@skillrecordings/cli 0.13.0 → 0.14.1

package/dist/index.js

@@ -9700,9 +9700,9 @@ var require_dispatcher_base = __commonJS({
       }
       close(callback) {
         if (callback === void 0) {
-          return new Promise((resolve7, reject) => {
+          return new Promise((resolve9, reject) => {
             this.close((err, data2) => {
-              return err ? reject(err) : resolve7(data2);
+              return err ? reject(err) : resolve9(data2);
             });
           });
         }
@@ -9740,9 +9740,9 @@ var require_dispatcher_base = __commonJS({
           err = null;
         }
         if (callback === void 0) {
-          return new Promise((resolve7, reject) => {
+          return new Promise((resolve9, reject) => {
             this.destroy(err, (err2, data2) => {
-              return err2 ? reject(err2) : resolve7(data2);
+              return err2 ? reject(err2) : resolve9(data2);
             });
           });
         }
@@ -13234,8 +13234,8 @@ var require_promise = __commonJS({
     function createDeferredPromise() {
       let res;
       let rej;
-      const promise = new Promise((resolve7, reject) => {
-        res = resolve7;
+      const promise = new Promise((resolve9, reject) => {
+        res = resolve9;
         rej = reject;
       });
       return { promise, resolve: res, reject: rej };
@@ -14538,12 +14538,12 @@ upgrade: ${upgrade}\r
           cb();
         }
       }
-      const waitForDrain = () => new Promise((resolve7, reject) => {
+      const waitForDrain = () => new Promise((resolve9, reject) => {
         assert(callback === null);
         if (socket[kError]) {
           reject(socket[kError]);
         } else {
-          callback = resolve7;
+          callback = resolve9;
         }
       });
       socket.on("close", onDrain).on("drain", onDrain);
@@ -15354,12 +15354,12 @@ var require_client_h2 = __commonJS({
           cb();
         }
       }
-      const waitForDrain = () => new Promise((resolve7, reject) => {
+      const waitForDrain = () => new Promise((resolve9, reject) => {
         assert(callback === null);
         if (socket[kError]) {
           reject(socket[kError]);
         } else {
-          callback = resolve7;
+          callback = resolve9;
         }
       });
       h2stream.on("close", onDrain).on("drain", onDrain);
@@ -15662,16 +15662,16 @@ var require_client = __commonJS({
         return this[kNeedDrain] < 2;
       }
       [kClose]() {
-        return new Promise((resolve7) => {
+        return new Promise((resolve9) => {
           if (this[kSize]) {
-            this[kClosedResolve] = resolve7;
+            this[kClosedResolve] = resolve9;
           } else {
-            resolve7(null);
+            resolve9(null);
           }
         });
       }
       [kDestroy](err) {
-        return new Promise((resolve7) => {
+        return new Promise((resolve9) => {
           const requests = this[kQueue].splice(this[kPendingIdx]);
           for (let i = 0; i < requests.length; i++) {
             const request = requests[i];
@@ -15682,7 +15682,7 @@ var require_client = __commonJS({
               this[kClosedResolve]();
               this[kClosedResolve] = null;
             }
-            resolve7(null);
+            resolve9(null);
           };
           if (this[kHTTPContext]) {
             this[kHTTPContext].destroy(err, callback);
@@ -16075,8 +16075,8 @@ var require_pool_base = __commonJS({
           }
           return Promise.all(closeAll);
         } else {
-          return new Promise((resolve7) => {
-            this[kClosedResolve] = resolve7;
+          return new Promise((resolve9) => {
+            this[kClosedResolve] = resolve9;
           });
         }
       }
@@ -17615,7 +17615,7 @@ var require_readable = __commonJS({
         if (this._readableState.closeEmitted) {
           return Promise.resolve(null);
         }
-        return new Promise((resolve7, reject) => {
+        return new Promise((resolve9, reject) => {
           if (this[kContentLength] && this[kContentLength] > limit2 || this[kBytesRead] > limit2) {
             this.destroy(new AbortError2());
           }
@@ -17629,11 +17629,11 @@ var require_readable = __commonJS({
               if (signal.aborted) {
                 reject(signal.reason ?? new AbortError2());
               } else {
-                resolve7(null);
+                resolve9(null);
               }
             });
           } else {
-            this.on("close", resolve7);
+            this.on("close", resolve9);
           }
           this.on("error", noop).on("data", () => {
             if (this[kBytesRead] > limit2) {
@@ -17661,7 +17661,7 @@ var require_readable = __commonJS({
     }
     function consume(stream, type) {
       assert(!stream[kConsume]);
-      return new Promise((resolve7, reject) => {
+      return new Promise((resolve9, reject) => {
         if (isUnusable(stream)) {
           const rState = stream._readableState;
           if (rState.destroyed && rState.closeEmitted === false) {
@@ -17676,7 +17676,7 @@ var require_readable = __commonJS({
             stream[kConsume] = {
               type,
               stream,
-              resolve: resolve7,
+              resolve: resolve9,
               reject,
               length: 0,
               body: []
@@ -17750,18 +17750,18 @@ var require_readable = __commonJS({
       return buffer;
     }
     function consumeEnd(consume2, encoding) {
-      const { type, body, resolve: resolve7, stream, length } = consume2;
+      const { type, body, resolve: resolve9, stream, length } = consume2;
       try {
         if (type === "text") {
-          resolve7(chunksDecode(body, length, encoding));
+          resolve9(chunksDecode(body, length, encoding));
         } else if (type === "json") {
-          resolve7(JSON.parse(chunksDecode(body, length, encoding)));
+          resolve9(JSON.parse(chunksDecode(body, length, encoding)));
         } else if (type === "arrayBuffer") {
-          resolve7(chunksConcat(body, length).buffer);
+          resolve9(chunksConcat(body, length).buffer);
         } else if (type === "blob") {
-          resolve7(new Blob(body, { type: stream[kContentType] }));
+          resolve9(new Blob(body, { type: stream[kContentType] }));
         } else if (type === "bytes") {
-          resolve7(chunksConcat(body, length));
+          resolve9(chunksConcat(body, length));
         }
         consumeFinish(consume2);
       } catch (err) {
@@ -17952,9 +17952,9 @@ var require_api_request = __commonJS({
     };
     function request(opts, callback) {
       if (callback === void 0) {
-        return new Promise((resolve7, reject) => {
+        return new Promise((resolve9, reject) => {
           request.call(this, opts, (err, data2) => {
-            return err ? reject(err) : resolve7(data2);
+            return err ? reject(err) : resolve9(data2);
           });
         });
       }
@@ -18168,9 +18168,9 @@ var require_api_stream = __commonJS({
     };
     function stream(opts, factory, callback) {
       if (callback === void 0) {
-        return new Promise((resolve7, reject) => {
+        return new Promise((resolve9, reject) => {
           stream.call(this, opts, factory, (err, data2) => {
-            return err ? reject(err) : resolve7(data2);
+            return err ? reject(err) : resolve9(data2);
           });
         });
       }
@@ -18460,9 +18460,9 @@ var require_api_upgrade = __commonJS({
     };
     function upgrade(opts, callback) {
       if (callback === void 0) {
-        return new Promise((resolve7, reject) => {
+        return new Promise((resolve9, reject) => {
           upgrade.call(this, opts, (err, data2) => {
-            return err ? reject(err) : resolve7(data2);
+            return err ? reject(err) : resolve9(data2);
           });
         });
       }
@@ -18556,9 +18556,9 @@ var require_api_connect = __commonJS({
     };
     function connect(opts, callback) {
       if (callback === void 0) {
-        return new Promise((resolve7, reject) => {
+        return new Promise((resolve9, reject) => {
           connect.call(this, opts, (err, data2) => {
-            return err ? reject(err) : resolve7(data2);
+            return err ? reject(err) : resolve9(data2);
           });
         });
       }
@@ -19838,7 +19838,7 @@ var require_snapshot_recorder = __commonJS({
     "use strict";
     init_esm_shims();
     var { writeFile: writeFile9, readFile: readFile10, mkdir: mkdir2 } = __require("fs/promises");
-    var { dirname: dirname6, resolve: resolve7 } = __require("path");
+    var { dirname: dirname8, resolve: resolve9 } = __require("path");
     var { setTimeout: setTimeout2, clearTimeout: clearTimeout2 } = __require("timers");
     var { InvalidArgumentError, UndiciError } = require_errors();
     var { hashId, isUrlExcludedFactory, normalizeHeaders, createHeaderFilters } = require_snapshot_utils();
@@ -20039,7 +20039,7 @@ var require_snapshot_recorder = __commonJS({
           throw new InvalidArgumentError("Snapshot path is required");
         }
         try {
-          const data2 = await readFile10(resolve7(path), "utf8");
+          const data2 = await readFile10(resolve9(path), "utf8");
           const parsed = JSON.parse(data2);
           if (Array.isArray(parsed)) {
             this.#snapshots.clear();
@@ -20068,8 +20068,8 @@ var require_snapshot_recorder = __commonJS({
         if (!path) {
           throw new InvalidArgumentError("Snapshot path is required");
         }
-        const resolvedPath = resolve7(path);
-        await mkdir2(dirname6(resolvedPath), { recursive: true });
+        const resolvedPath = resolve9(path);
+        await mkdir2(dirname8(resolvedPath), { recursive: true });
         const data2 = Array.from(this.#snapshots.entries()).map(([hash, snapshot]) => ({
           hash,
           snapshot
@@ -26646,7 +26646,7 @@ var require_fetch = __commonJS({
       function dispatch({ body }) {
         const url = requestCurrentURL(request);
         const agent = fetchParams.controller.dispatcher;
-        return new Promise((resolve7, reject) => agent.dispatch(
+        return new Promise((resolve9, reject) => agent.dispatch(
           {
             path: url.pathname + url.search,
             origin: url.origin,
@@ -26726,7 +26726,7 @@ var require_fetch = __commonJS({
                 }
               }
               const onError = this.onError.bind(this);
-              resolve7({
+              resolve9({
                 status,
                 statusText,
                 headersList,
@@ -26769,7 +26769,7 @@ var require_fetch = __commonJS({
               for (let i = 0; i < rawHeaders.length; i += 2) {
                 headersList.append(bufferToLowerCasedHeaderName(rawHeaders[i]), rawHeaders[i + 1].toString("latin1"), true);
               }
-              resolve7({
+              resolve9({
                 status,
                 statusText: STATUS_CODES2[status],
                 headersList,
@@ -62982,7 +62982,7 @@ var require_resolve_uri_umd = __commonJS({
         }
         url.path = path;
       }
-      function resolve7(input2, base) {
+      function resolve9(input2, base) {
         if (!input2 && !base)
           return "";
         const url = parseUrl(input2);
@@ -63035,7 +63035,7 @@ var require_resolve_uri_umd = __commonJS({
             return url.scheme + "//" + url.user + url.host + url.port + url.path + queryHash;
         }
       }
-      return resolve7;
+      return resolve9;
     }));
   }
 });
@@ -63382,8 +63382,8 @@ var require_trace_mapping_umd = __commonJS({
           this.sources = sources;
           this.sourcesContent = sourcesContent;
           this.ignoreList = parsed.ignoreList || parsed.x_google_ignoreList || void 0;
-          const resolve7 = resolver(mapUrl, sourceRoot);
-          this.resolvedSources = sources.map(resolve7);
+          const resolve9 = resolver(mapUrl, sourceRoot);
+          this.resolvedSources = sources.map(resolve9);
           const { mappings } = parsed;
           if (typeof mappings === "string") {
             this._encoded = mappings;
@@ -72917,7 +72917,7 @@ var require_introspection = __commonJS({
     exports.isStatic = isStatic;
     exports.matchesPattern = matchesPattern;
     exports.referencesImport = referencesImport;
-    exports.resolve = resolve7;
+    exports.resolve = resolve9;
     exports.willIMaybeExecuteBefore = willIMaybeExecuteBefore;
     var _t = require_lib6();
     var {
@@ -73175,7 +73175,7 @@ var require_introspection = __commonJS({
       nodeMap.set(target.node, result);
       return result;
     }
-    function resolve7(dangerous, resolved) {
+    function resolve9(dangerous, resolved) {
       return _resolve.call(this, dangerous, resolved) || this;
     }
     function _resolve(dangerous, resolved) {
@@ -74537,8 +74537,67 @@ var require_lib10 = __commonJS({
 
 // src/index.ts
 init_esm_shims();
-import { readFileSync as readFileSync8 } from "fs";
-import { resolve as resolve6 } from "path";
+import { resolve as resolve8 } from "path";
+
+// src/core/config-loader.ts
+init_esm_shims();
+import { readFileSync } from "fs";
+import { resolve } from "path";
+
+// src/core/user-config.ts
+init_esm_shims();
+import { homedir } from "os";
+import { join } from "path";
+
+// src/core/fs-extra.ts
+init_esm_shims();
+import { existsSync } from "fs";
+import { cp, mkdir, readFile } from "fs/promises";
+async function ensureDir(path) {
+  await mkdir(path, { recursive: true });
+}
+async function pathExists(path) {
+  return existsSync(path);
+}
+async function readJson(path) {
+  const contents2 = await readFile(path, "utf-8");
+  return JSON.parse(contents2);
+}
+async function copy(src, dest) {
+  await cp(src, dest, { recursive: true, force: true });
+}
+
+// src/core/config-loader.ts
+function parseEnvContent(content) {
+  const env = {};
+  for (const line of content.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const eqIdx = trimmed.indexOf("=");
+    if (eqIdx === -1) continue;
+    const key = trimmed.slice(0, eqIdx).trim();
+    const raw = trimmed.slice(eqIdx + 1).trim();
+    const value = raw.replace(/^["'](.*)["']$/, "$1");
+    env[key] = value;
+  }
+  return env;
+}
+var globalProvenance = /* @__PURE__ */ new Map();
+function getKeyProvenance(key) {
+  return globalProvenance.get(key);
+}
+function loadPlaintextEnv(cliRoot2) {
+  for (const envFile of [".env.local", ".env"]) {
+    try {
+      const content = readFileSync(resolve(cliRoot2, envFile), "utf8");
+      return parseEnvContent(content);
+    } catch {
+    }
+  }
+  return {};
+}
+
+// src/index.ts
 import { Command as Command4 } from "commander";
 
 // src/commands/auth/index.ts
@@ -75055,8 +75114,8 @@ async function loginAction(ctx, options) {
 
 // src/commands/auth/setup.ts
 init_esm_shims();
-import { existsSync, writeFileSync } from "fs";
-import { resolve } from "path";
+import { existsSync as existsSync2, writeFileSync } from "fs";
+import { resolve as resolve2 } from "path";
 import { confirm, select } from "@inquirer/prompts";
 
 // src/core/errors.ts
@@ -75403,8 +75462,8 @@ async function authSetupAction(ctx, options = {}) {
       ]
     });
     if (persistence === "env") {
-      const envPath = resolve(process.cwd(), ".env.local");
-      if (existsSync(envPath)) {
+      const envPath = resolve2(process.cwd(), ".env.local");
+      if (existsSync2(envPath)) {
         const overwrite = await confirm({
           message: `.env.local already exists at ${envPath}. Overwrite?`,
           default: false
@@ -76955,11 +77014,11 @@ Saved to ${options.output}`);
   }
 }
 async function toEvalite(options) {
-  const { readFileSync: readFileSync9 } = await import("fs");
+  const { readFileSync: readFileSync12 } = await import("fs");
   const { ctx } = options;
   const outputJson = ctx.format === "json";
   const data2 = JSON.parse(
-    readFileSync9(options.input, "utf-8")
+    readFileSync12(options.input, "utf-8")
   );
   const evaliteData = data2.map((d) => ({
     input: d.triggerMessage.body,
@@ -77015,6 +77074,411 @@ function registerDatasetCommands(program3) {
   });
 }
 
+// src/commands/config/index.ts
+init_esm_shims();
+
+// src/commands/config/get.ts
+init_esm_shims();
+import { existsSync as existsSync5, readFileSync as readFileSync3 } from "fs";
+import { Decrypter as Decrypter2 } from "age-encryption";
+
+// src/commands/config/init.ts
+init_esm_shims();
+import { existsSync as existsSync3, mkdirSync, writeFileSync as writeFileSync3 } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
+import { generateIdentity, identityToRecipient } from "age-encryption";
+function getUserConfigDir() {
+  return join2(homedir2(), ".config", "skill");
+}
+function getAgeKeyPath() {
+  return join2(getUserConfigDir(), "age.key");
+}
+async function configInitAction(ctx, options = {}) {
+  const outputJson = options.json === true || ctx.format === "json";
+  const keyPath = getAgeKeyPath();
+  const configDir = getUserConfigDir();
+  if (existsSync3(keyPath) && !options.force) {
+    const result = {
+      success: false,
+      error: `Age key already exists at ${keyPath}. Use --force to overwrite.`
+    };
+    if (outputJson) {
+      ctx.output.data(result);
+    } else {
+      ctx.output.error(result.error);
+      ctx.output.data(`
+To view your public key: skill config public-key`);
+    }
+    process.exitCode = EXIT_CODES.usage;
+    return;
+  }
+  try {
+    if (!existsSync3(configDir)) {
+      mkdirSync(configDir, { recursive: true, mode: 448 });
+    }
+    const identity = await generateIdentity();
+    const recipient = await identityToRecipient(identity);
+    writeFileSync3(keyPath, identity, { encoding: "utf8", mode: 384 });
+    const result = {
+      success: true,
+      keyPath,
+      publicKey: recipient
+    };
+    if (outputJson) {
+      ctx.output.data(result);
+    } else {
+      ctx.output.success("Age keypair generated successfully!");
+      ctx.output.data(`
+Private key saved to: ${keyPath}`);
+      ctx.output.data(`Public key (age recipient): ${recipient}`);
+      ctx.output.data(
+        "\n\u26A0\uFE0F  Keep your private key secure. Anyone with access can decrypt your config."
+      );
+      ctx.output.data("\nNext steps:");
+      ctx.output.data("  1. Set config values: skill config set KEY=value");
+      ctx.output.data("  2. View config: skill config list");
+    }
+  } catch (error) {
+    const result = {
+      success: false,
+      error: error instanceof Error ? error.message : "Failed to generate keypair"
+    };
+    if (outputJson) {
+      ctx.output.data(result);
+    } else {
+      ctx.output.error(`Failed to generate keypair: ${result.error}`);
+    }
+    process.exitCode = EXIT_CODES.error;
+  }
+}
+
+// src/commands/config/set.ts
+init_esm_shims();
+import { existsSync as existsSync4, readFileSync as readFileSync2, writeFileSync as writeFileSync4 } from "fs";
+import { Decrypter, Encrypter, identityToRecipient as identityToRecipient2 } from "age-encryption";
+function getEncryptedConfigPath() {
+  return `${getUserConfigDir()}/.env.user.encrypted`;
+}
+function parseKeyValue(input2) {
+  const match = input2.match(/^([A-Z_][A-Z0-9_]*)=(.*)$/);
+  if (!match) return null;
+  const key = match[1];
+  const value = match[2];
+  if (!key || value === void 0) return null;
+  return { key, value };
+}
+async function readExistingConfig(identity, configPath) {
+  if (!existsSync4(configPath)) {
+    return {};
+  }
+  try {
+    const encrypted = readFileSync2(configPath);
+    const decrypter = new Decrypter();
+    decrypter.addIdentity(identity);
+    const decrypted = await decrypter.decrypt(encrypted, "text");
+    const config = {};
+    for (const line of decrypted.split("\n")) {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith("#")) continue;
+      const eqIndex = trimmed.indexOf("=");
+      if (eqIndex > 0) {
+        const key = trimmed.substring(0, eqIndex);
+        const value = trimmed.substring(eqIndex + 1);
+        config[key] = value;
+      }
+    }
+    return config;
+  } catch {
+    return {};
+  }
+}
+async function configSetAction(ctx, keyValue, options = {}) {
+  const outputJson = options.json === true || ctx.format === "json";
+  const keyPath = getAgeKeyPath();
+  if (!existsSync4(keyPath)) {
+    const result = {
+      success: false,
+      error: "Age key not found. Run: skill config init"
+    };
+    if (outputJson) {
+      ctx.output.data(result);
+    } else {
+      ctx.output.error(result.error);
+    }
+    process.exitCode = EXIT_CODES.usage;
+    return;
+  }
+  const parsed = parseKeyValue(keyValue);
+  if (!parsed) {
+    const result = {
+      success: false,
+      error: "Invalid format. Expected: KEY=value"
+    };
+    if (outputJson) {
+      ctx.output.data(result);
+    } else {
+      ctx.output.error(result.error);
+      ctx.output.data("Example: skill config set DATABASE_URL=postgresql://...");
+    }
+    process.exitCode = EXIT_CODES.usage;
+    return;
+  }
+  try {
+    const identity = readFileSync2(keyPath, "utf8").trim();
+    const recipient = await identityToRecipient2(identity);
+    const configPath = getEncryptedConfigPath();
+    const config = await readExistingConfig(identity, configPath);
+    config[parsed.key] = parsed.value;
+    const envContent = Object.entries(config).map(([k, v]) => `${k}=${v}`).join("\n");
+    const encrypter = new Encrypter();
+    encrypter.addRecipient(recipient);
+    const encrypted = await encrypter.encrypt(envContent + "\n");
+    writeFileSync4(configPath, Buffer.from(encrypted));
+    const result = {
+      success: true,
+      key: parsed.key,
+      encrypted: true
+    };
+    if (outputJson) {
+      ctx.output.data(result);
+    } else {
+      ctx.output.success(`Set ${parsed.key} (encrypted)`);
+      ctx.output.data(`Saved to: ${configPath}`);
+    }
+  } catch (error) {
+    const result = {
+      success: false,
+      error: error instanceof Error ? error.message : "Failed to encrypt config"
+    };
+    if (outputJson) {
+      ctx.output.data(result);
+    } else {
+      ctx.output.error(`Failed to set config: ${result.error}`);
+    }
+    process.exitCode = EXIT_CODES.error;
+  }
+}
+
+// src/commands/config/get.ts
+async function decryptConfig(identity) {
+  const configPath = getEncryptedConfigPath();
+  if (!existsSync5(configPath)) {
+    return {};
+  }
+  const encrypted = readFileSync3(configPath);
+  const decrypter = new Decrypter2();
+  decrypter.addIdentity(identity);
+  try {
+    const decrypted = await decrypter.decrypt(encrypted, "text");
+    const config = {};
+    for (const line of decrypted.split("\n")) {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith("#")) continue;
+      const eqIndex = trimmed.indexOf("=");
+      if (eqIndex > 0) {
+        const key = trimmed.substring(0, eqIndex);
+        const value = trimmed.substring(eqIndex + 1);
+        config[key] = value;
+      }
+    }
+    return config;
+  } catch (error) {
+    throw new Error(
+      `Failed to decrypt config: ${error instanceof Error ? error.message : "unknown error"}`
+    );
+  }
+}
+async function configGetAction(ctx, key, options = {}) {
+  const outputJson = options.json === true || ctx.format === "json";
+  const keyPath = getAgeKeyPath();
+  if (!existsSync5(keyPath)) {
+    const result = {
+      success: false,
+      error: "Age key not found. Run: skill config init"
+    };
+    if (outputJson) {
+      ctx.output.data(result);
+    } else {
+      ctx.output.error(result.error);
+    }
+    process.exitCode = EXIT_CODES.usage;
+    return;
+  }
+  try {
+    const identity = readFileSync3(keyPath, "utf8").trim();
+    const config = await decryptConfig(identity);
+    if (!(key in config)) {
+      const result2 = {
+        success: false,
+        key,
+        error: `Key not found: ${key}`
+      };
+      if (outputJson) {
+        ctx.output.data(result2);
+      } else {
+        ctx.output.error(result2.error);
+      }
+      process.exitCode = EXIT_CODES.usage;
+      return;
+    }
+    const result = {
+      success: true,
+      key,
+      value: config[key]
+    };
+    if (outputJson) {
+      ctx.output.data(result);
+    } else {
+      ctx.output.data(config[key]);
+    }
+  } catch (error) {
+    const result = {
+      success: false,
+      key,
+      error: error instanceof Error ? error.message : "Failed to get config"
+    };
+    if (outputJson) {
+      ctx.output.data(result);
+    } else {
+      ctx.output.error(`Failed to get config: ${result.error}`);
+    }
+    process.exitCode = EXIT_CODES.error;
+  }
+}
+
+// src/commands/config/list.ts
+init_esm_shims();
+import { existsSync as existsSync6, readFileSync as readFileSync4 } from "fs";
+import { Decrypter as Decrypter3 } from "age-encryption";
+async function decryptConfig2(identity) {
+  const configPath = getEncryptedConfigPath();
+  if (!existsSync6(configPath)) {
+    return {};
+  }
+  const encrypted = readFileSync4(configPath);
+  const decrypter = new Decrypter3();
+  decrypter.addIdentity(identity);
+  try {
+    const decrypted = await decrypter.decrypt(encrypted, "text");
+    const config = {};
+    for (const line of decrypted.split("\n")) {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith("#")) continue;
+      const eqIndex = trimmed.indexOf("=");
+      if (eqIndex > 0) {
+        const key = trimmed.substring(0, eqIndex);
+        const value = trimmed.substring(eqIndex + 1);
+        config[key] = value;
+      }
+    }
+    return config;
+  } catch (error) {
+    throw new Error(
+      `Failed to decrypt config: ${error instanceof Error ? error.message : "unknown error"}`
+    );
+  }
+}
+async function configListAction(ctx, options = {}) {
+  const outputJson = options.json === true || ctx.format === "json";
+  const keyPath = getAgeKeyPath();
+  if (!existsSync6(keyPath)) {
+    const result = {
+      success: false,
+      error: "Age key not found. Run: skill config init"
+    };
+    if (outputJson) {
+      ctx.output.data(result);
+    } else {
+      ctx.output.error(result.error);
+    }
+    process.exitCode = EXIT_CODES.usage;
+    return;
+  }
+  try {
+    const identity = readFileSync4(keyPath, "utf8").trim();
+    const config = await decryptConfig2(identity);
+    const keys = Object.keys(config);
+    if (keys.length === 0) {
+      const result2 = {
+        success: true,
+        config: {},
+        keys: []
+      };
+      if (outputJson) {
+        ctx.output.data(result2);
+      } else {
+        ctx.output.data("No config overrides set.");
+        ctx.output.data("\nTo add a config: skill config set KEY=value");
+      }
+      return;
+    }
+    const result = {
+      success: true,
+      config: options.showValues ? config : void 0,
+      keys
+    };
+    if (outputJson) {
+      ctx.output.data(result);
+    } else {
+      ctx.output.data("User config overrides:\n");
+      if (options.showValues) {
+        for (const key of keys.sort()) {
+          ctx.output.data(`${key}=${config[key]}`);
+        }
+      } else {
+        for (const key of keys.sort()) {
+          ctx.output.data(`${key}=********`);
+        }
+        ctx.output.data("\nTo view values: skill config list --show-values");
+      }
+    }
+  } catch (error) {
+    const result = {
+      success: false,
+      error: error instanceof Error ? error.message : "Failed to list config"
+    };
+    if (outputJson) {
+      ctx.output.data(result);
+    } else {
+      ctx.output.error(`Failed to list config: ${result.error}`);
+    }
+    process.exitCode = EXIT_CODES.error;
+  }
+}
+
+// src/commands/config/index.ts
+var buildContext2 = async (command, json) => {
+  const opts = typeof command.optsWithGlobals === "function" ? command.optsWithGlobals() : {
+    ...command.parent?.opts(),
+    ...command.opts()
+  };
+  return createContext({
+    format: json ? "json" : opts.format,
+    verbose: opts.verbose,
+    quiet: opts.quiet
+  });
+};
+function registerConfigCommands(program3) {
+  const config = program3.command("config").description("Manage user-specific config overrides (encrypted)");
+  config.command("init").description("Generate age keypair for user config encryption").option("--force", "Overwrite existing keypair").option("--json", "Output as JSON").action(async (options, command) => {
+    const ctx = await buildContext2(command, options.json);
+    await configInitAction(ctx, options);
+  });
+  config.command("set <key-value>").description("Set encrypted config value (format: KEY=value)").option("--json", "Output as JSON").action(async (keyValue, options, command) => {
+    const ctx = await buildContext2(command, options.json);
+    await configSetAction(ctx, keyValue, options);
+  });
+  config.command("get <key>").description("Get decrypted config value").option("--json", "Output as JSON").action(async (key, options, command) => {
+    const ctx = await buildContext2(command, options.json);
+    await configGetAction(ctx, key, options);
+  });
+  config.command("list").description("List all user config overrides").option("--show-values", "Show decrypted values (keys only by default)").option("--json", "Output as JSON").action(async (options, command) => {
+    const ctx = await buildContext2(command, options.json);
+    await configListAction(ctx, options);
+  });
+}
+
 // src/commands/db-status.ts
 init_esm_shims();
 import "commander";
@@ -77344,7 +77808,7 @@ function registerDeployCommands(program3) {
 
 // src/commands/eval.ts
 init_esm_shims();
-import { access, readFile } from "fs/promises";
+import { access, readFile as readFile2 } from "fs/promises";
 async function runEval(ctx, evalType, datasetPath, options = {}) {
   const outputJson = options.json === true || ctx.format === "json";
   const { gates } = options;
@@ -77371,7 +77835,7 @@ async function runEval(ctx, evalType, datasetPath, options = {}) {
     }
     let dataset;
     try {
-      const content = await readFile(datasetPath, "utf-8");
+      const content = await readFile2(datasetPath, "utf-8");
       dataset = JSON.parse(content);
     } catch (error) {
       throw new CLIError({
@@ -77763,7 +78227,7 @@ async function checkRedis() {
       signal: AbortSignal.timeout(5e3)
     }).catch(() => null);
     const net = await import("net");
-    return new Promise((resolve7) => {
+    return new Promise((resolve9) => {
       const socket = new net.Socket();
       socket.setTimeout(5e3);
       socket.on("connect", () => {
@@ -77773,13 +78237,13 @@ async function checkRedis() {
         const response2 = data2.toString();
         socket.destroy();
         if (response2.includes("PONG")) {
-          resolve7({
+          resolve9({
             service: "Redis",
             healthy: true,
             message: "Redis responding to PING"
           });
         } else {
-          resolve7({
+          resolve9({
             service: "Redis",
             healthy: false,
             message: "Unexpected response"
@@ -77788,7 +78252,7 @@ async function checkRedis() {
       });
       socket.on("timeout", () => {
         socket.destroy();
-        resolve7({
+        resolve9({
           service: "Redis",
           healthy: false,
           message: "Connection timeout"
@@ -77796,7 +78260,7 @@ async function checkRedis() {
       });
       socket.on("error", (err) => {
         socket.destroy();
-        resolve7({
+        resolve9({
           service: "Redis",
           healthy: false,
           message: err.message
@@ -78037,7 +78501,7 @@ var Helpfulness = ({
 
 // src/commands/eval-local/run.ts
 import { generateText, stepCountIs, tool as tool2 } from "ai";
-import { readFile as readFile2, writeFile } from "fs/promises";
+import { readFile as readFile3, writeFile } from "fs/promises";
 import { glob } from "glob";
 import { z as z3 } from "zod";
 
@@ -78764,14 +79228,14 @@ async function run(ctx, options) {
   }
   let systemPrompt = SUPPORT_AGENT_PROMPT;
   if (promptPath) {
-    systemPrompt = await readFile2(promptPath, "utf-8");
+    systemPrompt = await readFile3(promptPath, "utf-8");
     log(`Using prompt from: ${promptPath}`);
   } else {
     log("Using production prompt");
   }
   let scenarios = [];
   if (datasetPath) {
-    const datasetContent = await readFile2(datasetPath, "utf-8");
+    const datasetContent = await readFile3(datasetPath, "utf-8");
     const dataset = JSON.parse(datasetContent);
     scenarios = dataset.map((item) => {
       const trigger = item.triggerMessage || {
@@ -78804,7 +79268,7 @@ async function run(ctx, options) {
     }
     scenarios = await Promise.all(
       scenarioFiles.map(async (file) => {
-        const content = await readFile2(file, "utf-8");
+        const content = await readFile3(file, "utf-8");
         return JSON.parse(content);
       })
     );
@@ -78842,7 +79306,7 @@ async function run(ctx, options) {
   const summary = aggregateResults(results, totalDuration);
   if (baseline) {
     try {
-      const baselineContent = await readFile2(baseline, "utf-8");
+      const baselineContent = await readFile3(baseline, "utf-8");
       const baselineData = JSON.parse(baselineContent);
       printComparison(ctx, summary, baselineData.summary || baselineData);
     } catch (e) {
@@ -79169,14 +79633,14 @@ function printComparison(ctx, current, baseline) {
 
 // src/commands/eval-local/score-production.ts
 init_esm_shims();
-import { readFile as readFile3, writeFile as writeFile2 } from "fs/promises";
+import { readFile as readFile4, writeFile as writeFile2 } from "fs/promises";
 async function scoreProduction(ctx, options) {
   const { dataset: datasetPath, output, verbose, json } = options;
   const outputJson = json === true || ctx.format === "json";
   const log = (text3) => {
     if (!outputJson) ctx.output.data(text3);
   };
-  const datasetContent = await readFile3(datasetPath, "utf-8");
+  const datasetContent = await readFile4(datasetPath, "utf-8");
   const dataset = JSON.parse(datasetContent);
   log(`
 \u{1F4CA} Scoring ${dataset.length} production responses
@@ -79349,13 +79813,13 @@ async function scoreProduction(ctx, options) {
 
 // src/commands/eval-local/seed.ts
 init_esm_shims();
-import { join as join2 } from "path";
+import { join as join4 } from "path";
 import { glob as glob3 } from "glob";
 
 // src/lib/eval-seed.ts
 init_esm_shims();
-import { join } from "path";
-import { readFile as readFile4, readdir } from "fs/promises";
+import { join as join3 } from "path";
+import { readFile as readFile5, readdir } from "fs/promises";
 import { glob as glob2 } from "glob";
 import matter from "gray-matter";
 function generateUUID() {
@@ -79400,7 +79864,7 @@ async function loadJsonFiles(dirPath) {
     const jsonFiles = files.filter((f) => f.endsWith(".json"));
     const items = await Promise.all(
       jsonFiles.map(async (file) => {
-        const content = await readFile4(join(dirPath, file), "utf-8");
+        const content = await readFile5(join3(dirPath, file), "utf-8");
         return JSON.parse(content);
       })
     );
@@ -79410,10 +79874,10 @@ async function loadJsonFiles(dirPath) {
   }
 }
 async function loadKnowledgeFiles(basePath) {
-  const files = await glob2(join(basePath, "**/*.md"));
+  const files = await glob2(join3(basePath, "**/*.md"));
   const docs = [];
   for (const filePath of files) {
-    const content = await readFile4(filePath, "utf-8");
+    const content = await readFile5(filePath, "utf-8");
     const { data: frontmatter, content: body } = matter(content);
     const titleMatch = body.match(/^#\s+(.+)$/m);
     const title = titleMatch?.[1] ?? filePath.split("/").pop()?.replace(".md", "") ?? "Untitled";
@@ -79600,16 +80064,16 @@ async function seed(ctx, options) {
       await cleanQdrant();
     }
     log("\u{1F4E6} Seeding apps...");
-    const apps = await loadJsonFiles(join2(fixturesPath, "apps"));
+    const apps = await loadJsonFiles(join4(fixturesPath, "apps"));
     result.apps = await seedApps(connection, apps);
     log("\u{1F465} Loading customer fixtures...");
-    const customers = await loadJsonFiles(join2(fixturesPath, "customers"));
+    const customers = await loadJsonFiles(join4(fixturesPath, "customers"));
     result.customers = customers.length;
     log("\u{1F4DA} Seeding knowledge base...");
-    const knowledge = await loadKnowledgeFiles(join2(fixturesPath, "knowledge"));
+    const knowledge = await loadKnowledgeFiles(join4(fixturesPath, "knowledge"));
     result.knowledge = knowledge.length;
     result.embeddings = await seedKnowledgeBase(knowledge, !outputJson);
-    const scenarioFiles = await glob3(join2(fixturesPath, "scenarios/**/*.json"));
+    const scenarioFiles = await glob3(join4(fixturesPath, "scenarios/**/*.json"));
     result.scenarios = scenarioFiles.length;
     await connection.end();
     if (outputJson) {
@@ -79639,7 +80103,7 @@ async function seed(ctx, options) {
 }
 
 // src/commands/eval-local/index.ts
-var buildContext2 = async (command, json) => {
+var buildContext3 = async (command, json) => {
   const opts = typeof command.optsWithGlobals === "function" ? command.optsWithGlobals() : {
     ...command.parent?.opts(),
     ...command.opts()
@@ -79653,11 +80117,11 @@ var buildContext2 = async (command, json) => {
 function registerEvalLocalCommands(program3) {
   const evalLocal = program3.command("eval-local").description("Local evaluation environment commands");
   evalLocal.command("health").description("Check health of local eval environment services").option("--json", "Output as JSON").action(async (options, command) => {
-    const ctx = await buildContext2(command, options.json);
+    const ctx = await buildContext3(command, options.json);
     await health(ctx, options);
   });
   evalLocal.command("seed").description("Seed the local eval environment with fixtures").option("--clean", "Drop and recreate all data before seeding").option("--fixtures <path>", "Path to fixtures directory", "fixtures").option("--json", "Output as JSON").action(async (options, command) => {
-    const ctx = await buildContext2(command, options.json);
+    const ctx = await buildContext3(command, options.json);
     await seed(ctx, options);
   });
   evalLocal.command("run").description("Run eval suite against local environment").option("--scenarios <glob>", "Scenario files glob pattern").option("--dataset <file>", "Dataset JSON file (alternative to scenarios)").option("--prompt <file>", "Custom prompt file (default: production)").option("--model <model>", "Model to use", "anthropic/claude-haiku-4-5").option("--limit <number>", "Max scenarios to run", parseInt).option("--output <file>", "Save results to JSON file").option("--baseline <file>", "Compare against baseline results").option(
@@ -79665,7 +80129,7 @@ function registerEvalLocalCommands(program3) {
     "Fail if pass rate below threshold",
     parseFloat
   ).option("--verbose", "Show individual scenario results").option("--json", "JSON output for scripting").option("--real-tools", "Use real Docker services instead of mocks").action(async (options, command) => {
-    const ctx = await buildContext2(command, options.json);
+    const ctx = await buildContext3(command, options.json);
     await run(ctx, options);
   });
   evalLocal.command("score-production").description(
@@ -79674,7 +80138,7 @@ function registerEvalLocalCommands(program3) {
     "--dataset <file>",
     "Dataset JSON file with production responses"
   ).option("--output <file>", "Save results to JSON file").option("--verbose", "Show individual failures").option("--json", "JSON output for scripting").action(async (options, command) => {
-    const ctx = await buildContext2(command, options.json);
+    const ctx = await buildContext3(command, options.json);
     await scoreProduction(ctx, options);
   });
 }
@@ -79685,9 +80149,9 @@ init_esm_shims();
 // src/commands/eval-pipeline/run.ts
 init_esm_shims();
 import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync2, mkdirSync, readFileSync, rmSync, writeFileSync as writeFileSync3 } from "fs";
-import { join as join3 } from "path";
-import { readFile as readFile5 } from "fs/promises";
+import { existsSync as existsSync7, mkdirSync as mkdirSync2, readFileSync as readFileSync5, rmSync, writeFileSync as writeFileSync5 } from "fs";
+import { join as join5 } from "path";
+import { readFile as readFile6 } from "fs/promises";
 import { glob as glob4 } from "glob";
 
 // src/commands/eval-pipeline/real-tools.ts
@@ -80099,12 +80563,12 @@ function getCacheKey(scenarioId, classifySourceHash) {
 function getClassifySourceHash() {
   try {
     const possiblePaths = [
-      join3(process.cwd(), "packages/core/src/pipeline/classify.ts"),
-      join3(process.cwd(), "../core/src/pipeline/classify.ts")
+      join5(process.cwd(), "packages/core/src/pipeline/classify.ts"),
+      join5(process.cwd(), "../core/src/pipeline/classify.ts")
     ];
     for (const path of possiblePaths) {
-      if (existsSync2(path)) {
-        const content = readFileSync(path, "utf-8");
+      if (existsSync7(path)) {
+        const content = readFileSync5(path, "utf-8");
         return createHash2("md5").update(content).digest("hex");
       }
     }
@@ -80113,10 +80577,10 @@ function getClassifySourceHash() {
   return createHash2("md5").update(Math.floor(Date.now() / 3e5).toString()).digest("hex");
 }
 function loadCachedClassify(cacheKey) {
-  const cachePath = join3(CACHE_DIR, `${cacheKey}.json`);
+  const cachePath = join5(CACHE_DIR, `${cacheKey}.json`);
   try {
-    if (existsSync2(cachePath)) {
-      return JSON.parse(readFileSync(cachePath, "utf-8"));
+    if (existsSync7(cachePath)) {
+      return JSON.parse(readFileSync5(cachePath, "utf-8"));
     }
   } catch {
   }
@@ -80124,17 +80588,17 @@ function loadCachedClassify(cacheKey) {
 }
 function saveCachedClassify(cacheKey, result) {
   try {
-    if (!existsSync2(CACHE_DIR)) {
-      mkdirSync(CACHE_DIR, { recursive: true });
+    if (!existsSync7(CACHE_DIR)) {
+      mkdirSync2(CACHE_DIR, { recursive: true });
     }
-    const cachePath = join3(CACHE_DIR, `${cacheKey}.json`);
-    writeFileSync3(cachePath, JSON.stringify(result));
+    const cachePath = join5(CACHE_DIR, `${cacheKey}.json`);
+    writeFileSync5(cachePath, JSON.stringify(result));
   } catch {
   }
 }
 function clearClassifyCache() {
   try {
-    if (existsSync2(CACHE_DIR)) {
+    if (existsSync7(CACHE_DIR)) {
       rmSync(CACHE_DIR, { recursive: true, force: true });
     }
   } catch {
@@ -80273,7 +80737,7 @@ async function run2(ctx, options) {
 }
 async function loadScenarios(scenarioGlob, datasetPath) {
   if (datasetPath) {
-    const content = await readFile5(datasetPath, "utf-8");
+    const content = await readFile6(datasetPath, "utf-8");
     const data2 = JSON.parse(content);
     return data2.map((item) => ({
       id: item.id || item.conversationId,
@@ -80297,7 +80761,7 @@ async function loadScenarios(scenarioGlob, datasetPath) {
     }
     return Promise.all(
       files.map(async (file) => {
-        const content = await readFile5(file, "utf-8");
+        const content = await readFile6(file, "utf-8");
         return JSON.parse(content);
       })
     );
@@ -81010,7 +81474,7 @@ Latency: ${avgLatency.toFixed(0)}ms avg`);
 
 // src/commands/eval-pipeline/seed.ts
 init_esm_shims();
-import { join as join4 } from "path";
+import { join as join6 } from "path";
 import { glob as glob5 } from "glob";
 async function seed2(ctx, options) {
   const fixturesPath = options.fixtures || "fixtures";
@@ -81041,20 +81505,20 @@ async function seed2(ctx, options) {
       await cleanQdrant();
     }
     if (!outputJson) ctx.output.message("\u{1F4E6} Seeding apps...");
-    const apps = await loadJsonFiles(join4(fixturesPath, "apps"));
+    const apps = await loadJsonFiles(join6(fixturesPath, "apps"));
     result.apps = await seedApps(connection, apps);
     const [trustRows] = await connection.execute(
       "SELECT COUNT(*) as count FROM SUPPORT_trust_scores"
     );
     result.trustScores = trustRows[0].count;
     if (!outputJson) ctx.output.message("\u{1F465} Loading customer fixtures...");
-    const customers = await loadJsonFiles(join4(fixturesPath, "customers"));
+    const customers = await loadJsonFiles(join6(fixturesPath, "customers"));
     result.customers = customers.length;
     if (!outputJson) ctx.output.message("\u{1F4DA} Seeding knowledge base...");
-    const knowledge = await loadKnowledgeFiles(join4(fixturesPath, "knowledge"));
+    const knowledge = await loadKnowledgeFiles(join6(fixturesPath, "knowledge"));
     result.knowledge = knowledge.length;
     result.embeddings = await seedKnowledgeBase(knowledge, !outputJson);
-    const scenarioFiles = await glob5(join4(fixturesPath, "scenarios/**/*.json"));
+    const scenarioFiles = await glob5(join6(fixturesPath, "scenarios/**/*.json"));
     result.scenarios = scenarioFiles.length;
     await connection.end();
     if (outputJson) {
@@ -81126,7 +81590,7 @@ function registerEvalPipelineCommands(program3) {
 
 // src/commands/eval-prompt.ts
 init_esm_shims();
-import { existsSync as existsSync3, readFileSync as readFileSync2, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync8, readFileSync as readFileSync6, writeFileSync as writeFileSync6 } from "fs";
 import { generateText as generateText2, stepCountIs as stepCountIs2, tool as tool4 } from "ai";
 import { z as z5 } from "zod";
 var leakPatterns = [
@@ -81313,27 +81777,27 @@ async function runEval2(ctx, options) {
   try {
     let prompt = SUPPORT_AGENT_PROMPT;
     if (promptPath) {
-      if (!existsSync3(promptPath)) {
+      if (!existsSync8(promptPath)) {
         throw new CLIError({
           userMessage: `Prompt file not found: ${promptPath}.`,
           suggestion: "Verify the prompt path and try again."
         });
       }
-      prompt = readFileSync2(promptPath, "utf-8");
+      prompt = readFileSync6(promptPath, "utf-8");
       if (!outputJson) {
         ctx.output.message(`Using prompt from: ${promptPath}`);
       }
     } else if (!outputJson) {
       ctx.output.message("Using production prompt");
     }
-    if (!existsSync3(datasetPath)) {
+    if (!existsSync8(datasetPath)) {
       throw new CLIError({
         userMessage: `Dataset not found: ${datasetPath}.`,
         suggestion: "Provide a valid dataset file path."
       });
     }
     const dataset = JSON.parse(
-      readFileSync2(datasetPath, "utf-8")
+      readFileSync6(datasetPath, "utf-8")
     );
     const samples = dataset.slice(0, limit2);
     if (!outputJson) {
@@ -81409,7 +81873,7 @@ async function runEval2(ctx, options) {
       });
     }
     if (outputPath) {
-      writeFileSync4(outputPath, JSON.stringify(results, null, 2));
+      writeFileSync6(outputPath, JSON.stringify(results, null, 2));
       if (!outputJson) {
         ctx.output.success(`Saved results to ${outputPath}`);
       }
@@ -81436,16 +81900,16 @@ async function comparePrompts(ctx, options) {
     model = "anthropic/claude-haiku-4-5"
   } = options;
   try {
-    const baselinePrompt = baseline ? readFileSync2(baseline, "utf-8") : SUPPORT_AGENT_PROMPT;
-    const candidatePrompt = readFileSync2(candidate, "utf-8");
-    if (!existsSync3(datasetPath)) {
+    const baselinePrompt = baseline ? readFileSync6(baseline, "utf-8") : SUPPORT_AGENT_PROMPT;
+    const candidatePrompt = readFileSync6(candidate, "utf-8");
+    if (!existsSync8(datasetPath)) {
       throw new CLIError({
         userMessage: `Dataset not found: ${datasetPath}.`,
         suggestion: "Provide a valid dataset file path."
       });
     }
     const dataset = JSON.parse(
-      readFileSync2(datasetPath, "utf-8")
+      readFileSync6(datasetPath, "utf-8")
     );
     const samples = dataset.slice(0, limit2);
     if (!outputJson) {
@@ -81586,20 +82050,20 @@ init_esm_shims();
 
 // src/commands/faq/classify.ts
 init_esm_shims();
-import { appendFileSync, existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync3 } from "fs";
-import { dirname as dirname2, join as join5, resolve as resolve2 } from "path";
+import { appendFileSync, existsSync as existsSync9, mkdirSync as mkdirSync3, readFileSync as readFileSync7 } from "fs";
+import { dirname as dirname3, join as join7, resolve as resolve3 } from "path";
 import { generateObject } from "ai";
 import { z as z6 } from "zod";
-var PROJECT_ROOT = resolve2(__dirname, "../../../..");
-var DEFAULT_PARQUET_PATH = join5(
+var PROJECT_ROOT = resolve3(__dirname, "../../../..");
+var DEFAULT_PARQUET_PATH = join7(
   PROJECT_ROOT,
   "artifacts/phase-0/embeddings/v2/conversations.parquet"
 );
-var DEFAULT_TAXONOMY_PATH = join5(
+var DEFAULT_TAXONOMY_PATH = join7(
   PROJECT_ROOT,
   "artifacts/phase-1/llm-topics/taxonomy.json"
 );
-var DEFAULT_OUTPUT_PATH = join5(
+var DEFAULT_OUTPUT_PATH = join7(
   PROJECT_ROOT,
   "artifacts/phase-1/llm-topics/classifications.jsonl"
 );
@@ -81654,10 +82118,10 @@ async function loadConversationsFromParquet(parquetPath) {
 }
 function loadExistingClassifications(outputPath) {
   const classifiedIds = /* @__PURE__ */ new Set();
-  if (!existsSync4(outputPath)) {
+  if (!existsSync9(outputPath)) {
     return classifiedIds;
   }
-  const content = readFileSync3(outputPath, "utf-8");
+  const content = readFileSync7(outputPath, "utf-8");
   const lines = content.split("\n").filter((line) => line.trim());
   for (const line of lines) {
     try {
@@ -81772,7 +82236,7 @@ async function faqClassify(ctx, options) {
     ctx.output.data(`   Dry run:        ${options.dryRun ?? false}`);
     ctx.output.data("");
   }
-  if (!existsSync4(parquetPath)) {
+  if (!existsSync9(parquetPath)) {
     handleFaqClassifyError(
       ctx,
       new CLIError({
@@ -81783,7 +82247,7 @@ async function faqClassify(ctx, options) {
     );
     return;
   }
-  if (!existsSync4(taxonomyPath)) {
+  if (!existsSync9(taxonomyPath)) {
     handleFaqClassifyError(
       ctx,
       new CLIError({
@@ -81794,12 +82258,12 @@ async function faqClassify(ctx, options) {
     );
     return;
   }
-  const outputDir = dirname2(outputPath);
-  if (!existsSync4(outputDir)) {
-    mkdirSync2(outputDir, { recursive: true });
+  const outputDir = dirname3(outputPath);
+  if (!existsSync9(outputDir)) {
+    mkdirSync3(outputDir, { recursive: true });
   }
   if (!outputJson) ctx.output.data("\u{1F4DA} Loading taxonomy...");
-  const taxonomy = JSON.parse(readFileSync3(taxonomyPath, "utf-8"));
+  const taxonomy = JSON.parse(readFileSync7(taxonomyPath, "utf-8"));
   const validTopicIds = new Set(taxonomy.topics.map((t2) => t2.id));
   validTopicIds.add("unknown");
   if (!outputJson) {
@@ -81964,51 +82428,51 @@ function registerFaqClassifyCommands(program3) {
 
 // src/commands/faq/cluster.ts
 init_esm_shims();
-import { existsSync as existsSync6 } from "fs";
-import { join as join7, resolve as resolve3 } from "path";
+import { existsSync as existsSync11 } from "fs";
+import { join as join9, resolve as resolve4 } from "path";
 
 // ../core/src/faq/production-clusterer.ts
 init_esm_shims();
-import { existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync5 } from "fs";
-import { join as join6 } from "path";
+import { existsSync as existsSync10, mkdirSync as mkdirSync4, readFileSync as readFileSync8, writeFileSync as writeFileSync7 } from "fs";
+import { join as join8 } from "path";
 function readPhase0Assignments(phase0Path) {
-  const assignmentsPath = join6(phase0Path, "clusters/v1/assignments.json");
-  if (!existsSync5(assignmentsPath)) {
-    const latestPath = join6(phase0Path, "clusters/latest/assignments.json");
-    if (!existsSync5(latestPath)) {
+  const assignmentsPath = join8(phase0Path, "clusters/v1/assignments.json");
+  if (!existsSync10(assignmentsPath)) {
+    const latestPath = join8(phase0Path, "clusters/latest/assignments.json");
+    if (!existsSync10(latestPath)) {
       throw new Error(`Phase 0 assignments not found at ${assignmentsPath}`);
     }
-    const content2 = readFileSync4(latestPath, "utf-8");
+    const content2 = readFileSync8(latestPath, "utf-8");
     return JSON.parse(content2);
   }
-  const content = readFileSync4(assignmentsPath, "utf-8");
+  const content = readFileSync8(assignmentsPath, "utf-8");
   return JSON.parse(content);
 }
 function readPhase0Labels(phase0Path) {
-  const labelsPath = join6(phase0Path, "clusters/v1/labels.json");
-  if (!existsSync5(labelsPath)) {
-    const latestPath = join6(phase0Path, "clusters/latest/labels.json");
-    if (!existsSync5(latestPath)) {
+  const labelsPath = join8(phase0Path, "clusters/v1/labels.json");
+  if (!existsSync10(labelsPath)) {
+    const latestPath = join8(phase0Path, "clusters/latest/labels.json");
+    if (!existsSync10(latestPath)) {
       throw new Error(`Phase 0 labels not found at ${labelsPath}`);
     }
-    const content2 = readFileSync4(latestPath, "utf-8");
+    const content2 = readFileSync8(latestPath, "utf-8");
     const parsed2 = JSON.parse(content2);
     return parsed2.clusters || [];
   }
-  const content = readFileSync4(labelsPath, "utf-8");
+  const content = readFileSync8(labelsPath, "utf-8");
   const parsed = JSON.parse(content);
   return parsed.clusters || [];
 }
 function readPhase0Metrics(phase0Path) {
-  const metricsPath = join6(phase0Path, "clusters/v1/metrics.json");
-  if (!existsSync5(metricsPath)) {
-    const latestPath = join6(phase0Path, "clusters/latest/metrics.json");
-    if (!existsSync5(latestPath)) {
+  const metricsPath = join8(phase0Path, "clusters/v1/metrics.json");
+  if (!existsSync10(metricsPath)) {
+    const latestPath = join8(phase0Path, "clusters/latest/metrics.json");
+    if (!existsSync10(latestPath)) {
       throw new Error(`Phase 0 metrics not found at ${metricsPath}`);
     }
-    return JSON.parse(readFileSync4(latestPath, "utf-8"));
+    return JSON.parse(readFileSync8(latestPath, "utf-8"));
   }
-  return JSON.parse(readFileSync4(metricsPath, "utf-8"));
+  return JSON.parse(readFileSync8(metricsPath, "utf-8"));
 }
 function calculateConfidence2(distance) {
   if (distance === null) return 0;
@@ -82123,18 +82587,18 @@ async function generateProductionClustering(options) {
   return result;
 }
 function writeProductionArtifacts(result, outputPath) {
-  const versionPath = join6(outputPath, result.version);
-  if (!existsSync5(versionPath)) {
-    mkdirSync3(versionPath, { recursive: true });
+  const versionPath = join8(outputPath, result.version);
+  if (!existsSync10(versionPath)) {
+    mkdirSync4(versionPath, { recursive: true });
   }
-  const resultPath = join6(versionPath, "clustering-result.json");
-  writeFileSync5(resultPath, JSON.stringify(result, null, 2));
+  const resultPath = join8(versionPath, "clustering-result.json");
+  writeFileSync7(resultPath, JSON.stringify(result, null, 2));
   console.log(`\u2705 Written: ${resultPath}`);
-  const assignmentsPath = join6(versionPath, "assignments.json");
-  writeFileSync5(assignmentsPath, JSON.stringify(result.assignments, null, 2));
+  const assignmentsPath = join8(versionPath, "assignments.json");
+  writeFileSync7(assignmentsPath, JSON.stringify(result.assignments, null, 2));
   console.log(`\u2705 Written: ${assignmentsPath}`);
-  const clustersPath = join6(versionPath, "clusters.json");
-  writeFileSync5(
+  const clustersPath = join8(versionPath, "clusters.json");
+  writeFileSync7(
     clustersPath,
     JSON.stringify(
       {
@@ -82148,7 +82612,7 @@ function writeProductionArtifacts(result, outputPath) {
     )
   );
   console.log(`\u2705 Written: ${clustersPath}`);
-  const summaryPath = join6(versionPath, "summary.json");
+  const summaryPath = join8(versionPath, "summary.json");
   const summary = {
     version: result.version,
     generatedAt: result.generatedAt,
@@ -82160,23 +82624,23 @@ function writeProductionArtifacts(result, outputPath) {
       priorityTier: c.priorityTier
     }))
   };
-  writeFileSync5(summaryPath, JSON.stringify(summary, null, 2));
+  writeFileSync7(summaryPath, JSON.stringify(summary, null, 2));
   console.log(`\u2705 Written: ${summaryPath}`);
-  const latestPath = join6(outputPath, "latest");
-  if (existsSync5(latestPath)) {
+  const latestPath = join8(outputPath, "latest");
+  if (existsSync10(latestPath)) {
     const { rmSync: rmSync2 } = __require("fs");
     rmSync2(latestPath, { recursive: true, force: true });
   }
-  mkdirSync3(latestPath, { recursive: true });
+  mkdirSync4(latestPath, { recursive: true });
   for (const file of [
     "clustering-result.json",
     "assignments.json",
     "clusters.json",
     "summary.json"
   ]) {
-    const src = join6(versionPath, file);
-    const dst = join6(latestPath, file);
-    writeFileSync5(dst, readFileSync4(src));
+    const src = join8(versionPath, file);
+    const dst = join8(latestPath, file);
+    writeFileSync7(dst, readFileSync8(src));
   }
   console.log(`\u2705 Updated: ${latestPath}`);
 }
@@ -82227,26 +82691,26 @@ function displayClusteringSummary(result) {
 }
 
 // src/commands/faq/cluster.ts
-var PROJECT_ROOT2 = resolve3(__dirname, "../../../..");
-var DEFAULT_PHASE0_PATH = join7(PROJECT_ROOT2, "artifacts/phase-0");
-var DEFAULT_OUTPUT_PATH2 = join7(PROJECT_ROOT2, "artifacts/phase-1/clustering");
+var PROJECT_ROOT2 = resolve4(__dirname, "../../../..");
+var DEFAULT_PHASE0_PATH = join9(PROJECT_ROOT2, "artifacts/phase-0");
+var DEFAULT_OUTPUT_PATH2 = join9(PROJECT_ROOT2, "artifacts/phase-1/clustering");
 function validatePaths(phase0Path) {
-  const assignmentsPath = join7(phase0Path, "clusters/v1/assignments.json");
-  const labelsPath = join7(phase0Path, "clusters/v1/labels.json");
-  const metricsPath = join7(phase0Path, "clusters/v1/metrics.json");
-  if (!existsSync6(assignmentsPath)) {
+  const assignmentsPath = join9(phase0Path, "clusters/v1/assignments.json");
+  const labelsPath = join9(phase0Path, "clusters/v1/labels.json");
+  const metricsPath = join9(phase0Path, "clusters/v1/metrics.json");
+  if (!existsSync11(assignmentsPath)) {
     throw new CLIError({
       userMessage: `Phase 0 assignments not found at ${assignmentsPath}.`,
       suggestion: "Run Phase 0 clustering first or specify the correct --phase0-path."
     });
   }
-  if (!existsSync6(labelsPath)) {
+  if (!existsSync11(labelsPath)) {
     throw new CLIError({
       userMessage: `Phase 0 labels not found at ${labelsPath}.`,
       suggestion: "Verify the --phase0-path points to valid artifacts."
     });
   }
-  if (!existsSync6(metricsPath)) {
+  if (!existsSync11(metricsPath)) {
     throw new CLIError({
       userMessage: `Phase 0 metrics not found at ${metricsPath}.`,
       suggestion: "Verify the --phase0-path points to valid artifacts."
@@ -82284,7 +82748,7 @@ async function faqCluster(ctx, options) {
       writeProductionArtifacts(result, outputPath);
       if (!outputJson) {
         ctx.output.data("\n\u2705 Production clustering complete!");
-        ctx.output.data(`   Artifacts written to: ${join7(outputPath, version)}`);
+        ctx.output.data(`   Artifacts written to: ${join9(outputPath, version)}`);
       }
     } else {
       if (!outputJson) ctx.output.data("\n\u{1F9EA} Dry run - no artifacts written");
@@ -82327,13 +82791,13 @@ function registerFaqClusterCommands(program3) {
 
 // src/commands/faq/extract.ts
 init_esm_shims();
-import { existsSync as existsSync8 } from "fs";
-import { join as join9, resolve as resolve4 } from "path";
+import { existsSync as existsSync13 } from "fs";
+import { join as join11, resolve as resolve5 } from "path";
 
 // ../core/src/faq/extractor.ts
 init_esm_shims();
-import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync6 } from "fs";
-import { join as join8 } from "path";
+import { existsSync as existsSync12, mkdirSync as mkdirSync5, readFileSync as readFileSync9, writeFileSync as writeFileSync8 } from "fs";
+import { join as join10 } from "path";
 
 // ../core/src/faq/review.ts
 init_esm_shims();
@@ -82715,12 +83179,12 @@ function deduplicateCandidates(candidates, threshold) {
   };
 }
 function readClusteringResult(path) {
-  const content = readFileSync5(path, "utf-8");
+  const content = readFileSync9(path, "utf-8");
   return JSON.parse(content);
 }
 function readGoldenResponses(path) {
   try {
-    const content = readFileSync5(path, "utf-8");
+    const content = readFileSync9(path, "utf-8");
     const parsed = JSON.parse(content);
     return parsed.responses || parsed;
   } catch {
@@ -82947,14 +83411,14 @@ async function extractFaqCandidates(options) {
   return result;
 }
 function writeExtractionArtifacts(result, outputPath) {
-  const versionPath = join8(outputPath, result.version);
-  if (!existsSync7(versionPath)) {
-    mkdirSync4(versionPath, { recursive: true });
+  const versionPath = join10(outputPath, result.version);
+  if (!existsSync12(versionPath)) {
+    mkdirSync5(versionPath, { recursive: true });
   }
-  const resultPath = join8(versionPath, "extraction-result.json");
-  writeFileSync6(resultPath, JSON.stringify(result, null, 2));
+  const resultPath = join10(versionPath, "extraction-result.json");
+  writeFileSync8(resultPath, JSON.stringify(result, null, 2));
   console.log(`\u2705 Written: ${resultPath}`);
-  const candidatesPath = join8(versionPath, "candidates.json");
+  const candidatesPath = join10(versionPath, "candidates.json");
   const candidatesData = {
     version: result.version,
     extractedAt: result.extractedAt,
@@ -82972,10 +83436,10 @@ function writeExtractionArtifacts(result, outputPath) {
       sourceConversations: c.sourceConversations.slice(0, 5)
     }))
   };
-  writeFileSync6(candidatesPath, JSON.stringify(candidatesData, null, 2));
+  writeFileSync8(candidatesPath, JSON.stringify(candidatesData, null, 2));
   console.log(`\u2705 Written: ${candidatesPath}`);
-  const statsPath = join8(versionPath, "stats.json");
-  writeFileSync6(
+  const statsPath = join10(versionPath, "stats.json");
+  writeFileSync8(
     statsPath,
     JSON.stringify(
       {
@@ -82988,21 +83452,21 @@ function writeExtractionArtifacts(result, outputPath) {
     )
   );
   console.log(`\u2705 Written: ${statsPath}`);
-  const latestPath = join8(outputPath, "latest");
-  if (existsSync7(latestPath)) {
+  const latestPath = join10(outputPath, "latest");
+  if (existsSync12(latestPath)) {
     const { rmSync: rmSync2 } = __require("fs");
     rmSync2(latestPath, { recursive: true, force: true });
   }
-  mkdirSync4(latestPath, { recursive: true });
+  mkdirSync5(latestPath, { recursive: true });
   for (const file of [
     "extraction-result.json",
     "candidates.json",
     "stats.json"
   ]) {
-    const src = join8(versionPath, file);
-    const dst = join8(latestPath, file);
-    if (existsSync7(src)) {
-      writeFileSync6(dst, readFileSync5(src));
+    const src = join10(versionPath, file);
+    const dst = join10(latestPath, file);
+    if (existsSync12(src)) {
+      writeFileSync8(dst, readFileSync9(src));
     }
   }
   console.log(`\u2705 Updated: ${latestPath}`);
@@ -83054,25 +83518,25 @@ ${i + 1}. [${confPct}%]${golden} ${candidate.suggestedCategory}`
 }
 
 // src/commands/faq/extract.ts
-var PROJECT_ROOT3 = resolve4(__dirname, "../../../..");
-var DEFAULT_CLUSTERING_PATH = join9(
+var PROJECT_ROOT3 = resolve5(__dirname, "../../../..");
+var DEFAULT_CLUSTERING_PATH = join11(
   PROJECT_ROOT3,
   "artifacts/phase-1/clustering/v1/clustering-result.json"
 );
-var DEFAULT_GOLDEN_PATH = join9(
+var DEFAULT_GOLDEN_PATH = join11(
   PROJECT_ROOT3,
   "artifacts/phase-0/golden/latest/responses.json"
 );
-var DEFAULT_OUTPUT_PATH3 = join9(PROJECT_ROOT3, "artifacts/phase-1/extraction");
+var DEFAULT_OUTPUT_PATH3 = join11(PROJECT_ROOT3, "artifacts/phase-1/extraction");
 var DEFAULT_CACHE_PATH = `${process.env.HOME}/skill/data/front-cache.db`;
 function validatePaths2(ctx, clusteringPath, goldenPath, outputJson) {
-  if (!existsSync8(clusteringPath)) {
+  if (!existsSync13(clusteringPath)) {
     throw new CLIError({
       userMessage: `Clustering result not found at ${clusteringPath}.`,
       suggestion: "Run `bun src/index.ts faq cluster` first to generate clustering."
     });
   }
-  if (goldenPath && !existsSync8(goldenPath)) {
+  if (goldenPath && !existsSync13(goldenPath)) {
     if (!outputJson) {
       ctx.output.warn(`Golden responses not found at ${goldenPath}`);
       ctx.output.warn("Golden matching will be disabled.");
@@ -83101,7 +83565,7 @@ async function faqExtract(ctx, options) {
     ctx.output.data("");
   }
   validatePaths2(ctx, clusteringPath, goldenPath, outputJson);
-  if (!existsSync8(cachePath)) {
+  if (!existsSync13(cachePath)) {
     const cliError = new CLIError({
       userMessage: `DuckDB cache not found at ${cachePath}.`,
       suggestion: "Run `bun src/index.ts front-cache sync` first to populate cache."
@@ -83123,7 +83587,7 @@ async function faqExtract(ctx, options) {
     }
     const extractionOptions = {
       clusteringPath,
-      goldenPath: existsSync8(goldenPath) ? goldenPath : void 0,
+      goldenPath: existsSync13(goldenPath) ? goldenPath : void 0,
       source,
       outputPath,
       version,
@@ -83168,7 +83632,7 @@ async function faqExtract(ctx, options) {
       if (!options.dryRun) {
         ctx.output.data(`
 \u2705 Extraction complete!`);
-        ctx.output.data(`   Artifacts written to: ${join9(outputPath, version)}`);
+        ctx.output.data(`   Artifacts written to: ${join11(outputPath, version)}`);
         if (options.pushRedis && options.app) {
           ctx.output.data(
             `   Candidates pushed to Redis queue: faq:pending:${options.app}`
@@ -83243,7 +83707,7 @@ function registerFaqExtractCommands(program3) {
 
 // src/commands/faq/mine.ts
 init_esm_shims();
-import { writeFileSync as writeFileSync7 } from "fs";
+import { writeFileSync as writeFileSync9 } from "fs";
 
 // ../core/src/faq/index.ts
 init_esm_shims();
@@ -83988,7 +84452,7 @@ function consumeBody() {
   let accum = [];
   let accumBytes = 0;
   let abort = false;
-  return new Body.Promise(function(resolve7, reject) {
+  return new Body.Promise(function(resolve9, reject) {
     let resTimeout;
     if (_this4.timeout) {
       resTimeout = setTimeout(function() {
@@ -84022,7 +84486,7 @@ function consumeBody() {
       }
       clearTimeout(resTimeout);
       try {
-        resolve7(Buffer.concat(accum, accumBytes));
+        resolve9(Buffer.concat(accum, accumBytes));
       } catch (err) {
         reject(new FetchError(`Could not create Buffer from response body for ${_this4.url}: ${err.message}`, "system", err));
       }
@@ -84697,7 +85161,7 @@ function fetch3(url, opts) {
     throw new Error("native promise missing, set fetch.Promise to your favorite alternative");
   }
   Body.Promise = fetch3.Promise;
-  return new fetch3.Promise(function(resolve7, reject) {
+  return new fetch3.Promise(function(resolve9, reject) {
     const request = new Request2(url, opts);
     const options = getNodeRequestOptions(request);
     const send = (options.protocol === "https:" ? https : http).request;
@@ -84830,7 +85294,7 @@ function fetch3(url, opts) {
               requestOpts.body = void 0;
               requestOpts.headers.delete("content-length");
             }
-            resolve7(fetch3(new Request2(locationURL, requestOpts)));
+            resolve9(fetch3(new Request2(locationURL, requestOpts)));
             finalize();
             return;
         }
@@ -84851,7 +85315,7 @@ function fetch3(url, opts) {
       const codings = headers.get("Content-Encoding");
       if (!request.compress || request.method === "HEAD" || codings === null || res.statusCode === 204 || res.statusCode === 304) {
         response = new Response2(body, response_options);
-        resolve7(response);
+        resolve9(response);
         return;
       }
       const zlibOptions = {
@@ -84861,7 +85325,7 @@ function fetch3(url, opts) {
       if (codings == "gzip" || codings == "x-gzip") {
         body = body.pipe(zlib.createGunzip(zlibOptions));
         response = new Response2(body, response_options);
-        resolve7(response);
+        resolve9(response);
         return;
       }
       if (codings == "deflate" || codings == "x-deflate") {
@@ -84873,12 +85337,12 @@ function fetch3(url, opts) {
             body = body.pipe(zlib.createInflateRaw());
           }
           response = new Response2(body, response_options);
-          resolve7(response);
+          resolve9(response);
         });
         raw.on("end", function() {
           if (!response) {
             response = new Response2(body, response_options);
-            resolve7(response);
+            resolve9(response);
           }
         });
         return;
@@ -84886,11 +85350,11 @@ function fetch3(url, opts) {
       if (codings == "br" && typeof zlib.createBrotliDecompress === "function") {
         body = body.pipe(zlib.createBrotliDecompress());
         response = new Response2(body, response_options);
-        resolve7(response);
+        resolve9(response);
         return;
       }
       response = new Response2(body, response_options);
-      resolve7(response);
+      resolve9(response);
     });
     writeToStream(req, request);
   });
@@ -85972,8 +86436,8 @@ function _addRequestID(value, response) {
 }
 var APIPromise = class _APIPromise extends Promise {
   constructor(responsePromise, parseResponse2 = defaultParseResponse) {
-    super((resolve7) => {
-      resolve7(null);
+    super((resolve9) => {
+      resolve9(null);
     });
     this.responsePromise = responsePromise;
     this.parseResponse = parseResponse2;
@@ -86548,7 +87012,7 @@ var startsWithSchemeRegexp = /^[a-z][a-z0-9+.-]*:/i;
 var isAbsoluteURL = (url) => {
   return startsWithSchemeRegexp.test(url);
 };
-var sleep = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
+var sleep = (ms) => new Promise((resolve9) => setTimeout(resolve9, ms));
 var validatePositiveInteger = (name, n) => {
   if (typeof n !== "number" || !Number.isInteger(n)) {
     throw new OpenAIError(`${name} must be an integer`);
@@ -87013,12 +87477,12 @@ var EventStream = class {
     _EventStream_errored.set(this, false);
     _EventStream_aborted.set(this, false);
     _EventStream_catchingPromiseCreated.set(this, false);
-    __classPrivateFieldSet4(this, _EventStream_connectedPromise, new Promise((resolve7, reject) => {
-      __classPrivateFieldSet4(this, _EventStream_resolveConnectedPromise, resolve7, "f");
+    __classPrivateFieldSet4(this, _EventStream_connectedPromise, new Promise((resolve9, reject) => {
+      __classPrivateFieldSet4(this, _EventStream_resolveConnectedPromise, resolve9, "f");
       __classPrivateFieldSet4(this, _EventStream_rejectConnectedPromise, reject, "f");
     }), "f");
-    __classPrivateFieldSet4(this, _EventStream_endPromise, new Promise((resolve7, reject) => {
-      __classPrivateFieldSet4(this, _EventStream_resolveEndPromise, resolve7, "f");
+    __classPrivateFieldSet4(this, _EventStream_endPromise, new Promise((resolve9, reject) => {
+      __classPrivateFieldSet4(this, _EventStream_resolveEndPromise, resolve9, "f");
       __classPrivateFieldSet4(this, _EventStream_rejectEndPromise, reject, "f");
     }), "f");
     __classPrivateFieldGet5(this, _EventStream_connectedPromise, "f").catch(() => {
@@ -87102,11 +87566,11 @@ var EventStream = class {
    *   const message = await stream.emitted('message') // rejects if the stream errors
    */
   emitted(event) {
-    return new Promise((resolve7, reject) => {
+    return new Promise((resolve9, reject) => {
       __classPrivateFieldSet4(this, _EventStream_catchingPromiseCreated, true, "f");
       if (event !== "error")
         this.once("error", reject);
-      this.once(event, resolve7);
+      this.once(event, resolve9);
     });
   }
   async done() {
@@ -87259,7 +87723,7 @@ var AssistantStream = class _AssistantStream extends EventStream {
           if (done) {
             return { value: void 0, done: true };
           }
-          return new Promise((resolve7, reject) => readQueue.push({ resolve: resolve7, reject })).then((chunk2) => chunk2 ? { value: chunk2, done: false } : { value: void 0, done: true });
+          return new Promise((resolve9, reject) => readQueue.push({ resolve: resolve9, reject })).then((chunk2) => chunk2 ? { value: chunk2, done: false } : { value: void 0, done: true });
         }
         const chunk = pushQueue.shift();
         return { value: chunk, done: false };
@@ -88899,7 +89363,7 @@ var ChatCompletionStream = class _ChatCompletionStream extends AbstractChatCompl
           if (done) {
             return { value: void 0, done: true };
           }
-          return new Promise((resolve7, reject) => readQueue.push({ resolve: resolve7, reject })).then((chunk2) => chunk2 ? { value: chunk2, done: false } : { value: void 0, done: true });
+          return new Promise((resolve9, reject) => readQueue.push({ resolve: resolve9, reject })).then((chunk2) => chunk2 ? { value: chunk2, done: false } : { value: void 0, done: true });
         }
         const chunk = pushQueue.shift();
         return { value: chunk, done: false };
@@ -90609,7 +91073,7 @@ var ResponseStream = class _ResponseStream extends EventStream {
           if (done) {
             return { value: void 0, done: true };
           }
-          return new Promise((resolve7, reject) => readQueue.push({ resolve: resolve7, reject })).then((event2) => event2 ? { value: event2, done: false } : { value: void 0, done: true });
+          return new Promise((resolve9, reject) => readQueue.push({ resolve: resolve9, reject })).then((event2) => event2 ? { value: event2, done: false } : { value: void 0, done: true });
         }
         const event = pushQueue.shift();
         return { value: event, done: false };
@@ -92060,7 +92524,7 @@ async function faqMine(ctx, options) {
         }))
       };
       if (options.export) {
-        writeFileSync7(options.export, JSON.stringify(rawData, null, 2), "utf-8");
+        writeFileSync9(options.export, JSON.stringify(rawData, null, 2), "utf-8");
         if (outputJson) {
           ctx.output.data({
             success: true,
@@ -92134,7 +92598,7 @@ async function faqMine(ctx, options) {
           generatedAt: c.generatedAt.toISOString()
         }))
       };
-      writeFileSync7(
+      writeFileSync9(
         options.export,
         JSON.stringify(exportData, null, 2),
         "utf-8"
@@ -92197,9 +92661,9 @@ function registerFaqMineCommands(program3) {
 // src/commands/faq/review.ts
 init_esm_shims();
 import { spawnSync } from "child_process";
-import { existsSync as existsSync9, readFileSync as readFileSync6, unlinkSync, writeFileSync as writeFileSync8 } from "fs";
+import { existsSync as existsSync14, readFileSync as readFileSync10, unlinkSync, writeFileSync as writeFileSync10 } from "fs";
 import { tmpdir } from "os";
-import { join as join10 } from "path";
+import { join as join12 } from "path";
 import { confirm as confirm2, select as select2 } from "@inquirer/prompts";
 var COLORS2 = {
   reset: "\x1B[0m",
@@ -92260,7 +92724,7 @@ function getEditor() {
 }
 function editInEditor(ctx, question, answer) {
   const editor = getEditor();
-  const tmpFile = join10(tmpdir(), `faq-edit-${Date.now()}.md`);
+  const tmpFile = join12(tmpdir(), `faq-edit-${Date.now()}.md`);
   const content = `# FAQ Edit
 
 ## Question
@@ -92275,7 +92739,7 @@ Save and close the editor when done.
 The sections are separated by "## Question" and "## Answer" headers.
 -->
 `;
-  writeFileSync8(tmpFile, content, "utf-8");
+  writeFileSync10(tmpFile, content, "utf-8");
   try {
     const result = spawnSync(editor, [tmpFile], {
       stdio: "inherit",
@@ -92285,7 +92749,7 @@ The sections are separated by "## Question" and "## Answer" headers.
       ctx.output.warn(`${COLORS2.red}Editor exited with error${COLORS2.reset}`);
       return null;
     }
-    const edited = readFileSync6(tmpFile, "utf-8");
+    const edited = readFileSync10(tmpFile, "utf-8");
     const questionMatch = edited.match(
       /## Question\s*\n([\s\S]*?)(?=\n## Answer|$)/
     );
@@ -92303,7 +92767,7 @@ The sections are separated by "## Question" and "## Answer" headers.
       answer: editedAnswer
     };
   } finally {
-    if (existsSync9(tmpFile)) {
+    if (existsSync14(tmpFile)) {
       unlinkSync(tmpFile);
     }
   }
@@ -92824,8 +93288,8 @@ var FrontRateLimiter = class {
         )
       );
     }
-    return new Promise((resolve7, reject) => {
-      const item = { resolve: resolve7, reject, signal };
+    return new Promise((resolve9, reject) => {
+      const item = { resolve: resolve9, reject, signal };
       if (signal) {
         const onAbort = () => {
           this.removeFromQueue(item);
@@ -92886,9 +93350,9 @@ var FrontRateLimiter = class {
     return 0;
   }
   sleep(ms, signal) {
-    return new Promise((resolve7, reject) => {
+    return new Promise((resolve9, reject) => {
       if (ms <= 0) {
-        resolve7();
+        resolve9();
         return;
       }
       let settled = false;
@@ -92896,7 +93360,7 @@ var FrontRateLimiter = class {
         if (settled) return;
         settled = true;
         if (signal) signal.removeEventListener("abort", onAbort);
-        resolve7();
+        resolve9();
       };
       const onAbort = () => {
         if (settled) return;
@@ -94498,7 +94962,7 @@ function registerInboxCommand(front) {
 
 // src/commands/front/pull-conversations.ts
 init_esm_shims();
-import { writeFileSync as writeFileSync9 } from "fs";
+import { writeFileSync as writeFileSync11 } from "fs";
 async function pullConversations(ctx, options) {
   const { inbox, limit: limit2 = 50, output, filter: filter4 } = options;
   const outputJson = options.json === true || ctx.format === "json";
@@ -94631,7 +95095,7 @@ Built ${samples.length} eval samples`);
       ctx.output.data(`  ${cat}: ${count}`);
     }
     if (output) {
-      writeFileSync9(output, JSON.stringify(samples, null, 2));
+      writeFileSync11(output, JSON.stringify(samples, null, 2));
       ctx.output.data(`
 Saved to ${output}`);
     } else if (outputJson) {
@@ -95001,7 +95465,7 @@ function truncate2(str2, len) {
   return str2.slice(0, len - 3) + "...";
 }
 function sleep2(ms) {
-  return new Promise((resolve7) => setTimeout(resolve7, ms));
+  return new Promise((resolve9) => setTimeout(resolve9, ms));
 }
 async function getConversationCount(front, tagId) {
   try {
@@ -96486,10 +96950,10 @@ async function promptForName(ctx) {
     input: ctx.stdin,
     output: ctx.stdout
   });
-  return new Promise((resolve7) => {
+  return new Promise((resolve9) => {
     rl.question("App name: ", (answer) => {
       rl.close();
-      resolve7(answer.trim() || "my-app");
+      resolve9(answer.trim() || "my-app");
     });
   });
 }
@@ -97349,7 +97813,7 @@ function registerRunsCommands(inngest) {
 
 // src/commands/inngest/signal.ts
 init_esm_shims();
-import { readFileSync as readFileSync7 } from "fs";
+import { readFileSync as readFileSync11 } from "fs";
 import "commander";
 async function signalCommand(ctx, signal, options) {
   const { data: dataString, dataFile, dev = false } = options;
@@ -97357,7 +97821,7 @@ async function signalCommand(ctx, signal, options) {
   let data2 = null;
   if (dataFile) {
     try {
-      const fileContent = readFileSync7(dataFile, "utf-8");
+      const fileContent = readFileSync11(dataFile, "utf-8");
       data2 = JSON.parse(fileContent);
     } catch (err) {
       const cliError = new CLIError({
@@ -113472,6 +113936,21 @@ init_esm_shims();
 // src/commands/linear/assign.ts
 init_esm_shims();
 
+// src/core/write-gate.ts
+init_esm_shims();
+function requirePersonalKey(keyName) {
+  const provenance = getKeyProvenance(keyName);
+  if (provenance === "user") {
+    return;
+  }
+  throw new CLIError({
+    userMessage: `Write operations require a personal API key for ${keyName}.`,
+    exitCode: EXIT_CODES.auth,
+    suggestion: "Run 'skill config init' to set up your personal keys.",
+    debugMessage: `Key provenance for ${keyName}: ${provenance ?? "undefined"}`
+  });
+}
+
 // src/commands/linear/client.ts
 init_esm_shims();
 import { LinearClient } from "@linear/sdk";
@@ -113490,14 +113969,22 @@ function getLinearClient() {
 // src/commands/linear/hateoas.ts
 init_esm_shims();
 function hateoasWrap2(opts) {
-  return {
+  const response = {
     _type: opts.type,
     _command: opts.command,
     data: opts.data,
     _links: opts.links ?? [],
     _actions: opts.actions ?? []
   };
+  if (opts.meta) {
+    response._meta = opts.meta;
+  }
+  return response;
 }
+var WRITE_ACTION_META = {
+  personal_key_hint: "\u26A0\uFE0F Write operations require a personal LINEAR_API_KEY. Run `skill config init` to set up your keys.",
+  setup_command: "skill config init"
+};
 function issueLinks(identifier, teamKey) {
   const links = [
     {
@@ -113525,43 +114012,51 @@ function issueActions(identifier) {
     {
       action: "comment",
       command: `skill linear comment ${identifier} --body "<text>"`,
-      description: "Add a comment"
+      description: "Add a comment",
+      requires_personal_key: true
     },
     {
       action: "assign",
       command: `skill linear assign ${identifier} --to <user-email>`,
-      description: "Assign this issue"
+      description: "Assign this issue",
+      requires_personal_key: true
     },
     {
       action: "unassign",
       command: `skill linear assign ${identifier} --unassign`,
-      description: "Unassign this issue"
+      description: "Unassign this issue",
+      requires_personal_key: true
     },
     {
       action: "update-state",
       command: `skill linear state ${identifier} --state "<state-name>"`,
-      description: "Change workflow state"
+      description: "Change workflow state",
+      requires_personal_key: true
     },
     {
       action: "update-priority",
       command: `skill linear update ${identifier} --priority <0-4>`,
-      description: "Change priority (0=urgent, 4=none)"
+      description: "Change priority (0=urgent, 4=none)",
+      requires_personal_key: true
     },
     {
       action: "add-label",
       command: `skill linear label ${identifier} --add "<label-name>"`,
-      description: "Add a label"
+      description: "Add a label",
+      requires_personal_key: true
     },
     {
       action: "close",
       command: `skill linear close ${identifier}`,
       description: "Close this issue",
-      destructive: true
+      destructive: true,
+      requires_personal_key: true
     },
     {
       action: "link",
       command: `skill linear link ${identifier} --blocks <other-id>`,
-      description: "Link to another issue"
+      description: "Link to another issue",
+      requires_personal_key: true
     }
   ];
 }
@@ -113585,7 +114080,8 @@ function issueListActions(teamKey) {
     {
       action: "create",
       command: `skill linear create "<title>"${teamKey ? ` --team ${teamKey}` : ""}`,
-      description: "Create a new issue"
+      description: "Create a new issue",
+      requires_personal_key: true
     },
     {
       action: "search",
@@ -113674,6 +114170,7 @@ async function assignIssue(ctx, issueId, options) {
       exitCode: 1
     });
   }
+  requirePersonalKey("LINEAR_API_KEY");
   try {
     const client = getLinearClient();
     const issue = await client.issue(issueId);
@@ -113757,6 +114254,7 @@ async function assignIssue(ctx, issueId, options) {
 // src/commands/linear/close.ts
 init_esm_shims();
 async function closeIssue(ctx, issueId, options = {}) {
+  requirePersonalKey("LINEAR_API_KEY");
   try {
     const client = getLinearClient();
     const issue = await client.issue(issueId);
@@ -113844,6 +114342,7 @@ async function addComment(ctx, issueId, options) {
       exitCode: 1
     });
   }
+  requirePersonalKey("LINEAR_API_KEY");
   try {
     const client = getLinearClient();
     const issue = await client.issue(issueId);
@@ -114033,6 +114532,7 @@ async function createIssue(ctx, title, options = {}) {
       exitCode: 1
     });
   }
+  requirePersonalKey("LINEAR_API_KEY");
   try {
     const client = getLinearClient();
     let teamId;
@@ -114263,7 +114763,8 @@ async function getIssue(ctx, id) {
             command: `skill linear issue ${issue.identifier} --json`,
             data: issueData,
             links: issueLinks(issue.identifier, teamKey),
-            actions: issueActions(issue.identifier)
+            actions: issueActions(issue.identifier),
+            meta: WRITE_ACTION_META
           }),
           null,
           2
@@ -114330,7 +114831,7 @@ async function getIssue(ctx, id) {
       }
     }
     ctx.output.data("");
-    ctx.output.data("   Actions:");
+    ctx.output.data("   Actions (require personal API key):");
     ctx.output.data(
       `     \u2022 Comment:  skill linear comment ${issue.identifier} --body "text"`
     );
@@ -114342,6 +114843,9 @@ async function getIssue(ctx, id) {
     );
     ctx.output.data(`     \u2022 Close:    skill linear close ${issue.identifier}`);
     ctx.output.data("");
+    ctx.output.data("   \u26A0\uFE0F  Write operations require a personal LINEAR_API_KEY.");
+    ctx.output.data("       Run `skill config init` to set up your keys.");
+    ctx.output.data("");
   } catch (error) {
     const cliError = error instanceof CLIError ? error : new CLIError({
       userMessage: "Failed to fetch Linear issue.",
@@ -114365,6 +114869,7 @@ async function modifyLabels(ctx, issueId, options) {
       exitCode: 1
     });
   }
+  requirePersonalKey("LINEAR_API_KEY");
   try {
     const client = getLinearClient();
     const issue = await client.issue(issueId);
@@ -114612,6 +115117,7 @@ async function linkIssues(ctx, issueId, options) {
   }
   const relationship = relationships[0];
   const targetValue = relationship.value;
+  requirePersonalKey("LINEAR_API_KEY");
   try {
     const client = getLinearClient();
     const [issue, targetIssue] = await Promise.all([
@@ -114820,7 +115326,8 @@ async function listIssues(ctx, options = {}) {
               })),
               teamKey
             ),
-            actions: issueListActions(teamKey)
+            actions: issueListActions(teamKey),
+            meta: WRITE_ACTION_META
           }),
           null,
           2
@@ -115184,6 +115691,7 @@ async function changeState(ctx, issueId, options) {
       exitCode: 1
     });
   }
+  requirePersonalKey("LINEAR_API_KEY");
   try {
     const client = getLinearClient();
     const issue = await client.issue(issueId);
@@ -115434,6 +115942,7 @@ async function updateIssue(ctx, issueId, options) {
       exitCode: 1
     });
   }
+  requirePersonalKey("LINEAR_API_KEY");
   try {
     const client = getLinearClient();
     const issue = await client.issue(issueId);
@@ -116264,7 +116773,7 @@ async function deleteMemory(ctx, id, options) {
 }
 
 // src/commands/memory/index.ts
-var buildContext3 = async (command, json) => {
+var buildContext4 = async (command, json) => {
   const opts = typeof command.optsWithGlobals === "function" ? command.optsWithGlobals() : {
     ...command.parent?.opts(),
     ...command.opts()
@@ -116278,42 +116787,42 @@ var buildContext3 = async (command, json) => {
 function registerMemoryCommands(program3) {
   const memory = program3.command("memory").description("Manage semantic memory for agent learning");
   memory.command("store").description("Store a new memory").argument("<content>", "Memory content to store").option("--tags <tags>", "Comma-separated tags").option("--collection <collection>", "Collection name (default: learnings)").option("--app <app>", "App slug to associate with memory").option("--json", "Output as JSON").action(async (content, options, command) => {
-    const ctx = await buildContext3(command, options.json);
+    const ctx = await buildContext4(command, options.json);
     await store(ctx, content, options);
   });
   memory.command("find").description("Search memories by semantic similarity").argument("<query>", "Search query text").option("--limit <number>", "Max results (1-100, default: 10)").option("--collection <collection>", "Collection name (default: learnings)").option("--app <app>", "Filter by app slug").option(
     "--min-confidence <confidence>",
     "Minimum confidence threshold (0-1, default: 0.5)"
   ).option("--json", "Output as JSON").action(async (query, options, command) => {
-    const ctx = await buildContext3(command, options.json);
+    const ctx = await buildContext4(command, options.json);
     await find5(ctx, query, options);
   });
   memory.command("get").description("Get a specific memory by ID").argument("<id>", "Memory ID").option("--collection <collection>", "Collection name (default: learnings)").option("--json", "Output as JSON").action(async (id, options, command) => {
-    const ctx = await buildContext3(command, options.json);
+    const ctx = await buildContext4(command, options.json);
     await get2(ctx, id, options);
   });
   memory.command("validate").description("Validate a memory (resets decay clock)").argument("<id>", "Memory ID").option("--collection <collection>", "Collection name (default: learnings)").option("--json", "Output as JSON").action(async (id, options, command) => {
-    const ctx = await buildContext3(command, options.json);
+    const ctx = await buildContext4(command, options.json);
     await validate2(ctx, id, options);
   });
   memory.command("upvote").description("Upvote a memory").argument("<id>", "Memory ID").option("--collection <collection>", "Collection name (default: learnings)").option("--reason <reason>", "Optional reason for upvote").option("--json", "Output as JSON").action(async (id, options, command) => {
-    const ctx = await buildContext3(command, options.json);
+    const ctx = await buildContext4(command, options.json);
     await upvote(ctx, id, options);
   });
   memory.command("downvote").description("Downvote a memory").argument("<id>", "Memory ID").option("--collection <collection>", "Collection name (default: learnings)").option("--reason <reason>", "Optional reason for downvote").option("--json", "Output as JSON").action(async (id, options, command) => {
-    const ctx = await buildContext3(command, options.json);
+    const ctx = await buildContext4(command, options.json);
     await downvote(ctx, id, options);
   });
   memory.command("delete").description("Delete a memory").argument("<id>", "Memory ID").option("--collection <collection>", "Collection name (default: learnings)").option("--json", "Output as JSON").action(async (id, options, command) => {
-    const ctx = await buildContext3(command, options.json);
+    const ctx = await buildContext4(command, options.json);
     await deleteMemory(ctx, id, options);
   });
   memory.command("stats").description("Display memory statistics").option("--collection <collection>", "Filter by collection").option("--app <app>", "Filter by app slug").option("--json", "Output as JSON").action(async (options, command) => {
-    const ctx = await buildContext3(command, options.json);
+    const ctx = await buildContext4(command, options.json);
     await stats3(ctx, options);
   });
   memory.command("stale").description("List stale memories needing validation").option("--collection <collection>", "Filter by collection").option("--threshold <threshold>", "Confidence threshold (default: 0.25)").option("--json", "Output as JSON").action(async (options, command) => {
-    const ctx = await buildContext3(command, options.json);
+    const ctx = await buildContext4(command, options.json);
     await stale(ctx, options);
   });
 }
@@ -116323,10 +116832,10 @@ init_esm_shims();
 
 // ../core/src/pipeline/evals/classify.eval.ts
 init_esm_shims();
-import { readFile as readFile6, writeFile as writeFile4 } from "fs/promises";
+import { readFile as readFile7, writeFile as writeFile4 } from "fs/promises";
 async function runClassifyEval2(options) {
   const { dataset, output, verbose, json, forceLLM, model } = options;
-  const datasetContent = await readFile6(dataset, "utf-8");
+  const datasetContent = await readFile7(dataset, "utf-8");
   const scenarios = JSON.parse(datasetContent);
   if (!json) {
     console.log(`
@@ -116427,7 +116936,7 @@ Latency: ${(totalDuration / results.length).toFixed(0)}ms avg`
   return summary;
 }
 async function buildClassifyDataset(productionDataPath, outputPath) {
-  const content = await readFile6(productionDataPath, "utf-8");
+  const content = await readFile7(productionDataPath, "utf-8");
   const production = JSON.parse(content);
   const categoryMap = {
     "tool-assisted": "support_access",
@@ -116468,7 +116977,7 @@ async function buildClassifyDataset(productionDataPath, outputPath) {
 
 // ../core/src/pipeline/evals/e2e.eval.ts
 init_esm_shims();
-import { readFile as readFile7, writeFile as writeFile5 } from "fs/promises";
+import { readFile as readFile8, writeFile as writeFile5 } from "fs/promises";
 async function runE2EEval2(options) {
   const {
     dataset,
@@ -116478,7 +116987,7 @@ async function runE2EEval2(options) {
     limit: limit2,
     model = "anthropic/claude-haiku-4-5"
   } = options;
-  const content = await readFile7(dataset, "utf-8");
+  const content = await readFile8(dataset, "utf-8");
   let scenarios = JSON.parse(content);
   if (limit2) {
     scenarios = scenarios.slice(0, limit2);
@@ -116633,7 +117142,7 @@ async function runE2EEval2(options) {
 
 // ../core/src/pipeline/evals/validate.eval.ts
 init_esm_shims();
-import { readFile as readFile8, writeFile as writeFile6 } from "fs/promises";
+import { readFile as readFile9, writeFile as writeFile6 } from "fs/promises";
 var BUILT_IN_SCENARIOS = [
   // Internal leaks
   {
@@ -116765,7 +117274,7 @@ async function runValidateEval2(options) {
   const { dataset, output, verbose, json } = options;
   let scenarios;
   if (dataset) {
-    const content = await readFile8(dataset, "utf-8");
+    const content = await readFile9(dataset, "utf-8");
     scenarios = JSON.parse(content);
   } else {
     scenarios = BUILT_IN_SCENARIOS;
@@ -116872,7 +117381,7 @@ Latency: ${(totalDuration / results.length).toFixed(2)}ms avg`
   return summary;
 }
 async function buildValidateDatasetFromProduction(productionResultsPath, outputPath) {
-  const content = await readFile8(productionResultsPath, "utf-8");
+  const content = await readFile9(productionResultsPath, "utf-8");
   const production = JSON.parse(content);
   const scenarios = production.results.filter((r) => !r.passed && r.productionResponse).map((r, i) => ({
     id: `prod-fail-${i}`,
@@ -116895,7 +117404,7 @@ async function buildValidateDatasetFromProduction(productionResultsPath, outputP
 }
 
 // src/commands/pipeline.ts
-var buildContext4 = async (command, json) => {
+var buildContext5 = async (command, json) => {
   const opts = typeof command.optsWithGlobals === "function" ? command.optsWithGlobals() : {
     ...command.parent?.opts(),
     ...command.opts()
@@ -116966,7 +117475,7 @@ function registerPipelineCommands(program3) {
     "Model for LLM classification",
     "anthropic/claude-haiku-4-5"
   ).action(async (opts, command) => {
-    const ctx = await buildContext4(command, opts.json);
+    const ctx = await buildContext5(command, opts.json);
     try {
       await runClassifyEval2({
         ...opts,
@@ -116977,7 +117486,7 @@ function registerPipelineCommands(program3) {
     }
   });
   pipeline.command("build-classify-dataset").description("Build classify eval dataset from production data").requiredOption("--production <file>", "Production dataset JSON").requiredOption("--output <file>", "Output scenarios JSON").action(async (opts, command) => {
-    const ctx = await buildContext4(command);
+    const ctx = await buildContext5(command);
     try {
       await buildClassifyDataset(opts.production, opts.output);
       ctx.output.success(`Dataset written to ${opts.output}`);
@@ -116989,7 +117498,7 @@ function registerPipelineCommands(program3) {
     "--dataset <file>",
     "Path to scenarios JSON (uses built-in if not provided)"
   ).option("--output <file>", "Save results to JSON").option("--verbose", "Show individual failures").option("--json", "JSON output").action(async (opts, command) => {
-    const ctx = await buildContext4(command, opts.json);
+    const ctx = await buildContext5(command, opts.json);
     try {
       await runValidateEval2({
         ...opts,
@@ -117000,7 +117509,7 @@ function registerPipelineCommands(program3) {
     }
   });
   pipeline.command("build-validate-dataset").description("Build validate eval dataset from production failures").requiredOption("--production <file>", "Production baseline results JSON").requiredOption("--output <file>", "Output scenarios JSON").action(async (opts, command) => {
-    const ctx = await buildContext4(command);
+    const ctx = await buildContext5(command);
     try {
       await buildValidateDatasetFromProduction(opts.production, opts.output);
       ctx.output.success(`Dataset written to ${opts.output}`);
@@ -117013,7 +117522,7 @@ function registerPipelineCommands(program3) {
     "Model for LLM steps",
     "anthropic/claude-haiku-4-5"
   ).action(async (opts, command) => {
-    const ctx = await buildContext4(command, opts.json);
+    const ctx = await buildContext5(command, opts.json);
     try {
       await runE2EEval2({ ...opts, json: opts.json ?? ctx.format === "json" });
     } catch (error) {
@@ -117021,44 +117530,24 @@ function registerPipelineCommands(program3) {
     }
   });
   pipeline.command("run").description("Run pipeline on a single message").requiredOption("--subject <text>", "Message subject").requiredOption("--body <text>", "Message body").option("--app <id>", "App ID", "total-typescript").option("--dry-run", "Don't actually send", true).option("--json", "JSON output").action(async (opts, command) => {
-    const ctx = await buildContext4(command, opts.json);
+    const ctx = await buildContext5(command, opts.json);
     await runPipelineCommand(ctx, opts);
   });
 }
 
 // src/commands/plugin-sync.ts
 init_esm_shims();
-import { homedir } from "os";
-import { dirname as dirname3, join as join11, resolve as resolve5 } from "path";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname4, join as join13, resolve as resolve6 } from "path";
 import { fileURLToPath } from "url";
-
-// src/core/fs-extra.ts
-init_esm_shims();
-import { existsSync as existsSync10 } from "fs";
-import { cp, mkdir, readFile as readFile9 } from "fs/promises";
-async function ensureDir(path) {
-  await mkdir(path, { recursive: true });
-}
-async function pathExists(path) {
-  return existsSync10(path);
-}
-async function readJson(path) {
-  const contents2 = await readFile9(path, "utf-8");
-  return JSON.parse(contents2);
-}
-async function copy(src, dest) {
-  await cp(src, dest, { recursive: true, force: true });
-}
-
-// src/commands/plugin-sync.ts
-var PLUGIN_SOURCE_DIR = resolve5(
-  dirname3(fileURLToPath(import.meta.url)),
+var PLUGIN_SOURCE_DIR = resolve6(
+  dirname4(fileURLToPath(import.meta.url)),
   "../../plugin"
 );
-var PLUGIN_MANIFEST_RELATIVE = join11(".claude-plugin", "plugin.json");
+var PLUGIN_MANIFEST_RELATIVE = join13(".claude-plugin", "plugin.json");
 var resolveTargetDir = (global2) => {
-  const base = join11(homedir(), ".claude", global2 ? "skills" : "plugins");
-  return join11(base, "skill-cli");
+  const base = join13(homedir3(), ".claude", global2 ? "skills" : "plugins");
+  return join13(base, "skill-cli");
 };
 var readManifest = async (path) => {
   const manifest = await readJson(path);
@@ -117087,7 +117576,7 @@ var writeResult4 = (ctx, payload) => {
 };
 async function executePluginSync(ctx, options) {
   try {
-    const sourceManifestPath = join11(PLUGIN_SOURCE_DIR, PLUGIN_MANIFEST_RELATIVE);
+    const sourceManifestPath = join13(PLUGIN_SOURCE_DIR, PLUGIN_MANIFEST_RELATIVE);
     const sourceExists = await pathExists(sourceManifestPath);
     if (!sourceExists) {
       throw new CLIError({
@@ -117097,7 +117586,7 @@ async function executePluginSync(ctx, options) {
     }
     const sourceManifest = await readManifest(sourceManifestPath);
     const targetDir = resolveTargetDir(options.global);
-    const targetManifestPath = join11(targetDir, PLUGIN_MANIFEST_RELATIVE);
+    const targetManifestPath = join13(targetDir, PLUGIN_MANIFEST_RELATIVE);
     const targetExists = await pathExists(targetManifestPath);
     if (targetExists && !options.force) {
       const targetManifest = await readManifest(targetManifestPath);
@@ -117158,7 +117647,7 @@ var registerPluginSyncCommand = (program3) => {
 
 // src/commands/responses.ts
 init_esm_shims();
-import { writeFileSync as writeFileSync10 } from "fs";
+import { writeFileSync as writeFileSync12 } from "fs";
 function formatDate3(date) {
   return date.toLocaleString("en-US", {
     month: "short",
@@ -117691,7 +118180,7 @@ async function exportResponses(ctx, options) {
     }
     const outputJson = JSON.stringify(exportData, null, 2);
     if (options.output) {
-      writeFileSync10(options.output, outputJson, "utf-8");
+      writeFileSync12(options.output, outputJson, "utf-8");
       if (!outputJsonFormat) {
         ctx.output.success(
           `Exported ${exportData.length} responses to ${options.output}`
@@ -118339,8 +118828,8 @@ async function wizard(ctx, options = {}) {
 init_esm_shims();
 import { spawn } from "child_process";
 import { writeFile as writeFile7 } from "fs/promises";
-import { homedir as homedir2 } from "os";
-import { dirname as dirname4, join as join12 } from "path";
+import { homedir as homedir4 } from "os";
+import { dirname as dirname5, join as join14 } from "path";
 var CONFIG_DIR_NAME = "skill-cli";
 var AUTO_UPDATE_STATE_FILE = "auto-update.json";
 var DEFAULT_PACKAGE = "@skillrecordings/cli";
@@ -118352,7 +118841,7 @@ var AutoUpdateStore = class {
   now;
   constructor(options = {}) {
     const configDir = resolveConfigDir(options.configDir);
-    this.filePath = join12(configDir, AUTO_UPDATE_STATE_FILE);
+    this.filePath = join14(configDir, AUTO_UPDATE_STATE_FILE);
     this.now = options.now ?? (() => /* @__PURE__ */ new Date());
   }
   getNow() {
@@ -118370,7 +118859,7 @@ var AutoUpdateStore = class {
   }
   async save(state) {
     try {
-      await ensureDir(dirname4(this.filePath));
+      await ensureDir(dirname5(this.filePath));
       await writeFile7(this.filePath, JSON.stringify(state, null, 2), "utf-8");
     } catch {
     }
@@ -118380,9 +118869,9 @@ function resolveConfigDir(configDir) {
   if (configDir) return configDir;
   const xdgConfigHome = process.env.XDG_CONFIG_HOME;
   if (xdgConfigHome && xdgConfigHome.trim() !== "") {
-    return join12(xdgConfigHome, CONFIG_DIR_NAME);
+    return join14(xdgConfigHome, CONFIG_DIR_NAME);
   }
-  return join12(homedir2(), ".config", CONFIG_DIR_NAME);
+  return join14(homedir4(), ".config", CONFIG_DIR_NAME);
 }
 function isAutoUpdateState(value) {
   if (!value || typeof value !== "object") return false;
@@ -118500,16 +118989,16 @@ async function performUpdate(options = {}) {
   const packageManager = resolvePackageManager(options.userAgent);
   const spawnFn = options.spawnFn ?? spawn;
   const [command, args] = packageManager === "bun" ? ["bun", ["add", "-g", packageName]] : ["npm", ["install", "-g", packageName]];
-  const exitCode = await new Promise((resolve7) => {
+  const exitCode = await new Promise((resolve9) => {
     try {
       const child = spawnFn(command, args, {
         stdio: "ignore",
         env: process.env
       });
-      child.on("error", () => resolve7(1));
-      child.on("close", (code) => resolve7(code ?? 1));
+      child.on("error", () => resolve9(1));
+      child.on("close", (code) => resolve9(code ?? 1));
     } catch {
-      resolve7(1);
+      resolve9(1);
     }
   });
   if (exitCode === 0) {
@@ -118674,6 +119163,72 @@ var writeHints = (hints, stderr) => {
   }
 };
 
+// src/core/skill-link.ts
+init_esm_shims();
+import { lstat, readlink, symlink } from "fs/promises";
+import { homedir as homedir5 } from "os";
+import { dirname as dirname6, join as join15, resolve as resolve7 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+var SKILL_SOURCE_DIR = resolve7(
+  dirname6(fileURLToPath2(import.meta.url)),
+  "../../../../.claude/skills/skill-cli"
+);
+var SKILL_TARGET_DIR = join15(homedir5(), ".claude", "skills", "skill-cli");
+async function autoLinkSkill() {
+  const source = SKILL_SOURCE_DIR;
+  const target = SKILL_TARGET_DIR;
+  try {
+    let stats4;
+    try {
+      stats4 = await lstat(target);
+    } catch (e) {
+      if (e.code === "ENOENT") {
+        const { mkdir: mkdir2 } = await import("fs/promises");
+        await mkdir2(dirname6(target), { recursive: true });
+        await symlink(source, target, "dir");
+        return {
+          status: "linked",
+          source,
+          target,
+          message: `Linked skill-cli to ${target}`
+        };
+      }
+      throw e;
+    }
+    if (stats4.isSymbolicLink()) {
+      const linkTarget = await readlink(target);
+      const resolvedLinkTarget = resolve7(dirname6(target), linkTarget);
+      if (resolvedLinkTarget === source || linkTarget === source) {
+        return {
+          status: "exists",
+          source,
+          target,
+          message: "Skill already linked"
+        };
+      }
+      return {
+        status: "conflict",
+        source,
+        target,
+        message: `Conflict: ${target} is a symlink to ${linkTarget}`
+      };
+    }
+    return {
+      status: "conflict",
+      source,
+      target,
+      message: `Conflict: ${target} already exists`
+    };
+  } catch (error) {
+    return {
+      status: "error",
+      source,
+      target,
+      message: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+
 // src/core/telemetry.ts
 init_esm_shims();
 import { Axiom as Axiom2 } from "@axiomhq/js";
@@ -118721,17 +119276,17 @@ async function sendTelemetryEvent(event) {
 // src/core/usage-tracker.ts
 init_esm_shims();
 import { writeFile as writeFile8 } from "fs/promises";
-import { homedir as homedir3 } from "os";
-import { dirname as dirname5, join as join13 } from "path";
+import { homedir as homedir6 } from "os";
+import { dirname as dirname7, join as join16 } from "path";
 var CONFIG_DIR_NAME2 = "skill-cli";
 var USAGE_FILE_NAME = "usage.json";
 function resolveConfigDir2(configDir) {
   if (configDir) return configDir;
   const xdgConfigHome = process.env.XDG_CONFIG_HOME;
   if (xdgConfigHome && xdgConfigHome.trim() !== "") {
-    return join13(xdgConfigHome, CONFIG_DIR_NAME2);
+    return join16(xdgConfigHome, CONFIG_DIR_NAME2);
   }
-  return join13(homedir3(), ".config", CONFIG_DIR_NAME2);
+  return join16(homedir6(), ".config", CONFIG_DIR_NAME2);
 }
 function createDefaultState(now) {
   return {
@@ -118769,7 +119324,7 @@ var UsageTracker = class {
   statePromise;
   constructor(options = {}) {
     const configDir = resolveConfigDir2(options.configDir);
-    this.filePath = join13(configDir, USAGE_FILE_NAME);
+    this.filePath = join16(configDir, USAGE_FILE_NAME);
     this.now = options.now ?? (() => /* @__PURE__ */ new Date());
   }
   async loadState() {
@@ -118792,7 +119347,7 @@ var UsageTracker = class {
   }
   async saveState(state) {
     try {
-      await ensureDir(dirname5(this.filePath));
+      await ensureDir(dirname7(this.filePath));
       await writeFile8(this.filePath, JSON.stringify(state, null, 2), "utf-8");
     } catch {
     }
@@ -119087,14 +119642,14 @@ async function createToolContext() {
   return ctx;
 }
 function captureOutput(stream) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve9) => {
     let buffer = "";
     stream.on("data", (chunk) => {
       buffer += chunk.toString();
     });
-    stream.on("end", () => resolve7(buffer));
-    stream.on("close", () => resolve7(buffer));
-    stream.on("finish", () => resolve7(buffer));
+    stream.on("end", () => resolve9(buffer));
+    stream.on("close", () => resolve9(buffer));
+    stream.on("finish", () => resolve9(buffer));
   });
 }
 function parseJsonOutput(stdout) {
@@ -119326,33 +119881,21 @@ function createMcpServer(options = {}) {
     const onSigterm = () => stop();
     process.once("SIGTERM", onSigterm);
     removeSigterm = () => process.off("SIGTERM", onSigterm);
-    return new Promise((resolve7) => {
-      resolveStop = resolve7;
+    return new Promise((resolve9) => {
+      resolveStop = resolve9;
     });
   };
   return { start, stop };
 }
 
 // src/index.ts
+var cliRoot = resolve8(import.meta.dirname, "..");
+var plaintextEnv = loadPlaintextEnv(cliRoot);
 var envLoaded = false;
-var cliRoot = resolve6(import.meta.dirname, "../..");
-for (const envFile of [".env.local", ".env"]) {
-  try {
-    const content = readFileSync8(resolve6(cliRoot, envFile), "utf8");
-    for (const line of content.split("\n")) {
-      const trimmed = line.trim();
-      if (!trimmed || trimmed.startsWith("#")) continue;
-      const eqIdx = trimmed.indexOf("=");
-      if (eqIdx === -1) continue;
-      const key = trimmed.slice(0, eqIdx).trim();
-      const raw = trimmed.slice(eqIdx + 1).trim();
-      const value = raw.replace(/^["'](.*)["']$/, "$1");
-      if (!process.env[key]) {
-        process.env[key] = value;
-      }
-    }
+for (const [key, value] of Object.entries(plaintextEnv)) {
+  if (!process.env[key]) {
+    process.env[key] = value;
     envLoaded = true;
-  } catch {
   }
 }
 if (!envLoaded && !process.env.DATABASE_URL) {
@@ -119578,6 +120121,7 @@ registerFaqCommands(program2);
 registerDeployCommands(program2);
 registerKbCommands(program2);
 registerAuthCommands(program2, usageState);
+registerConfigCommands(program2);
 registerPluginSyncCommand(program2);
 program2.command("mcp").description(
   "Start MCP server for AI coding agent integration.\n  Exposes 9 Front tools over JSON-RPC stdio for Claude Code, Cursor, etc.\n  Tools: inbox, conversation, message, assign, reply, tag, archive, search, report\n  Usage: skill mcp  (then connect your AI editor to stdin/stdout)"
@@ -119585,6 +120129,7 @@ program2.command("mcp").description(
   const server = createMcpServer();
   await server.start();
 });
+void autoLinkSkill();
 program2.parseAsync().finally(async () => {
   const { closeDb: closeDb2 } = await import("./src-6OB6UR3N.js");
   await closeDb2();