agentic-workflow-manager 3.0.1 → 3.2.0

package/dist/src/core/diagnostics/context.js

@@ -16,6 +16,7 @@ const profile_1 = require("../profile");
 const bundles_1 = require("../bundles");
 const skill_integrity_1 = require("../skill-integrity");
 const paths_1 = require("../paths");
+const provider_checks_1 = require("./provider-checks");
 // Estado de un artefacto en <dir>/<skill>: link vivo / symlink colgante / ausente.
 function linkState(dir, skill) {
     const p = path_1.default.join(dir, skill);
@@ -44,12 +45,12 @@ function classifyLinks(skillNames, dir) {
 }
 function detectGitState(repoDir) {
     try {
-        const porcelain = (0, child_process_1.execSync)('git status --porcelain', { cwd: repoDir, stdio: ['ignore', 'pipe', 'ignore'] })
+        const porcelain = (0, child_process_1.execFileSync)('git', ['status', '--porcelain'], { cwd: repoDir, stdio: ['ignore', 'pipe', 'ignore'], encoding: 'utf8' })
             .toString().trim();
         if (porcelain.length > 0)
             return 'dirty';
         try {
-            const behind = (0, child_process_1.execSync)('git rev-list --count HEAD..@{u}', { cwd: repoDir, stdio: ['ignore', 'pipe', 'ignore'], timeout: 3000 })
+            const behind = (0, child_process_1.execFileSync)('git', ['rev-list', '--count', 'HEAD..@{u}'], { cwd: repoDir, stdio: ['ignore', 'pipe', 'ignore'], timeout: 3000, encoding: 'utf8' })
                 .toString().trim();
             if (behind !== '' && behind !== '0')
                 return 'behind';
@@ -67,8 +68,8 @@ function detectGitState(repoDir) {
 function gatherContextInjection() {
     const out = [];
     const orch = new orchestrator_1.InjectionOrchestrator();
-    for (const agent of Object.keys(providers_1.PROVIDERS)) {
-        const inj = providers_1.PROVIDERS[agent].injection;
+    for (const agent of providers_1.AGENT_TARGETS) {
+        const inj = (0, providers_1.providerFor)(agent).injection;
         if (!inj || inj.type !== 'config-instructions')
             continue;
         if (!fs_1.default.existsSync(inj.configPath))
@@ -96,17 +97,22 @@ function gatherMachine(bundles, agent = 'claude-code') {
     const first = regs[0];
     const cachePresent = !!first && fs_1.default.existsSync(path_1.default.join(first.contentRoot, '.git'));
     const gitState = cachePresent ? detectGitState(first.contentRoot) : undefined;
-    // hook (reutiliza computeHookStatus)
+    // hook (reutiliza computeHookStatus) — Task 9 fix: this used to be hardcoded to
+    // 'claude-code' regardless of `agent`, so `awm init --agent codex`'s own hook
+    // precondition silently read CLAUDE's hook status instead of Codex's. Whenever
+    // Claude's hook was already installed, stepHook would then wrongly conclude
+    // Codex's hook was "already present" and skip installing it (R18 regression —
+    // caught while building this task's real end-to-end init test).
     let hookPresent = false;
     let hookDegraded = false;
     try {
-        const hs = (0, status_1.computeHookStatus)('claude-code');
+        const hs = (0, status_1.computeHookStatus)(agent);
         hookPresent = hs.checks.settingsEntry.ok;
         hookDegraded = hs.overall === 'DEGRADED';
     }
     catch { /* sin soporte de hooks → ausente */ }
     // devCore (bundle baseline)
-    const skillsDir = providers_1.PROVIDERS[agent].skill.global;
+    const skillsDir = (0, providers_1.providerFor)(agent).skill.global;
     const baseline = bundles.find((b) => b.scope === 'baseline');
     let devCorePresent = false;
     let brokenLinks = [];
@@ -116,6 +122,26 @@ function gatherMachine(bundles, agent = 'claude-code') {
         const absent = skillNames.filter((s) => !linked.includes(s) && !broken.includes(s));
         devCorePresent = skillNames.length > 0 && (linked.length + broken.length) > 0;
         brokenLinks = [...broken, ...absent];
+        // Agent-type artifacts are never shared across agents (R12/R13 —
+        // install-planner.ts — unlike skills, where OpenCode and Codex both
+        // resolve to ~/.agents/skills). A shared skill directory already
+        // linked by a co-owner agent must not make THIS agent's own native
+        // agent artifacts look "present" when they were never installed for
+        // it specifically — otherwise stepDevCore (init/steps.ts) would skip
+        // re-running and Codex would never get its .toml rendered on a
+        // machine where OpenCode was initialized first. Found while building
+        // the real Codex+OpenCode coexistence E2E test
+        // (tests/integration/codex-provider-isolated.test.ts).
+        const agentConfig = (0, providers_1.providerFor)(agent).agent;
+        if (agentConfig) {
+            const agentNames = (0, bundles_1.resolveBundleAgents)(baseline.name, bundles);
+            if (agentNames.length > 0) {
+                const filenames = agentNames.map((n) => agentConfig.renderer === 'codex-agent-toml' ? `${n}.toml` : n);
+                const { linked: agentLinked, broken: agentBroken } = classifyLinks(filenames, agentConfig.global);
+                const agentAbsent = filenames.filter((f) => !agentLinked.includes(f) && !agentBroken.includes(f));
+                brokenLinks = [...brokenLinks, ...agentBroken, ...agentAbsent];
+            }
+        }
     }
     // ambient (deseados desde ~/.awm/config.json)
     let wanted = [];
@@ -145,7 +171,7 @@ function gatherMachine(bundles, agent = 'claude-code') {
 function gatherProject(root, bundles, agent = 'claude-code') {
     const profile = (0, profile_1.readProfile)(root);
     const profilePresent = fs_1.default.existsSync(path_1.default.join(root, '.awm', 'profile.json'));
-    const localSkillsDir = path_1.default.join(root, providers_1.PROVIDERS[agent].skill.local);
+    const localSkillsDir = path_1.default.join(root, (0, providers_1.providerFor)(agent).skill.local);
     const expected = [];
     for (const ext of profile.extensions) {
         for (const s of (0, bundles_1.resolveBundleSkills)(ext, bundles))
@@ -172,8 +198,11 @@ function gatherContext(opts = {}) {
     const bundles = opts.bundles ?? (0, bundles_1.discoverAllBundles)();
     const agent = opts.agent ?? 'claude-code';
     const root = (0, profile_1.findProjectRoot)(cwd);
+    const agents = opts.agents ?? [agent];
+    const scanSkills = opts.scanSkills ?? ((dir) => (0, skill_integrity_1.classifyGlobalSkills)(dir, (0, registries_1.contentRoots)()));
     return {
         machine: gatherMachine(bundles, agent),
         project: root ? gatherProject(root, bundles, agent) : null,
+        providers: (0, provider_checks_1.gatherProviderChecks)(agents, scanSkills),
     };
 }

package/dist/src/core/diagnostics/provider-checks.js

@@ -0,0 +1,219 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.gatherProviderChecks = gatherProviderChecks;
+// src/core/diagnostics/provider-checks.ts
+//
+// Builds the per-provider diagnostic matrix consumed by `awm doctor`
+// (Task 9). Kept in its own module (rather than growing context.ts or
+// checks.ts) because it has a distinct concern: turning raw provider state
+// (binary version, skill/agent dirs, hook trust, context injection) into a
+// small set of stable, JSON-friendly `ProviderCheck` rows — one per
+// provider, deduplicated for physical directories shared between providers
+// (today: OpenCode and Codex both read/write ~/.agents/skills).
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const providers_1 = require("../../providers");
+const provider_version_1 = require("../provider-version");
+const status_1 = require("../../commands/hooks/status");
+const orchestrator_1 = require("../context/orchestrator");
+const registries_1 = require("../registries");
+function binaryVersionCheck(agent) {
+    const provider = (0, providers_1.providerFor)(agent);
+    if (!provider.versionCommand || !provider.minimumVersion) {
+        // No version gate for this agent — nothing to enforce, treat as supported.
+        return { id: 'binary.version', state: 'supported' };
+    }
+    try {
+        const { version } = (0, provider_version_1.assertProviderSupported)(agent);
+        return { id: 'binary.version', state: 'supported', target: version ?? undefined };
+    }
+    catch (err) {
+        const message = err.message;
+        const missing = /not installed|not available on PATH/i.test(message);
+        return {
+            id: 'binary.version',
+            state: missing ? 'missing' : 'unsupported',
+            detail: message,
+            remediationCode: missing ? 'install-provider-binary' : 'upgrade-provider-binary',
+        };
+    }
+}
+function skillsGlobalCheck(dir, owners, integrity) {
+    const shared = owners.length > 1;
+    const broken = integrity.repairable.length + integrity.dead.length;
+    // Broken links are checked BEFORE shared: 'shared' is a non-degrading/OK state
+    // (see checks.ts's DEGRADING_PROVIDER_STATES), so if it were set unconditionally
+    // for a shared dir it would silently mask real broken/dead symlinks — a green
+    // checkmark next to "N broken links → repair-global-skills" would contradict its
+    // own trailing text, and `overall` would never degrade despite real breakage.
+    let state;
+    if (broken > 0) {
+        state = 'broken';
+    }
+    else if (shared) {
+        state = 'shared';
+    }
+    else if (!fs_1.default.existsSync(dir)) {
+        state = 'absent';
+    }
+    else {
+        state = 'healthy';
+    }
+    return {
+        id: 'skills.global',
+        state,
+        target: dir,
+        owners: shared ? owners : undefined,
+        detail: broken > 0 ? `${broken} broken links` : undefined,
+        remediationCode: broken > 0 ? 'repair-global-skills' : undefined,
+    };
+}
+/** R8: verify the Codex `.toml` agents this run's renderer would have produced still parse. */
+function tomlAgentsHealthy(dir, entries) {
+    const tomls = entries.filter((e) => e.endsWith('.toml'));
+    const broken = tomls.filter((file) => {
+        try {
+            const content = fs_1.default.readFileSync(path_1.default.join(dir, file), 'utf8');
+            // renderCodexAgent (Task 4) always emits this key — its absence means the
+            // file was hand-edited or truncated, not a shape `awm` would have written.
+            return !content.includes('developer_instructions = ');
+        }
+        catch {
+            return true;
+        }
+    }).length;
+    return { broken };
+}
+/**
+ * Returns `null` when a check doesn't structurally apply to `agent` (e.g. Antigravity
+ * has no `agent`/`hooks`/`injection` config; OpenCode has no hooks; Claude Code's global
+ * context rides its SessionStart hook, already covered by hook.trust). `null` rows are
+ * dropped by `gatherProviderChecks` — omitted entirely, not rendered as a failure. This
+ * is deliberately distinct from `state: 'unsupported'`, which `binaryVersionCheck` still
+ * uses for a genuine failure (an installed CLI version below the required minimum) — that
+ * state correctly degrades `overall` (see checks.ts's DEGRADING_PROVIDER_STATES) and must
+ * never be reused to mean "not applicable", or a fully-healthy single-provider `awm doctor`
+ * run (e.g. claude-code-only, opencode-only, antigravity-only) would always render
+ * inapplicable rows as red ✖ and `overall` could never be 'healthy'.
+ */
+function agentsNativeCheck(agent) {
+    const provider = (0, providers_1.providerFor)(agent);
+    if (!provider.agent)
+        return null;
+    const dir = provider.agent.global;
+    let entries;
+    try {
+        entries = fs_1.default.readdirSync(dir);
+    }
+    catch {
+        return { id: 'agents.native', state: 'absent', target: dir };
+    }
+    if (entries.length === 0)
+        return { id: 'agents.native', state: 'absent', target: dir };
+    if (provider.agent.renderer === 'codex-agent-toml') {
+        const { broken } = tomlAgentsHealthy(dir, entries);
+        return {
+            id: 'agents.native',
+            state: broken > 0 ? 'broken' : 'healthy',
+            target: dir,
+            detail: broken > 0 ? `${broken} malformed .toml` : undefined,
+            remediationCode: broken > 0 ? 'reinstall-native-agents' : undefined,
+        };
+    }
+    return { id: 'agents.native', state: 'healthy', target: dir };
+}
+function hookTrustCheck(agent) {
+    const provider = (0, providers_1.providerFor)(agent);
+    if (!provider.hooks)
+        return null;
+    let status;
+    try {
+        status = (0, status_1.computeHookStatus)(agent);
+    }
+    catch {
+        return { id: 'hook.trust', state: 'absent', remediationCode: 'awm-init' };
+    }
+    if (status.overall === 'NOT_INSTALLED') {
+        return { id: 'hook.trust', state: 'absent', remediationCode: 'awm-init' };
+    }
+    if (status.trust) {
+        // Codex: 'pending-trust' | 'healthy' | 'stale' map directly onto ProviderCheckState.
+        return {
+            id: 'hook.trust',
+            state: status.trust,
+            remediationCode: status.trust === 'pending-trust' ? 'open-hooks-trust' : undefined,
+        };
+    }
+    return { id: 'hook.trust', state: status.overall === 'HEALTHY' ? 'healthy' : 'broken' };
+}
+/** R7: reflects the provider's global context-delivery mechanism (config-instructions /
+ *  managed-agents-md). claude-code's context rides the SessionStart hook — already
+ *  covered by hook.trust, so this check is OMITTED (returns null) rather than reported,
+ *  to avoid double-reporting the same fact as a separate, redundant row. */
+function contextGlobalCheck(agent) {
+    const injection = (0, providers_1.providerFor)(agent).injection;
+    if (!injection || injection.type === 'cc-settings-merge') {
+        return null;
+    }
+    let state = 'absent';
+    try {
+        const orchestrator = new orchestrator_1.InjectionOrchestrator();
+        const result = orchestrator.contextStatus({
+            agent,
+            scope: 'global',
+            registryRoot: (0, registries_1.capabilityRoot)('skills') ?? '',
+            installMethod: 'symlink',
+            profileExtensions: [],
+        });
+        state = result === 'injected' ? 'delivered' : result === 'stale' ? 'stale' : 'absent';
+    }
+    catch {
+        state = 'absent';
+    }
+    return {
+        id: 'context.global',
+        state,
+        remediationCode: state === 'delivered' ? undefined : 'awm-init',
+    };
+}
+/**
+ * Builds one `ProviderFacts` row per requested agent. Physical skill directories shared
+ * between providers (OpenCode + Codex both use `~/.agents/skills`) are scanned exactly
+ * once via `scanSkills` and every owner's `skills.global` check is marked `state: 'shared'`
+ * — mirrors the dedup principle `install-planner.ts` (Task 5) already applies to writes.
+ *
+ * Named `gatherProviderChecks` (not `gatherProviderFacts`) to avoid colliding with the
+ * unrelated `gatherProviderFacts` in `core/init/provider-facts.ts` (Task 8, baseline-hash
+ * snapshot for rollback comparison — a different shape, a different purpose). No file
+ * currently imports both, but the names are close enough to trip up a future reader/editor.
+ */
+function gatherProviderChecks(agents, scanSkills) {
+    const ownersByDir = new Map();
+    for (const agent of agents) {
+        const dir = (0, providers_1.providerFor)(agent).skill.global;
+        const owners = ownersByDir.get(dir) ?? [];
+        owners.push(agent);
+        ownersByDir.set(dir, owners);
+    }
+    const scansByDir = new Map();
+    for (const dir of ownersByDir.keys()) {
+        scansByDir.set(dir, scanSkills(dir));
+    }
+    return agents.map((agent) => {
+        const provider = (0, providers_1.providerFor)(agent);
+        const dir = provider.skill.global;
+        const owners = ownersByDir.get(dir) ?? [agent];
+        const integrity = scansByDir.get(dir) ?? { valid: [], repairable: [], dead: [] };
+        const checks = [
+            binaryVersionCheck(agent),
+            skillsGlobalCheck(dir, owners, integrity),
+            agentsNativeCheck(agent),
+            hookTrustCheck(agent),
+            contextGlobalCheck(agent),
+        ].filter((check) => check !== null);
+        return { id: agent, label: provider.label, checks };
+    });
+}

package/dist/src/core/discovery.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.matchFrontmatterBlock = matchFrontmatterBlock;
 exports.readArtifactDescription = readArtifactDescription;
 exports.discoverSkills = discoverSkills;
 exports.discoverWorkflows = discoverWorkflows;
@@ -11,13 +12,18 @@ exports.discoverAgents = discoverAgents;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const registries_1 = require("./registries");
+/** Extracts the raw frontmatter text (between the --- delimiters), or null if the block is missing/malformed. CRLF-tolerant. */
+function matchFrontmatterBlock(raw) {
+    const fmMatch = raw.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+    return fmMatch ? fmMatch[1] : null;
+}
 function readArtifactDescription(filePath) {
     try {
         const raw = fs_1.default.readFileSync(filePath, 'utf-8');
-        const fmMatch = raw.match(/^---\r?\n([\s\S]*?)\r?\n---/);
-        if (!fmMatch)
+        const frontmatter = matchFrontmatterBlock(raw);
+        if (frontmatter === null)
             return '';
-        const line = fmMatch[1]
+        const line = frontmatter
             .split(/\r?\n/)
             .find((l) => /^description\s*:/.test(l));
         if (!line)

package/dist/src/core/executor.js

@@ -4,6 +4,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.removeArtifact = removeArtifact;
+exports.stageArtifact = stageArtifact;
+exports.replaceArtifact = replaceArtifact;
 exports.installArtifact = installArtifact;
 // src/core/executor.ts
 const fs_1 = __importDefault(require("fs"));
@@ -22,20 +24,39 @@ function removeArtifact(targetPath) {
     }
     fs_1.default.rmSync(targetPath, { recursive: true, force: true });
 }
-function installArtifact(sourcePath, targetPath, method) {
+/**
+ * Stages `sourcePath` next to `targetPath` (same parent directory) WITHOUT
+ * touching `targetPath` itself (R17): the live target is never removed until
+ * a stage has already succeeded. Returns the staged path, ready to be swapped
+ * in via `replaceArtifact`.
+ */
+function stageArtifact(sourcePath, targetPath, method) {
     if (!fs_1.default.existsSync(sourcePath)) {
         throw new Error(`Source path does not exist: ${sourcePath}`);
     }
-    const parentDir = path_1.default.dirname(targetPath);
-    if (!fs_1.default.existsSync(parentDir)) {
-        fs_1.default.mkdirSync(parentDir, { recursive: true });
-    }
-    // Clean up existing if it exists
-    fs_1.default.rmSync(targetPath, { recursive: true, force: true });
+    const parent = path_1.default.dirname(targetPath);
+    fs_1.default.mkdirSync(parent, { recursive: true });
+    const staged = path_1.default.join(parent, `.${path_1.default.basename(targetPath)}.${process.pid}.staged`);
+    fs_1.default.rmSync(staged, { recursive: true, force: true });
     if (method === 'symlink') {
-        fs_1.default.symlinkSync(sourcePath, targetPath, 'dir');
+        fs_1.default.symlinkSync(sourcePath, staged, 'dir');
     }
     else {
-        fs_1.default.cpSync(sourcePath, targetPath, { recursive: true });
+        fs_1.default.cpSync(sourcePath, staged, { recursive: true });
     }
+    return staged;
+}
+/** Atomically swaps a staged artifact into `targetPath`, replacing whatever is there. */
+function replaceArtifact(staged, targetPath) {
+    fs_1.default.rmSync(targetPath, { recursive: true, force: true });
+    fs_1.default.renameSync(staged, targetPath);
+}
+/**
+ * Convenience wrapper over `stageArtifact` + `replaceArtifact` for callers
+ * that don't need transactional multi-target coordination (see
+ * install-transaction.ts's `applyInstallPlan` for the transactional path).
+ */
+function installArtifact(sourcePath, targetPath, method) {
+    const staged = stageArtifact(sourcePath, targetPath, method);
+    replaceArtifact(staged, targetPath);
 }

package/dist/src/core/export/index.js

@@ -0,0 +1,51 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EXPORT_TARGETS = void 0;
+exports.runExport = runExport;
+// cli/src/core/export/index.ts
+//
+// Orquestación del export (issue #9): resolve → adapt (override verbatim R3,
+// o transform mecánico R3.1) → pack. Opera 100% offline (R5.2): solo fs local.
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const registries_1 = require("../registries");
+const resolve_1 = require("./resolve");
+const transform_1 = require("./transform");
+const pack_1 = require("./pack");
+exports.EXPORT_TARGETS = ['claude-ai'];
+function runExport(opts) {
+    const target = opts.target ?? 'claude-ai';
+    if (!exports.EXPORT_TARGETS.includes(target)) {
+        throw new Error(`Unknown export target "${target}". Valid targets: ${exports.EXPORT_TARGETS.join(', ')}.`);
+    }
+    const roots = opts.roots ?? (0, registries_1.contentRoots)();
+    const outDir = path_1.default.join(opts.out ?? path_1.default.join(process.cwd(), 'awm-export'), target);
+    const resolution = (0, resolve_1.resolveExport)(opts.name, roots);
+    fs_1.default.mkdirSync(outDir, { recursive: true });
+    const exported = [];
+    let zipAvailable = true;
+    for (const skill of resolution.skills) {
+        let adapted;
+        if (skill.overridePath) {
+            adapted = fs_1.default.readFileSync(skill.overridePath, 'utf-8'); // R3: verbatim
+        }
+        else {
+            const canonical = path_1.default.join(skill.dir, 'SKILL.md');
+            const raw = fs_1.default.readFileSync(canonical, 'utf-8');
+            try {
+                adapted = (0, transform_1.claudeAiTransform)(raw, skill.name);
+            }
+            catch (e) {
+                throw new Error(`${canonical}: ${e instanceof Error ? e.message : String(e)}`); // R3.4 cita el archivo
+            }
+        }
+        const packed = (0, pack_1.packSkill)({ name: skill.name, adaptedSkillMd: adapted, srcDir: skill.dir, targetRoot: outDir, zip: opts.zip });
+        if (packed.zipMissing)
+            zipAvailable = false;
+        exported.push({ name: skill.name, dir: packed.dir, zip: packed.zip });
+    }
+    return { outDir, kind: resolution.kind, exported, skipped: resolution.skipped, zipAvailable };
+}

package/dist/src/core/export/pack.js

@@ -0,0 +1,58 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultZip = void 0;
+exports.packSkill = packSkill;
+// cli/src/core/export/pack.ts
+//
+// Escritura determinística del artefacto (R4: limpia su propio subárbol antes
+// de escribir) + zip por capas con binario del sistema (R4.1/R4.2). ZipFn es
+// inyectable para tests.
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
+/** Refuses symlinks anywhere in the tree — copying/zipping them could dereference
+ * into content outside the registry (info-leak) or embed a broken/unexpected
+ * link for the recipient. Exported artifacts are plain files only. */
+function assertNoSymlinks(dir) {
+    for (const entry of fs_1.default.readdirSync(dir, { withFileTypes: true })) {
+        const full = path_1.default.join(dir, entry.name);
+        if (entry.isSymbolicLink()) {
+            throw new Error(`Refusing to export "${full}": symlinks are not supported in exported artifacts (could leak file content via zip dereferencing, or resolve unexpectedly for the recipient).`);
+        }
+        if (entry.isDirectory())
+            assertNoSymlinks(full);
+    }
+}
+/** Capa 1: binario `zip` del sistema. ENOENT → missing (capa 2: carpeta). */
+const defaultZip = (cwd, zipName, folderName) => {
+    const r = (0, child_process_1.spawnSync)('zip', ['-r', '-q', zipName, folderName], { cwd });
+    if (r.error && r.error.code === 'ENOENT') {
+        return { ok: false, missing: true };
+    }
+    return { ok: r.status === 0, missing: false };
+};
+exports.defaultZip = defaultZip;
+function packSkill(opts) {
+    const zip = opts.zip ?? exports.defaultZip;
+    const skillOut = path_1.default.join(opts.targetRoot, opts.name);
+    const zipPath = path_1.default.join(opts.targetRoot, `${opts.name}.zip`);
+    // R4: determinismo — el re-export limpia su propio subárbol primero.
+    fs_1.default.rmSync(skillOut, { recursive: true, force: true });
+    fs_1.default.rmSync(zipPath, { force: true });
+    fs_1.default.mkdirSync(skillOut, { recursive: true });
+    fs_1.default.writeFileSync(path_1.default.join(skillOut, 'SKILL.md'), opts.adaptedSkillMd);
+    const refs = path_1.default.join(opts.srcDir, 'references');
+    if (fs_1.default.existsSync(refs)) {
+        assertNoSymlinks(refs);
+        fs_1.default.cpSync(refs, path_1.default.join(skillOut, 'references'), { recursive: true }); // R3.2 byte-idéntico
+    }
+    const zr = zip(opts.targetRoot, `${opts.name}.zip`, opts.name);
+    if (zr.missing)
+        return { dir: skillOut, zip: null, zipMissing: true };
+    if (!zr.ok)
+        throw new Error(`zip failed for skill "${opts.name}" (non-zero exit).`);
+    return { dir: skillOut, zip: zipPath, zipMissing: false };
+}

package/dist/src/core/export/resolve.js

@@ -0,0 +1,77 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveExport = resolveExport;
+// cli/src/core/export/resolve.ts
+//
+// Resolución <nombre> → skills a exportar (R1/R1.1) con gate de portabilidad
+// (R2.x) y consistencia de override (R3.3). Lee SIEMPRE de content roots del
+// registry instalado — nunca de ~/.claude/skills.
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const bundles_1 = require("../bundles");
+const discovery_1 = require("../discovery");
+const OVERRIDE_FILE = 'port.claude-ai.md';
+/** portable: true en el frontmatter (bloque --- inicial), CRLF-tolerant como readArtifactDescription en discovery.ts. */
+function isPortable(skillMd) {
+    const frontmatter = (0, discovery_1.matchFrontmatterBlock)(skillMd);
+    if (frontmatter === null)
+        return false;
+    return /^portable\s*:\s*true\s*$/m.test(frontmatter);
+}
+/**
+ * Delegates skill location to discoverSkills(roots) so the SAME collision/override
+ * contract used by bundles/workflows/agents applies here (R3): a same-named skill in
+ * two roots throws unless the later root's awm-registry.json declares it in "overrides",
+ * in which case the later root's version wins. Locating manually (first-root-wins) would
+ * silently resolve to the wrong registry's version — see Finding 1.
+ */
+function locate(skillName, roots) {
+    const found = (0, discovery_1.discoverSkills)(roots).find((s) => s.name === skillName);
+    if (!found)
+        return null;
+    const dir = found.path;
+    const skillFile = path_1.default.join(dir, 'SKILL.md');
+    const overridePath = fs_1.default.existsSync(path_1.default.join(dir, OVERRIDE_FILE))
+        ? path_1.default.join(dir, OVERRIDE_FILE) : null;
+    return { name: skillName, dir, portable: isPortable(fs_1.default.readFileSync(skillFile, 'utf-8')), overridePath };
+}
+/** R3.3: un override declara intención de export; sin portable es contrato a medias. */
+function assertOverrideConsistency(s) {
+    if (s.overridePath && !s.portable) {
+        throw new Error(`Inconsistent metadata for skill "${s.name}": ${OVERRIDE_FILE} exists but SKILL.md does not declare portable: true.`);
+    }
+}
+function resolveExport(requested, roots) {
+    const bundles = (0, bundles_1.discoverAllBundles)(roots);
+    if (bundles.some((b) => b.name === requested)) {
+        const skills = [];
+        const skipped = [];
+        for (const name of (0, bundles_1.resolveBundleSkills)(requested, bundles)) {
+            const s = locate(name, roots);
+            if (!s)
+                throw new Error(`Bundle "${requested}" lists skill "${name}" but no content root contains skills/${name}/SKILL.md.`);
+            assertOverrideConsistency(s);
+            if (s.portable)
+                skills.push(s);
+            else
+                skipped.push(s.name);
+        }
+        if (skills.length === 0) {
+            throw new Error(`Bundle "${requested}" has no portable skills — nothing to export. Mark skills with portable: true in their frontmatter.`);
+        }
+        return { kind: 'bundle', requested, skills, skipped: skipped.sort() };
+    }
+    const single = locate(requested, roots);
+    if (!single) {
+        const available = bundles.map((b) => b.name).join(', ') || '(none)';
+        throw new Error(`"${requested}" is neither a bundle nor a skill in any content root. Available bundles: ${available}.`);
+    }
+    assertOverrideConsistency(single);
+    if (!single.portable) {
+        throw new Error(`Skill "${requested}" is not portable (no portable: true in its frontmatter) — it likely depends on filesystem/git and would break on claude.ai.`);
+    }
+    return { kind: 'skill', requested, skills: [single], skipped: [] };
+}

package/dist/src/core/export/transform.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFERENCE_LINE = void 0;
+exports.claudeAiTransform = claudeAiTransform;
+// cli/src/core/export/transform.ts
+//
+// Transform mecánico claude.ai (R3.1): función pura string → string.
+// Frontmatter line-based plano (los SKILL.md del baseline usan claves de una
+// línea) — sin parser YAML a propósito (YAGNI, cero deps).
+const DEFERENCE_LINE = (skillName) => `In environments with AWM installed (Claude Code), defer to the registry's ${skillName} skill — this port is for environments without filesystem access.`;
+exports.DEFERENCE_LINE = DEFERENCE_LINE;
+function claudeAiTransform(skillMd, skillName) {
+    // \r?\n-tolerant, same rationale as readArtifactDescription in discovery.ts:
+    // SKILL.md files may be CRLF-terminated and that's still valid frontmatter.
+    const startMatch = skillMd.match(/^---\r?\n/);
+    if (!startMatch) {
+        throw new Error('missing frontmatter block (file must start with ---)');
+    }
+    const startLen = startMatch[0].length;
+    const endMatch = skillMd.slice(startLen).match(/\r?\n---\r?\n/);
+    if (!endMatch || endMatch.index === undefined) {
+        throw new Error('unterminated frontmatter block (closing --- not found)');
+    }
+    const end = startLen + endMatch.index;
+    const body = skillMd.slice(end + endMatch[0].length);
+    const fmLines = skillMd.slice(startLen, end).split(/\r?\n/)
+        .filter((l) => !/^(version|portable):/.test(l));
+    const descIdx = fmLines.findIndex((l) => /^description:/.test(l));
+    if (descIdx === -1) {
+        throw new Error('frontmatter has no description field');
+    }
+    const descLine = fmLines[descIdx];
+    const value = descLine.slice('description:'.length).trim();
+    if (value === '' || value === '>' || value === '|' || value.startsWith('>') || value.startsWith('|')) {
+        throw new Error('description must be single-line (block scalars are not supported by the export transform)');
+    }
+    const deference = (0, exports.DEFERENCE_LINE)(skillName);
+    // Quote-style detection mirrors readArtifactDescription in discovery.ts: both
+    // single- and double-quoted scalars are first-class, and we work off the
+    // trimmed value so trailing whitespace after a closing quote doesn't fool us.
+    const isDoubleQuoted = value.length >= 2 && value.startsWith('"') && value.endsWith('"');
+    const isSingleQuoted = value.length >= 2 && value.startsWith("'") && value.endsWith("'");
+    if ((value.startsWith('"') || value.startsWith("'")) && !isDoubleQuoted && !isSingleQuoted) {
+        throw new Error('description has trailing content after its closing quote (e.g. an inline comment) — not supported by the export transform; remove the comment or use a port.claude-ai.md override');
+    }
+    // YAML single-quoted scalars escape a literal ' by doubling it (''); the
+    // deference text ("...registry's..." — see DEFERENCE_LINE) contains an
+    // apostrophe, so it must be escaped before splicing into a single-quoted
+    // description or it would prematurely close the YAML string.
+    const newValue = isDoubleQuoted
+        ? `${value.slice(0, -1)} ${deference}"`
+        : isSingleQuoted
+            ? `${value.slice(0, -1)} ${deference.replace(/'/g, "''")}'`
+            : `${value} ${deference}`;
+    fmLines[descIdx] = `description: ${newValue}`;
+    return `---\n${fmLines.join('\n')}\n---\n${body}`;
+}