slice(1)) {
       case "jpg":
       case "jpeg":
         pipeline = pipeline.jpeg({ quality: options.quality });
@@ -534,14 +874,14 @@ var ImageTools = class {
     if (options.replaceOriginImage) {
       return inputPath;
     }
-    const dir = path.dirname(inputPath);
-    const ext = path.extname(inputPath);
-    const name = path.basename(inputPath, ext);
-    return path.join(dir, `${name}_compressed${ext}`);
+    const dir = path2.dirname(inputPath);
+    const ext = path2.extname(inputPath);
+    const name = path2.basename(inputPath, ext);
+    return path2.join(dir, `${name}_compressed${ext}`);
   }
   async pathExists(targetPath) {
     try {
-      await fs.access(targetPath);
+      await fs2.access(targetPath);
       return true;
     } catch {
       return false;
@@ -551,7 +891,7 @@ var ImageTools = class {
     try {
       return sharpModulePath ? __require(sharpModulePath) : __require("sharp");
     } catch (error) {
-      throw createServicemeError4(
+      throw createServicemeError5(
         "internal_error",
         `sharp is required for image operations: ${error instanceof Error ? error.message : String(error)}`
       );
@@ -564,7 +904,7 @@ function createImageTools() {
 
 // src/json/jsonTools.ts
 import {
-  createServicemeError as createServicemeError5,
+  createServicemeError as createServicemeError6,
   DEFAULT_JSON_SORT_OPTIONS
 } from "@serviceme/devtools-protocol";
 import { parse as parseCommentJson } from "comment-json";
@@ -608,7 +948,7 @@ function parseJson(text) {
     } catch {
     }
   }
-  throw createServicemeError5("json_invalid_input", "Invalid JSON format.");
+  throw createServicemeError6("json_invalid_input", "Invalid JSON format.");
 }
 function sortObject(obj, options) {
   if (Array.isArray(obj)) {
@@ -700,10 +1040,10 @@ function createConsoleLogger(prefix = "serviceme") {
 }
 
 // src/project/projectTools.ts
-import * as fs2 from "fs/promises";
-import * as path2 from "path";
+import * as fs3 from "fs/promises";
+import * as path3 from "path";
 import {
-  createServicemeError as createServicemeError6
+  createServicemeError as createServicemeError7
 } from "@serviceme/devtools-protocol";
 
 // src/utils/fileUtils.ts
@@ -717,7 +1057,7 @@ import {
   rename,
   rm
 } from "fs/promises";
-import { dirname as dirname2, join as join2 } from "path";
+import { dirname as dirname3, join as join3 } from "path";
 import { open } from "yauzl";
 var unzipFile = (zipPath, dest) => {
   return new Promise((resolve, reject) => {
@@ -730,12 +1070,12 @@ var unzipFile = (zipPath, dest) => {
         zipfile.readEntry();
         zipfile.on("entry", (entry) => {
           if (/\/$/.test(entry.fileName)) {
-            void mkdir(join2(dest, entry.fileName), { recursive: true }).then(() => {
+            void mkdir(join3(dest, entry.fileName), { recursive: true }).then(() => {
               zipfile.readEntry();
             }).catch(reject);
           } else {
-            const outputPath = join2(dest, entry.fileName);
-            void mkdir(dirname2(outputPath), { recursive: true }).then(() => {
+            const outputPath = join3(dest, entry.fileName);
+            void mkdir(dirname3(outputPath), { recursive: true }).then(() => {
               zipfile.openReadStream(
                 entry,
                 (streamError, readStream) => {
@@ -788,8 +1128,8 @@ var mergeEntry = async (sourcePath, destPath, overwrite) => {
     const children = await readdir(sourcePath);
     for (const child of children) {
       await mergeEntry(
-        join2(sourcePath, child),
-        join2(destPath, child),
+        join3(sourcePath, child),
+        join3(destPath, child),
         overwrite
       );
     }
@@ -814,8 +1154,8 @@ var moveFiles = async (sourceDir, destDir, overwrite = false) => {
   await mkdir(destDir, { recursive: true });
   const files = await readdir(sourceDir);
   for (const file of files) {
-    const sourceFile = join2(sourceDir, file);
-    const destFile = join2(destDir, file);
+    const sourceFile = join3(sourceDir, file);
+    const destFile = join3(destDir, file);
     if (!overwrite) {
       try {
         await access2(destFile, constants.F_OK);
@@ -832,10 +1172,10 @@ var moveFiles = async (sourceDir, destDir, overwrite = false) => {
 var ProjectTools = class {
   async extractTemplate(zipPath, workspacePath, tempExtractDir, input) {
     await unzipFile(zipPath, tempExtractDir);
-    let sourceDir = path2.join(tempExtractDir, input.extractedDirName);
+    let sourceDir = path3.join(tempExtractDir, input.extractedDirName);
     let actualDirName = input.extractedDirName;
     if (!await this.pathExists(sourceDir)) {
-      const entries = await fs2.readdir(tempExtractDir, { withFileTypes: true });
+      const entries = await fs3.readdir(tempExtractDir, { withFileTypes: true });
       const directories = entries.filter(
         (entry) => entry.isDirectory() && !entry.name.startsWith(".")
       );
@@ -847,7 +1187,7 @@ var ProjectTools = class {
       );
       if (selectedDirectory) {
         actualDirName = selectedDirectory;
-        sourceDir = path2.join(tempExtractDir, actualDirName);
+        sourceDir = path3.join(tempExtractDir, actualDirName);
       } else if (directories.length === 0) {
         throw new Error(
           `No directory found after extraction. Expected directory: ${input.extractedDirName}`
@@ -868,7 +1208,7 @@ var ProjectTools = class {
   }
   async installDependencies(workspacePath, command) {
     if (!command) {
-      throw createServicemeError6("invalid_params", "Expected install command.");
+      throw createServicemeError7("invalid_params", "Expected install command.");
     }
     await runCommand(command, {
       cwd: workspacePath,
@@ -905,7 +1245,7 @@ var ProjectTools = class {
     } else {
       for (const scriptPath of scripts) {
         try {
-          await fs2.chmod(scriptPath, 493);
+          await fs3.chmod(scriptPath, 493);
           updatedCount += 1;
         } catch {
         }
@@ -931,13 +1271,16 @@ var ProjectTools = class {
   }
   async runScaffoldPrune(workspacePath, preset) {
     if (!preset) {
-      throw createServicemeError6("invalid_params", "Expected scaffold preset.");
+      throw createServicemeError7("invalid_params", "Expected scaffold preset.");
     }
-    const commands = [
-      `pnpm run scaffold:prune -- --preset ${preset} --project-root .`,
-      `pnpm run scaffold:init-metadata -- --preset ${preset} --project-root . --force`
-    ];
+    await this.ensurePresetManifest(workspacePath, preset);
+    const pruneCommand = `pnpm run scaffold:prune -- --preset ${preset} --project-root .`;
+    const initMetadataCommand = `pnpm run scaffold:init-metadata -- --preset ${preset} --project-root . --force`;
+    const commands = [pruneCommand, initMetadataCommand];
     for (const command of commands) {
+      if (command === initMetadataCommand) {
+        await this.ensurePresetManifest(workspacePath, preset);
+      }
       await runCommand(command, {
         cwd: workspacePath,
         shell: true
@@ -949,16 +1292,54 @@ var ProjectTools = class {
       commands
     };
   }
+  async ensurePresetManifest(workspacePath, preset) {
+    const presetManifestPath = path3.join(
+      workspacePath,
+      ".ms-scaffold",
+      "presets",
+      `${preset}.json`
+    );
+    if (await this.pathExists(presetManifestPath)) {
+      return;
+    }
+    const projectModePath = path3.join(
+      workspacePath,
+      ".ms-scaffold",
+      "project-mode.json"
+    );
+    if (!await this.pathExists(projectModePath)) {
+      return;
+    }
+    const projectModeRaw = await fs3.readFile(projectModePath, "utf8");
+    const projectMode = JSON.parse(projectModeRaw);
+    const synthesizedPreset = {
+      preset,
+      selectedModules: Array.isArray(projectMode.selectedModules) ? projectMode.selectedModules : [],
+      prunedModules: Array.isArray(projectMode.prunedModules) ? projectMode.prunedModules : [],
+      exclude: [],
+      recommendedFollowUps: [],
+      managedFiles: [],
+      mergeManagedFiles: [],
+      userOwnedPaths: []
+    };
+    await fs3.mkdir(path3.dirname(presetManifestPath), { recursive: true });
+    await fs3.writeFile(
+      presetManifestPath,
+      `${JSON.stringify(synthesizedPreset, null, 2)}
+`,
+      "utf8"
+    );
+  }
   async findScripts(dir, extensions) {
     const results = [];
     let entries;
     try {
-      entries = await fs2.readdir(dir, { withFileTypes: true });
+      entries = await fs3.readdir(dir, { withFileTypes: true });
     } catch {
       return results;
     }
     for (const entry of entries) {
-      const fullPath = path2.join(dir, entry.name);
+      const fullPath = path3.join(dir, entry.name);
       if (entry.isDirectory() && entry.name !== "node_modules" && !entry.name.startsWith(".")) {
         results.push(...await this.findScripts(fullPath, extensions));
       } else if (entry.isFile() && extensions.some((ext) => entry.name.endsWith(ext))) {
@@ -969,7 +1350,7 @@ var ProjectTools = class {
   }
   async pathExists(targetPath) {
     try {
-      await fs2.access(targetPath);
+      await fs3.access(targetPath);
       return true;
     } catch {
       return false;
@@ -988,7 +1369,7 @@ var ProjectTools = class {
     const matches = [];
     for (const directoryName of directoryNames) {
       if (await this.directoryMatchesProjectPattern(
-        path2.join(tempExtractDir, directoryName),
+        path3.join(tempExtractDir, directoryName),
         projectFilePattern
       )) {
         matches.push(directoryName);
@@ -1000,7 +1381,7 @@ var ProjectTools = class {
     return null;
   }
   async directoryMatchesProjectPattern(directoryPath, projectFilePattern) {
-    const entries = await fs2.readdir(directoryPath);
+    const entries = await fs3.readdir(directoryPath);
     if (projectFilePattern.includes("*")) {
       const regex = new RegExp(`^${projectFilePattern.replace("*", ".*")}$`);
       return entries.some((entry) => regex.test(entry));
@@ -1013,17 +1394,17 @@ function createProjectTools() {
 }
 
 // src/scheduled-tasks/daemon/DaemonLogger.ts
-import * as fs3 from "fs";
-import * as path3 from "path";
+import * as fs4 from "fs";
+import * as path4 from "path";
 var CONFIG_DIR = ".serviceme";
 var LOG_FILE = "scheduler.log";
 var MAX_LOG_SIZE = 1024 * 1024;
 var DaemonLogger = class {
   constructor(workspacePath) {
-    this.logPath = path3.join(workspacePath, CONFIG_DIR, LOG_FILE);
-    const dir = path3.dirname(this.logPath);
-    if (!fs3.existsSync(dir)) {
-      fs3.mkdirSync(dir, { recursive: true });
+    this.logPath = path4.join(workspacePath, CONFIG_DIR, LOG_FILE);
+    const dir = path4.dirname(this.logPath);
+    if (!fs4.existsSync(dir)) {
+      fs4.mkdirSync(dir, { recursive: true });
     }
   }
   getLogPath() {
@@ -1034,16 +1415,16 @@ var DaemonLogger = class {
     const line = `[${ts}] [${level.toUpperCase()}] ${message}
 `;
     this.rotateIfNeeded();
-    fs3.appendFileSync(this.logPath, line, "utf-8");
+    fs4.appendFileSync(this.logPath, line, "utf-8");
   }
   rotateIfNeeded() {
     try {
-      const stats = fs3.statSync(this.logPath);
+      const stats = fs4.statSync(this.logPath);
       if (stats.size > MAX_LOG_SIZE) {
-        const content = fs3.readFileSync(this.logPath, "utf-8");
+        const content = fs4.readFileSync(this.logPath, "utf-8");
         const halfIdx = content.indexOf("\n", Math.floor(content.length / 2));
         if (halfIdx > 0) {
-          fs3.writeFileSync(this.logPath, content.slice(halfIdx + 1), "utf-8");
+          fs4.writeFileSync(this.logPath, content.slice(halfIdx + 1), "utf-8");
         }
       }
     } catch {
@@ -1052,33 +1433,33 @@ var DaemonLogger = class {
 };
 
 // src/scheduled-tasks/daemon/PidManager.ts
-import * as fs4 from "fs";
-import * as path4 from "path";
+import * as fs5 from "fs";
+import * as path5 from "path";
 var CONFIG_DIR2 = ".serviceme";
 var PID_FILE = "scheduler.pid";
 var PidManager = class {
   constructor(workspacePath) {
-    this.pidPath = path4.join(workspacePath, CONFIG_DIR2, PID_FILE);
+    this.pidPath = path5.join(workspacePath, CONFIG_DIR2, PID_FILE);
   }
   getPidPath() {
     return this.pidPath;
   }
   writePid(pid) {
-    const dir = path4.dirname(this.pidPath);
-    if (!fs4.existsSync(dir)) {
-      fs4.mkdirSync(dir, { recursive: true });
+    const dir = path5.dirname(this.pidPath);
+    if (!fs5.existsSync(dir)) {
+      fs5.mkdirSync(dir, { recursive: true });
     }
-    fs4.writeFileSync(this.pidPath, String(pid), "utf-8");
+    fs5.writeFileSync(this.pidPath, String(pid), "utf-8");
   }
   readPid() {
-    if (!fs4.existsSync(this.pidPath)) return null;
-    const raw = fs4.readFileSync(this.pidPath, "utf-8").trim();
+    if (!fs5.existsSync(this.pidPath)) return null;
+    const raw = fs5.readFileSync(this.pidPath, "utf-8").trim();
     const pid = Number.parseInt(raw, 10);
     return Number.isNaN(pid) ? null : pid;
   }
   removePid() {
-    if (fs4.existsSync(this.pidPath)) {
-      fs4.unlinkSync(this.pidPath);
+    if (fs5.existsSync(this.pidPath)) {
+      fs5.unlinkSync(this.pidPath);
     }
   }
   isProcessRunning(pid) {
@@ -1099,12 +1480,12 @@ var PidManager = class {
 };
 
 // src/scheduled-tasks/daemon/SchedulerDaemon.ts
-import * as fs9 from "fs";
+import * as fs10 from "fs";
 import * as os from "os";
 
 // src/scheduled-tasks/executors/GithubCopilotCliExecutor.ts
 import { spawn as spawn2 } from "child_process";
-import * as fs5 from "fs";
+import * as fs6 from "fs";
 
 // src/scheduled-tasks/executors/timeout.ts
 function resolveConfiguredTimeoutMs(timeoutSeconds, defaultTimeoutMs) {
@@ -1139,7 +1520,7 @@ function redactArgs(args) {
 function writeDiagnostic(message) {
   const logPath = process.env.SERVICEME_SCHEDULER_LOG_PATH;
   if (logPath) {
-    fs5.appendFileSync(logPath, message);
+    fs6.appendFileSync(logPath, message);
     return;
   }
   process.stderr.write(message);
@@ -1349,15 +1730,15 @@ ${body}`.trim()
 
 // src/scheduled-tasks/executors/ShellExecutor.ts
 import { spawn as spawn3 } from "child_process";
-import * as fs6 from "fs";
-import * as path5 from "path";
+import * as fs7 from "fs";
+import * as path6 from "path";
 var MAX_OUTPUT_BYTES2 = 1024 * 1024;
 var DEFAULT_TIMEOUT_MS4 = 6e4;
 var POSIX_SHELL_CANDIDATES = ["bash.exe", "sh.exe"];
 function resolveShellExecution(script, options = {}) {
   const platform = options.platform ?? process.platform;
   const env = options.env ?? process.env;
-  const fileExists = options.fileExists ?? fs6.existsSync;
+  const fileExists = options.fileExists ?? fs7.existsSync;
   if (platform === "win32") {
     const posixShell = usesPosixShellSyntax(script) ? findWindowsPosixShell(env, fileExists) : null;
     if (posixShell) {
@@ -1402,10 +1783,10 @@ function findWindowsPosixShell(env, fileExists) {
     if (fileExists(candidate)) return candidate;
   }
   const pathValue = env.Path ?? env.PATH ?? "";
-  for (const dir of pathValue.split(path5.win32.delimiter)) {
+  for (const dir of pathValue.split(path6.win32.delimiter)) {
     if (!dir) continue;
     for (const executable of POSIX_SHELL_CANDIDATES) {
-      const candidate = path5.win32.join(dir, executable);
+      const candidate = path6.win32.join(dir, executable);
       if (fileExists(candidate) && !isWindowsWslLauncher(candidate)) {
         return candidate;
       }
@@ -1414,13 +1795,13 @@ function findWindowsPosixShell(env, fileExists) {
   return null;
 }
 function isWindowsWslLauncher(candidate) {
-  const normalized = path5.win32.normalize(candidate).toLowerCase();
+  const normalized = path6.win32.normalize(candidate).toLowerCase();
   return normalized.endsWith("\\windows\\system32\\bash.exe") || normalized.endsWith("\\windows\\syswow64\\bash.exe");
 }
 function writeDiagnostic2(message) {
   const logPath = process.env.SERVICEME_SCHEDULER_LOG_PATH;
   if (logPath) {
-    fs6.appendFileSync(logPath, message);
+    fs7.appendFileSync(logPath, message);
     return;
   }
   process.stderr.write(message);
@@ -1567,9 +1948,9 @@ function getExecutor(taskType) {
 
 // src/scheduled-tasks/TaskConfigManager.ts
 import { randomUUID } from "crypto";
-import * as fs7 from "fs";
-import * as path6 from "path";
-import { createServicemeError as createServicemeError7 } from "@serviceme/devtools-protocol";
+import * as fs8 from "fs";
+import * as path7 from "path";
+import { createServicemeError as createServicemeError8 } from "@serviceme/devtools-protocol";
 var CONFIG_DIR3 = ".serviceme";
 var CONFIG_FILE = "scheduled-tasks.json";
 function emptyConfig() {
@@ -1580,7 +1961,7 @@ function isRecord(value) {
 }
 function requireNonEmptyString(payload, field, taskType) {
   if (!isRecord(payload) || typeof payload[field] !== "string" || !payload[field].trim()) {
-    throw createServicemeError7(
+    throw createServicemeError8(
       "invalid_payload",
       `${taskType} payload ${field} is required`
     );
@@ -1605,27 +1986,27 @@ function validateTaskPayload(taskType, payload) {
 }
 var TaskConfigManager = class {
   constructor(workspacePath) {
-    this.configPath = path6.join(workspacePath, CONFIG_DIR3, CONFIG_FILE);
+    this.configPath = path7.join(workspacePath, CONFIG_DIR3, CONFIG_FILE);
   }
   getConfigPath() {
     return this.configPath;
   }
   readConfig() {
-    if (!fs7.existsSync(this.configPath)) {
+    if (!fs8.existsSync(this.configPath)) {
       return emptyConfig();
     }
-    const raw = fs7.readFileSync(this.configPath, "utf-8");
+    const raw = fs8.readFileSync(this.configPath, "utf-8");
     const parsed = JSON.parse(raw);
     return parsed;
   }
   writeConfig(config) {
-    const dir = path6.dirname(this.configPath);
-    if (!fs7.existsSync(dir)) {
-      fs7.mkdirSync(dir, { recursive: true });
+    const dir = path7.dirname(this.configPath);
+    if (!fs8.existsSync(dir)) {
+      fs8.mkdirSync(dir, { recursive: true });
     }
     const tmp = `${this.configPath}.tmp`;
-    fs7.writeFileSync(tmp, JSON.stringify(config, null, "	"), "utf-8");
-    fs7.renameSync(tmp, this.configPath);
+    fs8.writeFileSync(tmp, JSON.stringify(config, null, "	"), "utf-8");
+    fs8.renameSync(tmp, this.configPath);
   }
   listTasks() {
     return this.readConfig().tasks;
@@ -1896,8 +2277,8 @@ var TaskExecutionEngine = class {
 
 // src/scheduled-tasks/TaskLogManager.ts
 import { randomUUID as randomUUID2 } from "crypto";
-import * as fs8 from "fs";
-import * as path7 from "path";
+import * as fs9 from "fs";
+import * as path8 from "path";
 var CONFIG_DIR4 = ".serviceme";
 var LOG_FILE2 = "scheduled-tasks-log.json";
 var MAX_LOGS = 200;
@@ -1922,17 +2303,17 @@ function validateAndRepairLogFile(raw) {
 }
 var TaskLogManager = class {
   constructor(workspacePath) {
-    this.logPath = path7.join(workspacePath, CONFIG_DIR4, LOG_FILE2);
+    this.logPath = path8.join(workspacePath, CONFIG_DIR4, LOG_FILE2);
   }
   getLogPath() {
     return this.logPath;
   }
   readLogFile() {
-    if (!fs8.existsSync(this.logPath)) {
+    if (!fs9.existsSync(this.logPath)) {
       return emptyLogFile();
     }
     try {
-      const raw = fs8.readFileSync(this.logPath, "utf-8");
+      const raw = fs9.readFileSync(this.logPath, "utf-8");
       const parsed = JSON.parse(raw);
       const file = validateAndRepairLogFile(parsed);
       if (!parsed || typeof parsed !== "object" || !Array.isArray(parsed.logs) || parsed.logs.length !== file.logs.length) {
@@ -1948,21 +2329,21 @@ var TaskLogManager = class {
   }
   backupCorruptedFile() {
     try {
-      if (fs8.existsSync(this.logPath)) {
+      if (fs9.existsSync(this.logPath)) {
         const backupPath = `${this.logPath}.corrupted.${Date.now()}`;
-        fs8.copyFileSync(this.logPath, backupPath);
+        fs9.copyFileSync(this.logPath, backupPath);
       }
     } catch {
     }
   }
   writeLogFile(file) {
-    const dir = path7.dirname(this.logPath);
-    if (!fs8.existsSync(dir)) {
-      fs8.mkdirSync(dir, { recursive: true });
+    const dir = path8.dirname(this.logPath);
+    if (!fs9.existsSync(dir)) {
+      fs9.mkdirSync(dir, { recursive: true });
     }
     const tmp = `${this.logPath}.tmp`;
-    fs8.writeFileSync(tmp, JSON.stringify(file, null, "	"), "utf-8");
-    fs8.renameSync(tmp, this.logPath);
+    fs9.writeFileSync(tmp, JSON.stringify(file, null, "	"), "utf-8");
+    fs9.renameSync(tmp, this.logPath);
   }
   appendLog(input) {
     const file = this.readLogFile();
@@ -2073,8 +2454,8 @@ var SchedulerDaemon = class {
     const configPath = this.configManager.getConfigPath();
     const dir = configPath.substring(0, configPath.lastIndexOf("/"));
     try {
-      if (fs9.existsSync(dir)) {
-        this.watcher = fs9.watch(dir, (_eventType, filename) => {
+      if (fs10.existsSync(dir)) {
+        this.watcher = fs10.watch(dir, (_eventType, filename) => {
           if (filename === "scheduled-tasks.json") {
             this.logger.log("info", "Config file changed, reconciling...");
           }
@@ -2226,7 +2607,214 @@ function matchCronField(field, value) {
   const values = field.split(",");
   return values.some((v) => Number.parseInt(v, 10) === value);
 }
+
+// src/skills/SkillCatalogClient.ts
+import { createServicemeError as createServicemeError9 } from "@serviceme/devtools-protocol";
+var SkillCatalogClient = class {
+  constructor(options = {}) {
+    this.fetchImpl = options.fetchImpl ?? fetch;
+    this.baseUrl = options.baseUrl;
+  }
+  async getCatalog() {
+    if (!this.baseUrl) {
+      return {
+        skills: [],
+        fetchedAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+    }
+    const response = await this.fetchImpl(
+      `${this.baseUrl}/api/v1/marketplace/skills`
+    );
+    if (!response.ok) {
+      throw new Error(`Failed to fetch skills catalog: ${response.status}`);
+    }
+    const data = await response.json();
+    return {
+      skills: data.skills ?? [],
+      fetchedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+  }
+  async downloadSkill(remoteId) {
+    if (!this.baseUrl) {
+      throw createServicemeError9(
+        "workspace_not_found",
+        "Skill catalog baseUrl is not configured."
+      );
+    }
+    const response = await this.fetchImpl(
+      `${this.baseUrl}/api/v1/marketplace/skills/download/${remoteId}`
+    );
+    if (!response.ok) {
+      if (response.status === 404) {
+        throw createServicemeError9(
+          "not_found",
+          `Skill '${remoteId}' not found`
+        );
+      }
+      throw new Error(
+        `Failed to download skill ${remoteId}: ${response.status}`
+      );
+    }
+    const payload = await response.json();
+    return payload.data?.files ?? [];
+  }
+};
+
+// src/skills/SkillReconciler.ts
+var SkillReconciler = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  async mutate(request) {
+    if (request.targetScope !== "workspace" && request.targetScope !== "user") {
+      throw new Error(`Invalid target scope: ${String(request.targetScope)}`);
+    }
+    if (request.action === "uninstall" || request.action === "move" || request.action === "removeExternal") {
+      return {
+        status: "success",
+        changed: true,
+        message: `Skill ${request.action} completed.`
+      };
+    }
+    if (request.action !== "install") {
+      return {
+        status: "blocked",
+        changed: false,
+        message: `Skill action is not supported by bridge reconciler: ${request.action}`
+      };
+    }
+    const catalog = await this.deps.catalogClient.getCatalog();
+    const remoteSkill = catalog.skills.find(
+      (skill) => this.deps.skillStore.normalizeRemoteSkillId(skill.id) === request.skillId
+    );
+    if (!remoteSkill) {
+      return {
+        status: "blocked",
+        changed: false,
+        message: "Skill not found in catalog."
+      };
+    }
+    if (!request.confirmed && (remoteSkill.hasScripts || remoteSkill.hasHooks)) {
+      return {
+        status: "requires_confirmation",
+        changed: false,
+        hasScripts: Boolean(remoteSkill.hasScripts),
+        hasHooks: Boolean(remoteSkill.hasHooks),
+        message: "This skill contains executable scripts that require confirmation."
+      };
+    }
+    return {
+      status: "success",
+      changed: true,
+      message: "Skill installed."
+    };
+  }
+};
+
+// src/skills/SkillStore.ts
+import * as fs11 from "fs/promises";
+import * as path9 from "path";
+var USER_SKILL_MARKER_FILE = ".ms-devtools-skill.json";
+var WORKSPACE_SKILLS_ROOT_RELATIVE = ".github/skills";
+var WORKSPACE_SKILLS_MARKER_RELATIVE = ".github/.ms-devtools-skills.yml";
+var SAFE_LOCAL_ID_PATTERN2 = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+function assertSafeLocalSkillId(skillId) {
+  if (typeof skillId !== "string" || skillId.length === 0 || skillId === "." || skillId === ".." || skillId.includes("/") || skillId.includes("\\") || !SAFE_LOCAL_ID_PATTERN2.test(skillId)) {
+    throw new Error(`Invalid skill id: ${skillId}`);
+  }
+  return skillId;
+}
+var SkillStore = class {
+  constructor(options) {
+    this.workspacePath = options.workspacePath;
+    this.userSkillsRoot = options.userSkillsRoot;
+    this.fileSystem = options.fileSystem ?? fs11;
+  }
+  normalizeRemoteSkillId(remoteId) {
+    if (remoteId.startsWith("official/")) {
+      return assertSafeLocalSkillId(remoteId.slice("official/".length));
+    }
+    if (remoteId.startsWith("community/")) {
+      const lastSlash = remoteId.lastIndexOf("/");
+      return assertSafeLocalSkillId(remoteId.slice(lastSlash + 1));
+    }
+    return assertSafeLocalSkillId(remoteId);
+  }
+  getWorkspaceSkillPath(skillId) {
+    return `${WORKSPACE_SKILLS_ROOT_RELATIVE}/${skillId}`;
+  }
+  getWorkspaceMarkerPath() {
+    return WORKSPACE_SKILLS_MARKER_RELATIVE;
+  }
+  getUserSkillPath(skillId) {
+    return path9.join(this.userSkillsRoot, skillId);
+  }
+  async listWorkspaceSkillIds() {
+    const skillsRootPath = path9.join(
+      this.workspacePath,
+      WORKSPACE_SKILLS_ROOT_RELATIVE
+    );
+    try {
+      const entries = await this.fileSystem.readdir(skillsRootPath, {
+        withFileTypes: true
+      });
+      return entries.filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).map((entry) => entry.name).sort();
+    } catch {
+      return [];
+    }
+  }
+  async listUserSkillIds() {
+    try {
+      const entries = await this.fileSystem.readdir(this.userSkillsRoot, {
+        withFileTypes: true
+      });
+      return entries.filter((entry) => entry.isDirectory() && !entry.name.startsWith(".")).map((entry) => entry.name).sort();
+    } catch {
+      return [];
+    }
+  }
+  async writeManagedUserSkillMarker(skillId) {
+    const targetDir = this.getUserSkillPath(skillId);
+    await this.fileSystem.mkdir(targetDir, { recursive: true });
+    await this.fileSystem.writeFile(
+      path9.join(targetDir, USER_SKILL_MARKER_FILE),
+      JSON.stringify({ skillId, installedBy: "ms-devtools" }, null, 2),
+      "utf-8"
+    );
+  }
+  async isManagedUserSkill(skillId) {
+    try {
+      const marker = await this.fileSystem.readFile(
+        path9.join(this.getUserSkillPath(skillId), USER_SKILL_MARKER_FILE),
+        "utf-8"
+      );
+      const parsed = JSON.parse(marker);
+      return parsed.skillId === skillId;
+    } catch {
+      return false;
+    }
+  }
+  async writeSkillFiles(skillId, scope, files) {
+    const root = scope === "workspace" ? path9.join(this.workspacePath, WORKSPACE_SKILLS_ROOT_RELATIVE) : this.userSkillsRoot;
+    const targetDir = path9.join(root, skillId);
+    await this.fileSystem.mkdir(targetDir, { recursive: true });
+    for (const file of files) {
+      const filePath = path9.join(targetDir, file.path);
+      await this.fileSystem.mkdir(path9.dirname(filePath), { recursive: true });
+      await this.fileSystem.writeFile(filePath, file.content, "utf-8");
+      if (file.executable) {
+        try {
+          await this.fileSystem.chmod(filePath, 493);
+        } catch {
+        }
+      }
+    }
+  }
+};
 export {
+  AgentCatalogClient,
+  AgentReconciler,
+  AgentStore,
   DaemonLogger,
   EnvironmentInspector,
   GithubCopilotCliExecutor,
@@ -2236,6 +2824,10 @@ export {
   ProjectTools,
   SchedulerDaemon,
   ShellExecutor,
+  SkillCatalogClient,
+  SkillReconciler,
+  SkillStore,
+  TOOL_RISK_MAP,
   TaskConfigManager,
   TaskExecutionEngine,
   TaskLogManager,
@@ -2253,6 +2845,7 @@ export {
   matchesCron,
   moveFiles,
   noopLogger,
+  parseAgentToolPermissions,
   parseIntervalMs,
   resolveTaskExecutionPayload,
   unzipFile,