agents-inc 0.164.0 → 0.166.0

package/CHANGELOG.md

@@ -7,6 +7,69 @@ Each release has detailed notes in its own file under [`changelogs/`](./changelo
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.166.0] - 2026-10-04
+
+**From a project, `share`, `edit --ui` and every `--from` treat the global install as one every project reads, every write refuses a broken `config.ts` by name, and the audit that followed the journey fixes is applied**
+
+- CLI-902: the 14 non-Codex failures from the 2026-10-01 manual journey run are fixed as ruled. From a project, `share` and `edit --ui` carry the global sub-agents' skills, and `share` refuses ejected skills because a share carries plugins only. Dropping a project copy writes nothing global, and `config.ts` rewrites keep `branding`. `edit` prints the trust line, and the editor's preview matches the install.
+- **Every `--from` lists what goes into the project and what into the global install, then asks.** With no terminal, `init --from` prints the lists and carries on. From a project, `--from` never removes or changes anything global, and names what it kept. The plan discloses a dropped project copy. A kept skill joins the configuration's row, or yields a one-skill slot and stays installed, and every refusal comes before the question.
+- **`init --marketplace` takes the bare-init route; `init --ui --marketplace` refuses.** A custom marketplace needs a valid `marketplace.json`, and `eject`, `local` and `external` are reserved at build and at load, recorded names included.
+- **A broken `config.ts` is refused by every write, naming the file and the folder to recreate it from.** `uninstall` still works on one and clears both source folders, and `doctor` labels the config it read.
+- **Commands that need a terminal refuse cleanly without one.** Raw mode is held before the first paint, Ctrl+C on the dashboard exits as cancelled, and the bare dashboard no longer prints help.
+- **The Claude trust check follows git roots and `CLAUDE_CONFIG_DIR`, and `update` says truthfully that it refreshed listings, not plugins.** Skipped registered projects get bare `Skipped <path>: <reason>.` lines, and counts are singular for one.
+- **`bun run dev` builds the local skill index and applies the local migrations.** The editor's Playwright suite runs on its own port. The modulepreload polyfill is off, and the first-paint budget is 352 KiB.
+- CLI-868: `check-finding-citations` resolves a dated plan under `todo/plans/` as a plan, not a missing finding, and a `compile` unit test no longer depends on TMPDIR's length.
+
+See [changelogs/0.166.0.md](./changelogs/0.166.0.md) for full details.
+
+## [0.165.0] - 2026-10-01
+
+**A new installation's source folder is `.agents-inc/<provider>/`, a configuration can be installed onto OpenAI Codex, and `edit --from` applies a sub-agent's model and effort**
+
+**The source folder.** No command moves an installation that already exists.
+
+- **New installs write `.agents-inc/claude/`** instead of `.claude-src/`, at both scopes: `<project>/.agents-inc/claude/` and `~/.agents-inc/claude/`. The folder is named for the product and grouped by provider, so a Codex installation is `.agents-inc/codex/` with the same shape. One installation is exactly one provider and the folder is what says which; nothing inside `config.ts` records it.
+- **Nothing in the CLI moves an existing installation.** An installation on `.claude-src/` is read and written where it is, by every command, indefinitely. There is no dual-write, no copy on first run, and no deprecation warning that changes where bytes land. Every message naming the config file names the folder the scope is actually on.
+- **Moving a folder is a manual step, and there is no command for it.** The procedure is in `.ai-docs/reference/concepts/source-folder-layout.md`, along with its two gotchas: `config-types.ts`'s relative import gains a level, and a `.gitignore` with a bare `.agents-inc/` rule hides the moved config, so the next commit records only the deletion. Running `npx agents-inc compile` in the moved scope repairs the first.
+- **`doctor` gains a `Layout` row per scope.** It reports which folder the scope is on, whether both folders are on disk and which one is being read, and any compiled sub-agent whose prompt names the folder this installation does not use. At `$HOME` it also lists the registered projects still on the old name, labelled as the registry rather than an inventory of the machine.
+- **`init`, `edit`, `compile`, `update` and `eject` refuse outright while a scope holds both folders**, because the folder the resolver prefers can be the stale one. The refusal names the folder being read and asks you to merge by hand. `doctor` and `list` keep working in that state. A scope on the old name alone is a supported state, not a fault: no write command prints a line about it, and `doctor`'s `Layout` row reports it as a warning naming the move by hand.
+- **Installed output keeps every path it had.** Claude still installs into `.claude/`, skills into `.claude/skills/` and compiled sub-agents into `.claude/agents/`. A shared payload names no source folder, so the rename reaches no share id.
+- **A marketplace source repository gains no provider segment.** A repo declares itself in `.agents-inc/config.ts`, and one still declaring `.claude-src/config.ts` is read there with no sunset.
+- **`uninstall` removes the `.agents-inc/` parent** once the last provider folder under it is gone, and only when the parent is otherwise empty. If you keep your own files under it, the run says it kept the parent rather than leaving it behind silently.
+- **A compiled `agent-summoner` names the source folder its own installation uses**, substituted at compile time, rather than a literal that is wrong on half of all installs.
+
+**OpenAI Codex as a second provider.** You pick the provider in the web app, and the folder on disk is the only record of which one it is.
+
+- **The provider is chosen in the editor, not in the terminal.** A `provider` row in the roster footer picks it, and the command the Install dialog hands you becomes `npx agents-inc init --from <id> --provider codex`. The terminal wizard gains no step. `--provider` without `--from` exits `INVALID_ARGS`, naming `--from` and the editor.
+- **Where one scope holds an installation of each provider, `--provider` is the disambiguator.** `edit`, `uninstall`, `share`, `eject`, `compile` and `update` refuse rather than guess, naming both. `list --provider` picks one. `doctor` reports the state instead of refusing.
+- **Codex offers three of the four placements**: plugin + global, eject + global, and eject + project. Eject + project lands at `<repo>/.agents/skills/<id>/`, a committed directory that reaches the model with no plugin, no marketplace and no trust entry. `plugin + project` is refused by name before anything is written, never quietly ejected instead. The refusal also fires when a config is read, so a `.agents-inc/claude/` copied to `.agents-inc/codex/` is caught.
+- **Sixteen of the eighteen sub-agents compile, as Codex agent role definitions in TOML.** `agent-summoner` and `skill-summoner` are left out for v1, and every Codex install says so once. A role file carries no `model`, since every model a sub-agent can name is Claude's and Codex refuses to start a role naming one; each sub-agent runs on your Codex session's model. Six settings have no Codex expression, and each compile says so once.
+- **`doctor` gains a `Placements Offered` row.** It reports a placement no host can fill and a scope holding two installations, the states other commands stop on, and never refuses.
+- **`uninstall` counts the plugins it observed being removed**, on either host, rather than the plugins it asked about.
+- **What Codex cannot do**: install a plugin for one project; restrict a sub-agent's tools (`tools` is a configuration struct, not an allowlist, so the read-only sub-agents can still edit files); preload a named list of skills; or carry a sub-agent's `disallowedTools`, which is dropped without a mention (no shipped sub-agent declares one).
+- CLI-893: a Codex project's role files need that project trusted in your global Codex config, so the install writes that entry and prints exactly what it wrote. Any later `compile` does the same. A `trust_level` you already set, `"untrusted"` included, is left as you set it and reported. Each of the four ways that trust fails is silent: no entry, `untrusted`, a trailing slash on the path, or the entry written inside the project.
+- CLI-895: an ejected skill's copy is deleted from the folder Codex reads. Switching it to plugin or deselecting it in `edit` used to leave the copy, so Codex read the skill twice.
+- CLI-896: `uninstall` on Codex removes the role files it compiled (`.codex/agents/*.toml`) and leaves a role you wrote yourself, as it does `.claude/agents/*.md` on Claude. `compile` prunes a deselected Codex role the same way.
+
+**Fixes on either host.**
+
+- CLI-898: the editor's output preview lists each skill with the description the install writes, its `SKILL.md` description, rather than the wizard's short label. `build marketplace` puts it in `catalog.json` as `activationDescription`; a catalogue built before this release still previews the label.
+- CLI-899: the loading spinner's last frame no longer survives into the `init` and `edit` wizards. A frame held by Ink's render throttle was painted after the clear, so the full-height wizard lost its top line.
+- `compile` no longer refuses an installation with sub-agents and no skills, which the editor makes and `init --from` installs. A config that declares skills, none of which are on disk, is still refused.
+- `edit --from` applies a configuration whose only difference is a sub-agent's `model` or `effort`, and reports it as its own line. It used to print `No changes made.` and write nothing. Re-selecting a sub-agent in the wizard no longer reverts its model and effort.
+- A local marketplace directory whose path contains a space, such as `/Users/My Name/…`, now reaches `claude` and `codex` instead of being refused by a pattern written for `owner/repo` references.
+
+**On Claude Code, a project sub-agent's completion gate runs only in a folder you have trusted.**
+
+- Claude Code drops the gate otherwise, without a word anywhere you would look. So `init` and `compile` now say so in one line naming the folder. They print it when a compiled sub-agent in `<project>/.claude/agents/` has at least one hook under `Stop` or `SubagentStop`, and `~/.claude.json` has no record of you accepting that folder's trust dialog. A run from the home directory never prints it. The CLI never accepts the dialog for you.
+
+**Withdrawn before release.**
+
+- **`npx agents-inc migrate`.** An earlier draft of this release carried a command that performed the move, with `--adopt`, `--dry-run`, a forwarding stub at the old path, a registered-project rewrite and a git-visibility probe. It was never requested and is deleted whole; nothing in the CLI hands out the invocation.
+- A per-agent lint and check gate, including the `check:` map and a Codex gate plugin with its hook trust, was reverted before release on the owner's 2026-10-01 ruling, and 0.163.0's typecheck `Stop` hook is unchanged.
+
+See [changelogs/0.165.0.md](./changelogs/0.165.0.md) for full details.
+
 ## [0.164.0] - 2026-09-06
 
 **Every shipped sub-agent moves to the 2026-09-03 doctrine, the web skills say when to reach for them, and the editor takes the 2026-09-05 design refresh**

package/README.md

@@ -61,7 +61,6 @@ npx agents-inc init
 | [Editing your config](https://github.com/agents-inc/agents-inc/blob/main/apps/www/src/content/docs/docs/guides/editing-config.md)                        | Skill mappings, preloaded vs dynamic loading, and config structure   |
 | [Customizing subagents](https://github.com/agents-inc/agents-inc/blob/main/apps/www/src/content/docs/docs/guides/customizing-subagents.md)               | Eject and modify partials, templates, and skills                     |
 | [Writing custom skills and subagents](https://github.com/agents-inc/agents-inc/blob/main/apps/www/src/content/docs/docs/guides/writing-custom-skills.md) | Author skills and subagents from scratch or iterate on existing ones |
-| [Importing third-party skills](https://github.com/agents-inc/agents-inc/blob/main/apps/www/src/content/docs/docs/guides/importing-skills.md)             | Install skills from external repositories                            |
 | [Creating a marketplace](https://github.com/agents-inc/agents-inc/blob/main/apps/www/src/content/docs/docs/guides/creating-a-marketplace.md)             | Build a personal or org-level marketplace with curated skills        |
 | [Documenting your codebase](https://github.com/agents-inc/agents-inc/blob/main/apps/www/src/content/docs/docs/guides/documenting-your-codebase.md)       | Generate and maintain AI-focused reference documentation             |
 
@@ -73,13 +72,13 @@ Over 200 skills across 9 domains:
 | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | Web     | React, Vue, Angular, Svelte, SolidJS, Next.js, Remix, Nuxt, SvelteKit, Astro, Qwik, Tailwind, SCSS Modules, Zustand, Redux, Pinia, Vitest, Playwright, Storybook, and more |
 | API     | Hono, Express, Fastify, NestJS, Elysia, Drizzle, Prisma, PostgreSQL, MongoDB, Redis, Stripe, and more                                                                      |
-| AI      | Anthropic SDK, OpenAI SDK, Vercel AI SDK, LangChain, LlamaIndex, Pinecone, ChromaDB, and more                                                                              |
-| Mobile  | React Native, Expo                                                                                                                                                         |
-| Desktop | Tauri, Electron, Electron Forge, electron-updater                                                                                                                          |
+| AI      | Anthropic SDK, OpenAI SDK, Vercel AI SDK, LangChain, LlamaIndex, and more                                                                                                  |
+| Mobile  | React Native, Expo, and more                                                                                                                                               |
+| Desktop | Tauri, Electron, Electron Forge, electron-updater, and more                                                                                                                |
 | CLI     | oclif + Ink, Commander, Clack                                                                                                                                              |
-| Infra   | Docker, GitHub Actions, Cloudflare Workers                                                                                                                                 |
-| Shared  | Turborepo, ESLint + Prettier, Code Reviewing, Auth Security                                                                                                                |
-| Meta    | Research Methodology, CLI Reviewing                                                                                                                                        |
+| Infra   | Docker, GitHub Actions, Cloudflare Workers, and more                                                                                                                       |
+| Shared  | Turborepo, ESLint + Prettier, Auth Security, and more                                                                                                                      |
+| Meta    | Code Reviewing, CLI Reviewing, Research Methodology, and more                                                                                                              |
 
 Browse the full catalog on the [Plugin Marketplace](https://github.com/agents-inc/skills).
 
@@ -107,7 +106,7 @@ Each subagent is composed from modular partials (role, workflow, output format)
 | `edit`    | Modify skill selection via the interactive wizard                           |
 | `compile` | Recompile subagents after changes                                           |
 | `update`  | Refresh the marketplaces this installation uses (ejected skills are yours)  |
-| `search`  | Search skills across all sources                                            |
+| `search`  | Search this installation's marketplace and your local skills                |
 
 ### Customization
 
@@ -119,7 +118,7 @@ Each subagent is composed from modular partials (role, workflow, output format)
 
 | Command             | Description                                    |
 | ------------------- | ---------------------------------------------- |
-| `build marketplace` | Generate `marketplace.json` from source skills |
+| `build marketplace` | Generate `marketplace.json` from built plugins |
 | `build plugins`     | Build skill and agent plugins for distribution |
 
 ### Diagnostics

package/dist/{chunk-X4SSJZLY.js → chunk-25MPBIK3.js}

@@ -1,256 +1,10 @@
 #!/usr/bin/env node
 import {
-  claimSlug,
-  computeFileHash,
-  defaultUsageGuidance,
-  directoryExists,
-  glob,
-  injectForkedFromMetadata,
-  readFile,
-  readForkedFromMetadata,
-  readLocalSkillMetadata,
-  readSkillMetadata,
-  resolveInstallPaths,
-  truncateText,
-  validateSkillPath,
-  writeFile,
-  writeMetadataYaml
-} from "./chunk-XPDVAJDH.js";
+  truncateText
+} from "./chunk-A4KDXNOT.js";
 import {
-  BUILT_IN_MATRIX,
-  getCategoryDomain,
-  typedEntries,
-  typedKeys
-} from "./chunk-AVK2HEKB.js";
-import {
-  GITHUB_SOURCE,
-  LOCAL_SKILLS_PATH,
-  STANDARD_FILES,
-  seedExternalSkillSchema,
   seedPayloadSchema
-} from "./chunk-UITEKY2R.js";
-
-// src/cli/lib/seed/external-skills.ts
-import path from "path";
-function pluginInstallError(ids) {
-  return [
-    "This configuration cannot be installed: these skills travel inside it, so no marketplace serves them and they cannot be installed as plugins:",
-    ...ids.map((id) => `  ${id}`),
-    "Re-share it with each skill above set to eject, which is the only way a carried skill installs."
-  ].join("\n");
-}
-function selectedExternals(payload) {
-  return typedEntries(payload.external ?? {}).flatMap(([id, skill]) => {
-    const entry = payload.skills[id];
-    return entry ? [{ id, skill, entry }] : [];
-  });
-}
-function askedForAsPlugin(externals) {
-  return externals.filter(({ entry }) => entry.install !== "eject").map(({ id }) => id);
-}
-function claimingACatalogueId(externals, matrix) {
-  return externals.filter(({ id }) => heldByEitherCatalogue(id, matrix)).map(({ id }) => id);
-}
-var CATALOGUE_SKILL_IDS = new Set(typedKeys(BUILT_IN_MATRIX.skills));
-function heldByEitherCatalogue(id, matrix) {
-  return heldByLoadedCatalogue(matrix.skills[id]) || CATALOGUE_SKILL_IDS.has(id);
-}
-function heldByLoadedCatalogue(incumbent) {
-  return incumbent !== void 0 && incumbent.local !== true;
-}
-function catalogueIdCollisionError(ids) {
-  return [
-    "This configuration cannot be installed: these skills travel inside it under ids a catalogue already owns:",
-    ...ids.map((id) => `  ${id}`),
-    "A skill id is the directory the skill installs into, so each would be written over the catalogue's own copy of that skill. Re-share it with each skill above added again, which mints an id \u2014 'external-<category>-<name>' \u2014 that no catalogue owns."
-  ].join("\n");
-}
-function externalSlug(id) {
-  return id;
-}
-function skillAuthor(repo) {
-  const [owner = repo] = repo.split("/");
-  return `@${owner}`;
-}
-function repoRef(repo) {
-  return `${GITHUB_SOURCE.GITHUB_PREFIX}${repo}`;
-}
-function externalSkillDir(id, scope, projectDir) {
-  return path.join(resolveInstallPaths(projectDir, scope).skillsDir, id);
-}
-function externalCatalogueEntry(install) {
-  return {
-    id: install.id,
-    slug: externalSlug(install.id),
-    displayName: install.skill.displayName,
-    description: install.skill.description,
-    // Boundary cast held by the guard above it: the category was confirmed against the catalogue
-    // the payload names, and this one has just been shown to declare it too.
-    category: install.skill.categoryId,
-    author: skillAuthor(install.skill.repo),
-    path: `${LOCAL_SKILLS_PATH}/${install.id}/`,
-    conflictsWith: [],
-    requires: [],
-    alternatives: [],
-    discourages: [],
-    // Local and custom for the same reason: the bytes are on this machine and nowhere else, and
-    // the skill was authored outside the vocabulary this catalogue ships.
-    local: true,
-    custom: true,
-    localPath: install.skillDir
-  };
-}
-function seatExternalSkill({ id, skill, entry }, matrix, projectDir) {
-  const domain = getCategoryDomain(skill.categoryId);
-  if (domain === void 0) return [];
-  const install = {
-    id,
-    skill,
-    domain,
-    scope: entry.scope,
-    skillDir: externalSkillDir(id, entry.scope, projectDir)
-  };
-  matrix.skills[id] = externalCatalogueEntry(install);
-  claimSlug(matrix.slugMap, externalSlug(id), id);
-  return [install];
-}
-function registerExternalSkills(payload, matrix, projectDir) {
-  const externals = selectedExternals(payload);
-  const asPlugin = askedForAsPlugin(externals);
-  const colliding = claimingACatalogueId(externals, matrix);
-  if (asPlugin.length > 0) throw new Error(pluginInstallError(asPlugin));
-  if (colliding.length > 0) throw new Error(catalogueIdCollisionError(colliding));
-  return externals.flatMap((external) => seatExternalSkill(external, matrix, projectDir));
-}
-async function writeExternalSkills(installs) {
-  await refuseUncarriedDestinations(installs);
-  for (const install of installs) {
-    await writeSkillTree(install);
-    await writeSkillManifest(install);
-    await registerSkillOnDisk(install);
-  }
-}
-async function refuseUncarriedDestinations(installs) {
-  const judged = await Promise.all(installs.map(judgeDestination));
-  const blocked = judged.filter((destination) => destination !== null);
-  if (blocked.length > 0) throw new Error(uncarriedDestinationError(blocked));
-}
-async function judgeDestination(install) {
-  const { id, skillDir } = install;
-  if (!await directoryExists(skillDir)) return null;
-  if ((await readForkedFromMetadata(skillDir))?.path !== void 0) return null;
-  return { id, skillDir };
-}
-function uncarriedDestinationError(blocked) {
-  return [
-    "This configuration cannot be installed: these skills travel inside it under ids this installation already keeps a skill directory for, and no shared configuration put those directories there:",
-    ...blocked.map(({ id, skillDir }) => `  ${id}  ->  ${skillDir}`),
-    "A skill id is the directory the skill installs into, so each would be written over a skill written here by hand or ejected from a marketplace. Move or rename the directory above, or re-share the configuration with each skill added again, which mints an id \u2014 'external-<category>-<name>' \u2014 that nothing here holds."
-  ].join("\n");
-}
-async function writeSkillTree(install) {
-  for (const [relativePath, contents] of Object.entries(install.skill.files)) {
-    const filePath = path.join(install.skillDir, relativePath);
-    validateSkillPath(filePath, install.skillDir, relativePath);
-    await writeFile(filePath, contents);
-  }
-}
-var FRONTMATTER_BLOCK = /^---\r?\n([\s\S]*?)\r?\n---/;
-var NAME_FIELD = /^name:.*$/m;
-function withInstalledName(manifest, install) {
-  const named = `name: ${install.id}`;
-  const block = FRONTMATTER_BLOCK.exec(manifest);
-  if (!block) {
-    return `---
-${named}
-description: ${install.skill.description}
----
-
-${manifest}`;
-  }
-  const [whole, fields = ""] = block;
-  const renamed = NAME_FIELD.test(fields) ? fields.replace(NAME_FIELD, named) : `${named}
-${fields}`;
-  return `---
-${renamed}
----${manifest.slice(whole.length)}`;
-}
-async function writeSkillManifest(install) {
-  const manifestPath = path.join(install.skillDir, STANDARD_FILES.SKILL_MD);
-  await writeFile(manifestPath, withInstalledName(await readFile(manifestPath), install));
-}
-function externalSkillMetadata(install, shipped) {
-  return {
-    author: skillAuthor(install.skill.repo),
-    usageGuidance: defaultUsageGuidance(install.skill.categoryId),
-    ...shipped,
-    displayName: install.skill.displayName,
-    slug: install.id,
-    category: install.skill.categoryId,
-    domain: install.domain,
-    cliDescription: install.skill.description,
-    custom: true
-  };
-}
-async function registerSkillOnDisk(install) {
-  const metadataPath = path.join(install.skillDir, STANDARD_FILES.METADATA_YAML);
-  const shipped = await readLocalSkillMetadata(install.skillDir);
-  await writeMetadataYaml(metadataPath, externalSkillMetadata(install, shipped));
-  await injectForkedFromMetadata(
-    install.skillDir,
-    install.id,
-    await computeFileHash(path.join(install.skillDir, STANDARD_FILES.SKILL_MD)),
-    { source: repoRef(install.skill.repo), path: install.skill.path }
-  );
-}
-function unnameableRepoMessage(id) {
-  return `${id} travels inside a shared configuration, and this installation does not record the repository its content came from`;
-}
-function uncarryableContentMessage(id, reason) {
-  return `${id} travels inside a shared configuration, and ${reason}`;
-}
-function repoFromRef(ref) {
-  if (ref === void 0 || !ref.startsWith(GITHUB_SOURCE.GITHUB_PREFIX)) return void 0;
-  return ref.slice(GITHUB_SOURCE.GITHUB_PREFIX.length);
-}
-async function readSkillTree(skillDir) {
-  const files = await glob("**/*", skillDir, { dot: true });
-  const entries = await Promise.all(
-    files.map(async (file) => [file, await readFile(path.join(skillDir, file))])
-  );
-  return Object.fromEntries(entries);
-}
-async function readCarriedSkill({ id, skillDir, provenance }) {
-  if (provenance.path === void 0) return { carries: "nothing" };
-  const repo = repoFromRef(provenance.source);
-  if (repo === void 0) return { carries: "unshareable", line: unnameableRepoMessage(id) };
-  const described = await readSkillMetadata(path.join(skillDir, STANDARD_FILES.METADATA_YAML));
-  if (!described.usable) {
-    return { carries: "unshareable", line: uncarryableContentMessage(id, described.reason) };
-  }
-  const parsed = seedExternalSkillSchema.safeParse({
-    displayName: described.metadata.displayName,
-    description: described.metadata.cliDescription,
-    categoryId: described.metadata.category,
-    repo,
-    path: provenance.path,
-    files: await readSkillTree(skillDir)
-  });
-  if (!parsed.success) {
-    const reason = parsed.error.issues.map((issue) => issue.message).join("; ");
-    return { carries: "unshareable", line: uncarryableContentMessage(id, reason) };
-  }
-  return { carries: "content", id, skill: parsed.data };
-}
-async function readCarriedSkills(owned) {
-  const reads = await Promise.all(owned.map(readCarriedSkill));
-  return {
-    external: Object.fromEntries(
-      reads.flatMap((read) => read.carries === "content" ? [[read.id, read.skill]] : [])
-    ),
-    uncarryable: reads.flatMap((read) => read.carries === "unshareable" ? [read.line] : [])
-  };
-}
+} from "./chunk-ENGYJCTF.js";
 
 // ../../node_modules/hono/dist/utils/cookie.js
 var validCookieNameRegEx = /^[\w!#$%&'*.^`|~+-]+$/;
@@ -326,11 +80,11 @@ var serialize = (name, value, opt) => {
 };
 
 // ../../node_modules/hono/dist/client/utils.js
-var mergePath = (base, path2) => {
+var mergePath = (base, path) => {
   base = base.replace(/\/+$/, "");
   base = base + "/";
-  path2 = path2.replace(/^\/+/, "");
-  return base + path2;
+  path = path.replace(/^\/+/, "");
+  return base + path;
 };
 var replaceUrlParam = (urlString, params) => {
   for (const [k, v] of Object.entries(params)) {
@@ -389,18 +143,18 @@ function deepMerge(target, source) {
 }
 
 // ../../node_modules/hono/dist/client/client.js
-var createProxy = (callback, path2) => {
+var createProxy = (callback, path) => {
   const proxy = new Proxy(() => {
   }, {
     get(_obj, key) {
       if (typeof key !== "string" || key === "then") {
         return void 0;
       }
-      return createProxy(callback, [...path2, key]);
+      return createProxy(callback, [...path, key]);
     },
     apply(_1, _2, args) {
       return callback({
-        path: path2,
+        path,
         args
       });
     }
@@ -504,8 +258,8 @@ var hc = (baseUrl, options) => createProxy(function proxyCallback(opts) {
       method = last.replace(/^\$/, "");
     }
   }
-  const path2 = parts.join("/");
-  const url = mergePath(baseUrl, path2);
+  const path = parts.join("/");
+  const url = mergePath(baseUrl, path);
   if (method === "url" || method === "path") {
     let result = url;
     if (opts.args[0]) {
@@ -650,11 +404,8 @@ function explanationOf(body) {
 }
 
 export {
-  registerExternalSkills,
-  writeExternalSkills,
-  readCarriedSkills,
   SEED_API_URL,
   SEED_USER_AGENT,
   fetchSeedConfig
 };
-//# sourceMappingURL=chunk-X4SSJZLY.js.map
+//# sourceMappingURL=chunk-25MPBIK3.js.map

package/dist/chunk-25MPBIK3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../node_modules/hono/dist/utils/cookie.js","../../../node_modules/hono/dist/client/utils.js","../../../node_modules/hono/dist/client/client.js","../../api/src/client.ts","../src/cli/lib/seed/fetch-seed.ts"],"sourcesContent":["// src/utils/cookie.ts\nimport { decodeURIComponent_, tryDecode } from \"./url.js\";\nvar algorithm = { name: \"HMAC\", hash: \"SHA-256\" };\nvar getCryptoKey = async (secret) => {\n  const secretBuf = typeof secret === \"string\" ? new TextEncoder().encode(secret) : secret;\n  return await crypto.subtle.importKey(\"raw\", secretBuf, algorithm, false, [\"sign\", \"verify\"]);\n};\nvar makeSignature = async (value, secret) => {\n  const key = await getCryptoKey(secret);\n  const signature = await crypto.subtle.sign(algorithm.name, key, new TextEncoder().encode(value));\n  return btoa(String.fromCharCode(...new Uint8Array(signature)));\n};\nvar verifySignature = async (base64Signature, value, secret) => {\n  try {\n    const signatureBinStr = atob(base64Signature);\n    const signature = new Uint8Array(signatureBinStr.length);\n    for (let i = 0, len = signatureBinStr.length; i < len; i++) {\n      signature[i] = signatureBinStr.charCodeAt(i);\n    }\n    return await crypto.subtle.verify(algorithm, secret, signature, new TextEncoder().encode(value));\n  } catch {\n    return false;\n  }\n};\nvar validCookieNameRegEx = /^[\\w!#$%&'*.^`|~+-]+$/;\nvar relaxedCookieNameRegEx = /^[!#-:<>-[\\]-~]+$/;\nvar validCookieValueRegEx = /^[ !#-:<-[\\]-~]*$/;\nvar trimCookieWhitespace = (value) => {\n  let start = 0;\n  let end = value.length;\n  while (start < end) {\n    const charCode = value.charCodeAt(start);\n    if (charCode !== 32 && charCode !== 9) {\n      break;\n    }\n    start++;\n  }\n  while (end > start) {\n    const charCode = value.charCodeAt(end - 1);\n    if (charCode !== 32 && charCode !== 9) {\n      break;\n    }\n    end--;\n  }\n  return start === 0 && end === value.length ? value : value.slice(start, end);\n};\nvar parse = (cookie, name) => {\n  if (name && cookie.indexOf(name) === -1) {\n    return {};\n  }\n  const pairs = cookie.split(\";\");\n  const parsedCookie = /* @__PURE__ */ Object.create(null);\n  for (const pairStr of pairs) {\n    const valueStartPos = pairStr.indexOf(\"=\");\n    if (valueStartPos === -1) {\n      continue;\n    }\n    const cookieName = trimCookieWhitespace(pairStr.substring(0, valueStartPos));\n    if (name && name !== cookieName || !relaxedCookieNameRegEx.test(cookieName) || cookieName in parsedCookie) {\n      continue;\n    }\n    let cookieValue = trimCookieWhitespace(pairStr.substring(valueStartPos + 1));\n    if (cookieValue.startsWith('\"') && cookieValue.endsWith('\"')) {\n      cookieValue = cookieValue.slice(1, -1);\n    }\n    if (validCookieValueRegEx.test(cookieValue)) {\n      parsedCookie[cookieName] = cookieValue.indexOf(\"%\") !== -1 ? tryDecode(cookieValue, decodeURIComponent_) : cookieValue;\n      if (name) {\n        break;\n      }\n    }\n  }\n  return parsedCookie;\n};\nvar parseSigned = async (cookie, secret, name) => {\n  const parsedCookie = /* @__PURE__ */ Object.create(null);\n  const secretKey = await getCryptoKey(secret);\n  for (const [key, value] of Object.entries(parse(cookie, name))) {\n    const signatureStartPos = value.lastIndexOf(\".\");\n    if (signatureStartPos < 1) {\n      continue;\n    }\n    const signedValue = value.substring(0, signatureStartPos);\n    const signature = value.substring(signatureStartPos + 1);\n    if (signature.length !== 44 || !signature.endsWith(\"=\")) {\n      continue;\n    }\n    const isVerified = await verifySignature(signature, signedValue, secretKey);\n    parsedCookie[key] = isVerified ? signedValue : false;\n  }\n  return parsedCookie;\n};\nvar _serialize = (name, value, opt = {}) => {\n  if (!validCookieNameRegEx.test(name)) {\n    throw new Error(\"Invalid cookie name\");\n  }\n  let cookie = `${name}=${value}`;\n  if (name.startsWith(\"__Secure-\") && !opt.secure) {\n    throw new Error(\"__Secure- Cookie must have Secure attributes\");\n  }\n  if (name.startsWith(\"__Host-\")) {\n    if (!opt.secure) {\n      throw new Error(\"__Host- Cookie must have Secure attributes\");\n    }\n    if (opt.path !== \"/\") {\n      throw new Error('__Host- Cookie must have Path attributes with \"/\"');\n    }\n    if (opt.domain) {\n      throw new Error(\"__Host- Cookie must not have Domain attributes\");\n    }\n  }\n  for (const key of [\"domain\", \"path\", \"sameSite\", \"priority\"]) {\n    if (opt[key] && /[;\\r\\n]/.test(opt[key])) {\n      throw new Error(`${key} must not contain \";\", \"\\\\r\", or \"\\\\n\"`);\n    }\n  }\n  if (opt && typeof opt.maxAge === \"number\" && opt.maxAge >= 0) {\n    if (opt.maxAge > 3456e4) {\n      throw new Error(\n        \"Cookies Max-Age SHOULD NOT be greater than 400 days (34560000 seconds) in duration.\"\n      );\n    }\n    cookie += `; Max-Age=${opt.maxAge | 0}`;\n  }\n  if (opt.domain && opt.prefix !== \"host\") {\n    cookie += `; Domain=${opt.domain}`;\n  }\n  if (opt.path) {\n    cookie += `; Path=${opt.path}`;\n  }\n  if (opt.expires) {\n    if (opt.expires.getTime() - Date.now() > 3456e7) {\n      throw new Error(\n        \"Cookies Expires SHOULD NOT be greater than 400 days (34560000 seconds) in the future.\"\n      );\n    }\n    cookie += `; Expires=${opt.expires.toUTCString()}`;\n  }\n  if (opt.httpOnly) {\n    cookie += \"; HttpOnly\";\n  }\n  if (opt.secure) {\n    cookie += \"; Secure\";\n  }\n  if (opt.sameSite) {\n    cookie += `; SameSite=${opt.sameSite.charAt(0).toUpperCase() + opt.sameSite.slice(1)}`;\n  }\n  if (opt.priority) {\n    cookie += `; Priority=${opt.priority.charAt(0).toUpperCase() + opt.priority.slice(1)}`;\n  }\n  if (opt.partitioned) {\n    if (!opt.secure) {\n      throw new Error(\"Partitioned Cookie must have Secure attributes\");\n    }\n    cookie += \"; Partitioned\";\n  }\n  return cookie;\n};\nvar serialize = (name, value, opt) => {\n  value = encodeURIComponent(value);\n  return _serialize(name, value, opt);\n};\nvar serializeSigned = async (name, value, secret, opt = {}) => {\n  const signature = await makeSignature(value, secret);\n  value = `${value}.${signature}`;\n  value = encodeURIComponent(value);\n  return _serialize(name, value, opt);\n};\nexport {\n  parse,\n  parseSigned,\n  serialize,\n  serializeSigned\n};\n","// src/client/utils.ts\nimport { fetchRP, DetailedError } from \"./fetch-result-please.js\";\nvar mergePath = (base, path) => {\n  base = base.replace(/\\/+$/, \"\");\n  base = base + \"/\";\n  path = path.replace(/^\\/+/, \"\");\n  return base + path;\n};\nvar replaceUrlParam = (urlString, params) => {\n  for (const [k, v] of Object.entries(params)) {\n    const reg = new RegExp(\"/:\" + k + \"(?:{[^/]+})?\\\\??(?=/|$)\");\n    urlString = urlString.replace(reg, v ? `/${v}` : \"\");\n  }\n  return urlString;\n};\nvar buildSearchParams = (query) => {\n  const searchParams = new URLSearchParams();\n  for (const [k, v] of Object.entries(query)) {\n    if (v === void 0) {\n      continue;\n    }\n    if (Array.isArray(v)) {\n      for (const v2 of v) {\n        searchParams.append(k, v2);\n      }\n    } else {\n      searchParams.set(k, v);\n    }\n  }\n  return searchParams;\n};\nvar replaceUrlProtocol = (urlString, protocol) => {\n  switch (protocol) {\n    case \"ws\":\n      return urlString.replace(/^http/, \"ws\");\n    case \"http\":\n      return urlString.replace(/^ws/, \"http\");\n  }\n};\nvar removeIndexString = (urlString) => {\n  if (/^https?:\\/\\/[^\\/]+?\\/index(?=\\?|$)/.test(urlString)) {\n    return urlString.replace(/\\/index(?=\\?|$)/, \"/\");\n  }\n  return urlString.replace(/\\/index(?=\\?|$)/, \"\");\n};\nfunction isObject(item) {\n  return typeof item === \"object\" && item !== null && !Array.isArray(item);\n}\nfunction deepMerge(target, source) {\n  if (!isObject(target) && !isObject(source)) {\n    return source;\n  }\n  const merged = { ...target };\n  for (const key in source) {\n    const value = source[key];\n    if (isObject(merged[key]) && isObject(value)) {\n      merged[key] = deepMerge(merged[key], value);\n    } else {\n      merged[key] = value;\n    }\n  }\n  return merged;\n}\nasync function parseResponse(fetchRes) {\n  return fetchRP(fetchRes);\n}\nexport {\n  DetailedError,\n  buildSearchParams,\n  deepMerge,\n  mergePath,\n  parseResponse,\n  removeIndexString,\n  replaceUrlParam,\n  replaceUrlProtocol\n};\n","// src/client/client.ts\nimport { serialize } from \"../utils/cookie.js\";\nimport {\n  buildSearchParams,\n  deepMerge,\n  mergePath,\n  removeIndexString,\n  replaceUrlParam,\n  replaceUrlProtocol\n} from \"./utils.js\";\nvar createProxy = (callback, path) => {\n  const proxy = new Proxy(() => {\n  }, {\n    get(_obj, key) {\n      if (typeof key !== \"string\" || key === \"then\") {\n        return void 0;\n      }\n      return createProxy(callback, [...path, key]);\n    },\n    apply(_1, _2, args) {\n      return callback({\n        path,\n        args\n      });\n    }\n  });\n  return proxy;\n};\nvar ClientRequestImpl = class {\n  url;\n  method;\n  buildSearchParams;\n  queryParams = void 0;\n  pathParams = {};\n  rBody;\n  cType = void 0;\n  constructor(url, method, options) {\n    this.url = url;\n    this.method = method;\n    this.buildSearchParams = options.buildSearchParams;\n  }\n  fetch = async (args, opt) => {\n    if (args) {\n      if (args.query) {\n        this.queryParams = this.buildSearchParams(args.query);\n      }\n      if (args.form) {\n        const form = new FormData();\n        for (const [k, v] of Object.entries(args.form)) {\n          if (v === void 0) {\n            continue;\n          }\n          if (Array.isArray(v)) {\n            for (const v2 of v) {\n              form.append(k, v2);\n            }\n          } else {\n            form.append(k, v);\n          }\n        }\n        this.rBody = form;\n      }\n      if (args.json) {\n        this.rBody = JSON.stringify(args.json);\n        this.cType = \"application/json\";\n      }\n      if (args.param) {\n        this.pathParams = args.param;\n      }\n    }\n    let methodUpperCase = this.method.toUpperCase();\n    const headerValues = {\n      ...args?.header,\n      ...typeof opt?.headers === \"function\" ? await opt.headers() : opt?.headers\n    };\n    if (args?.cookie) {\n      const cookies = [];\n      for (const [key, value] of Object.entries(args.cookie)) {\n        cookies.push(serialize(key, value, { path: \"/\" }));\n      }\n      headerValues[\"Cookie\"] = cookies.join(\",\");\n    }\n    if (this.cType) {\n      headerValues[\"Content-Type\"] = this.cType;\n    }\n    const headers = new Headers(headerValues ?? void 0);\n    let url = this.url;\n    url = removeIndexString(url);\n    url = replaceUrlParam(url, this.pathParams);\n    if (this.queryParams) {\n      url = url + \"?\" + this.queryParams.toString();\n    }\n    methodUpperCase = this.method.toUpperCase();\n    const setBody = !(methodUpperCase === \"GET\" || methodUpperCase === \"HEAD\");\n    return (opt?.fetch || fetch)(url, {\n      body: setBody ? this.rBody : void 0,\n      method: methodUpperCase,\n      headers,\n      ...opt?.init\n    });\n  };\n};\nvar hc = (baseUrl, options) => createProxy(function proxyCallback(opts) {\n  const buildSearchParamsOption = options?.buildSearchParams ?? buildSearchParams;\n  const parts = [...opts.path];\n  const lastParts = parts.slice(-3).reverse();\n  if (lastParts[0] === \"toString\") {\n    if (lastParts[1] === \"name\") {\n      return lastParts[2] || \"\";\n    }\n    return proxyCallback.toString();\n  }\n  if (lastParts[0] === \"valueOf\") {\n    if (lastParts[1] === \"name\") {\n      return lastParts[2] || \"\";\n    }\n    return proxyCallback;\n  }\n  let method = \"\";\n  if (/^\\$/.test(lastParts[0])) {\n    const last = parts.pop();\n    if (last) {\n      method = last.replace(/^\\$/, \"\");\n    }\n  }\n  const path = parts.join(\"/\");\n  const url = mergePath(baseUrl, path);\n  if (method === \"url\" || method === \"path\") {\n    let result = url;\n    if (opts.args[0]) {\n      if (opts.args[0].param) {\n        result = replaceUrlParam(url, opts.args[0].param);\n      }\n      if (opts.args[0].query) {\n        result = result + \"?\" + buildSearchParamsOption(opts.args[0].query).toString();\n      }\n    }\n    result = removeIndexString(result);\n    if (method === \"url\") {\n      return new URL(result);\n    }\n    return result.slice(baseUrl.replace(/\\/+$/, \"\").length).replace(/^\\/?/, \"/\");\n  }\n  if (method === \"ws\") {\n    const webSocketUrl = replaceUrlProtocol(\n      opts.args[0] && opts.args[0].param ? replaceUrlParam(url, opts.args[0].param) : url,\n      \"ws\"\n    );\n    const targetUrl = new URL(webSocketUrl);\n    const queryParams = opts.args[0]?.query;\n    if (queryParams) {\n      Object.entries(queryParams).forEach(([key, value]) => {\n        if (Array.isArray(value)) {\n          value.forEach((item) => targetUrl.searchParams.append(key, item));\n        } else {\n          targetUrl.searchParams.set(key, value);\n        }\n      });\n    }\n    const establishWebSocket = (...args) => {\n      if (options?.webSocket !== void 0 && typeof options.webSocket === \"function\") {\n        return options.webSocket(...args);\n      }\n      return new WebSocket(...args);\n    };\n    return establishWebSocket(targetUrl.toString());\n  }\n  const req = new ClientRequestImpl(url, method, {\n    buildSearchParams: buildSearchParamsOption\n  });\n  if (method) {\n    options ??= {};\n    const reqOptions = { ...opts.args[1] };\n    const baseHeaders = options.headers;\n    const reqHeaders = reqOptions.headers;\n    if (baseHeaders && reqHeaders) {\n      reqOptions.headers = async () => ({\n        ...typeof baseHeaders === \"function\" ? await baseHeaders() : baseHeaders,\n        ...typeof reqHeaders === \"function\" ? await reqHeaders() : reqHeaders\n      });\n    }\n    const args = deepMerge(options, reqOptions);\n    return req.fetch(opts.args[0], args);\n  }\n  return req;\n}, []);\nexport {\n  hc\n};\n","import { hc } from \"hono/client\"\n\nimport type { AppType } from \"server\"\n\n/**\n * The typed client both front doors reach the worker through.\n *\n * The editor and the CLI shared nothing before this package existed: the\n * editor configured `hc<AppType>` and the CLI hand-wrote a `fetch` at a URL it\n * built itself, so the two agreed about the worker's routes only by\n * coincidence. What they genuinely differ in is small and finite — where the\n * worker is, whether a session cookie rides along, and what identifies the\n * caller — so those are the parameters and everything else is shared.\n *\n * What this package deliberately does NOT own is either consumer's refusal\n * copy. The editor turns a failure into a union member a component renders;\n * the CLI turns one into a sentence a person reads in a terminal. Those are\n * different artefacts for different readers, and a shared \"message\" would be\n * wrong for both.\n *\n * `AppType` is a type and nothing else. `import type` erases before any\n * bundler sees it, so no worker code is reachable from the editor's bundle\n * (which fails its build on a first-paint budget) or from the CLI's.\n */\n\n/**\n * Whether the browser's session cookie rides along.\n *\n * Only the two values either consumer has a use for, rather than the full\n * `RequestCredentials`: `same-origin` is exactly the setting that breaks the\n * editor, because the cookie is set on `.agentsinc.sh` by a different origin\n * than the one the app is served from, and naming it here would make it\n * reachable by a typo.\n */\nexport type ApiCredentials = \"include\" | \"omit\"\n\n/**\n * What every request carries, however it is sent.\n *\n * `credentials` defaults to `\"include\"` and that direction is the point. The\n * session cookie is set by a different origin on the same registrable domain,\n * and without it sign-in appears to work and the very next request is\n * anonymous — with nothing logged on either side. A policy that has to be\n * opted INTO is one a new call site can forget silently; this one has to be\n * opted out of by name, which is a thing a reader can see.\n */\nexport type ApiRequestPolicy = {\n  headers?: Record<string, string>\n  credentials?: ApiCredentials\n}\n\nexport type ApiClientOptions = ApiRequestPolicy & {\n  /** Where the worker is. No default: a wrong guess is a silent wrong API. */\n  baseUrl: string\n  /**\n   * The seam tests reach through. hc calls\n   * `(opt?.fetch || fetch)(url, { body, method, headers, ...opt?.init })`, so\n   * injecting one is the only way to observe what this package produces without\n   * a network — and the exact shape matters, because `init` is spread LAST.\n   * That is why `headers` goes through hc's own option rather than through\n   * `init`: in `init` it would replace the whole `Headers` object, including\n   * the content type hc sets for a JSON body.\n   */\n  fetch?: typeof globalThis.fetch\n}\n\ntype ResolvedPolicy = {\n  headers: Record<string, string>\n  credentials: ApiCredentials\n}\n\n/**\n * The one place the defaults are applied, so the typed client and any\n * hand-written fetch cannot drift about what a request carries.\n */\nconst resolvePolicy = ({\n  headers = {},\n  credentials = \"include\",\n}: ApiRequestPolicy): ResolvedPolicy => ({ headers, credentials })\n\n/**\n * The policy as a `RequestInit`, for the paths `AppType` does not describe.\n *\n * Better Auth mounts its own surface under `/api/auth/*` with a single\n * handler rather than a described route, so there is nothing there for `hc` to\n * type — and a hand-written fetch at those paths is how the editor signs a\n * person in. This is what keeps that call on the same session policy as the\n * typed ones instead of on a second copy of it.\n *\n * Spread it LAST over a caller's own init: a caller may add a method, a body\n * or headers of its own, and may not drop the cookie.\n */\nexport const apiRequestInit = (policy: ApiRequestPolicy): RequestInit =>\n  resolvePolicy(policy)\n\n/**\n * Builds the client for one consumer's base URL, headers and session policy.\n *\n * The two configured values go to different places in hc's options, and which\n * goes where is load-bearing. hc spreads `init` LAST over the request it\n * built, so anything named there replaces what hc put in that field — a\n * `headers` in `init` would replace the whole `Headers` object, including the\n * `Content-Type: application/json` hc sets for a `$post({ json })`. Headers go\n * through hc's own `headers` option, which is merged into that object instead,\n * and `init` names `credentials` and nothing else.\n */\nexport const createApiClient = ({\n  baseUrl,\n  fetch,\n  ...policy\n}: ApiClientOptions) => {\n  const { headers, credentials } = resolvePolicy(policy)\n\n  return hc<AppType>(baseUrl, {\n    headers,\n    init: { credentials },\n    // Spread rather than named. Under `exactOptionalPropertyTypes` hc's\n    // optional `fetch` does not accept an explicit `undefined`, so writing\n    // `fetch,` here is a TS2379 whenever a caller omits one.\n    ...(fetch && { fetch }),\n  })\n}\n\n/** The configured client, for consumers that pass one around. */\nexport type ApiClient = ReturnType<typeof createApiClient>\n","import { createApiClient } from \"@workspace/api\";\nimport { seedPayloadSchema, type SeedPayload } from \"@workspace/matrix/seed\";\n\nimport { truncateText } from \"../../utils/string.js\";\n\n/** The config store behind agentsinc.sh. Overridable so tests never touch the network. */\nexport const SEED_API_URL = process.env.AGENTS_INC_API_URL ?? \"https://api.agentsinc.sh\";\n\n/**\n * Identifies this fetch as the CLI rather than a browser.\n *\n * `GET /configs/:id` is the only place either side can observe a config being *installed* rather\n * than merely built, and the worker can only separate that from someone opening a share link if\n * we say so. Without this the conversion signal does not exist.\n */\nexport const SEED_USER_AGENT = \"agents-inc-cli\";\n\n/**\n * The worker's routes, typed from the worker itself, configured for a terminal.\n *\n * `credentials: \"omit\"` is named rather than left to the shared default. The default is `include`\n * because the editor's session is a cookie the browser holds; a terminal holds no cookie jar at\n * all, so inheriting that default would claim a session that cannot exist.\n *\n * Built once at module scope, like `SEED_API_URL` above and for the same reason — the base URL is\n * read from the environment once at import, so there is nothing per-call for a client to pick up.\n */\nconst store = createApiClient({\n  baseUrl: SEED_API_URL,\n  headers: { accept: \"application/json\", \"user-agent\": SEED_USER_AGENT },\n  credentials: \"omit\",\n});\n\n/**\n * How much of the store's account of a refused read to quote back.\n *\n * Sized on what this route really says, which is one short line per refusal: `Stored config is\n * unreadable` and `Could not read this config` are both under thirty characters. This holds the\n * longer of them four times over — room for that sentence to grow into a real one, and none for\n * anything that has stopped being a sentence.\n *\n * Far short of the 300-character `EXPLANATION_BUDGET` in `publish-seed.ts`, and for the reason\n * that one gives for its own size rather than in spite of it: a budget is sized on what the store\n * really writes there, and what it writes there is a list of schema issues naming a skill and a\n * sub-agent apiece. Neither number is a policy about terminals; each is a measurement of one\n * route.\n */\nconst EXPLANATION_BUDGET = 120;\n\n/** The content type the store's own refusals arrive as, and the only one worth reading. */\nconst QUOTABLE_TYPE = \"text/plain\";\n\n/** The status the store spends on an id it has never held, which is the one it is asked for. */\nconst NO_SUCH_CONFIG = 404;\n\nexport type FetchSeedResult = { ok: true; payload: SeedPayload } | { ok: false; error: string };\n\n/**\n * Fetches and validates a shared configuration.\n *\n * Every failure is a message rather than a throw: this runs before anything has been written, so\n * there is nothing to roll back and the caller's job is to explain rather than recover.\n */\nexport async function fetchSeedConfig(id: string): Promise<FetchSeedResult> {\n  let response: Response;\n  try {\n    // Escaped here rather than by the client: hono's `replaceUrlParam` substitutes a path\n    // parameter verbatim, so an id carrying a `/` or a `?` would silently address another route.\n    response = await store.configs[\":id\"].$get({ param: { id: encodeURIComponent(id) } });\n  } catch {\n    return { ok: false, error: `Could not reach ${SEED_API_URL} — check your connection.` };\n  }\n\n  // Ahead of the quoting arm below, and the only status held out of it. The store answers this\n  // one `No config under this id`, which says strictly less than the sentence here does — it does\n  // not name the id the caller typed, and that is the whole of what a person needs to see.\n  if (response.status === NO_SUCH_CONFIG) {\n    return { ok: false, error: `No configuration found for id '${id}'.` };\n  }\n  if (!response.ok) {\n    return { ok: false, error: await refusalMessage(response) };\n  }\n\n  let body: unknown;\n  try {\n    body = await response.json();\n  } catch {\n    return { ok: false, error: \"The configuration store returned something that is not JSON.\" };\n  }\n\n  const parsed = seedPayloadSchema.safeParse(body);\n  if (!parsed.success) {\n    // Names the remedy rather than a cause it cannot observe. The payload was validated by the\n    // store on the way IN, so a stored payload that no longer parses means the contract moved\n    // underneath it — and every way that happens lands in this one `safeParse`: an id minted\n    // before a version bump, an id minted after one, and a body that is simply broken. The CLI\n    // cannot tell them apart, and the one thing true of all three is that re-sharing fixes it,\n    // because the store content-addresses an id and a fresh share mints one under this version.\n    return {\n      ok: false,\n      error: `Configuration '${id}' is not in a format this version of the CLI can install. Shared ids are never migrated — re-share the configuration to mint a current one, or update the CLI if that id came from a newer version.`,\n    };\n  }\n\n  return { ok: true, payload: parsed.data };\n}\n\n/**\n * A refusal, carrying the store's own account of it wherever there is one to have.\n *\n * The same posture `refusalMessage` in `publish-seed.ts` takes on the write side, and deliberately\n * NOT the same mechanism. That route's 400 arrives as a `@hono/zod-validator` envelope with the\n * refused issues rendered inside it; `getConfig` writes every one of its refusals with `c.text`,\n * so there is no envelope here to parse and a copy of that parser would find nothing in any body\n * this route can produce.\n *\n * The status is never given up. It is what separates a store that is present and holding bytes it\n * can no longer read (500) from one that would not answer at all (503) — and what the body then\n * adds is the store saying which of its own failures this was, in words the status has no room\n * for.\n */\nasync function refusalMessage(response: Response): Promise<string> {\n  const refused = `Fetching configuration failed (HTTP ${response.status}).`;\n  const explanation = explanationOf(await refusalBody(response));\n\n  return explanation === undefined ? refused : `${refused} The store said: ${explanation}`;\n}\n\n/**\n * Whatever the store sent, as far as it can be read — and only where it was the store that sent it.\n *\n * Nothing below this line is worth failing over: the message being assembled is already a failure,\n * and a body that cannot be read is one more thing the status will have to cover on its own.\n * Draining the stream can throw in its own right — a connection dropped mid-body — which is why\n * the `try` is around the read.\n */\nasync function refusalBody(response: Response): Promise<string | undefined> {\n  if (!arrivedAsText(response)) return undefined;\n\n  try {\n    return await response.text();\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Whether what arrived is the store speaking, as far as the wire says it is.\n *\n * `getConfig` writes every refusal with `c.text(...)`, so `text/plain` is the shape the store's\n * own words take on this route. What arrives as anything else did not come from it: a proxy, a\n * WAF, a captive portal or a gateway answering in its place — and their answer is markup rather\n * than prose, which quoted into a terminal is a screenful of tags that explains nothing and buries\n * the status that does.\n *\n * This is the plain-text half of what `refusalSchema` does for `publish-seed.ts`. That side has a\n * SHAPE a foreign body fails to be; a sentence has no shape, so the wire's own statement of what\n * it sent is the only discriminator there is. It is not proof — a hostile answer may claim any\n * type it likes — which is what {@link EXPLANATION_BUDGET} is for, and why what survives both is\n * attributed to the store rather than spoken in the CLI's own voice.\n */\nfunction arrivedAsText(response: Response): boolean {\n  return (response.headers.get(\"content-type\") ?? \"\").startsWith(QUOTABLE_TYPE);\n}\n\n/** The store's account of a refusal, where what came back really is one. */\nfunction explanationOf(body: string | undefined): string | undefined {\n  if (body === undefined) return undefined;\n\n  const said = body.trim();\n  if (said === \"\") return undefined;\n\n  return truncateText(said, EXPLANATION_BUDGET);\n}\n"],"mappings":";;;;;;;;;AAwBA,IAAI,uBAAuB;AAoE3B,IAAI,aAAa,CAAC,MAAM,OAAO,MAAM,CAAC,MAAM;AAC1C,MAAI,CAAC,qBAAqB,KAAK,IAAI,GAAG;AACpC,UAAM,IAAI,MAAM,qBAAqB;AAAA,EACvC;AACA,MAAI,SAAS,GAAG,IAAI,IAAI,KAAK;AAC7B,MAAI,KAAK,WAAW,WAAW,KAAK,CAAC,IAAI,QAAQ;AAC/C,UAAM,IAAI,MAAM,8CAA8C;AAAA,EAChE;AACA,MAAI,KAAK,WAAW,SAAS,GAAG;AAC9B,QAAI,CAAC,IAAI,QAAQ;AACf,YAAM,IAAI,MAAM,4CAA4C;AAAA,IAC9D;AACA,QAAI,IAAI,SAAS,KAAK;AACpB,YAAM,IAAI,MAAM,mDAAmD;AAAA,IACrE;AACA,QAAI,IAAI,QAAQ;AACd,YAAM,IAAI,MAAM,gDAAgD;AAAA,IAClE;AAAA,EACF;AACA,aAAW,OAAO,CAAC,UAAU,QAAQ,YAAY,UAAU,GAAG;AAC5D,QAAI,IAAI,GAAG,KAAK,UAAU,KAAK,IAAI,GAAG,CAAC,GAAG;AACxC,YAAM,IAAI,MAAM,GAAG,GAAG,wCAAwC;AAAA,IAChE;AAAA,EACF;AACA,MAAI,OAAO,OAAO,IAAI,WAAW,YAAY,IAAI,UAAU,GAAG;AAC5D,QAAI,IAAI,SAAS,QAAQ;AACvB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,cAAU,aAAa,IAAI,SAAS,CAAC;AAAA,EACvC;AACA,MAAI,IAAI,UAAU,IAAI,WAAW,QAAQ;AACvC,cAAU,YAAY,IAAI,MAAM;AAAA,EAClC;AACA,MAAI,IAAI,MAAM;AACZ,cAAU,UAAU,IAAI,IAAI;AAAA,EAC9B;AACA,MAAI,IAAI,SAAS;AACf,QAAI,IAAI,QAAQ,QAAQ,IAAI,KAAK,IAAI,IAAI,QAAQ;AAC/C,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,cAAU,aAAa,IAAI,QAAQ,YAAY,CAAC;AAAA,EAClD;AACA,MAAI,IAAI,UAAU;AAChB,cAAU;AAAA,EACZ;AACA,MAAI,IAAI,QAAQ;AACd,cAAU;AAAA,EACZ;AACA,MAAI,IAAI,UAAU;AAChB,cAAU,cAAc,IAAI,SAAS,OAAO,CAAC,EAAE,YAAY,IAAI,IAAI,SAAS,MAAM,CAAC,CAAC;AAAA,EACtF;AACA,MAAI,IAAI,UAAU;AAChB,cAAU,cAAc,IAAI,SAAS,OAAO,CAAC,EAAE,YAAY,IAAI,IAAI,SAAS,MAAM,CAAC,CAAC;AAAA,EACtF;AACA,MAAI,IAAI,aAAa;AACnB,QAAI,CAAC,IAAI,QAAQ;AACf,YAAM,IAAI,MAAM,gDAAgD;AAAA,IAClE;AACA,cAAU;AAAA,EACZ;AACA,SAAO;AACT;AACA,IAAI,YAAY,CAAC,MAAM,OAAO,QAAQ;AACpC,UAAQ,mBAAmB,KAAK;AAChC,SAAO,WAAW,MAAM,OAAO,GAAG;AACpC;;;AC/JA,IAAI,YAAY,CAAC,MAAM,SAAS;AAC9B,SAAO,KAAK,QAAQ,QAAQ,EAAE;AAC9B,SAAO,OAAO;AACd,SAAO,KAAK,QAAQ,QAAQ,EAAE;AAC9B,SAAO,OAAO;AAChB;AACA,IAAI,kBAAkB,CAAC,WAAW,WAAW;AAC3C,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,MAAM,GAAG;AAC3C,UAAM,MAAM,IAAI,OAAO,OAAO,IAAI,yBAAyB;AAC3D,gBAAY,UAAU,QAAQ,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE;AAAA,EACrD;AACA,SAAO;AACT;AACA,IAAI,oBAAoB,CAAC,UAAU;AACjC,QAAM,eAAe,IAAI,gBAAgB;AACzC,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAK,GAAG;AAC1C,QAAI,MAAM,QAAQ;AAChB;AAAA,IACF;AACA,QAAI,MAAM,QAAQ,CAAC,GAAG;AACpB,iBAAW,MAAM,GAAG;AAClB,qBAAa,OAAO,GAAG,EAAE;AAAA,MAC3B;AAAA,IACF,OAAO;AACL,mBAAa,IAAI,GAAG,CAAC;AAAA,IACvB;AAAA,EACF;AACA,SAAO;AACT;AACA,IAAI,qBAAqB,CAAC,WAAW,aAAa;AAChD,UAAQ,UAAU;AAAA,IAChB,KAAK;AACH,aAAO,UAAU,QAAQ,SAAS,IAAI;AAAA,IACxC,KAAK;AACH,aAAO,UAAU,QAAQ,OAAO,MAAM;AAAA,EAC1C;AACF;AACA,IAAI,oBAAoB,CAAC,cAAc;AACrC,MAAI,qCAAqC,KAAK,SAAS,GAAG;AACxD,WAAO,UAAU,QAAQ,mBAAmB,GAAG;AAAA,EACjD;AACA,SAAO,UAAU,QAAQ,mBAAmB,EAAE;AAChD;AACA,SAAS,SAAS,MAAM;AACtB,SAAO,OAAO,SAAS,YAAY,SAAS,QAAQ,CAAC,MAAM,QAAQ,IAAI;AACzE;AACA,SAAS,UAAU,QAAQ,QAAQ;AACjC,MAAI,CAAC,SAAS,MAAM,KAAK,CAAC,SAAS,MAAM,GAAG;AAC1C,WAAO;AAAA,EACT;AACA,QAAM,SAAS,EAAE,GAAG,OAAO;AAC3B,aAAW,OAAO,QAAQ;AACxB,UAAM,QAAQ,OAAO,GAAG;AACxB,QAAI,SAAS,OAAO,GAAG,CAAC,KAAK,SAAS,KAAK,GAAG;AAC5C,aAAO,GAAG,IAAI,UAAU,OAAO,GAAG,GAAG,KAAK;AAAA,IAC5C,OAAO;AACL,aAAO,GAAG,IAAI;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;;;ACpDA,IAAI,cAAc,CAAC,UAAU,SAAS;AACpC,QAAM,QAAQ,IAAI,MAAM,MAAM;AAAA,EAC9B,GAAG;AAAA,IACD,IAAI,MAAM,KAAK;AACb,UAAI,OAAO,QAAQ,YAAY,QAAQ,QAAQ;AAC7C,eAAO;AAAA,MACT;AACA,aAAO,YAAY,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC;AAAA,IAC7C;AAAA,IACA,MAAM,IAAI,IAAI,MAAM;AAClB,aAAO,SAAS;AAAA,QACd;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACD,SAAO;AACT;AACA,IAAI,oBAAoB,MAAM;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA,cAAc;AAAA,EACd,aAAa,CAAC;AAAA,EACd;AAAA,EACA,QAAQ;AAAA,EACR,YAAY,KAAK,QAAQ,SAAS;AAChC,SAAK,MAAM;AACX,SAAK,SAAS;AACd,SAAK,oBAAoB,QAAQ;AAAA,EACnC;AAAA,EACA,QAAQ,OAAO,MAAM,QAAQ;AAC3B,QAAI,MAAM;AACR,UAAI,KAAK,OAAO;AACd,aAAK,cAAc,KAAK,kBAAkB,KAAK,KAAK;AAAA,MACtD;AACA,UAAI,KAAK,MAAM;AACb,cAAM,OAAO,IAAI,SAAS;AAC1B,mBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAK,IAAI,GAAG;AAC9C,cAAI,MAAM,QAAQ;AAChB;AAAA,UACF;AACA,cAAI,MAAM,QAAQ,CAAC,GAAG;AACpB,uBAAW,MAAM,GAAG;AAClB,mBAAK,OAAO,GAAG,EAAE;AAAA,YACnB;AAAA,UACF,OAAO;AACL,iBAAK,OAAO,GAAG,CAAC;AAAA,UAClB;AAAA,QACF;AACA,aAAK,QAAQ;AAAA,MACf;AACA,UAAI,KAAK,MAAM;AACb,aAAK,QAAQ,KAAK,UAAU,KAAK,IAAI;AACrC,aAAK,QAAQ;AAAA,MACf;AACA,UAAI,KAAK,OAAO;AACd,aAAK,aAAa,KAAK;AAAA,MACzB;AAAA,IACF;AACA,QAAI,kBAAkB,KAAK,OAAO,YAAY;AAC9C,UAAM,eAAe;AAAA,MACnB,GAAG,MAAM;AAAA,MACT,GAAG,OAAO,KAAK,YAAY,aAAa,MAAM,IAAI,QAAQ,IAAI,KAAK;AAAA,IACrE;AACA,QAAI,MAAM,QAAQ;AAChB,YAAM,UAAU,CAAC;AACjB,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,MAAM,GAAG;AACtD,gBAAQ,KAAK,UAAU,KAAK,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC;AAAA,MACnD;AACA,mBAAa,QAAQ,IAAI,QAAQ,KAAK,GAAG;AAAA,IAC3C;AACA,QAAI,KAAK,OAAO;AACd,mBAAa,cAAc,IAAI,KAAK;AAAA,IACtC;AACA,UAAM,UAAU,IAAI,QAAQ,gBAAgB,MAAM;AAClD,QAAI,MAAM,KAAK;AACf,UAAM,kBAAkB,GAAG;AAC3B,UAAM,gBAAgB,KAAK,KAAK,UAAU;AAC1C,QAAI,KAAK,aAAa;AACpB,YAAM,MAAM,MAAM,KAAK,YAAY,SAAS;AAAA,IAC9C;AACA,sBAAkB,KAAK,OAAO,YAAY;AAC1C,UAAM,UAAU,EAAE,oBAAoB,SAAS,oBAAoB;AACnE,YAAQ,KAAK,SAAS,OAAO,KAAK;AAAA,MAChC,MAAM,UAAU,KAAK,QAAQ;AAAA,MAC7B,QAAQ;AAAA,MACR;AAAA,MACA,GAAG,KAAK;AAAA,IACV,CAAC;AAAA,EACH;AACF;AACA,IAAI,KAAK,CAAC,SAAS,YAAY,YAAY,SAAS,cAAc,MAAM;AACtE,QAAM,0BAA0B,SAAS,qBAAqB;AAC9D,QAAM,QAAQ,CAAC,GAAG,KAAK,IAAI;AAC3B,QAAM,YAAY,MAAM,MAAM,EAAE,EAAE,QAAQ;AAC1C,MAAI,UAAU,CAAC,MAAM,YAAY;AAC/B,QAAI,UAAU,CAAC,MAAM,QAAQ;AAC3B,aAAO,UAAU,CAAC,KAAK;AAAA,IACzB;AACA,WAAO,cAAc,SAAS;AAAA,EAChC;AACA,MAAI,UAAU,CAAC,MAAM,WAAW;AAC9B,QAAI,UAAU,CAAC,MAAM,QAAQ;AAC3B,aAAO,UAAU,CAAC,KAAK;AAAA,IACzB;AACA,WAAO;AAAA,EACT;AACA,MAAI,SAAS;AACb,MAAI,MAAM,KAAK,UAAU,CAAC,CAAC,GAAG;AAC5B,UAAM,OAAO,MAAM,IAAI;AACvB,QAAI,MAAM;AACR,eAAS,KAAK,QAAQ,OAAO,EAAE;AAAA,IACjC;AAAA,EACF;AACA,QAAM,OAAO,MAAM,KAAK,GAAG;AAC3B,QAAM,MAAM,UAAU,SAAS,IAAI;AACnC,MAAI,WAAW,SAAS,WAAW,QAAQ;AACzC,QAAI,SAAS;AACb,QAAI,KAAK,KAAK,CAAC,GAAG;AAChB,UAAI,KAAK,KAAK,CAAC,EAAE,OAAO;AACtB,iBAAS,gBAAgB,KAAK,KAAK,KAAK,CAAC,EAAE,KAAK;AAAA,MAClD;AACA,UAAI,KAAK,KAAK,CAAC,EAAE,OAAO;AACtB,iBAAS,SAAS,MAAM,wBAAwB,KAAK,KAAK,CAAC,EAAE,KAAK,EAAE,SAAS;AAAA,MAC/E;AAAA,IACF;AACA,aAAS,kBAAkB,MAAM;AACjC,QAAI,WAAW,OAAO;AACpB,aAAO,IAAI,IAAI,MAAM;AAAA,IACvB;AACA,WAAO,OAAO,MAAM,QAAQ,QAAQ,QAAQ,EAAE,EAAE,MAAM,EAAE,QAAQ,QAAQ,GAAG;AAAA,EAC7E;AACA,MAAI,WAAW,MAAM;AACnB,UAAM,eAAe;AAAA,MACnB,KAAK,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,EAAE,QAAQ,gBAAgB,KAAK,KAAK,KAAK,CAAC,EAAE,KAAK,IAAI;AAAA,MAChF;AAAA,IACF;AACA,UAAM,YAAY,IAAI,IAAI,YAAY;AACtC,UAAM,cAAc,KAAK,KAAK,CAAC,GAAG;AAClC,QAAI,aAAa;AACf,aAAO,QAAQ,WAAW,EAAE,QAAQ,CAAC,CAAC,KAAK,KAAK,MAAM;AACpD,YAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,gBAAM,QAAQ,CAAC,SAAS,UAAU,aAAa,OAAO,KAAK,IAAI,CAAC;AAAA,QAClE,OAAO;AACL,oBAAU,aAAa,IAAI,KAAK,KAAK;AAAA,QACvC;AAAA,MACF,CAAC;AAAA,IACH;AACA,UAAM,qBAAqB,IAAI,SAAS;AACtC,UAAI,SAAS,cAAc,UAAU,OAAO,QAAQ,cAAc,YAAY;AAC5E,eAAO,QAAQ,UAAU,GAAG,IAAI;AAAA,MAClC;AACA,aAAO,IAAI,UAAU,GAAG,IAAI;AAAA,IAC9B;AACA,WAAO,mBAAmB,UAAU,SAAS,CAAC;AAAA,EAChD;AACA,QAAM,MAAM,IAAI,kBAAkB,KAAK,QAAQ;AAAA,IAC7C,mBAAmB;AAAA,EACrB,CAAC;AACD,MAAI,QAAQ;AACV,gBAAY,CAAC;AACb,UAAM,aAAa,EAAE,GAAG,KAAK,KAAK,CAAC,EAAE;AACrC,UAAM,cAAc,QAAQ;AAC5B,UAAM,aAAa,WAAW;AAC9B,QAAI,eAAe,YAAY;AAC7B,iBAAW,UAAU,aAAa;AAAA,QAChC,GAAG,OAAO,gBAAgB,aAAa,MAAM,YAAY,IAAI;AAAA,QAC7D,GAAG,OAAO,eAAe,aAAa,MAAM,WAAW,IAAI;AAAA,MAC7D;AAAA,IACF;AACA,UAAM,OAAO,UAAU,SAAS,UAAU;AAC1C,WAAO,IAAI,MAAM,KAAK,KAAK,CAAC,GAAG,IAAI;AAAA,EACrC;AACA,SAAO;AACT,GAAG,CAAC,CAAC;;;AC9GL,IAAM,gBAAgB,CAAC;AAAA,EACrB,UAAU,CAAC;AAAA,EACX,cAAc;AAChB,OAAyC,EAAE,SAAS,YAAY;AA4BzD,IAAM,kBAAkB,CAAC;AAAA,EAC9B;AAAA,EACA,OAAAA;AAAA,EACA,GAAG;AACL,MAAwB;AACtB,QAAM,EAAE,SAAS,YAAY,IAAI,cAAc,MAAM;AAErD,SAAO,GAAY,SAAS;AAAA,IAC1B;AAAA,IACA,MAAM,EAAE,YAAY;AAAA;AAAA;AAAA;AAAA,IAIpB,GAAIA,UAAS,EAAE,OAAAA,OAAM;AAAA,EACvB,CAAC;AACH;;;ACnHO,IAAM,eAAe,QAAQ,IAAI,sBAAsB;AASvD,IAAM,kBAAkB;AAY/B,IAAM,QAAQ,gBAAgB;AAAA,EAC5B,SAAS;AAAA,EACT,SAAS,EAAE,QAAQ,oBAAoB,cAAc,gBAAgB;AAAA,EACrE,aAAa;AACf,CAAC;AAgBD,IAAM,qBAAqB;AAG3B,IAAM,gBAAgB;AAGtB,IAAM,iBAAiB;AAUvB,eAAsB,gBAAgB,IAAsC;AAC1E,MAAI;AACJ,MAAI;AAGF,eAAW,MAAM,MAAM,QAAQ,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,mBAAmB,EAAE,EAAE,EAAE,CAAC;AAAA,EACtF,QAAQ;AACN,WAAO,EAAE,IAAI,OAAO,OAAO,mBAAmB,YAAY,iCAA4B;AAAA,EACxF;AAKA,MAAI,SAAS,WAAW,gBAAgB;AACtC,WAAO,EAAE,IAAI,OAAO,OAAO,kCAAkC,EAAE,KAAK;AAAA,EACtE;AACA,MAAI,CAAC,SAAS,IAAI;AAChB,WAAO,EAAE,IAAI,OAAO,OAAO,MAAM,eAAe,QAAQ,EAAE;AAAA,EAC5D;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,SAAS,KAAK;AAAA,EAC7B,QAAQ;AACN,WAAO,EAAE,IAAI,OAAO,OAAO,+DAA+D;AAAA,EAC5F;AAEA,QAAM,SAAS,kBAAkB,UAAU,IAAI;AAC/C,MAAI,CAAC,OAAO,SAAS;AAOnB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,OAAO,kBAAkB,EAAE;AAAA,IAC7B;AAAA,EACF;AAEA,SAAO,EAAE,IAAI,MAAM,SAAS,OAAO,KAAK;AAC1C;AAgBA,eAAe,eAAe,UAAqC;AACjE,QAAM,UAAU,uCAAuC,SAAS,MAAM;AACtE,QAAM,cAAc,cAAc,MAAM,YAAY,QAAQ,CAAC;AAE7D,SAAO,gBAAgB,SAAY,UAAU,GAAG,OAAO,oBAAoB,WAAW;AACxF;AAUA,eAAe,YAAY,UAAiD;AAC1E,MAAI,CAAC,cAAc,QAAQ,EAAG,QAAO;AAErC,MAAI;AACF,WAAO,MAAM,SAAS,KAAK;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAiBA,SAAS,cAAc,UAA6B;AAClD,UAAQ,SAAS,QAAQ,IAAI,cAAc,KAAK,IAAI,WAAW,aAAa;AAC9E;AAGA,SAAS,cAAc,MAA8C;AACnE,MAAI,SAAS,OAAW,QAAO;AAE/B,QAAM,OAAO,KAAK,KAAK;AACvB,MAAI,SAAS,GAAI,QAAO;AAExB,SAAO,aAAa,MAAM,kBAAkB;AAC9C;","names":["fetch"]}

package/dist/{chunk-LT5GXEB2.js → chunk-2VUYFTUB.js}

@@ -1,26 +1,26 @@
 #!/usr/bin/env node
 import {
   ScrollAffordance
-} from "./chunk-6MV4JOCL.js";
+} from "./chunk-SAYZWCH6.js";
 import {
   getStackName
-} from "./chunk-4VL3CEOS.js";
+} from "./chunk-QHDPLLK6.js";
 import {
   useMeasuredHeight
 } from "./chunk-TSIU7DME.js";
 import {
   SkillAgentSummary
-} from "./chunk-B3Y3QMWI.js";
+} from "./chunk-MAWNVT2C.js";
 import {
   useWizardStore
-} from "./chunk-K5ITEA3I.js";
+} from "./chunk-7JNJ52CD.js";
 import {
   ALL_SKILLS_EJECTED_LABEL,
   CLI_COLORS,
   DEFAULT_PUBLIC_SOURCE_NAME,
   EJECT_SOURCE,
   formatSourceDisplayName
-} from "./chunk-UITEKY2R.js";
+} from "./chunk-ENGYJCTF.js";
 
 // src/cli/components/wizard/summary-panel.tsx
 import { Box, Text } from "ink";
@@ -95,8 +95,9 @@ var SummaryPanel = () => {
   const skillConfigs = useWizardStore((s) => s.skillConfigs);
   const agentConfigs = useWizardStore((s) => s.agentConfigs);
   const selectedStackId = useWizardStore((s) => s.selectedStackId);
+  const setupMarketplace = useWizardStore((s) => s.setupMarketplace);
   const { viewportRef, contentRef, contentMarginTop, hiddenAbove, hiddenBelow } = usePanelScroll();
-  const sourceNames = formatSkillMarketplaces(skillConfigs);
+  const sourceNames = setupMarketplace === null ? formatSkillMarketplaces(skillConfigs) : formatSourceDisplayName(setupMarketplace);
   const stackName = getStackName(selectedStackId);
   return /* @__PURE__ */ jsxs(
     Box,
@@ -121,4 +122,4 @@ var SummaryPanel = () => {
 export {
   SummaryPanel
 };
-//# sourceMappingURL=chunk-LT5GXEB2.js.map
+//# sourceMappingURL=chunk-2VUYFTUB.js.map

package/dist/chunk-2VUYFTUB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli/components/wizard/summary-panel.tsx","../src/cli/components/hooks/use-panel-scroll.ts"],"sourcesContent":["import { Box, Text } from \"ink\";\nimport React from \"react\";\nimport { unique } from \"remeda\";\nimport {\n  ALL_SKILLS_EJECTED_LABEL,\n  CLI_COLORS,\n  DEFAULT_PUBLIC_SOURCE_NAME,\n  EJECT_SOURCE,\n  formatSourceDisplayName,\n} from \"../../consts.js\";\nimport { useWizardStore } from \"../../stores/wizard-store.js\";\nimport type { SkillConfig } from \"../../types/config.js\";\nimport { usePanelScroll } from \"../hooks/use-panel-scroll.js\";\nimport { ScrollAffordance } from \"./scroll-affordance.js\";\nimport { SkillAgentSummary } from \"./skill-agent-summary.js\";\nimport { getStackName } from \"./utils.js\";\n\n/**\n * The Marketplace row's value: the distinct marketplaces the summarised skills come from.\n *\n * `SkillConfig.origin` is authoritative for where a skill came from, and holds exactly one\n * of two things: {@link EJECT_SOURCE}, meaning the files were copied locally, or the marketplace's\n * own name as its `marketplace.json` declares it — which is why a project initialised from a\n * different marketplace names that marketplace here without any extra plumbing.\n *\n * Three cases, and the two zero-marketplace ones are NOT the same state:\n * - **No skills at all.** Reachable — the `I` overlay opens from the stack step before anything is\n *   selected. Nothing is claimed yet, so the default public marketplace stands in.\n * - **Skills, but every one ejected.** \"eject\" names no marketplace, so there is none to list;\n *   naming the default would assert an origin none of those skills has.\n * - **Any marketplace-sourced skill.** Its marketplace is named. Ejected siblings contribute no\n *   name but do not suppress the ones that do.\n *\n * Tombstoned (`excluded`) entries count. One still records a real global install and the\n * marketplace it came from, and `computeScopeDiff` renders it as a row in the summary below, so\n * dropping it here would leave the header disowning a row it sits above.\n *\n * Sorted, so the row cannot reorder between renders on config iteration order alone.\n */\nfunction formatSkillMarketplaces(skillConfigs: SkillConfig[]): string {\n  if (skillConfigs.length === 0) return formatSourceDisplayName(DEFAULT_PUBLIC_SOURCE_NAME);\n\n  const marketplaceNames = unique(\n    skillConfigs.map((config) => config.origin).filter((origin) => origin !== EJECT_SOURCE),\n  );\n  if (marketplaceNames.length === 0) return ALL_SKILLS_EJECTED_LABEL;\n\n  return marketplaceNames\n    .map((name) => formatSourceDisplayName(name))\n    .sort()\n    .join(\" · \");\n}\n\ntype PanelHeaderProps = {\n  sourceNames: string;\n  stackName: string | undefined;\n};\n\n/**\n * Which marketplaces and which stack the summary below was built from.\n *\n * Rendered inside the scrolled content, so its `marginBottom` scrolls away\n * rather than permanently costing the viewport a row.\n *\n * `flexShrink={0}` is load-bearing: Ink defaults every box to `flexShrink: 1`,\n * so on a short terminal Yoga squeezes this block to fit instead of letting the\n * viewport clip it, and the Marketplace and Stack rows overprint into one\n * unreadable line. Clipping is the panel's job; the header must keep its height.\n */\nconst PanelHeader: React.FC<PanelHeaderProps> = ({ sourceNames, stackName }) => (\n  <Box\n    flexDirection=\"column\"\n    flexShrink={0}\n    borderStyle=\"single\"\n    borderBottom={true}\n    borderTop={false}\n    borderLeft={false}\n    borderRight={false}\n    borderColor={CLI_COLORS.NEUTRAL}\n    borderBottomDimColor\n    paddingBottom={1}\n    marginBottom={1}\n  >\n    <Box flexDirection=\"row\" columnGap={1}>\n      <Text color={CLI_COLORS.WARNING} bold>\n        Marketplace\n      </Text>\n      <Text color={CLI_COLORS.NEUTRAL}>{sourceNames}</Text>\n    </Box>\n    <Box flexDirection=\"row\" columnGap={1}>\n      <Text color={CLI_COLORS.WARNING} bold>\n        Stack\n      </Text>\n      <Text color={CLI_COLORS.NEUTRAL}>{stackName ?? \"none\"}</Text>\n    </Box>\n  </Box>\n);\n\n/**\n * Marketplace/stack header above a clipped, arrow-scrollable\n * `SkillAgentSummary` — the one panel both summary surfaces render: the `I`\n * overlay in `wizard-layout.tsx` and the confirm step.\n *\n * It owns the `↑`/`↓` keys through `usePanelScroll`. A host that needs other\n * keys adds its own `useInput` alongside it — `StepConfirm` claims `Enter` and\n * `Esc` that way.\n *\n * Horizontal padding only. Vertical padding is unshrinkable, so on a short\n * terminal it claims the last row the viewport has and the content measures 0\n * before it has ever been laid out — the panel then paints neither a summary\n * row nor the affordance that would say rows are missing.\n */\nexport const SummaryPanel: React.FC = () => {\n  const skillConfigs = useWizardStore((s) => s.skillConfigs);\n  const agentConfigs = useWizardStore((s) => s.agentConfigs);\n  const selectedStackId = useWizardStore((s) => s.selectedStackId);\n  const setupMarketplace = useWizardStore((s) => s.setupMarketplace);\n  const { viewportRef, contentRef, contentMarginTop, hiddenAbove, hiddenBelow } = usePanelScroll();\n\n  // A project set up from a marketplace named for it is set up from THAT one, whichever the\n  // global install's skills it shows come from.\n  const sourceNames =\n    setupMarketplace === null\n      ? formatSkillMarketplaces(skillConfigs)\n      : formatSourceDisplayName(setupMarketplace);\n  const stackName = getStackName(selectedStackId);\n\n  return (\n    <Box\n      flexDirection=\"column\"\n      flexGrow={1}\n      flexBasis={0}\n      borderStyle=\"single\"\n      borderColor={CLI_COLORS.NEUTRAL}\n      paddingX={2}\n    >\n      <Box ref={viewportRef} flexDirection=\"column\" flexGrow={1} flexBasis={0} overflow=\"hidden\">\n        <Box ref={contentRef} flexDirection=\"column\" flexShrink={0} marginTop={contentMarginTop}>\n          <PanelHeader sourceNames={sourceNames} stackName={stackName} />\n\n          <Box width=\"100%\">\n            <SkillAgentSummary skillConfigs={skillConfigs} agentConfigs={agentConfigs} />\n          </Box>\n        </Box>\n      </Box>\n      <ScrollAffordance hiddenAbove={hiddenAbove} hiddenBelow={hiddenBelow} />\n    </Box>\n  );\n};\n","import { useEffect, useRef, useState } from \"react\";\nimport type { Ref, RefObject } from \"react\";\nimport { type DOMElement, measureElement, useInput } from \"ink\";\nimport { useMeasuredHeight } from \"./use-measured-height.js\";\n\nexport type UsePanelScrollResult = {\n  /** Attach to the clipping box — the one with `overflow=\"hidden\"`. */\n  viewportRef: Ref<DOMElement>;\n  /** Attach to the scrolled content box inside the viewport. */\n  contentRef: RefObject<DOMElement | null>;\n  /** Apply as the content box's `marginTop`; negative by the number of lines scrolled off the top. */\n  contentMarginTop: number;\n  /** Content lines scrolled off the top of the viewport. */\n  hiddenAbove: number;\n  /** Content lines clipped below the viewport. */\n  hiddenBelow: number;\n};\n\n/**\n * Line scrolling for a single clipped viewport, driven by the `↑`/`↓` keys.\n *\n * The caller renders viewport, content and a `ScrollAffordance` sibling; this\n * owns the offset those three agree on. Distinct from `useSectionScroll`, which\n * moves a viewport to follow focus across variable-height sections — here there\n * is no focus, only the arrow keys.\n *\n * A host that needs other keys adds its own `useInput` alongside it, on keys\n * disjoint from `↑`/`↓`.\n */\nexport function usePanelScroll(): UsePanelScrollResult {\n  // Measured on the clipping box itself, inside the border and padding, so it\n  // is the height the content actually gets.\n  const { ref: viewportRef, measuredHeight: viewportHeight } = useMeasuredHeight();\n  const contentRef = useRef<DOMElement>(null);\n  const [contentHeight, setContentHeight] = useState(0);\n  const [scrollOffset, setScrollOffset] = useState(0);\n\n  // Ink's measurement idiom: re-measure on every render, no dependency array\n  // on purpose. The setState inside is guarded to fire only when the measured\n  // height actually changed, so the chain converges instead of looping — a\n  // dependency array here would skip re-measures after layout changes React\n  // cannot see.\n  // eslint-disable-next-line react-hooks/exhaustive-deps\n  useEffect(() => {\n    if (!contentRef.current) return;\n    const { height } = measureElement(contentRef.current);\n    // Yoga under-reports a wrapped subtree measured inside a viewport too\n    // short to lay it out, and reports 0 inside a zero-height one, so the\n    // tallest reading is the trustworthy one. Believing a squeezed reading\n    // would shrink the hidden-line count until the affordance disappeared,\n    // which hands its row back and grows the count again — a render loop.\n    setContentHeight((prev) => Math.max(prev, height));\n  });\n\n  // contentHeight only ever sizes the scroll range and the affordance count.\n  // It must never gate the clip — which is why it is not returned: a viewport\n  // that stops clipping when it looks too small grows to content height, which\n  // makes it look big enough to stop clipping — a stable wrong answer that\n  // paints the content over the border.\n  const maxScroll = Math.max(0, contentHeight - viewportHeight);\n  const hiddenBelow = Math.max(0, maxScroll - scrollOffset);\n\n  useInput((_input, key) => {\n    if (key.upArrow) setScrollOffset((prev) => Math.max(0, prev - 1));\n    if (key.downArrow) setScrollOffset((prev) => Math.min(maxScroll, prev + 1));\n  });\n\n  return {\n    viewportRef,\n    contentRef,\n    contentMarginTop: scrollOffset > 0 ? -scrollOffset : 0,\n    hiddenAbove: scrollOffset,\n    hiddenBelow,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,KAAK,YAAY;AAC1B,OAAkB;AAClB,SAAS,cAAc;;;ACFvB,SAAS,WAAW,QAAQ,gBAAgB;AAE5C,SAA0B,gBAAgB,gBAAgB;AA2BnD,SAAS,iBAAuC;AAGrD,QAAM,EAAE,KAAK,aAAa,gBAAgB,eAAe,IAAI,kBAAkB;AAC/E,QAAM,aAAa,OAAmB,IAAI;AAC1C,QAAM,CAAC,eAAe,gBAAgB,IAAI,SAAS,CAAC;AACpD,QAAM,CAAC,cAAc,eAAe,IAAI,SAAS,CAAC;AAQlD,YAAU,MAAM;AACd,QAAI,CAAC,WAAW,QAAS;AACzB,UAAM,EAAE,OAAO,IAAI,eAAe,WAAW,OAAO;AAMpD,qBAAiB,CAAC,SAAS,KAAK,IAAI,MAAM,MAAM,CAAC;AAAA,EACnD,CAAC;AAOD,QAAM,YAAY,KAAK,IAAI,GAAG,gBAAgB,cAAc;AAC5D,QAAM,cAAc,KAAK,IAAI,GAAG,YAAY,YAAY;AAExD,WAAS,CAAC,QAAQ,QAAQ;AACxB,QAAI,IAAI,QAAS,iBAAgB,CAAC,SAAS,KAAK,IAAI,GAAG,OAAO,CAAC,CAAC;AAChE,QAAI,IAAI,UAAW,iBAAgB,CAAC,SAAS,KAAK,IAAI,WAAW,OAAO,CAAC,CAAC;AAAA,EAC5E,CAAC;AAED,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,kBAAkB,eAAe,IAAI,CAAC,eAAe;AAAA,IACrD,aAAa;AAAA,IACb;AAAA,EACF;AACF;;;ADSI,SACE,KADF;AA5CJ,SAAS,wBAAwB,cAAqC;AACpE,MAAI,aAAa,WAAW,EAAG,QAAO,wBAAwB,0BAA0B;AAExF,QAAM,mBAAmB;AAAA,IACvB,aAAa,IAAI,CAAC,WAAW,OAAO,MAAM,EAAE,OAAO,CAAC,WAAW,WAAW,YAAY;AAAA,EACxF;AACA,MAAI,iBAAiB,WAAW,EAAG,QAAO;AAE1C,SAAO,iBACJ,IAAI,CAAC,SAAS,wBAAwB,IAAI,CAAC,EAC3C,KAAK,EACL,KAAK,QAAK;AACf;AAkBA,IAAM,cAA0C,CAAC,EAAE,aAAa,UAAU,MACxE;AAAA,EAAC;AAAA;AAAA,IACC,eAAc;AAAA,IACd,YAAY;AAAA,IACZ,aAAY;AAAA,IACZ,cAAc;AAAA,IACd,WAAW;AAAA,IACX,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,aAAa,WAAW;AAAA,IACxB,sBAAoB;AAAA,IACpB,eAAe;AAAA,IACf,cAAc;AAAA,IAEd;AAAA,2BAAC,OAAI,eAAc,OAAM,WAAW,GAClC;AAAA,4BAAC,QAAK,OAAO,WAAW,SAAS,MAAI,MAAC,yBAEtC;AAAA,QACA,oBAAC,QAAK,OAAO,WAAW,SAAU,uBAAY;AAAA,SAChD;AAAA,MACA,qBAAC,OAAI,eAAc,OAAM,WAAW,GAClC;AAAA,4BAAC,QAAK,OAAO,WAAW,SAAS,MAAI,MAAC,mBAEtC;AAAA,QACA,oBAAC,QAAK,OAAO,WAAW,SAAU,uBAAa,QAAO;AAAA,SACxD;AAAA;AAAA;AACF;AAiBK,IAAM,eAAyB,MAAM;AAC1C,QAAM,eAAe,eAAe,CAAC,MAAM,EAAE,YAAY;AACzD,QAAM,eAAe,eAAe,CAAC,MAAM,EAAE,YAAY;AACzD,QAAM,kBAAkB,eAAe,CAAC,MAAM,EAAE,eAAe;AAC/D,QAAM,mBAAmB,eAAe,CAAC,MAAM,EAAE,gBAAgB;AACjE,QAAM,EAAE,aAAa,YAAY,kBAAkB,aAAa,YAAY,IAAI,eAAe;AAI/F,QAAM,cACJ,qBAAqB,OACjB,wBAAwB,YAAY,IACpC,wBAAwB,gBAAgB;AAC9C,QAAM,YAAY,aAAa,eAAe;AAE9C,SACE;AAAA,IAAC;AAAA;AAAA,MACC,eAAc;AAAA,MACd,UAAU;AAAA,MACV,WAAW;AAAA,MACX,aAAY;AAAA,MACZ,aAAa,WAAW;AAAA,MACxB,UAAU;AAAA,MAEV;AAAA,4BAAC,OAAI,KAAK,aAAa,eAAc,UAAS,UAAU,GAAG,WAAW,GAAG,UAAS,UAChF,+BAAC,OAAI,KAAK,YAAY,eAAc,UAAS,YAAY,GAAG,WAAW,kBACrE;AAAA,8BAAC,eAAY,aAA0B,WAAsB;AAAA,UAE7D,oBAAC,OAAI,OAAM,QACT,8BAAC,qBAAkB,cAA4B,cAA4B,GAC7E;AAAA,WACF,GACF;AAAA,QACA,oBAAC,oBAAiB,aAA0B,aAA0B;AAAA;AAAA;AAAA,EACxE;AAEJ;","names":[]}