agent-trellis 0.8.0 → 0.9.0

package/dist/lib/chatAgents.js

@@ -0,0 +1,59 @@
+/**
+ * Config for the GUI's in-app chat feature: which CLI agents can be chatted
+ * with from the desktop app, keyed by an arbitrary string id (not `AgentId`
+ * — chat targets are not necessarily fully-managed Agents with adapters,
+ * sync, and probes; they're just "a non-interactive CLI I can spawn and
+ * stream from"). Kept as its own file + config path, sibling to
+ * `agent-bridge.yaml`, so delegation's `ALL_AGENTS` constraint (needed for
+ * the cross-Agent-delegation use case) never has to bend for chat's needs.
+ *
+ * Configuration lives at `~/.trellis/mcp/chat-agents.yaml`. Its absence
+ * means zero targets, not an error — the same "optional, additive" shape
+ * as `agent-bridge.yaml`.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { parse as parseYaml } from "yaml";
+const OUTPUT_FORMATS = ["text", "json", "stream-json"];
+const STREAM_PROTOCOLS = ["claude", "zcode"];
+export function chatAgentsPath(homeDir) {
+    return join(homeDir, ".trellis", "mcp", "chat-agents.yaml");
+}
+export function loadChatAgentConfig(homeDir) {
+    const path = chatAgentsPath(homeDir);
+    if (!existsSync(path))
+        return { targets: {} };
+    const parsed = (parseYaml(readFileSync(path, "utf-8")) ?? {});
+    const targets = {};
+    for (const [id, raw] of Object.entries(parsed.targets ?? {})) {
+        if (!raw)
+            continue;
+        if (!raw.label || !raw.label.trim()) {
+            throw new Error(`chat-agents.yaml: target "${id}" must declare a non-empty "label"`);
+        }
+        if (!raw.command || !Array.isArray(raw.args) || raw.args.length === 0) {
+            throw new Error(`chat-agents.yaml: target "${id}" must declare "command" and a non-empty "args"`);
+        }
+        if (raw.resumeArgs !== undefined && (!Array.isArray(raw.resumeArgs) || raw.resumeArgs.length === 0)) {
+            throw new Error(`chat-agents.yaml: target "${id}" has an invalid "resumeArgs"`);
+        }
+        if (raw.outputFormat !== undefined && !OUTPUT_FORMATS.includes(raw.outputFormat)) {
+            throw new Error(`chat-agents.yaml: target "${id}" has unknown outputFormat "${raw.outputFormat}"`);
+        }
+        if (raw.streamProtocol !== undefined && !STREAM_PROTOCOLS.includes(raw.streamProtocol)) {
+            throw new Error(`chat-agents.yaml: target "${id}" has unknown streamProtocol "${raw.streamProtocol}"`);
+        }
+        targets[id] = {
+            label: raw.label,
+            command: raw.command,
+            args: raw.args,
+            ...(raw.resumeArgs ? { resumeArgs: raw.resumeArgs } : {}),
+            ...(raw.outputFormat ? { outputFormat: raw.outputFormat } : {}),
+            ...(raw.streamProtocol ? { streamProtocol: raw.streamProtocol } : {}),
+            ...(raw.timeoutMs ? { timeoutMs: raw.timeoutMs } : {}),
+            ...(raw.tags ? { tags: raw.tags } : {}),
+            ...(raw.persona ? { persona: raw.persona } : {}),
+        };
+    }
+    return { targets };
+}

package/dist/lib/dirDigest.d.ts

@@ -0,0 +1,11 @@
+/**
+ * A deterministic digest for a directory tree.  Paths, empty directories,
+ * file bytes, and link targets all contribute to the digest so it can be
+ * used for provenance and for detecting edits before a remote update.
+ */
+/**
+ * Hashes a tree without following symbolic links.  A caller that needs a
+ * stricter source policy can reject links separately; keeping their target in
+ * this digest means a locally added link is still detected as drift.
+ */
+export declare function directoryDigest(dir: string): string;

package/dist/lib/dirDigest.js

@@ -0,0 +1,52 @@
+/**
+ * A deterministic digest for a directory tree.  Paths, empty directories,
+ * file bytes, and link targets all contribute to the digest so it can be
+ * used for provenance and for detecting edits before a remote update.
+ */
+import { createHash } from "node:crypto";
+import { lstatSync, readFileSync, readdirSync, readlinkSync } from "node:fs";
+import { join, relative, sep } from "node:path";
+function portablePath(path) {
+    return path.split(sep).join("/");
+}
+function addPart(hash, value) {
+    hash.update(String(Buffer.byteLength(value)));
+    hash.update(":");
+    hash.update(value);
+    hash.update("\0");
+}
+/**
+ * Hashes a tree without following symbolic links.  A caller that needs a
+ * stricter source policy can reject links separately; keeping their target in
+ * this digest means a locally added link is still detected as drift.
+ */
+export function directoryDigest(dir) {
+    const hash = createHash("sha256");
+    const walk = (current) => {
+        const rel = portablePath(relative(dir, current)) || ".";
+        const stat = lstatSync(current);
+        if (stat.isDirectory()) {
+            addPart(hash, "directory");
+            addPart(hash, rel);
+            for (const name of readdirSync(current).sort((a, b) => a.localeCompare(b))) {
+                walk(join(current, name));
+            }
+            return;
+        }
+        if (stat.isFile()) {
+            addPart(hash, "file");
+            addPart(hash, rel);
+            addPart(hash, readFileSync(current));
+            return;
+        }
+        if (stat.isSymbolicLink()) {
+            addPart(hash, "symlink");
+            addPart(hash, rel);
+            addPart(hash, readlinkSync(current));
+            return;
+        }
+        throw new Error(`Cannot digest unsupported filesystem entry: ${current}`);
+    };
+    walk(dir);
+    return `sha256:${hash.digest("hex")}`;
+}

package/dist/lib/envVarNames.d.ts

@@ -44,6 +44,9 @@ export declare function declaredEnvNames(def: McpServerDef): string[];
  * different command, not this extractor's job.
  */
 export declare function extractJsonEnvVarNames(content: string): string[];
+/** ZCode stores the same server value shape under `mcp.servers` rather than
+ * the top-level `mcpServers` map used by Claude Code and Kiro. */
+export declare function extractZcodeEnvVarNames(content: string): string[];
 /** Codex's config is TOML. The shapes audit needs: every `env_vars = [...]`
  * line's quoted string contents, plus a `bearer_token_env_var = "VAR"`
  * line's bare name (a name directly, not a `${VAR}` template — Codex's

package/dist/lib/envVarNames.js

@@ -71,6 +71,25 @@ export function extractJsonEnvVarNames(content) {
     }
     return names;
 }
+/** ZCode stores the same server value shape under `mcp.servers` rather than
+ * the top-level `mcpServers` map used by Claude Code and Kiro. */
+export function extractZcodeEnvVarNames(content) {
+    let parsed;
+    try {
+        parsed = JSON.parse(content);
+    }
+    catch {
+        return [];
+    }
+    const names = [];
+    for (const server of Object.values(parsed.mcp?.servers ?? {})) {
+        for (const value of Object.values(server.env ?? {}))
+            names.push(...extractTemplateVarNames(value));
+        for (const value of Object.values(server.headers ?? {}))
+            names.push(...extractTemplateVarNames(value));
+    }
+    return names;
+}
 const ENV_VARS_LINE_RE = /^\s*env_vars\s*=\s*\[(.*)\]\s*$/;
 const BEARER_TOKEN_ENV_VAR_LINE_RE = /^\s*bearer_token_env_var\s*=\s*"([^"]*)"\s*$/;
 const QUOTED_STRING_RE = /"((?:[^"\\]|\\.)*)"/g;

package/dist/lib/installAgent.d.ts

@@ -10,7 +10,7 @@ import type { AgentId } from "../core/types.js";
 /** Only agents with a real `npm install -g <pkg>` command — Kiro's own
  * `INSTALL_HINTS` entry is a download URL, not a package, and is never
  * looked up here. */
-export declare const NPM_INSTALLABLE: Record<Exclude<AgentId, "kiro" | "kimi-code">, string>;
+export declare const NPM_INSTALLABLE: Record<Exclude<AgentId, "kiro" | "kimi-code" | "zcode">, string>;
 export interface ConfirmAndInstallOptions {
     /** Test/real seam, same pattern as onboard's `promptForAgent` — a real
      * terminal confirmation by default. */

package/dist/lib/installAgent.js

@@ -32,7 +32,7 @@ function runInstallReal(pkg) {
     execFileSync("npm", ["install", "-g", pkg], { stdio: "inherit" });
 }
 export async function confirmAndInstall(agent, opts = {}) {
-    if (agent === "kiro" || agent === "kimi-code") {
+    if (agent === "kiro" || agent === "kimi-code" || agent === "zcode") {
         return { installed: false, installable: false };
     }
     const pkg = NPM_INSTALLABLE[agent];

package/dist/lib/mcpMigrateRead.d.ts

@@ -38,6 +38,7 @@ export declare function resolvedEnvTextMap(def: Pick<McpServerDef, "env" | "envA
 export declare function readClaudeCodeMcpDefs(homeDir: string): McpMigrateReadResult;
 export declare function readKiroMcpDefs(homeDir: string): McpMigrateReadResult;
 export declare function readKimiCodeMcpDefs(homeDir: string): McpMigrateReadResult;
+export declare function readZcodeMcpDefs(homeDir: string): McpMigrateReadResult;
 export interface CodexMcpEntryRich {
     name: string;
     enabled: boolean;

package/dist/lib/mcpMigrateRead.js

@@ -15,6 +15,8 @@ import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { readJsonFile } from "./probeCommon.js";
 import { readServerEnvTable } from "./tomlSection.js";
+import { resolveZcodeProfile } from "../probes/zcode.js";
+import { codexEnv } from "../probes/codex.js";
 const EMPTY_RESULT = { entries: [], unsupported: [] };
 /**
  * Trellis's own `env` (self-referencing name) vs. `envAliases`
@@ -111,6 +113,22 @@ export function readKiroMcpDefs(homeDir) {
 export function readKimiCodeMcpDefs(homeDir) {
     return readRichJsonMcpDefs(join(homeDir, ".kimi-code", "mcp.json"));
 }
+export function readZcodeMcpDefs(homeDir) {
+    const profile = resolveZcodeProfile(homeDir);
+    if (!profile)
+        return EMPTY_RESULT;
+    const parsed = readJsonFile(profile.configPath);
+    const entries = [];
+    const unsupported = [];
+    for (const [name, raw] of Object.entries(parsed?.mcp?.servers ?? {})) {
+        const def = fromRichJsonServerDef(raw);
+        if (def)
+            entries.push({ name, def });
+        else
+            unsupported.push({ name, reason: "stdio entry has no command — malformed, skipped" });
+    }
+    return { entries, unsupported };
+}
 /**
  * Pure conversion half — separated from the subprocess/file-read effects
  * below so the stdio/non-stdio/malformed decision logic is unit-testable
@@ -202,7 +220,7 @@ export function readCodexMcpDefs(homeDir) {
         // `[]`, not the real machine's servers), so this must be scoped to
         // `homeDir` explicitly — `src/probes/codex.ts`'s own equivalent call
         // has this same gap, unaddressed there; not touched by this change.
-        raw = execFileSync("codex", ["mcp", "list", "--json"], { encoding: "utf-8", timeout: 5_000, env: { ...process.env, HOME: homeDir } });
+        raw = execFileSync("codex", ["mcp", "list", "--json"], { encoding: "utf-8", timeout: 5_000, env: codexEnv(homeDir) });
     }
     catch {
         return EMPTY_RESULT;

package/dist/lib/realHomeSnapshot.js

@@ -21,6 +21,11 @@ export const REAL_HOME_ALLOWLIST = [
     ".codex/config.toml",
     ".agents/skills",
     ".codex/skills",
+    // zcode (src/probes/zcode.ts)
+    ".zcode/cli/config.json",
+    ".zcode/cli/setting.json",
+    ".zcode/skills",
+    ".zcode/AGENTS.md",
     // kiro (src/probes/kiro.ts)
     ".kiro/settings/mcp.json",
     ".kiro/skills",

package/dist/lib/remoteSkillLock.d.ts

@@ -0,0 +1,26 @@
+/** Durable provenance for remote Skills in ~/.trellis/skills.lock.json. */
+import type { BackupSession } from "./backup.js";
+export declare const REMOTE_SKILL_LOCK_VERSION = 1;
+export interface RemoteSkillLockEntry {
+    source: string;
+    requestedRef: string;
+    commit: string;
+    subdirectory: string;
+    digest: string;
+}
+export interface RemoteSkillLock {
+    version: typeof REMOTE_SKILL_LOCK_VERSION;
+    skills: Record<string, RemoteSkillLockEntry>;
+}
+export type RemoteSkillLockRead = {
+    ok: true;
+    lock: RemoteSkillLock;
+} | {
+    ok: false;
+    error: string;
+};
+export declare function remoteSkillLockPath(homeDir: string): string;
+export declare function emptyRemoteSkillLock(): RemoteSkillLock;
+export declare function readRemoteSkillLock(homeDir: string): RemoteSkillLockRead;
+export declare function serializeRemoteSkillLock(lock: RemoteSkillLock): string;
+export declare function writeRemoteSkillLock(homeDir: string, lock: RemoteSkillLock, backup?: BackupSession): void;

package/dist/lib/remoteSkillLock.js

@@ -0,0 +1,88 @@
+/** Durable provenance for remote Skills in ~/.trellis/skills.lock.json. */
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+export const REMOTE_SKILL_LOCK_VERSION = 1;
+export function remoteSkillLockPath(homeDir) {
+    return join(homeDir, ".trellis", "skills.lock.json");
+}
+export function emptyRemoteSkillLock() {
+    return { version: REMOTE_SKILL_LOCK_VERSION, skills: {} };
+}
+function isObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function validSource(value) {
+    if (typeof value !== "string")
+        return false;
+    try {
+        const parsed = new URL(value);
+        return parsed.protocol === "https:"
+            && parsed.hostname === "github.com"
+            && !parsed.username
+            && !parsed.password
+            && !parsed.search
+            && !parsed.hash
+            && /^\/[A-Za-z0-9][A-Za-z0-9-]{0,38}\/[A-Za-z0-9_.-]+\.git$/.test(parsed.pathname);
+    }
+    catch {
+        return false;
+    }
+}
+function validEntry(value) {
+    if (!isObject(value))
+        return false;
+    const keys = Object.keys(value).sort();
+    if (keys.join(",") !== "commit,digest,requestedRef,source,subdirectory")
+        return false;
+    return validSource(value.source)
+        && typeof value.requestedRef === "string" && value.requestedRef.length > 0 && !/[\0\r\n]/.test(value.requestedRef)
+        && typeof value.commit === "string" && /^[0-9a-f]{40}$/.test(value.commit)
+        && typeof value.subdirectory === "string" && value.subdirectory.length > 0 && !value.subdirectory.startsWith("/") && !value.subdirectory.split("/").includes("..")
+        && typeof value.digest === "string" && /^sha256:[0-9a-f]{64}$/.test(value.digest);
+}
+function validateLock(value) {
+    if (!isObject(value) || value.version !== REMOTE_SKILL_LOCK_VERSION || !isObject(value.skills) || Object.keys(value).some((key) => key !== "version" && key !== "skills")) {
+        throw new Error("expected version 1 and a skills object");
+    }
+    const skills = {};
+    for (const [name, entry] of Object.entries(value.skills)) {
+        if (!name || name.includes("/") || name.includes("\\") || !validEntry(entry)) {
+            throw new Error(`invalid provenance entry for Skill ${JSON.stringify(name)}`);
+        }
+        skills[name] = entry;
+    }
+    return { version: REMOTE_SKILL_LOCK_VERSION, skills };
+}
+export function readRemoteSkillLock(homeDir) {
+    const path = remoteSkillLockPath(homeDir);
+    try {
+        if (!existsSync(path))
+            return { ok: true, lock: emptyRemoteSkillLock() };
+        return { ok: true, lock: validateLock(JSON.parse(readFileSync(path, "utf8"))) };
+    }
+    catch (error) {
+        return { ok: false, error: `Cannot use ${path}: ${error instanceof Error ? error.message : String(error)}` };
+    }
+}
+export function serializeRemoteSkillLock(lock) {
+    const valid = validateLock(lock);
+    const skills = Object.fromEntries(Object.entries(valid.skills).sort(([a], [b]) => a.localeCompare(b)));
+    return `${JSON.stringify({ version: REMOTE_SKILL_LOCK_VERSION, skills }, null, 2)}\n`;
+}
+export function writeRemoteSkillLock(homeDir, lock, backup) {
+    const path = remoteSkillLockPath(homeDir);
+    const content = serializeRemoteSkillLock(lock);
+    mkdirSync(dirname(path), { recursive: true });
+    if (backup) {
+        backup.writeFile(path, content);
+        return;
+    }
+    const temporary = join(dirname(path), `.${path.split("/").pop()}.${process.pid}.${Date.now()}.tmp`);
+    try {
+        writeFileSync(temporary, content, { mode: 0o600 });
+        renameSync(temporary, path);
+    }
+    finally {
+        rmSync(temporary, { force: true });
+    }
+}

package/dist/lib/remoteSkillSource.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Remote Skill source handling.  The public command accepts only GitHub
+ * identities, while the lower-level fetch function intentionally accepts a
+ * repository URL so unit and sandbox tests can use a local bare Git remote.
+ * No command in this module evaluates checked-out content.
+ */
+export interface GitHubRepository {
+    source: string;
+    url: string;
+    owner: string;
+    repository: string;
+}
+export interface RemoteSkillCandidate {
+    name: string;
+    directory: string;
+    subdirectory: string;
+}
+export interface SelectedRemoteSkill extends RemoteSkillCandidate {
+    digest: string;
+}
+export interface FetchedRemoteRepository {
+    repository: {
+        url: string;
+    };
+    requestedRef: string;
+    commit: string;
+    root: string;
+    candidates: readonly RemoteSkillCandidate[];
+    select(name: string): SelectedRemoteSkill;
+    dispose(): void;
+}
+/** Accept the exact two source syntaxes Trellis documents, with no URL state
+ * that could put a credential in the provenance lock. */
+export declare function normalizeGitHubRepository(source: string): GitHubRepository;
+/**
+ * Fetches a single immutable commit into a system temporary directory.  It is
+ * exported with a URL-shaped repository argument to let tests exercise the
+ * real Git protocol against a local bare repo; CLI callers first use
+ * normalizeGitHubRepository and therefore cannot pass arbitrary hosts.
+ */
+export declare function fetchRemoteRepository(repository: {
+    url: string;
+}, opts?: {
+    branch?: string;
+}): FetchedRemoteRepository;

package/dist/lib/remoteSkillSource.js

@@ -0,0 +1,206 @@
+/**
+ * Remote Skill source handling.  The public command accepts only GitHub
+ * identities, while the lower-level fetch function intentionally accepts a
+ * repository URL so unit and sandbox tests can use a local bare Git remote.
+ * No command in this module evaluates checked-out content.
+ */
+import { execFileSync } from "node:child_process";
+import { lstatSync, mkdtempSync, readdirSync, realpathSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { basename, join, relative, resolve, sep } from "node:path";
+import { directoryDigest } from "./dirDigest.js";
+function git(args, cwd) {
+    try {
+        return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        throw new Error(`Git could not read the remote Skill source: ${detail}`);
+    }
+}
+/** Accept the exact two source syntaxes Trellis documents, with no URL state
+ * that could put a credential in the provenance lock. */
+export function normalizeGitHubRepository(source) {
+    const shorthand = /^([A-Za-z0-9](?:[A-Za-z0-9-]{0,38})?)\/([A-Za-z0-9_.-]+)$/.exec(source);
+    if (shorthand) {
+        const [, owner, repository] = shorthand;
+        return { source, owner: owner, repository: repository, url: `https://github.com/${owner}/${repository}.git` };
+    }
+    let parsed;
+    try {
+        parsed = new URL(source);
+    }
+    catch {
+        throw new Error(`Remote Skill source must be GitHub owner/repository or an HTTPS github.com URL: ${source}`);
+    }
+    const parts = parsed.pathname.split("/").filter(Boolean);
+    if (parsed.protocol !== "https:"
+        || parsed.hostname.toLowerCase() !== "github.com"
+        || parsed.username
+        || parsed.password
+        || parsed.search
+        || parsed.hash
+        || parts.length !== 2
+        || !/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})?$/.test(parts[0])
+        || !/^[A-Za-z0-9_.-]+(?:\.git)?$/.test(parts[1])) {
+        throw new Error(`Remote Skill source must be a credential-free HTTPS github.com repository URL: ${source}`);
+    }
+    const owner = parts[0];
+    const repository = parts[1].replace(/\.git$/i, "");
+    return { source, owner, repository, url: `https://github.com/${owner}/${repository}.git` };
+}
+function parseLsRemote(output) {
+    return output.split("\n").flatMap((line) => {
+        const match = /^([0-9a-f]{40})\t(.+)$/.exec(line.trim());
+        return match ? [{ hash: match[1], ref: match[2] }] : [];
+    });
+}
+function resolveDefaultRef(url) {
+    const output = git(["ls-remote", "--symref", url, "HEAD"]);
+    const branch = /^ref:\s+refs\/heads\/([^\s]+)\s+HEAD$/m.exec(output)?.[1];
+    const commit = parseLsRemote(output).find((entry) => entry.ref === "HEAD")?.hash;
+    if (!branch || !commit)
+        throw new Error(`Could not resolve the default branch for ${url}`);
+    return { requestedRef: branch, commit };
+}
+function resolveRequestedRef(url, requestedRef) {
+    if (!requestedRef || /[\0\r\n]/.test(requestedRef))
+        throw new Error("--branch must be a non-empty Git ref");
+    const entries = parseLsRemote(git(["ls-remote", url, requestedRef]));
+    const peeled = entries.find((entry) => entry.ref.endsWith("^{}"));
+    const direct = entries.find((entry) => !entry.ref.endsWith("^{}"));
+    const selected = peeled ?? direct;
+    if (!selected)
+        throw new Error(`Remote source has no ref named ${requestedRef}`);
+    return { requestedRef, commit: selected.hash };
+}
+function isInside(root, target) {
+    const rel = relative(root, target);
+    return rel === "" || (!rel.startsWith(`..${sep}`) && rel !== ".." && !rel.startsWith("..\/"));
+}
+function walkDirectories(root) {
+    const dirs = [];
+    const walk = (current) => {
+        dirs.push(current);
+        for (const name of readdirSync(current).sort((a, b) => a.localeCompare(b))) {
+            // The Git administration directory is implementation state, never
+            // source content to inspect for a Skill candidate.
+            if (current === root && name === ".git")
+                continue;
+            const entry = join(current, name);
+            const stat = lstatSync(entry);
+            if (stat.isDirectory())
+                walk(entry);
+        }
+    };
+    walk(root);
+    return dirs;
+}
+function candidatesIn(root) {
+    return walkDirectories(root).flatMap((directory) => {
+        const names = readdirSync(directory);
+        const exact = names.find((name) => name === "SKILL.md");
+        if (!exact)
+            return [];
+        const entry = join(directory, exact);
+        // A non-file `SKILL.md` is deliberately not advertised as a valid
+        // candidate; selecting this directory produces a precise error below.
+        if (!lstatSync(entry).isFile())
+            return [];
+        return [{ name: basename(directory), directory, subdirectory: relative(root, directory).split(sep).join("/") }];
+    });
+}
+function validateSelectedDirectory(root, directory, expectedName) {
+    if (basename(directory) !== expectedName)
+        throw new Error(`Selected remote Skill directory is not named ${expectedName}`);
+    const rootReal = realpathSync(root);
+    const walk = (current) => {
+        const stat = lstatSync(current);
+        if (stat.isSymbolicLink())
+            throw new Error(`Remote Skill ${expectedName} contains a symbolic link: ${current}`);
+        const resolved = realpathSync(current);
+        if (!isInside(rootReal, resolved))
+            throw new Error(`Remote Skill ${expectedName} resolves outside the fetched repository`);
+        if (!stat.isDirectory())
+            return;
+        for (const name of readdirSync(current))
+            walk(join(current, name));
+    };
+    const entry = join(directory, "SKILL.md");
+    const entryStat = lstatSync(entry);
+    if (entryStat.isSymbolicLink()) {
+        const resolvedEntry = realpathSync(entry);
+        if (!isInside(rootReal, resolvedEntry))
+            throw new Error(`Remote Skill ${expectedName} entry file resolves outside the fetched repository`);
+        throw new Error(`Remote Skill ${expectedName} entry file must not be a symbolic link`);
+    }
+    if (!entryStat.isFile())
+        throw new Error(`Remote Skill ${expectedName} has no regular, exact-case SKILL.md`);
+    walk(directory);
+    return {
+        name: expectedName,
+        directory,
+        subdirectory: relative(root, directory).split(sep).join("/"),
+        digest: directoryDigest(directory),
+    };
+}
+/**
+ * Fetches a single immutable commit into a system temporary directory.  It is
+ * exported with a URL-shaped repository argument to let tests exercise the
+ * real Git protocol against a local bare repo; CLI callers first use
+ * normalizeGitHubRepository and therefore cannot pass arbitrary hosts.
+ */
+export function fetchRemoteRepository(repository, opts = {}) {
+    const resolvedRef = opts.branch === undefined ? resolveDefaultRef(repository.url) : resolveRequestedRef(repository.url, opts.branch);
+    const temp = mkdtempSync(join(tmpdir(), "trellis-remote-skill-"));
+    let disposed = false;
+    try {
+        git(["init", "--quiet"], temp);
+        git(["remote", "add", "origin", repository.url], temp);
+        git(["fetch", "--quiet", "--depth=1", "origin", resolvedRef.commit], temp);
+        git(["checkout", "--quiet", "--detach", "FETCH_HEAD"], temp);
+        const actualCommit = git(["rev-parse", "HEAD"], temp).trim();
+        if (!/^[0-9a-f]{40}$/.test(actualCommit))
+            throw new Error("Git did not produce an immutable commit identifier");
+        const root = resolve(temp);
+        const candidates = candidatesIn(root);
+        return {
+            repository: { url: repository.url },
+            requestedRef: resolvedRef.requestedRef,
+            commit: actualCommit,
+            root,
+            candidates,
+            select(name) {
+                const matchingDirectories = walkDirectories(root).filter((directory) => basename(directory) === name);
+                if (matchingDirectories.length === 0) {
+                    const available = candidates.map((candidate) => candidate.name).sort().join(", ") || "none";
+                    throw new Error(`Remote source has no Skill named ${name}. Available Skills: ${available}`);
+                }
+                const withEntry = matchingDirectories.filter((directory) => {
+                    try {
+                        return readdirSync(directory).includes("SKILL.md");
+                    }
+                    catch {
+                        return false;
+                    }
+                });
+                if (withEntry.length !== 1) {
+                    if (withEntry.length === 0)
+                        throw new Error(`Remote Skill ${name} has no regular, exact-case SKILL.md`);
+                    throw new Error(`Remote source contains multiple Skills named ${name}; select a repository with one matching Skill`);
+                }
+                return validateSelectedDirectory(root, withEntry[0], name);
+            },
+            dispose() {
+                if (disposed)
+                    return;
+                disposed = true;
+                rmSync(temp, { recursive: true, force: true });
+            },
+        };
+    }
+    catch (error) {
+        rmSync(temp, { recursive: true, force: true });
+        throw error;
+    }
+}

package/dist/lib/runtimeControlProvider.js

@@ -9,6 +9,7 @@ import * as codexProbe from "../probes/codex.js";
 import * as kiroProbe from "../probes/kiro.js";
 import * as piProbe from "../probes/pi.js";
 import * as kimiCodeProbe from "../probes/kimi-code.js";
+import * as zcodeProbe from "../probes/zcode.js";
 import { TRELLIS_VERSION } from "./cliMetadata.js";
 import { inspectMemoryReadiness } from "./memoryStatus.js";
 const MAX_INSTRUCTIONS_BYTES = 256 * 1024;
@@ -37,6 +38,7 @@ const PROBES = {
     kiro: (homeDir) => kiroProbe.probe(homeDir),
     pi: (homeDir) => piProbe.probe(homeDir),
     "kimi-code": (homeDir) => kimiCodeProbe.probe(homeDir),
+    zcode: (homeDir) => zcodeProbe.probe(homeDir),
 };
 function textResult(value) {
     return { content: [{ type: "text", text: JSON.stringify(value, null, 2) }], structuredContent: value };

package/dist/lib/taskStore.js

@@ -42,7 +42,7 @@ function now() {
     return new Date().toISOString();
 }
 function assertAgent(value, label) {
-    if (value !== "claude-code" && value !== "codex" && value !== "kiro" && value !== "pi" && value !== "kimi-code") {
+    if (value !== "claude-code" && value !== "codex" && value !== "kiro" && value !== "pi" && value !== "kimi-code" && value !== "zcode") {
         throw new Error(`${label} must be a supported Agent id`);
     }
 }