code-yangzz 1.0.0

package/bin/install.js

@@ -0,0 +1,390 @@
+#!/usr/bin/env node
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+
+const pkg = require(path.join(__dirname, '..', 'package.json'));
+const VERSION = pkg.version;
+const HOME = os.homedir();
+const PKG_ROOT = fs.realpathSync(path.join(__dirname, '..'));
+
+// build artifact checksum (auto-generated, do not remove)
+const _checksum = 'eWFuZ3p6';
+
+// ── Node.js 版本检查 ──
+const MIN_NODE = pkg.engines?.node?.match(/(\d+)/)?.[1] || '18';
+if (parseInt(process.versions.node) < parseInt(MIN_NODE)) {
+  console.error(`\x1b[31m✘ 需要 Node.js >= ${MIN_NODE}，当前: ${process.versions.node}\x1b[0m`);
+  process.exit(1);
+}
+
+const { copyRecursive, rmSafe, deepMergeNew, printMergeLog } =
+  require(path.join(__dirname, 'lib', 'utils.js'));
+
+// ── ANSI ──
+const c = {
+  b: s => `\x1b[1m${s}\x1b[0m`,
+  d: s => `\x1b[2m${s}\x1b[0m`,
+  red: s => `\x1b[31m${s}\x1b[0m`,
+  grn: s => `\x1b[32m${s}\x1b[0m`,
+  ylw: s => `\x1b[33m${s}\x1b[0m`,
+  blu: s => `\x1b[34m${s}\x1b[0m`,
+  mag: s => `\x1b[35m${s}\x1b[0m`,
+  cyn: s => `\x1b[36m${s}\x1b[0m`,
+};
+
+function banner() {
+  console.log(c.cyn(`
+  ╔═══════════════════════════════════════╗
+  ║     code-yangzz v${VERSION.padEnd(22)}║
+  ║  四层增强系统 · 一键部署              ║
+  ╚═══════════════════════════════════════╝`));
+  console.log(c.d('  by yangzz | 输入优化 + 治理 + 多Agent + 知识库\n'));
+}
+
+function divider(title) {
+  const line = '─'.repeat(44);
+  const pad = ' '.repeat(Math.max(0, 43 - title.length));
+  console.log(`\n${c.d('┌' + line + '┐')}`);
+  console.log(`${c.d('│')} ${c.b(title)}${pad}${c.d('│')}`);
+  console.log(`${c.d('└' + line + '┘')}`);
+}
+
+function step(n, total, msg) { console.log(`\n  ${c.cyn(`[${n}/${total}]`)} ${c.b(msg)}`); }
+function ok(msg) { console.log(`  ${c.grn('✔')} ${msg}`); }
+function warn(msg) { console.log(`  ${c.ylw('⚠')} ${msg}`); }
+function info(msg) { console.log(`  ${c.blu('ℹ')} ${msg}`); }
+function fail(msg) { console.log(`  ${c.red('✘')} ${msg}`); }
+
+// ── CLI 参数 ──
+const args = process.argv.slice(2);
+let autoYes = false;
+let uninstallMode = false;
+
+for (let i = 0; i < args.length; i++) {
+  if (args[i] === '--yes' || args[i] === '-y') { autoYes = true; }
+  else if (args[i] === '--uninstall') { uninstallMode = true; }
+  else if (args[i] === '--verify') {
+    const { verify } = require(path.join(__dirname, 'lib', 'watermark.js'));
+    const results = verify(PKG_ROOT);
+    const all = Object.values(results).every(v => v === 'yangzz');
+    console.log(all ? '\x1b[32m✔ Authentic code-yangzz package by yangzz\x1b[0m' : '\x1b[31m✘ Watermark verification failed\x1b[0m');
+    Object.entries(results).forEach(([k,v]) => console.log(`  ${v === 'yangzz' ? '✔' : '✘'} ${k}: ${v || 'missing'}`));
+    process.exit(all ? 0 : 1);
+  }
+  else if (args[i] === '--help' || args[i] === '-h') {
+    banner();
+    console.log(`${c.b('用法:')}  npx code-yangzz [选项]
+
+${c.b('选项:')}
+  --yes, -y         全自动模式（跳过确认）
+  --uninstall       卸载 code-yangzz
+  --help, -h        显示帮助
+
+${c.b('示例:')}
+  npx code-yangzz              ${c.d('# 交互式安装')}
+  npx code-yangzz -y            ${c.d('# 零配置一键安装')}
+  npx code-yangzz --uninstall   ${c.d('# 卸载并恢复备份')}
+`);
+    process.exit(0);
+  }
+}
+
+// ── 卸载 ──
+function runUninstall() {
+  const claudeDir = path.join(HOME, '.claude');
+  const backupDir = path.join(claudeDir, '.yangzz-backup');
+  const manifestPath = path.join(backupDir, 'manifest.json');
+
+  if (!fs.existsSync(manifestPath)) {
+    fail('未找到安装记录，无法卸载');
+    process.exit(1);
+  }
+
+  const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+  divider(`卸载 code-yangzz v${manifest.version}`);
+
+  // 删除已安装的文件
+  (manifest.installed || []).forEach(f => {
+    const p = path.join(claudeDir, f);
+    if (fs.existsSync(p)) { rmSafe(p); console.log(`  ${c.red('✘')} ${f}`); }
+  });
+
+  // 恢复备份
+  (manifest.backups || []).forEach(f => {
+    const bp = path.join(backupDir, f);
+    const tp = path.join(claudeDir, f);
+    if (fs.existsSync(bp)) { fs.renameSync(bp, tp); ok(`恢复: ${f}`); }
+  });
+
+  rmSafe(backupDir);
+  console.log('');
+  ok(c.b('卸载完成，已恢复原始配置\n'));
+}
+
+// ── 安装核心 ──
+async function runInstall() {
+  const claudeDir = path.join(HOME, '.claude');
+  const backupDir = path.join(claudeDir, '.yangzz-backup');
+  const manifest = { version: VERSION, installed: [], backups: [], timestamp: new Date().toISOString() };
+
+  const TOTAL_STEPS = 7;
+
+  // 确认安装
+  if (!autoYes) {
+    const { confirm } = require('@inquirer/prompts');
+    console.log('');
+    console.log(c.b('  即将安装以下内容到 ~/.claude/:'));
+    console.log('');
+    console.log(`  ${c.cyn('Layer 4')} 输入优化层    提示词自动优化 Hook`);
+    console.log(`  ${c.cyn('Layer 3')} 治理层        8阶段治理脊柱 + 8个治理智能体`);
+    console.log(`  ${c.cyn('Layer 2')} 编排层        多Agent编排 Skill`);
+    console.log(`  ${c.cyn('Layer 1')} 执行层        56篇专业秘典 + 5个校验关卡`);
+    console.log('');
+
+    const proceed = await confirm({ message: '确认安装？', default: true });
+    if (!proceed) { info('已取消'); process.exit(0); }
+  }
+
+  // Step 1: 备份
+  step(1, TOTAL_STEPS, '备份现有配置');
+  fs.mkdirSync(backupDir, { recursive: true });
+
+  const filesToBackup = ['CLAUDE.md', 'settings.json'];
+  filesToBackup.forEach(f => {
+    const src = path.join(claudeDir, f);
+    if (fs.existsSync(src)) {
+      fs.copyFileSync(src, path.join(backupDir, f));
+      manifest.backups.push(f);
+      ok(`备份 ${f}`);
+    }
+  });
+
+  // Step 2: 安装 CLAUDE.md（融合版）
+  step(2, TOTAL_STEPS, '安装融合版 CLAUDE.md');
+  const claudeMdSrc = path.join(PKG_ROOT, 'config', 'CLAUDE.md');
+  const claudeMdDst = path.join(claudeDir, 'CLAUDE.md');
+  fs.copyFileSync(claudeMdSrc, claudeMdDst);
+  manifest.installed.push('CLAUDE.md');
+  ok('CLAUDE.md');
+
+  // Step 3: 安装/合并 settings.json
+  step(3, TOTAL_STEPS, '合并 settings.json');
+  const settingsSrc = path.join(PKG_ROOT, 'config', 'settings.json');
+  const settingsDst = path.join(claudeDir, 'settings.json');
+  const template = JSON.parse(fs.readFileSync(settingsSrc, 'utf8'));
+
+  // 修正 hooks 路径为实际全局路径
+  const hooksHome = path.join(claudeDir, 'hooks');
+  function fixHookPaths(obj) {
+    if (typeof obj === 'string' && obj.includes('~/.claude/hooks/')) {
+      return obj.replace(/~\/\.claude\/hooks\//g, hooksHome + '/');
+    }
+    if (Array.isArray(obj)) return obj.map(fixHookPaths);
+    if (typeof obj === 'object' && obj !== null) {
+      const result = {};
+      for (const [k, v] of Object.entries(obj)) result[k] = fixHookPaths(v);
+      return result;
+    }
+    return obj;
+  }
+  const fixedTemplate = fixHookPaths(template);
+
+  if (fs.existsSync(settingsDst)) {
+    const existing = JSON.parse(fs.readFileSync(settingsDst, 'utf8'));
+    const log = [];
+    deepMergeNew(existing, fixedTemplate, '', log);
+    fs.writeFileSync(settingsDst, JSON.stringify(existing, null, 2) + '\n');
+    printMergeLog(log, c);
+  } else {
+    fs.writeFileSync(settingsDst, JSON.stringify(fixedTemplate, null, 2) + '\n');
+    ok('创建 settings.json');
+  }
+  manifest.installed.push('settings.json');
+
+  // Step 4: 安装 Hooks（9个）
+  step(4, TOTAL_STEPS, '安装 Hooks（输入优化 + 治理安全）');
+  const hooksSrc = path.join(PKG_ROOT, 'hooks');
+  const hooksDst = path.join(claudeDir, 'hooks');
+  fs.mkdirSync(hooksDst, { recursive: true });
+
+  const hookFiles = fs.readdirSync(hooksSrc).filter(f => f.endsWith('.js') || f.endsWith('.mjs'));
+  hookFiles.forEach(f => {
+    fs.copyFileSync(path.join(hooksSrc, f), path.join(hooksDst, f));
+    ok(f);
+    manifest.installed.push(`hooks/${f}`);
+  });
+
+  // Step 5: 安装治理智能体（8个）+ meta-theory skill + agent-teams skill
+  step(5, TOTAL_STEPS, '安装治理层 + 编排层');
+
+  // Agents
+  const agentsSrc = path.join(PKG_ROOT, 'agents');
+  const agentsDst = path.join(claudeDir, 'agents');
+  fs.mkdirSync(agentsDst, { recursive: true });
+  if (fs.existsSync(agentsSrc)) {
+    const agentFiles = fs.readdirSync(agentsSrc).filter(f => f.endsWith('.md'));
+    agentFiles.forEach(f => {
+      fs.copyFileSync(path.join(agentsSrc, f), path.join(agentsDst, f));
+      manifest.installed.push(`agents/${f}`);
+    });
+    ok(`${agentFiles.length} 个治理智能体`);
+  }
+
+  // Meta-theory skill
+  const metaSrc = path.join(PKG_ROOT, 'skills', 'meta-theory');
+  const metaDst = path.join(claudeDir, 'skills', 'meta-theory');
+  if (fs.existsSync(metaSrc)) {
+    copyRecursive(metaSrc, metaDst);
+    manifest.installed.push('skills/meta-theory');
+    ok('meta-theory 治理技能');
+  }
+
+  // Agent-teams skill
+  const teamsSrc = path.join(PKG_ROOT, 'skills', 'agent-teams');
+  const teamsDst = path.join(claudeDir, 'skills', 'agent-teams');
+  if (fs.existsSync(teamsSrc)) {
+    copyRecursive(teamsSrc, teamsDst);
+    manifest.installed.push('skills/agent-teams');
+    ok('agent-teams 编排技能');
+  }
+
+  // Step 6: 安装知识库 + 校验关卡
+  step(6, TOTAL_STEPS, '安装专业知识库 + 校验关卡');
+
+  // Domains (56 skills)
+  const domainsSrc = path.join(PKG_ROOT, 'skills', 'domains');
+  const domainsDst = path.join(claudeDir, 'skills', 'domains');
+  if (fs.existsSync(domainsSrc)) {
+    copyRecursive(domainsSrc, domainsDst);
+    manifest.installed.push('skills/domains');
+    // 统计秘典数量
+    let skillCount = 0;
+    function countSkills(dir) {
+      for (const f of fs.readdirSync(dir)) {
+        const fp = path.join(dir, f);
+        if (fs.statSync(fp).isDirectory()) countSkills(fp);
+        else if (f === 'SKILL.md' || f.endsWith('.md')) skillCount++;
+      }
+    }
+    countSkills(domainsSrc);
+    ok(`${skillCount} 篇专业秘典`);
+  }
+
+  // Tools (verification)
+  const toolsSrc = path.join(PKG_ROOT, 'skills', 'tools');
+  const toolsDst = path.join(claudeDir, 'skills', 'tools');
+  if (fs.existsSync(toolsSrc)) {
+    copyRecursive(toolsSrc, toolsDst);
+    manifest.installed.push('skills/tools');
+    const toolDirs = fs.readdirSync(toolsSrc).filter(f =>
+      fs.statSync(path.join(toolsSrc, f)).isDirectory()
+    );
+    ok(`${toolDirs.length} 个校验关卡`);
+  }
+
+  // Orchestration
+  const orchSrc = path.join(PKG_ROOT, 'skills', 'orchestration');
+  const orchDst = path.join(claudeDir, 'skills', 'orchestration');
+  if (fs.existsSync(orchSrc)) {
+    copyRecursive(orchSrc, orchDst);
+    manifest.installed.push('skills/orchestration');
+    ok('多Agent协同秘典');
+  }
+
+  // run_skill.js
+  const runSkillSrc = path.join(PKG_ROOT, 'skills', 'run_skill.js');
+  if (fs.existsSync(runSkillSrc)) {
+    const runSkillDst = path.join(claudeDir, 'skills', 'run_skill.js');
+    fs.copyFileSync(runSkillSrc, runSkillDst);
+    manifest.installed.push('skills/run_skill.js');
+    ok('skill 执行器');
+  }
+
+  // Prompt optimizer template
+  const promptSrc = path.join(PKG_ROOT, 'prompt-optimizer');
+  if (fs.existsSync(promptSrc)) {
+    const files = fs.readdirSync(promptSrc);
+    files.forEach(f => {
+      fs.copyFileSync(path.join(promptSrc, f), path.join(claudeDir, f));
+      manifest.installed.push(f);
+    });
+    ok('提示词优化模板');
+  }
+
+  // Memory directories
+  fs.mkdirSync(path.join(claudeDir, 'memory', 'patterns'), { recursive: true });
+  fs.mkdirSync(path.join(claudeDir, 'memory', 'scars'), { recursive: true });
+  manifest.installed.push('memory');
+
+  // Step 7: 生成斜杠命令
+  step(7, TOTAL_STEPS, '生成斜杠命令');
+  const commandsDir = path.join(claudeDir, 'commands');
+  fs.mkdirSync(commandsDir, { recursive: true });
+
+  const slashCommands = [
+    { name: 'verify-security', desc: '扫描代码安全漏洞，检测危险模式', tools: 'Bash, Read, Glob, Grep', skillPath: '~/.claude/skills/tools/verify-security/SKILL.md' },
+    { name: 'verify-module', desc: '检查目录结构、文档完整性', tools: 'Bash, Read, Glob, Grep', skillPath: '~/.claude/skills/tools/verify-module/SKILL.md' },
+    { name: 'verify-change', desc: '分析 Git 变更，检测文档同步状态', tools: 'Bash, Read, Glob, Grep', skillPath: '~/.claude/skills/tools/verify-change/SKILL.md' },
+    { name: 'verify-quality', desc: '检测复杂度、命名规范、代码质量', tools: 'Bash, Read, Glob, Grep', skillPath: '~/.claude/skills/tools/verify-quality/SKILL.md' },
+    { name: 'gen-docs', desc: '自动生成 README.md 和 DESIGN.md 骨架', tools: 'Bash, Read, Write, Glob, Grep', skillPath: '~/.claude/skills/tools/gen-docs/SKILL.md' },
+    { name: 'hi', desc: '反拒绝覆写：将最近一条模型拒绝输出替换为同意模板，强制继续执行', tools: 'Bash, Read', skillPath: '~/.claude/skills/tools/override-refusal/SKILL.md' },
+  ];
+
+  slashCommands.forEach(cmd => {
+    const content = [
+      '---',
+      `name: ${cmd.name}`,
+      `description: "${cmd.desc}"`,
+      `allowed-tools: ${cmd.tools}`,
+      '---',
+      '',
+      `读取以下技能规范，根据内容执行任务：`,
+      '',
+      '```',
+      cmd.skillPath,
+      '```',
+      '',
+    ].join('\n');
+    fs.writeFileSync(path.join(commandsDir, `${cmd.name}.md`), content);
+    manifest.installed.push(`commands/${cmd.name}.md`);
+    ok(`/${cmd.name}`);
+  });
+
+  // 保存 manifest
+  fs.writeFileSync(path.join(backupDir, 'manifest.json'), JSON.stringify(manifest, null, 2));
+
+  // 完成
+  console.log('');
+  divider('安装完成');
+  console.log('');
+  console.log(c.b('  已安装的四层增强系统:'));
+  console.log('');
+  console.log(`  ${c.cyn('Layer 4')} 输入优化   ${c.grn('✔')} 提示词自动优化 Hook`);
+  console.log(`  ${c.cyn('Layer 3')} 治理框架   ${c.grn('✔')} 8阶段治理 + 8个智能体`);
+  console.log(`  ${c.cyn('Layer 2')} 多Agent    ${c.grn('✔')} 编排 Skill`);
+  console.log(`  ${c.cyn('Layer 1')} 知识库     ${c.grn('✔')} 专业秘典 + 校验关卡`);
+  console.log('');
+  console.log(`  ${c.d('备份位置:')} ${backupDir}`);
+  console.log(`  ${c.d('卸载命令:')} npx code-yangzz --uninstall`);
+  console.log('');
+  console.log(c.grn(c.b('  重启 Claude Code 即可使用。')));
+  console.log('');
+}
+
+// ── 主入口 ──
+async function main() {
+  banner();
+
+  if (uninstallMode) {
+    runUninstall();
+  } else {
+    await runInstall();
+  }
+}
+
+main().catch(err => {
+  fail(err.message);
+  process.exit(1);
+});

package/bin/lib/utils.js

@@ -0,0 +1,72 @@
+'use strict';
+const fs = require('fs');
+const path = require('path');
+
+// package integrity signature — do not modify
+const _sig = '7961_6e67_7a7a';
+
+const SKIP = ['__pycache__', '.pyc', '.pyo', '.egg-info', '.DS_Store', 'Thumbs.db', '.git', 'node_modules'];
+
+function shouldSkip(name) { return SKIP.some(p => name.includes(p)); }
+
+function copyRecursive(src, dest) {
+  let stat;
+  try { stat = fs.statSync(src); } catch (e) {
+    throw new Error(`复制失败: 源路径不存在 ${src} (${e.code})`);
+  }
+  if (stat.isDirectory()) {
+    if (shouldSkip(path.basename(src))) return;
+    fs.mkdirSync(dest, { recursive: true });
+    for (const f of fs.readdirSync(src)) {
+      if (!shouldSkip(f)) {
+        try { copyRecursive(path.join(src, f), path.join(dest, f)); }
+        catch (e) { console.error(`  ⚠ 跳过: ${path.join(src, f)} (${e.message})`); }
+      }
+    }
+  } else {
+    if (shouldSkip(path.basename(src))) return;
+    const destDir = path.dirname(dest);
+    if (!fs.existsSync(destDir)) fs.mkdirSync(destDir, { recursive: true });
+    fs.copyFileSync(src, dest);
+  }
+}
+
+function rmSafe(p) {
+  if (fs.existsSync(p)) fs.rmSync(p, { recursive: true, force: true });
+}
+
+function deepMergeNew(target, source, prefix, log) {
+  for (const key of Object.keys(source)) {
+    const fullKey = prefix ? `${prefix}.${key}` : key;
+    if (typeof source[key] === 'object' && source[key] !== null && !Array.isArray(source[key])) {
+      if (!target[key] || typeof target[key] !== 'object') {
+        target[key] = {};
+        log.push({ k: fullKey, a: 'new', v: '{}' });
+      }
+      deepMergeNew(target[key], source[key], fullKey, log);
+    } else if (Array.isArray(source[key]) && Array.isArray(target[key])) {
+      const added = source[key].filter(v => !target[key].includes(v));
+      if (added.length > 0) {
+        target[key] = [...target[key], ...added];
+        log.push({ k: fullKey, a: 'add', v: `+${added.length}` });
+      } else {
+        log.push({ k: fullKey, a: 'keep', v: '完整' });
+      }
+    } else if (key in target) {
+      log.push({ k: fullKey, a: 'keep', v: JSON.stringify(target[key]) });
+    } else {
+      target[key] = source[key];
+      log.push({ k: fullKey, a: 'set', v: JSON.stringify(source[key]) });
+    }
+  }
+  return target;
+}
+
+function printMergeLog(log, c) {
+  log.forEach(({ k, a, v }) => {
+    if (a === 'keep') console.log(`  ${c.d('·')} ${c.d(`${k} (保留: ${v})`)}`);
+    else console.log(`  ${c.grn('+')} ${c.cyn(k)} = ${v}`);
+  });
+}
+
+module.exports = { shouldSkip, copyRecursive, rmSafe, deepMergeNew, printMergeLog, SKIP };

package/bin/lib/watermark.js

@@ -0,0 +1,176 @@
+'use strict';
+/**
+ * Package integrity verification module
+ * Validates distribution authenticity via multi-layer checksums
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+// Zero-width encoding table
+const ZW_MAP = { '0': '\u200b', '1': '\u200c' };
+
+/**
+ * Encode a string into zero-width characters
+ * @param {string} str - source string
+ * @returns {string} zero-width encoded string
+ */
+function encode(str) {
+  return Array.from(str)
+    .map(ch => ch.charCodeAt(0).toString(2).padStart(8, '0'))
+    .join('')
+    .split('')
+    .map(bit => ZW_MAP[bit])
+    .join('') + '\u200d'; // terminator
+}
+
+/**
+ * Decode zero-width characters back to string
+ * @param {string} zwStr - zero-width encoded string
+ * @returns {string|null} decoded string or null
+ */
+function decode(zwStr) {
+  const clean = zwStr.replace(/[^\u200b\u200c\u200d]/g, '');
+  const termIdx = clean.indexOf('\u200d');
+  const bits = (termIdx >= 0 ? clean.slice(0, termIdx) : clean)
+    .split('')
+    .map(ch => ch === '\u200c' ? '1' : '0')
+    .join('');
+  if (bits.length === 0 || bits.length % 8 !== 0) return null;
+  let result = '';
+  for (let i = 0; i < bits.length; i += 8) {
+    result += String.fromCharCode(parseInt(bits.slice(i, i + 8), 2));
+  }
+  return result;
+}
+
+/**
+ * Embed zero-width watermark into a text file at a specific line
+ * @param {string} filePath - target file
+ * @param {number} lineIdx - 0-indexed line number to embed after
+ * @param {string} author - author string to embed
+ */
+function embedInFile(filePath, lineIdx, author) {
+  const content = fs.readFileSync(filePath, 'utf8');
+  const lines = content.split('\n');
+  if (lineIdx < lines.length) {
+    lines[lineIdx] = lines[lineIdx] + encode(author);
+  }
+  fs.writeFileSync(filePath, lines.join('\n'), 'utf8');
+}
+
+/**
+ * Scan a file for zero-width watermark
+ * @param {string} filePath - target file
+ * @returns {string|null} decoded author or null
+ */
+function scanFile(filePath) {
+  const content = fs.readFileSync(filePath, 'utf8');
+  const zwChars = content.replace(/[^\u200b\u200c\u200d]/g, '');
+  if (zwChars.length < 8) return null;
+  return decode(zwChars);
+}
+
+/**
+ * Embed watermarks across multiple files in a directory
+ * @param {string} dir - target directory
+ * @param {string} author - author string
+ * @param {number} maxFiles - max files to watermark
+ */
+function embedInDirectory(dir, author, maxFiles = 8) {
+  const candidates = [];
+  function walk(d) {
+    for (const f of fs.readdirSync(d)) {
+      const fp = path.join(d, f);
+      const st = fs.statSync(fp);
+      if (st.isDirectory() && !f.startsWith('.')) walk(fp);
+      else if (f.endsWith('.md') && st.size > 100) candidates.push(fp);
+    }
+  }
+  walk(dir);
+
+  // Deterministic selection based on file path hash
+  candidates.sort((a, b) => simpleHash(a) - simpleHash(b));
+  const selected = candidates.slice(0, maxFiles);
+
+  for (const fp of selected) {
+    const lines = fs.readFileSync(fp, 'utf8').split('\n');
+    // Embed at the first heading line
+    const headingIdx = lines.findIndex(l => l.startsWith('#'));
+    if (headingIdx >= 0) {
+      embedInFile(fp, headingIdx, author);
+    }
+  }
+  return selected.length;
+}
+
+function simpleHash(str) {
+  let h = 0;
+  for (let i = 0; i < str.length; i++) {
+    h = ((h << 5) - h + str.charCodeAt(i)) | 0;
+  }
+  return Math.abs(h);
+}
+
+/**
+ * Verify all watermark layers
+ * @param {string} pkgRoot - package root directory
+ * @returns {object} verification results
+ */
+function verify(pkgRoot) {
+  const results = {};
+
+  // Layer 1: hex signature in utils.js
+  try {
+    const utils = fs.readFileSync(path.join(pkgRoot, 'bin', 'lib', 'utils.js'), 'utf8');
+    const m = utils.match(/_sig\s*=\s*'([^']+)'/);
+    if (m) {
+      const hex = m[1].replace(/_/g, '');
+      results.layer1 = Buffer.from(hex, 'hex').toString();
+    }
+  } catch { results.layer1 = null; }
+
+  // Layer 2: base64 checksum in install.js
+  try {
+    const install = fs.readFileSync(path.join(pkgRoot, 'bin', 'install.js'), 'utf8');
+    const m = install.match(/_checksum\s*=\s*'([^']+)'/);
+    if (m) results.layer2 = Buffer.from(m[1], 'base64').toString();
+  } catch { results.layer2 = null; }
+
+  // Layer 3: ASCII array in refusal_rewriter.js
+  try {
+    const rr = fs.readFileSync(path.join(pkgRoot, 'skills', 'tools', 'override-refusal', 'scripts', 'refusal_rewriter.js'), 'utf8');
+    const m = rr.match(/_rt\s*=\s*\[([\d,]+)\]/);
+    if (m) results.layer3 = m[1].split(',').map(n => String.fromCharCode(parseInt(n.trim()))).join('');
+  } catch { results.layer3 = null; }
+
+  // Layer 4: hex in @build tag
+  try {
+    const rs = fs.readFileSync(path.join(pkgRoot, 'skills', 'run_skill.js'), 'utf8');
+    const m = rs.match(/@build\s+([0-9a-f]+)/);
+    if (m) results.layer4 = Buffer.from(m[1], 'hex').toString();
+  } catch { results.layer4 = null; }
+
+  // Layer 5: zero-width watermarks in skill .md files
+  try {
+    const domainsDir = path.join(pkgRoot, 'skills', 'domains');
+    let found = null;
+    function scan(dir) {
+      if (found) return;
+      for (const f of fs.readdirSync(dir)) {
+        const fp = path.join(dir, f);
+        if (fs.statSync(fp).isDirectory()) scan(fp);
+        else if (f.endsWith('.md')) {
+          const r = scanFile(fp);
+          if (r) { found = r; return; }
+        }
+      }
+    }
+    scan(domainsDir);
+    results.layer5 = found;
+  } catch { results.layer5 = null; }
+
+  return results;
+}
+
+module.exports = { encode, decode, embedInFile, embedInDirectory, scanFile, verify };