@try-works/dsh-righthand 0.1.1 → 0.1.3

package/README.md

@@ -6,6 +6,8 @@ tool guard. Every tool is built on the harness's own services
 (`storageDomain`, `credentials`, `settings`, `subprocess`, `jobs`, `tools`),
 not hand-rolled primitives.
 
+The plugin also ships **blueprint guidance** — ten named recipes for the agent-built tools this plugin exists to compose (see [Blueprints](#blueprints) below) — plus a packaged skill, a settings namespace, and an optional tool guard.
+
 ## Install
 
 ```bash
@@ -46,6 +48,13 @@ dsh --profile <profile> --patch ./cordis.patch.yml
 Guard modes: `allow` (pass through), `deny` (block with an error), `ask`
 (defer to the policy function). Omitted rules leave the guard inert.
 
+Rules may also declare `destructive: true` — a documentation flag for
+irreversible effects (deploy, delete, DNS change). It does not change
+enforcement; it records *why* the prefix is gated, and
+`tests/permissions.golden` records every `rh_*` tool's derived guard facts so
+guard changes are never silent (run `UPDATE_GOLDEN=1 pnpm test` to
+re-baseline deliberately).
+
 ## Settings
 
 Namespace "righthand" (registered by the secrets family):
@@ -59,6 +68,73 @@ Namespace "righthand" (registered by the secrets family):
 `rh_settings_get` returns the resolved values; `rh_settings_set` merges a
 partial patch (persisted by the harness settings provider).
 
+## Blueprints
+
+Blueprint guidance lives under `experiments/<blueprint>/` — each a
+`blueprint.json` spec plus a runnable template kit (`run.ts` + `test.ts`,
+`LEARNINGS.md`, and for the cloud-tested ones a `cloud/` Worker). They
+describe the tools this plugin composes; the daily-digest kit is the
+canonical example of the current DSH-native form (tool-to-tool via
+`ctx.tools.execute`, synthesis via `ctx.llm`, deliverables via `ctx.fs`).
+
+| Blueprint | What it builds |
+|---|---|
+| `blueprint/daily-digest` | Collect sources, summarize, send on a schedule — extractive locally, LLM synthesis as escalation |
+| `blueprint/research-radar` | Multi-source research over a rolling window (Reddit, X, YouTube, HN, Polymarket, web): score, dedupe, synthesize with citations |
+| `blueprint/web-scraper` | Fetch a page, extract title/headings/links/text, make it searchable — static HTML first, render/vision as escalation |
+| `blueprint/vision-worker` | Cloudflare Worker exposing kimi-k2.6 vision: route image requests for text-only models, return a versioned `VisionEnvelope` |
+| `blueprint/vision-qa-assistant` | Answer questions about images for a text-only model — hash-cache locally, Workers AI vision as the semantic path |
+| `blueprint/inbound-webhook-pipeline` | Receive → validate → run job → store → notify, with idempotency-key dedupe as the load-bearing invariant |
+| `blueprint/event-sourced-store` | Tool store where every mutation is an event: govern, checksum, append offset-addressable events, catch up by version |
+| `blueprint/governed-registry` | Register a tool format; every write runs the governed flow: validate → normalize → checksum → index → summarize |
+| `blueprint/mcp-tool-surface` | Deterministic + AI-backed tools behind a stateless MCP surface with normalized LLM output |
+| `blueprint/session-watcher` | Poll DSH sessions, evaluate a condition (new publish / builder idle / cadence), message a target session |
+
+Analyses of the [micro.mu](https://github.com/micro/mu) project this plugin
+learns from: [`docs/agent-tool-catalog.md`](docs/agent-tool-catalog.md) (tool
+families worth adding, from the tools catalogue + permission commit) and
+[`docs/mu-repo-analysis.md`](docs/mu-repo-analysis.md) (architecture lessons
+from the whole repo — single-source specs, golden permissions, layering,
+held-state gates, SSRF guarding).
+
+## Packaged skill
+
+The plugin ships the `dsh-righthand` skill
+(`skills/dsh-righthand/SKILL.md`, the dsh-plugin packaged-skill standard):
+tool-reference tables, store/credential/settings semantics, guard modes, and
+service availability. It registers via `ctx.skills` on mount, so the agent's
+skill catalog lists it automatically.
+
+## Use cases
+
+Everything below runs through the harness's own services; nothing is
+hand-rolled.
+
+**Durable agent memory / task board.** Store task cards under `task:<slug>`
+and let `rh_store_list` enumerate them across restarts and context
+compaction — no project files touched. Complete by overwriting, clean up
+with `rh_store_delete`.
+
+**Pre-deploy gate.** Before any deploy: `rh_credential_describe` asserts the
+API token exists, `rh_settings_get` asserts the account/zone, `rh_run` runs
+tests + build, `rh_store_put` records a deploy receipt, and a guard rule
+gates the actual deploy tool behind `mode: 'ask'`.
+
+**Secret onboarding.** `rh_credential_set` stores a key through the
+credential provider (the value is never echoed back); `rh_credential_describe`
+reports configured state + source; rotation is unset-then-set.
+
+**Daily digests.** The agent fetches sources and stores them under
+`digest:<date>` (see `blueprint/daily-digest`), diffing days with
+`rh_store_get` and rendering MDX deliverables through `ctx.fs`.
+
+**CI-lite.** `rh_run_bg` starts a long build as an owner-scoped background
+job; its id + status live in the store so a later turn can poll and collect.
+
+**Governed exec.** Any high-impact command can be fronted by a guard rule
+(`deny` to block a prefix, `ask` to require a policy function's approval),
+so the agent cannot deploy or destroy without the gate.
+
 ## Service availability
 
 The store family needs `ctx.storageDomain`, which the web profile provides

package/lib/guard-tools.d.ts

@@ -3,6 +3,14 @@
  * Demonstrates the §4.4 allow/deny/ask gate the righthand plugin uses to
  * gate high-impact deploy/invoke tools. Built on ctx.on('tools/pre-execute'),
  * not a hand-rolled wrapper.
+ *
+ * Rules are prefix-based. A rule may also declare `destructive: true` — a
+ * pure documentation flag saying the gated tools have irreversible effects
+ * (deploy, delete, DNS change): the kind of surface a tool *description*
+ * (attacker-controlled text) could talk the agent into. The flag does not
+ * change enforcement — `mode` does — it records WHY the prefix is guarded,
+ * and `tests/permissions.golden` records it so guard changes are never
+ * silent.
  * @module dsh-righthand/guard-tools
  */
 import type { Context } from '@deepseek-ai/cordis';
@@ -13,9 +21,30 @@ export interface GuardRule {
     toolPrefix: string;
     /** 'allow' passes through; 'deny' blocks; 'ask' defers to a policy function. */
     mode: 'allow' | 'deny' | 'ask';
+    /**
+     * Documentation flag: the gated tools have irreversible effects nobody
+     * asked for (a deploy, a delete, a DNS change). Declarative only —
+     * enforcement is the rule's `mode`. Default false.
+     */
+    destructive?: boolean;
     /** Only consulted when mode is 'ask'. Return true to allow. */
     ask?: (args: unknown) => boolean;
 }
+/**
+ * The guard facts a tool name resolves to: the mode the first matching rule
+ * enforces (or 'none' when no rule matches) and whether that rule marks the
+ * prefix destructive. This is the SINGLE lookup both the enforcement hook
+ * and the permissions golden use, so the recorded facts cannot drift from
+ * what the gate actually does.
+ */
+export interface GuardFacts {
+    mode: 'allow' | 'deny' | 'ask' | 'none';
+    destructive: boolean;
+    /** The matched rule, when one matched — the enforcement hook's ask path needs it. */
+    rule: GuardRule | undefined;
+}
+/** Resolve one tool name to its guard facts. Rules match in order, first wins. */
+export declare function guardFactsFor(toolName: string, rules: readonly GuardRule[]): GuardFacts;
 /** Apply a guard over a set of tool-name prefixes. */
 export declare function apply(ctx: Context, config?: {
     rules?: GuardRule[];

package/lib/guard-tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guard-tools.d.ts","sourceRoot":"","sources":["../src/guard-tools.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAElD,eAAO,MAAM,IAAI,oBAAoB,CAAA;AACrC,eAAO,MAAM,MAAM,UAAY,CAAA;AAE/B,MAAM,WAAW,SAAS;IACxB,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAA;IAClB,gFAAgF;IAChF,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,CAAA;IAC9B,+DAA+D;IAC/D,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAA;CACjC;AAED,sDAAsD;AACtD,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE;IAAE,KAAK,CAAC,EAAE,SAAS,EAAE,CAAA;CAAO,GAAG,IAAI,CAgB9E"}
+{"version":3,"file":"guard-tools.d.ts","sourceRoot":"","sources":["../src/guard-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAElD,eAAO,MAAM,IAAI,oBAAoB,CAAA;AACrC,eAAO,MAAM,MAAM,UAAY,CAAA;AAE/B,MAAM,WAAW,SAAS;IACxB,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAA;IAClB,gFAAgF;IAChF,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,CAAA;IAC9B;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,+DAA+D;IAC/D,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAA;CACjC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,CAAA;IACvC,WAAW,EAAE,OAAO,CAAA;IACpB,qFAAqF;IACrF,IAAI,EAAE,SAAS,GAAG,SAAS,CAAA;CAC5B;AAED,kFAAkF;AAClF,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,SAAS,EAAE,GAAG,UAAU,CAIvF;AAED,sDAAsD;AACtD,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE;IAAE,KAAK,CAAC,EAAE,SAAS,EAAE,CAAA;CAAO,GAAG,IAAI,CAa9E"}

package/lib/guard-tools.js

@@ -3,26 +3,38 @@
  * Demonstrates the §4.4 allow/deny/ask gate the righthand plugin uses to
  * gate high-impact deploy/invoke tools. Built on ctx.on('tools/pre-execute'),
  * not a hand-rolled wrapper.
+ *
+ * Rules are prefix-based. A rule may also declare `destructive: true` — a
+ * pure documentation flag saying the gated tools have irreversible effects
+ * (deploy, delete, DNS change): the kind of surface a tool *description*
+ * (attacker-controlled text) could talk the agent into. The flag does not
+ * change enforcement — `mode` does — it records WHY the prefix is guarded,
+ * and `tests/permissions.golden` records it so guard changes are never
+ * silent.
  * @module dsh-righthand/guard-tools
  */
 export const name = 'righthand-guard';
 export const inject = ['tools'];
+/** Resolve one tool name to its guard facts. Rules match in order, first wins. */
+export function guardFactsFor(toolName, rules) {
+    const rule = rules.find(r => toolName.startsWith(r.toolPrefix));
+    if (rule === undefined)
+        return { mode: 'none', destructive: false, rule: undefined };
+    return { mode: rule.mode, destructive: rule.destructive === true, rule };
+}
 /** Apply a guard over a set of tool-name prefixes. */
 export function apply(ctx, config = {}) {
     const rules = config.rules ?? [];
     ctx.on('tools/pre-execute', (exec, next) => {
-        const rule = rules.find(r => exec.name.startsWith(r.toolPrefix));
-        if (rule === undefined)
+        const facts = guardFactsFor(exec.name, rules);
+        if (facts.mode === 'none' || facts.mode === 'allow')
             return next();
-        if (rule.mode === 'deny') {
+        if (facts.mode === 'deny') {
             throw new Error(`tool ${exec.name} is denied by righthand guard`);
         }
-        if (rule.mode === 'ask') {
-            const allowed = rule.ask?.(exec.arguments) ?? false;
-            if (!allowed)
-                throw new Error(`tool ${exec.name} requires approval (ask returned false)`);
-            return next();
-        }
+        const allowed = facts.rule?.ask?.(exec.arguments) ?? false;
+        if (!allowed)
+            throw new Error(`tool ${exec.name} requires approval (ask returned false)`);
         return next();
     }, { prepend: true });
 }

package/lib/guard-tools.js.map

@@ -1 +1 @@
-{"version":3,"file":"guard-tools.js","sourceRoot":"","sources":["../src/guard-tools.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,CAAC,MAAM,IAAI,GAAG,iBAAiB,CAAA;AACrC,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,CAAA;AAW/B,sDAAsD;AACtD,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,SAAkC,EAAE;IACtE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAA;IAEhC,GAAG,CAAC,EAAE,CAAC,mBAAmB,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAA;QAChE,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,EAAE,CAAA;QACrC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,IAAI,+BAA+B,CAAC,CAAA;QACnE,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,CAAA;YACnD,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,IAAI,yCAAyC,CAAC,CAAA;YACzF,OAAO,IAAI,EAAE,CAAA;QACf,CAAC;QACD,OAAO,IAAI,EAAE,CAAA;IACf,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;AACvB,CAAC"}
+{"version":3,"file":"guard-tools.js","sourceRoot":"","sources":["../src/guard-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,MAAM,CAAC,MAAM,IAAI,GAAG,iBAAiB,CAAA;AACrC,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,CAAA;AA+B/B,kFAAkF;AAClF,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,KAA2B;IACzE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAA;IAC/D,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IACpF,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,KAAK,IAAI,EAAE,IAAI,EAAE,CAAA;AAC1E,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,SAAkC,EAAE;IACtE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAA;IAEhC,GAAG,CAAC,EAAE,CAAC,mBAAmB,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;QACzC,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAC7C,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,IAAI,EAAE,CAAA;QAClE,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,IAAI,+BAA+B,CAAC,CAAA;QACnE,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,CAAA;QAC1D,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,IAAI,yCAAyC,CAAC,CAAA;QACzF,OAAO,IAAI,EAAE,CAAA;IACf,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;AACvB,CAAC"}

package/lib/index.d.ts

@@ -5,8 +5,9 @@
  * the harness's own services (storageDomain, credentials, settings,
  * subprocess, jobs, tools), not hand-rolled primitives.
  *
- * The package's plugin entry (name/inject/apply) mounts the four tool
- * modules as child fibers; each child waits on its own services, so a
+ * The package's plugin entry (name/inject/apply) mounts the tool families
+ * and the packaged skill as child fibers; each child waits on its own
+ * services, so a
  * profile without `storageDomain` (e.g. headless) simply gets the other
  * seven tools instead of failing the boot.
  *
@@ -15,6 +16,7 @@
  * - secrets-tools:   rh_credential_describe/set/unset + rh_settings_get/set
  * - exec-tools:      rh_run / rh_run_bg over ctx.subprocess + ctx.jobs
  * - guard-tools:     tools/pre-execute policy (config.rules)
+ * - skills:          the packaged dsh-righthand skill (ctx.skills)
  *
  * @module @try-works/dsh-righthand
  */
@@ -23,6 +25,7 @@ import * as storeTools from './store-tools.ts';
 import * as secretsTools from './secrets-tools.ts';
 import * as execTools from './exec-tools.ts';
 import * as guardTools from './guard-tools.ts';
+import * as righthandSkills from './skills.ts';
 import type { GuardRule } from './guard-tools.ts';
 export declare const name = "dsh-righthand";
 /** The combined plugin needs no services itself; each child waits on its own. */
@@ -39,6 +42,9 @@ export interface RighthandConfig {
  * instead of failing the whole plugin.
  */
 export declare function apply(ctx: Context, config?: RighthandConfig): void;
-export { storeTools, secretsTools, execTools, guardTools };
+export { storeTools, secretsTools, execTools, guardTools, righthandSkills };
+export { SKILL_NAME, SKILL_DESCRIPTION, skillDirectory, skillBody } from './skills.ts';
 export type { GuardRule } from './guard-tools.ts';
+export { guardFactsFor } from './guard-tools.ts';
+export type { GuardFacts } from './guard-tools.ts';
 //# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,UAAU,MAAM,kBAAkB,CAAA;AAC9C,OAAO,KAAK,YAAY,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,SAAS,MAAM,iBAAiB,CAAA;AAC5C,OAAO,KAAK,UAAU,MAAM,kBAAkB,CAAA;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAEjD,eAAO,MAAM,IAAI,kBAAkB,CAAA;AAEnC,iFAAiF;AACjF,eAAO,MAAM,MAAM,EAAE,MAAM,EAAO,CAAA;AAElC,qCAAqC;AACrC,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,KAAK,CAAC,EAAE,SAAS,EAAE,CAAA;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,eAAoB,GAAG,IAAI,CAKtE;AAGD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;AAC1D,YAAY,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,UAAU,MAAM,kBAAkB,CAAA;AAC9C,OAAO,KAAK,YAAY,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,SAAS,MAAM,iBAAiB,CAAA;AAC5C,OAAO,KAAK,UAAU,MAAM,kBAAkB,CAAA;AAC9C,OAAO,KAAK,eAAe,MAAM,aAAa,CAAA;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAEjD,eAAO,MAAM,IAAI,kBAAkB,CAAA;AAEnC,iFAAiF;AACjF,eAAO,MAAM,MAAM,EAAE,MAAM,EAAO,CAAA;AAElC,qCAAqC;AACrC,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,KAAK,CAAC,EAAE,SAAS,EAAE,CAAA;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,eAAoB,GAAG,IAAI,CAMtE;AAGD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,eAAe,EAAE,CAAA;AAC3E,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACtF,YAAY,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAChD,YAAY,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA"}

package/lib/index.js

@@ -5,8 +5,9 @@
  * the harness's own services (storageDomain, credentials, settings,
  * subprocess, jobs, tools), not hand-rolled primitives.
  *
- * The package's plugin entry (name/inject/apply) mounts the four tool
- * modules as child fibers; each child waits on its own services, so a
+ * The package's plugin entry (name/inject/apply) mounts the tool families
+ * and the packaged skill as child fibers; each child waits on its own
+ * services, so a
  * profile without `storageDomain` (e.g. headless) simply gets the other
  * seven tools instead of failing the boot.
  *
@@ -15,6 +16,7 @@
  * - secrets-tools:   rh_credential_describe/set/unset + rh_settings_get/set
  * - exec-tools:      rh_run / rh_run_bg over ctx.subprocess + ctx.jobs
  * - guard-tools:     tools/pre-execute policy (config.rules)
+ * - skills:          the packaged dsh-righthand skill (ctx.skills)
  *
  * @module @try-works/dsh-righthand
  */
@@ -22,6 +24,7 @@ import * as storeTools from "./store-tools.js";
 import * as secretsTools from "./secrets-tools.js";
 import * as execTools from "./exec-tools.js";
 import * as guardTools from "./guard-tools.js";
+import * as righthandSkills from "./skills.js";
 export const name = 'dsh-righthand';
 /** The combined plugin needs no services itself; each child waits on its own. */
 export const inject = [];
@@ -36,7 +39,10 @@ export function apply(ctx, config = {}) {
     ctx.plugin(secretsTools);
     ctx.plugin(execTools);
     ctx.plugin(guardTools, { rules: config.rules ?? [] });
+    ctx.plugin(righthandSkills);
 }
 // Individual modules stay importable for selective mounting.
-export { storeTools, secretsTools, execTools, guardTools };
+export { storeTools, secretsTools, execTools, guardTools, righthandSkills };
+export { SKILL_NAME, SKILL_DESCRIPTION, skillDirectory, skillBody } from "./skills.js";
+export { guardFactsFor } from "./guard-tools.js";
 //# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,UAAU,MAAM,kBAAkB,CAAA;AAC9C,OAAO,KAAK,YAAY,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,SAAS,MAAM,iBAAiB,CAAA;AAC5C,OAAO,KAAK,UAAU,MAAM,kBAAkB,CAAA;AAG9C,MAAM,CAAC,MAAM,IAAI,GAAG,eAAe,CAAA;AAEnC,iFAAiF;AACjF,MAAM,CAAC,MAAM,MAAM,GAAa,EAAE,CAAA;AAQlC;;;;;GAKG;AACH,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,SAA0B,EAAE;IAC9D,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACtB,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;IACxB,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IACrB,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAA;AACvD,CAAC;AAED,6DAA6D;AAC7D,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,KAAK,UAAU,MAAM,kBAAkB,CAAA;AAC9C,OAAO,KAAK,YAAY,MAAM,oBAAoB,CAAA;AAClD,OAAO,KAAK,SAAS,MAAM,iBAAiB,CAAA;AAC5C,OAAO,KAAK,UAAU,MAAM,kBAAkB,CAAA;AAC9C,OAAO,KAAK,eAAe,MAAM,aAAa,CAAA;AAG9C,MAAM,CAAC,MAAM,IAAI,GAAG,eAAe,CAAA;AAEnC,iFAAiF;AACjF,MAAM,CAAC,MAAM,MAAM,GAAa,EAAE,CAAA;AAQlC;;;;;GAKG;AACH,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,SAA0B,EAAE;IAC9D,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACtB,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;IACxB,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IACrB,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAA;IACrD,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;AAC7B,CAAC;AAED,6DAA6D;AAC7D,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,eAAe,EAAE,CAAA;AAC3E,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAEtF,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA"}

package/lib/skills.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The bundled dsh-righthand skill registration.
+ *
+ * Lives at `skills/dsh-righthand/SKILL.md` and registers with a directory
+ * `resourceBase` pointing at the bundled copy, so any relative references
+ * inside the SKILL.md resolve against the package's own files (the
+ * dsh-plugin packaged-skill standard, same shape as dsh-anti-slop).
+ *
+ * @module @try-works/dsh-righthand/src/skills
+ */
+import type { Context } from '@deepseek-ai/cordis';
+export declare const name = "righthand-skills";
+export declare const inject: string[];
+export declare const SKILL_NAME = "dsh-righthand";
+/** Routing description shown by skill discovery (matches the SKILL.md frontmatter). */
+export declare const SKILL_DESCRIPTION = "Use when a task needs the righthand toolkit \u2014 durable key-value storage (rh_store_*), credential and settings management (rh_credential_* / rh_settings_*), governed command execution (rh_run / rh_run_bg), or its tool guard policy. Covers tool reference, guard semantics, and service availability.";
+/** The bundled skill directory (this module lives in the bundle at lib/skills.js). */
+export declare function skillDirectory(): string;
+/** The skill body: SKILL.md verbatim from the bundled skill directory. */
+export declare function skillBody(): string;
+/** Register the packaged skill. Returns the cordis effect disposer. */
+export declare function apply(ctx: Context): void;
+//# sourceMappingURL=skills.d.ts.map

package/lib/skills.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills.d.ts","sourceRoot":"","sources":["../src/skills.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAMlD,eAAO,MAAM,IAAI,qBAAqB,CAAA;AACtC,eAAO,MAAM,MAAM,UAAa,CAAA;AAEhC,eAAO,MAAM,UAAU,kBAAkB,CAAA;AAEzC,uFAAuF;AACvF,eAAO,MAAM,iBAAiB,kTAA6S,CAAA;AAE3U,sFAAsF;AACtF,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,0EAA0E;AAC1E,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED,uEAAuE;AACvE,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAQxC"}

package/lib/skills.js

@@ -0,0 +1,37 @@
+/**
+ * The bundled dsh-righthand skill registration.
+ *
+ * Lives at `skills/dsh-righthand/SKILL.md` and registers with a directory
+ * `resourceBase` pointing at the bundled copy, so any relative references
+ * inside the SKILL.md resolve against the package's own files (the
+ * dsh-plugin packaged-skill standard, same shape as dsh-anti-slop).
+ *
+ * @module @try-works/dsh-righthand/src/skills
+ */
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+export const name = 'righthand-skills';
+export const inject = ['skills'];
+export const SKILL_NAME = 'dsh-righthand';
+/** Routing description shown by skill discovery (matches the SKILL.md frontmatter). */
+export const SKILL_DESCRIPTION = 'Use when a task needs the righthand toolkit — durable key-value storage (rh_store_*), credential and settings management (rh_credential_* / rh_settings_*), governed command execution (rh_run / rh_run_bg), or its tool guard policy. Covers tool reference, guard semantics, and service availability.';
+/** The bundled skill directory (this module lives in the bundle at lib/skills.js). */
+export function skillDirectory() {
+    return join(dirname(fileURLToPath(import.meta.url)), '..', `skills/${SKILL_NAME}`);
+}
+/** The skill body: SKILL.md verbatim from the bundled skill directory. */
+export function skillBody() {
+    return readFileSync(join(skillDirectory(), 'SKILL.md'), 'utf8');
+}
+/** Register the packaged skill. Returns the cordis effect disposer. */
+export function apply(ctx) {
+    ctx.skills.register({
+        name: SKILL_NAME,
+        description: SKILL_DESCRIPTION,
+        source: 'bundled',
+        content: skillBody(),
+        resourceBase: { kind: 'directory', path: skillDirectory() },
+    });
+}
+//# sourceMappingURL=skills.js.map

package/lib/skills.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills.js","sourceRoot":"","sources":["../src/skills.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAItC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAExC,MAAM,CAAC,MAAM,IAAI,GAAG,kBAAkB,CAAA;AACtC,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAA;AAEhC,MAAM,CAAC,MAAM,UAAU,GAAG,eAAe,CAAA;AAEzC,uFAAuF;AACvF,MAAM,CAAC,MAAM,iBAAiB,GAAG,0SAA0S,CAAA;AAE3U,sFAAsF;AACtF,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,UAAU,EAAE,CAAC,CAAA;AACpF,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,SAAS;IACvB,OAAO,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAA;AACjE,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,KAAK,CAAC,GAAY;IAChC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC;QAClB,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,iBAAiB;QAC9B,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,SAAS,EAAE;QACpB,YAAY,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE;KAC5D,CAAC,CAAA;AACJ,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@try-works/dsh-righthand",
   "description": "DeepSeek Harness plugin: DSH-native righthand tools — durable KV store, credential/settings management, governed exec, and a tool guard",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -28,7 +28,8 @@
     "@deepseek-ai/dsh-settings": "^0.1.0-rc.5",
     "@deepseek-ai/dsh-subprocess": "^0.1.0-rc.5",
     "@deepseek-ai/dsh-jobs": "^0.1.0-rc.5",
-    "@deepseek-ai/schemastery": "^3.18.1"
+    "@deepseek-ai/schemastery": "^3.18.1",
+    "@deepseek-ai/dsh-skill": "^0.1.0-rc.5"
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "file:D:/deepseek-harness/vendor/cordis",
@@ -72,6 +73,7 @@
   "files": [
     "lib",
     "src",
+    "skills",
     "cordis.patch.yml",
     "README.md",
     "LICENSE"

package/skills/dsh-righthand/SKILL.md

@@ -0,0 +1,49 @@
+---
+name: dsh-righthand
+description: Use when a task needs the righthand toolkit — durable key-value storage (rh_store_*), credential and settings management (rh_credential_* / rh_settings_*), governed command execution (rh_run / rh_run_bg), or its tool guard policy. Covers tool reference, guard semantics, and service availability.
+---
+
+# dsh-righthand
+
+The righthand toolkit: DSH-native tools over the harness's own services. Use this skill as the **tool reference** when any `rh_*` tool applies.
+
+## Tool families
+
+| Family | Tools | Backing service | Use when |
+|--------|-------|-----------------|----------|
+| store | `rh_store_put` / `rh_store_get` / `rh_store_delete` / `rh_store_list` | `ctx.storageDomain` (domain KV) | The task needs durable state across turns: a catalog, counter, cache, or note. Prefer this over files for structured JSON records. |
+| secrets | `rh_credential_describe` / `rh_credential_set` / `rh_credential_unset` | `ctx.credentials` | The task must check, store, or remove a credential reference (e.g. `CLOUDFLARE_API_TOKEN`). Values are written durably and **never echoed back**. |
+| settings | `rh_settings_get` / `rh_settings_set` | `ctx.settings` (namespace `righthand`) | Reading or patching righthand settings (`accountId`, `defaultZone`, `defaultScriptPrefix`). |
+| exec | `rh_run` / `rh_run_bg` | `ctx.subprocess` + `ctx.jobs` | Running one command (argv array, no shell interpretation). `rh_run` collects bounded output; `rh_run_bg` starts an owner-scoped background job and returns its id. |
+| guard | (policy, not a tool) | `ctx.tools` `tools/pre-execute` | Configured via plugin config `rules`; gates tools by name prefix with `allow` / `deny` / `ask` modes. |
+
+## Store semantics
+
+- One domain `righthand_store`: a `rows` table (string key → JSON value + timestamp) and a global write counter.
+- `rh_store_get` returns `{ found, key, value?, updatedAt? }` — `found: false` means the key is absent, not an error.
+- Writes are durable (backend flush before commit) and serialized on one write chain; values must be JSON-serializable.
+
+## Credential semantics
+
+- `rh_credential_describe` reports `configured`, `source`, `writable` — never the value.
+- `rh_credential_set` requires a non-empty value and returns only `{ ref, stored: true }`.
+- References are POSIX env-var style names (uppercase, e.g. `CLOUDFLARE_API_TOKEN`).
+
+## Settings namespace `righthand`
+
+| Key | Default | Meaning |
+|-----|---------|---------|
+| `accountId` | `""` | Cloudflare account id used by righthand Cloudflare tools |
+| `defaultScriptPrefix` | `"rh-"` | default name prefix for generated workers/scripts |
+| `defaultZone` | `""` | default Cloudflare zone |
+
+## Guard policy
+
+Rules come from the plugin config (`rules: [{ toolPrefix, mode, ask?, destructive? }]`). `deny` throws before dispatch; `ask` defers to the policy function (return true to allow); `allow` passes through. Tools matching no rule are unaffected. Prefixes match by prefix — `rh_run` also covers `rh_run_bg`.
+
+`destructive: true` is a documentation flag for irreversible effects (deploy, delete, DNS change); it never changes enforcement, only records why a prefix is gated. `tests/permissions.golden` records every tool's derived guard facts; a guard change that moves a fact fails the test until re-baselined (`UPDATE_GOLDEN=1 pnpm test`).
+
+## Service availability
+
+- **web profile**: all twelve tools register (`storageDomain` is provided by the web app rows).
+- **other profiles** (e.g. headless): the store family stays dormant; the other seven tools still register. The plugin never fails the boot.

package/src/guard-tools.ts

@@ -3,6 +3,14 @@
  * Demonstrates the §4.4 allow/deny/ask gate the righthand plugin uses to
  * gate high-impact deploy/invoke tools. Built on ctx.on('tools/pre-execute'),
  * not a hand-rolled wrapper.
+ *
+ * Rules are prefix-based. A rule may also declare `destructive: true` — a
+ * pure documentation flag saying the gated tools have irreversible effects
+ * (deploy, delete, DNS change): the kind of surface a tool *description*
+ * (attacker-controlled text) could talk the agent into. The flag does not
+ * change enforcement — `mode` does — it records WHY the prefix is guarded,
+ * and `tests/permissions.golden` records it so guard changes are never
+ * silent.
  * @module dsh-righthand/guard-tools
  */
 
@@ -16,25 +24,49 @@ export interface GuardRule {
   toolPrefix: string
   /** 'allow' passes through; 'deny' blocks; 'ask' defers to a policy function. */
   mode: 'allow' | 'deny' | 'ask'
+  /**
+   * Documentation flag: the gated tools have irreversible effects nobody
+   * asked for (a deploy, a delete, a DNS change). Declarative only —
+   * enforcement is the rule's `mode`. Default false.
+   */
+  destructive?: boolean
   /** Only consulted when mode is 'ask'. Return true to allow. */
   ask?: (args: unknown) => boolean
 }
 
+/**
+ * The guard facts a tool name resolves to: the mode the first matching rule
+ * enforces (or 'none' when no rule matches) and whether that rule marks the
+ * prefix destructive. This is the SINGLE lookup both the enforcement hook
+ * and the permissions golden use, so the recorded facts cannot drift from
+ * what the gate actually does.
+ */
+export interface GuardFacts {
+  mode: 'allow' | 'deny' | 'ask' | 'none'
+  destructive: boolean
+  /** The matched rule, when one matched — the enforcement hook's ask path needs it. */
+  rule: GuardRule | undefined
+}
+
+/** Resolve one tool name to its guard facts. Rules match in order, first wins. */
+export function guardFactsFor(toolName: string, rules: readonly GuardRule[]): GuardFacts {
+  const rule = rules.find(r => toolName.startsWith(r.toolPrefix))
+  if (rule === undefined) return { mode: 'none', destructive: false, rule: undefined }
+  return { mode: rule.mode, destructive: rule.destructive === true, rule }
+}
+
 /** Apply a guard over a set of tool-name prefixes. */
 export function apply(ctx: Context, config: { rules?: GuardRule[] } = {}): void {
   const rules = config.rules ?? []
 
   ctx.on('tools/pre-execute', (exec, next) => {
-    const rule = rules.find(r => exec.name.startsWith(r.toolPrefix))
-    if (rule === undefined) return next()
-    if (rule.mode === 'deny') {
+    const facts = guardFactsFor(exec.name, rules)
+    if (facts.mode === 'none' || facts.mode === 'allow') return next()
+    if (facts.mode === 'deny') {
       throw new Error(`tool ${exec.name} is denied by righthand guard`)
     }
-    if (rule.mode === 'ask') {
-      const allowed = rule.ask?.(exec.arguments) ?? false
-      if (!allowed) throw new Error(`tool ${exec.name} requires approval (ask returned false)`)
-      return next()
-    }
+    const allowed = facts.rule?.ask?.(exec.arguments) ?? false
+    if (!allowed) throw new Error(`tool ${exec.name} requires approval (ask returned false)`)
     return next()
   }, { prepend: true })
-}
+}

package/src/index.ts

@@ -5,8 +5,9 @@
  * the harness's own services (storageDomain, credentials, settings,
  * subprocess, jobs, tools), not hand-rolled primitives.
  *
- * The package's plugin entry (name/inject/apply) mounts the four tool
- * modules as child fibers; each child waits on its own services, so a
+ * The package's plugin entry (name/inject/apply) mounts the tool families
+ * and the packaged skill as child fibers; each child waits on its own
+ * services, so a
  * profile without `storageDomain` (e.g. headless) simply gets the other
  * seven tools instead of failing the boot.
  *
@@ -15,6 +16,7 @@
  * - secrets-tools:   rh_credential_describe/set/unset + rh_settings_get/set
  * - exec-tools:      rh_run / rh_run_bg over ctx.subprocess + ctx.jobs
  * - guard-tools:     tools/pre-execute policy (config.rules)
+ * - skills:          the packaged dsh-righthand skill (ctx.skills)
  *
  * @module @try-works/dsh-righthand
  */
@@ -24,6 +26,7 @@ import * as storeTools from './store-tools.ts'
 import * as secretsTools from './secrets-tools.ts'
 import * as execTools from './exec-tools.ts'
 import * as guardTools from './guard-tools.ts'
+import * as righthandSkills from './skills.ts'
 import type { GuardRule } from './guard-tools.ts'
 
 export const name = 'dsh-righthand'
@@ -48,9 +51,13 @@ export function apply(ctx: Context, config: RighthandConfig = {}): void {
   ctx.plugin(secretsTools)
   ctx.plugin(execTools)
   ctx.plugin(guardTools, { rules: config.rules ?? [] })
+  ctx.plugin(righthandSkills)
 }
 
 // Individual modules stay importable for selective mounting.
-export { storeTools, secretsTools, execTools, guardTools }
+export { storeTools, secretsTools, execTools, guardTools, righthandSkills }
+export { SKILL_NAME, SKILL_DESCRIPTION, skillDirectory, skillBody } from './skills.ts'
 export type { GuardRule } from './guard-tools.ts'
+export { guardFactsFor } from './guard-tools.ts'
+export type { GuardFacts } from './guard-tools.ts'
 

package/src/skills.ts

@@ -0,0 +1,47 @@
+/**
+ * The bundled dsh-righthand skill registration.
+ *
+ * Lives at `skills/dsh-righthand/SKILL.md` and registers with a directory
+ * `resourceBase` pointing at the bundled copy, so any relative references
+ * inside the SKILL.md resolve against the package's own files (the
+ * dsh-plugin packaged-skill standard, same shape as dsh-anti-slop).
+ *
+ * @module @try-works/dsh-righthand/src/skills
+ */
+
+import { readFileSync } from 'node:fs'
+import type { Context } from '@deepseek-ai/cordis'
+// Type-only import activates the cordis Context augmentation for `ctx.skills`.
+import type {} from '@deepseek-ai/dsh-skill'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+export const name = 'righthand-skills'
+export const inject = ['skills']
+
+export const SKILL_NAME = 'dsh-righthand'
+
+/** Routing description shown by skill discovery (matches the SKILL.md frontmatter). */
+export const SKILL_DESCRIPTION = 'Use when a task needs the righthand toolkit — durable key-value storage (rh_store_*), credential and settings management (rh_credential_* / rh_settings_*), governed command execution (rh_run / rh_run_bg), or its tool guard policy. Covers tool reference, guard semantics, and service availability.'
+
+/** The bundled skill directory (this module lives in the bundle at lib/skills.js). */
+export function skillDirectory(): string {
+  return join(dirname(fileURLToPath(import.meta.url)), '..', `skills/${SKILL_NAME}`)
+}
+
+/** The skill body: SKILL.md verbatim from the bundled skill directory. */
+export function skillBody(): string {
+  return readFileSync(join(skillDirectory(), 'SKILL.md'), 'utf8')
+}
+
+/** Register the packaged skill. Returns the cordis effect disposer. */
+export function apply(ctx: Context): void {
+  ctx.skills.register({
+    name: SKILL_NAME,
+    description: SKILL_DESCRIPTION,
+    source: 'bundled',
+    content: skillBody(),
+    resourceBase: { kind: 'directory', path: skillDirectory() },
+  })
+}
+