cherry-works 0.7.2 → 0.8.0

package/dist/main.js

@@ -9507,7 +9507,7 @@ var require_core = __commonJS({
       errorsText(errors = this.errors, { separator = ", ", dataVar = "data" } = {}) {
         if (!errors || errors.length === 0)
           return "No errors";
-        return errors.map((e) => `${dataVar}${e.instancePath} ${e.message}`).reduce((text, msg) => text + separator + msg);
+        return errors.map((e) => `${dataVar}${e.instancePath} ${e.message}`).reduce((text2, msg) => text2 + separator + msg);
       }
       $dataMetaSchema(metaSchema, keywordsJsonPointers) {
         const rules = this.RULES.all;
@@ -14822,14 +14822,14 @@ var require_foldFlowLines = __commonJS({
     var FOLD_FLOW = "flow";
     var FOLD_BLOCK = "block";
     var FOLD_QUOTED = "quoted";
-    function foldFlowLines(text, indent, mode = "flow", { indentAtStart, lineWidth = 80, minContentWidth = 20, onFold, onOverflow } = {}) {
+    function foldFlowLines(text2, indent, mode = "flow", { indentAtStart, lineWidth = 80, minContentWidth = 20, onFold, onOverflow } = {}) {
       if (!lineWidth || lineWidth < 0)
-        return text;
+        return text2;
       if (lineWidth < minContentWidth)
         minContentWidth = 0;
       const endStep = Math.max(1 + minContentWidth, 1 + lineWidth - indent.length);
-      if (text.length <= endStep)
-        return text;
+      if (text2.length <= endStep)
+        return text2;
       const folds = [];
       const escapedFolds = {};
       let end = lineWidth - indent.length;
@@ -14846,14 +14846,14 @@ var require_foldFlowLines = __commonJS({
       let escStart = -1;
       let escEnd = -1;
       if (mode === FOLD_BLOCK) {
-        i = consumeMoreIndentedLines(text, i, indent.length);
+        i = consumeMoreIndentedLines(text2, i, indent.length);
         if (i !== -1)
           end = i + endStep;
       }
-      for (let ch; ch = text[i += 1]; ) {
+      for (let ch; ch = text2[i += 1]; ) {
         if (mode === FOLD_QUOTED && ch === "\\") {
           escStart = i;
-          switch (text[i + 1]) {
+          switch (text2[i + 1]) {
             case "x":
               i += 3;
               break;
@@ -14870,12 +14870,12 @@ var require_foldFlowLines = __commonJS({
         }
         if (ch === "\n") {
           if (mode === FOLD_BLOCK)
-            i = consumeMoreIndentedLines(text, i, indent.length);
+            i = consumeMoreIndentedLines(text2, i, indent.length);
           end = i + indent.length + endStep;
           split = void 0;
         } else {
           if (ch === " " && prev && prev !== " " && prev !== "\n" && prev !== "	") {
-            const next = text[i + 1];
+            const next = text2[i + 1];
             if (next && next !== " " && next !== "\n" && next !== "	")
               split = i;
           }
@@ -14887,12 +14887,12 @@ var require_foldFlowLines = __commonJS({
             } else if (mode === FOLD_QUOTED) {
               while (prev === " " || prev === "	") {
                 prev = ch;
-                ch = text[i += 1];
+                ch = text2[i += 1];
                 overflow = true;
               }
               const j = i > escEnd + 1 ? i - 2 : escStart - 1;
               if (escapedFolds[j])
-                return text;
+                return text2;
               folds.push(j);
               escapedFolds[j] = true;
               end = j + endStep;
@@ -14907,39 +14907,39 @@ var require_foldFlowLines = __commonJS({
       if (overflow && onOverflow)
         onOverflow();
       if (folds.length === 0)
-        return text;
+        return text2;
       if (onFold)
         onFold();
-      let res = text.slice(0, folds[0]);
+      let res = text2.slice(0, folds[0]);
       for (let i2 = 0; i2 < folds.length; ++i2) {
         const fold = folds[i2];
-        const end2 = folds[i2 + 1] || text.length;
+        const end2 = folds[i2 + 1] || text2.length;
         if (fold === 0)
           res = `
-${indent}${text.slice(0, end2)}`;
+${indent}${text2.slice(0, end2)}`;
         else {
           if (mode === FOLD_QUOTED && escapedFolds[fold])
-            res += `${text[fold]}\\`;
+            res += `${text2[fold]}\\`;
           res += `
-${indent}${text.slice(fold + 1, end2)}`;
+${indent}${text2.slice(fold + 1, end2)}`;
         }
       }
       return res;
     }
-    function consumeMoreIndentedLines(text, i, indent) {
+    function consumeMoreIndentedLines(text2, i, indent) {
       let end = i;
       let start = i + 1;
-      let ch = text[start];
+      let ch = text2[start];
       while (ch === " " || ch === "	") {
         if (i < start + indent) {
-          ch = text[++i];
+          ch = text2[++i];
         } else {
           do {
-            ch = text[++i];
+            ch = text2[++i];
           } while (ch && ch !== "\n");
           end = i;
           start = i + 1;
-          ch = text[start];
+          ch = text2[start];
         }
       }
       return end;
@@ -21665,7 +21665,7 @@ var require_cross_spawn = __commonJS({
     var cp = __require("child_process");
     var parse5 = require_parse2();
     var enoent = require_enoent();
-    function spawn5(command2, args, options) {
+    function spawn6(command2, args, options) {
       const parsed = parse5(command2, args, options);
       const spawned = cp.spawn(parsed.command, parsed.args, parsed.options);
       enoent.hookChildProcess(spawned, parsed);
@@ -21677,8 +21677,8 @@ var require_cross_spawn = __commonJS({
       result.error = result.error || enoent.verifyENOENTSync(result.status, parsed);
       return result;
     }
-    module.exports = spawn5;
-    module.exports.spawn = spawn5;
+    module.exports = spawn6;
+    module.exports.spawn = spawn6;
     module.exports.sync = spawnSync;
     module.exports._parse = parse5;
     module.exports._enoent = enoent;
@@ -21898,7 +21898,7 @@ import { pathToFileURL as pathToFileURL2 } from "url";
 // package.json
 var package_default = {
   name: "cherry-works",
-  version: "0.7.2",
+  version: "0.8.0",
   description: "The charter engine: resolves a charter and compiles it into what a coding agent reads.",
   keywords: [
     "claude-code",
@@ -22057,10 +22057,10 @@ var UI = class {
     });
     return this.rows[this.rows.length - 1];
   }
-  colFromString(text) {
+  colFromString(text2) {
     return {
-      text,
-      padding: this.measurePadding(text)
+      text: text2,
+      padding: this.measurePadding(text2)
     };
   }
   measurePadding(str) {
@@ -25324,17 +25324,17 @@ function usage(yargs, shim3) {
   };
   return self;
 }
-function isIndentedText(text) {
-  return typeof text === "object";
+function isIndentedText(text2) {
+  return typeof text2 === "object";
 }
-function addIndentation(text, indent) {
-  return isIndentedText(text) ? { text: text.text, indentation: text.indentation + indent } : { text, indentation: indent };
+function addIndentation(text2, indent) {
+  return isIndentedText(text2) ? { text: text2.text, indentation: text2.indentation + indent } : { text: text2, indentation: indent };
 }
-function getIndentation(text) {
-  return isIndentedText(text) ? text.indentation : 0;
+function getIndentation(text2) {
+  return isIndentedText(text2) ? text2.indentation : 0;
 }
-function getText(text) {
-  return isIndentedText(text) ? text.text : text;
+function getText(text2) {
+  return isIndentedText(text2) ? text2.text : text2;
 }
 
 // node_modules/.pnpm/yargs@18.1.0/node_modules/yargs/build/lib/completion-templates.js
@@ -37577,8 +37577,8 @@ function ko_default() {
 }
 
 // node_modules/.pnpm/zod@4.6.1/node_modules/zod/v4/locales/lt.js
-var capitalizeFirstCharacter = (text) => {
-  return text.charAt(0).toUpperCase() + text.slice(1);
+var capitalizeFirstCharacter = (text2) => {
+  return text2.charAt(0).toUpperCase() + text2.slice(1);
 };
 function getUnitTypeFromNumber(number4) {
   const abs = Math.abs(number4);
@@ -51930,7 +51930,7 @@ var HonoRequest = class {
    * ```
    */
   json() {
-    return this.#cachedBody("text").then((text) => JSON.parse(text));
+    return this.#cachedBody("text").then((text2) => JSON.parse(text2));
   }
   /**
    * `.text()` can parse Request body of type `text/plain`
@@ -52496,9 +52496,9 @@ var Context = class {
    * })
    * ```
    */
-  text = (text, arg, headers) => {
-    return !this.#preparedHeaders && !this.#status && !arg && !headers && !this.finalized ? new Response(text) : this.#newResponse(
-      text,
+  text = (text2, arg, headers) => {
+    return !this.#preparedHeaders && !this.#status && !arg && !headers && !this.finalized ? new Response(text2) : this.#newResponse(
+      text2,
       arg,
       setDefaultContentType(TEXT_PLAIN, headers)
     );
@@ -57394,6 +57394,15 @@ var ServedToolsSchema = dto(
   })
 );
 var ToolAnswerSchema = dto("ToolAnswer", external_exports.record(external_exports.string(), external_exports.unknown()));
+var VendorPrimitiveSchema = dto(
+  "VendorPrimitive",
+  external_exports.object({
+    kind: external_exports.string(),
+    id: external_exports.string(),
+    description: external_exports.string(),
+    leftOutHeaders: StringsSchema
+  })
+);
 var WorkspaceSettingsSchema = dto(
   "WorkspaceSettings",
   external_exports.object({
@@ -57474,6 +57483,7 @@ var DataDTOs = byType(
   TestSuiteSchema,
   TestSuitesSchema,
   ToolAnswerSchema,
+  VendorPrimitiveSchema,
   WorkspaceSettingsSchema
 );
 
@@ -57515,7 +57525,28 @@ var SessionReviewOutcomeSchema = dto(
     dailySessionSummary: external_exports.record(external_exports.string(), DataDTOs.SessionSummary)
   })
 );
-var OutcomeDTOs = byType(DoctorOutcomeSchema, ExplanationOutcomeSchema, SessionReviewOutcomeSchema);
+var SensorRunOutcomeSchema = dto(
+  "SensorRunOutcome",
+  external_exports.object({
+    exitCode: external_exports.number(),
+    answer: external_exports.string(),
+    problem: external_exports.string()
+  })
+);
+var VendorAddOutcomeSchema = dto(
+  "VendorAddOutcome",
+  external_exports.object({
+    folder: external_exports.string(),
+    primitives: external_exports.array(DataDTOs.VendorPrimitive).readonly()
+  })
+);
+var OutcomeDTOs = byType(
+  DoctorOutcomeSchema,
+  ExplanationOutcomeSchema,
+  SensorRunOutcomeSchema,
+  SessionReviewOutcomeSchema,
+  VendorAddOutcomeSchema
+);
 
 // src/hexagon/domain/models/helper.ts
 function formatFrontmatterValue(value) {
@@ -57837,10 +57868,10 @@ var SAMPLE_CASES = [
 var SAMPLE = JSON.stringify({ cases: SAMPLE_CASES }, void 0, 1).replace(/\n\s*/g, " ");
 var DEFAULT_TEST_SUITE_BODY = `${JSON.stringify({ description: "What these cases pin down.", cases: [SAMPLE_CASES[0]] }, null, 2)}
 `;
-function testSuiteOf(text) {
+function testSuiteOf(text2) {
   let written;
   try {
-    written = JSON.parse(text);
+    written = JSON.parse(text2);
   } catch {
     throw new TestSuiteFault(
       `This file is not JSON, so nothing can read the cases it was meant to hold.`,
@@ -57849,7 +57880,7 @@ function testSuiteOf(text) {
   }
   const read = TestSuiteSchema2.safeParse(written);
   if (!read.success) throw new TestSuiteFault(`This file is not written as a suite of cases.`, `Write it as ${SAMPLE}`);
-  return new TestSuite(read.data.description, read.data.cases, text);
+  return new TestSuite(read.data.description, read.data.cases, text2);
 }
 
 // src/hexagon/domain/models/test/TestRoot.ts
@@ -58075,6 +58106,16 @@ function sessionReviewOutcomeDTO(sessionAnalysis, sessionAnalysisSummary, sessio
     }
   };
 }
+function sensorRunOutcomeDTO(signalAnswer) {
+  return { type: "SensorRunOutcome", data: { exitCode: signalAnswer.exitCode, answer: signalAnswer.stdout, problem: signalAnswer.stderr } };
+}
+function vendorPrimitiveDTO(vendorPrimitive) {
+  const { kind, id, description, leftOutHeaders } = vendorPrimitive;
+  return { type: "VendorPrimitive", data: { kind, id, description, leftOutHeaders } };
+}
+function vendorAddOutcomeDTO(vendorInstall) {
+  return { type: "VendorAddOutcome", data: { folder: vendorInstall.folder, primitives: vendorInstall.vendorPrimitives.map(vendorPrimitiveDTO) } };
+}
 
 // src/driver/portal/routes.ts
 var json3 = (schema, description) => ({
@@ -58377,8 +58418,8 @@ function api(charterAuthoringApp2, charterVendoringApp2, testAuthoringApp2) {
         )
       },
       responses: {
-        204: { description: "The source is installed, and committed" },
-        422: json3(DataDTOs.Fault, "No repository, work in hand, or what git refused")
+        204: { description: "The source is installed \u2014 a charter whole, or every skill of a skills repository \u2014 left unstaged" },
+        422: json3(DataDTOs.Fault, "No repository, a source holding neither a charter nor a skill, or what git refused")
       }
     }),
     async (c) => {
@@ -58514,8 +58555,27 @@ var RemoveCommand = class {
   }
 };
 
-// src/driver/cli/commands/SessionsCommand.ts
+// src/driver/cli/commands/SensorRunCommand.ts
+import { text } from "stream/consumers";
 var OPTIONS12 = {
+  signal: {
+    type: "string",
+    describe: "The signal the host fired, as a sensor names it: Stop, PreToolUse\u2026"
+  }
+};
+var SensorRunCommand = class {
+  name = "sensor run <signal>";
+  summary = "Run every sensor of a signal, as the host's one hook for it";
+  options = OPTIONS12;
+  async run({ sensorRunningApp: sensorRunningApp2 }, { signal }) {
+    const stdin = process.stdin.isTTY ? "" : await text(process.stdin);
+    const { data: sensorRunOutcome } = await sensorRunningApp2.runSensors(signal ?? "", stdin);
+    return { code: sensorRunOutcome.exitCode, result: sensorRunOutcome.answer, problem: sensorRunOutcome.problem };
+  }
+};
+
+// src/driver/cli/commands/SessionsCommand.ts
+var OPTIONS13 = {
   since: {
     type: "string",
     describe: "Count the sessions whose last stop is on or after this day, YYYY-MM-DD; 31 days from it unless --until says"
@@ -58533,7 +58593,7 @@ var OPTIONS12 = {
 var SessionsCommand = class {
   name = "sessions";
   summary = "Sum up the tokens of the sessions kept on this machine, by day and by session";
-  options = OPTIONS12;
+  options = OPTIONS13;
   async run({ sessionReviewingApp: sessionReviewingApp2 }, { since, until, json: isJson }) {
     const sessionReviewOutcome = await sessionReviewingApp2.sessionSummary(since, until);
     if (isJson) return { code: EXIT_OK, result: `${JSON.stringify(sessionReviewOutcome, null, 2)}
@@ -58591,7 +58651,7 @@ var SuiteAddCommand = class {
 };
 
 // src/driver/cli/commands/SuiteEditCommand.ts
-var OPTIONS13 = {
+var OPTIONS14 = {
   name: {
     type: "string",
     describe: `The test file's name under ${TEST_DIRECTORY}/: "untitled-1.json"`
@@ -58600,7 +58660,7 @@ var OPTIONS13 = {
 var SuiteEditCommand = class {
   name = "suite edit <name>";
   summary = "Open one test file in your editor";
-  options = OPTIONS13;
+  options = OPTIONS14;
   async run({ cwd, testAuthoringApp: testAuthoringApp2 }, { name }) {
     const { testSuites } = (await testAuthoringApp2.suites()).data;
     if (!testSuites.some((one) => one.data.name === name))
@@ -58613,7 +58673,7 @@ var SuiteEditCommand = class {
 };
 
 // src/driver/cli/commands/SuiteRemoveCommand.ts
-var OPTIONS14 = {
+var OPTIONS15 = {
   name: {
     type: "string",
     describe: `The test file's name under ${TEST_DIRECTORY}/: "untitled-1.json"`
@@ -58622,7 +58682,7 @@ var OPTIONS14 = {
 var SuiteRemoveCommand = class {
   name = "suite remove <name>";
   summary = "Delete one test file";
-  options = OPTIONS14;
+  options = OPTIONS15;
   async run({ testAuthoringApp: testAuthoringApp2 }, { name }) {
     const removedName = await testAuthoringApp2.removeSuite(name ?? "");
     return { code: EXIT_OK, result: `Removed ${TEST_DIRECTORY}/${removedName}.
@@ -58669,26 +58729,34 @@ function lines2(one) {
 }
 
 // src/driver/cli/commands/VendorAddCommand.ts
-var OPTIONS15 = {
+var OPTIONS16 = {
   source: {
     type: "string",
-    describe: "What git clones the charter from: an address over any transport, or a path on disk"
+    describe: "What git fetches the charter or the skills from: an address over any transport, or a path on disk"
   },
   ref: {
     type: "string",
     describe: "The tag, branch or commit to pin to; the source's own default where none is named"
+  },
+  skill: {
+    type: "string",
+    isArray: true,
+    describe: "A skill to take from a skills repository, by its name; typed once per skill, and every skill it holds where none is named. Refused for a charter"
   }
 };
 var VendorAddCommand = class {
   name = "vendor add <source>";
-  summary = "Install a charter from a git source, or bring an installed one up to date";
-  options = OPTIONS15;
-  async run({ charterVendoringApp: charterVendoringApp2 }, { source, ref }) {
-    const folder = await charterVendoringApp2.add(source ?? "", ref);
+  summary = "Install a charter or skills from a git source, or bring an installed one up to date";
+  options = OPTIONS16;
+  async run({ charterVendoringApp: charterVendoringApp2 }, { source, ref, skill }) {
+    const { folder, primitives } = (await charterVendoringApp2.add(source ?? "", ref, skill)).data;
     return {
       code: EXIT_OK,
       result: [
         `Installed ${source} under ${folder}${ref === void 0 ? "" : `, pinned to ${ref}`}.`,
+        ...primitives.map(
+          ({ data: { kind, id, leftOutHeaders } }) => `  ${kind} ${id}${leftOutHeaders.length === 0 ? "" : `, leaving out ${leftOutHeaders.join(", ")}: the charter has no field for them`}`
+        ),
         'Run "cw build" to compile what it adds to this charter.',
         ""
       ].join("\n")
@@ -58710,7 +58778,7 @@ var VendorListCommand = class {
 };
 
 // src/driver/cli/commands/VendorRemoveCommand.ts
-var OPTIONS16 = {
+var OPTIONS17 = {
   name: {
     type: "string",
     describe: "The folder this charter was installed as, as it reads under .cw/vendor/"
@@ -58719,7 +58787,7 @@ var OPTIONS16 = {
 var VendorRemoveCommand = class {
   name = "vendor remove <name>";
   summary = "Take an installed charter away";
-  options = OPTIONS16;
+  options = OPTIONS17;
   async run({ charterVendoringApp: charterVendoringApp2 }, { name }) {
     const folder = await charterVendoringApp2.remove(name ?? "");
     return {
@@ -58756,7 +58824,8 @@ var COMMANDS = [
   new VendorListCommand(),
   new PortalCommand(),
   new McpAuthCommand(),
-  new McpServeCommand()
+  new McpServeCommand(),
+  new SensorRunCommand()
 ];
 
 // src/driver/cli/Commander.ts
@@ -59088,7 +59157,16 @@ var PlaybookHeadersSchema = CommonHeadersSchema.extend({
   triggers: GoodArraySchema,
   /** Whether it is kept out of the commands its host offers the user, being a
    *  step of something else; the agent still opens it (CORE-FR-173). */
-  "disable-user-invocation": FlagSchema.optional()
+  "disable-user-invocation": FlagSchema.optional(),
+  /** Whether the agent is kept from opening it by itself, its description
+   *  matching what is asked; the user still runs it as a command (CORE-FR-181). */
+  "disable-model-invocation": FlagSchema.optional()
+}).superRefine((headers, context) => {
+  if (headers["disable-user-invocation"] === true && headers["disable-model-invocation"] === true)
+    context.addIssue({
+      code: "custom",
+      message: `This playbook declares both "disable-user-invocation: true" and "disable-model-invocation: true", so neither the user nor the agent could open it; drop one.`
+    });
 });
 var PlaybookPrimitive = class _PlaybookPrimitive extends BasePrimitive {
   static kind = "playbook";
@@ -59160,7 +59238,16 @@ var SkillHeadersSchema = CommonHeadersSchema.extend({
   triggers: GoodArraySchema,
   /** Whether it is kept out of the commands its host offers the user, being a
    *  step of something else; the agent still opens it (CORE-FR-173). */
-  "disable-user-invocation": FlagSchema.optional()
+  "disable-user-invocation": FlagSchema.optional(),
+  /** Whether the agent is kept from opening it by itself, its description
+   *  matching what is asked; the user still runs it as a command (CORE-FR-181). */
+  "disable-model-invocation": FlagSchema.optional()
+}).superRefine((headers, context) => {
+  if (headers["disable-user-invocation"] === true && headers["disable-model-invocation"] === true)
+    context.addIssue({
+      code: "custom",
+      message: `This skill declares both "disable-user-invocation: true" and "disable-model-invocation: true", so neither the user nor the agent could open it; drop one.`
+    });
 });
 var SkillPrimitive = class _SkillPrimitive extends BasePrimitive {
   static kind = "skill";
@@ -59958,6 +60045,220 @@ agent stops as it would have.`,
 // src/hexagon/domain/models/charter/builtin/index.ts
 var BUILTIN_PRIMITIVES = [new CwAuthorSkill(), new CwSessionTokensCounterScript(), new CwSessionTokensSensor(), new CwSessionCostSkill()];
 
+// src/hexagon/domain/models/vendor/VendorPrimitive.ts
+var SKILL_FILE = "SKILL.md";
+var SKILLS_FOLDER = "skills";
+var SKILLS_FOLDER_DEPTH = 3;
+var DEPENDENCIES_FOLDER = "node_modules";
+var CONVERTED_HEADERS = ["name", "description", "disable-model-invocation", "user-invocable"];
+var VendorPrimitive = class {
+  constructor(kind, id, description, sourceFolder, convertedSkill, leftOutHeaders = []) {
+    this.kind = kind;
+    this.id = id;
+    this.description = description;
+    this.sourceFolder = sourceFolder;
+    this.convertedSkill = convertedSkill;
+    this.leftOutHeaders = leftOutHeaders;
+  }
+  kind;
+  id;
+  description;
+  sourceFolder;
+  convertedSkill;
+  leftOutHeaders;
+};
+function frontmatterOf(markdown, parser2) {
+  const lines3 = markdown.replace(/^/, "").split(/\r?\n/);
+  const frontmatterEnd = lines3[0]?.trim() === "---" ? lines3.findIndex((line, index) => index > 0 && line.trim() === "---") : -1;
+  if (frontmatterEnd === -1) return void 0;
+  return {
+    headers: parser2.parse(lines3.slice(1, frontmatterEnd).join("\n")),
+    body: lines3.slice(frontmatterEnd + 1).join("\n").replace(/^(\s*\n)+/, "").trimEnd()
+  };
+}
+function skillFilesOf(sourcePaths) {
+  const skillFolders = sourcePaths.filter((sourcePath) => sourcePath.startsWith(`${SKILLS_FOLDER}/`) && sourcePath.endsWith(`/${SKILL_FILE}`)).map((skillFile) => skillFile.slice(0, -`/${SKILL_FILE}`.length)).filter((skillFolder) => {
+    const folderNames = skillFolder.split("/");
+    return folderNames.length - 1 <= SKILLS_FOLDER_DEPTH && !folderNames.includes(DEPENDENCIES_FOLDER);
+  });
+  return skillFolders.filter((skillFolder) => !skillFolders.some((outerFolder) => skillFolder.startsWith(`${outerFolder}/`))).map((skillFolder) => `${skillFolder}/${SKILL_FILE}`);
+}
+function charterVendorPrimitiveOf(indexMd, indexPath, charterFolder, parser2) {
+  const sourceFolder = indexPath.slice(0, indexPath.lastIndexOf("/"));
+  const [kind = "", ...idFolders] = sourceFolder.slice(charterFolder.length + 1).split("/");
+  let description = "";
+  try {
+    const declaredDescription = frontmatterOf(indexMd, parser2)?.headers.description;
+    if (typeof declaredDescription === "string") description = declaredDescription;
+  } catch {
+  }
+  return new VendorPrimitive(kind, idFolders.join("/"), description, sourceFolder);
+}
+function skillVendorPrimitiveOf(skillMd, skillFile, parser2) {
+  const skillFrontmatter = frontmatterOf(skillMd, parser2);
+  if (skillFrontmatter === void 0)
+    throw new VendorFault(`${skillFile} opens with no "---" frontmatter block.`, `Take a skill whose ${SKILL_FILE} declares its name and description.`);
+  const { headers: skillHeaders, body } = skillFrontmatter;
+  try {
+    const skillPrimitive = SkillPrimitive.of(
+      {
+        id: skillHeaders.name,
+        description: skillHeaders.description,
+        triggers: [skillHeaders.name],
+        ...skillHeaders["disable-model-invocation"] === true ? { "disable-model-invocation": true } : {},
+        ...skillHeaders["user-invocable"] === false ? { "disable-user-invocation": true } : {}
+      },
+      body
+    );
+    return new VendorPrimitive(
+      SkillPrimitive.kind,
+      skillPrimitive.headers.id,
+      skillPrimitive.headers.description,
+      skillFile.slice(0, -SKILL_FILE.length).replace(/\/$/, ""),
+      skillPrimitive,
+      Object.keys(skillHeaders).filter((header) => !CONVERTED_HEADERS.includes(header))
+    );
+  } catch (raised) {
+    const faultMessages = raised instanceof AggregateError ? raised.errors.map((fault) => fault.message) : [`${raised}`];
+    throw new VendorFault(
+      `${skillFile} is no skill the charter can hold: ${faultMessages.join(" ")}`,
+      `Take a skill whose ${SKILL_FILE} declares a "name" of lowercase words joined by "-", and a "description".`
+    );
+  }
+}
+
+// src/hexagon/domain/models/vendor/VendorSource.ts
+var VendorSource = class {
+  constructor(source, name) {
+    this.source = source;
+    this.name = name;
+  }
+  source;
+  name;
+};
+function vendorSourceOf(source) {
+  const addressPath = source.replace(/\.git$/, "").replace(/^[a-z][a-z0-9+.-]*:\/\/[^/]*/i, "").replace(/^[^/\\:@]+@[^/\\:]+:/, "");
+  const folderNames = addressPath.split(/[/\\]/).filter(Boolean).slice(-2);
+  if (folderNames.length < 2 || folderNames.some((folderName) => folderName === "." || folderName === ".."))
+    throw new VendorFault(`Invalid path "${source}".`, "Use correct git path, naming its owner and its repository.");
+  return new VendorSource(source, folderNames.join("/"));
+}
+function installedVendorFolderOf(name) {
+  const folderNames = name.split(/[/\\]/).filter(Boolean);
+  if (folderNames.length === 0 || folderNames.length > 2 || folderNames.some((folderName) => folderName === "." || folderName === ".."))
+    throw new VendorFault(`Invalid path "${name}".`, "Name the folder as cw vendor list names it under .cw/vendor/.");
+  return folderNames.join("/");
+}
+
+// src/hexagon/service/vendorRepo.ts
+var VENDOR_README = "README.md";
+async function loadVendorFolders(repo, fileReaders) {
+  const installedFolders = await fileReaders.listFolders(vendorFolderIn(repo));
+  const vendorFolders = await Promise.all(
+    installedFolders.map(async (folder) => {
+      const ownerName = decodeURIComponent(folder.href.split("/").at(-2) ?? "");
+      const childFolders = await fileReaders.listFolders(folder);
+      const childFolderNames = childFolders.map((childFolder) => decodeURIComponent(childFolder.href.split("/").at(-2) ?? ""));
+      const isSource = childFolderNames.some((childFolderName) => KINDS.includes(childFolderName)) || (await fileReaders.listFiles(folder)).some(({ file: file2 }) => file2.href.endsWith(`/${VENDOR_README}`));
+      if (isSource) return [{ folder, vendorName: ownerName }];
+      return childFolders.map((childFolder, index) => ({ folder: childFolder, vendorName: `${ownerName}/${childFolderNames[index]}` }));
+    })
+  );
+  return vendorFolders.flat().sort((leftFolder, rightFolder) => leftFolder.vendorName.localeCompare(rightFolder.vendorName));
+}
+async function loadVendorNames(repo, fileReaders) {
+  return (await loadVendorFolders(repo, fileReaders)).map(({ vendorName }) => `${VENDOR_DIRECTORY}/${vendorName}`);
+}
+async function ensureVCSReady(repo, vcs2, because) {
+  if (!await vcs2.isInstalled(repo))
+    throw new DomainFault(
+      "This folder is not inside a git repository, and a vendor lives in one.",
+      'Run "git init" here, or run this again where your repository is.'
+    );
+  if (because !== void 0 && !await vcs2.isClean(repo))
+    throw new DomainFault(
+      `This repository has work in hand, and ${because}.`,
+      "Commit or stash what you are holding, then run this again."
+    );
+}
+async function loadFetchedVendor(repo, fileReaders, vcs2, yamlParser2, source, fetchedCommit) {
+  const vendorName = vendorSourceOf(source).name;
+  const folder = `${VENDOR_DIRECTORY}/${vendorName}`;
+  const sourcePaths = await vcs2.listFilesAt(repo, fetchedCommit);
+  const folderUrl = new URL(`${folder}/`, repo);
+  const installedFolderNames = (await fileReaders.listFolders(folderUrl)).map((installedFolder) => decodeURIComponent(installedFolder.href.split("/").at(-2) ?? ""));
+  const holdsCharter = installedFolderNames.some((installedFolderName) => installedFolderName !== SkillPrimitive.kind) || (await fileReaders.listFiles(folderUrl)).some(({ file: file2 }) => file2.href.endsWith(`/${VENDOR_README}`));
+  const holdsVendorSkills = !holdsCharter && installedFolderNames.includes(SkillPrimitive.kind);
+  const reinstallFix = `Run "cw vendor remove ${vendorName}", then install it again.`;
+  if (sourcePaths.some((sourcePath) => sourcePath.startsWith(`${CHARTER_DIRECTORY}/`))) {
+    if (sourcePaths.some((sourcePath) => sourcePath.startsWith(`${VENDOR_DIRECTORY}/`)))
+      throw new VendorFault(`${source} holds "${VENDOR_DIRECTORY}", and vendoring is one level deep.`, `Remove "${VENDOR_DIRECTORY}" from the source, or install a version without it.`);
+    if (holdsVendorSkills) throw new VendorFault(`${folder} holds skills taken from ${source}, which holds a charter now.`, reinstallFix);
+    const charterIndexPaths = sourcePaths.filter((sourcePath) => sourcePath.startsWith(`${CHARTER_DIRECTORY}/`) && sourcePath.endsWith(`/${SkillPrimitive.index}`));
+    const vendorPrimitives2 = await Promise.all(
+      charterIndexPaths.map(async (indexPath) => charterVendorPrimitiveOf(await vcs2.readFileAt(repo, fetchedCommit, indexPath), indexPath, CHARTER_DIRECTORY, yamlParser2))
+    );
+    return { folder, isCharter: true, vendorPrimitives: vendorPrimitives2 };
+  }
+  const skillFiles = skillFilesOf(sourcePaths);
+  if (skillFiles.length === 0)
+    throw new VendorFault(
+      `${source} has no "${CHARTER_DIRECTORY}" and no ${SKILL_FILE} under "${SKILLS_FOLDER}/".`,
+      `Check that the source holds "${CHARTER_DIRECTORY}", or skills under "${SKILLS_FOLDER}/" each in a folder holding its ${SKILL_FILE}, at the version asked for.`
+    );
+  if (holdsCharter) throw new VendorFault(`${folder} holds a charter installed from ${source}, which holds skills alone now.`, reinstallFix);
+  const vendorPrimitives = await Promise.all(
+    skillFiles.map(async (skillFile) => skillVendorPrimitiveOf(await vcs2.readFileAt(repo, fetchedCommit, skillFile), skillFile, yamlParser2))
+  );
+  const sharedIdPrimitives = vendorPrimitives.filter((vendorPrimitive) => vendorPrimitives.some((otherPrimitive) => otherPrimitive !== vendorPrimitive && otherPrimitive.id === vendorPrimitive.id));
+  if (sharedIdPrimitives.length > 0)
+    throw new VendorFault(
+      `${sharedIdPrimitives.map(({ sourceFolder }) => `${sourceFolder}/${SKILL_FILE}`).join(", ")} declare one name, and a name is one skill.`,
+      "Take the skills from a version of the source whose names are its own."
+    );
+  return { folder, isCharter: false, vendorPrimitives: [...vendorPrimitives].sort((leftPrimitive, rightPrimitive) => leftPrimitive.id.localeCompare(rightPrimitive.id)) };
+}
+async function addVendor(repo, fileReaders, fileWriter2, vcs2, yamlParser2, source, version2, skillIds = []) {
+  await ensureVCSReady(repo, vcs2);
+  vendorSourceOf(source);
+  const fetchedCommit = await vcs2.fetchCommit(source, repo, version2);
+  const { folder, isCharter, vendorPrimitives } = await loadFetchedVendor(repo, fileReaders, vcs2, yamlParser2, source, fetchedCommit);
+  if (isCharter) {
+    if (skillIds.length > 0)
+      throw new VendorFault(`${source} holds a charter, and --skill is for skills repositories (compatible with npx skills), not a charter: a charter is installed whole.`, "Run this again without --skill.");
+    await vcs2.checkoutFolderAt(repo, fetchedCommit, CHARTER_DIRECTORY, folder);
+    if ((await vcs2.listFilesAt(repo, fetchedCommit)).includes(VENDOR_README))
+      await fileWriter2.write(new URL(`${folder}/${VENDOR_README}`, repo), await vcs2.readFileAt(repo, fetchedCommit, VENDOR_README));
+    return { folder, vendorPrimitives };
+  }
+  const heldSkillIds = vendorPrimitives.map(({ id }) => id);
+  const unheldSkillIds = skillIds.filter((skillId) => !heldSkillIds.includes(skillId));
+  if (unheldSkillIds.length > 0) throw new VendorFault(`${source} holds no skill ${unheldSkillIds.join(", ")}.`, `Take one it holds: ${heldSkillIds.join(", ")}.`);
+  const chosenPrimitives = skillIds.length === 0 ? vendorPrimitives : vendorPrimitives.filter(({ id }) => skillIds.includes(id));
+  for (const { id, sourceFolder, convertedSkill } of chosenPrimitives) {
+    const skillFolder = `${folder}/${SkillPrimitive.kind}/${id}`;
+    await vcs2.checkoutFolderAt(repo, fetchedCommit, sourceFolder, skillFolder);
+    await fileWriter2.write(new URL(`${skillFolder}/${SkillPrimitive.index}`, repo), convertedSkill.toMarkdown());
+    await fileWriter2.delete(new URL(`${skillFolder}/${SKILL_FILE}`, repo));
+  }
+  return { folder, vendorPrimitives: chosenPrimitives };
+}
+async function removeVendor(repo, vcs2, name) {
+  await ensureVCSReady(repo, vcs2, "removing a vendor commits that it is gone");
+  const folder = `${VENDOR_DIRECTORY}/${installedVendorFolderOf(name)}`;
+  await vcs2.removeSubFolder(repo, folder);
+  return folder;
+}
+async function driftedVendors(repo, vcs2) {
+  const changed = await vcs2.changedUnder(repo, VENDOR_DIRECTORY);
+  const vendorNames = changed.map((path) => {
+    const [ownerName = "", childName = ""] = path.slice(`${VENDOR_DIRECTORY}/`.length).split("/");
+    const isSource = childName === VENDOR_README || KINDS.includes(childName);
+    return isSource ? ownerName : `${ownerName}/${childName}`;
+  });
+  return [...new Set(vendorNames.filter((vendorName) => vendorName !== "" && !vendorName.endsWith("/")))].sort();
+}
+
 // src/hexagon/service/charterRepo.ts
 async function loadCharterRoot(repo, fileReaders, yamlParser2) {
   const repoHref = repo.href.endsWith("/") ? repo.href : `${repo.href}/`;
@@ -59989,12 +60290,9 @@ async function loadCharterRoot(repo, fileReaders, yamlParser2) {
     ];
   };
   const authoredFiles = await read(charterFolderIn(repo));
-  const vendors = await fileReaders.listFolders(vendorFolderIn(repo));
+  const vendorFolders = await loadVendorFolders(repo, fileReaders);
   const vendorFiles = await Promise.all(
-    vendors.map(async (folder) => {
-      const vendor = decodeURIComponent(folder.href.split("/").at(-2) ?? "");
-      return (await read(folder)).map((one) => ({ ...one, vendor }));
-    })
+    vendorFolders.map(async ({ folder, vendorName }) => (await read(folder)).map((vendoredFile) => ({ ...vendoredFile, vendor: vendorName })))
   );
   const builtinFiles = BUILTIN_PRIMITIVES.map((primitive) => ({
     path: primitive.file,
@@ -60077,11 +60375,11 @@ var WorkspaceSettings = class {
 
 // src/hexagon/service/settingsRepo.ts
 async function loadSettings(repo, fileReaders) {
-  const text = await fileReaders.readIfThere(settingsFileIn(repo));
-  if (text === void 0) return new WorkspaceSettings([]);
+  const text2 = await fileReaders.readIfThere(settingsFileIn(repo));
+  if (text2 === void 0) return new WorkspaceSettings([]);
   let written;
   try {
-    written = JSON.parse(text);
+    written = JSON.parse(text2);
   } catch {
     throw new SettingsFault(
       `These are this repository's own settings and this is not JSON.`,
@@ -60137,10 +60435,10 @@ async function addTestSuite(repo, fileReaders, fileWriter2) {
   await fileWriter2.write(new URL(name, testFolderIn(repo)), DEFAULT_TEST_SUITE_BODY);
   return name;
 }
-async function writeTestSuite(repo, fileReaders, fileWriter2, name, text) {
+async function writeTestSuite(repo, fileReaders, fileWriter2, name, text2) {
   await ensureTestSuiteNamed(repo, fileReaders, name);
-  testSuiteOf(text);
-  await fileWriter2.write(new URL(name, testFolderIn(repo)), text);
+  testSuiteOf(text2);
+  await fileWriter2.write(new URL(name, testFolderIn(repo)), text2);
   return name;
 }
 async function removeTestSuite(repo, fileReaders, fileWriter2, name) {
@@ -60153,54 +60451,6 @@ async function ensureTestSuiteNamed(repo, fileReaders, name) {
     throw new TestSuiteFault(`${TEST_DIRECTORY}/ holds no test file called "${name}".`, 'Run "cw suite add" to write a new one.');
 }
 
-// src/hexagon/domain/models/vendor/VendorSource.ts
-var VendorSource = class {
-  constructor(source, name) {
-    this.source = source;
-    this.name = name;
-  }
-  source;
-  name;
-};
-function vendorSourceOf(source) {
-  const name = source.replace(/\.git$/, "").split(/[/:\\]/).filter(Boolean).at(-1) ?? "";
-  if (name === "." || name === ".." || name === "") throw new VendorFault(`Invalid path "${source}".`, "Use correct git path.");
-  return new VendorSource(source, name);
-}
-
-// src/hexagon/service/vendorRepo.ts
-async function loadVendorNames(repo, fileReaders) {
-  return (await fileReaders.listFolders(vendorFolderIn(repo))).map((folder) => `${VENDOR_DIRECTORY}/${decodeURIComponent(folder.href.split("/").at(-2) ?? "")}`).sort();
-}
-async function ensureVCSReady(repo, vcs2, because) {
-  if (!await vcs2.isInstalled(repo))
-    throw new DomainFault(
-      "This folder is not inside a git repository, and a vendor lives in one.",
-      'Run "git init" here, or run this again where your repository is.'
-    );
-  if (because !== void 0 && !await vcs2.isClean(repo))
-    throw new DomainFault(
-      `This repository has work in hand, and ${because}.`,
-      "Commit or stash what you are holding, then run this again."
-    );
-}
-async function addVendor(repo, vcs2, source, version2) {
-  await ensureVCSReady(repo, vcs2);
-  const folder = `${VENDOR_DIRECTORY}/${vendorSourceOf(source).name}`;
-  return vcs2.subtreeAdd(source, [CHARTER_DIRECTORY, "README.md"], repo, folder, version2, VENDOR_DIRECTORY);
-}
-async function removeVendor(repo, vcs2, name) {
-  await ensureVCSReady(repo, vcs2, "removing a vendor commits that it is gone");
-  const folder = `${VENDOR_DIRECTORY}/${vendorSourceOf(name).name}`;
-  await vcs2.removeSubFolder(repo, folder);
-  return folder;
-}
-async function driftedVendors(repo, vcs2) {
-  const changed = await vcs2.changedUnder(repo, VENDOR_DIRECTORY);
-  const names = changed.map((path) => path.slice(`${VENDOR_DIRECTORY}/`.length).split("/")[0]).filter((name) => name !== void 0 && name !== "");
-  return [...new Set(names)].sort();
-}
-
 // src/hexagon/domain/services/testService.ts
 var TestCaseReport = class {
   constructor(suiteName, situation, unmet) {
@@ -60387,22 +60637,24 @@ function isStamped(contents) {
 
 // src/hexagon/domain/models/output/CharterOutput.ts
 var CharterOutput = class {
-  constructor(catalogue, charterMd, compiledPrimitives, mcpOrigins, providerComponents) {
+  constructor(catalogue, charterMd, compiledPrimitives, mcpOrigins, builtSensors, providerComponents) {
     this.catalogue = catalogue;
     this.charterMd = charterMd;
     this.compiledPrimitives = compiledPrimitives;
     this.mcpOrigins = mcpOrigins;
+    this.builtSensors = builtSensors;
     this.providerComponents = providerComponents;
   }
   catalogue;
   charterMd;
   compiledPrimitives;
   mcpOrigins;
+  builtSensors;
   providerComponents;
   /** Every file this output is put down as: what each of its parts says it is
    *  put down as, together (FR-020, FR-021). */
   get projections() {
-    return [this.catalogue, this.mcpOrigins, this.charterMd, ...this.compiledPrimitives, ...this.providerComponents].flatMap(
+    return [this.catalogue, this.mcpOrigins, this.builtSensors, this.charterMd, ...this.compiledPrimitives, ...this.providerComponents].flatMap(
       (outputPart) => outputPart.projections
     );
   }
@@ -60528,6 +60780,36 @@ function compiledPrimitiveOf(charter, primitive) {
   );
 }
 
+// src/hexagon/domain/models/output/common/BuiltSensor.ts
+function sensorRunCommandOf(signal) {
+  return `cw sensor run ${signal}`;
+}
+var BuiltSensors = class {
+  constructor(sensors) {
+    this.sensors = sensors;
+  }
+  sensors;
+  /** The file it is put down as, in the output folder: generated, and the
+   *  charter's alone. Indented, since it is committed and read in diffs when a
+   *  sensor's command changes. */
+  get projections() {
+    return [
+      {
+        file: `${OUT_DIRECTORY}/sensors.json`,
+        contents: `${JSON.stringify({ sensors: this.sensors }, void 0, 2)}
+`,
+        projectionPolicy: "replace",
+        executable: false
+      }
+    ];
+  }
+  /** Every signal at least one sensor names, each once, in the order the
+   *  sensors name them. */
+  get signals() {
+    return [...new Set(this.sensors.map((builtSensor) => builtSensor.signal))];
+  }
+};
+
 // src/hexagon/domain/models/output/provider-component/ProviderComponent.ts
 var ProviderComponent = class {
   constructor(path, document, projectionPolicy) {
@@ -60672,7 +60954,7 @@ var ClaudeSettings = class _ClaudeSettings extends SettingBasedComponent {
 };
 
 // src/hexagon/domain/services/compile/claudeComponentFactory.ts
-function claudeComponentsOf(charter, compiledPrimitiveByPrimitive, shortMcpIds) {
+function claudeComponentsOf(charter, compiledPrimitiveByPrimitive, shortMcpIds, builtSensors) {
   const isSettingComponent = (one) => one.kind === PosturePrimitive.kind || one.kind === SensorPrimitive.kind;
   const asSettings = charter.primitives.filter(isSettingComponent);
   const asDocuments = charter.primitives.filter((one) => !isSettingComponent(one));
@@ -60690,7 +60972,7 @@ function claudeComponentsOf(charter, compiledPrimitiveByPrimitive, shortMcpIds)
     // The section of `CLAUDE.md` that sends this host to the charter at all
     // (FR-051).
     ClaudeEntryFile.of(),
-    ...asSettings.length === 0 && toolsByMcpId.size === 0 ? [] : [ClaudeSettings.of(claudeSettingsOf(charter, compiledPrimitiveByPrimitive, asSettings))],
+    ...asSettings.length === 0 && toolsByMcpId.size === 0 ? [] : [ClaudeSettings.of(claudeSettingsOf(charter, builtSensors, asSettings))],
     ClaudeMcpConfig.of(),
     ...asDocuments.flatMap(
       (one) => claudeDocumentComponentOf(
@@ -60702,30 +60984,19 @@ function claudeComponentsOf(charter, compiledPrimitiveByPrimitive, shortMcpIds)
     )
   ];
 }
-function claudeSettingsOf(charter, compiledPrimitiveByPrimitive, ones) {
-  const allow = /* @__PURE__ */ new Set();
-  const deny = /* @__PURE__ */ new Set();
-  const hooks = {};
-  for (const one of ones) {
-    if (one.kind === PosturePrimitive.kind) {
-      const headers = one.headers;
-      for (const permission of headers.allow) allow.add(permission);
-      for (const permission of headers.deny) deny.add(permission);
-    }
-    if (one.kind === SensorPrimitive.kind) {
-      const { signal, run: run3 } = one.headers;
-      const command2 = run3.replace(REFERENCE, (reference, referencedId) => {
-        const scriptPrimitive = charter.primitiveById.get(referencedId);
-        const executionFile = scriptPrimitive && compiledPrimitiveByPrimitive.get(scriptPrimitive)?.projections.find((projection) => projection.executable)?.file;
-        return executionFile ?? reference;
-      });
-      if (isClaudeHookEvent(signal))
-        hooks[signal] = [...hooks[signal] ?? [], { hooks: [{ type: "command", command: command2 }] }];
+function claudeSettingsOf(charter, builtSensors, settingPrimitives) {
+  const allowedPermissions = /* @__PURE__ */ new Set();
+  const deniedPermissions = /* @__PURE__ */ new Set();
+  for (const settingPrimitive of settingPrimitives) {
+    if (settingPrimitive.kind === PosturePrimitive.kind) {
+      for (const permission of settingPrimitive.headers.allow) allowedPermissions.add(permission);
+      for (const permission of settingPrimitive.headers.deny) deniedPermissions.add(permission);
     }
   }
+  const hookEvents = builtSensors.signals.filter(isClaudeHookEvent).sort();
   return {
-    ...allow.size === 0 && deny.size === 0 ? {} : { permissions: { allow: [...allow], deny: [...deny] } },
-    ...Object.keys(hooks).length === 0 ? {} : { hooks },
+    ...allowedPermissions.size === 0 && deniedPermissions.size === 0 ? {} : { permissions: { allow: [...allowedPermissions], deny: [...deniedPermissions] } },
+    ...hookEvents.length === 0 ? {} : { hooks: Object.fromEntries(hookEvents.map((hookEvent) => [hookEvent, [{ hooks: [{ type: "command", command: sensorRunCommandOf(hookEvent) }] }]])) },
     // A charter reaching an mcp origin has its tools' schemas deferred by the host
     // itself, the one server listing every tool (EVAL-FR-016).
     ...charter.primitives.some((primitive) => primitive instanceof McpPrimitive) && { env: CLAUDE_TOOL_SEARCH_ENV }
@@ -60762,12 +61033,17 @@ function claudeDocumentComponentOf(sc, compiledFile, agentTools) {
     // for them: what decides that the body is worth opening is the description,
     // because that line is all this host reads before deciding (FR-013), and
     // composing it is the primitive's. One that is a step of another is kept
-    // out of the user's commands (CORE-FR-174).
+    // out of the user's commands (CORE-FR-174), and one the user alone starts is
+    // kept out of the agent's own reach (CORE-FR-182).
     case SkillPrimitive.kind:
     case PlaybookPrimitive.kind:
       return ClaudeSkill.of(
         name,
-        { description: sc.description(), ...sc.headers["disable-user-invocation"] === true ? { "user-invocable": false } : {} },
+        {
+          description: sc.description(),
+          ...sc.headers["disable-user-invocation"] === true ? { "user-invocable": false } : {},
+          ...sc.headers["disable-model-invocation"] === true ? { "disable-model-invocation": true } : {}
+        },
         pointerTo(`../${compiledFromClaudeFolder}`)
       );
     default:
@@ -60805,6 +61081,19 @@ function mcpOriginsOf(charter, shortMcpIds, toolsByOriginKey = /* @__PURE__ */ n
   });
 }
 
+// src/hexagon/domain/services/compile/builtSensorsFactory.ts
+function builtSensorsOf(charter, compiledPrimitiveByPrimitive) {
+  return [...charter.primitives].flatMap((primitive) => primitive.kind === SensorPrimitive.kind ? [primitive] : []).sort((one, another) => one.headers.id < another.headers.id ? -1 : 1).map(({ headers: { id, signal, run: run3 } }) => ({
+    id,
+    signal,
+    command: run3.replace(REFERENCE, (reference, referencedId) => {
+      const scriptPrimitive = charter.primitiveById.get(referencedId);
+      const executionFile = scriptPrimitive && compiledPrimitiveByPrimitive.get(scriptPrimitive)?.projections.find((projection) => projection.executable)?.file;
+      return executionFile ?? reference;
+    })
+  }));
+}
+
 // src/hexagon/domain/services/compile/compileService.ts
 function compile2(charter, agents, toolsByOriginKey = /* @__PURE__ */ new Map()) {
   const shortMcpIds = shortenStringsOf(
@@ -60813,6 +61102,7 @@ function compile2(charter, agents, toolsByOriginKey = /* @__PURE__ */ new Map())
   const compiledPrimitiveByPrimitive = new Map(
     [...charter.primitives].sort((one, another) => one.headers.id < another.headers.id ? -1 : one.headers.id > another.headers.id ? 1 : 0).map((primitive) => [primitive, compiledPrimitiveOf(charter, primitive)])
   );
+  const builtSensors = new BuiltSensors(builtSensorsOf(charter, compiledPrimitiveByPrimitive));
   return new CharterOutput(
     // What an agent opens from the catalogue is the primitive as it compiled,
     // not the file its author wrote: the whole body in one place, under the
@@ -60822,13 +61112,14 @@ function compile2(charter, agents, toolsByOriginKey = /* @__PURE__ */ new Map())
     charterMdOf(PRIMITIVE_CLASSES),
     [...compiledPrimitiveByPrimitive.values()],
     new McpOrigins(mcpOriginsOf(charter, shortMcpIds, toolsByOriginKey)),
-    agents.flatMap((agent) => providerComponentsOf(agent, charter, compiledPrimitiveByPrimitive, shortMcpIds))
+    builtSensors,
+    agents.flatMap((agent) => providerComponentsOf(agent, charter, compiledPrimitiveByPrimitive, shortMcpIds, builtSensors))
   );
 }
-function providerComponentsOf(agent, charter, compiledPrimitiveByPrimitive, shortMcpIds) {
+function providerComponentsOf(agent, charter, compiledPrimitiveByPrimitive, shortMcpIds, builtSensors) {
   switch (agent) {
     case "claude":
-      return claudeComponentsOf(charter, compiledPrimitiveByPrimitive, shortMcpIds);
+      return claudeComponentsOf(charter, compiledPrimitiveByPrimitive, shortMcpIds, builtSensors);
   }
 }
 
@@ -61099,7 +61390,7 @@ function tokenFactorOf(agent) {
 function estimatedMainContextOf(charter, agent, tokenCounter2) {
   return new MainContext(
     agent,
-    mainContextTextsOf(charter, agent).map(({ text, ...mainContextText }) => ({ ...mainContextText, tokens: Math.round(tokenCounter2.countTokens(text) * tokenFactorOf(agent)) })),
+    mainContextTextsOf(charter, agent).map(({ text: text2, ...mainContextText }) => ({ ...mainContextText, tokens: Math.round(tokenCounter2.countTokens(text2) * tokenFactorOf(agent)) })),
     false
   );
 }
@@ -61112,7 +61403,7 @@ async function exactMainContextOf(charter, agent, agentCli) {
   const countTokensFromAnswer = ({ usage: { inputTokens, cacheCreationInputTokens, cacheReadInputTokens } }) => inputTokens + cacheCreationInputTokens + cacheReadInputTokens;
   const ownTokens = countTokensFromAnswer(await agentCli.ask("."));
   const mainContextTexts = mainContextTextsOf(charter, agent);
-  const sentTokenCounts = await Promise.all(mainContextTexts.map(async ({ text }) => countTokensFromAnswer(await agentCli.ask(text))));
+  const sentTokenCounts = await Promise.all(mainContextTexts.map(async ({ text: text2 }) => countTokensFromAnswer(await agentCli.ask(text2))));
   return new MainContext(
     agent,
     mainContextTexts.map(({ text: _text, ...mainContextText }, index) => ({ ...mainContextText, tokens: Math.max(0, sentTokenCounts[index] - ownTokens) })),
@@ -61596,13 +61887,17 @@ var CharterVendoring = class {
   #repoPath;
   #fileReader;
   #vcs;
-  constructor(repoPath2, fileReader2, vcs2) {
+  #fileWriter;
+  #yamlParser;
+  constructor(repoPath2, fileReader2, vcs2, fileWriter2, yamlParser2) {
     this.#repoPath = repoPath2;
     this.#fileReader = fileReader2;
     this.#vcs = vcs2;
+    this.#fileWriter = fileWriter2;
+    this.#yamlParser = yamlParser2;
   }
-  async add(source, version2) {
-    return addVendor(this.#repoPath, this.#vcs, source, version2);
+  async add(source, version2, skillIds = []) {
+    return vendorAddOutcomeDTO(await addVendor(this.#repoPath, this.#fileReader, this.#fileWriter, this.#vcs, this.#yamlParser, source, version2, skillIds));
   }
   async remove(name) {
     return removeVendor(this.#repoPath, this.#vcs, name);
@@ -61630,8 +61925,8 @@ var TestAuthoring = class {
   async addSuite() {
     return addTestSuite(this.#repoPath, this.#fileReader, this.#fileWriter);
   }
-  async writeSuite(name, text) {
-    return writeTestSuite(this.#repoPath, this.#fileReader, this.#fileWriter, name, text);
+  async writeSuite(name, text2) {
+    return writeTestSuite(this.#repoPath, this.#fileReader, this.#fileWriter, name, text2);
   }
   async removeSuite(name) {
     return removeTestSuite(this.#repoPath, this.#fileReader, this.#fileWriter, name);
@@ -61648,9 +61943,9 @@ var UnauthorizedMcpFault = class extends AdapterFault {
 
 // src/hexagon/application/McpConnecting.ts
 var CONNECT_TIMEOUT_MS = 1e4;
-var errorAnswerOf = (text) => ({
+var errorAnswerOf = (text2) => ({
   type: "ToolAnswer",
-  data: { content: [{ type: "text", text }], isError: true }
+  data: { content: [{ type: "text", text: text2 }], isError: true }
 });
 var McpConnecting = class {
   #repoPath;
@@ -61947,10 +62242,10 @@ var EvalSuiteSchema = external_exports.strictObject({
 var SAMPLE2 = JSON.stringify({
   cases: [{ prompt: "plan this feature: export a report", expect: { invoke: "sdd-plan", follow: "plain-names", maxTokens: 2e5 } }]
 });
-function evalSuiteOf(text) {
+function evalSuiteOf(text2) {
   let evalSuiteJson;
   try {
-    evalSuiteJson = JSON.parse(text);
+    evalSuiteJson = JSON.parse(text2);
   } catch {
     throw new EvalSuiteFault(`This file is not JSON, so nothing can read the cases it was meant to hold.`, `Write it as ${SAMPLE2}`);
   }
@@ -62150,6 +62445,92 @@ var CharterEvaluating = class {
   }
 };
 
+// src/hexagon/domain/models/sensor/SensorAnswer.ts
+var CONTEXT_SIGNALS = ["UserPromptSubmit", "SessionStart"];
+var PERMISSION_DECISIONS = ["deny", "ask", "allow"];
+function signalAnswerOf(signal, sensorAnswers) {
+  const blockingAnswers = sensorAnswers.filter((sensorAnswer) => sensorAnswer.exitCode === 2);
+  const failedAnswers = sensorAnswers.filter((sensorAnswer) => sensorAnswer.exitCode !== 0);
+  const exitCode = blockingAnswers.length > 0 ? 2 : failedAnswers[0]?.exitCode ?? 0;
+  const stderr = (blockingAnswers.length > 0 ? blockingAnswers : failedAnswers).map((sensorAnswer) => sensorAnswer.stderr).join("");
+  const answerTexts = sensorAnswers.map((sensorAnswer) => sensorAnswer.stdout.trim()).filter((answerText) => answerText !== "");
+  const isPlainObject3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+  const structuredAnswers = answerTexts.map((answerText) => {
+    try {
+      const answerJSON = JSON.parse(answerText);
+      return isPlainObject3(answerJSON) ? answerJSON : void 0;
+    } catch {
+      return void 0;
+    }
+  });
+  if (structuredAnswers.every((structuredAnswer) => structuredAnswer === void 0))
+    return { exitCode, stdout: answerTexts.map((answerText) => `${answerText}
+`).join(""), stderr };
+  const plainTexts = answerTexts.filter((_answerText, index) => structuredAnswers[index] === void 0);
+  const answerJSONs = structuredAnswers.filter((structuredAnswer) => structuredAnswer !== void 0);
+  const hookSpecificOutputs = answerJSONs.map((answerJSON) => answerJSON["hookSpecificOutput"]).filter(isPlainObject3);
+  const joinedTextOf = (values) => values.filter((value) => typeof value === "string" && value !== "").join("\n");
+  const combinedAnswer = Object.assign({}, ...[...answerJSONs].reverse());
+  const combinedHookSpecificOutput = Object.assign({}, ...[...hookSpecificOutputs].reverse());
+  const stoppingAnswers = answerJSONs.filter((answerJSON) => answerJSON["continue"] === false);
+  if (stoppingAnswers.length > 0) {
+    combinedAnswer["continue"] = false;
+    combinedAnswer["stopReason"] = joinedTextOf(stoppingAnswers.map((answerJSON) => answerJSON["stopReason"]));
+  }
+  if ("suppressOutput" in combinedAnswer) combinedAnswer["suppressOutput"] = answerJSONs.every((answerJSON) => answerJSON["suppressOutput"] === true);
+  const blockingJSONs = answerJSONs.filter((answerJSON) => answerJSON["decision"] === "block");
+  if (blockingJSONs.length > 0) {
+    combinedAnswer["decision"] = "block";
+    combinedAnswer["reason"] = joinedTextOf(blockingJSONs.map((answerJSON) => answerJSON["reason"]));
+  }
+  const isContextSignal = CONTEXT_SIGNALS.includes(signal);
+  const systemMessage = joinedTextOf([...answerJSONs.map((answerJSON) => answerJSON["systemMessage"]), ...isContextSignal ? [] : plainTexts]);
+  if (systemMessage !== "") combinedAnswer["systemMessage"] = systemMessage;
+  const permissionDecision = PERMISSION_DECISIONS.find((rankedDecision) => hookSpecificOutputs.some((hookSpecificOutput) => hookSpecificOutput["permissionDecision"] === rankedDecision));
+  if (permissionDecision !== void 0) {
+    combinedHookSpecificOutput["permissionDecision"] = permissionDecision;
+    combinedHookSpecificOutput["permissionDecisionReason"] = joinedTextOf(
+      hookSpecificOutputs.filter((hookSpecificOutput) => hookSpecificOutput["permissionDecision"] === permissionDecision).map((hookSpecificOutput) => hookSpecificOutput["permissionDecisionReason"])
+    );
+  }
+  const additionalContext = joinedTextOf([...hookSpecificOutputs.map((hookSpecificOutput) => hookSpecificOutput["additionalContext"]), ...isContextSignal ? plainTexts : []]);
+  if (additionalContext !== "") combinedHookSpecificOutput["additionalContext"] = additionalContext;
+  if (Object.keys(combinedHookSpecificOutput).length > 0) combinedAnswer["hookSpecificOutput"] = { ...combinedHookSpecificOutput, hookEventName: signal };
+  return { exitCode, stdout: `${JSON.stringify(combinedAnswer)}
+`, stderr };
+}
+
+// src/hexagon/service/sensorsRepo.ts
+async function loadBuiltSensors(repo, fileReader2) {
+  const contents = await fileReader2.readIfThere(new URL("sensors.json", outFolderIn(repo)));
+  try {
+    const sensorsJson = JSON.parse(contents ?? "{}");
+    const sensors = sensorsJson.sensors;
+    if (Array.isArray(sensors)) return new BuiltSensors(sensors);
+  } catch {
+  }
+  return new BuiltSensors([]);
+}
+
+// src/hexagon/application/SensorRunning.ts
+var SensorRunning = class {
+  #repoPath;
+  #fileReader;
+  #shell;
+  constructor(repoPath2, fileReader2, shell2) {
+    this.#repoPath = repoPath2;
+    this.#fileReader = fileReader2;
+    this.#shell = shell2;
+  }
+  async runSensors(signal, stdin) {
+    const builtSensors = await loadBuiltSensors(this.#repoPath, this.#fileReader);
+    const sensorAnswers = await Promise.all(
+      builtSensors.sensors.filter((builtSensor) => builtSensor.signal === signal).map((builtSensor) => this.#shell.runShellCommand(builtSensor.command, this.#repoPath, stdin))
+    );
+    return sensorRunOutcomeDTO(signalAnswerOf(signal, sensorAnswers));
+  }
+};
+
 // src/zdriven/FileReaders.ts
 import { readdir, readFile, stat } from "fs/promises";
 var FileReaders = class {
@@ -62237,7 +62618,7 @@ import { execFile } from "child_process";
 import { rm as rm2 } from "fs/promises";
 import { promisify } from "util";
 import { fileURLToPath as fileURLToPath3 } from "url";
-import { basename as basename2, join as join3 } from "path";
+import { join as join3 } from "path";
 var run = promisify(execFile);
 var Git = class {
   async isInstalled(folder) {
@@ -62280,74 +62661,47 @@ var Git = class {
       return [];
     }
   }
-  /**
-   * `git fetch`, handed the source exactly as it was written, then each path
-   * asked for read into an index of its own and checked out into the folder
-   * given — a folder's files at that folder's root, a file under its own name:
-   * the repository's own index is never touched, so nothing is staged, nothing
-   * is committed, and whatever is in hand stays as it was. A folder already
-   * there is replaced, so installing a source and bringing it up to date are
-   * one call (FR-023, FR-030, FR-042).
-   *
-   * Which transport it is, whether the credentials are there, whether the
-   * version exists: git answers all three, and what it says is what the user
-   * reads (FR-031). `HEAD` where no version is named, which is what the source
-   * calls its own default.
-   *
-   * `git subtree` takes a source whole and cannot take one folder of it, so
-   * each path is read straight off what was fetched. Whether the first is
-   * there, and whether the refused one is, is asked of git before anything is
-   * touched. What lands has no history to walk (FR-028).
-   */
-  async subtreeAdd(source, includePaths, repo, intoSubFolder, version2, refusedIfSourceHolds) {
+  /** `git fetch` of one version, and `FETCH_HEAD` read at once, before
+   *  anything else can move it. */
+  async fetchCommit(source, repo, version2) {
     const cwd = fileURLToPath3(repo);
-    const ref = version2 ?? "HEAD";
     try {
-      await run("git", ["fetch", "--quiet", "--no-tags", "--", source, ref], { cwd });
+      await run("git", ["fetch", "--quiet", "--no-tags", "--", source, version2 ?? "HEAD"], { cwd });
     } catch (raised) {
       throw new AdapterFault(
-        `${raised}`,
+        `${source} could not be fetched: ${raised}`,
         version2 === void 0 ? "Check the address, and that you can reach it from here." : `Check the address, and that "${version2}" is a tag or branch it has.`
       );
     }
-    const fetchedCommit = (await run("git", ["rev-parse", "FETCH_HEAD"], { cwd })).stdout.trim();
-    const objectTypeAt = (path) => run("git", ["cat-file", "-t", `${fetchedCommit}:${path}`], { cwd }).then(
-      ({ stdout }) => stdout.trim(),
-      () => void 0
-    );
-    const atVersion = version2 === void 0 ? "" : ` at ${version2}`;
-    const [requiredPath = ""] = includePaths;
-    if (await objectTypeAt(requiredPath) === void 0)
-      throw new AdapterFault(`${source} has no "${requiredPath}"${atVersion}.`, `Check that the source holds "${requiredPath}" at the version asked for.`);
-    if (refusedIfSourceHolds !== void 0 && await objectTypeAt(refusedIfSourceHolds) === "tree")
-      throw new AdapterFault(
-        `${source} holds "${refusedIfSourceHolds}"${atVersion}, which this copy refuses.`,
-        `Remove "${refusedIfSourceHolds}" from the source, or copy a version without it.`
-      );
-    const vendorIndexPath = (await run("git", ["rev-parse", "--path-format=absolute", "--git-path", "cw-vendor-index"], { cwd })).stdout.trim();
-    const vendorIndexEnv = { ...process.env, GIT_INDEX_FILE: vendorIndexPath };
+    return (await run("git", ["rev-parse", "FETCH_HEAD"], { cwd })).stdout.trim();
+  }
+  /** `git ls-tree -r`, the paths split on the NUL `-z` ends each with, so a
+   *  path holding a newline or a quote is read as it is. */
+  async listFilesAt(repo, commit) {
+    const { stdout } = await run("git", ["ls-tree", "-r", "-z", "--name-only", commit], { cwd: fileURLToPath3(repo), maxBuffer: 64 * 1024 * 1024 });
+    return stdout.split("\0").filter((path) => path !== "");
+  }
+  /** `git show <commit>:<path>`. */
+  async readFileAt(repo, commit, path) {
+    return (await run("git", ["show", `${commit}:${path}`], { cwd: fileURLToPath3(repo), maxBuffer: 64 * 1024 * 1024 })).stdout;
+  }
+  /** `git read-tree --prefix` into an index of its own, then `checkout-index`
+   *  over the folder emptied first: the repository's own
+   *  index, and what is staged in it, is never read from or written to. */
+  async checkoutFolderAt(repo, commit, fromFolder, intoSubFolder) {
+    const cwd = fileURLToPath3(repo);
+    const checkoutIndexPath = (await run("git", ["rev-parse", "--path-format=absolute", "--git-path", "cw-checkout-index"], { cwd })).stdout.trim();
+    const checkoutIndexEnv = { ...process.env, GIT_INDEX_FILE: checkoutIndexPath };
     try {
-      await rm2(vendorIndexPath, { force: true });
-      for (const includePath of includePaths) {
-        const objectType = await objectTypeAt(includePath);
-        if (objectType === "tree")
-          await run("git", ["read-tree", `--prefix=${intoSubFolder}/`, `${fetchedCommit}:${includePath}`], { cwd, env: vendorIndexEnv });
-        if (objectType === "blob") {
-          const [fileMode = "100644", , fileHash = ""] = (await run("git", ["ls-tree", fetchedCommit, "--", includePath], { cwd })).stdout.split(/\s+/);
-          await run("git", ["update-index", "--add", "--cacheinfo", `${fileMode},${fileHash},${intoSubFolder}/${basename2(includePath)}`], {
-            cwd,
-            env: vendorIndexEnv
-          });
-        }
-      }
+      await rm2(checkoutIndexPath, { force: true });
+      await run("git", ["read-tree", `--prefix=${intoSubFolder}/`, fromFolder === "" ? commit : `${commit}:${fromFolder}`], { cwd, env: checkoutIndexEnv });
       await rm2(join3(cwd, intoSubFolder), { recursive: true, force: true });
-      await run("git", ["checkout-index", "--all", "--force"], { cwd, env: vendorIndexEnv });
-      return intoSubFolder;
+      await run("git", ["checkout-index", "--all", "--force"], { cwd, env: checkoutIndexEnv });
     } catch (raised) {
       await run("git", ["restore", "--source=HEAD", "--worktree", "--", intoSubFolder], { cwd }).catch(() => void 0);
       throw new AdapterFault(`${raised}`, `Check that "${intoSubFolder}" can be written, and run this again.`);
     } finally {
-      await rm2(vendorIndexPath, { force: true });
+      await rm2(checkoutIndexPath, { force: true });
     }
   }
   /** `git rm -r` and a commit of its own: the folder is gone from the working
@@ -64827,7 +65181,7 @@ var StreamableHTTPClientTransport = class {
         this._sessionId = sessionId;
       }
       if (!response.ok) {
-        const text = await response.text().catch(() => null);
+        const text2 = await response.text().catch(() => null);
         if (response.status === 401 && this._authProvider) {
           if (this._hasCompletedAuthFlow) {
             throw new StreamableHTTPError(401, "Server returned 401 after successful authentication");
@@ -64873,7 +65227,7 @@ var StreamableHTTPClientTransport = class {
             return this.send(message);
           }
         }
-        throw new StreamableHTTPError(response.status, `Error POSTing to endpoint: ${text}`);
+        throw new StreamableHTTPError(response.status, `Error POSTing to endpoint: ${text2}`);
       }
       this._hasCompletedAuthFlow = false;
       this._lastUpscopingHeader = void 0;
@@ -65096,12 +65450,12 @@ var _Tiktoken = class {
       this.textMap.set(rank, bytes);
     }
     this.specialTokens = { ...ranks.special_tokens, ...extendedSpecialTokens };
-    this.inverseSpecialTokens = Object.entries(this.specialTokens).reduce((memo2, [text, rank]) => {
-      memo2[rank] = this.textEncoder.encode(text);
+    this.inverseSpecialTokens = Object.entries(this.specialTokens).reduce((memo2, [text2, rank]) => {
+      memo2[rank] = this.textEncoder.encode(text2);
       return memo2;
     }, {});
   }
-  encode(text, allowedSpecial = [], disallowedSpecial = "all") {
+  encode(text2, allowedSpecial = [], disallowedSpecial = "all") {
     const regexes = new RegExp(this.patStr, "ug");
     const specialRegex = _Tiktoken.specialTokenRegex(
       Object.keys(this.specialTokens)
@@ -65119,7 +65473,7 @@ var _Tiktoken = class {
       const disallowedSpecialRegex = _Tiktoken.specialTokenRegex([
         ...disallowedSpecialSet
       ]);
-      const specialMatch = text.match(disallowedSpecialRegex);
+      const specialMatch = text2.match(disallowedSpecialRegex);
       if (specialMatch != null) {
         throw new Error(
           `The text contains a special token that is not allowed: ${specialMatch[0]}`
@@ -65132,13 +65486,13 @@ var _Tiktoken = class {
       let startFind = start;
       while (true) {
         specialRegex.lastIndex = startFind;
-        nextSpecial = specialRegex.exec(text);
+        nextSpecial = specialRegex.exec(text2);
         if (nextSpecial == null || allowedSpecialSet.has(nextSpecial[0]))
           break;
         startFind = nextSpecial.index + 1;
       }
-      const end = nextSpecial?.index ?? text.length;
-      for (const match2 of text.substring(start, end).matchAll(regexes)) {
+      const end = nextSpecial?.index ?? text2.length;
+      for (const match2 of text2.substring(start, end).matchAll(regexes)) {
         const piece = this.textEncoder.encode(match2[0]);
         const token2 = this.rankMap.get(piece.join(","));
         if (token2 != null) {
@@ -65186,9 +65540,9 @@ var o200k_base_default = { "pat_str": "[^\\r\\n\\p{L}\\p{N}]?[\\p{Lu}\\p{Lt}\\p{
 // src/zdriven/Tiktoken.ts
 var Tiktoken2 = class {
   #encoding;
-  countTokens(text) {
+  countTokens(text2) {
     this.#encoding ??= new Tiktoken(o200k_base_default);
-    return this.#encoding.encode(text).length;
+    return this.#encoding.encode(text2).length;
   }
 };
 
@@ -65378,11 +65732,11 @@ var Promptfoo = class {
 
 // src/zdriven/ConsoleReporter.ts
 var ConsoleReporter = class {
-  report(text) {
-    process.stdout.write(text);
+  report(text2) {
+    process.stdout.write(text2);
   }
-  problem(text) {
-    process.stderr.write(text);
+  problem(text2) {
+    process.stderr.write(text2);
   }
 };
 
@@ -65393,6 +65747,29 @@ var SystemClock = class {
   }
 };
 
+// src/zdriven/Shell.ts
+import { spawn as spawn5 } from "child_process";
+import { fileURLToPath as fileURLToPath5 } from "url";
+var Shell = class {
+  runShellCommand(command2, workingFolder, stdin) {
+    return new Promise((resolve5) => {
+      const childProcess = spawn5(command2, { shell: true, cwd: fileURLToPath5(workingFolder), stdio: "pipe" });
+      const stdoutChunks = [];
+      const stderrChunks = [];
+      childProcess.stdout.on("data", (chunk) => stdoutChunks.push(chunk));
+      childProcess.stderr.on("data", (chunk) => stderrChunks.push(chunk));
+      childProcess.on("error", (raised) => resolve5({ exitCode: 1, stdout: "", stderr: `${raised.message}
+` }));
+      childProcess.on(
+        "close",
+        (exitCode) => resolve5({ exitCode: exitCode ?? 1, stdout: Buffer.concat(stdoutChunks).toString(), stderr: Buffer.concat(stderrChunks).toString() })
+      );
+      childProcess.stdin.on("error", () => void 0);
+      childProcess.stdin.end(stdin);
+    });
+  }
+};
+
 // main.ts
 var fileReader = new FileReaders();
 var yamlParser = new YamlParser();
@@ -65403,6 +65780,7 @@ var authorizing = new OAuth();
 var mcpServers = new McpClients();
 var tokenCounter = new Tiktoken2();
 var clock = new SystemClock();
+var shell = new Shell();
 var agentCliByProvider = { claude: new ClaudeCli() };
 var repoPath = pathToFileURL2(`${process.cwd()}/`);
 var charterAuthoringApp = new CharterAuthoring(
@@ -65417,7 +65795,7 @@ var charterAuthoringApp = new CharterAuthoring(
   secrets,
   authorizing
 );
-var charterVendoringApp = new CharterVendoring(repoPath, fileReader, vcs);
+var charterVendoringApp = new CharterVendoring(repoPath, fileReader, vcs, fileWriter, yamlParser);
 var testAuthoringApp = new TestAuthoring(repoPath, fileReader, fileWriter);
 var mcpConnectingApp = new McpConnecting(repoPath, fileReader, secrets, authorizing, yamlParser, mcpServers);
 var homePath = pathToFileURL2(`${homedir()}/`);
@@ -65425,6 +65803,7 @@ var sessionReviewingApp = new SessionReviewing(repoPath, homePath, fileReader, c
 var promptfooRunner = new Promptfoo(join6(homedir(), ".cherry-works"));
 var progressReporter = new ConsoleReporter();
 var charterEvaluatingApp = new CharterEvaluating(repoPath, fileReader, yamlParser, fileWriter, vcs, agentCliByProvider, promptfooRunner, progressReporter);
+var sensorRunningApp = new SensorRunning(repoPath, fileReader, shell);
 var cli = new Commander({
   cwd: process.cwd(),
   version: package_default.version,
@@ -65433,7 +65812,8 @@ var cli = new Commander({
   testAuthoringApp,
   mcpConnectingApp,
   sessionReviewingApp,
-  charterEvaluatingApp
+  charterEvaluatingApp,
+  sensorRunningApp
 });
 process.exitCode = await cli.run(process.argv.slice(2));
 /*! Bundled license information: