@try-works/dsh-righthand 0.1.1 → 0.1.2

package/lib/index.d.ts

@@ -5,8 +5,9 @@
  * the harness's own services (storageDomain, credentials, settings,
  * subprocess, jobs, tools), not hand-rolled primitives.
  *
- * The package's plugin entry (name/inject/apply) mounts the four tool
- * modules as child fibers; each child waits on its own services, so a
+ * The package's plugin entry (name/inject/apply) mounts the tool families
+ * and the packaged skill as child fibers; each child waits on its own
+ * services, so a
  * profile without `storageDomain` (e.g. headless) simply gets the other
  * seven tools instead of failing the boot.
  *
@@ -15,6 +16,7 @@
  * - secrets-tools:   rh_credential_describe/set/unset + rh_settings_get/set
  * - exec-tools:      rh_run / rh_run_bg over ctx.subprocess + ctx.jobs
  * - guard-tools:     tools/pre-execute policy (config.rules)
+ * - skills:          the packaged dsh-righthand skill (ctx.skills)
  *
  * @module @try-works/dsh-righthand
  */
@@ -23,6 +25,7 @@ import * as storeTools from './store-tools.ts';
 import * as secretsTools from './secrets-tools.ts';
 import * as execTools from './exec-tools.ts';
 import * as guardTools from './guard-tools.ts';
+import * as righthandSkills from './skills.ts';
 import type { GuardRule } from './guard-tools.ts';
 export declare const name = "dsh-righthand";
 /** The combined plugin needs no services itself; each child waits on its own. */
@@ -39,6 +42,7 @@ export interface RighthandConfig {
  * instead of failing the whole plugin.
  */
 export declare function apply(ctx: Context, config?: RighthandConfig): void;
-export { storeTools, secretsTools, execTools, guardTools };
+export { storeTools, secretsTools, execTools, guardTools, righthandSkills };
+export { SKILL_NAME, SKILL_DESCRIPTION, skillDirectory, skillBody } from './skills.ts';
 export type { GuardRule } from './guard-tools.ts';
 //# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,UAAU,MAAM,kBAAkB,CAAA;AAC9C,OAAO,KAAK,YAAY,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,SAAS,MAAM,iBAAiB,CAAA;AAC5C,OAAO,KAAK,UAAU,MAAM,kBAAkB,CAAA;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAEjD,eAAO,MAAM,IAAI,kBAAkB,CAAA;AAEnC,iFAAiF;AACjF,eAAO,MAAM,MAAM,EAAE,MAAM,EAAO,CAAA;AAElC,qCAAqC;AACrC,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,KAAK,CAAC,EAAE,SAAS,EAAE,CAAA;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,eAAoB,GAAG,IAAI,CAKtE;AAGD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;AAC1D,YAAY,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,UAAU,MAAM,kBAAkB,CAAA;AAC9C,OAAO,KAAK,YAAY,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,SAAS,MAAM,iBAAiB,CAAA;AAC5C,OAAO,KAAK,UAAU,MAAM,kBAAkB,CAAA;AAC9C,OAAO,KAAK,eAAe,MAAM,aAAa,CAAA;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAEjD,eAAO,MAAM,IAAI,kBAAkB,CAAA;AAEnC,iFAAiF;AACjF,eAAO,MAAM,MAAM,EAAE,MAAM,EAAO,CAAA;AAElC,qCAAqC;AACrC,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,KAAK,CAAC,EAAE,SAAS,EAAE,CAAA;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,eAAoB,GAAG,IAAI,CAMtE;AAGD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,eAAe,EAAE,CAAA;AAC3E,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACtF,YAAY,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA"}

package/lib/index.js

@@ -5,8 +5,9 @@
  * the harness's own services (storageDomain, credentials, settings,
  * subprocess, jobs, tools), not hand-rolled primitives.
  *
- * The package's plugin entry (name/inject/apply) mounts the four tool
- * modules as child fibers; each child waits on its own services, so a
+ * The package's plugin entry (name/inject/apply) mounts the tool families
+ * and the packaged skill as child fibers; each child waits on its own
+ * services, so a
  * profile without `storageDomain` (e.g. headless) simply gets the other
  * seven tools instead of failing the boot.
  *
@@ -15,6 +16,7 @@
  * - secrets-tools:   rh_credential_describe/set/unset + rh_settings_get/set
  * - exec-tools:      rh_run / rh_run_bg over ctx.subprocess + ctx.jobs
  * - guard-tools:     tools/pre-execute policy (config.rules)
+ * - skills:          the packaged dsh-righthand skill (ctx.skills)
  *
  * @module @try-works/dsh-righthand
  */
@@ -22,6 +24,7 @@ import * as storeTools from "./store-tools.js";
 import * as secretsTools from "./secrets-tools.js";
 import * as execTools from "./exec-tools.js";
 import * as guardTools from "./guard-tools.js";
+import * as righthandSkills from "./skills.js";
 export const name = 'dsh-righthand';
 /** The combined plugin needs no services itself; each child waits on its own. */
 export const inject = [];
@@ -36,7 +39,9 @@ export function apply(ctx, config = {}) {
     ctx.plugin(secretsTools);
     ctx.plugin(execTools);
     ctx.plugin(guardTools, { rules: config.rules ?? [] });
+    ctx.plugin(righthandSkills);
 }
 // Individual modules stay importable for selective mounting.
-export { storeTools, secretsTools, execTools, guardTools };
+export { storeTools, secretsTools, execTools, guardTools, righthandSkills };
+export { SKILL_NAME, SKILL_DESCRIPTION, skillDirectory, skillBody } from "./skills.js";
 //# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,UAAU,MAAM,kBAAkB,CAAA;AAC9C,OAAO,KAAK,YAAY,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,SAAS,MAAM,iBAAiB,CAAA;AAC5C,OAAO,KAAK,UAAU,MAAM,kBAAkB,CAAA;AAG9C,MAAM,CAAC,MAAM,IAAI,GAAG,eAAe,CAAA;AAEnC,iFAAiF;AACjF,MAAM,CAAC,MAAM,MAAM,GAAa,EAAE,CAAA;AAQlC;;;;;GAKG;AACH,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,SAA0B,EAAE;IAC9D,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACtB,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;IACxB,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IACrB,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAA;AACvD,CAAC;AAED,6DAA6D;AAC7D,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,KAAK,UAAU,MAAM,kBAAkB,CAAA;AAC9C,OAAO,KAAK,YAAY,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,SAAS,MAAM,iBAAiB,CAAA;AAC5C,OAAO,KAAK,UAAU,MAAM,kBAAkB,CAAA;AAC9C,OAAO,KAAK,eAAe,MAAM,aAAa,CAAA;AAG9C,MAAM,CAAC,MAAM,IAAI,GAAG,eAAe,CAAA;AAEnC,iFAAiF;AACjF,MAAM,CAAC,MAAM,MAAM,GAAa,EAAE,CAAA;AAQlC;;;;;GAKG;AACH,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,SAA0B,EAAE;IAC9D,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACtB,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;IACxB,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IACrB,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAA;IACrD,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;AAC7B,CAAC;AAED,6DAA6D;AAC7D,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,eAAe,EAAE,CAAA;AAC3E,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA"}

package/lib/skills.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The bundled dsh-righthand skill registration.
+ *
+ * Lives at `skills/dsh-righthand/SKILL.md` and registers with a directory
+ * `resourceBase` pointing at the bundled copy, so any relative references
+ * inside the SKILL.md resolve against the package's own files (the
+ * dsh-plugin packaged-skill standard, same shape as dsh-anti-slop).
+ *
+ * @module @try-works/dsh-righthand/src/skills
+ */
+import type { Context } from '@deepseek-ai/cordis';
+export declare const name = "righthand-skills";
+export declare const inject: string[];
+export declare const SKILL_NAME = "dsh-righthand";
+/** Routing description shown by skill discovery (matches the SKILL.md frontmatter). */
+export declare const SKILL_DESCRIPTION = "Use when a task needs the righthand toolkit \u2014 durable key-value storage (rh_store_*), credential and settings management (rh_credential_* / rh_settings_*), governed command execution (rh_run / rh_run_bg), or its tool guard policy. Covers tool reference, guard semantics, and service availability.";
+/** The bundled skill directory (this module lives in the bundle at lib/skills.js). */
+export declare function skillDirectory(): string;
+/** The skill body: SKILL.md verbatim from the bundled skill directory. */
+export declare function skillBody(): string;
+/** Register the packaged skill. Returns the cordis effect disposer. */
+export declare function apply(ctx: Context): void;
+//# sourceMappingURL=skills.d.ts.map

package/lib/skills.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills.d.ts","sourceRoot":"","sources":["../src/skills.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAMlD,eAAO,MAAM,IAAI,qBAAqB,CAAA;AACtC,eAAO,MAAM,MAAM,UAAa,CAAA;AAEhC,eAAO,MAAM,UAAU,kBAAkB,CAAA;AAEzC,uFAAuF;AACvF,eAAO,MAAM,iBAAiB,kTAA6S,CAAA;AAE3U,sFAAsF;AACtF,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,0EAA0E;AAC1E,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED,uEAAuE;AACvE,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAQxC"}

package/lib/skills.js

@@ -0,0 +1,37 @@
+/**
+ * The bundled dsh-righthand skill registration.
+ *
+ * Lives at `skills/dsh-righthand/SKILL.md` and registers with a directory
+ * `resourceBase` pointing at the bundled copy, so any relative references
+ * inside the SKILL.md resolve against the package's own files (the
+ * dsh-plugin packaged-skill standard, same shape as dsh-anti-slop).
+ *
+ * @module @try-works/dsh-righthand/src/skills
+ */
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+export const name = 'righthand-skills';
+export const inject = ['skills'];
+export const SKILL_NAME = 'dsh-righthand';
+/** Routing description shown by skill discovery (matches the SKILL.md frontmatter). */
+export const SKILL_DESCRIPTION = 'Use when a task needs the righthand toolkit — durable key-value storage (rh_store_*), credential and settings management (rh_credential_* / rh_settings_*), governed command execution (rh_run / rh_run_bg), or its tool guard policy. Covers tool reference, guard semantics, and service availability.';
+/** The bundled skill directory (this module lives in the bundle at lib/skills.js). */
+export function skillDirectory() {
+    return join(dirname(fileURLToPath(import.meta.url)), '..', `skills/${SKILL_NAME}`);
+}
+/** The skill body: SKILL.md verbatim from the bundled skill directory. */
+export function skillBody() {
+    return readFileSync(join(skillDirectory(), 'SKILL.md'), 'utf8');
+}
+/** Register the packaged skill. Returns the cordis effect disposer. */
+export function apply(ctx) {
+    ctx.skills.register({
+        name: SKILL_NAME,
+        description: SKILL_DESCRIPTION,
+        source: 'bundled',
+        content: skillBody(),
+        resourceBase: { kind: 'directory', path: skillDirectory() },
+    });
+}
+//# sourceMappingURL=skills.js.map

package/lib/skills.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills.js","sourceRoot":"","sources":["../src/skills.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAItC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAExC,MAAM,CAAC,MAAM,IAAI,GAAG,kBAAkB,CAAA;AACtC,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAA;AAEhC,MAAM,CAAC,MAAM,UAAU,GAAG,eAAe,CAAA;AAEzC,uFAAuF;AACvF,MAAM,CAAC,MAAM,iBAAiB,GAAG,0SAA0S,CAAA;AAE3U,sFAAsF;AACtF,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,UAAU,EAAE,CAAC,CAAA;AACpF,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,SAAS;IACvB,OAAO,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAA;AACjE,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,KAAK,CAAC,GAAY;IAChC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC;QAClB,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,iBAAiB;QAC9B,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,SAAS,EAAE;QACpB,YAAY,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE;KAC5D,CAAC,CAAA;AACJ,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@try-works/dsh-righthand",
   "description": "DeepSeek Harness plugin: DSH-native righthand tools — durable KV store, credential/settings management, governed exec, and a tool guard",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -28,7 +28,8 @@
     "@deepseek-ai/dsh-settings": "^0.1.0-rc.5",
     "@deepseek-ai/dsh-subprocess": "^0.1.0-rc.5",
     "@deepseek-ai/dsh-jobs": "^0.1.0-rc.5",
-    "@deepseek-ai/schemastery": "^3.18.1"
+    "@deepseek-ai/schemastery": "^3.18.1",
+    "@deepseek-ai/dsh-skill": "^0.1.0-rc.5"
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "file:D:/deepseek-harness/vendor/cordis",
@@ -72,6 +73,7 @@
   "files": [
     "lib",
     "src",
+    "skills",
     "cordis.patch.yml",
     "README.md",
     "LICENSE"

package/skills/dsh-righthand/SKILL.md

@@ -0,0 +1,47 @@
+---
+name: dsh-righthand
+description: Use when a task needs the righthand toolkit — durable key-value storage (rh_store_*), credential and settings management (rh_credential_* / rh_settings_*), governed command execution (rh_run / rh_run_bg), or its tool guard policy. Covers tool reference, guard semantics, and service availability.
+---
+
+# dsh-righthand
+
+The righthand toolkit: DSH-native tools over the harness's own services. Use this skill as the **tool reference** when any `rh_*` tool applies.
+
+## Tool families
+
+| Family | Tools | Backing service | Use when |
+|--------|-------|-----------------|----------|
+| store | `rh_store_put` / `rh_store_get` / `rh_store_delete` / `rh_store_list` | `ctx.storageDomain` (domain KV) | The task needs durable state across turns: a catalog, counter, cache, or note. Prefer this over files for structured JSON records. |
+| secrets | `rh_credential_describe` / `rh_credential_set` / `rh_credential_unset` | `ctx.credentials` | The task must check, store, or remove a credential reference (e.g. `CLOUDFLARE_API_TOKEN`). Values are written durably and **never echoed back**. |
+| settings | `rh_settings_get` / `rh_settings_set` | `ctx.settings` (namespace `righthand`) | Reading or patching righthand settings (`accountId`, `defaultZone`, `defaultScriptPrefix`). |
+| exec | `rh_run` / `rh_run_bg` | `ctx.subprocess` + `ctx.jobs` | Running one command (argv array, no shell interpretation). `rh_run` collects bounded output; `rh_run_bg` starts an owner-scoped background job and returns its id. |
+| guard | (policy, not a tool) | `ctx.tools` `tools/pre-execute` | Configured via plugin config `rules`; gates tools by name prefix with `allow` / `deny` / `ask` modes. |
+
+## Store semantics
+
+- One domain `righthand_store`: a `rows` table (string key → JSON value + timestamp) and a global write counter.
+- `rh_store_get` returns `{ found, key, value?, updatedAt? }` — `found: false` means the key is absent, not an error.
+- Writes are durable (backend flush before commit) and serialized on one write chain; values must be JSON-serializable.
+
+## Credential semantics
+
+- `rh_credential_describe` reports `configured`, `source`, `writable` — never the value.
+- `rh_credential_set` requires a non-empty value and returns only `{ ref, stored: true }`.
+- References are POSIX env-var style names (uppercase, e.g. `CLOUDFLARE_API_TOKEN`).
+
+## Settings namespace `righthand`
+
+| Key | Default | Meaning |
+|-----|---------|---------|
+| `accountId` | `""` | Cloudflare account id used by righthand Cloudflare tools |
+| `defaultScriptPrefix` | `"rh-"` | default name prefix for generated workers/scripts |
+| `defaultZone` | `""` | default Cloudflare zone |
+
+## Guard policy
+
+Rules come from the plugin config (`rules: [{ toolPrefix, mode, ask? }]`). `deny` throws before dispatch; `ask` defers to the policy function (return true to allow); `allow` passes through. Tools matching no rule are unaffected.
+
+## Service availability
+
+- **web profile**: all twelve tools register (`storageDomain` is provided by the web app rows).
+- **other profiles** (e.g. headless): the store family stays dormant; the other seven tools still register. The plugin never fails the boot.

package/src/index.ts

@@ -5,8 +5,9 @@
  * the harness's own services (storageDomain, credentials, settings,
  * subprocess, jobs, tools), not hand-rolled primitives.
  *
- * The package's plugin entry (name/inject/apply) mounts the four tool
- * modules as child fibers; each child waits on its own services, so a
+ * The package's plugin entry (name/inject/apply) mounts the tool families
+ * and the packaged skill as child fibers; each child waits on its own
+ * services, so a
  * profile without `storageDomain` (e.g. headless) simply gets the other
  * seven tools instead of failing the boot.
  *
@@ -15,6 +16,7 @@
  * - secrets-tools:   rh_credential_describe/set/unset + rh_settings_get/set
  * - exec-tools:      rh_run / rh_run_bg over ctx.subprocess + ctx.jobs
  * - guard-tools:     tools/pre-execute policy (config.rules)
+ * - skills:          the packaged dsh-righthand skill (ctx.skills)
  *
  * @module @try-works/dsh-righthand
  */
@@ -24,6 +26,7 @@ import * as storeTools from './store-tools.ts'
 import * as secretsTools from './secrets-tools.ts'
 import * as execTools from './exec-tools.ts'
 import * as guardTools from './guard-tools.ts'
+import * as righthandSkills from './skills.ts'
 import type { GuardRule } from './guard-tools.ts'
 
 export const name = 'dsh-righthand'
@@ -48,9 +51,11 @@ export function apply(ctx: Context, config: RighthandConfig = {}): void {
   ctx.plugin(secretsTools)
   ctx.plugin(execTools)
   ctx.plugin(guardTools, { rules: config.rules ?? [] })
+  ctx.plugin(righthandSkills)
 }
 
 // Individual modules stay importable for selective mounting.
-export { storeTools, secretsTools, execTools, guardTools }
+export { storeTools, secretsTools, execTools, guardTools, righthandSkills }
+export { SKILL_NAME, SKILL_DESCRIPTION, skillDirectory, skillBody } from './skills.ts'
 export type { GuardRule } from './guard-tools.ts'
 

package/src/skills.ts

@@ -0,0 +1,47 @@
+/**
+ * The bundled dsh-righthand skill registration.
+ *
+ * Lives at `skills/dsh-righthand/SKILL.md` and registers with a directory
+ * `resourceBase` pointing at the bundled copy, so any relative references
+ * inside the SKILL.md resolve against the package's own files (the
+ * dsh-plugin packaged-skill standard, same shape as dsh-anti-slop).
+ *
+ * @module @try-works/dsh-righthand/src/skills
+ */
+
+import { readFileSync } from 'node:fs'
+import type { Context } from '@deepseek-ai/cordis'
+// Type-only import activates the cordis Context augmentation for `ctx.skills`.
+import type {} from '@deepseek-ai/dsh-skill'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+export const name = 'righthand-skills'
+export const inject = ['skills']
+
+export const SKILL_NAME = 'dsh-righthand'
+
+/** Routing description shown by skill discovery (matches the SKILL.md frontmatter). */
+export const SKILL_DESCRIPTION = 'Use when a task needs the righthand toolkit — durable key-value storage (rh_store_*), credential and settings management (rh_credential_* / rh_settings_*), governed command execution (rh_run / rh_run_bg), or its tool guard policy. Covers tool reference, guard semantics, and service availability.'
+
+/** The bundled skill directory (this module lives in the bundle at lib/skills.js). */
+export function skillDirectory(): string {
+  return join(dirname(fileURLToPath(import.meta.url)), '..', `skills/${SKILL_NAME}`)
+}
+
+/** The skill body: SKILL.md verbatim from the bundled skill directory. */
+export function skillBody(): string {
+  return readFileSync(join(skillDirectory(), 'SKILL.md'), 'utf8')
+}
+
+/** Register the packaged skill. Returns the cordis effect disposer. */
+export function apply(ctx: Context): void {
+  ctx.skills.register({
+    name: SKILL_NAME,
+    description: SKILL_DESCRIPTION,
+    source: 'bundled',
+    content: skillBody(),
+    resourceBase: { kind: 'directory', path: skillDirectory() },
+  })
+}
+