@zleap-ai/sag-cli 0.5.0 → 0.6.0

package/dist/cli.js

@@ -1,13 +1,15 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import os5 from "os";
+import { mkdtemp, rm as rm3 } from "fs/promises";
+import os5, { tmpdir } from "os";
+import path15 from "path";
 import { checkbox, confirm, input, select } from "@inquirer/prompts";
 
 // package.json
 var package_default = {
   name: "@zleap-ai/sag-cli",
-  version: "0.5.0",
+  version: "0.6.0",
   description: "Command-line client and diagnostics for SAG knowledge bases",
   type: "module",
   bin: {
@@ -22,7 +24,7 @@ var package_default = {
     "skills/sag-mcp"
   ],
   scripts: {
-    build: "tsup",
+    build: "tsup && node scripts/sync-skill-runtime.mjs",
     dev: "tsx src/cli.ts",
     test: "vitest run",
     "test:watch": "vitest",
@@ -94,6 +96,32 @@ import path from "path";
 import { z } from "zod";
 
 // src/core/errors.ts
+function toSkillErrorCode(code) {
+  switch (code) {
+    case "AUTH_REQUIRED":
+    case "PERMISSION_DENIED":
+    case "NETWORK_UNREACHABLE":
+    case "INVALID_ARGUMENT":
+    case "MCP_FAILED":
+    case "HOST_NOT_FOUND":
+    case "HOST_CONFIG_FAILED":
+    case "CONFIG_CONFLICT":
+    case "DEPENDENCY_MISSING":
+    case "INVALID_RESPONSE":
+    case "INTERNAL_ERROR":
+      return code;
+    case "EXTERNAL_DEPENDENCY_MISSING":
+      return "DEPENDENCY_MISSING";
+    case "SERVICE_NOT_READY":
+      return "PLATFORM_UNAVAILABLE";
+    case "RESOURCE_NOT_FOUND":
+      return "DOCUMENT_NOT_FOUND";
+    case "DOCUMENT_NOT_READY":
+      return "PROCESSING_FAILED";
+    default:
+      return "INTERNAL_ERROR";
+  }
+}
 var CliError = class extends Error {
   code;
   exitCode;
@@ -145,6 +173,14 @@ function toCliError(error) {
 
 // src/agents/adapter.ts
 import { createHash } from "crypto";
+async function isAgentInstalled(adapter) {
+  try {
+    await adapter.detect();
+    return true;
+  } catch {
+    return false;
+  }
+}
 function canonicalize(value) {
   if (Array.isArray(value)) {
     return value.map(canonicalize);
@@ -476,8 +512,8 @@ function parseTomlTablePath(line) {
 function findHeaderTables(config, name) {
   const target = ["mcp_servers", name, "http_headers"];
   return config.split(/\r?\n/u).flatMap((line, index) => {
-    const path11 = parseTomlTablePath(line);
-    return path11 && path11.length === target.length && path11.every((part, partIndex) => part === target[partIndex]) ? [index] : [];
+    const path16 = parseTomlTablePath(line);
+    return path16 && path16.length === target.length && path16.every((part, partIndex) => part === target[partIndex]) ? [index] : [];
   });
 }
 function readHttpHeaders(config, name) {
@@ -1443,6 +1479,8 @@ function defaultManagedConnectionsPath(options = {}) {
 var defaultEnterpriseMcpConnectionsPath = (options = {}) => path6.join(path6.dirname(defaultConfigPath(options)), "mcp-connections.yaml");
 var defaultEnterpriseMcpManagedStatePath = (options = {}) => path6.join(path6.dirname(defaultConfigPath(options)), "mcp-managed-state.yaml");
 var defaultEnterpriseMcpCredentialsPath = (options = {}) => path6.join(path6.dirname(defaultConfigPath(options)), "mcp-credentials.json");
+var defaultSkillStatePath = (options = {}) => path6.join(options.homeDirectory ?? os4.homedir(), ".sag", "skill", "state.json");
+var defaultSkillAccountConfigPath = (options = {}) => path6.join(options.homeDirectory ?? os4.homedir(), ".sag", "config.json");
 
 // src/credentials/file.ts
 import { randomUUID as randomUUID2 } from "crypto";
@@ -1594,11 +1632,13 @@ var MemoryCredentialStore = class {
   }
 };
 
-// src/credentials/keychain.ts
-var SERVICE_NAME = "@zleap-ai/sag-cli";
+// src/credentials/namespaces.ts
+var PERSONAL_SERVICE_NAME = "@zleap-ai/sag-cli";
 var ENTERPRISE_MCP_SERVICE_NAME = "@zleap-ai/sag-cli/enterprise-mcp";
+
+// src/credentials/keychain.ts
 var KeychainCredentialStore = class {
-  constructor(entryFactory, serviceName = SERVICE_NAME) {
+  constructor(entryFactory, serviceName = PERSONAL_SERVICE_NAME) {
     this.entryFactory = entryFactory;
     this.serviceName = serviceName;
   }
@@ -2681,46 +2721,562 @@ var NodeProcessRunner = class {
   }
 };
 
+// src/skill/state-store.ts
+import { randomUUID as randomUUID4 } from "crypto";
+import { mkdir as mkdir7, open as open3, readFile as readFile9, rename as rename8, unlink as unlink8 } from "fs/promises";
+import path10 from "path";
+import { lock as lock6 } from "proper-lockfile";
+import { z as z10 } from "zod";
+var agentSchema = z10.enum(["codex", "claude-code", "workbuddy"]);
+var digestSchema = z10.string().regex(/^sha256:[a-f0-9]{64}$/u);
+var managedSkillSchema = z10.strictObject({
+  agent: agentSchema,
+  backupPath: z10.string().min(1).optional(),
+  fingerprint: digestSchema,
+  target: z10.string().min(1),
+  version: z10.string().min(1)
+});
+var skillStateSchema = z10.strictObject({
+  schema: z10.literal(2),
+  managedSkills: z10.record(z10.string(), managedSkillSchema)
+});
+function emptyState5() {
+  return { schema: 2, managedSkills: {} };
+}
+function invalidState5(filePath) {
+  return new CliError("CONFIG_CONFLICT", "Skill installation state is invalid", {
+    exitCode: exitCodes.configConflict,
+    hint: `Remove the unpublished legacy state at ${filePath}, then reinstall the Skill.`
+  });
+}
+function managedSkillKey(agent, target) {
+  return `${agent}:${target}`;
+}
+var SkillStateStore = class {
+  constructor(filePath) {
+    this.filePath = filePath;
+  }
+  filePath;
+  async #withLock(operation) {
+    await mkdir7(path10.dirname(this.filePath), { recursive: true });
+    let release;
+    try {
+      release = await lock6(this.filePath, {
+        realpath: false,
+        stale: 1e4,
+        update: 2e3,
+        retries: { retries: 100, factor: 1, minTimeout: 10, maxTimeout: 10 }
+      });
+    } catch {
+      throw new CliError("CONFIG_CONFLICT", "Skill installation state is busy", {
+        exitCode: exitCodes.configConflict
+      });
+    }
+    try {
+      return await operation();
+    } finally {
+      await release();
+    }
+  }
+  async load() {
+    try {
+      return skillStateSchema.parse(JSON.parse(await readFile9(this.filePath, "utf8")));
+    } catch (error) {
+      if (error.code === "ENOENT") return emptyState5();
+      throw invalidState5(this.filePath);
+    }
+  }
+  async #saveUnlocked(state) {
+    const validated = skillStateSchema.parse(state);
+    const directory = path10.dirname(this.filePath);
+    await mkdir7(directory, { recursive: true });
+    const temporaryPath = path10.join(
+      directory,
+      `.${path10.basename(this.filePath)}.${randomUUID4()}.tmp`
+    );
+    let temporaryCreated = false;
+    try {
+      const handle = await open3(temporaryPath, "wx", 384);
+      temporaryCreated = true;
+      try {
+        await handle.chmod(384);
+        await handle.writeFile(JSON.stringify(validated), "utf8");
+      } finally {
+        await handle.close();
+      }
+      await rename8(temporaryPath, this.filePath);
+    } catch (error) {
+      if (temporaryCreated) await unlink8(temporaryPath).catch(() => void 0);
+      throw error;
+    }
+  }
+  async getManagedSkill(agent, target) {
+    return (await this.load()).managedSkills[managedSkillKey(agent, target)] ?? null;
+  }
+  async saveManagedSkill(managedSkill) {
+    const validated = managedSkillSchema.parse(managedSkill);
+    await this.#withLock(async () => {
+      const state = await this.load();
+      state.managedSkills[managedSkillKey(validated.agent, validated.target)] = validated;
+      await this.#saveUnlocked(state);
+    });
+  }
+  async deleteManagedSkill(agent, target) {
+    await this.#withLock(async () => {
+      const state = await this.load();
+      delete state.managedSkills[managedSkillKey(agent, target)];
+      await this.#saveUnlocked(state);
+    });
+  }
+};
+
+// src/skill/account-auth-client.ts
+import { z as z12 } from "zod";
+
+// src/skill/account-config.ts
+import { createHash as createHash2, randomUUID as randomUUID5 } from "crypto";
+import { mkdir as mkdir8, open as open4, readFile as readFile10, rename as rename9, unlink as unlink9 } from "fs/promises";
+import path11 from "path";
+import { lock as lock7 } from "proper-lockfile";
+import { z as z11 } from "zod";
+var recentKnowledgeBaseSchema = z11.strictObject({
+  id: z11.string().min(1),
+  name: z11.string().min(1)
+});
+var skillAccountSchema = z11.strictObject({
+  accessToken: z11.string().min(1),
+  refreshToken: z11.string().min(1),
+  accessExpiresAt: z11.string().datetime({ offset: true }),
+  refreshExpiresAt: z11.string().datetime({ offset: true }),
+  user: z11.strictObject({ id: z11.string().min(1), name: z11.string().min(1) }),
+  recentKnowledgeBase: recentKnowledgeBaseSchema.optional()
+});
+var skillAccountConfigSchema = z11.object({
+  version: z11.literal(1),
+  currentOrigin: z11.string().optional(),
+  accounts: z11.record(z11.string(), skillAccountSchema)
+}).passthrough();
+function configurationConflict(message, filePath) {
+  return new CliError("CONFIG_CONFLICT", message, {
+    exitCode: exitCodes.configConflict,
+    hint: filePath ? `Review or restore ${filePath}.` : "Provide a pure SAG Origin."
+  });
+}
+function normalizeSkillOrigin(input2) {
+  try {
+    const parsed = new URL(input2);
+    if (!["http:", "https:"].includes(parsed.protocol) || !parsed.hostname || parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash) {
+      throw new Error("not a pure HTTP Origin");
+    }
+    return parsed.origin;
+  } catch {
+    throw configurationConflict("SAG address must be a pure HTTP or HTTPS Origin");
+  }
+}
+var SkillAccountConfigStore = class {
+  constructor(filePath) {
+    this.filePath = filePath;
+  }
+  filePath;
+  async load() {
+    let raw;
+    try {
+      raw = await readFile10(this.filePath, "utf8");
+    } catch (error) {
+      if (error.code === "ENOENT") {
+        return { version: 1, accounts: {} };
+      }
+      throw error;
+    }
+    try {
+      return skillAccountConfigSchema.parse(JSON.parse(raw));
+    } catch {
+      throw configurationConflict(
+        "SAG account configuration is invalid",
+        this.filePath
+      );
+    }
+  }
+  async saveAccount(origin, account) {
+    const normalizedOrigin = normalizeSkillOrigin(origin);
+    let validated;
+    try {
+      validated = skillAccountSchema.parse(account);
+    } catch {
+      throw configurationConflict("SAG account is invalid", this.filePath);
+    }
+    await this.#withLock(async () => {
+      const config = await this.load();
+      config.accounts[normalizedOrigin] = validated;
+      config.currentOrigin = normalizedOrigin;
+      await this.#saveUnlocked(config);
+    });
+  }
+  async removeAccount(origin) {
+    const normalizedOrigin = normalizeSkillOrigin(origin);
+    await this.#withLock(async () => {
+      const config = await this.load();
+      delete config.accounts[normalizedOrigin];
+      if (config.currentOrigin === normalizedOrigin) {
+        config.currentOrigin = Object.keys(config.accounts).sort()[0];
+      }
+      await this.#saveUnlocked(config);
+    });
+  }
+  async setCurrentOrigin(origin) {
+    const normalizedOrigin = normalizeSkillOrigin(origin);
+    await this.#withLock(async () => {
+      const config = await this.load();
+      config.currentOrigin = normalizedOrigin;
+      await this.#saveUnlocked(config);
+    });
+  }
+  async getAccount(origin) {
+    return (await this.load()).accounts[normalizeSkillOrigin(origin)] ?? null;
+  }
+  async saveRecentKnowledgeBase(origin, knowledgeBase) {
+    const normalizedOrigin = normalizeSkillOrigin(origin);
+    const validated = recentKnowledgeBaseSchema.parse(knowledgeBase);
+    await this.#withLock(async () => {
+      const config = await this.load();
+      const account = config.accounts[normalizedOrigin];
+      if (!account) {
+        throw configurationConflict(
+          "SAG account authorization is required",
+          this.filePath
+        );
+      }
+      config.accounts[normalizedOrigin] = {
+        ...account,
+        recentKnowledgeBase: validated
+      };
+      config.currentOrigin = normalizedOrigin;
+      await this.#saveUnlocked(config);
+    });
+  }
+  async withRefreshLock(origin, operation) {
+    const normalizedOrigin = normalizeSkillOrigin(origin);
+    const digest2 = createHash2("sha256").update(normalizedOrigin).digest("hex");
+    await mkdir8(path11.dirname(this.filePath), { recursive: true });
+    let release;
+    try {
+      release = await lock7(`${this.filePath}.refresh-${digest2}`, {
+        realpath: false,
+        stale: 1e4,
+        update: 2e3,
+        retries: { retries: 300, factor: 1, minTimeout: 100, maxTimeout: 100 }
+      });
+    } catch {
+      throw new CliError("CONFIG_CONFLICT", "SAG account refresh is busy", {
+        exitCode: exitCodes.configConflict,
+        hint: "Wait for the other SAG Skill refresh to finish and retry."
+      });
+    }
+    try {
+      return await operation();
+    } finally {
+      await release();
+    }
+  }
+  async #withLock(operation) {
+    await mkdir8(path11.dirname(this.filePath), { recursive: true });
+    let release;
+    try {
+      release = await lock7(this.filePath, {
+        realpath: false,
+        stale: 1e4,
+        update: 2e3,
+        retries: { retries: 100, factor: 1, minTimeout: 10, maxTimeout: 10 }
+      });
+    } catch {
+      throw new CliError("CONFIG_CONFLICT", "SAG account configuration is busy", {
+        exitCode: exitCodes.configConflict,
+        hint: "Wait for the other SAG Skill operation to finish and retry."
+      });
+    }
+    try {
+      return await operation();
+    } finally {
+      await release();
+    }
+  }
+  async #saveUnlocked(config) {
+    let validated;
+    try {
+      validated = skillAccountConfigSchema.parse(config);
+    } catch {
+      throw configurationConflict(
+        "SAG account configuration is invalid",
+        this.filePath
+      );
+    }
+    const directory = path11.dirname(this.filePath);
+    await mkdir8(directory, { recursive: true });
+    const temporaryPath = path11.join(
+      directory,
+      `.${path11.basename(this.filePath)}.${randomUUID5()}.tmp`
+    );
+    let temporaryCreated = false;
+    try {
+      const handle = await open4(temporaryPath, "wx", 384);
+      temporaryCreated = true;
+      try {
+        await handle.chmod(384).catch(() => void 0);
+        await handle.writeFile(JSON.stringify(validated), "utf8");
+      } finally {
+        await handle.close();
+      }
+      await rename9(temporaryPath, this.filePath);
+    } catch (error) {
+      if (temporaryCreated) await unlink9(temporaryPath).catch(() => void 0);
+      throw error;
+    }
+  }
+};
+
+// src/skill/model.ts
+var SkillError = class extends Error {
+  code;
+  details;
+  exitCode;
+  problemCode;
+  constructor(code, message, options) {
+    super(message);
+    this.name = "SkillError";
+    this.code = code;
+    this.details = options.details;
+    this.exitCode = options.exitCode;
+    this.problemCode = options.problemCode;
+  }
+};
+
+// src/skill/account-auth-client.ts
+var dateTimeSchema = z12.string().datetime({ offset: true });
+var sessionIdSchema = z12.uuid();
+var createSessionSchema = z12.strictObject({
+  session_id: sessionIdSchema,
+  verification_url: z12.url(),
+  expires_at: dateTimeSchema
+});
+var loginSessionSchema = z12.strictObject({
+  session_id: sessionIdSchema,
+  status: z12.enum(["pending", "approved", "denied", "consumed"]),
+  expires_at: dateTimeSchema
+});
+var accountSchema = z12.strictObject({
+  access_token: z12.string().min(1),
+  refresh_token: z12.string().min(1),
+  access_expires_at: dateTimeSchema,
+  refresh_expires_at: dateTimeSchema,
+  user: z12.strictObject({ id: z12.string().min(1), name: z12.string().min(1) })
+});
+var problemSchema = z12.object({ code: z12.string().min(1) }).passthrough();
+var SkillAccountAuthHttpClient = class {
+  #fetch;
+  #timeoutMs;
+  constructor(options = {}) {
+    this.#fetch = options.fetchImplementation ?? fetch;
+    this.#timeoutMs = options.timeoutMs ?? 1e4;
+  }
+  async createLoginSession(origin, pkceChallenge) {
+    const normalizedOrigin = normalizeSkillOrigin(origin);
+    const response = await this.#request(
+      normalizedOrigin,
+      "/api/v1/integrations/skill-account-logins",
+      { method: "POST", body: { pkce_challenge: pkceChallenge } }
+    );
+    const parsed = await this.#parse(response, createSessionSchema);
+    if (normalizeSkillOrigin(new URL(parsed.verification_url).origin) !== normalizedOrigin) {
+      throw invalidResponse();
+    }
+    return {
+      sessionId: parsed.session_id,
+      verificationUrl: parsed.verification_url,
+      expiresAt: parsed.expires_at
+    };
+  }
+  async getLoginSession(origin, sessionId) {
+    const validatedId = this.#sessionId(sessionId);
+    const response = await this.#request(
+      normalizeSkillOrigin(origin),
+      `/api/v1/integrations/skill-account-logins/${encodeURIComponent(validatedId)}`,
+      { method: "GET" }
+    );
+    const parsed = await this.#parse(response, loginSessionSchema);
+    if (parsed.session_id !== validatedId) throw invalidResponse();
+    return {
+      sessionId: parsed.session_id,
+      status: parsed.status,
+      expiresAt: parsed.expires_at
+    };
+  }
+  async exchange(origin, input2) {
+    const sessionId = this.#sessionId(input2.sessionId);
+    const response = await this.#request(
+      normalizeSkillOrigin(origin),
+      `/api/v1/integrations/skill-account-logins/${encodeURIComponent(sessionId)}/exchange`,
+      { method: "POST", body: { pkce_verifier: input2.pkceVerifier } }
+    );
+    return asAccount(await this.#parse(response, accountSchema));
+  }
+  async refresh(origin, refreshToken) {
+    const response = await this.#request(
+      normalizeSkillOrigin(origin),
+      "/api/v1/integrations/skill-account-sessions/refresh",
+      { method: "POST", body: { refresh_token: refreshToken } }
+    );
+    return asAccount(await this.#parse(response, accountSchema));
+  }
+  async logout(origin, accessToken, refreshToken) {
+    const response = await this.#request(
+      normalizeSkillOrigin(origin),
+      "/api/v1/integrations/skill-account-sessions/current",
+      {
+        method: "DELETE",
+        body: { refresh_token: refreshToken },
+        authorization: `Bearer ${accessToken}`
+      }
+    );
+    if (response.status !== 204) throw invalidResponse();
+  }
+  #sessionId(value) {
+    const parsed = sessionIdSchema.safeParse(value);
+    if (!parsed.success) {
+      throw new SkillError("INVALID_ARGUMENT", "Skill login session is invalid", {
+        exitCode: exitCodes.invalidArgument
+      });
+    }
+    return parsed.data;
+  }
+  async #request(origin, requestPath, options) {
+    let response;
+    try {
+      response = await this.#fetch(new URL(requestPath, origin), {
+        headers: {
+          Accept: "application/json",
+          "Cache-Control": "no-store",
+          ...options.body ? { "Content-Type": "application/json" } : {},
+          ...options.authorization ? { Authorization: options.authorization } : {}
+        },
+        method: options.method,
+        redirect: "error",
+        signal: AbortSignal.timeout(this.#timeoutMs),
+        ...options.body ? { body: JSON.stringify(options.body) } : {}
+      });
+    } catch {
+      throw new SkillError(
+        "NETWORK_UNREACHABLE",
+        "Cannot reach the SAG account authorization service",
+        { exitCode: exitCodes.networkUnreachable }
+      );
+    }
+    if (response.redirected || response.status >= 300 && response.status < 400) {
+      throw invalidResponse();
+    }
+    if (!response.ok) {
+      let code = "unknown";
+      try {
+        const problem = problemSchema.safeParse(await response.json());
+        if (problem.success) code = problem.data.code;
+      } catch {
+      }
+      throw problemError(code, response.status);
+    }
+    return response;
+  }
+  async #parse(response, schema) {
+    try {
+      const parsed = schema.safeParse(await response.json());
+      if (parsed.success) return parsed.data;
+    } catch {
+    }
+    throw invalidResponse();
+  }
+};
+function asAccount(value) {
+  return {
+    accessToken: value.access_token,
+    refreshToken: value.refresh_token,
+    accessExpiresAt: value.access_expires_at,
+    refreshExpiresAt: value.refresh_expires_at,
+    user: value.user
+  };
+}
+function invalidResponse() {
+  return new SkillError(
+    "INVALID_RESPONSE",
+    "SAG account authorization returned an incompatible response",
+    { exitCode: exitCodes.internalError }
+  );
+}
+function problemError(code, status2) {
+  if (code === "access_denied" || status2 === 403) {
+    return new SkillError("PERMISSION_DENIED", "SAG account authorization was denied", {
+      exitCode: exitCodes.permissionDenied,
+      problemCode: "access_denied"
+    });
+  }
+  if (code === "login_session_expired" || code === "invalid_grant" || status2 === 410) {
+    return new SkillError("AUTH_EXPIRED", "SAG account authorization has expired", {
+      exitCode: exitCodes.authRequired,
+      problemCode: code
+    });
+  }
+  if (status2 === 401) {
+    return new SkillError("AUTH_REQUIRED", "SAG account authorization is required", {
+      exitCode: exitCodes.authRequired
+    });
+  }
+  if (status2 === 429 || code === "rate_limited") {
+    return new SkillError("RATE_LIMITED", "SAG account authorization is rate limited", {
+      exitCode: exitCodes.networkUnreachable,
+      problemCode: "rate_limited"
+    });
+  }
+  return invalidResponse();
+}
+
 // src/program.ts
+import { randomUUID as randomUUID7 } from "crypto";
 import { Command, CommanderError, Option } from "commander";
 
 // src/api/schemas.ts
-import { z as z10 } from "zod";
-var dateTime = z10.string().min(1);
-var rootSchema = z10.object({
-  name: z10.string().min(1),
-  version: z10.string().min(1),
-  docs: z10.string()
+import { z as z13 } from "zod";
+var dateTime = z13.string().min(1);
+var rootSchema = z13.object({
+  name: z13.string().min(1),
+  version: z13.string().min(1),
+  docs: z13.string()
 }).passthrough();
-var readySchema = z10.object({
-  status: z10.string(),
-  db: z10.boolean()
+var readySchema = z13.object({
+  status: z13.string(),
+  db: z13.boolean()
 }).passthrough();
-var capabilitiesSchema = z10.record(z10.string(), z10.unknown());
-var userSchema = z10.object({
-  id: z10.string().min(1),
-  email: z10.string(),
-  name: z10.string(),
+var capabilitiesSchema = z13.record(z13.string(), z13.unknown());
+var userSchema = z13.object({
+  id: z13.string().min(1),
+  email: z13.string(),
+  name: z13.string(),
   created_at: dateTime.optional()
 }).passthrough();
-var loginResponseSchema = z10.object({
-  access_token: z10.string().min(1),
+var loginResponseSchema = z13.object({
+  access_token: z13.string().min(1),
   user: userSchema
 }).passthrough();
-var sourceSchema = z10.object({
-  id: z10.string().min(1),
-  name: z10.string(),
-  description: z10.string(),
-  source_type: z10.enum(["document", "web", "message", "audio"]),
-  connector_kind: z10.string(),
-  status: z10.enum(["active", "paused", "error"]),
-  document_count: z10.number().int().nonnegative(),
-  chunk_count: z10.number().int().nonnegative(),
-  event_count: z10.number().int().nonnegative(),
+var sourceSchema = z13.object({
+  id: z13.string().min(1),
+  name: z13.string(),
+  description: z13.string(),
+  source_type: z13.enum(["document", "web", "message", "audio"]),
+  connector_kind: z13.string(),
+  status: z13.enum(["active", "paused", "error"]),
+  document_count: z13.number().int().nonnegative(),
+  chunk_count: z13.number().int().nonnegative(),
+  event_count: z13.number().int().nonnegative(),
   created_at: dateTime,
   updated_at: dateTime
 }).passthrough();
-var documentStatusSchema = z10.enum([
+var documentStatusSchema = z13.enum([
   "pending",
   "loading",
   "extracting",
@@ -2728,102 +3284,102 @@ var documentStatusSchema = z10.enum([
   "ready",
   "failed"
 ]);
-var documentSchema = z10.object({
-  id: z10.string().min(1),
-  source_id: z10.string().min(1),
-  filename: z10.string(),
-  content_type: z10.string(),
-  size_bytes: z10.number().int().nonnegative(),
+var documentSchema = z13.object({
+  id: z13.string().min(1),
+  source_id: z13.string().min(1),
+  filename: z13.string(),
+  content_type: z13.string(),
+  size_bytes: z13.number().int().nonnegative(),
   status: documentStatusSchema,
-  chunk_count: z10.number().int().nonnegative(),
-  event_count: z10.number().int().nonnegative(),
-  progress: z10.number().int().min(0).max(100),
-  token_usage: z10.number().int().nonnegative(),
-  error: z10.string().nullable(),
+  chunk_count: z13.number().int().nonnegative(),
+  event_count: z13.number().int().nonnegative(),
+  progress: z13.number().int().min(0).max(100),
+  token_usage: z13.number().int().nonnegative(),
+  error: z13.string().nullable(),
   created_at: dateTime,
   updated_at: dateTime
 }).passthrough();
-var searchSectionSchema = z10.object({
-  chunk_id: z10.string().nullable(),
-  heading: z10.string(),
-  content: z10.string(),
-  score: z10.number(),
-  rank: z10.number().int(),
-  source_id: z10.string().nullable(),
-  source_name: z10.string().nullable().optional()
+var searchSectionSchema = z13.object({
+  chunk_id: z13.string().nullable(),
+  heading: z13.string(),
+  content: z13.string(),
+  score: z13.number(),
+  rank: z13.number().int(),
+  source_id: z13.string().nullable(),
+  source_name: z13.string().nullable().optional()
 }).passthrough();
-var searchEventSchema = z10.object({
-  id: z10.string(),
-  title: z10.string(),
-  summary: z10.string(),
-  rank: z10.number().int(),
-  score: z10.number()
+var searchEventSchema = z13.object({
+  id: z13.string(),
+  title: z13.string(),
+  summary: z13.string(),
+  rank: z13.number().int(),
+  score: z13.number()
 }).passthrough();
-var sourceHitSchema = z10.object({
-  source_id: z10.string(),
-  source_name: z10.string().nullable().optional(),
-  event_hits: z10.number().int(),
-  max_score: z10.number(),
-  latest_event_time: z10.string().nullable().optional()
+var sourceHitSchema = z13.object({
+  source_id: z13.string(),
+  source_name: z13.string().nullable().optional(),
+  event_hits: z13.number().int(),
+  max_score: z13.number(),
+  latest_event_time: z13.string().nullable().optional()
 }).passthrough();
-var searchResponseSchema = z10.object({
-  query: z10.string(),
-  sections: z10.array(searchSectionSchema),
-  events: z10.array(searchEventSchema),
-  entities: z10.array(z10.record(z10.string(), z10.unknown())),
-  relations: z10.array(z10.record(z10.string(), z10.unknown())),
-  source_hits: z10.array(sourceHitSchema),
-  summary: z10.string(),
-  exploration_id: z10.string().nullable(),
-  stats: z10.record(z10.string(), z10.unknown())
+var searchResponseSchema = z13.object({
+  query: z13.string(),
+  sections: z13.array(searchSectionSchema),
+  events: z13.array(searchEventSchema),
+  entities: z13.array(z13.record(z13.string(), z13.unknown())),
+  relations: z13.array(z13.record(z13.string(), z13.unknown())),
+  source_hits: z13.array(sourceHitSchema),
+  summary: z13.string(),
+  exploration_id: z13.string().nullable(),
+  stats: z13.record(z13.string(), z13.unknown())
 }).passthrough();
-var mcpDescriptorSchema = z10.object({
-  name: z10.string(),
-  scope: z10.string(),
-  source_count: z10.number().int().nonnegative(),
-  tools: z10.array(z10.string()),
-  http: z10.object({
-    transport: z10.string(),
-    url: z10.string().url(),
-    headers: z10.record(z10.string(), z10.string())
+var mcpDescriptorSchema = z13.object({
+  name: z13.string(),
+  scope: z13.string(),
+  source_count: z13.number().int().nonnegative(),
+  tools: z13.array(z13.string()),
+  http: z13.object({
+    transport: z13.string(),
+    url: z13.string().url(),
+    headers: z13.record(z13.string(), z13.string())
   }).passthrough()
 }).passthrough();
-var outlineItemSchema = z10.object({
-  rank: z10.number().int(),
-  heading: z10.string(),
-  chunk_id: z10.string()
+var outlineItemSchema = z13.object({
+  rank: z13.number().int(),
+  heading: z13.string(),
+  chunk_id: z13.string()
 }).passthrough();
-var outlineSchema = z10.object({
-  document_id: z10.string(),
-  filename: z10.string(),
-  outline: z10.array(outlineItemSchema)
+var outlineSchema = z13.object({
+  document_id: z13.string(),
+  filename: z13.string(),
+  outline: z13.array(outlineItemSchema)
 }).passthrough();
-var grepMatchSchema = z10.object({
-  chunk_id: z10.string(),
-  heading: z10.string(),
-  snippet: z10.string()
+var grepMatchSchema = z13.object({
+  chunk_id: z13.string(),
+  heading: z13.string(),
+  snippet: z13.string()
 }).passthrough();
-var grepResponseSchema = z10.object({
-  pattern: z10.string(),
-  matches: z10.array(grepMatchSchema),
-  count: z10.number().int().nonnegative()
+var grepResponseSchema = z13.object({
+  pattern: z13.string(),
+  matches: z13.array(grepMatchSchema),
+  count: z13.number().int().nonnegative()
 }).passthrough();
-var readResponseSchema = z10.object({
-  document_id: z10.string(),
-  filename: z10.string(),
-  total_lines: z10.number().int().nonnegative(),
-  offset: z10.number().int().positive(),
-  limit: z10.number().int().positive(),
-  lines: z10.array(z10.string())
+var readResponseSchema = z13.object({
+  document_id: z13.string(),
+  filename: z13.string(),
+  total_lines: z13.number().int().nonnegative(),
+  offset: z13.number().int().positive(),
+  limit: z13.number().int().positive(),
+  lines: z13.array(z13.string())
 }).passthrough();
-var entityContextSchema = z10.object({
-  entity_id: z10.string(),
-  name: z10.string(),
-  type: z10.string(),
-  description: z10.string(),
-  context: z10.string(),
-  source_id: z10.string(),
-  source_name: z10.string()
+var entityContextSchema = z13.object({
+  entity_id: z13.string(),
+  name: z13.string(),
+  type: z13.string(),
+  description: z13.string(),
+  context: z13.string(),
+  source_id: z13.string(),
+  source_name: z13.string()
 }).passthrough();
 
 // src/api/client.ts
@@ -2932,7 +3488,7 @@ var SagClient = class {
       entityContextSchema
     );
   }
-  async #request(path11, schema, options = {}) {
+  async #request(path16, schema, options = {}) {
     const authenticated = options.authenticated ?? true;
     if (authenticated && !this.#token) {
       throw new CliError("AUTH_REQUIRED", "No SAG token is configured", {
@@ -2952,7 +3508,7 @@ var SagClient = class {
     }
     let response;
     try {
-      response = await this.#fetch(new URL(path11, `${this.#origin}/`), {
+      response = await this.#fetch(new URL(path16, `${this.#origin}/`), {
         method: options.method ?? "GET",
         headers,
         ...options.body !== void 0 ? { body: JSON.stringify(options.body) } : {},
@@ -3532,9 +4088,9 @@ async function agentStatus(runtime2, agent, serverName) {
   }
 }
 async function statusLocalAgents(runtime2, input2) {
-  const agents = input2.agent ? [input2.agent] : ["codex", "claude-code"];
+  const agents2 = input2.agent ? [input2.agent] : ["codex", "claude-code"];
   return Promise.all(
-    agents.map((agent) => agentStatus(runtime2, agent, input2.serverName))
+    agents2.map((agent) => agentStatus(runtime2, agent, input2.serverName))
   );
 }
 async function listAgentHosts(runtime2) {
@@ -3829,7 +4385,7 @@ function credentialStoreForEnterpriseMcpConnection(connection, stores) {
 }
 
 // src/mcp/enterprise/import.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 function invalidImport(message, cause) {
   return new CliError("INVALID_ARGUMENT", message, {
     exitCode: exitCodes.invalidArgument,
@@ -3958,7 +4514,7 @@ function selectEnterpriseMcpCandidates(servers, requested = []) {
   return selectByServerKey(servers, requested);
 }
 function connectionIdForCollision(serverKey, url) {
-  return `${serverKey}-${createHash2("sha256").update(new URL(url).toString()).digest("hex").slice(0, 8)}`;
+  return `${serverKey}-${createHash3("sha256").update(new URL(url).toString()).digest("hex").slice(0, 8)}`;
 }
 
 // src/mcp/enterprise/runtime.ts
@@ -3997,7 +4553,7 @@ import { isDeepStrictEqual } from "util";
 function stateId(agent, connectionId) {
   return connectionKey(agent, "user", connectionId);
 }
-function configurationConflict(message) {
+function configurationConflict2(message) {
   return new CliError("CONFIG_CONFLICT", message, {
     exitCode: exitCodes.configConflict,
     hint: "\u8BF7\u68C0\u67E5\u8BE5 Agent \u7684\u540C\u540D MCP \u914D\u7F6E\u540E\u91CD\u8BD5\u3002"
@@ -4078,7 +4634,7 @@ async function attachEnterpriseMcp(runtime2, input2) {
     connectionId: input2.connection.id
   });
   if (action === "blocked-drift") {
-    throw configurationConflict("\u53D7\u7BA1 Agent MCP \u914D\u7F6E\u5DF2\u5728 SAG CLI \u4E4B\u5916\u88AB\u4FEE\u6539");
+    throw configurationConflict2("\u53D7\u7BA1 Agent MCP \u914D\u7F6E\u5DF2\u5728 SAG CLI \u4E4B\u5916\u88AB\u4FEE\u6539");
   }
   if (action === "unchanged") {
     return success(input2.agent, "skipped", "Agent \u4E2D\u7684\u4F01\u4E1A MCP \u914D\u7F6E\u5DF2\u7ECF\u662F\u6700\u65B0\u72B6\u6001\u3002");
@@ -4100,7 +4656,7 @@ async function attachEnterpriseMcp(runtime2, input2) {
     await adapter.add(input2.connection.id, "user", input2.spec);
     const readBack = await adapter.read(input2.connection.id, "user");
     if (!readBack || fingerprintConnection(readBack.spec) !== fingerprintConnection(input2.spec)) {
-      throw configurationConflict("Agent MCP \u56DE\u8BFB\u7ED3\u679C\u4E0E\u8BF7\u6C42\u7684\u8FDE\u63A5\u4E0D\u4E00\u81F4");
+      throw configurationConflict2("Agent MCP \u56DE\u8BFB\u7ED3\u679C\u4E0E\u8BF7\u6C42\u7684\u8FDE\u63A5\u4E0D\u4E00\u81F4");
     }
     await runtime2.verifier.verify(readBack.spec, { timeoutMs: input2.timeoutMs });
     await runtime2.managed.setAgent(
@@ -4146,10 +4702,10 @@ async function detachEnterpriseMcp(runtime2, input2) {
     runtime2.managed.getAgent(id)
   ]);
   if (!managed || managed.connectionId !== input2.connection.id || !host) {
-    throw configurationConflict("\u8BE5 Agent MCP \u914D\u7F6E\u4E0D\u53D7\u5F53\u524D\u4F01\u4E1A\u8FDE\u63A5\u7BA1\u7406");
+    throw configurationConflict2("\u8BE5 Agent MCP \u914D\u7F6E\u4E0D\u53D7\u5F53\u524D\u4F01\u4E1A\u8FDE\u63A5\u7BA1\u7406");
   }
   if (host.fingerprint !== managed.fingerprint) {
-    throw configurationConflict("\u53D7\u7BA1 Agent MCP \u914D\u7F6E\u5DF2\u5728 SAG CLI \u4E4B\u5916\u88AB\u4FEE\u6539");
+    throw configurationConflict2("\u53D7\u7BA1 Agent MCP \u914D\u7F6E\u5DF2\u5728 SAG CLI \u4E4B\u5916\u88AB\u4FEE\u6539");
   }
   if (input2.dryRun) {
     return success(
@@ -4187,7 +4743,7 @@ async function refreshManagedAgents(runtime2, input2) {
   return Promise.all(
     matching.map(async (state) => {
       const agent = agentForState(state, input2.connection.id);
-      if (!agent) return failed(state.id, configurationConflict("\u53D7\u7BA1 Agent \u72B6\u6001\u65E0\u6548"));
+      if (!agent) return failed(state.id, configurationConflict2("\u53D7\u7BA1 Agent \u72B6\u6001\u65E0\u6548"));
       try {
         return await attachEnterpriseMcp(runtime2, { ...input2, agent, yes: true });
       } catch (cause) {
@@ -4198,10 +4754,10 @@ async function refreshManagedAgents(runtime2, input2) {
 }
 
 // src/mcp/enterprise/skill-service.ts
-import { createHash as createHash3 } from "crypto";
-import { cp, lstat as lstat2, mkdir as mkdir7, readFile as readFile9, readdir, rename as rename8, rm } from "fs/promises";
+import { createHash as createHash4 } from "crypto";
+import { cp, lstat as lstat2, mkdir as mkdir9, readFile as readFile11, readdir, rename as rename10, rm } from "fs/promises";
 import { fileURLToPath } from "url";
-import path10 from "path";
+import path12 from "path";
 var skillName = "sag-mcp";
 var skillDescription = "Use connected enterprise SAG MCP servers to search, read, and manage authorized knowledge.";
 var requiredReferences = [
@@ -4211,32 +4767,32 @@ var requiredReferences = [
 function skillTarget(agent, options) {
   switch (agent) {
     case "codex":
-      return path10.join(
-        options.CODEX_HOME || path10.join(options.home, ".codex"),
+      return path12.join(
+        options.CODEX_HOME || path12.join(options.home, ".codex"),
         "skills",
         skillName
       );
     case "claude-code":
-      return path10.join(options.home, ".claude", "skills", skillName);
+      return path12.join(options.home, ".claude", "skills", skillName);
     case "workbuddy":
-      return path10.join(options.home, ".workbuddy", "skills", skillName);
+      return path12.join(options.home, ".workbuddy", "skills", skillName);
   }
 }
 function managedSkillId(agent) {
   return `${agent}:${skillName}`;
 }
 function bundledSkillPath() {
-  const moduleDirectory = path10.dirname(fileURLToPath(import.meta.url));
-  const packageRoot = path10.basename(moduleDirectory) === "dist" ? path10.dirname(moduleDirectory) : path10.resolve(moduleDirectory, "../../..");
-  return path10.join(packageRoot, "skills", skillName);
+  const moduleDirectory = path12.dirname(fileURLToPath(import.meta.url));
+  const packageRoot = path12.basename(moduleDirectory) === "dist" ? path12.dirname(moduleDirectory) : path12.resolve(moduleDirectory, "../../..");
+  return path12.join(packageRoot, "skills", skillName);
 }
 function timestamp(now) {
   return now.toISOString().replace(/[-:.]/gu, "");
 }
 function siblingPath(target, prefix, now) {
-  return path10.join(
-    path10.dirname(target),
-    `${path10.basename(target)}.${prefix}-${timestamp(now)}-${process.pid}`
+  return path12.join(
+    path12.dirname(target),
+    `${path12.basename(target)}.${prefix}-${timestamp(now)}-${process.pid}`
   );
 }
 async function exists(target) {
@@ -4249,26 +4805,26 @@ async function exists(target) {
   }
 }
 async function validateSkillBundle(bundlePath) {
-  const skill = await readFile9(path10.join(bundlePath, "SKILL.md"), "utf8");
+  const skill = await readFile11(path12.join(bundlePath, "SKILL.md"), "utf8");
   const lines = skill.split(/\r?\n/u);
   const lineCount = skill.endsWith("\n") ? lines.length - 1 : lines.length;
   if (lineCount >= 100 || lines[0] !== "---" || lines[1] !== `name: ${skillName}` || lines[2] !== `description: ${skillDescription}` || lines[3] !== "---") {
     throw new Error("\u968F\u5305\u53D1\u5E03\u7684 SAG MCP Skill frontmatter \u65E0\u6548\u3002");
   }
   for (const reference of requiredReferences) {
-    await readFile9(path10.join(bundlePath, reference), "utf8");
+    await readFile11(path12.join(bundlePath, reference), "utf8");
     if (!skill.includes(`(${reference})`)) {
       throw new Error(`\u968F\u5305\u53D1\u5E03\u7684 SAG MCP Skill \u672A\u5F15\u7528 ${reference}\u3002`);
     }
   }
 }
 async function updateDirectoryFingerprint(hash, root, relative = "") {
-  const current = path10.join(root, relative);
+  const current = path12.join(root, relative);
   const entries = await readdir(current, { withFileTypes: true });
   for (const entry of entries.sort(
     (left, right) => left.name.localeCompare(right.name)
   )) {
-    const entryRelative = path10.join(relative, entry.name);
+    const entryRelative = path12.join(relative, entry.name);
     if (entry.isDirectory()) {
       hash.update(`directory:${entryRelative}
 `);
@@ -4280,12 +4836,12 @@ async function updateDirectoryFingerprint(hash, root, relative = "") {
     }
     hash.update(`file:${entryRelative}
 `);
-    hash.update(await readFile9(path10.join(root, entryRelative)));
+    hash.update(await readFile11(path12.join(root, entryRelative)));
   }
 }
 async function fingerprintSkillBundle(bundlePath) {
   await validateSkillBundle(bundlePath);
-  const hash = createHash3("sha256");
+  const hash = createHash4("sha256");
   await updateDirectoryFingerprint(hash, bundlePath);
   return `sha256:${hash.digest("hex")}`;
 }
@@ -4321,7 +4877,7 @@ async function restoreTarget(input2) {
   if (!input2.targetMutated) return;
   if (input2.hadTarget && input2.backupPath && await exists(input2.backupPath)) {
     await rm(input2.target, { recursive: true, force: true });
-    await rename8(input2.backupPath, input2.target);
+    await rename10(input2.backupPath, input2.target);
     return;
   }
   if (!input2.hadTarget) {
@@ -4341,7 +4897,7 @@ async function installEnterpriseSkill(input2) {
   try {
     hadTarget = await exists(target);
     await validateSkillBundle(bundlePath);
-    await mkdir7(path10.dirname(target), { recursive: true });
+    await mkdir9(path12.dirname(target), { recursive: true });
     await cp(bundlePath, temporaryPath, {
       recursive: true,
       errorOnExist: true,
@@ -4350,10 +4906,10 @@ async function installEnterpriseSkill(input2) {
     await validateSkillBundle(temporaryPath);
     if (hadTarget) {
       backupPath = siblingPath(target, "backup", input2.now());
-      await rename8(target, backupPath);
+      await rename10(target, backupPath);
       targetMutated = true;
     }
-    await rename8(temporaryPath, target);
+    await rename10(temporaryPath, target);
     targetMutated = true;
     const fingerprint = await fingerprintSkillBundle(target);
     await input2.managed.setSkill({
@@ -4408,11 +4964,11 @@ async function uninstallEnterpriseSkill(input2) {
       throw conflict5("\u53D7 SAG CLI \u7BA1\u7406\u7684 SAG MCP Skill \u5DF2\u88AB\u5916\u90E8\u4FEE\u6539\u3002");
     }
     const removedPath = siblingPath(target, "remove", input2.now());
-    await rename8(target, removedPath);
+    await rename10(target, removedPath);
     try {
       await input2.managed.deleteSkill(state.id);
     } catch (cause) {
-      await rename8(removedPath, target);
+      await rename10(removedPath, target);
       throw cause;
     }
     await rm(removedPath, { recursive: true, force: true }).catch(() => void 0);
@@ -4428,11 +4984,11 @@ async function uninstallEnterpriseSkill(input2) {
     throw conflict5("\u6CA1\u6709\u53EF\u79FB\u9664\u7684 SAG MCP Skill\u3002");
   }
   const backupPath = siblingPath(target, "backup", input2.now());
-  await rename8(target, backupPath);
+  await rename10(target, backupPath);
   try {
     await input2.managed.deleteSkill(managedSkillId(input2.agent));
   } catch (cause) {
-    await rename8(backupPath, target).catch(() => void 0);
+    await rename10(backupPath, target).catch(() => void 0);
     throw cause;
   }
   return {
@@ -4844,7 +5400,7 @@ async function connectEnterpriseMcp(input2) {
       );
     }
   }
-  const agents = verified.length ? await selectInstalledAgents(input2) : [];
+  const agents2 = verified.length ? await selectInstalledAgents(input2) : [];
   const initialActive = await input2.runtime.store.active();
   const connections = [];
   const skillEligibleAgents = /* @__PURE__ */ new Set();
@@ -4952,19 +5508,19 @@ async function connectEnterpriseMcp(input2) {
           spec: item.parsed.connection
         });
       }
-      for (const agent of agents) {
+      for (const agent of agents2) {
         stages.push(skippedAgentStage(agent));
         zeroToolSkillAgents.add(agent);
       }
       continue;
     }
     let riskAccepted = input2.yes || input2.dryRun || !item.risk.hasWarning;
-    if (!riskAccepted && agents.length) {
+    if (!riskAccepted && agents2.length) {
       riskAccepted = await input2.runtime.agents.confirm(
         `MCP ${connection.id} \u542B\u6709\u5199\u5165\u3001\u5220\u9664\u6216\u98CE\u9669\u672A\u77E5\u7684\u5DE5\u5177\uFF0C\u662F\u5426\u7EE7\u7EED\u63A5\u5165\u6240\u9009 Agent\uFF1F`
       );
     }
-    for (const agent of agents) {
+    for (const agent of agents2) {
       if (!riskAccepted) {
         stages.push(
           stageSuccess(
@@ -4987,7 +5543,7 @@ async function connectEnterpriseMcp(input2) {
       if (attached.stage.ok && attached.connected) successfulAgents.add(agent);
     }
     for (const agent of successfulAgents) {
-      if (agents.includes(agent)) skillEligibleAgents.add(agent);
+      if (agents2.includes(agent)) skillEligibleAgents.add(agent);
       reverifications.push({
         agent,
         connectionId: connection.id,
@@ -4995,7 +5551,7 @@ async function connectEnterpriseMcp(input2) {
       });
     }
   }
-  for (const agent of agents) {
+  for (const agent of agents2) {
     if (skillEligibleAgents.has(agent)) {
       stages.push(await installSkillForAgent(input2, agent));
     } else if (zeroToolSkillAgents.has(agent)) {
@@ -5294,7 +5850,7 @@ async function inspectEnterpriseMcpStatus(input2) {
   } catch {
     health = "unavailable";
   }
-  const agents = await Promise.all(
+  const agents2 = await Promise.all(
     supportedAgents.map(async (agent) => {
       const [mcpInspection, skillInspection] = await Promise.allSettled([
         inspectEnterpriseAgent(input2.runtime.agents, {
@@ -5322,7 +5878,7 @@ async function inspectEnterpriseMcpStatus(input2) {
       return { agent, mcp, skill, nextActions: nextActions2 };
     })
   );
-  const nextActions = agents.flatMap((agent) => agent.nextActions);
+  const nextActions = agents2.flatMap((agent) => agent.nextActions);
   if (health !== "ready") {
     nextActions.unshift(`\u68C0\u67E5\u4F01\u4E1A MCP ${connection.id} \u7684\u7F51\u7EDC\u548C\u51ED\u636E`);
   }
@@ -5336,7 +5892,7 @@ async function inspectEnterpriseMcpStatus(input2) {
     health,
     toolCount,
     risk,
-    agents,
+    agents: agents2,
     nextActions
   };
 }
@@ -5694,9 +6250,9 @@ async function sourceStatus(client, sourceId) {
 }
 
 // src/core/context.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 function directCredentialRef(url) {
-  const fingerprint = createHash4("sha256").update(url).digest("hex").slice(0, 16);
+  const fingerprint = createHash5("sha256").update(url).digest("hex").slice(0, 16);
   return `sag-cli/direct-${fingerprint}`;
 }
 async function createRuntimeContext(input2) {
@@ -5943,12 +6499,14 @@ async function runDoctor(client, input2, localMcpChecks) {
 // src/output/redaction.ts
 var SENSITIVE_KEYS = /* @__PURE__ */ new Set([
   "authorization",
+  "authorization_code",
   "token",
   "access_token",
   "password",
   "secret",
   "secretkey",
-  "secret_key"
+  "secret_key",
+  "ticket"
 ]);
 var BEARER_TOKEN = /\bBearer\s+[^\s"',}\]]+/giu;
 function redactString(value) {
@@ -6095,7 +6653,7 @@ function renderEnterpriseMcpStages(value) {
 function renderEnterpriseMcpStatus(value) {
   const connection = isRecord(value.connection) ? value.connection : {};
   const risk = isRecord(value.risk) ? value.risk : {};
-  const agents = Array.isArray(value.agents) ? value.agents.filter(isRecord) : [];
+  const agents2 = Array.isArray(value.agents) ? value.agents.filter(isRecord) : [];
   const nextActions = Array.isArray(value.nextActions) ? value.nextActions.map(String) : [];
   const lines = [
     `\u8FDE\u63A5\uFF1A${String(connection.id ?? "unknown")}${connection.active ? "\uFF08\u5F53\u524D\uFF09" : ""}`,
@@ -6103,7 +6661,7 @@ function renderEnterpriseMcpStatus(value) {
     `\u5065\u5EB7\uFF1A${String(value.health ?? "unknown")}`,
     `\u5DE5\u5177\uFF1A${String(value.toolCount ?? 0)}`,
     `\u98CE\u9669\uFF1A\u53EA\u8BFB ${String(risk.readOnly ?? 0)}\uFF0C\u5199\u5165 ${String(risk.write ?? 0)}\uFF0C\u5220\u9664 ${String(risk.destructive ?? 0)}\uFF0C\u672A\u77E5 ${String(risk.unknown ?? 0)}`,
-    ...agents.map(
+    ...agents2.map(
       (agent) => `Agent ${String(agent.agent ?? "unknown")}\uFF1AMCP ${String(agent.mcp ?? "unknown")}\uFF0CSkill ${String(agent.skill ?? "unknown")}`
     ),
     ...nextActions.length ? ["\u4E0B\u4E00\u6B65\uFF1A", ...nextActions.map((action) => `  ${action}`)] : []
@@ -6208,190 +6766,1836 @@ function renderJson(result) {
 `;
 }
 
-// src/program.ts
-function parseInteger(value) {
-  return Number.parseInt(value, 10);
-}
-function parsePositiveInteger(value) {
-  const parsed = Number.parseInt(value, 10);
-  if (!Number.isSafeInteger(parsed) || parsed <= 0) {
-    throw new CliError("INVALID_ARGUMENT", "\u53C2\u6570\u5FC5\u987B\u662F\u6B63\u6574\u6570", {
-      exitCode: exitCodes.invalidArgument
-    });
+// src/output/ndjson.ts
+var terminalEvents = /* @__PURE__ */ new Set([
+  "completed",
+  "failed",
+  "detached",
+  "completed_with_errors"
+]);
+var SkillEventWriter = class {
+  constructor(write) {
+    this.write = write;
+  }
+  write;
+  terminal = false;
+  emit(event) {
+    if (this.terminal) throw new Error("Cannot emit after terminal event");
+    if (terminalEvents.has(event.event)) {
+      throw new Error("terminal event must be sent with complete");
+    }
+    this.write(`${JSON.stringify(redact(event))}
+`);
   }
-  return parsed;
-}
-function parseAgent(value) {
-  if (value === "codex" || value === "claude-code") {
-    return value;
+  complete(event) {
+    if (!terminalEvents.has(event.event)) {
+      throw new Error("A terminal event is required");
+    }
+    if (this.terminal) throw new Error("Cannot emit a second terminal event");
+    this.terminal = true;
+    this.write(`${JSON.stringify(redact(event))}
+`);
   }
-  throw new CliError("INVALID_ARGUMENT", `Unsupported Agent: ${value}`, {
-    exitCode: exitCodes.invalidArgument,
-    hint: "Choose codex or claude-code."
-  });
+};
+
+// src/skill/installer.ts
+import { createHash as createHash6, randomUUID as randomUUID6 } from "crypto";
+import {
+  cp as cp2,
+  lstat as lstat3,
+  mkdir as mkdir10,
+  readFile as readFile12,
+  readdir as readdir2,
+  rename as rename11,
+  rm as rm2,
+  writeFile as writeFile6
+} from "fs/promises";
+import { fileURLToPath as fileURLToPath2 } from "url";
+import path13 from "path";
+import { lock as lock8 } from "proper-lockfile";
+var skillName2 = "sag-knowledge";
+var packageName = "@zleap-ai/sag-cli";
+var agents = ["codex", "claude-code", "workbuddy"];
+var requiredFiles = [
+  "SKILL.md",
+  "references/cli-reference.md",
+  "references/ndjson-contract.md",
+  "references/safety.md",
+  "scripts/sag-knowledge.cjs"
+];
+function bundledSkillPath2() {
+  const directory = path13.dirname(fileURLToPath2(import.meta.url));
+  const packageRoot = path13.basename(directory) === "dist" ? path13.dirname(directory) : path13.resolve(directory, "../..");
+  return path13.join(packageRoot, "skill");
 }
-function parseEnterpriseAgent(value) {
-  if (value === "codex" || value === "claude-code" || value === "workbuddy") {
-    return value;
+function uniqueAgents(selected) {
+  return [...new Set(selected ?? agents)];
+}
+function skillTargetPath(agent, input2) {
+  const home = path13.resolve(input2.home);
+  const codexHome = input2.environment.CODEX_HOME ? path13.resolve(input2.environment.CODEX_HOME) : path13.join(home, ".codex");
+  switch (agent) {
+    case "codex":
+      return path13.join(codexHome, "skills", skillName2);
+    case "claude-code":
+      return path13.join(home, ".claude", "skills", skillName2);
+    case "workbuddy":
+      return path13.join(home, ".workbuddy", "skills", skillName2);
   }
-  throw new CliError("INVALID_ARGUMENT", `\u4E0D\u652F\u6301\u7684 Agent\uFF1A${value}`, {
-    exitCode: exitCodes.invalidArgument,
-    hint: "\u8BF7\u9009\u62E9 codex\u3001claude-code \u6216 workbuddy\u3002"
-  });
 }
-function parseCredentialStore(value) {
-  if (value === "keychain" || value === "file") return value;
-  throw new CliError("INVALID_ARGUMENT", `\u4E0D\u652F\u6301\u7684\u51ED\u636E\u5B58\u50A8\uFF1A${value}`, {
-    exitCode: exitCodes.invalidArgument,
-    hint: "\u8BF7\u9009\u62E9 keychain \u6216 file\u3002"
-  });
+function sourceTargetError() {
+  throw new Error("Skill target is outside the configured user-level Agent directory");
 }
-function resolveEnterpriseSkillAgent(positional, option) {
-  if (positional && option && positional !== option) {
-    throw new CliError(
-      "INVALID_ARGUMENT",
-      "\u4F4D\u7F6E\u53C2\u6570 Agent \u4E0E --agent \u6307\u5B9A\u7684 Agent \u4E0D\u4E00\u81F4",
-      { exitCode: exitCodes.invalidArgument }
-    );
-  }
-  const agent = option ?? positional;
-  if (!agent) {
-    throw new CliError("INVALID_ARGUMENT", "\u8BF7\u4F7F\u7528 --agent \u6307\u5B9A Agent", {
-      exitCode: exitCodes.invalidArgument,
-      hint: "\u8BF7\u9009\u62E9 codex\u3001claude-code \u6216 workbuddy\u3002"
-    });
-  }
-  return agent;
+function assertUserTarget(target, agent, runtime2) {
+  const parent = agent === "codex" ? path13.resolve(
+    runtime2.environment.CODEX_HOME ?? path13.join(runtime2.home, ".codex"),
+    "skills"
+  ) : path13.resolve(
+    runtime2.home,
+    agent === "claude-code" ? ".claude/skills" : ".workbuddy/skills"
+  );
+  if (path13.dirname(target) !== parent || path13.basename(target) !== skillName2)
+    sourceTargetError();
 }
-function parseMcpToolArguments(value) {
+var SkillTargetLeaseError = class extends Error {
+};
+async function withTargetLease(target, operation) {
+  await mkdir10(path13.dirname(target), { recursive: true });
+  let release;
   try {
-    const parsed = JSON.parse(value);
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-      throw new Error("not an object");
-    }
-    return parsed;
-  } catch (cause) {
-    throw new CliError("INVALID_ARGUMENT", "--arguments-json \u5FC5\u987B\u662F\u4E00\u4E2A JSON \u5BF9\u8C61", {
-      exitCode: exitCodes.invalidArgument,
-      cause
+    release = await lock8(path13.join(path13.dirname(target), `.${skillName2}.lease`), {
+      realpath: false,
+      stale: 1e4,
+      update: 2e3,
+      retries: { retries: 100, factor: 1, minTimeout: 10, maxTimeout: 10 }
     });
+  } catch {
+    throw new SkillTargetLeaseError();
+  }
+  try {
+    return await operation();
+  } finally {
+    await release();
   }
 }
-function collect(value, previous) {
-  return [...previous, value];
+async function exists2(location) {
+  try {
+    await lstat3(location);
+    return true;
+  } catch (error) {
+    if (error.code === "ENOENT") return false;
+    throw error;
+  }
 }
-function commandOptions2(program) {
-  return program.opts();
+async function moveTarget(runtime2, from, to) {
+  if (runtime2.filesystem?.rename) return runtime2.filesystem.rename(from, to);
+  await rename11(from, to);
 }
-function emit(program, dependencies2, data) {
-  const options = commandOptions2(program);
-  dependencies2.writeStdout(
-    options.json ? renderJson(success3(data)) : renderHuman(data, options.quiet ?? false)
-  );
+async function removeTarget(runtime2, target) {
+  if (runtime2.filesystem?.remove) return runtime2.filesystem.remove(target);
+  await rm2(target, { recursive: true, force: true });
 }
-async function runtime(program, dependencies2) {
-  const options = commandOptions2(program);
-  return createRuntimeContext({
-    options: {
-      ...options.url ? { url: options.url } : {},
-      ...options.profile ? { profile: options.profile } : {}
-    },
-    environment: dependencies2.environment,
-    configStore: dependencies2.configStore,
-    credentialStore: dependencies2.credentialStore,
-    createClient: dependencies2.createClient
-  });
+function sameManagedSkill(left, right) {
+  return left?.agent === right.agent && left.target === right.target && left.fingerprint === right.fingerprint && left.version === right.version && left.backupPath === right.backupPath;
 }
-function localMcpRuntime(dependencies2) {
-  if (!dependencies2.localMcp) {
-    throw new CliError("DEPENDENCY_MISSING", "Local MCP runtime is unavailable", {
-      exitCode: exitCodes.dependencyMissing
-    });
+async function deactivateUnmanagedTarget(input2) {
+  try {
+    await moveTarget(input2.runtime, input2.target, input2.removed);
+  } catch {
+    return "active-unmanaged";
   }
-  return dependencies2.localMcp;
+  return await exists2(input2.target) ? "active-unmanaged" : "incomplete";
 }
-function enterpriseMcpRuntime(dependencies2) {
-  if (!dependencies2.enterpriseMcp) {
-    throw new CliError("DEPENDENCY_MISSING", "\u4F01\u4E1A MCP \u8FD0\u884C\u73AF\u5883\u4E0D\u53EF\u7528", {
-      exitCode: exitCodes.dependencyMissing
-    });
+async function recoverUninstall(input2) {
+  try {
+    await moveTarget(input2.runtime, input2.removed, input2.target);
+  } catch {
+    return "incomplete";
   }
-  return dependencies2.enterpriseMcp;
+  if (!await exists2(input2.target)) return "incomplete";
+  try {
+    await validateBundle(input2.target, input2.agent);
+    if (await fingerprintDirectory(input2.target) !== input2.managed.fingerprint) {
+      return deactivateUnmanagedTarget(input2);
+    }
+  } catch {
+    return deactivateUnmanagedTarget(input2);
+  }
+  try {
+    const current = await input2.runtime.state.getManagedSkill(
+      input2.agent,
+      input2.target
+    );
+    if (sameManagedSkill(current, input2.managed)) return "restored";
+    await input2.runtime.state.saveManagedSkill(input2.managed);
+    const restored = await input2.runtime.state.getManagedSkill(
+      input2.agent,
+      input2.target
+    );
+    if (sameManagedSkill(restored, input2.managed)) return "restored";
+  } catch {
+  }
+  return deactivateUnmanagedTarget(input2);
 }
-function enterpriseMcpCommandRuntime(dependencies2, timeoutMs) {
-  return {
-    ...enterpriseMcpRuntime(dependencies2),
-    cliVersion: dependencies2.version,
-    timeoutMs
-  };
+function digest(value) {
+  return `sha256:${createHash6("sha256").update(value).digest("hex")}`;
 }
-function rejectEnterpriseProfile(program) {
-  if (!commandOptions2(program).profile) return;
-  throw new CliError("INVALID_ARGUMENT", "\u4F01\u4E1A MCP \u547D\u4EE4\u4E0D\u4F7F\u7528 Profile", {
-    exitCode: exitCodes.invalidArgument,
-    hint: "\u8BF7\u79FB\u9664 --profile\uFF1B\u4E2A\u4EBA Profile \u53EA\u7528\u4E8E sag mcp test \u548C sag agent\u3002"
-  });
+function parseManifest(raw) {
+  const value = JSON.parse(raw);
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("invalid manifest");
+  const manifest = value;
+  if (manifest.schema !== 1 || manifest.name !== skillName2 || manifest.package !== packageName || typeof manifest.packageVersion !== "string" || !manifest.packageVersion || typeof manifest.bundleDigest !== "string" || !/^sha256:[a-f0-9]{64}$/u.test(manifest.bundleDigest) || !agents.includes(manifest.agent) && manifest.agent !== "template") {
+    throw new Error("invalid manifest");
+  }
+  return manifest;
 }
-async function selectedProfileName(program, dependencies2) {
-  const options = commandOptions2(program);
-  if (options.profile) {
-    await dependencies2.configStore.getProfile(options.profile);
-    return options.profile;
+async function validateBundle(bundle, expectedAgent) {
+  const [rawManifest, runtime2] = await Promise.all([
+    readFile12(path13.join(bundle, "manifest.json"), "utf8"),
+    readFile12(path13.join(bundle, "scripts", "sag-knowledge.cjs"))
+  ]);
+  const manifest = parseManifest(rawManifest);
+  if (manifest.agent !== expectedAgent || manifest.bundleDigest !== digest(runtime2)) {
+    throw new Error("invalid Skill bundle");
+  }
+  await Promise.all(requiredFiles.map((file) => readFile12(path13.join(bundle, file))));
+  return manifest;
+}
+async function fingerprintDirectory(root, relative = "") {
+  const hash = createHash6("sha256");
+  async function visit(nested = "") {
+    const entries = await readdir2(path13.join(root, nested), { withFileTypes: true });
+    for (const entry of entries.sort(
+      (left, right) => left.name.localeCompare(right.name)
+    )) {
+      const entryPath = path13.join(nested, entry.name);
+      if (entry.isDirectory()) {
+        hash.update(`directory:${entryPath}
+`);
+        await visit(entryPath);
+      } else if (entry.isFile()) {
+        hash.update(`file:${entryPath}
+`);
+        hash.update(await readFile12(path13.join(root, entryPath)));
+      } else {
+        throw new Error("unsupported Skill file");
+      }
+    }
   }
-  return (await dependencies2.configStore.load()).currentProfile ?? "local";
+  await visit(relative);
+  return `sha256:${hash.digest("hex")}`;
 }
-async function selectedServerName(program, dependencies2, explicitName) {
-  const profile = await selectedProfileName(program, dependencies2);
-  return {
-    profile,
-    serverName: explicitName ?? `sag-knowledge-${profile}`
+function sibling(target, suffix) {
+  return path13.join(path13.dirname(target), `.${skillName2}.${suffix}-${randomUUID6()}`);
+}
+async function restore(input2) {
+  let recovered = true;
+  try {
+    await removeTarget(input2.runtime, input2.temporary);
+  } catch {
+    recovered = false;
+  }
+  const targetMatchesReplacement = async () => {
+    if (!input2.replacementFingerprint || !await exists2(input2.target)) return false;
+    try {
+      return await fingerprintDirectory(input2.target) === input2.replacementFingerprint;
+    } catch {
+      return false;
+    }
   };
+  if (input2.backup && await exists2(input2.backup)) {
+    if (await exists2(input2.target)) {
+      if (!await targetMatchesReplacement()) return false;
+      try {
+        await removeTarget(input2.runtime, input2.target);
+      } catch {
+        return false;
+      }
+    }
+    try {
+      await moveTarget(input2.runtime, input2.backup, input2.target);
+    } catch {
+      return false;
+    }
+  } else if (!input2.hadTarget && await exists2(input2.target)) {
+    if (!await targetMatchesReplacement()) return false;
+    try {
+      await removeTarget(input2.runtime, input2.target);
+    } catch {
+      return false;
+    }
+  }
+  return recovered;
 }
-function addProfileCommands(program, dependencies2) {
-  const profile = program.command("profile").description("Manage SAG profiles");
-  profile.command("add").argument("<name>").argument("<url>").action(async (name, url) => {
-    emit(program, dependencies2, await dependencies2.configStore.addProfile(name, url));
-  });
-  profile.command("list").action(async () => {
-    emit(program, dependencies2, await dependencies2.configStore.listProfiles());
-  });
-  profile.command("use").argument("<name>").action(async (name) => {
-    emit(program, dependencies2, await dependencies2.configStore.useProfile(name));
-  });
-  profile.command("show").argument("[name]").action(async (name) => {
-    emit(program, dependencies2, await dependencies2.configStore.getProfile(name));
-  });
-  profile.command("remove").argument("<name>").action(async (name) => {
-    if (!commandOptions2(program).yes && !await dependencies2.confirm(`Remove profile ${name}?`)) {
-      emit(program, dependencies2, { removed: null, cancelled: true });
-      return;
+async function inspectOne(runtime2, agent, inspectExplicitTarget = false) {
+  const target = skillTargetPath(agent, runtime2);
+  assertUserTarget(target, agent, runtime2);
+  if (!inspectExplicitTarget && !await runtime2.agents[agent].installed()) {
+    return { agent, target, status: "unavailable", message: "Agent is not installed." };
+  }
+  const managed = await runtime2.state.getManagedSkill(agent, target);
+  if (!await exists2(target)) {
+    return managed ? {
+      agent,
+      target,
+      status: "drifted",
+      code: "INSTALL_TARGET_CONFLICT",
+      message: "Managed Skill directory is missing."
+    } : { agent, target, status: "missing", message: "Skill is not installed." };
+  }
+  if (!managed) {
+    return {
+      agent,
+      target,
+      status: "unmanaged",
+      code: "INSTALL_TARGET_CONFLICT",
+      message: "Existing Skill directory is not managed by SAG CLI."
+    };
+  }
+  try {
+    const manifest = await validateBundle(target, agent);
+    const fingerprint = await fingerprintDirectory(target);
+    if (managed.fingerprint !== fingerprint || managed.version !== manifest.packageVersion) {
+      return {
+        agent,
+        target,
+        status: "drifted",
+        code: "INSTALL_TARGET_CONFLICT",
+        message: "Managed Skill directory has changed outside SAG CLI."
+      };
     }
-    await dependencies2.configStore.removeProfile(name);
-    emit(program, dependencies2, { removed: name });
-  });
+    return {
+      agent,
+      target,
+      status: "installed",
+      version: manifest.packageVersion,
+      package: manifest.package,
+      message: "Managed Skill is installed."
+    };
+  } catch {
+    return {
+      agent,
+      target,
+      status: "drifted",
+      code: "INSTALL_TARGET_CONFLICT",
+      message: "Managed Skill directory has changed outside SAG CLI."
+    };
+  }
 }
-function addAuthCommands(program, dependencies2) {
-  const auth = program.command("auth").description("Manage SAG credentials");
-  auth.command("login").option("--name <name>", "SAG user name for the existing local login").action(async (options) => {
-    const context = await runtime(program, dependencies2);
-    const result = await login({
-      credentialRef: context.credentialRef,
-      ...context.connection.environmentToken ? { environmentToken: context.connection.environmentToken } : {},
-      ...options.name ? { name: options.name } : {},
-      promptName: dependencies2.promptName,
-      authenticate: (name) => dependencies2.createClient({ origin: context.connection.url }).login(name),
-      validate: async (token) => dependencies2.createClient({ origin: context.connection.url, token }).me(),
-      store: dependencies2.credentialStore
-    });
-    emit(program, dependencies2, result);
-  });
-  auth.command("status").action(async () => {
-    const context = await runtime(program, dependencies2);
-    const result = await status({
-      credentialRef: context.credentialRef,
-      ...context.connection.environmentToken ? { environmentToken: context.connection.environmentToken } : {},
-      validate: async (token) => dependencies2.createClient({ origin: context.connection.url, token }).me(),
-      store: dependencies2.credentialStore
+async function activeAgents(runtime2, selected) {
+  const choices = uniqueAgents(selected);
+  if (selected) return choices;
+  const installed = await Promise.all(
+    choices.map(async (agent) => ({
+      agent,
+      installed: await runtime2.agents[agent].installed()
+    }))
+  );
+  return installed.filter((choice) => choice.installed).map((choice) => choice.agent);
+}
+async function requireConfirmation(runtime2, selection, action) {
+  if (selection.yes) return true;
+  return await runtime2.confirm?.(`${action} SAG Knowledge Skill?`) ?? false;
+}
+async function inspectSkillTargets(runtime2, input2) {
+  const source = await validateBundle(
+    runtime2.bundlePath ?? bundledSkillPath2(),
+    "template"
+  );
+  const selected = input2.agents ? uniqueAgents(input2.agents) : agents;
+  const targets = await Promise.all(
+    selected.map((agent) => inspectOne(runtime2, agent, input2.agents !== void 0))
+  );
+  return {
+    package: source.package,
+    version: source.packageVersion,
+    targets,
+    completedWithErrors: targets.some((target) => target.status === "drifted")
+  };
+}
+async function installSkillTargets(runtime2, input2) {
+  if (input2.update && !runtime2.resolveLatestBundle) {
+    throw new CliError(
+      "DEPENDENCY_MISSING",
+      "Unable to resolve @latest Skill package",
+      {
+        exitCode: exitCodes.dependencyMissing,
+        hint: "Run this update through `npx @zleap-ai/sag-cli@latest` or restore npm access."
+      }
+    );
+  }
+  const resolved = input2.update ? await runtime2.resolveLatestBundle?.() : void 0;
+  const sourcePath = resolved?.bundlePath ?? runtime2.bundlePath ?? bundledSkillPath2();
+  const source = await validateBundle(sourcePath, "template");
+  const selected = await activeAgents(runtime2, input2.agents);
+  if (selected.length === 0) {
+    return {
+      package: source.package,
+      version: source.packageVersion,
+      targets: agents.map((agent) => ({
+        agent,
+        target: skillTargetPath(agent, runtime2),
+        status: "unavailable",
+        message: "No supported Agent was detected on this device."
+      })),
+      completedWithErrors: true
+    };
+  }
+  if (!await requireConfirmation(runtime2, input2, "Install")) {
+    return {
+      package: source.package,
+      version: source.packageVersion,
+      targets: selected.map((agent) => ({
+        agent,
+        target: skillTargetPath(agent, runtime2),
+        status: "skipped",
+        message: "Installation was not confirmed."
+      })),
+      completedWithErrors: false
+    };
+  }
+  const targets = [];
+  try {
+    for (const agent of selected) {
+      const target = skillTargetPath(agent, runtime2);
+      assertUserTarget(target, agent, runtime2);
+      try {
+        targets.push(
+          await withTargetLease(target, async () => {
+            const inspection = await inspectOne(
+              runtime2,
+              agent,
+              input2.agents !== void 0
+            );
+            if (inspection.status === "installed" && inspection.version === source.packageVersion) {
+              return {
+                ...inspection,
+                status: "skipped",
+                message: "Managed Skill is already current."
+              };
+            }
+            if (inspection.status === "unmanaged" || inspection.status === "drifted") {
+              return { ...inspection, status: "conflict" };
+            }
+            if (inspection.status === "unavailable") return inspection;
+            const temporary = sibling(target, "tmp");
+            const hadTarget = inspection.status === "installed";
+            let backup;
+            let replacementFingerprint;
+            try {
+              await cp2(sourcePath, temporary, {
+                recursive: true,
+                errorOnExist: true,
+                force: false
+              });
+              const temporaryManifestPath = path13.join(temporary, "manifest.json");
+              const temporaryManifest = await validateBundle(temporary, "template");
+              await writeFile6(
+                temporaryManifestPath,
+                `${JSON.stringify({ ...temporaryManifest, agent }, null, 2)}
+`,
+                "utf8"
+              );
+              await validateBundle(temporary, agent);
+              replacementFingerprint = await fingerprintDirectory(temporary);
+              await runtime2.agents[agent].installSkill?.();
+              if (hadTarget) {
+                backup = sibling(target, "backup");
+                await moveTarget(runtime2, target, backup);
+              }
+              await moveTarget(runtime2, temporary, target);
+              if (await fingerprintDirectory(target) !== replacementFingerprint) {
+                throw new Error("Skill target changed during installation");
+              }
+              const managed = {
+                agent,
+                target,
+                version: source.packageVersion,
+                fingerprint: replacementFingerprint,
+                ...backup ? { backupPath: backup } : {}
+              };
+              await runtime2.state.saveManagedSkill(managed);
+              return {
+                agent,
+                target,
+                status: hadTarget ? "updated" : "created",
+                version: source.packageVersion,
+                package: source.package,
+                message: "Skill installed."
+              };
+            } catch {
+              const restored = await restore({
+                runtime: runtime2,
+                target,
+                temporary,
+                ...backup ? { backup } : {},
+                hadTarget,
+                ...replacementFingerprint ? { replacementFingerprint } : {}
+              }).catch(() => false);
+              return {
+                agent,
+                target,
+                status: "failed",
+                message: restored ? "Skill installation failed and this target was restored." : "Skill installation failed and recovery was incomplete."
+              };
+            }
+          })
+        );
+      } catch (error) {
+        if (!(error instanceof SkillTargetLeaseError)) throw error;
+        targets.push({
+          agent,
+          target,
+          status: "conflict",
+          code: "INSTALL_TARGET_CONFLICT",
+          message: "Skill target is busy; wait for the active SAG CLI operation and retry."
+        });
+      }
+    }
+    return {
+      package: source.package,
+      version: source.packageVersion,
+      targets,
+      completedWithErrors: targets.some(
+        (target) => ["failed", "conflict"].includes(target.status)
+      )
+    };
+  } finally {
+    await resolved?.cleanup();
+  }
+}
+async function uninstallSkillTargets(runtime2, input2) {
+  const source = await validateBundle(
+    runtime2.bundlePath ?? bundledSkillPath2(),
+    "template"
+  );
+  const selected = await activeAgents(runtime2, input2.agents);
+  if (!await requireConfirmation(runtime2, input2, "Uninstall")) {
+    return {
+      package: source.package,
+      version: source.packageVersion,
+      targets: selected.map((agent) => ({
+        agent,
+        target: skillTargetPath(agent, runtime2),
+        status: "skipped",
+        message: "Uninstall was not confirmed."
+      })),
+      completedWithErrors: false
+    };
+  }
+  const targets = [];
+  for (const agent of selected) {
+    const target = skillTargetPath(agent, runtime2);
+    assertUserTarget(target, agent, runtime2);
+    try {
+      targets.push(
+        await withTargetLease(target, async () => {
+          const inspection = await inspectOne(
+            runtime2,
+            agent,
+            input2.agents !== void 0
+          );
+          if (inspection.status === "missing") return inspection;
+          if (inspection.status !== "installed") {
+            return {
+              ...inspection,
+              status: "conflict",
+              code: "INSTALL_TARGET_CONFLICT"
+            };
+          }
+          const removed = sibling(inspection.target, "remove");
+          const managed = await runtime2.state.getManagedSkill(agent, inspection.target);
+          try {
+            await moveTarget(runtime2, inspection.target, removed);
+            await runtime2.state.deleteManagedSkill(agent, inspection.target);
+            await removeTarget(runtime2, removed);
+            return {
+              agent,
+              target: inspection.target,
+              status: "removed",
+              ...inspection.version ? { version: inspection.version } : {},
+              package: source.package,
+              message: "Managed Skill was removed."
+            };
+          } catch {
+            const recovery = managed && await exists2(removed) ? await recoverUninstall({
+              runtime: runtime2,
+              agent,
+              target: inspection.target,
+              removed,
+              managed
+            }) : "incomplete";
+            return {
+              agent,
+              target: inspection.target,
+              status: "failed",
+              message: recovery === "restored" ? "Skill uninstall failed; target and managed state were restored." : recovery === "active-unmanaged" ? "Skill uninstall failed; recovery is incomplete and the active target is unmanaged." : "Skill uninstall failed and recovery was incomplete."
+            };
+          }
+        })
+      );
+    } catch (error) {
+      if (!(error instanceof SkillTargetLeaseError)) throw error;
+      targets.push({
+        agent,
+        target,
+        status: "conflict",
+        code: "INSTALL_TARGET_CONFLICT",
+        message: "Skill target is busy; wait for the active SAG CLI operation and retry."
+      });
+    }
+  }
+  return {
+    package: source.package,
+    version: source.packageVersion,
+    targets,
+    completedWithErrors: targets.some(
+      (target) => ["failed", "conflict"].includes(target.status)
+    )
+  };
+}
+var skillInstallerExitCode = exitCodes.configConflict;
+
+// src/skill/account-auth.ts
+import { createHash as createHash7, randomBytes as nodeRandomBytes } from "crypto";
+import { setTimeout as delay } from "timers/promises";
+async function authorizeSkillAccount(runtime2, origin) {
+  const normalizedOrigin = normalizeSkillOrigin(origin);
+  const random = runtime2.randomBytes ?? nodeRandomBytes;
+  const verifier2 = random(32).toString("base64url");
+  const challenge = createHash7("sha256").update(verifier2).digest("base64url");
+  const session = await runtime2.client.createLoginSession(normalizedOrigin, challenge);
+  await runtime2.openBrowser(session.verificationUrl);
+  const sleep = runtime2.sleep ?? delay;
+  for (; ; ) {
+    if (runtime2.now().getTime() >= new Date(session.expiresAt).getTime()) {
+      throw expiredAuthorization();
+    }
+    const current = await runtime2.client.getLoginSession(
+      normalizedOrigin,
+      session.sessionId
+    );
+    if (current.status === "denied") {
+      throw new SkillError(
+        "PERMISSION_DENIED",
+        "SAG account authorization was denied",
+        { exitCode: exitCodes.permissionDenied }
+      );
+    }
+    if (current.status === "consumed") throw expiredAuthorization();
+    if (current.status === "approved") {
+      const account = await runtime2.client.exchange(normalizedOrigin, {
+        sessionId: session.sessionId,
+        pkceVerifier: verifier2
+      });
+      await runtime2.config.saveAccount(normalizedOrigin, account);
+      return { origin: normalizedOrigin, account, browserOpened: true };
+    }
+    await sleep(1e3);
+  }
+}
+async function withFreshSkillAccount(runtime2, origin, operation) {
+  const normalizedOrigin = normalizeSkillOrigin(origin);
+  const current = await requireAccount(runtime2, normalizedOrigin);
+  if (isFuture(current.accessExpiresAt, runtime2.now())) {
+    return operation(current.accessToken);
+  }
+  const accessToken = await runtime2.config.withRefreshLock(
+    normalizedOrigin,
+    async () => {
+      const latest = await requireAccount(runtime2, normalizedOrigin);
+      if (isFuture(latest.accessExpiresAt, runtime2.now())) return latest.accessToken;
+      if (!isFuture(latest.refreshExpiresAt, runtime2.now())) {
+        await runtime2.config.removeAccount(normalizedOrigin);
+        throw expiredAuthorization();
+      }
+      try {
+        const rotated = await runtime2.client.refresh(
+          normalizedOrigin,
+          latest.refreshToken
+        );
+        const next = {
+          ...rotated,
+          ...latest.recentKnowledgeBase && !rotated.recentKnowledgeBase ? { recentKnowledgeBase: latest.recentKnowledgeBase } : {}
+        };
+        await runtime2.config.saveAccount(normalizedOrigin, next);
+        return next.accessToken;
+      } catch (error) {
+        if (error instanceof SkillError && (error.code === "AUTH_EXPIRED" || error.code === "AUTH_REQUIRED")) {
+          await runtime2.config.removeAccount(normalizedOrigin);
+        }
+        throw error;
+      }
+    }
+  );
+  return operation(accessToken);
+}
+async function logoutSkillAccount(runtime2, origin) {
+  const normalizedOrigin = normalizeSkillOrigin(origin);
+  const account = await runtime2.config.getAccount(normalizedOrigin);
+  if (!account) return false;
+  await runtime2.client.logout(
+    normalizedOrigin,
+    account.accessToken,
+    account.refreshToken
+  );
+  await runtime2.config.removeAccount(normalizedOrigin);
+  return true;
+}
+async function requireAccount(runtime2, origin) {
+  const account = await runtime2.config.getAccount(origin);
+  if (account) return account;
+  throw new SkillError("AUTH_REQUIRED", "SAG account authorization is required", {
+    exitCode: exitCodes.authRequired
+  });
+}
+function isFuture(value, now) {
+  return new Date(value).getTime() > now.getTime();
+}
+function expiredAuthorization() {
+  return new SkillError("AUTH_EXPIRED", "SAG account authorization has expired", {
+    exitCode: exitCodes.authRequired
+  });
+}
+
+// src/skill/account-knowledge.ts
+async function renameSkillAccountDocument(runtime2, origin, input2) {
+  const knowledgeBase = await selectedKnowledgeBase(
+    runtime2,
+    origin,
+    input2.knowledgeBase
+  );
+  const renamed = await withSkillAccountKnowledgeClient(
+    runtime2,
+    origin,
+    (client) => client.renameDocument({
+      knowledgeBaseId: knowledgeBase.id,
+      documentId: input2.documentId,
+      expectedVersion: input2.expectedVersion,
+      idempotencyKey: runtime2.createId(),
+      title: input2.title
+    })
+  );
+  await remember(runtime2, origin, knowledgeBase);
+  return renamed;
+}
+async function deleteSkillAccountDocument(runtime2, origin, input2) {
+  const knowledgeBase = await selectedKnowledgeBase(
+    runtime2,
+    origin,
+    input2.knowledgeBase
+  );
+  const deleted = await withSkillAccountKnowledgeClient(
+    runtime2,
+    origin,
+    (client) => client.deleteDocument({
+      knowledgeBaseId: knowledgeBase.id,
+      documentId: input2.documentId,
+      expectedVersion: input2.expectedVersion,
+      idempotencyKey: runtime2.createId()
+    })
+  );
+  await remember(runtime2, origin, knowledgeBase);
+  return deleted;
+}
+async function listSkillAccountKnowledgeBases(runtime2, origin) {
+  return withSkillAccountKnowledgeClient(
+    runtime2,
+    origin,
+    (client) => client.listKnowledgeBases()
+  );
+}
+async function listSkillAccountDocuments(runtime2, origin, selector) {
+  const normalizedOrigin = normalizeSkillOrigin(origin);
+  const knowledgeBases = await listSkillAccountKnowledgeBases(
+    runtime2,
+    normalizedOrigin
+  );
+  const knowledgeBase = resolveKnowledgeBase(knowledgeBases, selector);
+  const documents = await withSkillAccountKnowledgeClient(
+    runtime2,
+    normalizedOrigin,
+    (client) => client.listDocuments(knowledgeBase.id)
+  );
+  await runtime2.config.saveRecentKnowledgeBase(normalizedOrigin, {
+    id: knowledgeBase.id,
+    name: knowledgeBase.name
+  });
+  return { knowledgeBase, documents };
+}
+async function askSkillAccountKnowledge(runtime2, origin, question, selector) {
+  const normalizedOrigin = normalizeSkillOrigin(origin);
+  let knowledgeBase;
+  if (selector) {
+    knowledgeBase = resolveKnowledgeBase(
+      await listSkillAccountKnowledgeBases(runtime2, normalizedOrigin),
+      selector
+    );
+  }
+  const answer = await withSkillAccountKnowledgeClient(
+    runtime2,
+    normalizedOrigin,
+    (client) => {
+      if (!client.ask) {
+        throw new SkillError(
+          "PLATFORM_UNAVAILABLE",
+          "SAG account question answering is unavailable",
+          { exitCode: exitCodes.serviceNotReady }
+        );
+      }
+      return client.ask(question, knowledgeBase?.id);
+    }
+  );
+  if (knowledgeBase) {
+    await runtime2.config.saveRecentKnowledgeBase(normalizedOrigin, {
+      id: knowledgeBase.id,
+      name: knowledgeBase.name
+    });
+  }
+  return answer;
+}
+function resolveKnowledgeBase(knowledgeBases, selector) {
+  const exactId = knowledgeBases.find((item) => item.id === selector);
+  if (exactId) return exactId;
+  const exactAlias = knowledgeBases.filter((item) => item.alias === selector);
+  if (exactAlias.length === 1) return exactAlias[0];
+  const normalized = selector.trim().toLocaleLowerCase();
+  const names = knowledgeBases.filter(
+    (item) => item.name.toLocaleLowerCase() === normalized
+  );
+  if (names.length === 1) return names[0];
+  throw new SkillError(
+    "INVALID_ARGUMENT",
+    names.length > 1 ? "Knowledge Base name is ambiguous" : "Knowledge Base was not found",
+    {
+      details: { selector },
+      exitCode: exitCodes.invalidArgument
+    }
+  );
+}
+async function selectedKnowledgeBase(runtime2, origin, selector) {
+  return resolveKnowledgeBase(
+    await listSkillAccountKnowledgeBases(runtime2, origin),
+    selector
+  );
+}
+async function remember(runtime2, origin, knowledgeBase) {
+  await runtime2.config.saveRecentKnowledgeBase(origin, {
+    id: knowledgeBase.id,
+    name: knowledgeBase.name
+  });
+}
+async function withSkillAccountKnowledgeClient(runtime2, origin, operation) {
+  const normalizedOrigin = normalizeSkillOrigin(origin);
+  return withFreshSkillAccount(
+    runtime2.auth,
+    normalizedOrigin,
+    (accessToken) => operation(runtime2.createClient({ accessToken, origin: normalizedOrigin }))
+  );
+}
+
+// src/skill/account-upload.ts
+import { createHash as createHash8 } from "crypto";
+import { createReadStream } from "fs";
+import { stat as stat3 } from "fs/promises";
+import path14 from "path";
+var DEFAULT_MAX_UPLOAD_BYTES = 25 * 1024 * 1024;
+async function uploadSkillAccountFile(runtime2, origin, filePath, knowledgeBaseSelector, waitMs = 30 * 60 * 1e3, overwriteDocumentId) {
+  const file = await inspectFile(filePath);
+  const knowledgeBase = resolveKnowledgeBase(
+    await listSkillAccountKnowledgeBases(runtime2, origin),
+    knowledgeBaseSelector
+  );
+  const serverLimit = await withSkillAccountKnowledgeClient(
+    runtime2,
+    origin,
+    (client) => {
+      if (!client.getServerLimit) return Promise.resolve(void 0);
+      return client.getServerLimit(knowledgeBase.id);
+    }
+  );
+  const limit = Math.min(
+    DEFAULT_MAX_UPLOAD_BYTES,
+    serverLimit ?? DEFAULT_MAX_UPLOAD_BYTES
+  );
+  if (file.size > limit) {
+    throw new SkillError(
+      "FILE_TOO_LARGE",
+      `This file exceeds the ${limit}-byte Knowledge Base upload limit.`,
+      {
+        details: { limit_bytes: limit, size_bytes: file.size },
+        exitCode: exitCodes.invalidArgument
+      }
+    );
+  }
+  const digest2 = await sha256(filePath);
+  const receipt = await withSkillAccountKnowledgeClient(runtime2, origin, (client) => {
+    if (!client.upload) return unavailableUpload();
+    return client.upload({
+      fileDigest: digest2,
+      fileName: file.name,
+      filePath,
+      fileSize: file.size,
+      idempotencyKey: runtime2.createId(),
+      knowledgeBaseId: knowledgeBase.id,
+      ...overwriteDocumentId ? { overwriteDocumentId } : {}
+    });
+  });
+  const accepted = {
+    event: "accepted",
+    importId: receipt.importId,
+    documentId: receipt.documentId,
+    jobId: receipt.jobId
+  };
+  await runtime2.onEvent?.(accepted);
+  if (waitMs === 0) {
+    const detached = { ...accepted, event: "detached" };
+    await runtime2.onEvent?.(detached);
+    return [accepted, detached];
+  }
+  const terminal = await poll(
+    runtime2,
+    origin,
+    knowledgeBase.id,
+    receipt.importId,
+    waitMs
+  );
+  return [accepted, terminal];
+}
+async function inspectSkillAccountUpload(runtime2, origin, importId, knowledgeBaseSelector) {
+  const knowledgeBase = resolveKnowledgeBase(
+    await listSkillAccountKnowledgeBases(runtime2, origin),
+    knowledgeBaseSelector
+  );
+  return readStatus(runtime2, origin, knowledgeBase.id, importId);
+}
+async function poll(runtime2, origin, knowledgeBaseId, importId, waitMs) {
+  const startedAt = runtime2.now().getTime();
+  for (; ; ) {
+    const event = await readStatus(runtime2, origin, knowledgeBaseId, importId);
+    await runtime2.onEvent?.(event);
+    if (event.event !== "processing") return event;
+    if (runtime2.now().getTime() - startedAt >= waitMs) {
+      const detached = { event: "detached", importId };
+      await runtime2.onEvent?.(detached);
+      return detached;
+    }
+    await runtime2.sleep(2e3);
+  }
+}
+async function readStatus(runtime2, origin, knowledgeBaseId, importId) {
+  const current = await withSkillAccountKnowledgeClient(runtime2, origin, (client) => {
+    if (!client.getImportStatus) return unavailableUpload();
+    return client.getImportStatus(knowledgeBaseId, importId);
+  });
+  return {
+    event: current.searchable ? "completed" : current.state === "failed" ? "failed" : "processing",
+    importId,
+    ...current.failure ? { failure: current.failure } : {}
+  };
+}
+async function inspectFile(filePath) {
+  let metadata;
+  try {
+    metadata = await stat3(filePath);
+  } catch {
+    throw new SkillError("FILE_NOT_FOUND", "The upload file could not be found.", {
+      exitCode: exitCodes.invalidArgument
+    });
+  }
+  if (!metadata.isFile()) {
+    throw new SkillError(
+      "UNSUPPORTED_FILE_TYPE",
+      "Upload accepts one regular file, not a directory or batch.",
+      { exitCode: exitCodes.invalidArgument }
+    );
+  }
+  return { name: path14.basename(filePath), size: metadata.size };
+}
+async function sha256(filePath) {
+  const digest2 = createHash8("sha256");
+  for await (const chunk of createReadStream(filePath)) digest2.update(chunk);
+  return `sha256:${digest2.digest("hex")}`;
+}
+function unavailableUpload() {
+  throw new SkillError("PLATFORM_UNAVAILABLE", "SAG upload is unavailable", {
+    exitCode: exitCodes.serviceNotReady
+  });
+}
+
+// src/skill/knowledge-client.ts
+import { z as z14 } from "zod";
+import { openAsBlob } from "fs";
+var knowledgeBaseSchema = z14.strictObject({
+  alias: z14.string().min(1).optional(),
+  id: z14.string().min(1),
+  name: z14.string().min(1)
+});
+var knowledgeBaseDirectorySchema = z14.strictObject({
+  items: z14.array(knowledgeBaseSchema)
+});
+var documentSchema2 = z14.strictObject({
+  id: z14.string().min(1),
+  knowledge_base_id: z14.string().min(1),
+  title: z14.string().min(1),
+  version: z14.number().int().positive()
+});
+var documentDirectorySchema = z14.strictObject({
+  items: z14.array(documentSchema2)
+});
+var deletedDocumentSchema = z14.strictObject({
+  deleted_at: z14.string().datetime({ offset: true }),
+  document_id: z14.string().min(1),
+  recoverable: z14.literal(true),
+  version: z14.number().int().positive()
+});
+var uploadStateSchema = z14.enum([
+  "queued",
+  "accepted",
+  "processing",
+  "completed",
+  "failed"
+]);
+var uploadResponseSchema = z14.strictObject({
+  document_id: z14.string().min(1),
+  import_id: z14.string().min(1),
+  job_id: z14.string().min(1),
+  state: uploadStateSchema
+});
+var uploadLimitSchema = z14.strictObject({
+  max_upload_bytes: z14.number().int().positive()
+});
+var importStatusSchema = z14.strictObject({
+  failure: z14.string().min(1).optional(),
+  searchable: z14.boolean(),
+  state: uploadStateSchema
+});
+var answerSchema = z14.strictObject({
+  answer: z14.string().min(1),
+  citations: z14.array(
+    z14.strictObject({
+      number: z14.number().int().positive(),
+      knowledge_base_id: z14.string().min(1),
+      document_id: z14.string().min(1),
+      document_version_id: z14.string().min(1),
+      excerpt: z14.string(),
+      location: z14.string().min(1).optional()
+    })
+  ),
+  search_completeness: z14.enum(["complete", "partial"]),
+  search_partial_reasons: z14.array(z14.string().min(1))
+});
+var problemSchema2 = z14.object({
+  code: z14.string().min(1),
+  data: z14.unknown().optional()
+}).passthrough();
+var duplicateImportDetailsSchema = z14.object({
+  conflict_type: z14.enum([
+    "same_filename_same_checksum",
+    "same_filename_changed_checksum"
+  ]),
+  existing_document_id: z14.string().min(1),
+  existing_import_id: z14.string().min(1),
+  existing_filename: z14.string().min(1),
+  current_filename: z14.string().min(1),
+  checksum_sha256: z14.string().min(1),
+  existing_state: z14.string().min(1),
+  overwrite_allowed: z14.boolean()
+});
+function httpError(status2, problemCode, problemData) {
+  const normalizedProblemCode = problemCode.toLowerCase();
+  const details = { problemCode };
+  if (normalizedProblemCode === "invalid_grant" || normalizedProblemCode === "expired_token") {
+    return new SkillError("AUTH_EXPIRED", "SAG account authorization has expired", {
+      exitCode: exitCodes.authRequired,
+      ...details
+    });
+  }
+  if (normalizedProblemCode === "document_title_conflict") {
+    return new SkillError("DOCUMENT_TITLE_CONFLICT", "The document title conflicts", {
+      exitCode: exitCodes.configConflict,
+      ...details
+    });
+  }
+  if (normalizedProblemCode === "document_import_duplicate") {
+    const details2 = duplicateImportDetailsSchema.safeParse(problemData);
+    return new SkillError(
+      "DOCUMENT_IMPORT_DUPLICATE",
+      "A file with the same name already exists in this Knowledge Base",
+      {
+        ...details2.success ? { details: details2.data } : {},
+        exitCode: exitCodes.configConflict,
+        problemCode
+      }
+    );
+  }
+  if (normalizedProblemCode === "stale_version") {
+    return new SkillError("STALE_VERSION", "The document version is stale", {
+      exitCode: exitCodes.configConflict,
+      ...details
+    });
+  }
+  if (status2 === 401) {
+    return new SkillError("AUTH_REQUIRED", "Skill authorization is required", {
+      exitCode: exitCodes.authRequired,
+      ...details
+    });
+  }
+  if (status2 === 403) {
+    return new SkillError("PERMISSION_DENIED", "Skill authorization was denied", {
+      exitCode: exitCodes.permissionDenied,
+      ...details
+    });
+  }
+  if (status2 === 404) {
+    return new SkillError(
+      "DOCUMENT_NOT_FOUND",
+      "Skill Knowledge resource was not found",
+      {
+        exitCode: exitCodes.resourceNotFound,
+        ...details
+      }
+    );
+  }
+  if (status2 === 409) {
+    return new SkillError("CONFIG_CONFLICT", "Skill Knowledge request conflicts", {
+      exitCode: exitCodes.configConflict,
+      ...details
+    });
+  }
+  if (status2 === 429) {
+    return new SkillError(
+      "RATE_LIMITED",
+      "Skill Knowledge service rate limit reached",
+      {
+        exitCode: exitCodes.networkUnreachable,
+        ...details
+      }
+    );
+  }
+  if (status2 >= 500) {
+    return new SkillError(
+      "PLATFORM_UNAVAILABLE",
+      "Skill Knowledge service is unavailable",
+      {
+        exitCode: exitCodes.serviceNotReady,
+        ...details
+      }
+    );
+  }
+  return new SkillError(
+    "INVALID_RESPONSE",
+    "Skill Knowledge service returned an incompatible response",
+    {
+      exitCode: exitCodes.internalError,
+      ...details
+    }
+  );
+}
+function throwIfAborted(signal) {
+  if (!signal?.aborted) return;
+  throw signal.reason instanceof Error ? signal.reason : new DOMException("The request was interrupted.", "AbortError");
+}
+var SkillKnowledgeHttpClient = class {
+  #accessToken;
+  #fetch;
+  #origin;
+  #timeoutMs;
+  constructor(options) {
+    try {
+      this.#origin = normalizeSkillOrigin(options.origin);
+    } catch {
+      throw new SkillError("CONFIG_CONFLICT", "SAG address is invalid", {
+        exitCode: exitCodes.configConflict
+      });
+    }
+    if (!options.accessToken) {
+      throw new SkillError("AUTH_REQUIRED", "Skill authorization is required", {
+        exitCode: exitCodes.authRequired
+      });
+    }
+    this.#accessToken = options.accessToken;
+    this.#fetch = options.fetchImplementation ?? fetch;
+    this.#timeoutMs = options.timeoutMs ?? 15e3;
+  }
+  async ask(question, knowledgeBaseId) {
+    const answer = this.#parse(
+      answerSchema,
+      await this.#request("/api/v1/integrations/skill/v1/questions", {
+        body: {
+          question,
+          ...knowledgeBaseId ? { knowledge_base_id: knowledgeBaseId } : {}
+        },
+        method: "POST"
+      })
+    );
+    return {
+      answer: answer.answer,
+      citations: answer.citations.map((citation) => ({
+        number: citation.number,
+        knowledgeBaseId: citation.knowledge_base_id,
+        documentId: citation.document_id,
+        documentVersionId: citation.document_version_id,
+        excerpt: citation.excerpt,
+        ...citation.location ? { location: citation.location } : {}
+      })),
+      completeness: answer.search_completeness,
+      partialReasons: answer.search_partial_reasons
+    };
+  }
+  async listKnowledgeBases() {
+    const parsed = await this.#request(
+      "/api/v1/integrations/skill/v1/knowledge-bases",
+      {
+        method: "GET"
+      }
+    );
+    return this.#parse(knowledgeBaseDirectorySchema, parsed).items.map(
+      (knowledgeBase) => ({
+        id: knowledgeBase.id,
+        name: knowledgeBase.name,
+        ...knowledgeBase.alias ? { alias: knowledgeBase.alias } : {}
+      })
+    );
+  }
+  async listDocuments(knowledgeBaseId) {
+    const parsed = await this.#request(
+      `/api/v1/integrations/skill/v1/knowledge-bases/${encodeURIComponent(knowledgeBaseId)}/documents`,
+      { method: "GET" }
+    );
+    return this.#parse(documentDirectorySchema, parsed).items.map((document) => ({
+      id: document.id,
+      knowledgeBaseId: document.knowledge_base_id,
+      title: document.title,
+      version: document.version
+    }));
+  }
+  async renameDocument(input2) {
+    const document = this.#parse(
+      documentSchema2,
+      await this.#request(this.#mutationPath(input2), {
+        body: { title: input2.title },
+        headers: this.#mutationHeaders(input2),
+        method: "PATCH"
+      })
+    );
+    if (document.id !== input2.documentId || document.knowledge_base_id !== input2.knowledgeBaseId) {
+      throw new SkillError(
+        "INVALID_RESPONSE",
+        "Skill Knowledge service returned a different document",
+        {
+          exitCode: exitCodes.internalError
+        }
+      );
+    }
+    return {
+      id: document.id,
+      knowledgeBaseId: document.knowledge_base_id,
+      title: document.title,
+      version: document.version
+    };
+  }
+  async deleteDocument(input2) {
+    const deleted = this.#parse(
+      deletedDocumentSchema,
+      await this.#request(this.#mutationPath(input2), {
+        headers: this.#mutationHeaders(input2),
+        method: "DELETE"
+      })
+    );
+    if (deleted.document_id !== input2.documentId) {
+      throw new SkillError(
+        "INVALID_RESPONSE",
+        "Skill Knowledge service returned a different document",
+        {
+          exitCode: exitCodes.internalError
+        }
+      );
+    }
+    return {
+      deletedAt: deleted.deleted_at,
+      documentId: deleted.document_id,
+      recoverable: deleted.recoverable,
+      version: deleted.version
+    };
+  }
+  async getServerLimit(knowledgeBaseId, signal) {
+    return this.#parse(
+      uploadLimitSchema,
+      await this.#request(
+        `/api/v1/integrations/skill/v1/knowledge-bases/${encodeURIComponent(knowledgeBaseId)}/upload-limit`,
+        { method: "GET", ...signal ? { signal } : {} }
+      )
+    ).max_upload_bytes;
+  }
+  async upload(input2, signal) {
+    throwIfAborted(signal);
+    const form = new FormData();
+    form.set("file", await openAsBlob(input2.filePath), input2.fileName);
+    if (input2.overwriteDocumentId) {
+      form.set("overwrite_document_id", input2.overwriteDocumentId);
+    }
+    const payload = await this.#multipartRequest(
+      `/api/v1/integrations/skill/v1/knowledge-bases/${encodeURIComponent(input2.knowledgeBaseId)}/documents`,
+      form,
+      input2.idempotencyKey,
+      signal
+    );
+    const response = this.#parse(uploadResponseSchema, payload);
+    return {
+      documentId: response.document_id,
+      importId: response.import_id,
+      jobId: response.job_id,
+      state: response.state
+    };
+  }
+  async getImportStatus(knowledgeBaseId, importId, signal) {
+    const status2 = this.#parse(
+      importStatusSchema,
+      await this.#request(
+        `/api/v1/integrations/skill/v1/knowledge-bases/${encodeURIComponent(knowledgeBaseId)}/imports/${encodeURIComponent(importId)}`,
+        { method: "GET", ...signal ? { signal } : {} }
+      )
+    );
+    return {
+      searchable: status2.searchable,
+      state: status2.state,
+      ...status2.failure ? { failure: status2.failure } : {}
+    };
+  }
+  async #request(path16, options) {
+    let response;
+    try {
+      throwIfAborted(options.signal);
+      response = await this.#fetch(new URL(path16, this.#origin), {
+        headers: {
+          Accept: "application/json",
+          Authorization: `Bearer ${this.#accessToken}`,
+          "Cache-Control": "no-store",
+          ...options.headers,
+          ...options.body === void 0 ? {} : { "Content-Type": "application/json" }
+        },
+        method: options.method,
+        redirect: "error",
+        signal: this.#requestSignal(options.signal),
+        ...options.body === void 0 ? {} : { body: JSON.stringify(options.body) }
+      });
+    } catch (error) {
+      if (options.signal?.aborted) throw error;
+      throw new SkillError(
+        "NETWORK_UNREACHABLE",
+        "Cannot reach the Skill Knowledge service",
+        {
+          exitCode: exitCodes.networkUnreachable
+        }
+      );
+    }
+    if (response.redirected || response.status >= 300 && response.status < 400) {
+      throw new SkillError(
+        "INVALID_RESPONSE",
+        "Skill Knowledge service redirect was rejected",
+        {
+          exitCode: exitCodes.internalError
+        }
+      );
+    }
+    const payload = await response.json().catch(() => void 0);
+    if (!response.ok) {
+      const problem = problemSchema2.safeParse(payload);
+      throw httpError(
+        response.status,
+        problem.success ? problem.data.code : "unknown",
+        problem.success ? problem.data.data : void 0
+      );
+    }
+    return payload;
+  }
+  #mutationPath(input2) {
+    return `/api/v1/integrations/skill/v1/knowledge-bases/${encodeURIComponent(input2.knowledgeBaseId)}/documents/${encodeURIComponent(input2.documentId)}`;
+  }
+  #mutationHeaders(input2) {
+    return {
+      "Idempotency-Key": input2.idempotencyKey,
+      "If-Match": `"document.${input2.documentId}.v${input2.expectedVersion}"`
+    };
+  }
+  async #multipartRequest(path16, body, idempotencyKey, signal) {
+    let response;
+    try {
+      throwIfAborted(signal);
+      response = await this.#fetch(new URL(path16, this.#origin), {
+        headers: {
+          Accept: "application/json",
+          Authorization: `Bearer ${this.#accessToken}`,
+          "Cache-Control": "no-store",
+          "Idempotency-Key": idempotencyKey
+        },
+        method: "POST",
+        redirect: "error",
+        signal: this.#requestSignal(signal),
+        body
+      });
+    } catch (error) {
+      if (signal?.aborted) throw error;
+      throw new SkillError(
+        "NETWORK_UNREACHABLE",
+        "Cannot reach the Skill Knowledge service",
+        {
+          exitCode: exitCodes.networkUnreachable
+        }
+      );
+    }
+    if (response.redirected || response.status >= 300 && response.status < 400) {
+      throw new SkillError(
+        "INVALID_RESPONSE",
+        "Skill Knowledge service redirect was rejected",
+        {
+          exitCode: exitCodes.internalError
+        }
+      );
+    }
+    const payload = await response.json().catch(() => void 0);
+    if (!response.ok) {
+      const problem = problemSchema2.safeParse(payload);
+      throw httpError(
+        response.status,
+        problem.success ? problem.data.code : "unknown",
+        problem.success ? problem.data.data : void 0
+      );
+    }
+    return payload;
+  }
+  #requestSignal(signal) {
+    const timeout = AbortSignal.timeout(this.#timeoutMs);
+    return signal ? AbortSignal.any([signal, timeout]) : timeout;
+  }
+  #parse(schema, payload) {
+    const parsed = schema.safeParse(payload);
+    if (parsed.success) return parsed.data;
+    throw new SkillError(
+      "INVALID_RESPONSE",
+      "Skill Knowledge service returned an incompatible response",
+      {
+        exitCode: exitCodes.internalError
+      }
+    );
+  }
+};
+
+// src/program.ts
+function parseInteger(value) {
+  return Number.parseInt(value, 10);
+}
+function parsePositiveInteger(value) {
+  const parsed = Number.parseInt(value, 10);
+  if (!Number.isSafeInteger(parsed) || parsed <= 0) {
+    throw new CliError("INVALID_ARGUMENT", "\u53C2\u6570\u5FC5\u987B\u662F\u6B63\u6574\u6570", {
+      exitCode: exitCodes.invalidArgument
+    });
+  }
+  return parsed;
+}
+function parseNonNegativeInteger(value) {
+  const parsed = Number.parseInt(value, 10);
+  if (!Number.isSafeInteger(parsed) || parsed < 0) {
+    throw new CliError("INVALID_ARGUMENT", "\u53C2\u6570\u5FC5\u987B\u662F\u975E\u8D1F\u6574\u6570", {
+      exitCode: exitCodes.invalidArgument
+    });
+  }
+  return parsed;
+}
+function parseAgent(value) {
+  if (value === "codex" || value === "claude-code") {
+    return value;
+  }
+  throw new CliError("INVALID_ARGUMENT", `Unsupported Agent: ${value}`, {
+    exitCode: exitCodes.invalidArgument,
+    hint: "Choose codex or claude-code."
+  });
+}
+function parseEnterpriseAgent(value) {
+  if (value === "codex" || value === "claude-code" || value === "workbuddy") {
+    return value;
+  }
+  throw new CliError("INVALID_ARGUMENT", `\u4E0D\u652F\u6301\u7684 Agent\uFF1A${value}`, {
+    exitCode: exitCodes.invalidArgument,
+    hint: "\u8BF7\u9009\u62E9 codex\u3001claude-code \u6216 workbuddy\u3002"
+  });
+}
+function parseCredentialStore(value) {
+  if (value === "keychain" || value === "file") return value;
+  throw new CliError("INVALID_ARGUMENT", `\u4E0D\u652F\u6301\u7684\u51ED\u636E\u5B58\u50A8\uFF1A${value}`, {
+    exitCode: exitCodes.invalidArgument,
+    hint: "\u8BF7\u9009\u62E9 keychain \u6216 file\u3002"
+  });
+}
+function resolveEnterpriseSkillAgent(positional, option) {
+  if (positional && option && positional !== option) {
+    throw new CliError(
+      "INVALID_ARGUMENT",
+      "\u4F4D\u7F6E\u53C2\u6570 Agent \u4E0E --agent \u6307\u5B9A\u7684 Agent \u4E0D\u4E00\u81F4",
+      { exitCode: exitCodes.invalidArgument }
+    );
+  }
+  const agent = option ?? positional;
+  if (!agent) {
+    throw new CliError("INVALID_ARGUMENT", "\u8BF7\u4F7F\u7528 --agent \u6307\u5B9A Agent", {
+      exitCode: exitCodes.invalidArgument,
+      hint: "\u8BF7\u9009\u62E9 codex\u3001claude-code \u6216 workbuddy\u3002"
+    });
+  }
+  return agent;
+}
+function parseMcpToolArguments(value) {
+  try {
+    const parsed = JSON.parse(value);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw new Error("not an object");
+    }
+    return parsed;
+  } catch (cause) {
+    throw new CliError("INVALID_ARGUMENT", "--arguments-json \u5FC5\u987B\u662F\u4E00\u4E2A JSON \u5BF9\u8C61", {
+      exitCode: exitCodes.invalidArgument,
+      cause
+    });
+  }
+}
+function collect(value, previous) {
+  return [...previous, value];
+}
+function commandOptions2(program) {
+  return program.opts();
+}
+var skillWriters = /* @__PURE__ */ new WeakMap();
+function skillOperation(program) {
+  const [command, subcommand, action] = program.args;
+  if (command === "auth" || command === "skill" && subcommand === "auth") {
+    return "auth";
+  }
+  if (command === "skill" && subcommand === "knowledge") {
+    if (action === "upload" || action === "upload-status") return "upload";
+    if (action === "ask") return "search";
+    return "document";
+  }
+  if (command === "search") return "search";
+  if (command === "document" && (subcommand === "upload" || subcommand === "upload-status")) {
+    return "upload";
+  }
+  if (command === "mcp" || command === "agent") return "install";
+  if (command === "document" || command === "knowledge") return "document";
+  return "install";
+}
+function skillData(program, data) {
+  const base = data && typeof data === "object" && !Array.isArray(data) ? data : Array.isArray(data) ? { items: data } : { value: data };
+  if (program.args[0] === "knowledge") {
+    return { resource: "knowledge_base", ...base };
+  }
+  return base;
+}
+function commandOutputIsNdjson(arguments_) {
+  return arguments_.some(
+    (argument, index) => argument === "--output=ndjson" || argument === "--output" && arguments_[index + 1] === "ndjson"
+  );
+}
+function skillOperationId() {
+  return `cli-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+}
+function skillEvent(program, event, data, error, operationId = skillOperationId()) {
+  return {
+    schema: "sag.skill.ndjson.v1",
+    operation: skillOperation(program),
+    event,
+    operation_id: operationId,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    ...data ? { data } : {},
+    ...error ? { error } : {}
+  };
+}
+function emit(program, dependencies2, data) {
+  const options = commandOptions2(program);
+  if (options.output === "ndjson") {
+    skillWriters.get(program)?.complete(skillEvent(program, "completed", skillData(program, data)));
+    return;
+  }
+  dependencies2.writeStdout(
+    options.json ? renderJson(success3(data)) : renderHuman(data, options.quiet ?? false)
+  );
+}
+async function runtime(program, dependencies2) {
+  const options = commandOptions2(program);
+  return createRuntimeContext({
+    options: {
+      ...options.url ? { url: options.url } : {},
+      ...options.profile ? { profile: options.profile } : {}
+    },
+    environment: dependencies2.environment,
+    configStore: dependencies2.configStore,
+    credentialStore: dependencies2.credentialStore,
+    createClient: dependencies2.createClient
+  });
+}
+function localMcpRuntime(dependencies2) {
+  if (!dependencies2.localMcp) {
+    throw new CliError("DEPENDENCY_MISSING", "Local MCP runtime is unavailable", {
+      exitCode: exitCodes.dependencyMissing
+    });
+  }
+  return dependencies2.localMcp;
+}
+function enterpriseMcpRuntime(dependencies2) {
+  if (!dependencies2.enterpriseMcp) {
+    throw new CliError("DEPENDENCY_MISSING", "\u4F01\u4E1A MCP \u8FD0\u884C\u73AF\u5883\u4E0D\u53EF\u7528", {
+      exitCode: exitCodes.dependencyMissing
+    });
+  }
+  return dependencies2.enterpriseMcp;
+}
+function enterpriseMcpCommandRuntime(dependencies2, timeoutMs) {
+  return {
+    ...enterpriseMcpRuntime(dependencies2),
+    cliVersion: dependencies2.version,
+    timeoutMs
+  };
+}
+function skillInstallerRuntime(dependencies2) {
+  if (!dependencies2.skill) {
+    throw new CliError(
+      "DEPENDENCY_MISSING",
+      "SAG Knowledge Skill runtime is unavailable",
+      {
+        exitCode: exitCodes.dependencyMissing
+      }
+    );
+  }
+  return dependencies2.skill;
+}
+function skillAccountAuthRuntime(dependencies2) {
+  const runtime2 = dependencies2.skillAccount;
+  if (!runtime2) {
+    throw new CliError(
+      "DEPENDENCY_MISSING",
+      "SAG account authorization runtime is unavailable",
+      { exitCode: exitCodes.dependencyMissing }
+    );
+  }
+  return runtime2;
+}
+function skillAccountKnowledgeRuntime(dependencies2) {
+  const account = dependencies2.skillAccount;
+  if (!account) {
+    throw new CliError(
+      "DEPENDENCY_MISSING",
+      "SAG account Knowledge runtime is unavailable",
+      { exitCode: exitCodes.dependencyMissing }
+    );
+  }
+  return {
+    auth: skillAccountAuthRuntime(dependencies2),
+    createId: randomUUID7,
+    config: account.config,
+    createClient: dependencies2.createSkillKnowledgeClient ?? ((options) => new SkillKnowledgeHttpClient(options))
+  };
+}
+function skillAccountUploadRuntime(dependencies2) {
+  return {
+    ...skillAccountKnowledgeRuntime(dependencies2),
+    now: () => /* @__PURE__ */ new Date(),
+    sleep: async (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds))
+  };
+}
+function emitSkillAccountUpload(program, dependencies2, events) {
+  if (commandOptions2(program).output !== "ndjson") {
+    emit(program, dependencies2, { events });
+    return;
+  }
+  const operationId = skillOperationId();
+  const writer = skillWriters.get(program);
+  events.forEach((event, index) => {
+    const data = {
+      import_id: event.importId,
+      ...event.documentId ? { document_id: event.documentId } : {},
+      ...event.jobId ? { job_id: event.jobId } : {},
+      ...event.failure ? { failure: event.failure } : {}
+    };
+    const frame = skillEvent(program, event.event, data, void 0, operationId);
+    if (index === events.length - 1) writer?.complete(frame);
+    else writer?.emit(frame);
+  });
+}
+function emitSkillAccountUploadStatus(program, dependencies2, status2) {
+  if (commandOptions2(program).output !== "ndjson") {
+    emitSkillAccountUpload(program, dependencies2, [status2]);
+    return;
+  }
+  skillWriters.get(program)?.complete(
+    skillEvent(program, "completed", {
+      import_id: status2.importId,
+      state: status2.event,
+      ...status2.documentId ? { document_id: status2.documentId } : {},
+      ...status2.jobId ? { job_id: status2.jobId } : {},
+      ...status2.failure ? { failure: status2.failure } : {}
+    })
+  );
+}
+async function resolveSkillOrigin(dependencies2, explicitOrigin, promptWhenMissing = false) {
+  if (explicitOrigin) return normalizeSkillOrigin(explicitOrigin);
+  const runtime2 = dependencies2.skillAccount;
+  if (!runtime2) {
+    throw new CliError(
+      "DEPENDENCY_MISSING",
+      "SAG account authorization runtime is unavailable",
+      { exitCode: exitCodes.dependencyMissing }
+    );
+  }
+  const current = (await runtime2.config.load()).currentOrigin;
+  if (current) return normalizeSkillOrigin(current);
+  if (promptWhenMissing && dependencies2.promptSkillOrigin) {
+    return normalizeSkillOrigin(await dependencies2.promptSkillOrigin());
+  }
+  throw new SkillError("AUTH_REQUIRED", "SAG address is required", {
+    exitCode: exitCodes.authRequired,
+    details: { required_option: "--origin" }
+  });
+}
+var ReportedSkillTargetFailure = class extends Error {
+  constructor(exitCode) {
+    super("Skill target operation completed with errors");
+    this.exitCode = exitCode;
+  }
+  exitCode;
+};
+function emitSkillTargets(program, dependencies2, report, options = {}) {
+  if (commandOptions2(program).output !== "ndjson") {
+    emit(program, dependencies2, report);
+    return;
+  }
+  const writer = skillWriters.get(program);
+  const operationId = options.operationId ?? skillOperationId();
+  for (const target of report.targets) {
+    const failed3 = target.status === "failed" || target.status === "conflict";
+    writer?.emit(
+      skillEvent(
+        program,
+        failed3 ? "target_failed" : "target_completed",
+        {
+          agent: target.agent,
+          target: target.target,
+          status: target.status,
+          ...target.version ? { version: target.version } : {},
+          ...target.package ? { package: target.package } : {},
+          ...target.code ? { code: target.code } : {}
+        },
+        void 0,
+        operationId
+      )
+    );
+  }
+  const terminal = options.terminal ?? true;
+  const summary = {
+    package: report.package,
+    version: report.version,
+    target_count: report.targets.length
+  };
+  if (!terminal && (!report.completedWithErrors || options.progressOnErrors)) {
+    writer?.emit(
+      skillEvent(
+        program,
+        options.progressEvent ?? "installation_completed",
+        options.progressData ?? summary,
+        void 0,
+        operationId
+      )
+    );
+    return;
+  }
+  writer?.complete(
+    skillEvent(
+      program,
+      report.completedWithErrors ? "completed_with_errors" : "completed",
+      options.terminalData ?? summary,
+      void 0,
+      operationId
+    )
+  );
+}
+async function executeSkillTargets(program, dependencies2, report) {
+  const resolved = await report;
+  emitSkillTargets(program, dependencies2, resolved);
+  if (resolved.completedWithErrors) {
+    const conflict6 = resolved.targets.some((target) => target.status === "conflict");
+    throw new ReportedSkillTargetFailure(
+      conflict6 ? exitCodes.configConflict : exitCodes.internalError
+    );
+  }
+}
+function rejectEnterpriseProfile(program) {
+  if (!commandOptions2(program).profile) return;
+  throw new CliError("INVALID_ARGUMENT", "\u4F01\u4E1A MCP \u547D\u4EE4\u4E0D\u4F7F\u7528 Profile", {
+    exitCode: exitCodes.invalidArgument,
+    hint: "\u8BF7\u79FB\u9664 --profile\uFF1B\u4E2A\u4EBA Profile \u53EA\u7528\u4E8E sag mcp test \u548C sag agent\u3002"
+  });
+}
+async function selectedProfileName(program, dependencies2) {
+  const options = commandOptions2(program);
+  if (options.profile) {
+    await dependencies2.configStore.getProfile(options.profile);
+    return options.profile;
+  }
+  return (await dependencies2.configStore.load()).currentProfile ?? "local";
+}
+async function selectedServerName(program, dependencies2, explicitName) {
+  const profile = await selectedProfileName(program, dependencies2);
+  return {
+    profile,
+    serverName: explicitName ?? `sag-knowledge-${profile}`
+  };
+}
+function addProfileCommands(program, dependencies2) {
+  const profile = program.command("profile").description("Manage SAG profiles");
+  profile.command("add").argument("<name>").argument("<url>").action(async (name, url) => {
+    emit(program, dependencies2, await dependencies2.configStore.addProfile(name, url));
+  });
+  profile.command("list").action(async () => {
+    emit(program, dependencies2, await dependencies2.configStore.listProfiles());
+  });
+  profile.command("use").argument("<name>").action(async (name) => {
+    emit(program, dependencies2, await dependencies2.configStore.useProfile(name));
+  });
+  profile.command("show").argument("[name]").action(async (name) => {
+    emit(program, dependencies2, await dependencies2.configStore.getProfile(name));
+  });
+  profile.command("remove").argument("<name>").action(async (name) => {
+    if (!commandOptions2(program).yes && !await dependencies2.confirm(`Remove profile ${name}?`)) {
+      emit(program, dependencies2, { removed: null, cancelled: true });
+      return;
+    }
+    await dependencies2.configStore.removeProfile(name);
+    emit(program, dependencies2, { removed: name });
+  });
+}
+function addAuthCommands(program, dependencies2) {
+  const auth = program.command("auth").description("Manage SAG credentials");
+  auth.command("login").option("--name <name>", "SAG user name for the existing local login").action(async (options) => {
+    const context = await runtime(program, dependencies2);
+    const result = await login({
+      credentialRef: context.credentialRef,
+      ...context.connection.environmentToken ? { environmentToken: context.connection.environmentToken } : {},
+      ...options.name ? { name: options.name } : {},
+      promptName: dependencies2.promptName,
+      authenticate: (name) => dependencies2.createClient({ origin: context.connection.url }).login(name),
+      validate: async (token) => dependencies2.createClient({ origin: context.connection.url, token }).me(),
+      store: dependencies2.credentialStore
+    });
+    emit(program, dependencies2, result);
+  });
+  auth.command("status").action(async () => {
+    const context = await runtime(program, dependencies2);
+    const result = await status({
+      credentialRef: context.credentialRef,
+      ...context.connection.environmentToken ? { environmentToken: context.connection.environmentToken } : {},
+      validate: async (token) => dependencies2.createClient({ origin: context.connection.url, token }).me(),
+      store: dependencies2.credentialStore
     });
     emit(program, dependencies2, result);
   });
@@ -6751,7 +8955,7 @@ function addLocalMcpCommands(program, dependencies2) {
             }
             return dependencies2.selectMcpServers(servers);
           },
-          selectAgents: async (agents) => dependencies2.selectAgents ? dependencies2.selectAgents(agents) : [],
+          selectAgents: async (agents2) => dependencies2.selectAgents ? dependencies2.selectAgents(agents2) : [],
           selectCollisionAction: async (collision) => {
             if (!dependencies2.selectCollisionAction) {
               throw new CliError("DEPENDENCY_MISSING", "\u65E0\u6CD5\u5904\u7406\u540C\u540D MCP \u8FDE\u63A5", {
@@ -6818,15 +9022,258 @@ function addAgentCommands(program, dependencies2) {
     );
   });
 }
+function addSkillCommands(program, dependencies2) {
+  const skill = program.command("skill").description("Install and manage the SAG Knowledge Skill");
+  const selectedAgents = (value, previous) => [
+    ...previous,
+    parseEnterpriseAgent(value)
+  ];
+  const addInstall = (name, description) => {
+    const command = skill.command(name).description(description).option(
+      "--agent <agent>",
+      "Target codex, claude-code, or workbuddy",
+      selectedAgents,
+      []
+    );
+    command.option("--origin <origin>", "Full SAG HTTP or HTTPS Origin");
+    command.action(async (options) => {
+      if (options.origin) {
+        const account = dependencies2.skillAccount;
+        if (!account) {
+          throw new CliError(
+            "DEPENDENCY_MISSING",
+            "SAG account configuration is unavailable",
+            { exitCode: exitCodes.dependencyMissing }
+          );
+        }
+        await account.config.setCurrentOrigin(options.origin);
+      }
+      await executeSkillTargets(
+        program,
+        dependencies2,
+        installSkillTargets(skillInstallerRuntime(dependencies2), {
+          ...options.agent.length ? { agents: options.agent } : {},
+          yes: commandOptions2(program).yes ?? false,
+          update: name === "update"
+        })
+      );
+    });
+  };
+  addInstall("install", "Install SAG Knowledge for every detected Agent");
+  addInstall("update", "Resolve the running @latest package and update managed Skills");
+  const auth = skill.command("auth").description("Authorize one SAG account Origin");
+  auth.command("login").description("Open browser approval and authorize the current SAG account").option("--origin <origin>", "Full SAG HTTP or HTTPS Origin").action(async (options) => {
+    const origin = await resolveSkillOrigin(dependencies2, options.origin, true);
+    emit(
+      program,
+      dependencies2,
+      await authorizeSkillAccount(skillAccountAuthRuntime(dependencies2), origin)
+    );
+  });
+  auth.command("status").description("Inspect the saved SAG account authorization").option("--origin <origin>", "Full SAG HTTP or HTTPS Origin").action(async (options) => {
+    const origin = await resolveSkillOrigin(dependencies2, options.origin);
+    const account = await skillAccountAuthRuntime(dependencies2).config.getAccount(origin);
+    emit(program, dependencies2, {
+      authenticated: Boolean(account),
+      origin,
+      ...account ? { user: account.user } : {}
+    });
+  });
+  auth.command("logout").description("Revoke and remove the saved SAG account authorization").option("--origin <origin>", "Full SAG HTTP or HTTPS Origin").action(async (options) => {
+    const origin = await resolveSkillOrigin(dependencies2, options.origin);
+    const removed = await logoutSkillAccount(
+      skillAccountAuthRuntime(dependencies2),
+      origin
+    );
+    emit(program, dependencies2, { origin, removed });
+  });
+  const accountKnowledge = skill.command("knowledge").description("Use Knowledge Bases available to the authorized SAG account");
+  accountKnowledge.command("list").description("List Knowledge Bases available to the current SAG account").option("--origin <origin>", "Full SAG HTTP or HTTPS Origin").action(async (options) => {
+    const origin = await resolveSkillOrigin(dependencies2, options.origin);
+    emit(
+      program,
+      dependencies2,
+      await listSkillAccountKnowledgeBases(
+        skillAccountKnowledgeRuntime(dependencies2),
+        origin
+      )
+    );
+  });
+  accountKnowledge.command("documents").description("List documents in one exact Knowledge Base").requiredOption(
+    "--knowledge-base <id-or-alias-or-name>",
+    "Exact Knowledge Base ID, alias, or unique name"
+  ).option("--origin <origin>", "Full SAG HTTP or HTTPS Origin").action(async (options) => {
+    const origin = await resolveSkillOrigin(dependencies2, options.origin);
+    emit(
+      program,
+      dependencies2,
+      await listSkillAccountDocuments(
+        skillAccountKnowledgeRuntime(dependencies2),
+        origin,
+        options.knowledgeBase
+      )
+    );
+  });
+  accountKnowledge.command("ask").description("Ask SAG and relay its answer and citations").argument("<question>", "Question for SAG").option("--origin <origin>", "Full SAG HTTP or HTTPS Origin").option(
+    "--knowledge-base <id-or-alias-or-name>",
+    "Optional exact Knowledge Base scope; omit for SAG global search"
+  ).action(
+    async (question, options) => {
+      const origin = await resolveSkillOrigin(dependencies2, options.origin);
+      emit(
+        program,
+        dependencies2,
+        await askSkillAccountKnowledge(
+          skillAccountKnowledgeRuntime(dependencies2),
+          origin,
+          question,
+          options.knowledgeBase
+        )
+      );
+    }
+  );
+  accountKnowledge.command("upload").description("Upload one regular file to an exact Knowledge Base").argument("<file>", "One regular file").requiredOption(
+    "--knowledge-base <id-or-alias-or-name>",
+    "Confirmed Knowledge Base ID, alias, or unique name"
+  ).option("--origin <origin>", "Full SAG HTTP or HTTPS Origin").option(
+    "--wait <milliseconds>",
+    "Use 0 to detach after acceptance",
+    parseNonNegativeInteger
+  ).option(
+    "--overwrite-document-id <document-id>",
+    "Existing document ID returned by a duplicate upload conflict"
+  ).action(
+    async (filePath, options) => {
+      const origin = await resolveSkillOrigin(dependencies2, options.origin);
+      const events = await uploadSkillAccountFile(
+        skillAccountUploadRuntime(dependencies2),
+        origin,
+        filePath,
+        options.knowledgeBase,
+        options.wait,
+        options.overwriteDocumentId
+      );
+      emitSkillAccountUpload(program, dependencies2, events);
+    }
+  );
+  accountKnowledge.command("upload-status").description("Read upload progress using the returned import ID").argument("<import-id>", "Import ID returned by upload").requiredOption(
+    "--knowledge-base <id-or-alias-or-name>",
+    "Exact Knowledge Base ID, alias, or unique name"
+  ).option("--origin <origin>", "Full SAG HTTP or HTTPS Origin").action(
+    async (importId, options) => {
+      const origin = await resolveSkillOrigin(dependencies2, options.origin);
+      emitSkillAccountUploadStatus(
+        program,
+        dependencies2,
+        await inspectSkillAccountUpload(
+          skillAccountUploadRuntime(dependencies2),
+          origin,
+          importId,
+          options.knowledgeBase
+        )
+      );
+    }
+  );
+  accountKnowledge.command("rename").description("Rename one exact document version").argument("<document-id>", "Exact document ID").requiredOption("--title <title>", "New document title").requiredOption(
+    "--expected-version <version>",
+    "Current document version",
+    parsePositiveInteger
+  ).requiredOption(
+    "--knowledge-base <id-or-alias-or-name>",
+    "Confirmed Knowledge Base ID, alias, or unique name"
+  ).option("--origin <origin>", "Full SAG HTTP or HTTPS Origin").action(
+    async (documentId, options) => {
+      const origin = await resolveSkillOrigin(dependencies2, options.origin);
+      emit(
+        program,
+        dependencies2,
+        await renameSkillAccountDocument(
+          skillAccountKnowledgeRuntime(dependencies2),
+          origin,
+          {
+            knowledgeBase: options.knowledgeBase,
+            documentId,
+            expectedVersion: options.expectedVersion,
+            title: options.title
+          }
+        )
+      );
+    }
+  );
+  accountKnowledge.command("delete").description("Move one exact document version to the recoverable recycle bin").argument("<document-id>", "Exact document ID").requiredOption(
+    "--expected-version <version>",
+    "Current document version",
+    parsePositiveInteger
+  ).requiredOption(
+    "--knowledge-base <id-or-alias-or-name>",
+    "Confirmed Knowledge Base ID, alias, or unique name"
+  ).option("--origin <origin>", "Full SAG HTTP or HTTPS Origin").action(
+    async (documentId, options) => {
+      const origin = await resolveSkillOrigin(dependencies2, options.origin);
+      emit(
+        program,
+        dependencies2,
+        await deleteSkillAccountDocument(
+          skillAccountKnowledgeRuntime(dependencies2),
+          origin,
+          {
+            knowledgeBase: options.knowledgeBase,
+            documentId,
+            expectedVersion: options.expectedVersion
+          }
+        )
+      );
+    }
+  );
+  skill.command("status").description("Inspect managed SAG Knowledge Skill targets").option(
+    "--agent <agent>",
+    "Target codex, claude-code, or workbuddy",
+    selectedAgents,
+    []
+  ).action(async (options) => {
+    emitSkillTargets(
+      program,
+      dependencies2,
+      await inspectSkillTargets(skillInstallerRuntime(dependencies2), {
+        ...options.agent.length ? { agents: options.agent } : {}
+      })
+    );
+  });
+  skill.command("uninstall").description("Remove unchanged SAG CLI-managed Skills").option(
+    "--agent <agent>",
+    "Target codex, claude-code, or workbuddy",
+    selectedAgents,
+    []
+  ).action(async (options) => {
+    await executeSkillTargets(
+      program,
+      dependencies2,
+      uninstallSkillTargets(skillInstallerRuntime(dependencies2), {
+        ...options.agent.length ? { agents: options.agent } : {},
+        yes: commandOptions2(program).yes ?? false
+      })
+    );
+  });
+}
 function createProgram(dependencies2) {
   const program = new Command();
-  program.name("sag").description("Command-line client and diagnostics for SAG").showHelpAfterError().exitOverride().option("--json", "Output a stable JSON envelope").option("--quiet", "Output only essential values").option("--profile <name>", "Use a configured SAG profile").option("--url <origin>", "Use a SAG origin without saving it").option("--yes", "Confirm safe local configuration changes").configureOutput({
+  skillWriters.set(program, new SkillEventWriter(dependencies2.writeStdout));
+  program.name("sag").description("Command-line client and diagnostics for SAG").showHelpAfterError().exitOverride().option("--json", "Output a stable JSON envelope").addOption(
+    new Option("--output <format>", "Output format").choices(["human", "ndjson"]).conflicts("json")
+  ).option("--quiet", "Output only essential values").option("--profile <name>", "Use a configured SAG profile").option("--url <origin>", "Use a SAG origin without saving it").option("--yes", "Confirm safe local configuration changes").configureOutput({
     writeOut: dependencies2.writeStdout,
     writeErr: dependencies2.writeStderr
   });
   program.command("version").action(() => {
     const options = commandOptions2(program);
-    if (options.json) {
+    if (options.output === "ndjson") {
+      skillWriters.get(program)?.complete(
+        skillEvent(program, "completed", {
+          name: "sag",
+          version: dependencies2.version
+        })
+      );
+    } else if (options.json) {
       dependencies2.writeStdout(
         renderJson(success3({ name: "sag", version: dependencies2.version }))
       );
@@ -6840,22 +9287,70 @@ function createProgram(dependencies2) {
   addKnowledgeCommands(program, dependencies2);
   addLocalMcpCommands(program, dependencies2);
   addAgentCommands(program, dependencies2);
+  addSkillCommands(program, dependencies2);
   return program;
 }
 async function runCli(arguments_, dependencies2) {
   const json = arguments_.includes("--json");
+  const program = createProgram(
+    commandOutputIsNdjson(arguments_) ? { ...dependencies2, writeStderr: () => void 0 } : dependencies2
+  );
   try {
-    await createProgram(dependencies2).parseAsync(arguments_);
+    await program.parseAsync(arguments_);
     return exitCodes.success;
   } catch (error) {
+    if (error instanceof ReportedSkillTargetFailure) return error.exitCode;
     if (error instanceof CommanderError && error.exitCode === 0) {
       return 0;
     }
+    if (error instanceof SkillError) {
+      if (json) {
+        dependencies2.writeStdout(
+          renderJson({
+            schema: "sag.cli.v1",
+            ok: false,
+            error: {
+              code: error.code,
+              message: error.message,
+              ...error.details ? { details: error.details } : {}
+            }
+          })
+        );
+      } else if (commandOutputIsNdjson(arguments_)) {
+        const event = skillEvent(program, "failed", void 0, {
+          code: error.code,
+          message: error.message,
+          retryable: error.code === "NETWORK_UNREACHABLE",
+          ...error.details ? { details: error.details } : {}
+        });
+        const operationId = error.details?.operation_id;
+        skillWriters.get(program)?.complete({
+          ...event,
+          ...typeof operationId === "string" ? { operation_id: operationId } : {}
+        });
+      } else {
+        const operationId = error.details?.operation_id;
+        dependencies2.writeStderr(
+          `Error [${error.code}]: ${error.message}${typeof operationId === "string" ? `
+Operation ID: ${operationId}` : ""}
+`
+        );
+      }
+      return error.exitCode;
+    }
     const cliError = error instanceof CommanderError ? new CliError("INVALID_ARGUMENT", error.message, {
       exitCode: exitCodes.invalidArgument
     }) : toCliError(error);
     if (json) {
       dependencies2.writeStdout(renderJson(failure(cliError)));
+    } else if (commandOutputIsNdjson(arguments_)) {
+      skillWriters.get(program)?.complete(
+        skillEvent(program, "failed", void 0, {
+          code: toSkillErrorCode(cliError.code),
+          message: cliError.message,
+          retryable: cliError.code === "NETWORK_UNREACHABLE"
+        })
+      );
     } else {
       dependencies2.writeStderr(
         `Error [${cliError.code}]: ${cliError.message}${cliError.hint ? `
@@ -6886,6 +9381,51 @@ function readStdin() {
     process.stdin.once("error", reject);
   });
 }
+async function resolveLatestSkillBundle(processRunner2) {
+  const directory = await mkdtemp(path15.join(tmpdir(), "sag-skill-latest-"));
+  const cleanup = () => rm3(directory, { recursive: true, force: true });
+  try {
+    const packed = await processRunner2.run({
+      command: "npm",
+      args: [
+        "pack",
+        "@zleap-ai/sag-cli@latest",
+        "--ignore-scripts",
+        "--json",
+        "--pack-destination",
+        directory,
+        "--cache",
+        path15.join(directory, "npm-cache"),
+        "--prefer-online"
+      ],
+      timeoutMs: 6e4
+    });
+    if (packed.exitCode !== 0) throw new Error("npm pack failed");
+    const result = JSON.parse(packed.stdout);
+    const filename = Array.isArray(result) && typeof result[0] === "object" && result[0] !== null && typeof result[0].filename === "string" ? result[0].filename : null;
+    if (!filename || path15.basename(filename) !== filename) {
+      throw new Error("npm pack returned an invalid filename");
+    }
+    const extracted = await processRunner2.run({
+      command: "tar",
+      args: ["-xzf", path15.join(directory, filename), "-C", directory],
+      timeoutMs: 3e4
+    });
+    if (extracted.exitCode !== 0) throw new Error("tar extraction failed");
+    return { bundlePath: path15.join(directory, "package", "skill"), cleanup };
+  } catch (cause) {
+    await cleanup();
+    throw new CliError(
+      "NETWORK_UNREACHABLE",
+      "Unable to resolve @latest Skill package",
+      {
+        exitCode: exitCodes.networkUnreachable,
+        cause,
+        hint: "Check npm network access and retry; the installed Skill was not changed."
+      }
+    );
+  }
+}
 var credentialSelection = await createCredentialStore();
 if (credentialSelection.warning) {
   process.stderr.write(`Warning: ${credentialSelection.warning}
@@ -6901,6 +9441,16 @@ var adapters = {
 var enterpriseManaged = new EnterpriseMcpManagedStateStore(
   defaultEnterpriseMcpManagedStatePath()
 );
+var skillState2 = new SkillStateStore(defaultSkillStatePath());
+var skillAccountConfig = new SkillAccountConfigStore(defaultSkillAccountConfigPath());
+async function openSkillAuthorizationBrowser(processRunner2, verificationUrl) {
+  const command = process.platform === "darwin" ? { command: "open", args: [verificationUrl] } : process.platform === "win32" ? { command: "cmd", args: ["/c", "start", "", verificationUrl] } : { command: "xdg-open", args: [verificationUrl] };
+  const result = await processRunner2.run({
+    ...command,
+    timeoutMs: 1e4
+  });
+  if (result.exitCode !== 0) throw new Error("browser opener failed");
+}
 function unavailableEnterpriseKeychain() {
   const unavailable = () => {
     throw new CliError("DEPENDENCY_MISSING", "\u7CFB\u7EDF\u51ED\u636E\u5E93\u4E0D\u53EF\u7528", {
@@ -6925,6 +9475,7 @@ var dependencies = {
   credentialStore: credentialSelection.store,
   createClient: defaultClientFactory,
   promptName: () => input({ message: "SAG user name" }),
+  promptSkillOrigin: () => input({ message: "SAG address" }),
   confirm: (message) => confirm({ message, default: false }),
   readStdin,
   stdinIsTty: Boolean(process.stdin.isTTY),
@@ -7002,6 +9553,31 @@ var dependencies = {
       now: () => /* @__PURE__ */ new Date()
     },
     now: () => /* @__PURE__ */ new Date()
+  },
+  skill: {
+    home: os5.homedir(),
+    environment: { CODEX_HOME: process.env.CODEX_HOME },
+    state: skillState2,
+    agents: {
+      codex: { id: "codex", installed: () => isAgentInstalled(adapters.codex) },
+      "claude-code": {
+        id: "claude-code",
+        installed: () => isAgentInstalled(adapters["claude-code"])
+      },
+      workbuddy: {
+        id: "workbuddy",
+        installed: () => isAgentInstalled(adapters.workbuddy)
+      }
+    },
+    now: () => /* @__PURE__ */ new Date(),
+    confirm: (message) => confirm({ message, default: false }),
+    resolveLatestBundle: () => resolveLatestSkillBundle(processRunner)
+  },
+  skillAccount: {
+    client: new SkillAccountAuthHttpClient(),
+    config: skillAccountConfig,
+    now: () => /* @__PURE__ */ new Date(),
+    openBrowser: (verificationUrl) => openSkillAuthorizationBrowser(processRunner, verificationUrl)
   }
 };
 process.exitCode = await runCli(process.argv, dependencies);