@vibe-agent-toolkit/cli 0.1.41-rc.5 → 0.1.41-rc.7

package/dist/commands/claude/plugin/build.js

@@ -8,14 +8,20 @@
  */
 import { cpSync, existsSync, readFileSync } from 'node:fs';
 import { mkdir, readdir, rm, writeFile } from 'node:fs/promises';
-import { applyFilesConfig, getPluginOutputDir, getPluginSourceDir, listPluginSourceSkillDirs, mergeFilesConfig, skillNameToFsPath } from '@vibe-agent-toolkit/agent-skills';
+import { basename } from 'node:path';
+import { countBySeverity } from '@vibe-agent-toolkit/agent-schema';
+import { createProjectRegistry, getPluginOutputDir, getPluginSourceDir, listPluginSourceSkillDirs, listUntrackedPluginSkillDirs, packageSkill, packagingConfigToPackageOptions, skillNameToFsPath } from '@vibe-agent-toolkit/agent-skills';
 import { safePath, toForwardSlash } from '@vibe-agent-toolkit/utils';
 import { Command } from 'commander';
+import { readSkillName } from '../../../commands/skills/skill-discovery.js';
 import { handleCommandError } from '../../../utils/command-error.js';
 import { loadConfig } from '../../../utils/config-loader.js';
+import { collectPostBuildIssues, formatIssueLines, formatIssueSetHeading, sumSeverityCounts, } from '../../../utils/issue-rendering.js';
 import { createLogger } from '../../../utils/logger.js';
 import { writeYamlOutput } from '../../../utils/output.js';
+import { mergeSkillPackagingConfig } from '../../../utils/skill-packaging-config.js';
 import { loadClaudeProjectConfig } from '../claude-config.js';
+import { buildMarketplaceJson } from './marketplace-json.js';
 import { resolvePluginChangelogPath } from './plugin-changelog.js';
 import { applyPluginFiles } from './plugin-files.js';
 import { mergePluginJson, resolveVersion } from './plugin-json-merge.js';
@@ -36,7 +42,10 @@ Description:
   plugin's skills: selector.
 
   For each marketplace, for each plugin:
-  - Tree-copies plugins/<name>/ (commands, hooks, agents, skills, .mcp.json) verbatim
+  - Tree-copies plugins/<name>/ non-skill content (commands, hooks, agents, .mcp.json)
+  - Packages each plugin-local skill (plugins/<name>/skills/*) with the same
+    packager used for pool skills — links rewritten, files: applied, declared
+    test input excluded. Skills are never copied verbatim.
   - Imports pool skills (dist/skills/) via the plugin's skills: selector
   - Applies explicit files: source→dest mappings for compiled artifacts
   - Merges plugin.json with author, description, and VAT-supplied metadata
@@ -114,15 +123,21 @@ export async function runClaudePluginBuild(configDir, options = {}) {
     }
     // Discover available skills from dist/skills/ for pool-to-plugin selectors
     const availableSkills = await discoverBuiltSkills(configDir);
-    // Load the project's skills config (defaults + per-skill) so the plugin build
-    // can apply each tree-copied skill's skill-level `files:` mapping — the
-    // verbatim tree-copy never runs the skill-packager, so without this a skill's
-    // build-provided artifacts (a bundled engine, generated data, a catalog)
-    // would be missing from the shipped plugin tree. Undefined when no config.
+    // Load the project's skills config (defaults + per-skill) so each plugin-local
+    // skill is PACKAGED with its own effective packaging config — the same config
+    // `vat skills build` would use for it. Undefined when no config, in which case
+    // plugin-local skills package with schema defaults.
     const skillsConfig = projectConfig?.skills;
     logger.info(`Building Claude plugin artifacts`);
     logger.info(`   Config: ${safePath.join(configDir, 'vibe-agent-toolkit.config.yaml')}`);
     logger.info(`   Skills available: ${availableSkills.length}`);
+    // THE registry for this build: one crawl+parse of the project's markdown,
+    // shared by every plugin-local skill in every marketplace. `packageSkill`
+    // builds this itself when it is not given one, so omitting it does not fail —
+    // it just re-reads the whole project once per skill, which is how a 46-skill
+    // build came to take longer than a 30-minute CI budget.
+    const sharedRegistry = await createProjectRegistry(configDir);
+    logger.debug(`Project registry: ${sharedRegistry.getAllResources().length} markdown resources (built once)`);
     const results = [];
     const allPluginNames = [];
     for (const mp of Object.values(marketplaces)) {
@@ -137,7 +152,16 @@ export async function runClaudePluginBuild(configDir, options = {}) {
         }
         const mpConfig = marketplaces[name];
         logger.info(`\n   Building marketplace: ${name}`);
-        const result = await buildMarketplace(name, mpConfig, availableSkills, configDir, skillsConfig, rootVersion, logger);
+        const result = await buildMarketplace({
+            name,
+            config: mpConfig,
+            availableSkills,
+            configDir,
+            skillsConfig,
+            rootVersion,
+            registry: sharedRegistry,
+            logger,
+        });
         results.push(result);
         if (result.status === 'error') {
             throw new Error(`Claude plugin build failed for marketplace '${name}': ${result.reason ?? 'unknown error'}`);
@@ -165,8 +189,12 @@ async function pluginBuildCommand(options) {
         const duration = Date.now() - startTime;
         const totalPlugins = results.flatMap((r) => r.plugins).length;
         const totalSkills = results.flatMap((r) => r.plugins).flatMap((p) => p.skillsCopied).length;
+        const allPlugins = results.flatMap((r) => r.plugins);
         writeYamlOutput({
             status: 'success',
+            // The build gate is two-valued and a warning does not fail it, so the
+            // distribution has to travel next to the status rather than inside it.
+            issueCounts: sumSeverityCounts(allPlugins.map((p) => p.localSkillIssueCounts)),
             marketplacesBuilt: results.filter((r) => r.status === 'built').length,
             pluginsBuilt: totalPlugins,
             skillsPackaged: totalSkills,
@@ -184,7 +212,8 @@ async function pluginBuildCommand(options) {
                     mcpCopied: p.mcpCopied,
                     treeFilesCopied: p.treeFilesCopied,
                     explicitFilesCopied: p.explicitFilesCopied,
-                    skillFilesCopied: p.skillFilesCopied,
+                    localSkillsPackaged: p.localSkillsPackaged,
+                    issueCounts: p.localSkillIssueCounts,
                 })),
             })),
             duration: `${duration}ms`,
@@ -219,7 +248,8 @@ async function copyDistributionFiles(marketplaceDir, configDir, config, logger)
         }
     }
 }
-async function buildMarketplace(name, config, availableSkills, configDir, skillsConfig, rootVersion, logger) {
+async function buildMarketplace(input) {
+    const { name, config, availableSkills, configDir, skillsConfig, rootVersion, registry, logger } = input;
     const plugins = [];
     // Clean stale marketplace directory before rebuilding — removes orphaned plugins
     const marketplaceBaseDir = safePath.join(configDir, 'dist', '.claude', 'plugins', 'marketplaces', name);
@@ -238,6 +268,7 @@ async function buildMarketplace(name, config, availableSkills, configDir, skills
             skillsConfig,
             owner: config.owner,
             rootVersion,
+            registry,
             logger,
         });
         plugins.push(pluginResult);
@@ -247,27 +278,18 @@ async function buildMarketplace(name, config, availableSkills, configDir, skills
     const claudePluginDir = safePath.join(marketplaceDir, CLAUDE_PLUGIN_DIRNAME);
     // eslint-disable-next-line security/detect-non-literal-fs-filename -- resolved paths
     await mkdir(claudePluginDir, { recursive: true });
-    const marketplaceJson = {
-        $schema: 'https://anthropic.com/claude-code/marketplace.schema.json',
+    // Each entry's author is the plugin's own MERGED author (see marketplace-json.ts),
+    // so marketplace.json and that plugin's plugin.json cannot disagree.
+    const marketplaceJson = buildMarketplaceJson({
         name,
-        owner: {
-            name: config.owner.name,
-            ...(config.owner.email ? { email: config.owner.email } : {}),
-        },
-        plugins: plugins.map((p) => {
-            const pluginDesc = config.plugins.find((pd) => pd.name === p.pluginName)?.description;
-            return {
-                name: p.pluginName,
-                ...(pluginDesc ? { description: pluginDesc } : {}),
-                source: `./plugins/${p.pluginName}`,
-                ...(p.pluginVersion ? { version: p.pluginVersion } : {}),
-                author: {
-                    name: config.owner.name,
-                    ...(config.owner.email ? { email: config.owner.email } : {}),
-                },
-            };
-        }),
-    };
+        owner: config.owner,
+        plugins: plugins.map((p) => ({
+            name: p.pluginName,
+            description: config.plugins.find((pd) => pd.name === p.pluginName)?.description,
+            version: p.pluginVersion,
+            author: p.pluginAuthor,
+        })),
+    });
     // eslint-disable-next-line security/detect-non-literal-fs-filename -- resolved paths
     await writeFile(safePath.join(claudePluginDir, 'marketplace.json'), JSON.stringify(marketplaceJson, null, 2));
     logger.info(`   .claude-plugin/marketplace.json`);
@@ -350,7 +372,7 @@ async function writeMergedPluginJson(pluginDef, authorJson, pluginVersion, plugi
     const pluginJsonDir = safePath.join(pluginDir, CLAUDE_PLUGIN_DIRNAME);
     // eslint-disable-next-line security/detect-non-literal-fs-filename -- resolved paths
     await mkdir(pluginJsonDir, { recursive: true });
-    const { merged, warnings } = mergePluginJson({
+    const { merged, author, warnings } = mergePluginJson({
         vat: {
             name: pluginDef.name,
             version: pluginVersion,
@@ -364,12 +386,24 @@ async function writeMergedPluginJson(pluginDef, authorJson, pluginVersion, plugi
     // eslint-disable-next-line security/detect-non-literal-fs-filename -- resolved paths
     await writeFile(safePath.join(pluginJsonDir, 'plugin.json'), JSON.stringify(merged, null, 2));
     logger.info(`         .claude-plugin/plugin.json`);
+    return author;
 }
 /**
  * Copy pool skills (from dist/skills/) selected by the plugin's skills: selector
  * into the plugin bundle's skills/ directory.
+ *
+ * `destOverrides` maps a selected skill's NAME to the `skills/`-relative directory
+ * it must land in, and carries the collision referee's decision (see
+ * {@link resolveCollidingSkills}): when the pool copy wins over a plugin-local copy,
+ * it takes over the plugin-local skill's own authored directory path rather than the
+ * default `skills/<fsName>`. That keeps ONE invariant true for every plugin-local
+ * skill, refereed or not — it ships at the path it was authored at, which is exactly
+ * what `DistributedSkillLocation.skillOutputDir` promises every consumer of the
+ * layout module. Without it a NESTED collision (`skills/group/foo` losing to pool
+ * `foo`) landed at `skills/foo`, and `vat skill test foo` then hard-failed looking for
+ * a dist at `skills/group/foo` that the build never wrote.
  */
-async function copyPoolSkills(pluginDef, marketplaceAvailable, configDir, pluginDir, logger) {
+async function copyPoolSkills(pluginDef, marketplaceAvailable, configDir, pluginDir, destOverrides, logger) {
     const selected = resolvePluginSkills(pluginDef, marketplaceAvailable);
     const copied = [];
     for (const skillName of selected) {
@@ -379,7 +413,7 @@ async function copyPoolSkills(pluginDef, marketplaceAvailable, configDir, plugin
             throw new Error(`Skill "${skillName}" not built at ${skillDistPath}. ` +
                 `Run: vat skills build (or vat build to build everything)`);
         }
-        const fsPath = skillNameToFsPath(skillName);
+        const fsPath = destOverrides.get(skillName) ?? skillNameToFsPath(skillName);
         const destPath = safePath.join(pluginDir, 'skills', fsPath);
         // eslint-disable-next-line security/detect-non-literal-fs-filename -- resolved paths
         await mkdir(destPath, { recursive: true });
@@ -390,56 +424,178 @@ async function copyPoolSkills(pluginDef, marketplaceAvailable, configDir, plugin
     return copied;
 }
 /**
- * Apply each tree-copied (plugin-source) skill's skill-level `files:` mapping
- * into the distributed skill dir, mirroring what `vat skills build` does for pool
- * skills. The plugin tree-copy is verbatim and never runs the skill-packager, so
- * a skill whose build-provided artifacts live in its own dir would otherwise ship
- * without them. Pool skills (copied from dist/skills/) already had `files:` baked
- * in by `vat skills build`, so only plugin-source skills are processed here.
- * Returns the number of files copied.
+ * Discover the plugin's own skills ONCE, resolving each one's declared name.
+ *
+ * Every later phase — the collision referee, the packager, and the tree-copy's
+ * exclusion list — reads this one list, so "which directories under `skills/` are
+ * skills" has exactly one answer per build. Two independent listings is the shape
+ * that previously let a directory be excluded by one phase and skipped by the
+ * other, shipping NOWHERE with no diagnostic.
+ *
+ * {@link listPluginSourceSkillDirs} supplies the directories: recursive (a nested
+ * `skills/<group>/<skill>/SKILL.md` is a skill Claude Code loads, so VAT packages
+ * it) and filtered to the same git-visible file set the tree-copy sees (a
+ * gitignored/untracked skill dir must not be published by one producer when the
+ * other would never have shipped it).
  */
-async function applyTreeCopiedSkillFiles(input) {
-    // Enumerate via the shared layout helper so build and verify resolve a plugin's
-    // tree-copied skills through ONE definition — verify's files-config-dests check
-    // (via computeTreeCopiedSkillLocations) and this write path can never diverge.
-    let copied = 0;
-    for (const skillName of listPluginSourceSkillDirs(input.pluginSourceDir)) {
-        // A colliding skill (Fix 1) is pool-sourced now, not tree-copied — its
-        // files: config was already applied by `vat skills build` and is baked
-        // into dist/skills/<name>/, which Phase 3 copies in. Applying it again
-        // here would write into a dir the tree-copy no longer produced and
-        // double-count skillFilesCopied.
-        if (input.excludeSkillDirs.has(skillName))
-            continue;
-        const filesConfig = mergeFilesConfig(input.skillsConfig?.defaults?.files, input.skillsConfig?.config?.[skillName]?.files);
-        if (filesConfig.length === 0)
-            continue;
-        const skillOutputDir = safePath.join(input.pluginDir, 'skills', skillName);
-        const dests = await applyFilesConfig({
-            filesConfig,
-            projectRoot: input.configDir,
-            skillOutputDir,
+async function discoverPluginLocalSkills(pluginSourceDir, logger) {
+    // Git visibility is the right filter, but a SILENT drop is not: a skill the author
+    // just created and has not `git add`ed is simply absent from the built plugin, and
+    // a build that says "success" while omitting it reads as one that shipped it.
+    // Gitignored dirs are excluded from this list — ignoring one IS the instruction.
+    for (const dir of listUntrackedPluginSkillDirs(pluginSourceDir)) {
+        logger.info(`warning: skills/${dir}/SKILL.md exists but is not tracked by git, so it was NOT packaged ` +
+            `into this plugin (the plugin build ships tracked files only). Run \`git add\` on it, or ` +
+            `add it to .gitignore to silence this.`);
+    }
+    const skills = [];
+    for (const skillDirPath of listPluginSourceSkillDirs(pluginSourceDir)) {
+        const skillPath = safePath.join(pluginSourceDir, 'skills', skillDirPath, 'SKILL.md');
+        // Resolved through the SAME reader `vat skills build` uses — per-skill config is
+        // keyed by name, so two answers would mean two effective configs.
+        const skillName = await readSkillName(skillPath) ?? lastPathSegment(skillDirPath);
+        skills.push({ skillDirPath, skillPath, skillName });
+    }
+    return skills;
+}
+/** Trailing segment of a skill dir path (`group/nested` → `nested`). */
+function lastPathSegment(dirPath) {
+    return basename(dirPath);
+}
+/**
+ * PACKAGE each plugin-local skill (a skill living in the plugin's own `skills/`
+ * source tree) with the SAME packager that produces pool skills.
+ *
+ * This is the "one production path" rule. A plugin-local skill used to be
+ * tree-copied VERBATIM — every byte in its source directory shipped, links were
+ * never rewritten, and `files:` had to be re-applied separately because the
+ * packager never ran. That produced a materially different artifact from the
+ * pool path for the same kind of thing, and the difference was invisible: it
+ * shipped eval suites (answer keys included), scratch files, and un-rewritten
+ * links. The collision referee already conceded the point by preferring the
+ * pool copy whenever both existed.
+ *
+ * Now both paths run `packageSkill`, so "what ships in a skill" has exactly one
+ * answer: link-reachable resources plus declared `files:`, links rewritten,
+ * declared test input excluded, post-build checks applied.
+ *
+ * `input.skills` is the already-refereed set: pool-sourced collisions have been
+ * filtered out by {@link resolveCollidingSkills} and are copied in by Phase 3
+ * instead. Returns each packaged skill's result for error reporting.
+ *
+ * The returned list is also the ONLY definition of "which dirs under `skills/` did
+ * the packager produce": the tree-copy exclusion list is derived from it (see
+ * Phase 2b in {@link buildPlugin}), so a directory absent from it is a directory
+ * the tree-copy still ships.
+ */
+export async function packagePluginLocalSkills(input) {
+    const packaged = [];
+    for (const { skillDirPath, skillPath, skillName } of input.skills) {
+        // Per-skill config is keyed by the skill's declared NAME; the directory path and
+        // its trailing segment are fallbacks for the common cases where they coincide.
+        // The fallback LIST must stay a superset of `vat verify`'s (checkFilesConfigDests
+        // cannot read declared names, so it tries path-then-leaf): if verify resolved a
+        // key the build did not, verify would check `files:` dests for a skill the build
+        // was never told to copy them into, and fail a build that had in fact succeeded.
+        const packagingConfig = mergeSkillPackagingConfig(input.skillsConfig?.defaults, input.skillsConfig?.config?.[skillName] ??
+            input.skillsConfig?.config?.[skillDirPath] ??
+            input.skillsConfig?.config?.[lastPathSegment(skillDirPath)]);
+        const skillOutputDir = safePath.join(input.pluginDir, 'skills', skillDirPath);
+        const result = await packageSkill(skillPath, {
+            ...packagingConfigToPackageOptions(packagingConfig, { skillPath, outputPath: skillOutputDir }),
+            registry: input.registry,
         });
-        for (const dest of dests) {
-            input.logger.info(`         ${skillName} files: -> skills/${skillName}/${dest}`);
+        input.logger.info(`         ${skillName} -> skills/${skillDirPath} (${result.files.dependencies.length + 1} files)`);
+        packaged.push({ skillDirPath, result });
+    }
+    return packaged;
+}
+/**
+ * Summarize post-build issues for the plugin-local skills: the lines to print,
+ * the dirs that emitted errors, and the per-severity distribution.
+ *
+ * Mirrors `vat skills build`: a skill whose packaged output fails validation
+ * fails the build, so the two lanes hold the same bar, and they now render
+ * findings through the same helper — this lane used to label every non-error
+ * severity `[WARNING]`, so `info` findings were reported as warnings, and it
+ * read only `postBuildIssues`, so a skill failing purely on the built-output
+ * validation aborted the plugin build with no issue text at all.
+ *
+ * Pure so the whole rendered set is assertable.
+ */
+export function summarizePackagedSkillIssues(packaged) {
+    const lines = [];
+    const withErrors = [];
+    const perSkillCounts = [];
+    for (const { skillDirPath, result } of packaged) {
+        const issues = collectPostBuildIssues(result);
+        perSkillCounts.push(countBySeverity(issues));
+        if (issues.length > 0) {
+            lines.push(`         ${skillDirPath}: ${formatIssueSetHeading(issues, 'post-build')}`);
+            for (const issue of issues) {
+                lines.push(...formatIssueLines(issue, '         '));
+            }
         }
-        copied += dests.length;
+        if (result.hasErrors)
+            withErrors.push(skillDirPath);
     }
-    return copied;
+    return { lines, withErrors, issueCounts: sumSeverityCounts(perSkillCounts) };
+}
+/** Print the summary to stderr and return what the caller gates on. */
+function reportPackagedSkillIssues(packaged, logger) {
+    const { lines, withErrors, issueCounts } = summarizePackagedSkillIssues(packaged);
+    for (const line of lines) {
+        logger.info(line);
+    }
+    return { withErrors, issueCounts };
 }
 /**
- * Skill directory names (fs-safe) present in BOTH the plugin's own `skills/`
- * source tree AND the plugin's resolved pool selector. These collide: the
- * pool-packaged copy has rewritten links, the raw tree-copy does not. The
- * tree-copy phase excludes them so the pool copy is the sole source (Fix 1
- * — collision referee, docs/plans/2026-07-01-plugin-skill-double-production-spec.md §5).
+ * Split the plugin's own skills into those that COLLIDE with its resolved pool
+ * selector and those that do not. A colliding skill would otherwise be produced
+ * twice — once by the local packager, once by the Phase 3 pool copy-in — putting
+ * two definitions of the same skill in one plugin.
+ *
+ * Matched on the DECLARED NAME, and ONLY the declared name. Name is what makes two
+ * copies the same skill: a skill named `foo` authored in `skills/bar/` collides
+ * with pool `foo` just as surely as one in `skills/foo/`, and a NESTED skill
+ * (`skills/group/foo/`) collides too even though its directory path shares no
+ * segment with the pool copy's `skills/foo/`. A dirname-only comparison missed all
+ * of those, and the nested case shipped the skill twice, at two depths, in one plugin.
+ *
+ * The directory leaf is deliberately NOT also matched. It adds nothing (when a
+ * skill's `SKILL.md` declares no name, {@link discoverPluginLocalSkills} already
+ * falls back to that leaf, so the name comparison covers it) and it over-matches:
+ * a plugin-local skill named `bar` living in `skills/foo/`, in a plugin that selects
+ * an unrelated pool skill `foo`, was refereed away as if it were the pool's `foo` —
+ * so `bar` was neither packaged nor tree-copied and shipped NOWHERE, under a warning
+ * claiming a skill named `bar` had been "selected from the pool".
+ *
+ * `conflicts` is the residue that name-matching alone cannot resolve: a
+ * non-colliding plugin-local skill whose authored directory is the same directory a
+ * selected pool skill copies into. Two DIFFERENT skills, one output dir — the
+ * packager and the Phase 3 copy would write over each other. There is no correct
+ * winner, so the caller fails the build instead of silently picking one.
  */
-function resolveCollidingSkillDirs(pluginSourceDir, selectedSkillNames) {
+function resolveCollidingSkills(skills, selectedSkillNames) {
     const selectedFsNames = new Set(selectedSkillNames.map((name) => skillNameToFsPath(name)));
-    return listPluginSourceSkillDirs(pluginSourceDir).filter((dirName) => selectedFsNames.has(dirName));
+    const colliding = [];
+    const packageable = [];
+    const conflicts = [];
+    for (const skill of skills) {
+        if (selectedFsNames.has(skillNameToFsPath(skill.skillName))) {
+            colliding.push(skill);
+            continue;
+        }
+        packageable.push(skill);
+        const clash = [...selectedFsNames].find((fsName) => toForwardSlash(skill.skillDirPath) === fsName ||
+            toForwardSlash(skill.skillDirPath).startsWith(`${toForwardSlash(fsName)}/`));
+        if (clash !== undefined)
+            conflicts.push({ skill, poolSkillFsPath: clash });
+    }
+    return { colliding, packageable, conflicts };
 }
 async function buildPlugin(input) {
-    const { marketplaceName, pluginDef, marketplaceAvailable, configDir, skillsConfig, owner, rootVersion, logger } = input;
+    const { marketplaceName, pluginDef, marketplaceAvailable, configDir, skillsConfig, owner, rootVersion, registry, logger } = input;
     const pluginDir = getPluginOutputDir(configDir, marketplaceName, pluginDef.name);
     const pluginSourceDir = getPluginSourceDir(configDir, pluginDef);
     logger.info(`      Building plugin: ${pluginDef.name}`);
@@ -463,47 +619,90 @@ async function buildPlugin(input) {
     }
     // eslint-disable-next-line security/detect-non-literal-fs-filename -- resolved paths
     await mkdir(pluginDir, { recursive: true });
-    // Phase 1.5: collision referee. Resolve the plugin's pool selector BEFORE
-    // tree-copy so a skill present in BOTH the plugin's own skills/ tree AND
-    // the resolved pool selector excludes from the verbatim tree-copy — the
-    // pool-packaged copy (Phase 3) becomes the sole source. Without this, both
-    // copies coexist at two depths inside the same skills/<name>/ dir and the
-    // raw copy ships un-rewritten (dead) links.
-    const selectedSkillNames = resolvePluginSkills(pluginDef, marketplaceAvailable);
-    const collidingSkillDirs = pluginSourceExists
-        ? resolveCollidingSkillDirs(pluginSourceDir, selectedSkillNames)
+    // Phase 1.4: discover the plugin's own skills ONCE (recursive; git-visible only),
+    // resolving each declared name. Every phase below reads this list.
+    const localSkills = pluginSourceExists
+        ? await discoverPluginLocalSkills(pluginSourceDir, logger)
         : [];
-    for (const dirName of collidingSkillDirs) {
-        logger.info(`warning: skill "${dirName}" is selected from the pool AND present at ` +
-            `${toForwardSlash(safePath.relative(configDir, pluginSourceDir))}/skills/${dirName}/ — ` +
-            `using the pool-packaged copy (dist/skills/${dirName}) and excluding the plugin-local copy from tree-copy.`);
+    // Phase 1.5: collision referee. Resolve the plugin's pool selector BEFORE the
+    // tree-copy so a skill present in BOTH the plugin's own skills/ tree AND the
+    // resolved pool selector is sourced from exactly one place. Both copies are now
+    // packager output, so the referee is no longer about "raw copy ships dead links"
+    // — it is about not producing the same skill twice, at two depths, in one dir.
+    const selectedSkillNames = resolvePluginSkills(pluginDef, marketplaceAvailable);
+    const { colliding: collidingSkills, packageable, conflicts } = resolveCollidingSkills(localSkills, selectedSkillNames);
+    if (conflicts.length > 0) {
+        const pluginSourceRel = toForwardSlash(safePath.relative(configDir, pluginSourceDir));
+        throw new Error(`Plugin '${pluginDef.name}': two DIFFERENT skills claim the same output directory.\n` +
+            conflicts
+                .map(({ skill, poolSkillFsPath }) => `  - skills/${skill.skillDirPath} holds the plugin-local skill "${skill.skillName}", ` +
+                `but the plugin's skills: selector also copies a pool skill into skills/${poolSkillFsPath}.`)
+                .join('\n') +
+            `\nRename the plugin-local directory under ${pluginSourceRel}/skills/, or drop the pool skill ` +
+            `from this plugin's skills: selector. (Only a same-NAME collision has a winner — the pool copy; ` +
+            `two different skills sharing one directory does not.)`);
+    }
+    // The pool copy takes over the plugin-local skill's OWN authored directory (see
+    // copyPoolSkills) so "a plugin-local skill ships at its authored path" holds
+    // whether it was packaged locally or refereed to the pool.
+    const poolDestOverrides = new Map(collidingSkills.map(({ skillName, skillDirPath }) => [skillName, skillDirPath]));
+    for (const { skillName, skillDirPath } of collidingSkills) {
+        logger.info(`warning: skill "${skillName}" is selected from the pool AND present at ` +
+            `${toForwardSlash(safePath.relative(configDir, pluginSourceDir))}/skills/${skillDirPath}/ — ` +
+            `using the pool-packaged copy (dist/skills/${skillNameToFsPath(skillName)}) and not packaging ` +
+            `the plugin-local copy. It ships at skills/${skillDirPath}, the path it was authored at.`);
+    }
+    // Phase 2a: PACKAGE each non-colliding plugin-local skill with the same packager
+    // that produces pool skills — one production path for skills (see
+    // packagePluginLocalSkills). This subsumes the old separate files: application:
+    // the packager owns files: semantics, so no lane re-implements them. Runs BEFORE
+    // the tree-copy so the tree-copy's exclusion list can be derived from what this
+    // actually produced.
+    const packagedLocalSkills = await packagePluginLocalSkills({
+        skills: packageable,
+        pluginDir,
+        skillsConfig,
+        registry,
+        logger,
+    });
+    const { withErrors: skillsWithErrors, issueCounts: localSkillIssueCounts } = reportPackagedSkillIssues(packagedLocalSkills, logger);
+    if (skillsWithErrors.length > 0) {
+        throw new Error(`Plugin '${pluginDef.name}': ${skillsWithErrors.length} plugin-local skill(s) emitted ` +
+            `post-build validation errors: ${skillsWithErrors.join(', ')}`);
     }
-    // Phase 2: tree copy (skips .claude-plugin/, colliding pool-selected skill dirs, respects .gitignore).
+    const localSkillsPackaged = packagedLocalSkills.length;
+    // Phase 2b: tree copy of everything the other phases did NOT produce (commands,
+    // hooks, agents, .mcp.json, root files), skipping .claude-plugin/ and respecting
+    // .gitignore.
+    //
+    // The exclusion list is the set of `skills/<dir>` entries some OTHER phase
+    // produces: the ones the packager just wrote (Phase 2a) plus the pool-sourced
+    // collisions Phase 3 copies in. Both halves come from the SAME Phase 1.4
+    // discovery, partitioned — never from a second listing of `skills/` — which is
+    // what makes "excluded here" and "produced elsewhere" the same set by
+    // construction. Two independent filters over the same directory would let a dir
+    // be excluded by one and skipped by the other, and it would then ship NOWHERE,
+    // with no diagnostic.
+    //
+    // What remains for the tree-copy is everything under `skills/` that is NOT a
+    // skill: a `shared/` helper dir, `_templates/`, or the bare PARENT segment of a
+    // nested skill (`skills/group/` when the skill is `skills/group/nested/`). A
+    // directory holding a SKILL.md is never copied verbatim at any depth — that is
+    // exactly how eval suites, scratch files, and un-rewritten links used to ship.
+    const producedSkillDirs = [
+        ...packagedLocalSkills.map(({ skillDirPath }) => skillDirPath),
+        ...collidingSkills.map(({ skillDirPath }) => skillDirPath),
+    ];
     const treeResult = pluginSourceExists
         ? await treeCopyPlugin({
             sourceDir: pluginSourceDir,
             destDir: pluginDir,
-            excludeSkillDirs: collidingSkillDirs,
+            excludeSkillDirs: producedSkillDirs,
             warn: (m) => logger.info(`warning: ${m}`),
         })
         : { commandsCopied: 0, hooksCopied: 0, agentsCopied: 0, mcpCopied: 0, filesCopied: 0 };
-    // Phase 2.5: apply each NON-colliding tree-copied plugin-source skill's
-    // skill-level files: mapping into the distributed skill dir (the tree-copy
-    // is verbatim and never runs the skill-packager). Pool skills — including a
-    // colliding skill, now pool-sourced only — already had files: baked in by
-    // `vat skills build`, so this only touches genuinely tree-copied skills.
-    const skillFilesCopied = pluginSourceExists
-        ? await applyTreeCopiedSkillFiles({
-            pluginSourceDir,
-            pluginDir,
-            configDir,
-            skillsConfig,
-            excludeSkillDirs: new Set(collidingSkillDirs),
-            logger,
-        })
-        : 0;
     // Phase 3: pool-skill copy-in (from dist/skills/ via the plugin's skills: selector).
-    const skillsCopied = await copyPoolSkills(pluginDef, marketplaceAvailable, configDir, pluginDir, logger);
+    const skillsCopied = await copyPoolSkills(pluginDef, marketplaceAvailable, configDir, pluginDir, poolDestOverrides, logger);
     // Phase 4: files[] mapping (may overwrite tree-copied files).
     let explicitFilesCopied = 0;
     if (pluginDef.files && pluginDef.files.length > 0) {
@@ -520,7 +719,7 @@ async function buildPlugin(input) {
     // truth that flows into both the merged plugin.json and marketplace.json.
     const authorJson = readAuthorPluginJson(pluginSourceDir);
     const pluginVersion = resolveVersion(pluginDef, authorJson, rootVersion, { warn: (message) => logger.info(`warning: ${message}`) });
-    await writeMergedPluginJson(pluginDef, authorJson, pluginVersion, pluginDir, owner, logger);
+    const pluginAuthor = await writeMergedPluginJson(pluginDef, authorJson, pluginVersion, pluginDir, owner, logger);
     // Phase 6: per-plugin CHANGELOG copy. Resolves to <pluginSourceDir>/CHANGELOG.md
     // by default, or `entry.changelog` (relative to plugin source) when configured.
     // No-op when neither resolves — marketplace-level CHANGELOG (handled in
@@ -534,6 +733,7 @@ async function buildPlugin(input) {
         pluginName: pluginDef.name,
         pluginDir,
         pluginVersion,
+        pluginAuthor,
         skillsCopied,
         commandsCopied: treeResult.commandsCopied,
         hooksCopied: treeResult.hooksCopied,
@@ -541,7 +741,8 @@ async function buildPlugin(input) {
         mcpCopied: treeResult.mcpCopied,
         treeFilesCopied: treeResult.filesCopied,
         explicitFilesCopied,
-        skillFilesCopied,
+        localSkillsPackaged,
+        localSkillIssueCounts,
     };
 }
 //# sourceMappingURL=build.js.map