@skaile/workspaces 4.9.4 → 4.11.0

package/dist/{chunk-7F4FGEMI.js → chunk-PBCNRS7Q.js}

@@ -1,6 +1,6 @@
-import { logErr } from './chunk-OIXSGSKM.js';
-import { flowKindProvider } from './chunk-AOE4KOMJ.js';
-import { knowledgeKindProvider } from './chunk-7LHSC2DS.js';
+import { logErr } from './chunk-JM2LRJ46.js';
+import { flowKindProvider } from './chunk-O3DHAGBO.js';
+import { knowledgeKindProvider } from './chunk-A3X4LDOD.js';
 import { createDefaultRegistry } from './chunk-M5H4DWIA.js';
 
 // cli/src/open-registry.ts
@@ -103,5 +103,5 @@ async function openLibraryManager() {
 }
 
 export { LocalCatalogDisabledError, createFullRegistry, openCatalogSource, openLibrary, openLibraryManager, resolveCatalogSource };
-//# sourceMappingURL=chunk-7F4FGEMI.js.map
-//# sourceMappingURL=chunk-7F4FGEMI.js.map
+//# sourceMappingURL=chunk-PBCNRS7Q.js.map
+//# sourceMappingURL=chunk-PBCNRS7Q.js.map

package/dist/{chunk-7F4FGEMI.js.map → chunk-PBCNRS7Q.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../cli/src/open-registry.ts","../cli/src/open-library.ts"],"names":["source"],"mappings":";;;;;;AA2BO,SAAS,kBAAA,GAAwC;AACtD,EAAA,MAAM,WAAW,qBAAA,EAAsB;AACvC,EAAA,QAAA,CAAS,SAAS,gBAAgB,CAAA;AAClC,EAAA,QAAA,CAAS,SAAS,qBAAqB,CAAA;AACvC,EAAA,OAAO,QAAA;AACT;;;ACfO,IAAM,yBAAA,GAAN,cAAwC,KAAA,CAAM;AAAA,EACnD,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,2BAAA;AAAA,EACd;AACF;AASA,eAAsB,WAAA,GAAc;AAClC,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,UAAA,EAAW,GAAI,MAAM,OAAO,oBAA4B,CAAA;AAChE,IAAA,OAAO,IAAI,UAAA,CAAW,EAAE,YAAA,EAAc,kBAAA,IAAsB,CAAA;AAAA,EAC9D,SAAS,GAAA,EAAK;AACZ,IAAA,MAAA,CAAO,CAAA,2BAAA,EAA8B,eAAe,KAAA,GAAQ,GAAA,CAAI,UAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAE,CAAA;AACvF,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AACF;AAqBA,eAAsB,kBAAkB,IAAA,EAQtC;AACA,EAAA,MAAM,EAAE,eAAe,mBAAA,EAAqB,iBAAA,EAAmB,mBAAkB,GAAI,MAAM,OACzF,oBACF,CAAA;AACA,EAAA,MAAM,MAAM,aAAA,CAAc;AAAA,IACxB,YAAY,IAAA,EAAM,UAAA;AAAA,IAClB,gBAAgB,IAAA,EAAM;AAAA,GACvB,CAAA;AACD,EAAA,MAAM,OAAA,GAAU,IAAA,EAAM,eAAA,IAAmB,GAAA,CAAI,OAAA,CAAQ,GAAA;AACrD,EAAA,IAAI,iBAAA,CAAkB,OAAO,CAAA,EAAG;AAC9B,IAAA,MAAM,IAAI,yBAAA;AAAA,MACR;AAAA,KAGF;AAAA,EACF;AACA,EAAA,MAAM,UAAA,GAAa,GAAA,CAAI,OAAA,CAAQ,SAAA,GAAY,GAAA;AAC3C,EAAA,IAAI,GAAA,CAAI,OAAA,CAAQ,OAAA,KAAY,MAAA,EAAQ;AAClC,IAAA,OAAO,IAAI,iBAAA,CAAkB,EAAE,OAAA,EAAS,YAAY,CAAA;AAAA,EACtD;AACA,EAAA,OAAO,IAAI,mBAAA,CAAoB,EAAE,OAAA,EAAS,YAAY,CAAA;AACxD;AAwCA,eAAsB,qBAAqB,IAAA,EAKR;AACjC,EAAA,MAAM;AAAA,IACJ,aAAA;AAAA,IACA,mBAAA;AAAA,IACA,iBAAA;AAAA,IACA,kBAAA;AAAA,IACA;AAAA,GACF,GAAI,MAAM,OAAO,oBAA4B,CAAA;AAC7C,EAAA,MAAM,MAAM,aAAA,CAAc;AAAA,IACxB,YAAY,IAAA,EAAM,UAAA;AAAA,IAClB,gBAAgB,IAAA,EAAM;AAAA,GACvB,CAAA;AACD,EAAA,MAAM,OAAA,GAAU,IAAA,EAAM,eAAA,IAAmB,GAAA,CAAI,OAAA,CAAQ,GAAA;AAErD,EAAA,IAAI,iBAAA,CAAkB,OAAO,CAAA,EAAG;AAC9B,IAAA,MAAM,EAAA,GAAK,MAAM,OAAO,IAAS,CAAA;AACjC,IAAA,MAAM,OAAA,GAAU,MAAM,WAAA,EAAY;AAClC,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,WAAA,EAAY;AAG1C,MAAA,MAAM,SAAS,OAAA,CACZ,MAAA;AAAA,QACC,CAAC,CAAA,KACC,CAAA,CAAE,OAAA,KAAY,OAAA,IAAW,OAAO,CAAA,CAAE,IAAA,KAAS,QAAA,IAAY,CAAA,CAAE,IAAA,CAAK,MAAA,GAAS;AAAA,OAC3E,CACC,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,SAAA,CAAU,OAAA,EAAQ,GAAI,CAAA,CAAE,SAAA,CAAU,OAAA,EAAS,CAAA;AAE/D,MAAA,IAAI,MAAA,CAAO,WAAW,CAAA,EAAG;AACvB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR;AAAA,SAEF;AAAA,MACF;AAGA,MAAA,MAAM,OAAA,GAAU,OAAO,IAAA,CAAK,CAAC,MAAM,EAAA,CAAG,UAAA,CAAW,CAAA,CAAE,IAAI,CAAC,CAAA;AACxD,MAAA,IAAI,CAAC,OAAA,EAAS;AACZ,QAAA,MAAM,IAAA,GAAO,OAAO,CAAC,CAAA;AACrB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,0GAAA,EACkB,IAAA,CAAK,IAAI,CAAA,UAAA,EAAa,KAAK,EAAE,CAAA,mGAAA;AAAA,SAEjD;AAAA,MACF;AAEA,MAAA,MAAMA,UAAS,IAAI,kBAAA;AAAA,QACjB,OAAA;AAAA,QACA,OAAA,CAAQ,EAAA;AAAA,QACR,OAAA,CAAQ,IAAA;AAAA,QACR,kBAAA;AAAmB,OACrB;AACA,MAAA,OAAO,EAAE,MAAA,EAAAA,OAAAA,EAAQ,OAAO,MAAM,OAAA,CAAQ,OAAM,EAAE;AAAA,IAChD,SAAS,GAAA,EAAK;AAGZ,MAAA,OAAA,CAAQ,KAAA,EAAM;AACd,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF;AAEA,EAAA,MAAM,UAAA,GAAa,GAAA,CAAI,OAAA,CAAQ,SAAA,GAAY,GAAA;AAC3C,EAAA,MAAM,SACJ,GAAA,CAAI,OAAA,CAAQ,OAAA,KAAY,MAAA,GACpB,IAAI,iBAAA,CAAkB,EAAE,OAAA,EAAS,UAAA,EAAY,CAAA,GAC7C,IAAI,oBAAoB,EAAE,OAAA,EAAS,YAAY,CAAA;AACrD,EAAA,OAAO,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM;AAAA,EAAC,CAAA,EAAE;AACnC;AASA,eAAsB,kBAAA,GAInB;AACD,EAAA,MAAM,EAAE,cAAA,EAAe,GAAI,MAAM,OAAO,oBAA4B,CAAA;AACpE,EAAA,MAAM,OAAA,GAAU,MAAM,WAAA,EAAY;AAClC,EAAA,MAAM,OAAA,GAAU,IAAI,cAAA,CAAe,OAAO,CAAA;AAC1C,EAAA,OAAO,EAAE,OAAA,EAAS,OAAA,EAAS,OAAO,MAAM,OAAA,CAAQ,OAAM,EAAE;AAC1D","file":"chunk-7F4FGEMI.js","sourcesContent":["/**\n * open-registry.ts — shared helper to create a full AssetKindRegistry.\n *\n * Bootstraps the registry with all built-in providers (9 core + preset)\n * from @skaile/discovery, plus the extension kind providers (flow from\n * @skaile/workspaces/factory-assets/connectors/flow/engine, knowledge from @skaile/library).\n *\n * This is the single registration point for the CLI. All code paths\n * that need a registry (source sync, lib-status, etc.) should use this.\n */\n\nimport type { AssetKindRegistry } from \"@skaile/workspaces/discovery\";\nimport { createDefaultRegistry } from \"@skaile/workspaces/discovery\";\nimport { flowKindProvider } from \"@skaile/workspaces/factory-assets/connectors/flow/engine\";\nimport { knowledgeKindProvider } from \"@skaile/workspaces/library\";\n\n/**\n * Create a fully-configured AssetKindRegistry with all known providers.\n *\n * Registers:\n * - 9 core kinds (skill, agent, connector, mount, mcp-server, contract, prompt, persona, ruleset)\n * - preset (composition entity)\n * - flow (extension, from @skaile/workspaces/factory-assets/connectors/flow/engine)\n * - knowledge (extension, from @skaile/library)\n *\n * @returns An unfrozen registry (auto-freezes on first read)\n */\nexport function createFullRegistry(): AssetKindRegistry {\n  const registry = createDefaultRegistry();\n  registry.register(flowKindProvider);\n  registry.register(knowledgeKindProvider);\n  return registry;\n}\n","/**\n * open-library.ts — shared helpers to open the LocalIndex and the configured\n * Catalog source.\n *\n * Lazy-loads the `@skaile/workspaces/library` subpath and returns the\n * LocalIndex instance (backed by `@libsql/client`; runs on Node and Bun).\n * The catalog-source helper reads\n * `~/.skaile/config.yaml` (and project-level overlay if `projectDir` is given)\n * to decide between {@link RemoteCatalogSource} (default — points at\n * `https://skaile.store`) and a {@link LocalCatalogSource} bound to the most\n * recent local library registered via `skaile source add`.\n */\n\nimport { logErr } from \"./helpers.ts\";\nimport { createFullRegistry } from \"./open-registry.ts\";\n\n/** Thrown by {@link openCatalogSource} when `catalog.url` is the `local` sentinel. */\nexport class LocalCatalogDisabledError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"LocalCatalogDisabledError\";\n  }\n}\n\n/**\n * Open the LocalIndex with the full kind registry. Exits with code 1\n * if the library directory cannot be created.\n *\n * @returns A `LocalIndex` instance ready for use.\n * @docLink cli/dev-guide#open-library\n */\nexport async function openLibrary() {\n  try {\n    const { LocalIndex } = await import(\"@skaile/workspaces/library\");\n    return new LocalIndex({ kindRegistry: createFullRegistry() });\n  } catch (err) {\n    logErr(`Could not open LocalIndex: ${err instanceof Error ? err.message : String(err)}`);\n    process.exit(1);\n  }\n}\n\n/**\n * Resolve the configured **remote** Catalog source for the CLI.\n *\n * Reads `~/.skaile/config.yaml` (plus the optional project-level overlay) and\n * returns a {@link RemoteCatalogSource} pointing at `catalog.url` (default:\n * `https://skaile.store`). The `cache_ttl: 0` config flag flips the source\n * into air-gapped mode: network reads are disabled, only `skaile update`\n * performs refreshes.\n *\n * **Local-mode rejection.** If the resolved config has `catalog.url: local`\n * this helper throws — callers wanting the dispatched local-or-remote source\n * must use {@link resolveCatalogSource}. Remote-only consumers like\n * `skaile update --catalog-only` rely on this strict behaviour.\n *\n * @param opts - Project directory (overlays project config) and explicit overrides.\n * @returns A configured {@link RemoteCatalogSource}.\n * @throws When `catalog.url` is the `local` sentinel.\n * @docLink cli/dev-guide#open-library\n */\nexport async function openCatalogSource(opts?: {\n  projectDir?: string;\n  baseUrlOverride?: string;\n  /** Override the user-config path for tests. */\n  userConfigFile?: string;\n}): Promise<\n  | import(\"@skaile/workspaces/library\").RemoteCatalogSource\n  | import(\"@skaile/workspaces/library\").RestCatalogSource\n> {\n  const { resolveConfig, RemoteCatalogSource, RestCatalogSource, isLocalCatalogUrl } = await import(\n    \"@skaile/workspaces/library\"\n  );\n  const cfg = resolveConfig({\n    projectDir: opts?.projectDir,\n    userConfigFile: opts?.userConfigFile,\n  });\n  const baseUrl = opts?.baseUrlOverride ?? cfg.catalog.url;\n  if (isLocalCatalogUrl(baseUrl)) {\n    throw new LocalCatalogDisabledError(\n      \"catalog.url is set to 'local' — remote catalog is disabled. \" +\n        \"Use `skaile source add <path>` + `skaile source sync` for local sources, \" +\n        \"or set `catalog.url: https://skaile.store` in ~/.skaile/config.yaml.\",\n    );\n  }\n  const cacheTtlMs = cfg.catalog.cache_ttl * 1000;\n  if (cfg.catalog.framing === \"rest\") {\n    return new RestCatalogSource({ baseUrl, cacheTtlMs });\n  }\n  return new RemoteCatalogSource({ baseUrl, cacheTtlMs });\n}\n\n/**\n * Resolved catalog source plus a close handle for releasing any underlying\n * resources (e.g. the `LocalIndex` SQLite connection in local mode).\n *\n * Callers MUST invoke `close()` when done — typically in a `finally` block.\n * For remote-mode sources `close()` is a no-op, but the contract is uniform\n * so consumers don't have to branch.\n *\n * @docLink cli/dev-guide#open-library\n */\nexport interface ResolvedCatalogSource {\n  /** The {@link ICatalogSource} ready for use. */\n  source: import(\"@skaile/workspaces/library\").ICatalogSource;\n  /** Release any underlying resources (SQLite handle in local mode). */\n  close(): void;\n}\n\n/**\n * Resolve the configured Catalog source — local or remote — based on\n * `~/.skaile/config.yaml`.\n *\n * Dispatch:\n * - `catalog.url: local` → opens {@link LocalIndex}, picks the most recently\n *   registered local library whose `path` still exists on disk, and returns a\n *   {@link LocalCatalogSource} bound to that library. Throws if no usable\n *   local library is registered.\n * - any URL → returns {@link RemoteCatalogSource} (same as\n *   {@link openCatalogSource}).\n *\n * The returned `close()` releases the underlying `LocalIndex` SQLite handle\n * in local mode (no-op in remote mode). Callers MUST invoke it — typically in\n * a `finally` block — to satisfy `library/CLAUDE.md` § \"Notes for Consumers\".\n *\n * @param opts - Project directory (overlays project config) and explicit overrides.\n * @returns A `ResolvedCatalogSource` carrying the source and a close handle.\n * @throws When `local` is configured but no usable local library is registered.\n * @docLink cli/dev-guide#open-library\n */\nexport async function resolveCatalogSource(opts?: {\n  projectDir?: string;\n  baseUrlOverride?: string;\n  /** Override the user-config path for tests. */\n  userConfigFile?: string;\n}): Promise<ResolvedCatalogSource> {\n  const {\n    resolveConfig,\n    RemoteCatalogSource,\n    RestCatalogSource,\n    LocalCatalogSource,\n    isLocalCatalogUrl,\n  } = await import(\"@skaile/workspaces/library\");\n  const cfg = resolveConfig({\n    projectDir: opts?.projectDir,\n    userConfigFile: opts?.userConfigFile,\n  });\n  const baseUrl = opts?.baseUrlOverride ?? cfg.catalog.url;\n\n  if (isLocalCatalogUrl(baseUrl)) {\n    const fs = await import(\"node:fs\");\n    const library = await openLibrary();\n    try {\n      const sources = await library.listSources();\n      type LibraryRow = (typeof sources)[number];\n      // Type-narrow: `path` is required for local libraries after the filter.\n      const usable = sources\n        .filter(\n          (s): s is LibraryRow & { path: string } =>\n            s.backend === \"local\" && typeof s.path === \"string\" && s.path.length > 0,\n        )\n        .sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime());\n\n      if (usable.length === 0) {\n        throw new Error(\n          \"catalog.url is set to 'local' but no local library is registered. \" +\n            \"Run `skaile source add <path>` first, then `skaile source sync`.\",\n        );\n      }\n\n      // Prefer the most recently added library whose path still exists.\n      const present = usable.find((s) => fs.existsSync(s.path));\n      if (!present) {\n        const head = usable[0];\n        throw new Error(\n          `catalog.url is set to 'local' but every registered local library has a missing path on disk. ` +\n            `Most recent: ${head.path} (library ${head.id}). ` +\n            `Re-register with \\`skaile source add <existing-path>\\` or run \\`skaile source list\\` to inspect.`,\n        );\n      }\n\n      const source = new LocalCatalogSource(\n        library,\n        present.id,\n        present.path,\n        createFullRegistry(),\n      );\n      return { source, close: () => library.close() };\n    } catch (err) {\n      // Release the handle on any failure during dispatch — otherwise the\n      // SQLite WAL state leaks for the lifetime of the process.\n      library.close();\n      throw err;\n    }\n  }\n\n  const cacheTtlMs = cfg.catalog.cache_ttl * 1000;\n  const source =\n    cfg.catalog.framing === \"rest\"\n      ? new RestCatalogSource({ baseUrl, cacheTtlMs })\n      : new RemoteCatalogSource({ baseUrl, cacheTtlMs });\n  return { source, close: () => {} };\n}\n\n/**\n * Open the LibraryManager bound to the active LocalIndex.\n * Caller owns lifetime — must call `close()` (returned helper closes the\n * underlying LocalIndex).\n *\n * @docLink cli/dev-guide#open-library\n */\nexport async function openLibraryManager(): Promise<{\n  manager: import(\"@skaile/workspaces/library\").LibraryManager;\n  library: import(\"@skaile/workspaces/library\").LocalIndex;\n  close: () => void;\n}> {\n  const { LibraryManager } = await import(\"@skaile/workspaces/library\");\n  const library = await openLibrary();\n  const manager = new LibraryManager(library);\n  return { manager, library, close: () => library.close() };\n}\n"]}
+{"version":3,"sources":["../cli/src/open-registry.ts","../cli/src/open-library.ts"],"names":["source"],"mappings":";;;;;;AA2BO,SAAS,kBAAA,GAAwC;AACtD,EAAA,MAAM,WAAW,qBAAA,EAAsB;AACvC,EAAA,QAAA,CAAS,SAAS,gBAAgB,CAAA;AAClC,EAAA,QAAA,CAAS,SAAS,qBAAqB,CAAA;AACvC,EAAA,OAAO,QAAA;AACT;;;ACfO,IAAM,yBAAA,GAAN,cAAwC,KAAA,CAAM;AAAA,EACnD,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,2BAAA;AAAA,EACd;AACF;AASA,eAAsB,WAAA,GAAc;AAClC,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,UAAA,EAAW,GAAI,MAAM,OAAO,oBAA4B,CAAA;AAChE,IAAA,OAAO,IAAI,UAAA,CAAW,EAAE,YAAA,EAAc,kBAAA,IAAsB,CAAA;AAAA,EAC9D,SAAS,GAAA,EAAK;AACZ,IAAA,MAAA,CAAO,CAAA,2BAAA,EAA8B,eAAe,KAAA,GAAQ,GAAA,CAAI,UAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAE,CAAA;AACvF,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB;AACF;AAqBA,eAAsB,kBAAkB,IAAA,EAQtC;AACA,EAAA,MAAM,EAAE,eAAe,mBAAA,EAAqB,iBAAA,EAAmB,mBAAkB,GAAI,MAAM,OACzF,oBACF,CAAA;AACA,EAAA,MAAM,MAAM,aAAA,CAAc;AAAA,IACxB,YAAY,IAAA,EAAM,UAAA;AAAA,IAClB,gBAAgB,IAAA,EAAM;AAAA,GACvB,CAAA;AACD,EAAA,MAAM,OAAA,GAAU,IAAA,EAAM,eAAA,IAAmB,GAAA,CAAI,OAAA,CAAQ,GAAA;AACrD,EAAA,IAAI,iBAAA,CAAkB,OAAO,CAAA,EAAG;AAC9B,IAAA,MAAM,IAAI,yBAAA;AAAA,MACR;AAAA,KAGF;AAAA,EACF;AACA,EAAA,MAAM,UAAA,GAAa,GAAA,CAAI,OAAA,CAAQ,SAAA,GAAY,GAAA;AAC3C,EAAA,IAAI,GAAA,CAAI,OAAA,CAAQ,OAAA,KAAY,MAAA,EAAQ;AAClC,IAAA,OAAO,IAAI,iBAAA,CAAkB,EAAE,OAAA,EAAS,YAAY,CAAA;AAAA,EACtD;AACA,EAAA,OAAO,IAAI,mBAAA,CAAoB,EAAE,OAAA,EAAS,YAAY,CAAA;AACxD;AAwCA,eAAsB,qBAAqB,IAAA,EAKR;AACjC,EAAA,MAAM;AAAA,IACJ,aAAA;AAAA,IACA,mBAAA;AAAA,IACA,iBAAA;AAAA,IACA,kBAAA;AAAA,IACA;AAAA,GACF,GAAI,MAAM,OAAO,oBAA4B,CAAA;AAC7C,EAAA,MAAM,MAAM,aAAA,CAAc;AAAA,IACxB,YAAY,IAAA,EAAM,UAAA;AAAA,IAClB,gBAAgB,IAAA,EAAM;AAAA,GACvB,CAAA;AACD,EAAA,MAAM,OAAA,GAAU,IAAA,EAAM,eAAA,IAAmB,GAAA,CAAI,OAAA,CAAQ,GAAA;AAErD,EAAA,IAAI,iBAAA,CAAkB,OAAO,CAAA,EAAG;AAC9B,IAAA,MAAM,EAAA,GAAK,MAAM,OAAO,IAAS,CAAA;AACjC,IAAA,MAAM,OAAA,GAAU,MAAM,WAAA,EAAY;AAClC,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,WAAA,EAAY;AAG1C,MAAA,MAAM,SAAS,OAAA,CACZ,MAAA;AAAA,QACC,CAAC,CAAA,KACC,CAAA,CAAE,OAAA,KAAY,OAAA,IAAW,OAAO,CAAA,CAAE,IAAA,KAAS,QAAA,IAAY,CAAA,CAAE,IAAA,CAAK,MAAA,GAAS;AAAA,OAC3E,CACC,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,SAAA,CAAU,OAAA,EAAQ,GAAI,CAAA,CAAE,SAAA,CAAU,OAAA,EAAS,CAAA;AAE/D,MAAA,IAAI,MAAA,CAAO,WAAW,CAAA,EAAG;AACvB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR;AAAA,SAEF;AAAA,MACF;AAGA,MAAA,MAAM,OAAA,GAAU,OAAO,IAAA,CAAK,CAAC,MAAM,EAAA,CAAG,UAAA,CAAW,CAAA,CAAE,IAAI,CAAC,CAAA;AACxD,MAAA,IAAI,CAAC,OAAA,EAAS;AACZ,QAAA,MAAM,IAAA,GAAO,OAAO,CAAC,CAAA;AACrB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,0GAAA,EACkB,IAAA,CAAK,IAAI,CAAA,UAAA,EAAa,KAAK,EAAE,CAAA,mGAAA;AAAA,SAEjD;AAAA,MACF;AAEA,MAAA,MAAMA,UAAS,IAAI,kBAAA;AAAA,QACjB,OAAA;AAAA,QACA,OAAA,CAAQ,EAAA;AAAA,QACR,OAAA,CAAQ,IAAA;AAAA,QACR,kBAAA;AAAmB,OACrB;AACA,MAAA,OAAO,EAAE,MAAA,EAAAA,OAAAA,EAAQ,OAAO,MAAM,OAAA,CAAQ,OAAM,EAAE;AAAA,IAChD,SAAS,GAAA,EAAK;AAGZ,MAAA,OAAA,CAAQ,KAAA,EAAM;AACd,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF;AAEA,EAAA,MAAM,UAAA,GAAa,GAAA,CAAI,OAAA,CAAQ,SAAA,GAAY,GAAA;AAC3C,EAAA,MAAM,SACJ,GAAA,CAAI,OAAA,CAAQ,OAAA,KAAY,MAAA,GACpB,IAAI,iBAAA,CAAkB,EAAE,OAAA,EAAS,UAAA,EAAY,CAAA,GAC7C,IAAI,oBAAoB,EAAE,OAAA,EAAS,YAAY,CAAA;AACrD,EAAA,OAAO,EAAE,MAAA,EAAQ,KAAA,EAAO,MAAM;AAAA,EAAC,CAAA,EAAE;AACnC;AASA,eAAsB,kBAAA,GAInB;AACD,EAAA,MAAM,EAAE,cAAA,EAAe,GAAI,MAAM,OAAO,oBAA4B,CAAA;AACpE,EAAA,MAAM,OAAA,GAAU,MAAM,WAAA,EAAY;AAClC,EAAA,MAAM,OAAA,GAAU,IAAI,cAAA,CAAe,OAAO,CAAA;AAC1C,EAAA,OAAO,EAAE,OAAA,EAAS,OAAA,EAAS,OAAO,MAAM,OAAA,CAAQ,OAAM,EAAE;AAC1D","file":"chunk-PBCNRS7Q.js","sourcesContent":["/**\n * open-registry.ts — shared helper to create a full AssetKindRegistry.\n *\n * Bootstraps the registry with all built-in providers (9 core + preset)\n * from @skaile/discovery, plus the extension kind providers (flow from\n * @skaile/workspaces/factory-assets/connectors/flow/engine, knowledge from @skaile/library).\n *\n * This is the single registration point for the CLI. All code paths\n * that need a registry (source sync, lib-status, etc.) should use this.\n */\n\nimport type { AssetKindRegistry } from \"@skaile/workspaces/discovery\";\nimport { createDefaultRegistry } from \"@skaile/workspaces/discovery\";\nimport { flowKindProvider } from \"@skaile/workspaces/factory-assets/connectors/flow/engine\";\nimport { knowledgeKindProvider } from \"@skaile/workspaces/library\";\n\n/**\n * Create a fully-configured AssetKindRegistry with all known providers.\n *\n * Registers:\n * - 9 core kinds (skill, agent, connector, mount, mcp-server, contract, prompt, persona, ruleset)\n * - preset (composition entity)\n * - flow (extension, from @skaile/workspaces/factory-assets/connectors/flow/engine)\n * - knowledge (extension, from @skaile/library)\n *\n * @returns An unfrozen registry (auto-freezes on first read)\n */\nexport function createFullRegistry(): AssetKindRegistry {\n  const registry = createDefaultRegistry();\n  registry.register(flowKindProvider);\n  registry.register(knowledgeKindProvider);\n  return registry;\n}\n","/**\n * open-library.ts — shared helpers to open the LocalIndex and the configured\n * Catalog source.\n *\n * Lazy-loads the `@skaile/workspaces/library` subpath and returns the\n * LocalIndex instance (backed by `@libsql/client`; runs on Node and Bun).\n * The catalog-source helper reads\n * `~/.skaile/config.yaml` (and project-level overlay if `projectDir` is given)\n * to decide between {@link RemoteCatalogSource} (default — points at\n * `https://skaile.store`) and a {@link LocalCatalogSource} bound to the most\n * recent local library registered via `skaile source add`.\n */\n\nimport { logErr } from \"./helpers.ts\";\nimport { createFullRegistry } from \"./open-registry.ts\";\n\n/** Thrown by {@link openCatalogSource} when `catalog.url` is the `local` sentinel. */\nexport class LocalCatalogDisabledError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"LocalCatalogDisabledError\";\n  }\n}\n\n/**\n * Open the LocalIndex with the full kind registry. Exits with code 1\n * if the library directory cannot be created.\n *\n * @returns A `LocalIndex` instance ready for use.\n * @docLink cli/dev-guide#open-library\n */\nexport async function openLibrary() {\n  try {\n    const { LocalIndex } = await import(\"@skaile/workspaces/library\");\n    return new LocalIndex({ kindRegistry: createFullRegistry() });\n  } catch (err) {\n    logErr(`Could not open LocalIndex: ${err instanceof Error ? err.message : String(err)}`);\n    process.exit(1);\n  }\n}\n\n/**\n * Resolve the configured **remote** Catalog source for the CLI.\n *\n * Reads `~/.skaile/config.yaml` (plus the optional project-level overlay) and\n * returns a {@link RemoteCatalogSource} pointing at `catalog.url` (default:\n * `https://skaile.store`). The `cache_ttl: 0` config flag flips the source\n * into air-gapped mode: network reads are disabled, only `skaile update`\n * performs refreshes.\n *\n * **Local-mode rejection.** If the resolved config has `catalog.url: local`\n * this helper throws — callers wanting the dispatched local-or-remote source\n * must use {@link resolveCatalogSource}. Remote-only consumers like\n * `skaile update --catalog-only` rely on this strict behaviour.\n *\n * @param opts - Project directory (overlays project config) and explicit overrides.\n * @returns A configured {@link RemoteCatalogSource}.\n * @throws When `catalog.url` is the `local` sentinel.\n * @docLink cli/dev-guide#open-library\n */\nexport async function openCatalogSource(opts?: {\n  projectDir?: string;\n  baseUrlOverride?: string;\n  /** Override the user-config path for tests. */\n  userConfigFile?: string;\n}): Promise<\n  | import(\"@skaile/workspaces/library\").RemoteCatalogSource\n  | import(\"@skaile/workspaces/library\").RestCatalogSource\n> {\n  const { resolveConfig, RemoteCatalogSource, RestCatalogSource, isLocalCatalogUrl } = await import(\n    \"@skaile/workspaces/library\"\n  );\n  const cfg = resolveConfig({\n    projectDir: opts?.projectDir,\n    userConfigFile: opts?.userConfigFile,\n  });\n  const baseUrl = opts?.baseUrlOverride ?? cfg.catalog.url;\n  if (isLocalCatalogUrl(baseUrl)) {\n    throw new LocalCatalogDisabledError(\n      \"catalog.url is set to 'local' — remote catalog is disabled. \" +\n        \"Use `skaile source add <path>` + `skaile source sync` for local sources, \" +\n        \"or set `catalog.url: https://skaile.store` in ~/.skaile/config.yaml.\",\n    );\n  }\n  const cacheTtlMs = cfg.catalog.cache_ttl * 1000;\n  if (cfg.catalog.framing === \"rest\") {\n    return new RestCatalogSource({ baseUrl, cacheTtlMs });\n  }\n  return new RemoteCatalogSource({ baseUrl, cacheTtlMs });\n}\n\n/**\n * Resolved catalog source plus a close handle for releasing any underlying\n * resources (e.g. the `LocalIndex` SQLite connection in local mode).\n *\n * Callers MUST invoke `close()` when done — typically in a `finally` block.\n * For remote-mode sources `close()` is a no-op, but the contract is uniform\n * so consumers don't have to branch.\n *\n * @docLink cli/dev-guide#open-library\n */\nexport interface ResolvedCatalogSource {\n  /** The {@link ICatalogSource} ready for use. */\n  source: import(\"@skaile/workspaces/library\").ICatalogSource;\n  /** Release any underlying resources (SQLite handle in local mode). */\n  close(): void;\n}\n\n/**\n * Resolve the configured Catalog source — local or remote — based on\n * `~/.skaile/config.yaml`.\n *\n * Dispatch:\n * - `catalog.url: local` → opens {@link LocalIndex}, picks the most recently\n *   registered local library whose `path` still exists on disk, and returns a\n *   {@link LocalCatalogSource} bound to that library. Throws if no usable\n *   local library is registered.\n * - any URL → returns {@link RemoteCatalogSource} (same as\n *   {@link openCatalogSource}).\n *\n * The returned `close()` releases the underlying `LocalIndex` SQLite handle\n * in local mode (no-op in remote mode). Callers MUST invoke it — typically in\n * a `finally` block — to satisfy `library/CLAUDE.md` § \"Notes for Consumers\".\n *\n * @param opts - Project directory (overlays project config) and explicit overrides.\n * @returns A `ResolvedCatalogSource` carrying the source and a close handle.\n * @throws When `local` is configured but no usable local library is registered.\n * @docLink cli/dev-guide#open-library\n */\nexport async function resolveCatalogSource(opts?: {\n  projectDir?: string;\n  baseUrlOverride?: string;\n  /** Override the user-config path for tests. */\n  userConfigFile?: string;\n}): Promise<ResolvedCatalogSource> {\n  const {\n    resolveConfig,\n    RemoteCatalogSource,\n    RestCatalogSource,\n    LocalCatalogSource,\n    isLocalCatalogUrl,\n  } = await import(\"@skaile/workspaces/library\");\n  const cfg = resolveConfig({\n    projectDir: opts?.projectDir,\n    userConfigFile: opts?.userConfigFile,\n  });\n  const baseUrl = opts?.baseUrlOverride ?? cfg.catalog.url;\n\n  if (isLocalCatalogUrl(baseUrl)) {\n    const fs = await import(\"node:fs\");\n    const library = await openLibrary();\n    try {\n      const sources = await library.listSources();\n      type LibraryRow = (typeof sources)[number];\n      // Type-narrow: `path` is required for local libraries after the filter.\n      const usable = sources\n        .filter(\n          (s): s is LibraryRow & { path: string } =>\n            s.backend === \"local\" && typeof s.path === \"string\" && s.path.length > 0,\n        )\n        .sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime());\n\n      if (usable.length === 0) {\n        throw new Error(\n          \"catalog.url is set to 'local' but no local library is registered. \" +\n            \"Run `skaile source add <path>` first, then `skaile source sync`.\",\n        );\n      }\n\n      // Prefer the most recently added library whose path still exists.\n      const present = usable.find((s) => fs.existsSync(s.path));\n      if (!present) {\n        const head = usable[0];\n        throw new Error(\n          `catalog.url is set to 'local' but every registered local library has a missing path on disk. ` +\n            `Most recent: ${head.path} (library ${head.id}). ` +\n            `Re-register with \\`skaile source add <existing-path>\\` or run \\`skaile source list\\` to inspect.`,\n        );\n      }\n\n      const source = new LocalCatalogSource(\n        library,\n        present.id,\n        present.path,\n        createFullRegistry(),\n      );\n      return { source, close: () => library.close() };\n    } catch (err) {\n      // Release the handle on any failure during dispatch — otherwise the\n      // SQLite WAL state leaks for the lifetime of the process.\n      library.close();\n      throw err;\n    }\n  }\n\n  const cacheTtlMs = cfg.catalog.cache_ttl * 1000;\n  const source =\n    cfg.catalog.framing === \"rest\"\n      ? new RestCatalogSource({ baseUrl, cacheTtlMs })\n      : new RemoteCatalogSource({ baseUrl, cacheTtlMs });\n  return { source, close: () => {} };\n}\n\n/**\n * Open the LibraryManager bound to the active LocalIndex.\n * Caller owns lifetime — must call `close()` (returned helper closes the\n * underlying LocalIndex).\n *\n * @docLink cli/dev-guide#open-library\n */\nexport async function openLibraryManager(): Promise<{\n  manager: import(\"@skaile/workspaces/library\").LibraryManager;\n  library: import(\"@skaile/workspaces/library\").LocalIndex;\n  close: () => void;\n}> {\n  const { LibraryManager } = await import(\"@skaile/workspaces/library\");\n  const library = await openLibrary();\n  const manager = new LibraryManager(library);\n  return { manager, library, close: () => library.close() };\n}\n"]}

package/dist/{chunk-5HZWDH3L.js → chunk-S2MT6SDZ.js}

@@ -1,27 +1,27 @@
-import { WorkspacePlugin } from './chunk-TXXPJ5CQ.js';
-import { buildWorkspaceToolDefs } from './chunk-XEWX4V7T.js';
+import { WorkspacePlugin } from './chunk-7SNYWCQS.js';
+import { buildWorkspaceToolDefs } from './chunk-IGGHUTOW.js';
 import { findAiAssetsRoot } from './chunk-7IRJ4K4F.js';
 import { WebSocketServerTransport } from './chunk-73ZXUUL6.js';
 import { assembleSystemPrompt, buildCapabilitiesPromptSection } from './chunk-W3UDISS2.js';
 import { prepareNativePolicy, codexInstanceEnvironment, parseCodexCredential, parseCodexRefreshInput, parseCodexRefreshResult } from './chunk-2HUQUTJ3.js';
-import { resolveFlowPath } from './chunk-PROIKXJR.js';
+import { resolveFlowPath } from './chunk-AT2TJEWG.js';
 import { findAiAssetsRoot as findAiAssetsRoot$1, deployCatalogEntry, undeployCatalogEntry } from './chunk-7BUZQVRR.js';
-import { registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, buildSdkConnectorTools, buildLazySdkFlowTools, describeFlowOperations, buildConnectorToolDefs, buildFlowToolDefs, driveOrchestratorTurn, SessionNodeExecutor, SessionSubpromptRunner, ClassifierSubpromptRunner, SessionInlineSubFlowRunner, buildSdkFlowTools } from './chunk-HRVXHRL4.js';
-import { loadConnectorDeclarations, SecretProviderChain, ConnectorStartupError, PreMintedSecretProvider, InMemorySecretProvider, resolvedConfigToDeclarations, isKnownSecretRef, deriveSingleMaterializedConnectorDeclaration } from './chunk-JUZJUKWM.js';
-import { EventNormalizer } from './chunk-ZVYWMD6Q.js';
+import { registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, buildSdkConnectorTools, buildLazySdkFlowTools, describeFlowOperations, buildConnectorToolDefs, buildFlowToolDefs, driveOrchestratorTurn, SessionNodeExecutor, SessionSubpromptRunner, ClassifierSubpromptRunner, SessionInlineSubFlowRunner, buildSdkFlowTools } from './chunk-GXACG5ZE.js';
+import { loadConnectorDeclarations, SecretProviderChain, ConnectorStartupError, PreMintedSecretProvider, InMemorySecretProvider, resolvedConfigToDeclarations, isKnownSecretRef, deriveSingleMaterializedConnectorDeclaration } from './chunk-MMLXSVQ3.js';
+import { EventNormalizer } from './chunk-VLXODO37.js';
 import { probeResumeTranscript } from './chunk-OUJVFZWJ.js';
 import { CodexNativeStateUnavailable } from './chunk-LOO5CB5M.js';
-import { dispatchCapability } from './chunk-3GKBSHUG.js';
+import { dispatchCapability } from './chunk-35PMOWAD.js';
 import { classifyClaudeSdkError } from './chunk-GAH4YRCI.js';
-import { createDriver, catalogLayer, providerCredentialEnvName, toMergedRegistry, registryCredentialEnv, AI_PROVIDER_PRESETS } from './chunk-LDQB5VEC.js';
-import { loadFlow } from './chunk-AOE4KOMJ.js';
+import { createDriver, catalogLayer, providerCredentialEnvName, toMergedRegistry, registryCredentialEnv, AI_PROVIDER_PRESETS } from './chunk-3T5DRUNZ.js';
+import { loadFlow } from './chunk-O3DHAGBO.js';
 import { parseFlowDefinition } from './chunk-REYJKU7T.js';
 import { renderStimulusPrompt } from './chunk-2D5BYAL6.js';
-import { withActivityLabelJsonSchema, TOOL_ACTIVITY_PROMPT_SECTION, SESSION_ROOT_CONNECTOR_ID, PROTOCOL_VERSION } from './chunk-QAH24E5U.js';
-import { resolveSettings, loadProviderRegistry } from './chunk-GFU367UH.js';
-import { resolveRuntimeAssets } from './chunk-UM4LDXV5.js';
+import { withActivityLabelJsonSchema, TOOL_ACTIVITY_PROMPT_SECTION, SESSION_ROOT_CONNECTOR_ID, PROTOCOL_VERSION } from './chunk-O64WU6WS.js';
+import { resolveSettings, loadProviderRegistry } from './chunk-JECDED7B.js';
+import { resolveRuntimeAssets } from './chunk-WILO77HE.js';
 import { resolveDriverPaths } from './chunk-K5GBV4SA.js';
-import { resolveSkWorkspaceConfig, resolveAgentDir, loadMcpServerDeclarations, COMPACTION_DEFAULTS, validateAssetRecipeAttr, deriveSingleMaterializedMcpDeclaration, stageMaterializedSkills, readSkillAllowList, isStagedSkillMarkerFor, unstageSkill } from './chunk-P2G6XSJ3.js';
+import { resolveSkWorkspaceConfig, resolveAgentDir, loadMcpServerDeclarations, COMPACTION_DEFAULTS, validateAssetRecipeAttr, deriveSingleMaterializedMcpDeclaration, stageMaterializedSkills, readSkillAllowList, isStagedSkillMarkerFor, unstageSkill } from './chunk-HO4UO25I.js';
 import { withFsDeadline, FsDeadlineError, fsDeadlineMs, tryWithFsDeadline } from './chunk-MKZOK4JU.js';
 import { parseAssetRef } from './chunk-GEEW6SY2.js';
 import { resolveLogStoreConfig, createLogStoreFromConfig, OnLogBridgeSink, WsLogSink, resolveLogsRetention, enforceLogsRetention } from './chunk-3HKYCT2M.js';
@@ -32,7 +32,7 @@ import pc from 'picocolors';
 import path5, { join, resolve, relative, sep, isAbsolute, basename, dirname } from 'path';
 import { Marked } from 'marked';
 import { markedTerminal } from 'marked-terminal';
-import fs4, { readFile, readdir, lstat, stat, rm, unlink, mkdir, writeFile, realpath, rename, readlink, mkdtemp } from 'fs/promises';
+import fs4, { readFile, readdir, lstat, stat, rm, unlink, mkdir, writeFile, realpath, rename, open, readlink, mkdtemp } from 'fs/promises';
 import { createHash, randomBytes, timingSafeEqual, randomUUID } from 'crypto';
 import { existsSync, lstatSync, realpathSync, readFileSync, mkdirSync, writeFileSync, watch, chmodSync, accessSync, constants } from 'fs';
 import { homedir } from 'os';
@@ -1017,16 +1017,16 @@ async function assertScopedTree(path6, root) {
   let remaining = 1e4;
   async function visit(entry) {
     if (--remaining < 0) throw new Error("CODEX_RESOURCE_SCOPE_INVALID");
-    let stat3;
+    let stat4;
     try {
-      stat3 = await lstat(entry);
+      stat4 = await lstat(entry);
     } catch (error) {
       if (error.code === "ENOENT") return;
       throw error;
     }
-    if (!contains(root, await realpath(entry)) || stat3.isSymbolicLink())
+    if (!contains(root, await realpath(entry)) || stat4.isSymbolicLink())
       throw new Error("CODEX_RESOURCE_SCOPE_INVALID");
-    if (stat3.isDirectory())
+    if (stat4.isDirectory())
       for (const child of await readdir(entry)) await visit(join(entry, child));
   }
   await visit(path6);
@@ -1138,6 +1138,255 @@ async function loadAgentManifest(agentDir) {
     return void 0;
   }
 }
+var DEFAULT_HOME_TAG = "SKAILE_HOME";
+var HOME_MAX_FILES = 16;
+var HOME_MAX_CHARS = 1e5;
+var HOME_READ_BYTES_PER_CHAR = 4;
+var TAG_PATTERN = /^[A-Z][A-Z0-9_]*$/;
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function homePathProblem(relPath) {
+  if (typeof relPath !== "string" || relPath.length === 0) return "path must be a non-empty string";
+  if (isAbsolute(relPath) || relPath.includes("\\") || relPath.includes("\0"))
+    return "path must be relative and '/'-separated";
+  for (const segment of relPath.split("/")) {
+    if (segment.length === 0) return "path has an empty segment";
+    if (segment.startsWith(".")) return "path segments must not start with '.'";
+  }
+  return void 0;
+}
+function resolveHomeConfig(raw) {
+  if (!isRecord(raw)) return { problems: ["agent.home must be a mapping"] };
+  const problems = [];
+  let tag = DEFAULT_HOME_TAG;
+  if (raw.tag !== void 0) {
+    if (typeof raw.tag === "string" && TAG_PATTERN.test(raw.tag)) tag = raw.tag;
+    else problems.push(`agent.home.tag must match ${TAG_PATTERN}; using ${DEFAULT_HOME_TAG}`);
+  }
+  let intro;
+  if (raw.intro !== void 0) {
+    if (typeof raw.intro === "string") intro = raw.intro.length > 0 ? raw.intro : void 0;
+    else problems.push("agent.home.intro must be a string; omitted");
+  }
+  if (!Array.isArray(raw.files))
+    return { problems: [...problems, "agent.home.files must be a list"] };
+  if (raw.files.length > HOME_MAX_FILES)
+    problems.push(
+      `agent.home.files has ${raw.files.length} entries; only the first ${HOME_MAX_FILES} are used`
+    );
+  const files = [];
+  const seen = /* @__PURE__ */ new Set();
+  raw.files.slice(0, HOME_MAX_FILES).forEach((entry, index) => {
+    const at = `agent.home.files[${index}]`;
+    if (!isRecord(entry)) {
+      problems.push(`${at} must be a mapping; ignored`);
+      return;
+    }
+    const pathProblem = homePathProblem(entry.path);
+    if (pathProblem) {
+      problems.push(`${at}: ${pathProblem}; ignored`);
+      return;
+    }
+    const path6 = entry.path;
+    const maxChars = entry["max-chars"];
+    if (typeof maxChars !== "number" || !Number.isInteger(maxChars) || maxChars < 1 || maxChars > HOME_MAX_CHARS) {
+      problems.push(`${at}: max-chars must be an integer from 1 to ${HOME_MAX_CHARS}; ignored`);
+      return;
+    }
+    const from = entry.from ?? "head";
+    if (from !== "head" && from !== "tail") {
+      problems.push(`${at}: from must be 'head' or 'tail'; ignored`);
+      return;
+    }
+    let label = basename(path6).replace(/\.md$/, "");
+    if (entry.label !== void 0) {
+      if (typeof entry.label !== "string" || entry.label.length === 0 || /[\r\n]/.test(entry.label)) {
+        problems.push(`${at}: label must be a one-line string; ignored`);
+        return;
+      }
+      label = entry.label;
+    }
+    if (seen.has(path6)) {
+      problems.push(`${at}: duplicate path ${path6}; ignored`);
+      return;
+    }
+    seen.add(path6);
+    files.push({ path: path6, label, maxChars, from });
+  });
+  return { tag, intro, files, problems };
+}
+function isWithin(root, target) {
+  const rel = relative(root, target);
+  return rel === "" || !rel.startsWith(`..${sep}`) && rel !== ".." && !isAbsolute(rel);
+}
+function errorCode(err) {
+  const code = err?.code;
+  if (typeof code === "string") return code;
+  if (err?.name === "FsDeadlineError") return "FS_DEADLINE";
+  return "UNKNOWN";
+}
+function errorMessage(err) {
+  const message = err?.message;
+  return typeof message === "string" ? message : String(err);
+}
+function createSafeHomeFileReader(deniedRoots = []) {
+  return async (projectDir, relPath, maxBytes, from, timeoutMs) => {
+    try {
+      return await withFsDeadline(
+        `read home file ${relPath}`,
+        async () => {
+          const root = await realpath(projectDir);
+          const denied = await Promise.all(deniedRoots.map((d) => realpath(d).catch(() => d)));
+          const absPath = join(root, ...relPath.split("/"));
+          const handle = await open(
+            absPath,
+            constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0)
+          );
+          try {
+            const opened = await handle.stat();
+            if (!opened.isFile())
+              return { status: "unreadable", code: "NOT_A_FILE", message: "not a regular file" };
+            if (opened.nlink > 1)
+              return {
+                status: "unreadable",
+                code: "HARDLINK",
+                message: "file has more than one link"
+              };
+            const real = await realpath(absPath);
+            if (!isWithin(root, real) || denied.some((d) => isWithin(d, real)))
+              return {
+                status: "unreadable",
+                code: "OUTSIDE_PROJECT",
+                message: "real path is outside the project root"
+              };
+            if (relative(root, real).split(sep).some((segment) => segment.startsWith(".")))
+              return {
+                status: "unreadable",
+                code: "OUTSIDE_PROJECT",
+                message: "real path enters a dot-directory"
+              };
+            const named = await stat(real);
+            if (named.dev !== opened.dev || named.ino !== opened.ino)
+              return {
+                status: "unreadable",
+                code: "PATH_CHANGED",
+                message: "path changed during read"
+              };
+            const length = Math.min(opened.size, maxBytes);
+            const buf = Buffer.alloc(length);
+            const start = from === "tail" ? opened.size - length : 0;
+            let bytesRead = 0;
+            while (bytesRead < length) {
+              const chunk = await handle.read(
+                buf,
+                bytesRead,
+                length - bytesRead,
+                start + bytesRead
+              );
+              if (chunk.bytesRead === 0) break;
+              bytesRead += chunk.bytesRead;
+            }
+            if (length > 0 && bytesRead === 0)
+              return {
+                status: "unreadable",
+                code: "SHORT_READ",
+                message: `read 0 of ${length} bytes`
+              };
+            return { status: "read", content: buf.subarray(0, bytesRead).toString("utf8") };
+          } finally {
+            await handle.close().catch(() => void 0);
+          }
+        },
+        timeoutMs
+      );
+    } catch (err) {
+      if (errorCode(err) === "ENOENT") return { status: "absent" };
+      return { status: "unreadable", code: errorCode(err), message: errorMessage(err) };
+    }
+  };
+}
+function capHead(text2, max) {
+  return text2.length <= max ? text2 : text2.slice(0, max);
+}
+function capTail(text2, max) {
+  return text2.length <= max ? text2 : text2.slice(text2.length - max);
+}
+var warnedConfigProblems = /* @__PURE__ */ new Set();
+function warnOnce(log, problem) {
+  if (warnedConfigProblems.has(problem)) return;
+  warnedConfigProblems.add(problem);
+  log.warn(problem);
+}
+async function buildHomeSection(raw, projectDir, opts = {}) {
+  if (raw === void 0 || raw === null) return void 0;
+  const log = opts.log ?? createLogger({ kind: "runner", subkind: "home" });
+  const config = resolveHomeConfig(raw);
+  for (const problem of config.problems) warnOnce(log, problem);
+  if (!("files" in config)) return void 0;
+  const read = opts.read ?? createSafeHomeFileReader(opts.deniedRoots);
+  const until = Date.now() + (opts.budgetMs ?? fsDeadlineMs());
+  const results = [];
+  let deadlineHit;
+  for (const file of config.files) {
+    const left = until - Date.now();
+    if (!deadlineHit && left <= 0)
+      deadlineHit = {
+        status: "unreadable",
+        code: "FS_DEADLINE",
+        message: "not read: the home block read budget is used up"
+      };
+    if (deadlineHit) {
+      results.push(deadlineHit);
+      continue;
+    }
+    let result;
+    try {
+      result = await read(
+        projectDir,
+        file.path,
+        file.maxChars * HOME_READ_BYTES_PER_CHAR,
+        file.from,
+        left
+      );
+    } catch (err) {
+      result = { status: "unreadable", code: errorCode(err), message: errorMessage(err) };
+    }
+    if (result.status === "unreadable" && result.code === "FS_DEADLINE")
+      deadlineHit = {
+        status: "unreadable",
+        code: "FS_DEADLINE",
+        message: "not read: an earlier home file missed its deadline"
+      };
+    results.push(result);
+  }
+  const sections = [];
+  config.files.forEach((file, index) => {
+    const result = results[index];
+    if (result.status === "unreadable") {
+      log.warn(
+        `home file ${file.path} could not be read (${result.code}); the agent starts without it: ${result.message}`,
+        { path: file.path, code: result.code }
+      );
+      return;
+    }
+    if (result.status === "absent") {
+      log.info(`home file ${file.path} is absent; skipped`, { path: file.path });
+      return;
+    }
+    if (result.content.trim() === "") return;
+    const content = file.from === "tail" ? capTail(result.content, file.maxChars) : capHead(result.content, file.maxChars);
+    sections.push(`## ${file.label}
+${content}`);
+  });
+  if (sections.length === 0) return void 0;
+  return [
+    `<${config.tag}>`,
+    ...config.intro !== void 0 ? [config.intro, ""] : [],
+    sections.join("\n\n"),
+    `</${config.tag}>`
+  ].join("\n");
+}
 
 // runner/src/file-changed-coalescer.ts
 var DEFAULT_WINDOW_MS = 1e3;
@@ -2322,6 +2571,10 @@ async function createAgentSession(config) {
   const wsConfig = managedWorkspaceConfig ?? wsConfigOverride ?? resolveSkWorkspaceConfig(projectDir);
   const contextSection = buildContextSection(wsConfig.agent?.context);
   const userPromptSection = wsConfig.agent?.prompt?.trim();
+  const homeSection = await buildHomeSection(wsConfig.agent?.home, projectDir, {
+    deniedRoots: managed ? [managed.runtime.privateRoot] : [],
+    log: createLogger({ kind: "runner", subkind: "home", instance: sessionId ?? "no-session" })
+  });
   const environmentSection = await buildEnvironmentSection(projectDir);
   const promptExtensions = await loadPromptExtensions(
     wsConfig.agent?.["prompt-extensions"],
@@ -2353,6 +2606,7 @@ async function createAgentSession(config) {
   const systemPromptSections = buildSystemPromptSections({
     contextSection,
     userPromptSection,
+    homeSection,
     environmentSection,
     resourcePromptSection,
     mcpPromptSection,
@@ -2363,6 +2617,7 @@ async function createAgentSession(config) {
   const systemPrompt = assembleSystemPrompt([
     contextSection,
     userPromptSection,
+    homeSection,
     environmentSection,
     resourcePromptSection,
     mcpPromptSection,
@@ -2517,6 +2772,7 @@ function buildSystemPromptSections(parts) {
   const {
     contextSection,
     userPromptSection,
+    homeSection,
     environmentSection,
     resourcePromptSection,
     mcpPromptSection,
@@ -2527,6 +2783,7 @@ function buildSystemPromptSections(parts) {
   const systemPromptSections = [];
   if (contextSection) systemPromptSections.push({ label: "context", value: contextSection });
   if (userPromptSection) systemPromptSections.push({ label: "prompt", value: userPromptSection });
+  if (homeSection) systemPromptSections.push({ label: "home", value: homeSection });
   if (environmentSection)
     systemPromptSections.push({ label: "environment", value: environmentSection });
   if (resourcePromptSection)
@@ -3527,7 +3784,7 @@ function isSessionRootPathAllowed(rel, operation) {
     (dir) => rel.startsWith(`${dir}/`) || operation === "delete" && rel === dir
   );
 }
-function isWithin(root, child) {
+function isWithin2(root, child) {
   const rel = relative(root, child);
   return rel === "" || !(rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel));
 }
@@ -3580,7 +3837,7 @@ async function handleSessionRootResourceRequest(command, rootDir, emit) {
     if (isAbsolute(reqPath)) throw new Error("Absolute paths are not allowed for the session root");
     const root = resolve(rootDir);
     const targetPath = resolve(root, reqPath);
-    if (!isWithin(root, targetPath)) throw new Error("Path traversal outside the session root");
+    if (!isWithin2(root, targetPath)) throw new Error("Path traversal outside the session root");
     const rel = relative(root, targetPath).split(sep).join("/");
     if (!isSessionRootPathAllowed(rel, operation)) {
       throw new Error(
@@ -3589,7 +3846,7 @@ async function handleSessionRootResourceRequest(command, rootDir, emit) {
     }
     const realRoot = await withFsDeadline(`realpath ${root}`, () => realpath(root));
     const onDisk = operation === "write" ? await resolveOnDisk(targetPath) : join(await resolveOnDisk(dirname(targetPath)), basename(targetPath));
-    if (!isWithin(realRoot, operation === "write" ? onDisk : dirname(onDisk))) {
+    if (!isWithin2(realRoot, operation === "write" ? onDisk : dirname(onDisk))) {
       throw new Error("Path escapes the session root through a symlink");
     }
     let data = true;
@@ -3742,10 +3999,10 @@ function validateManagedCodexHost(input, projectDir) {
 function loadManagedCodexHostConfig(file, projectDir) {
   try {
     if (!isAbsolute(file)) throw refused();
-    const stat3 = lstatSync(file);
-    if (!stat3.isFile() || stat3.isSymbolicLink() || stat3.size > 64 * 1024 || stat3.mode & 63)
+    const stat4 = lstatSync(file);
+    if (!stat4.isFile() || stat4.isSymbolicLink() || stat4.size > 64 * 1024 || stat4.mode & 63)
       throw refused();
-    if (process.getuid && stat3.uid !== 0 && stat3.uid !== process.getuid()) throw refused();
+    if (process.getuid && stat4.uid !== 0 && stat4.uid !== process.getuid()) throw refused();
     if (overlaps(realpathSync(file), realpathSync(projectDir))) throw refused();
     return validateManagedCodexHost(
       zHost.parse(JSON.parse(readFileSync(file, "utf8"))),
@@ -4794,9 +5051,9 @@ var CompactionOrchestrator = class {
     const { summaryText, promptError, elapsedMs, timedOut } = await this._runCompactionPrompt(prompt);
     const attempt = { ...attemptBase, elapsedMs };
     if (promptError !== null) {
-      const errorCode = this._emitThrownFailure(attempt, promptError, timedOut);
+      const errorCode2 = this._emitThrownFailure(attempt, promptError, timedOut);
       this._beginCooldown();
-      if (this._shouldRetry(trigger, errorCode, focus, isRetry)) {
+      if (this._shouldRetry(trigger, errorCode2, focus, isRetry)) {
         return await this._doCompact(trigger, RETRY_FOCUS_DIRECTIVE, { tokensBefore });
       }
       this._endCompaction();
@@ -4851,8 +5108,8 @@ var CompactionOrchestrator = class {
    * caller owns the decision to try again, and a caller-supplied `focus` would
    * be discarded by the retry's own directive.
    */
-  _shouldRetry(trigger, errorCode, focus, isRetry) {
-    return !isRetry && trigger === "threshold" && focus === void 0 && RETRYABLE_ERROR_CODES.has(errorCode);
+  _shouldRetry(trigger, errorCode2, focus, isRetry) {
+    return !isRetry && trigger === "threshold" && focus === void 0 && RETRYABLE_ERROR_CODES.has(errorCode2);
   }
   /**
    * Drive the compaction `prompt()` call, capturing summary text from the
@@ -4963,16 +5220,16 @@ var CompactionOrchestrator = class {
     const rawMessage = promptError instanceof Error ? promptError.message : String(promptError);
     const classified = classifyClaudeSdkError(rawMessage);
     const classifiedCode = classified.category === "rate_limit" ? "rate_limit" : classified.category === "auth" ? "auth" : classified.category === "network" ? "timeout" : classified.category === "validation" ? "parse_error" : classified.category;
-    const errorCode = timedOut ? "timeout" : classifiedCode;
+    const errorCode2 = timedOut ? "timeout" : classifiedCode;
     const diagnostic = truncateDiagnostic(classified.message);
-    this.opts.onLog?.(`[compaction] Failed: ${classified.message} (${errorCode})`);
+    this.opts.onLog?.(`[compaction] Failed: ${classified.message} (${errorCode2})`);
     this.opts.onCompactionAttempt?.({
       // Spread first: `status`/`validatedAt` below are load-bearing (see the
       // summary comment) and must not be override-able from the base object.
       ...attemptBase,
       type: "compaction_attempt",
       status: "failed",
-      errorCode,
+      errorCode: errorCode2,
       errorMessage: diagnostic,
       // Mirrored so the platform's existing `summary` column explains the
       // failure with no schema change. Safe: a failed attempt is never
@@ -4981,7 +5238,7 @@ var CompactionOrchestrator = class {
       outputTokens: 0,
       validatedAt: null
     });
-    return errorCode;
+    return errorCode2;
   }
   /**
    * Record a `failed` attempt for output that passed `prompt()` but failed
@@ -4989,17 +5246,17 @@ var CompactionOrchestrator = class {
    * occurrence is diagnosable from the row alone; signalling compaction end is
    * the caller's job.
    */
-  _emitValidationFailure(attemptBase, errorCode, tokensAfter, rejectedText) {
+  _emitValidationFailure(attemptBase, errorCode2, tokensAfter, rejectedText) {
     this.opts.onLog?.(
-      `[compaction] Output failed validation (${errorCode}); recording failed attempt`
+      `[compaction] Output failed validation (${errorCode2}); recording failed attempt`
     );
     this.opts.onCompactionAttempt?.({
       // Spread first — see _emitThrownFailure.
       ...attemptBase,
       type: "compaction_attempt",
       status: "failed",
-      errorCode,
-      errorMessage: `Compaction output rejected by validation (${errorCode}): ${rejectedText.length} chars, ${tokensAfter} output tokens`,
+      errorCode: errorCode2,
+      errorMessage: `Compaction output rejected by validation (${errorCode2}): ${rejectedText.length} chars, ${tokensAfter} output tokens`,
       // The rejected text itself, not a summary — see _emitThrownFailure on
       // why persisting it here cannot leak into a restored session.
       summary: truncateDiagnostic(rejectedText),
@@ -9153,5 +9410,5 @@ function touchSession(state) {
 }
 
 export { CLAUDE_CODE_CREDENTIALS_KEY, COMPILE_MANIFEST_FILENAME, CapabilityRegistry, DEFAULT_CAPABILITY_CALL_TIMEOUT_MS, DEFAULT_COALESCE_MS, DEFAULT_FLOW_MUTATE_CONNECTOR_WAIT_MS, MOUNT_LIST_MAX_DEPTH, MOUNT_LIST_MAX_ENTRIES, MOUNT_READ_DEADLINE_FACTOR, MOUNT_STAT_BUDGET_MS, MOUNT_STAT_MAX_ENTRIES, MOUNT_TREE_OP_DEADLINE_FACTOR, MarkdownStreamer, PreInitRingSink, ResourceOperationError, SESSION_ROOT_WRITABLE_DIRS, SESSION_ROOT_WRITABLE_FILES, agentDefinitionExists, bootstrapCapabilityRegistry, bootstrapRunnerLogStore, buildAgentResources, buildClientCapabilityHandler, buildConnectorTokenMediator, buildContextSection, buildEnvironmentSection, buildResourcesAvailablePayload, buildStoreSnapshotReplay, builtinCapabilities, capabilityLogInstance, clearPreInitRingSink, clearSession, compileComposition, computeCapabilitySignature, computeDirectoryTotals, connectorRefreshKind, createAgentSession, createFlowConnectorReadiness, createManagedCodexSubpromptDriver, createSessionStimulusBus, defineCapability, deleteSession, dispatchResourceRequest, dispatchRunnerCapabilityInvocation, emitSystemPromptComposed, ensureClaudeSettingsDisablesConnectors, ensureGitConfigInclude, executeConnectorMutate, extractClaudeAiOauthExpiresAt, flowStartNeedsDriverRestart, getPreInitRingSink, handleMountResourceRequest, handleResourceRequest, handleSessionRootResourceRequest, hasNonTerminalFlow, hostOpResumeStimulus, installPreInitRingSink, isSessionRootPathAllowed, isTerminalFlowStatus, listSessions, loadAgentManifest, loadCompileManifest, loadCompileManifestFromDir, loadManagedCodexHostConfig, loadSession, loadSessionById, mcpAuthSecretKey, newSession, nulTailPaddingLength, pickFlowToolTarget, pickRepointedManager, planFlowMutate, prepareCodexTools, reconcilePendingDecisions, registerActiveFlow, registerCompositionCapabilities, rejectCapabilityOnApprovalDeny, resetRunnerLogStore, resolveAgentComposition, resolveAgentMixins, resolveBinding, resolveCapabilityCallTimeoutMs, resolveCapabilityResult, resolveComposition, resolveFlowMutateConnectorWaitMs, resolveMixin, runAgentChat, saveSession, setCurrentSession, setUpFlowConnector, startAgentServer, stimulusFromMetas, supportsLiveToolUpdates, touchSession, validateInputResponse, writeClaudeCodeCredentialsFile };
-//# sourceMappingURL=chunk-5HZWDH3L.js.map
-//# sourceMappingURL=chunk-5HZWDH3L.js.map
+//# sourceMappingURL=chunk-S2MT6SDZ.js.map
+//# sourceMappingURL=chunk-S2MT6SDZ.js.map