@wrongstack/core 0.313.0 → 0.313.1

package/dist/skills/index.js

@@ -1,1582 +1,39 @@
-// src/skills/foreign-sources.ts
-var FOREIGN_SKILL_TOOLS = [
-  { id: "agents", subdir: "skills" },
-  // shared store (asm / agentskills.io ecosystem)
-  { id: "codex", subdir: "skills" },
-  // OpenAI Codex CLI
-  { id: "gemini", subdir: "skills" },
-  // Gemini CLI
-  { id: "cursor", subdir: "skills" },
-  // Cursor (standard subdir, aligned with skills.sh ecosystem)
-  { id: "qwen", subdir: "skills" },
-  // Qwen Code
-  { id: "trae", subdir: "skills" },
-  // Trae
-  { id: "windsurf", subdir: "skills" }
-  // Windsurf
-];
-var KNOWN_FOREIGN_IDS = new Set(FOREIGN_SKILL_TOOLS.map((t) => t.id));
-function resolveForeignToolIds(opt) {
-  return resolveForeignToolIdsWithWarnings(opt).ids;
-}
-function resolveForeignToolIdsWithWarnings(opt) {
-  if (opt === false) return { ids: [], unknownIds: [] };
-  if (Array.isArray(opt)) {
-    const ids = [];
-    const unknownIds = [];
-    for (const id of opt) {
-      if (KNOWN_FOREIGN_IDS.has(id)) ids.push(id);
-      else unknownIds.push(id);
-    }
-    return { ids, unknownIds };
-  }
-  return { ids: FOREIGN_SKILL_TOOLS.map((t) => t.id), unknownIds: [] };
-}
-function securityScoreToTier(score) {
-  if (score == null || Number.isNaN(score)) return "low";
-  if (score < 30) return "low";
-  if (score < 70) return "medium";
-  return "high";
-}
-
-// src/skills/frontmatter.ts
-var SCALAR_KEYS = /* @__PURE__ */ new Set([
-  "name",
-  "description",
-  "trigger",
-  "version",
-  "license",
-  "compatibility"
-]);
-function parseSkillFrontmatter(raw) {
-  const text = normalizeLineEndings(raw);
-  if (!text.startsWith("---")) return {};
-  const end = text.indexOf("\n---", 4);
-  if (end === -1) return {};
-  return parseFrontmatterBlock(text.slice(4, end));
-}
-function stripFrontmatter(raw) {
-  const text = normalizeLineEndings(raw);
-  if (!text.startsWith("---")) return text;
-  const end = text.indexOf("\n---", 4);
-  if (end === -1) return text;
-  let body = text.slice(end + 4);
-  if (body.startsWith("\n")) body = body.slice(1);
-  return body;
-}
-function normalizeLineEndings(s) {
-  return s.replace(/\r\n?/g, "\n");
-}
-function parseFrontmatterBlock(block) {
-  const out = {};
-  const lines = block.split("\n");
-  let i = 0;
-  while (i < lines.length) {
-    const line = lines[i] ?? "";
-    const m = /^([a-zA-Z][a-zA-Z0-9_-]*):\s*(.*)$/.exec(line);
-    if (!m) {
-      i++;
-      continue;
-    }
-    const key = m[1] ?? "";
-    const rest = (m[2] ?? "").trim();
-    if (key === "metadata") {
-      const map = {};
-      i++;
-      while (i < lines.length) {
-        const sub = lines[i] ?? "";
-        const sm = /^\s+([a-zA-Z0-9_.-]+):\s*(.*)$/.exec(sub);
-        if (!sm) break;
-        map[sm[1] ?? ""] = unquote((sm[2] ?? "").trim());
-        i++;
-      }
-      if (Object.keys(map).length > 0) out.metadata = map;
-      continue;
-    }
-    if (rest === "|" || rest === ">") {
-      const collected = [];
-      i++;
-      while (i < lines.length) {
-        const sub = lines[i] ?? "";
-        if (sub === "" || sub.startsWith(" ") || sub.startsWith("	")) {
-          collected.push(sub.replace(/^\s+/, ""));
-          i++;
-        } else break;
-      }
-      out[normalizeKey(key)] = collected.join("\n").trim();
-      continue;
-    }
-    if (key === "allowed-tools" || key === "allowedTools" || key === "required-capabilities" || key === "requiredCapabilities" || key === "required-tools" || key === "requiredTools" || key === "optional-capabilities" || key === "optionalCapabilities") {
-      const values = rest.replace(/^\[/, "").replace(/\]$/, "").split(/[\s,]+/).map(unquote).filter(Boolean);
-      out[normalizeKey(key)] = values;
-      i++;
-      continue;
-    }
-    if (SCALAR_KEYS.has(key)) {
-      out[key] = unquote(rest);
-      i++;
-      continue;
-    }
-    i++;
-  }
-  return out;
-}
-function normalizeKey(key) {
-  if (key === "allowed-tools") return "allowedTools";
-  if (key === "required-capabilities") return "requiredCapabilities";
-  if (key === "required-tools") return "requiredTools";
-  if (key === "optional-capabilities") return "optionalCapabilities";
-  return key;
-}
-function unquote(s) {
-  if (s.length >= 2 && (s.startsWith('"') && s.endsWith('"') || s.startsWith("'") && s.endsWith("'"))) {
-    return s.slice(1, -1);
-  }
-  return s;
-}
-function isValidSkillNameFormat(name) {
-  return name.length >= 1 && name.length <= 64 && /^[a-z0-9]+(-[a-z0-9]+)*$/.test(name);
-}
-function validateSkillName(name, parentDirName) {
-  const errors = [];
-  if (!name || name.trim().length === 0) {
-    errors.push("name is empty");
-    return errors;
-  }
-  if (name.length > 64) errors.push(`name is ${name.length} characters (max 64)`);
-  if (!/^[a-z0-9]+(-[a-z0-9]+)*$/.test(name)) {
-    errors.push(
-      "name must be lowercase letters, digits, and single hyphens only (no leading/trailing/consecutive hyphens)"
-    );
-  }
-  if (parentDirName !== void 0 && name !== parentDirName) {
-    errors.push(`name "${name}" must match its parent directory "${parentDirName}"`);
-  }
-  return errors;
-}
-
-// src/skills/github-fetcher.ts
-import { createWriteStream } from "node:fs";
-import * as fs from "node:fs/promises";
-import * as os from "node:os";
-import * as path from "node:path";
-import { Readable } from "node:stream";
-import { pipeline } from "node:stream/promises";
-import { createGunzip } from "node:zlib";
-
-// src/utils/error.ts
-function toErrorMessage(err) {
-  return err instanceof Error ? err.message : String(err);
-}
-
-// src/types/errors.ts
-var ERROR_CODES = {
-  // Provider
-  PROVIDER_RATE_LIMITED: "PROVIDER_RATE_LIMITED",
-  PROVIDER_AUTH_FAILED: "PROVIDER_AUTH_FAILED",
-  PROVIDER_OVERLOADED: "PROVIDER_OVERLOADED",
-  PROVIDER_INVALID_REQUEST: "PROVIDER_INVALID_REQUEST",
-  PROVIDER_SERVER_ERROR: "PROVIDER_SERVER_ERROR",
-  PROVIDER_NETWORK_ERROR: "PROVIDER_NETWORK_ERROR",
-  PROVIDER_CONTEXT_OVERFLOW: "PROVIDER_CONTEXT_OVERFLOW",
-  // Tool
-  TOOL_NOT_FOUND: "TOOL_NOT_FOUND",
-  TOOL_PERMISSION_DENIED: "TOOL_PERMISSION_DENIED",
-  TOOL_EXECUTION_FAILED: "TOOL_EXECUTION_FAILED",
-  TOOL_TIMEOUT: "TOOL_TIMEOUT",
-  TOOL_INPUT_INVALID: "TOOL_INPUT_INVALID",
-  // Config
-  CONFIG_INVALID: "CONFIG_INVALID",
-  CONFIG_NOT_FOUND: "CONFIG_NOT_FOUND",
-  CONFIG_PARSE_FAILED: "CONFIG_PARSE_FAILED",
-  CONFIG_MIGRATION_NEEDED: "CONFIG_MIGRATION_NEEDED",
-  // Plugin
-  PLUGIN_LOAD_FAILED: "PLUGIN_LOAD_FAILED",
-  PLUGIN_API_MISMATCH: "PLUGIN_API_MISMATCH",
-  PLUGIN_MISSING_DEPENDENCY: "PLUGIN_MISSING_DEPENDENCY",
-  // Agent
-  AGENT_ITERATION_LIMIT: "AGENT_ITERATION_LIMIT",
-  AGENT_CONTEXT_OVERFLOW: "AGENT_CONTEXT_OVERFLOW",
-  AGENT_ABORTED: "AGENT_ABORTED",
-  AGENT_RUN_FAILED: "AGENT_RUN_FAILED",
-  // Session
-  SESSION_NOT_FOUND: "SESSION_NOT_FOUND",
-  SESSION_CORRUPTED: "SESSION_CORRUPTED",
-  SESSION_WRITE_FAILED: "SESSION_WRITE_FAILED",
-  // Container / Registry
-  CONTAINER_TOKEN_ALREADY_BOUND: "CONTAINER_TOKEN_ALREADY_BOUND",
-  CONTAINER_TOKEN_NOT_BOUND: "CONTAINER_TOKEN_NOT_BOUND",
-  CONTAINER_CIRCULAR_DEPENDENCY: "CONTAINER_CIRCULAR_DEPENDENCY",
-  REGISTRY_DUPLICATE: "REGISTRY_DUPLICATE",
-  REGISTRY_NOT_FOUND: "REGISTRY_NOT_FOUND",
-  REGISTRY_INVALID: "REGISTRY_INVALID",
-  // File system
-  FS_READ_FAILED: "FS_READ_FAILED",
-  FS_WRITE_FAILED: "FS_WRITE_FAILED",
-  FS_MKDIR_FAILED: "FS_MKDIR_FAILED",
-  FS_DELETE_FAILED: "FS_DELETE_FAILED",
-  FS_ATOMIC_WRITE_FAILED: "FS_ATOMIC_WRITE_FAILED",
-  // SDD (Spec-Driven Development)
-  SDD_VALIDATION_FAILED: "SDD_VALIDATION_FAILED",
-  SDD_PARSE_FAILED: "SDD_PARSE_FAILED",
-  SDD_INVALID_STATE: "SDD_INVALID_STATE",
-  SDD_NOT_READY: "SDD_NOT_READY",
-  // General
-  VALIDATION_ERROR: "VALIDATION_ERROR",
-  PARSE_FAILED: "PARSE_FAILED",
-  UNKNOWN: "UNKNOWN"
-};
-var WrongStackError = class extends Error {
-  code;
-  subsystem;
-  severity;
-  recoverable;
-  context;
-  constructor(opts) {
-    super(opts.message, { cause: opts.cause });
-    this.name = "WrongStackError";
-    this.code = opts.code;
-    this.subsystem = opts.subsystem;
-    this.severity = opts.severity ?? "error";
-    this.recoverable = opts.recoverable ?? false;
-    this.context = opts.context;
-  }
-  /**
-   * Render a one-line user-facing description.
-   * Subclasses should override for domain-specific formatting.
-   */
-  describe() {
-    const ctx = this.context ? ` ${formatContext(this.context)}` : "";
-    return `${this.code}: ${this.message}${ctx}`;
-  }
-};
-function formatContext(ctx) {
-  const parts = Object.entries(ctx).filter(([, v]) => v !== void 0).slice(0, 3).map(([k, v]) => `${k}=${String(v)}`);
-  return parts.length > 0 ? `[${parts.join(" ")}]` : "";
-}
-var FsError = class extends WrongStackError {
-  path;
-  constructor(opts) {
-    super({
-      message: opts.message,
-      code: opts.code,
-      subsystem: "fs",
-      severity: "error",
-      recoverable: opts.code !== ERROR_CODES.FS_READ_FAILED,
-      context: { path: opts.path, ...opts.context },
-      cause: opts.cause
-    });
-    this.name = "FsError";
-    this.path = opts.path;
-  }
-};
-var FetchError = class extends WrongStackError {
-  status;
-  constructor(opts) {
-    super({
-      message: opts.message,
-      code: ERROR_CODES.VALIDATION_ERROR,
-      subsystem: "general",
-      severity: "error",
-      recoverable: opts.status === 429 || opts.status >= 500,
-      context: { status: opts.status, ...opts.context },
-      cause: opts.cause
-    });
-    this.name = "FetchError";
-    this.status = opts.status;
-  }
-};
-var ParseError = class extends WrongStackError {
-  source;
-  constructor(opts) {
-    super({
-      message: opts.message,
-      code: ERROR_CODES.PARSE_FAILED,
-      subsystem: "general",
-      severity: "error",
-      recoverable: false,
-      context: { source: opts.source, ...opts.context },
-      cause: opts.cause
-    });
-    this.name = "ParseError";
-    this.source = opts.source;
-  }
-};
-
-// src/utils/expect-defined.ts
-function expectDefined(value, label) {
-  if (value === null || value === void 0) {
-    const err = new Error(label ? `Expected ${label} to be defined` : "Expected value to be defined");
-    err.name = "ExpectDefinedError";
-    throw err;
-  }
-  return value;
-}
-
-// src/skills/limits.ts
-var SKILL_LIMITS = {
-  /**
-   * Per-skill body cap when injecting a full skill body into the system prompt
-   * (eager mode), and when returning a skill body from the `skill` tool.
-   * ~4k tokens. Oversized bodies are truncated at a paragraph boundary.
-   *
-   * Consumers: `system-prompt-builder.capSkillBody`, `skill` tool body return.
-   */
-  MAX_SKILL_BODY_CHARS: 16e3,
-  /**
-   * Per-resource cap when the `skill` tool loads a bundled file
-   * (`scripts/`, `references/`, `assets/`). ~8k tokens.
-   *
-   * Consumer: `skill` tool `loadResource`.
-   */
-  MAX_RESOURCE_CHARS: 32e3,
-  /**
-   * Maximum number of bundled resource paths the `skill` tool lists in one
-   * response. Caps a pathological skill (huge `assets/` tree) from blowing up
-   * the tool result.
-   *
-   * Consumer: `skill` tool resource listing.
-   */
-  MAX_LISTED_RESOURCES: 100,
-  /**
-   * Max size of a single installed skill file (SKILL.md or a bundled resource).
-   * Guards against a malicious registry skill shipping a multi-MB blob that
-   * then flows into the prompt. 100KB.
-   *
-   * Consumer: `SkillInstaller.install` / `importFromDir`.
-   */
-  MAX_SKILL_FILE_SIZE: 100 * 1024,
-  /**
-   * Max size of a GitHub tarball downloaded by the skill installer. Guards
-   * against a repo accidentally (or maliciously) shipping a giant tarball that
-   * would be extracted into a temp dir. 50MB.
-   *
-   * Consumer: `downloadGitHubTarball`.
-   */
-  MAX_TARBALL_SIZE: 50 * 1024 * 1024,
-  /**
-   * Maximum size of a GitHub skill tarball after gzip decompression. The
-   * compressed download limit alone does not protect against highly
-   * compressible archives expanding until the process runs out of memory.
-   *
-   * Consumer: `downloadGitHubTarball`.
-   */
-  MAX_UNCOMPRESSED_TARBALL_SIZE: 64 * 1024 * 1024,
-  /**
-   * Default total char budget for skill bodies injected in eager mode when
-   * `config.skills.eagerMaxChars` is unset. ~6k tokens. Skills are injected
-   * highest-priority first; once the budget is exhausted the remaining skills
-   * are listed as a manifest the agent loads via the `skill` tool. Set very
-   * high to effectively disable budgeting.
-   *
-   * Consumer: `DefaultSystemPromptBuilder.buildMemoryAndSkills` (default for
-   * `skillEagerMaxChars`).
-   */
-  EAGER_DEFAULT_MAX_CHARS: 24e3,
-  /**
-   * Default total char budget for compact (token-saving) skill bodies injected
-   * by `buildCompactSkillBodiesText`. Mirrors the eager ceiling so compact mode
-   * can never inject more total skill text than eager mode. Before this bound
-   * existed, compact mode injected EVERY skill's compact body with no cap, so
-   * the section grew linearly with the number of installed skills. Skills past
-   * the budget overflow to a name list the agent loads via the `skill` tool.
-   *
-   * Consumer: `buildCompactSkillBodiesText` (default for its `budget` param).
-   */
-  COMPACT_DEFAULT_MAX_CHARS: 24e3,
-  /**
-   * Auto-compact body limits (the token-saving fallback used when a skill has
-   * no hand-crafted `SKILL.save.md`). The Overview and Rules sections are
-   * extracted and trimmed to these char budgets, then the total is capped.
-   *
-   * Consumer: `DefaultSkillLoader.compactSkillBody`.
-   */
-  COMPACT_OVERVIEW_MAX: 200,
-  COMPACT_RULES_MAX: 350,
-  COMPACT_TOTAL_MAX: 450,
-  /**
-   * Max length of a skill name (agentskills.io spec). Enforced by the
-   * frontmatter validator's format regex plus this length bound.
-   *
-   * Consumer: `isValidSkillNameFormat`.
-   */
-  SKILL_NAME_MAX_LEN: 64,
-  /**
-   * Soft line limit for a SKILL.md body, per the bundled `skill-creator` rule.
-   * Not enforced in code (a skill can exceed it) — surfaced by `/skill-gen
-   * validate` and the `skill-creator` skill as guidance to move deep material
-   * into `references/`.
-   *
-   * Consumer: `skill-creator` skill, `/skill-gen validate` advisory.
-   */
-  SKILL_BODY_LINE_LIMIT: 500
-};
-
-// src/skills/github-fetcher.ts
-function parseSkillRef(input) {
-  const trimmed = input.trim().replace(/^https?:\/\/github\.com\//, "").replace(/\.git$/, "");
-  const atIdx = trimmed.indexOf("@");
-  let refPath;
-  let ref;
-  if (atIdx > 0) {
-    refPath = trimmed.slice(0, atIdx);
-    ref = trimmed.slice(atIdx + 1);
-  } else {
-    refPath = trimmed;
-    ref = "main";
-  }
-  const parts = refPath.split("/").filter(Boolean);
-  if (parts.length < 2) {
-    throw new WrongStackError({
-      message: `Invalid skill reference "${input}". Expected format: user/repo or user/repo@ref`,
-      code: ERROR_CODES.UNKNOWN,
-      subsystem: "general",
-      context: { input }
-    });
-  }
-  return { owner: expectDefined(parts[0]), repo: expectDefined(parts[1]), ref };
-}
-async function writeBoundedGzipStream(source, outputPath, maxBytes, maxCompressedBytes = SKILL_LIMITS.MAX_TARBALL_SIZE) {
-  let compressedBytes = 0;
-  let writtenBytes = 0;
-  await pipeline(
-    source,
-    async function* (chunks) {
-      for await (const chunk of chunks) {
-        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-        compressedBytes += buffer.byteLength;
-        if (compressedBytes > maxCompressedBytes) {
-          throw new WrongStackError({
-            message: `Compressed tarball too large. Max: ${maxCompressedBytes / 1024 / 1024}MB`,
-            code: ERROR_CODES.UNKNOWN,
-            subsystem: "general",
-            context: { compressedBytes, maxBytes: maxCompressedBytes }
-          });
-        }
-        yield buffer;
-      }
-    },
-    createGunzip(),
-    async function* (chunks) {
-      for await (const chunk of chunks) {
-        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-        writtenBytes += buffer.byteLength;
-        if (writtenBytes > maxBytes) {
-          throw new WrongStackError({
-            message: `Uncompressed tarball too large. Max: ${maxBytes / 1024 / 1024}MB`,
-            code: ERROR_CODES.UNKNOWN,
-            subsystem: "general",
-            context: { uncompressedBytes: writtenBytes, maxBytes }
-          });
-        }
-        yield buffer;
-      }
-    },
-    createWriteStream(outputPath, { flags: "wx" })
-  );
-  return writtenBytes;
-}
-function resolveGitHubToken(env = process.env) {
-  const raw = env["WRONGSTACK_GITHUB_TOKEN"] ?? env["GITHUB_TOKEN"] ?? env["GH_TOKEN"];
-  if (!raw) return void 0;
-  const trimmed = raw.trim();
-  return trimmed.length > 0 ? trimmed : void 0;
-}
-async function downloadGitHubTarball(parsed) {
-  const url = `https://api.github.com/repos/${parsed.owner}/${parsed.repo}/tarball/${parsed.ref}`;
-  const token = resolveGitHubToken();
-  const headers = {
-    Accept: "application/vnd.github+json",
-    "User-Agent": "wrongstack-skill-installer"
-  };
-  if (token) headers["Authorization"] = `Bearer ${token}`;
-  let response;
-  try {
-    response = await fetch(url, {
-      signal: AbortSignal.timeout(3e4),
-      headers,
-      redirect: "follow"
-    });
-  } catch (err) {
-    throw new FetchError({
-      message: `Network error fetching ${parsed.owner}/${parsed.repo}: ${err instanceof Error ? err.message : String(err)}`,
-      status: 0,
-      context: { owner: parsed.owner, repo: parsed.repo, ref: parsed.ref, op: "tarball" },
-      cause: err
-    });
-  }
-  if (!response.ok) {
-    if (response.status === 404) {
-      throw new WrongStackError({
-        message: `Repository not found: ${parsed.owner}/${parsed.repo}` + (parsed.ref !== "main" ? ` (ref: ${parsed.ref})` : "") + (token ? "" : ". If this is a private repo, set GITHUB_TOKEN (or GH_TOKEN)."),
-        code: ERROR_CODES.UNKNOWN,
-        subsystem: "general",
-        context: { owner: parsed.owner, repo: parsed.repo, ref: parsed.ref, status: 404 }
-      });
-    }
-    if (response.status === 403) {
-      const remaining = response.headers.get("x-ratelimit-remaining");
-      const isRateLimited = remaining === "0";
-      throw new WrongStackError({
-        message: isRateLimited ? `GitHub API rate limit exceeded. Set GITHUB_TOKEN (or GH_TOKEN) to use the higher authenticated limit.` : `Access denied: ${parsed.owner}/${parsed.repo}. The repository may be private (set GITHUB_TOKEN to install private repos) or rate-limited.`,
-        code: ERROR_CODES.UNKNOWN,
-        subsystem: "general",
-        context: {
-          owner: parsed.owner,
-          repo: parsed.repo,
-          status: 403,
-          rateLimited: isRateLimited,
-          hasToken: Boolean(token)
-        }
-      });
-    }
-    throw new WrongStackError({
-      message: `GitHub API error (${response.status}): ${response.statusText}`,
-      code: ERROR_CODES.UNKNOWN,
-      subsystem: "general",
-      context: { owner: parsed.owner, repo: parsed.repo, status: response.status }
-    });
-  }
-  const contentLength = response.headers.get("content-length");
-  if (contentLength && Number.parseInt(contentLength, 10) > SKILL_LIMITS.MAX_TARBALL_SIZE) {
-    throw new WrongStackError({
-      message: `Tarball too large (${(Number.parseInt(contentLength, 10) / 1024 / 1024).toFixed(1)}MB). Max: ${SKILL_LIMITS.MAX_TARBALL_SIZE / 1024 / 1024}MB`,
-      code: ERROR_CODES.UNKNOWN,
-      subsystem: "general",
-      context: {
-        owner: parsed.owner,
-        repo: parsed.repo,
-        contentLengthBytes: Number.parseInt(contentLength, 10),
-        maxBytes: SKILL_LIMITS.MAX_TARBALL_SIZE
-      }
-    });
-  }
-  const tempDir = await fs.mkdtemp(path.join(os.tmpdir(), "wskill-"));
-  try {
-    if (!response.body) {
-      throw new WrongStackError({
-        message: "Empty response body from GitHub API",
-        code: ERROR_CODES.UNKNOWN,
-        subsystem: "general",
-        context: { owner: parsed.owner, repo: parsed.repo }
-      });
-    }
-    const nodeStream = Readable.fromWeb(response.body);
-    const tarPath = path.join(tempDir, ".wrongstack-download.tar");
-    await writeBoundedGzipStream(nodeStream, tarPath, SKILL_LIMITS.MAX_UNCOMPRESSED_TARBALL_SIZE);
-    const tarBuf = await fs.readFile(tarPath);
-    try {
-      await extractTar(tarBuf, tempDir);
-    } finally {
-      await fs.rm(tarPath, { force: true });
-    }
-    return { tempDir };
-  } catch (err) {
-    await fs.rm(tempDir, { recursive: true, force: true }).catch(() => {
-    });
-    throw err;
-  }
-}
-function readTarSize(buf, start) {
-  const first = buf[start] ?? 0;
-  if ((first & 128) !== 0) {
-    if (first === 255) {
-      throw new Error("tar: negative base-256 size field");
-    }
-    let value = first & 127;
-    for (let i = start + 1; i < start + 12; i++) {
-      value = value * 256 + (buf[i] ?? 0);
-      if (!Number.isSafeInteger(value)) {
-        throw new Error("tar: base-256 size exceeds the safe integer range");
-      }
-    }
-    return value;
-  }
-  const text = readTarString(buf, start, 12).trim();
-  if (text === "") return 0;
-  if (!/^[0-7]+$/.test(text)) {
-    throw new Error(`tar: unparseable size field ${JSON.stringify(text)}`);
-  }
-  const parsed = Number.parseInt(text, 8);
-  if (!Number.isSafeInteger(parsed) || parsed < 0) {
-    throw new Error("tar: size field out of range");
-  }
-  return parsed;
-}
-function readTarString(buf, start, maxLen) {
-  let end = start;
-  while (end < start + maxLen && end < buf.length && buf[end] !== 0) {
-    end++;
-  }
-  return buf.subarray(start, end).toString("utf8");
-}
-function stripTopDir(p) {
-  const idx = p.indexOf("/");
-  if (idx === -1) return "";
-  return p.slice(idx + 1);
-}
-async function extractTar(buf, destDir) {
-  let offset = 0;
-  while (offset + 512 <= buf.length) {
-    const header = buf.subarray(offset, offset + 512);
-    if (header.every((b) => b === 0)) break;
-    const name = readTarString(buf, offset, 100);
-    const prefix = readTarString(buf, offset + 345, 155);
-    const size = readTarSize(buf, offset + 124);
-    const typeflag = buf[offset + 156] ?? 0;
-    const fullPath = prefix ? `${prefix}/${name}` : name;
-    const relPath = stripTopDir(fullPath);
-    if (relPath && relPath !== "." && relPath !== "..") {
-      const destPath = path.join(destDir, relPath);
-      const resolvedDest = path.resolve(destPath);
-      const resolvedRoot = path.resolve(destDir);
-      if (resolvedDest !== resolvedRoot && !resolvedDest.startsWith(resolvedRoot + path.sep)) {
-        offset += 512 + Math.ceil(size / 512) * 512;
-        continue;
-      }
-      if (typeflag === 53 || typeflag === 0) {
-        if (relPath.endsWith("/") || typeflag === 53) {
-          await fs.mkdir(destPath, { recursive: true });
-        }
-      }
-      if ((typeflag === 48 || typeflag === 0 || typeflag === 0) && size > 0) {
-        const dir = path.dirname(destPath);
-        await fs.mkdir(dir, { recursive: true });
-        const dataStart = offset + 512;
-        const dataEnd = dataStart + size;
-        if (dataEnd > buf.length) break;
-        await fs.writeFile(destPath, buf.subarray(dataStart, dataEnd));
-      }
-    }
-    offset += 512 + Math.ceil(size / 512) * 512;
-  }
-}
-
-// src/skills/manifest-store.ts
-import * as fs2 from "node:fs/promises";
-import * as path2 from "node:path";
-
-// src/utils/atomic-write.ts
+import "../chunk-GTCU6DZ3.js";
 import {
-  createPersistencePrimitives
-} from "@wrongstack/persistence";
-var primitives = createPersistencePrimitives({
-  createLockTimeoutError: ({ targetPath, timeoutMs }) => new FsError({
-    message: `Timed out waiting for file lock: ${targetPath}`,
-    code: "FS_ATOMIC_WRITE_FAILED",
-    path: targetPath,
-    context: { timeoutMs }
-  })
-});
-var atomicWrite = primitives.atomicWrite;
-var atomicReplaceWithWriter = primitives.atomicReplaceWithWriter;
-var ensureDir = primitives.ensureDir;
-var withFileLock = primitives.withFileLock;
-
-// src/skills/manifest-store.ts
-var SkillManifestStore = class {
-  manifestPath;
-  cache;
-  constructor(manifestPath) {
-    this.manifestPath = manifestPath;
-  }
-  async read() {
-    if (this.cache) return this.cache;
-    try {
-      const raw = await fs2.readFile(this.manifestPath, "utf8");
-      const data = JSON.parse(raw);
-      if (!Array.isArray(data.skills)) {
-        this.cache = { skills: [] };
-      } else {
-        this.cache = data;
-      }
-    } catch {
-      this.cache = { skills: [] };
-    }
-    return this.cache;
-  }
-  async write(data) {
-    const dir = path2.dirname(this.manifestPath);
-    await fs2.mkdir(dir, { recursive: true });
-    await atomicWrite(this.manifestPath, JSON.stringify(data, null, 2) + "\n");
-    this.cache = data;
-  }
-  async addEntry(entry) {
-    const data = await this.read();
-    data.skills = data.skills.filter((s) => !(s.name === entry.name && s.scope === entry.scope));
-    data.skills.push(entry);
-    await this.write(data);
-  }
-  async removeEntry(name, scope) {
-    const data = await this.read();
-    const before = data.skills.length;
-    data.skills = data.skills.filter((s) => !(s.name === name && s.scope === scope));
-    if (data.skills.length === before) return false;
-    await this.write(data);
-    return true;
-  }
-  async findByName(name) {
-    const data = await this.read();
-    return data.skills.filter((s) => s.name === name);
-  }
-  async findBySource(source) {
-    const data = await this.read();
-    return data.skills.filter((s) => s.source === source);
-  }
-  async listAll() {
-    const data = await this.read();
-    return data.skills;
-  }
-  /** Invalidate the in-memory cache (e.g. after external file changes). */
-  invalidateCache() {
-    this.cache = void 0;
-  }
-};
-
-// src/skills/registry/github-direct-adapter.ts
-var githubDirectAdapter = {
-  id: "github",
-  displayName: "GitHub (direct)",
-  async search(_query, _opts = {}) {
-    return { adapterId: "github", results: [], hasMore: false };
-  },
-  resolveInstallRef(registryId) {
-    const trimmed = registryId.trim();
-    if (!trimmed.includes("/")) {
-      return trimmed;
-    }
-    return trimmed;
-  }
-};
-
-// src/skills/registry/skills-sh-adapter.ts
-var DEFAULT_SKILLS_SH_URL = "https://skills.sh";
-var SEARCH_TIMEOUT_MS = 15e3;
-var MAX_PAGE_SIZE = 50;
-var defaultFetcher = async (url) => {
-  let res;
-  try {
-    res = await fetch(url, {
-      signal: AbortSignal.timeout(SEARCH_TIMEOUT_MS),
-      headers: {
-        Accept: "application/json",
-        "User-Agent": "wrongstack-skill-installer"
-      },
-      redirect: "follow"
-    });
-  } catch (err) {
-    throw new FetchError({
-      message: `Network error querying skill registry: ${err instanceof Error ? err.message : String(err)}`,
-      status: 0,
-      context: { url, op: "skills.sh.search" },
-      cause: err
-    });
-  }
-  if (!res.ok) {
-    throw new FetchError({
-      message: `Skill registry returned ${res.status} ${res.statusText}`,
-      status: res.status,
-      context: { url, op: "skills.sh.search" }
-    });
-  }
-  try {
-    return await res.json();
-  } catch (err) {
-    throw new ParseError({
-      message: `Skill registry response was not valid JSON: ${err instanceof Error ? err.message : String(err)}`,
-      source: "skills.sh.search",
-      context: { url },
-      cause: err
-    });
-  }
-};
-function createSkillsShAdapter(opts = {}) {
-  const baseUrl = (opts.baseUrl ?? DEFAULT_SKILLS_SH_URL).replace(/\/+$/, "");
-  const fetcher = opts.fetcher ?? defaultFetcher;
-  const id = "skills.sh";
-  return {
-    id,
-    displayName: "skills.sh",
-    async search(query, sopts = {}) {
-      const page = Math.max(1, sopts.page ?? 1);
-      const pageSize = Math.min(MAX_PAGE_SIZE, Math.max(1, sopts.pageSize ?? 20));
-      const q = query.trim();
-      if (!q) return { adapterId: id, results: [], hasMore: false };
-      const url = `${baseUrl}/api/skills?query=${encodeURIComponent(q)}&page=${page}&pageSize=${pageSize}&sortBy=installs`;
-      const raw = await fetcher(url);
-      const results = parseResults(raw, url);
-      return {
-        adapterId: id,
-        results,
-        hasMore: results.length === pageSize
-      };
-    },
-    resolveInstallRef(registryId) {
-      const trimmed = registryId.trim();
-      if (!trimmed) {
-        throw new ParseError({
-          message: "Empty skills.sh registry id.",
-          source: "skills.sh.resolveInstallRef"
-        });
-      }
-      const atIdx = trimmed.indexOf("@");
-      const repoPart = atIdx > 0 ? trimmed.slice(0, atIdx) : trimmed;
-      const segs = repoPart.split("/").filter(Boolean);
-      if (segs.length !== 2) {
-        throw new ParseError({
-          message: `Invalid skills.sh id "${registryId}". Expected "<owner>/<repo>" or "<owner>/<repo>@<ref>".`,
-          source: "skills.sh.resolveInstallRef",
-          context: { registryId }
-        });
-      }
-      return trimmed;
-    }
-  };
-}
-function parseResults(raw, url) {
-  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
-    throw new ParseError({
-      message: "Skill registry response was not a JSON object.",
-      source: "skills.sh.search",
-      context: { url }
-    });
-  }
-  const results = raw.results;
-  if (!Array.isArray(results)) {
-    return [];
-  }
-  const out = [];
-  for (let i = 0; i < results.length; i++) {
-    const entry = results[i];
-    if (!entry || typeof entry !== "object") continue;
-    const name = strField(entry, "name") ?? strField(entry, "slug");
-    const description = strField(entry, "description") ?? "";
-    const owner = strField(entry, "owner") ?? strField(entry, "author");
-    const repo = strField(entry, "repo") ?? strField(entry, "repository");
-    if (!name || !owner || !repo) continue;
-    const ref = strField(entry, "ref") ?? strField(entry, "branch") ?? strField(entry, "tag");
-    const installRef = ref ? `${owner}/${repo}@${ref}` : `${owner}/${repo}`;
-    out.push({
-      id: strField(entry, "id") ?? `${owner}/${repo}`,
-      name,
-      description,
-      author: owner,
-      installs: numField(entry, "installs") ?? numField(entry, "installCount"),
-      stars: numField(entry, "stars") ?? numField(entry, "starCount"),
-      securityScore: numField(entry, "securityScore") ?? numField(entry, "score"),
-      updatedAt: strField(entry, "updatedAt") ?? strField(entry, "updated_at"),
-      installRef
-    });
-  }
-  return out;
-}
-function strField(rec, key) {
-  const v = rec[key];
-  return typeof v === "string" && v.length > 0 ? v : void 0;
-}
-function numField(rec, key) {
-  const v = rec[key];
-  if (typeof v === "number" && Number.isFinite(v)) return v;
-  if (typeof v === "string" && /^\d+(\.\d+)?$/.test(v.trim())) {
-    const n = Number(v);
-    if (Number.isFinite(n)) return n;
-  }
-  return void 0;
-}
-
-// src/skills/skill-generator.ts
-import { spawn } from "node:child_process";
-import * as fs3 from "node:fs/promises";
-import * as path3 from "node:path";
-
-// src/utils/win32-cmd.ts
-var WIN32_CMD_META = /[&|<>"%\r\n\0]/;
-function buildWin32CmdShimInvocation(command, args = []) {
-  assertSafeWin32CmdArgs([command, ...args]);
-  const line = ["call", quoteWin32CmdArg(command), ...args.map(quoteWin32CmdArg)].join(" ");
-  return {
-    command: process.env["COMSPEC"] ?? "cmd.exe",
-    args: ["/d", "/c", line],
-    windowsVerbatimArguments: true
-  };
-}
-function assertSafeWin32CmdArgs(args) {
-  for (const arg of args) {
-    if (typeof arg === "string" && WIN32_CMD_META.test(arg)) {
-      throw new Error(
-        'win32 cmd shim spawn: argument contains a shell metacharacter (one of & | < > ", or a newline) that could enable command injection through the .cmd/.bat wrapper - refusing to run. Offending argument: ' + JSON.stringify(arg)
-      );
-    }
-  }
-}
-function quoteWin32CmdArg(arg) {
-  return `"${arg}"`;
-}
-
-// src/skills/skill-generator.ts
-async function validateSkillNameAvailable(name, loader) {
-  const formatViolations = validateSkillName(name);
-  const conflicts = loader ? (await loader.listEntries()).filter((e) => e.name === name) : [];
-  const formatOk = formatViolations.length === 0;
-  const collisionBlocks = conflicts.some((c) => c.source === "project" || c.source === "user");
-  return {
-    ok: formatOk && !collisionBlocks,
-    formatViolations,
-    conflicts
-  };
-}
-function generateSkillSkeleton(opts) {
-  const name = opts.name.trim();
-  if (!isValidSkillNameFormat(name)) {
-    throw new WrongStackError({
-      message: `Cannot generate skeleton: invalid skill name "${name}". Names must be kebab-case (a-z0-9 and hyphens), \u226464 chars.`,
-      code: ERROR_CODES.VALIDATION_ERROR,
-      subsystem: "general",
-      context: { name }
-    });
-  }
-  const description = opts.description.trim();
-  const triggers = (opts.triggerKeywords ?? []).map((k) => k.trim()).filter(Boolean).map((k) => `"${k}"`).join(", ");
-  const triggerLine = triggers ? `
-  Triggers: user says ${triggers}.` : "";
-  const version = opts.version?.trim() || "1.0.0";
-  const title = name.split("-").map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join(" ");
-  return `---
-name: ${name}
-description: |
-  ${description || `Use this skill when <trigger situation>.`}${triggerLine}
-version: ${version}
----
-
-# ${title}
-
-## Overview
-
-${description || "One-line description of what this skill does."}
-
-## Rules
-
-1. Rule one
-2. Rule two
-
-## Patterns
-
-### Do
-
-\`\`\`ts
-// good example
-\`\`\`
-
-### Don't
-
-\`\`\`ts
-// bad example
-\`\`\`
-
-## Skills in scope
-
-- \`other-skill\` \u2014 for delegation when this skill needs help
-`;
-}
-function extractSkillFromPrompt(prompt) {
-  const text = prompt.trim();
-  if (!text) {
-    return { suggestedName: "", description: "", body: "", triggerKeywords: [] };
-  }
-  const headingMatch = text.match(/^#{1,6}\s+(.+?)\s*$/m);
-  const firstLine = text.split("\n").find((l) => l.trim().length > 0)?.trim() ?? text;
-  const titleSource = headingMatch?.[1] ?? firstLine.replace(/^#+\s*/, "");
-  const suggestedName = toKebab(titleSource).slice(0, SKILL_LIMITS.SKILL_NAME_MAX_LEN);
-  const paragraphs = text.split(/\n\s*\n/).map((p) => p.trim()).filter(Boolean);
-  const description = paragraphs[0]?.replace(/^#{1,6}\s+/m, "").trim() ?? titleSource;
-  const body = paragraphs.slice(1).join("\n\n");
-  const quoted = [...text.matchAll(/"([^"]{2,40})"/g)].map((m) => m[1]).filter((q) => typeof q === "string").map((q) => q.toLowerCase());
-  const titleWords = titleSource.split(/\W+/).map((w) => w.toLowerCase()).filter((w) => w.length > 3 && !STOPWORDS.has(w));
-  const triggerKeywords = dedupe([...quoted, ...titleWords]).slice(0, 8);
-  return { suggestedName, description, body, triggerKeywords };
-}
-async function openInEditor(filePath, env = process.env) {
-  const editor = env["VISUAL"]?.trim() && env["VISUAL"] || env["EDITOR"]?.trim() && env["EDITOR"] || defaultEditor();
-  if (!editor) {
-    throw new WrongStackError({
-      message: "No editor found. Set the EDITOR or VISUAL environment variable (e.g. `export EDITOR=code` or `export EDITOR=vim`).",
-      code: ERROR_CODES.VALIDATION_ERROR,
-      subsystem: "general",
-      context: { filePath }
-    });
-  }
-  const shell = process.platform === "win32";
-  const parts = editor.split(/\s+/).filter(Boolean);
-  if (parts.length === 0) {
-    throw new WrongStackError({
-      message: "Resolved editor command is empty.",
-      code: ERROR_CODES.VALIDATION_ERROR,
-      subsystem: "general",
-      context: { filePath }
-    });
-  }
-  const editorArgs = [...parts.slice(1), filePath];
-  const child = shell ? (() => {
-    const inv = buildWin32CmdShimInvocation(parts[0], editorArgs);
-    return spawn(inv.command, inv.args, {
-      stdio: "ignore",
-      detached: true,
-      windowsVerbatimArguments: inv.windowsVerbatimArguments,
-      // Suppresses the console flash the cmd.exe wrapper would otherwise
-      // show before the editor appears. Repo convention — see
-      // `core/tests/architecture/spawn-convention.test.ts`.
-      windowsHide: true
-    });
-  })() : spawn(parts[0], editorArgs, {
-    stdio: "ignore",
-    detached: true,
-    windowsHide: true
-  });
-  child.unref();
-}
-async function writeSkeletonSkill(skillsDir, body, opts = {}) {
-  const fm = parseSkillFrontmatter(body);
-  const name = fm.name;
-  if (!name || !isValidSkillNameFormat(name)) {
-    throw new WrongStackError({
-      message: "Skeleton body has no valid `name` in its frontmatter.",
-      code: ERROR_CODES.VALIDATION_ERROR,
-      subsystem: "general"
-    });
-  }
-  const skillDir = path3.join(skillsDir, name);
-  const skillFile = path3.join(skillDir, "SKILL.md");
-  if (!opts.overwrite) {
-    try {
-      await fs3.access(skillFile);
-      throw new WrongStackError({
-        message: `A skill already exists at ${skillFile}. Use --force to overwrite.`,
-        code: ERROR_CODES.VALIDATION_ERROR,
-        subsystem: "general",
-        context: { skillFile }
-      });
-    } catch (err) {
-      if (err instanceof WrongStackError) throw err;
-    }
-  }
-  await fs3.mkdir(skillDir, { recursive: true });
-  await fs3.writeFile(skillFile, body, "utf8");
-  return skillFile;
-}
-function bodyLineAdvisory(body) {
-  const lines = body.split("\n").length;
-  return { lines, over: lines > SKILL_LIMITS.SKILL_BODY_LINE_LIMIT };
-}
-var STOPWORDS = /* @__PURE__ */ new Set([
-  "the",
-  "and",
-  "for",
-  "with",
-  "that",
-  "this",
-  "from",
-  "your",
-  "have",
-  "will",
-  "are",
-  "was",
-  "were",
-  "been",
-  "into",
-  "when",
-  "use",
-  "skill",
-  "about"
-]);
-function toKebab(s) {
-  return s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, SKILL_LIMITS.SKILL_NAME_MAX_LEN) || "skill";
-}
-function dedupe(arr) {
-  return [...new Set(arr)];
-}
-function defaultEditor() {
-  if (process.platform === "win32") return "notepad";
-  if (process.platform === "darwin") return "open";
-  return void 0;
-}
-
-// src/skills/skill-installer.ts
-import * as fs4 from "node:fs/promises";
-import * as path4 from "node:path";
-function isInside(resolved, destDir) {
-  const root = path4.resolve(destDir);
-  return resolved === root || resolved.startsWith(root + path4.sep);
-}
-var MAX_SKILL_FILE_SIZE = SKILL_LIMITS.MAX_SKILL_FILE_SIZE;
-var SkillInstaller = class {
-  opts;
-  manifest;
-  adapters;
-  constructor(opts) {
-    this.opts = opts;
-    this.manifest = new SkillManifestStore(opts.manifestPath);
-    this.adapters = opts.registryAdapters?.length ? opts.registryAdapters : [githubDirectAdapter];
-  }
-  /**
-   * Install skills from a skill reference.
-   *
-   * Accepts two ref formats:
-   *   - `user/repo[@ref]`               — direct GitHub install (original path)
-   *   - `<adapterId>:<registryId>`      — registry-resolved (e.g.
-   *                                       `skills.sh:owner/repo@v1`); the
-   *                                       adapter resolves it to a `user/repo`
-   *                                       ref and the install proceeds as above.
-   *
-   * Supports both single-skill repos (SKILL.md at root) and multi-skill repos
-   * (skills/ subdirectory). The manifest records the GitHub source as
-   * `github:owner/repo` (so `/skill-update` keeps working) plus the originating
-   * registry in `registryFrom` when the install came through a registry.
-   */
-  async install(refInput, opts) {
-    const resolved = this.resolveRef(refInput);
-    const parsed = parseSkillRef(resolved.installRef);
-    const scope = opts?.global ? "user" : "project";
-    const targetDir = scope === "project" ? this.opts.projectSkillsDir : this.opts.globalSkillsDir;
-    const source = `github:${parsed.owner}/${parsed.repo}`;
-    this.opts.log?.(
-      resolved.fromRegistry ? `Resolving ${refInput} \u2192 ${resolved.installRef} (${resolved.adapterId}), downloading...` : `Downloading ${parsed.owner}/${parsed.repo}@${parsed.ref}...`
-    );
-    const { tempDir } = await downloadGitHubTarball(parsed);
-    try {
-      const skills = await this.detectSkills(tempDir);
-      if (skills.length === 0) {
-        throw new WrongStackError({
-          message: "No skills found in repository. Expected SKILL.md at root or skills/ subdirectory.",
-          code: ERROR_CODES.VALIDATION_ERROR,
-          subsystem: "general",
-          context: { owner: parsed.owner, repo: parsed.repo, ref: parsed.ref }
-        });
-      }
-      const results = [];
-      for (const skill of skills) {
-        const existing = await this.manifest.findByName(skill.name);
-        const existingInScope = existing.find((e) => e.scope === scope);
-        if (existingInScope) {
-          this.opts.log?.(`Overwriting existing skill "${skill.name}" (${scope})...`);
-          await this.removeSkillFiles(skill.name, scope);
-        }
-        const destDir = path4.join(targetDir, skill.name);
-        await fs4.mkdir(destDir, { recursive: true });
-        const copiedFiles = [];
-        for (const file of skill.files) {
-          const srcPath = path4.join(skill.baseDir, file);
-          const destPath = path4.join(destDir, file);
-          const resolved2 = path4.resolve(destPath);
-          if (!isInside(resolved2, destDir)) {
-            throw new FsError({
-              message: `Path traversal detected in skill file: ${file}`,
-              code: ERROR_CODES.FS_DELETE_FAILED,
-              path: destPath,
-              context: { reason: "path_traversal", skillName: skill.name }
-            });
-          }
-          const stat2 = await fs4.stat(srcPath);
-          if (stat2.size > MAX_SKILL_FILE_SIZE) {
-            throw new FsError({
-              message: `Skill file "${file}" is too large (${(stat2.size / 1024).toFixed(1)}KB). Max: ${MAX_SKILL_FILE_SIZE / 1024}KB`,
-              code: ERROR_CODES.FS_WRITE_FAILED,
-              path: srcPath,
-              context: { skillName: skill.name, fileSize: stat2.size, maxSize: MAX_SKILL_FILE_SIZE }
-            });
-          }
-          await fs4.mkdir(path4.dirname(destPath), { recursive: true });
-          await fs4.copyFile(srcPath, destPath);
-          copiedFiles.push(file);
-        }
-        const entry = {
-          name: skill.name,
-          source,
-          ref: parsed.ref,
-          scope,
-          projectHash: scope === "project" ? this.opts.projectHash : void 0,
-          installedAt: (/* @__PURE__ */ new Date()).toISOString(),
-          files: copiedFiles,
-          // When the install came through a registry (e.g. skills.sh), record
-          // which adapter + registry id resolved to this GitHub repo, so the
-          // source is traceable. `source` stays `github:owner/repo` for
-          // backward compat with `/skill-update`.
-          ...resolved.fromRegistry ? { registryFrom: { adapterId: resolved.adapterId, registryId: resolved.registryId } } : {}
-        };
-        await this.manifest.addEntry(entry);
-        results.push({
-          name: skill.name,
-          path: destDir,
-          scope,
-          source,
-          ref: parsed.ref,
-          skillCount: 1
-        });
-      }
-      this.invalidateLoaderCache();
-      return results;
-    } finally {
-      await fs4.rm(tempDir, { recursive: true, force: true }).catch(() => {
-      });
-    }
-  }
-  /**
-   * Import skills from a local directory (e.g. `.claude/skills`) into the
-   * project or user skills dir, optionally as symlinks. Used by `/skill-import`
-   * to take ownership of foreign skills so they can be edited/committed.
-   * Each direct subdirectory containing a valid `SKILL.md` is copied verbatim.
-   */
-  async importFromDir(srcDir, opts) {
-    const scope = opts?.global ? "user" : "project";
-    const targetDir = scope === "project" ? this.opts.projectSkillsDir : this.opts.globalSkillsDir;
-    let entries;
-    try {
-      entries = await fs4.readdir(srcDir, { withFileTypes: true });
-    } catch {
-      throw new WrongStackError({
-        message: `Source directory not found or not readable: ${srcDir}`,
-        code: ERROR_CODES.VALIDATION_ERROR,
-        subsystem: "general",
-        context: { srcDir }
-      });
-    }
-    const results = [];
-    for (const e of entries) {
-      if (!await entryIsDirectory(srcDir, e)) continue;
-      const skillMdPath = path4.join(srcDir, e.name, "SKILL.md");
-      let content;
-      try {
-        content = await fs4.readFile(skillMdPath, "utf8");
-      } catch {
-        continue;
-      }
-      const fm = parseSkillFrontmatter(content);
-      if (!fm.name || !fm.description || !isValidSkillNameFormat(fm.name)) continue;
-      const existing = await this.manifest.findByName(fm.name);
-      if (existing.find((x) => x.scope === scope)) {
-        await this.removeSkillFiles(fm.name, scope);
-      }
-      const destDir = path4.join(targetDir, fm.name);
-      await fs4.mkdir(destDir, { recursive: true });
-      const srcSkillDir = path4.join(srcDir, e.name);
-      const files = await collectFiles(srcSkillDir, srcSkillDir);
-      const copiedFiles = [];
-      for (const file of files) {
-        const srcPath = path4.join(srcSkillDir, file);
-        const destPath = path4.join(destDir, file);
-        const resolved = path4.resolve(destPath);
-        if (!isInside(resolved, destDir)) {
-          throw new FsError({
-            message: `Path traversal detected in skill file: ${file}`,
-            code: ERROR_CODES.FS_DELETE_FAILED,
-            path: destPath,
-            context: { reason: "path_traversal", skillName: fm.name }
-          });
-        }
-        await fs4.mkdir(path4.dirname(destPath), { recursive: true });
-        if (opts?.link) {
-          try {
-            await fs4.symlink(srcPath, destPath);
-          } catch (err) {
-            await fs4.copyFile(srcPath, destPath);
-            this.opts.log?.(`symlink failed for ${file} (${toErrorMessage(err)}); copied instead`);
-          }
-        } else {
-          await fs4.copyFile(srcPath, destPath);
-        }
-        copiedFiles.push(file);
-      }
-      await this.manifest.addEntry({
-        name: fm.name,
-        source: `import:${srcDir}`,
-        ref: "-",
-        scope,
-        projectHash: scope === "project" ? this.opts.projectHash : void 0,
-        installedAt: (/* @__PURE__ */ new Date()).toISOString(),
-        files: copiedFiles
-      });
-      results.push({
-        name: fm.name,
-        path: destDir,
-        scope,
-        source: `import:${srcDir}`,
-        ref: "-",
-        skillCount: 1
-      });
-    }
-    this.invalidateLoaderCache();
-    return results;
-  }
-  /**
-   * Update installed skills.
-   * - No args: update all
-   * - Name: update that specific skill
-   * - Name + newRef: update to a different ref
-   */
-  async update(nameOrRef, _opts) {
-    const result = { updated: [], unchanged: [], errors: [] };
-    const allEntries = await this.manifest.listAll();
-    let targets;
-    if (nameOrRef) {
-      const byName = allEntries.filter((e) => e.name === nameOrRef);
-      if (byName.length > 0) {
-        targets = byName;
-      } else {
-        try {
-          const parsed = parseSkillRef(nameOrRef);
-          const source = `github:${parsed.owner}/${parsed.repo}`;
-          targets = allEntries.filter((e) => e.source === source);
-          if (targets.length === 0) {
-            result.errors.push({
-              name: nameOrRef,
-              error: `No installed skills found matching "${nameOrRef}"`
-            });
-            return result;
-          }
-        } catch {
-          result.errors.push({
-            name: nameOrRef,
-            error: `Invalid reference: ${nameOrRef}`
-          });
-          return result;
-        }
-      }
-    } else {
-      targets = allEntries;
-    }
-    const bySource = /* @__PURE__ */ new Map();
-    for (const entry of targets) {
-      const key = `${entry.source}@${entry.ref}`;
-      if (!bySource.has(key)) bySource.set(key, []);
-      bySource.get(key)?.push(entry);
-    }
-    for (const [, entries] of bySource) {
-      const first = expectDefined(entries[0]);
-      const scope = first.scope;
-      const isGlobal = scope === "user";
-      try {
-        const sourceRepo = first.source.replace("github:", "");
-        let refToInstall = first.ref;
-        if (nameOrRef && !allEntries.find((e) => e.name === nameOrRef)) {
-          try {
-            const parsed = parseSkillRef(nameOrRef);
-            refToInstall = parsed.ref;
-          } catch {
-          }
-        }
-        this.opts.log?.(`Updating ${first.source}@${refToInstall}...`);
-        const results = await this.install(`${sourceRepo}@${refToInstall}`, { global: isGlobal });
-        for (const r of results) {
-          result.updated.push({
-            name: r.name,
-            oldRef: first.ref,
-            newRef: refToInstall
-          });
-        }
-      } catch (err) {
-        const msg = toErrorMessage(err);
-        for (const entry of entries) {
-          result.errors.push({ name: entry.name, error: msg });
-        }
-      }
-    }
-    return result;
-  }
-  /**
-   * Uninstall a skill by name.
-   */
-  async uninstall(name, opts) {
-    const scope = opts?.global ? "user" : "project";
-    const entries = await this.manifest.findByName(name);
-    const entry = entries.find((e) => e.scope === scope);
-    if (!entry) {
-      throw new WrongStackError({
-        message: `Skill "${name}" is not installed${scope === "user" ? " (global)" : ""}.`,
-        code: ERROR_CODES.VALIDATION_ERROR,
-        subsystem: "general",
-        context: { skillName: name, scope }
-      });
-    }
-    await this.removeSkillFiles(name, scope);
-    await this.manifest.removeEntry(name, scope);
-    this.invalidateLoaderCache();
-  }
-  /**
-   * List all installed skills from the manifest.
-   */
-  async listInstalled() {
-    return this.manifest.listAll();
-  }
-  /**
-   * Search across all configured registry adapters. Results from each adapter
-   * are merged (deduplicated by `installRef`, adapters earlier in the list win
-   * conflicts). Adapters that don't support search (e.g. github-direct)
-   * contribute nothing.
-   */
-  async search(query, opts) {
-    const settled = await Promise.allSettled(this.adapters.map((a) => a.search(query, opts)));
-    const perAdapter = [];
-    const errors = [];
-    settled.forEach((s, i) => {
-      if (s.status === "fulfilled") perAdapter.push(s.value);
-      else {
-        const id = this.adapters[i]?.id ?? "?";
-        errors.push(`${id}: ${toErrorMessage(s.reason)}`);
-      }
-    });
-    if (errors.length > 0) {
-      this.opts.log?.(`Some registries failed during search: ${errors.join("; ")}`);
-    }
-    return dedupeSearchResults(perAdapter);
-  }
-  // ── Private helpers ──────────────────────────────────────────────
-  /**
-   * Detect skills in an extracted repository.
-   * Returns an array of detected skills with their files.
-   */
-  async detectSkills(baseDir) {
-    const results = [];
-    const rootSkillMd = path4.join(baseDir, "SKILL.md");
-    try {
-      await fs4.access(rootSkillMd);
-      const content = await fs4.readFile(rootSkillMd, "utf8");
-      const fm = parseSkillFrontmatter(content);
-      if (fm.name && fm.description && isValidSkillNameFormat(fm.name)) {
-        results.push({
-          name: fm.name,
-          baseDir,
-          files: ["SKILL.md"]
-        });
-        return results;
-      }
-    } catch {
-    }
-    const skillsDir = path4.join(baseDir, "skills");
-    try {
-      const entries = await fs4.readdir(skillsDir, { withFileTypes: true });
-      for (const entry of entries) {
-        if (!entry.isDirectory()) continue;
-        const skillFile = path4.join(skillsDir, entry.name, "SKILL.md");
-        try {
-          const content = await fs4.readFile(skillFile, "utf8");
-          const fm = parseSkillFrontmatter(content);
-          if (fm.name && fm.description && isValidSkillNameFormat(fm.name)) {
-            const skillDir = path4.join(skillsDir, entry.name);
-            const files = await collectFiles(skillDir, skillDir);
-            results.push({
-              name: fm.name,
-              baseDir: skillDir,
-              files
-            });
-          }
-        } catch {
-        }
-      }
-    } catch {
-    }
-    return results;
-  }
-  /**
-   * Remove all files for an installed skill.
-   */
-  /**
-   * Delete an installed skill's directory.
-   *
-   * The containment check is not ceremonial: this is a `recursive: true,
-   * force: true` delete whose target is built from a skill NAME taken from
-   * manifest frontmatter. `path.join` normalises `..`, so a crafted name
-   * escapes `targetDir` and takes the recursive delete with it. This file
-   * already had `isInside` and applied it on the copy path but not here.
-   *
-   * The strict-subdirectory requirement matters separately: `isInside` allows
-   * equality by design, and an empty or `.` name resolves `skillDir` to
-   * `targetDir` itself — deleting every installed skill (WS-097).
-   */
-  async removeSkillFiles(name, scope) {
-    const targetDir = scope === "project" ? this.opts.projectSkillsDir : this.opts.globalSkillsDir;
-    const root = path4.resolve(targetDir);
-    const skillDir = path4.resolve(path4.join(targetDir, name));
-    if (skillDir === root || !isInside(skillDir, root)) {
-      throw new FsError({
-        message: `Refusing to delete skill files outside the skills directory: ${name}`,
-        code: ERROR_CODES.FS_DELETE_FAILED,
-        path: skillDir,
-        context: { reason: "path_traversal", skillName: name, scope }
-      });
-    }
-    await fs4.rm(skillDir, { recursive: true, force: true });
-  }
-  /**
-   * Invalidate the skill loader's cache so newly installed skills appear.
-   */
-  invalidateLoaderCache() {
-    const loader = this.opts.skillLoader;
-    if (loader && typeof loader.invalidateCache === "function") {
-      loader.invalidateCache();
-    }
-  }
-  /**
-   * Resolve an install ref, dispatching registry-prefixed refs to the matching
-   * adapter. Returns the concrete `user/repo[@ref]` install ref plus provenance
-   * (which adapter resolved it, if any).
-   */
-  resolveRef(refInput) {
-    const trimmed = refInput.trim();
-    const colonIdx = trimmed.indexOf(":");
-    if (colonIdx > 0) {
-      const maybeAdapterId = trimmed.slice(0, colonIdx);
-      const adapter = this.adapters.find((a) => a.id === maybeAdapterId);
-      if (adapter) {
-        const registryId = trimmed.slice(colonIdx + 1);
-        const installRef = adapter.resolveInstallRef(registryId);
-        return { installRef, fromRegistry: true, adapterId: adapter.id, registryId };
-      }
-    }
-    return { installRef: trimmed, fromRegistry: false, adapterId: "", registryId: "" };
-  }
-};
-async function entryIsDirectory(dir, entry) {
-  if (entry.isDirectory()) return true;
-  if (entry.isSymbolicLink()) {
-    try {
-      return (await fs4.stat(path4.join(dir, entry.name))).isDirectory();
-    } catch {
-      return false;
-    }
-  }
-  return false;
-}
-async function collectFiles(dir, baseDir) {
-  const results = [];
-  const entries = await fs4.readdir(dir, { withFileTypes: true });
-  for (const entry of entries) {
-    const fullPath = path4.join(dir, entry.name);
-    const relPath = path4.relative(baseDir, fullPath);
-    if (entry.isDirectory()) {
-      if (entry.name.startsWith(".") || entry.name === "node_modules") continue;
-      results.push(...await collectFiles(fullPath, baseDir));
-    } else {
-      results.push(relPath);
-    }
-  }
-  return results;
-}
-function dedupeSearchResults(perAdapter) {
-  const seen = /* @__PURE__ */ new Set();
-  const out = [];
-  for (const block of perAdapter) {
-    const kept = [];
-    for (const r of block.results) {
-      const key = r.installRef;
-      if (seen.has(key)) continue;
-      seen.add(key);
-      kept.push(r);
-    }
-    if (kept.length > 0 || block.results.length > 0) {
-      out.push({ ...block, results: kept });
-    }
-  }
-  return out;
-}
+  DEFAULT_SKILLS_SH_URL,
+  SkillInstaller,
+  SkillManifestStore,
+  bodyLineAdvisory,
+  createSkillsShAdapter,
+  downloadGitHubTarball,
+  extractSkillFromPrompt,
+  generateSkillSkeleton,
+  githubDirectAdapter,
+  openInEditor,
+  parseSkillRef,
+  validateSkillNameAvailable,
+  writeSkeletonSkill
+} from "../chunk-SN2DQRL6.js";
+import {
+  FOREIGN_SKILL_TOOLS,
+  resolveForeignToolIds,
+  resolveForeignToolIdsWithWarnings,
+  securityScoreToTier
+} from "../chunk-JVKB2TBL.js";
+import "../chunk-LHOA5DWA.js";
+import {
+  SKILL_LIMITS
+} from "../chunk-XEBHSJLT.js";
+import "../chunk-7ZHZE5EO.js";
+import {
+  isValidSkillNameFormat,
+  parseSkillFrontmatter,
+  stripFrontmatter,
+  validateSkillName
+} from "../chunk-WEBMSQP2.js";
+import "../chunk-WOEZV3Q4.js";
+import "../chunk-TBRL2RCC.js";
+import "../chunk-PFZO3C6H.js";
 export {
   DEFAULT_SKILLS_SH_URL,
   FOREIGN_SKILL_TOOLS,