codiedev 0.10.0-beta.15 → 0.10.0-beta.17

package/dist/packs/files.js

@@ -0,0 +1,291 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SHA256_HEX = exports.PACK_FILES_MAX_TOTAL_BYTES = exports.PACK_FILE_MAX_BYTES = exports.PACK_MAX_FILES = void 0;
+exports.packFilePathProblem = packFilePathProblem;
+exports.blobsDir = blobsDir;
+exports.blobPath = blobPath;
+exports.sha256Of = sha256Of;
+exports.ensureBlobs = ensureBlobs;
+exports.parseFilesSection = parseFilesSection;
+exports.stripFilesSection = stripFilesSection;
+exports.expandHome = expandHome;
+exports.collectLocalFiles = collectLocalFiles;
+exports.rewritePluginRoot = rewritePluginRoot;
+const crypto_1 = require("crypto");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+exports.PACK_MAX_FILES = 500;
+exports.PACK_FILE_MAX_BYTES = 15 * 1024 * 1024;
+exports.PACK_FILES_MAX_TOTAL_BYTES = 50 * 1024 * 1024;
+const PATH_MAX = 300;
+const MAX_DEPTH = 16;
+const FILE_SEGMENT = /^[A-Za-z0-9_@+][A-Za-z0-9._ @+=,-]{0,127}$/;
+exports.SHA256_HEX = /^[0-9a-f]{64}$/;
+function packFilePathProblem(raw) {
+    if (typeof raw !== "string" || !raw)
+        return "empty path";
+    if (raw.length > PATH_MAX)
+        return `longer than ${PATH_MAX} characters`;
+    if (raw.includes("\\"))
+        return "use / as the separator";
+    if (raw.startsWith("/") || /^[A-Za-z]:/.test(raw))
+        return "must be relative to the pack folder";
+    const segments = raw.split("/");
+    if (segments.length > MAX_DEPTH)
+        return `nested deeper than ${MAX_DEPTH} folders`;
+    for (const seg of segments) {
+        if (!seg || seg === "." || seg === "..")
+            return "empty, . or .. segment";
+        if (!FILE_SEGMENT.test(seg) || seg.trim() !== seg || seg.endsWith("."))
+            return `unsupported name "${seg}"`;
+    }
+    const lower = raw.toLowerCase();
+    if (lower.startsWith(".claude-plugin/"))
+        return ".claude-plugin/ is written by Codiedev";
+    if (lower === "hooks/hooks.json")
+        return "hooks/hooks.json comes from the pack's hooks";
+    if (segments.length === 2 && segments[0].toLowerCase() === "agents" && lower.endsWith(".md"))
+        return "agents/*.md come from the pack's agents";
+    if (segments.length === 3 && segments[0].toLowerCase() === "skills" && segments[2].toLowerCase() === "skill.md") {
+        return "SKILL.md comes from the skill library";
+    }
+    return null;
+}
+function blobsDir(root) {
+    return path.join(root, ".blobs");
+}
+function blobPath(dir, sha256) {
+    if (!exports.SHA256_HEX.test(sha256))
+        throw new Error(`bad sha256: ${sha256}`);
+    return path.join(dir, sha256);
+}
+function sha256Of(buf) {
+    return (0, crypto_1.createHash)("sha256").update(buf).digest("hex");
+}
+function hasBlob(dir, file) {
+    try {
+        return fs.statSync(blobPath(dir, file.sha256)).size === file.size;
+    }
+    catch {
+        return false;
+    }
+}
+async function ensureBlobs(dir, files, download) {
+    let downloaded = 0;
+    const seen = new Set();
+    for (const file of files) {
+        if (seen.has(file.sha256) || hasBlob(dir, file))
+            continue;
+        seen.add(file.sha256);
+        const body = await download(file);
+        if (body.length !== file.size || sha256Of(body) !== file.sha256) {
+            throw new Error(`${file.path}: downloaded bytes don't match the pack (checksum mismatch)`);
+        }
+        fs.mkdirSync(dir, { recursive: true });
+        const target = blobPath(dir, file.sha256);
+        const tmp = `${target}.${process.pid}.${Date.now()}.tmp`;
+        fs.writeFileSync(tmp, body, { mode: 0o644 });
+        fs.renameSync(tmp, target);
+        downloaded += 1;
+    }
+    return { downloaded };
+}
+function parseFilesSection(markdown) {
+    const lines = markdown.replace(/^/, "").split("\n").map((l) => l.replace(/\r$/, ""));
+    let fence = null;
+    let inFiles = false;
+    let found = false;
+    const out = [];
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const f = line.match(/^(`{3,})/);
+        if (f) {
+            if (!fence)
+                fence = f[1];
+            else if (f[1].length >= fence.length && /^`+\s*$/.test(line))
+                fence = null;
+            continue;
+        }
+        if (fence)
+            continue;
+        const h2 = line.match(/^##\s+(.+?)\s*$/);
+        if (h2 && !line.startsWith("###")) {
+            inFiles = h2[1].toLowerCase() === "files";
+            if (inFiles)
+                found = true;
+            continue;
+        }
+        if (!inFiles || !line.trim())
+            continue;
+        const m = line.match(/^\s*[-*]\s+(.+?)\s+<-\s+(.+?)\s*$/);
+        if (!m)
+            throw new Error(`pack.md line ${i + 1}: expected "- <path in pack> <- <local path>" under ## Files`);
+        out.push({ dest: unquote(m[1]), source: unquote(m[2]), line: i + 1 });
+    }
+    return found ? out : null;
+}
+function unquote(value) {
+    const v = value.trim();
+    return (v.startsWith('"') && v.endsWith('"')) || (v.startsWith("'") && v.endsWith("'")) ? v.slice(1, -1) : v;
+}
+function stripFilesSection(markdown) {
+    const lines = markdown.split("\n");
+    const out = [];
+    let fence = null;
+    let skipping = false;
+    for (const raw of lines) {
+        const line = raw.replace(/\r$/, "");
+        const f = line.match(/^(`{3,})/);
+        if (f && !skipping) {
+            if (!fence)
+                fence = f[1];
+            else if (f[1].length >= fence.length && /^`+\s*$/.test(line))
+                fence = null;
+            out.push(raw);
+            continue;
+        }
+        if (!fence) {
+            const h2 = line.match(/^##\s+(.+?)\s*$/);
+            if (h2 && !line.startsWith("###"))
+                skipping = h2[1].toLowerCase() === "files";
+        }
+        if (!skipping)
+            out.push(raw);
+    }
+    return out.join("\n");
+}
+const SKIP_DIRS = new Set(["__pycache__", ".git", "node_modules", ".venv", "venv", ".mypy_cache", ".pytest_cache", ".ruff_cache", ".idea", ".vscode"]);
+const SKIP_FILES = new Set([".DS_Store", "Thumbs.db", "desktop.ini"]);
+const SKIP_EXT = /\.(pyc|pyo|swp|tmp)$/i;
+function expandHome(p, home = os.homedir()) {
+    return p === "~" ? home : p.startsWith("~/") ? path.join(home, p.slice(2)) : p;
+}
+function collectLocalFiles(entries, baseDir, home = os.homedir(), opts = {}) {
+    const files = new Map();
+    const notes = [];
+    let total = 0;
+    const add = (dest, abs) => {
+        if (opts.lenient && dest.toLowerCase() === "skill.md")
+            return;
+        const problem = packFilePathProblem(opts.checkAs ? opts.checkAs(dest) : dest);
+        if (problem) {
+            const parts = dest.split("/");
+            if (parts.length === 3 && parts[0] === "skills" && parts[2].toLowerCase() === "skill.md") {
+                notes.push(`skipped ${dest} (the skill itself comes from the skill library; push it with \`codiedev push\`)`);
+                return;
+            }
+            if (parts.some((s) => s.startsWith(".") && s !== "." && s !== "..")) {
+                notes.push(`skipped hidden file ${dest}`);
+                return;
+            }
+            if (opts.lenient) {
+                notes.push(`skipped ${dest} (${problem})`);
+                return;
+            }
+            throw new Error(`can't ship ${dest}: ${problem}`);
+        }
+        const stat = fs.statSync(abs);
+        if (stat.size > exports.PACK_FILE_MAX_BYTES && opts.lenient) {
+            notes.push(`skipped ${dest} (over ${exports.PACK_FILE_MAX_BYTES / (1024 * 1024)}MB)`);
+            return;
+        }
+        if (stat.size > exports.PACK_FILE_MAX_BYTES)
+            throw new Error(`${abs} is over ${exports.PACK_FILE_MAX_BYTES / (1024 * 1024)}MB`);
+        const key = dest.toLowerCase();
+        if (files.has(key))
+            throw new Error(`two sources write ${dest}`);
+        const buf = fs.readFileSync(abs);
+        total += buf.length;
+        files.set(key, { path: dest, abs, size: buf.length, sha256: sha256Of(buf), ...((stat.mode & 0o111) !== 0 ? { executable: true } : {}) });
+    };
+    const walk = (dir, dest, depth) => {
+        if (depth > MAX_DEPTH)
+            throw new Error(`${dir} is nested too deep`);
+        for (const name of fs.readdirSync(dir).sort()) {
+            const abs = path.join(dir, name);
+            const lst = fs.lstatSync(abs);
+            const child = dest ? `${dest}/${name}` : name;
+            if (lst.isSymbolicLink()) {
+                notes.push(`skipped symlink ${child}`);
+                continue;
+            }
+            if (lst.isDirectory()) {
+                if (!SKIP_DIRS.has(name))
+                    walk(abs, child, depth + 1);
+                continue;
+            }
+            if (!lst.isFile() || SKIP_FILES.has(name) || SKIP_EXT.test(name))
+                continue;
+            add(child, abs);
+        }
+    };
+    for (const entry of entries) {
+        const dest = entry.dest.replace(/^\.\/+/, "").replace(/\/+$/, "");
+        if (dest !== "." && (!dest || dest.startsWith("/") || dest.split("/").some((seg) => !seg || seg === "." || seg === ".."))) {
+            throw new Error(`pack.md line ${entry.line}: "${entry.dest}" must be a path inside the pack (or "." for its root)`);
+        }
+        const source = path.resolve(baseDir, expandHome(entry.source, home));
+        let stat;
+        try {
+            stat = fs.statSync(source);
+        }
+        catch {
+            throw new Error(`pack.md line ${entry.line}: ${entry.source} doesn't exist`);
+        }
+        if (stat.isDirectory())
+            walk(source, dest === "." ? "" : dest, 0);
+        else if (stat.isFile()) {
+            if (dest === "." || !dest)
+                throw new Error(`pack.md line ${entry.line}: give a file a path, e.g. "- tools/${path.basename(source)} <- ${entry.source}"`);
+            add(dest, source);
+        }
+        else
+            throw new Error(`pack.md line ${entry.line}: ${entry.source} is not a file or folder`);
+    }
+    const list = [...files.values()].sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+    if (opts.lenient)
+        return { files: list, notes, total };
+    if (list.length > exports.PACK_MAX_FILES)
+        throw new Error(`a pack holds at most ${exports.PACK_MAX_FILES} files (found ${list.length})`);
+    if (total > exports.PACK_FILES_MAX_TOTAL_BYTES)
+        throw new Error(`pack files total over ${exports.PACK_FILES_MAX_TOTAL_BYTES / (1024 * 1024)}MB`);
+    return { files: list, notes, total };
+}
+function rewritePluginRoot(content, pluginRoot) {
+    const root = pluginRoot.split(path.sep).join("/");
+    return content.replace(/\$\{CLAUDE_PLUGIN_ROOT\}|\$CLAUDE_PLUGIN_ROOT(?![A-Za-z0-9_])/g, root);
+}

package/dist/packs/harnesses.js

@@ -242,8 +242,7 @@ function copyCursorSkills(home, manifest, pluginDirPath) {
             }
             fs.rmSync(dest, { recursive: true, force: true });
         }
-        fs.mkdirSync(dest, { recursive: true });
-        fs.copyFileSync(path.join(pluginDirPath, "skills", skill.name, "SKILL.md"), path.join(dest, "SKILL.md"));
+        copyTreeNoSymlinks(path.join(pluginDirPath, "skills", skill.name), dest);
         fs.writeFileSync(path.join(dest, exports.CURSOR_MARKER), `${manifest.slug}\n`);
     }
     return notes;
@@ -295,7 +294,7 @@ function copyTreeNoSymlinks(source, dest, depth = 0) {
         if (stat.isDirectory())
             copyTreeNoSymlinks(from, to, depth + 1);
         else if (stat.isFile())
-            fs.writeFileSync(to, fs.readFileSync(from));
+            fs.writeFileSync(to, fs.readFileSync(from), { mode: stat.mode & 0o777 });
     }
 }
 function installCursorPlugin(home, slug, sourceDir) {

package/dist/packs/install.js

@@ -36,6 +36,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.codexPackHooksPath = codexPackHooksPath;
 exports.codexPackTrustEntries = codexPackTrustEntries;
 exports.installPacks = installPacks;
+exports.pruneBlobs = pruneBlobs;
 exports.uninstallPacks = uninstallPacks;
 exports.formatUninstallLines = formatUninstallLines;
 exports.formatResultLines = formatResultLines;
@@ -47,6 +48,7 @@ const codexHookTrust_1 = require("../codexHookTrust");
 const harnesses_1 = require("./harnesses");
 const manifest_1 = require("./manifest");
 const paths_1 = require("./paths");
+const files_1 = require("./files");
 const shim_1 = require("./shim");
 const store_1 = require("./store");
 function marketplaceEntries(registry) {
@@ -127,7 +129,7 @@ function installPacks(options) {
     for (const manifest of options.manifests) {
         const dir = (0, paths_1.pluginDir)(root, manifest.slug);
         const previous = registry.packs[manifest.slug];
-        const files = Object.keys((0, store_1.pluginFiles)(manifest)).sort();
+        const files = [...Object.keys((0, store_1.pluginFiles)(manifest)), ...(manifest.files ?? []).map((f) => f.path)].sort();
         const results = [];
         if (options.dryRun) {
             for (const adapter of adapters) {
@@ -139,8 +141,9 @@ function installPacks(options) {
             output.push({ slug: manifest.slug, version: manifest.version, contentHash: manifest.contentHash, dir, files, results, harnesses: [] });
             continue;
         }
-        (0, store_1.writePluginDir)(root, manifest);
-        (0, store_1.writePluginDir)((0, paths_1.portableRoot)(root), manifest, { portable: true });
+        const blobDir = options.blobDir ?? (0, files_1.blobsDir)(root);
+        (0, store_1.writePluginDir)(root, manifest, { blobDir });
+        (0, store_1.writePluginDir)((0, paths_1.portableRoot)(root), manifest, { portable: true, blobDir });
         const pending = {
             packs: {
                 ...registry.packs,
@@ -183,12 +186,14 @@ function installPacks(options) {
             description: manifest.description,
             ...(manifest.channel ? { channel: manifest.channel } : {}),
             ...(manifest.icon ? { icon: manifest.icon } : {}),
+            ...(manifest.files?.length ? { blobs: [...new Set(manifest.files.map((f) => f.sha256))] } : {}),
         };
         (0, store_1.writeRegistry)(root, registry);
         output.push({ slug: manifest.slug, ...(manifest.channel ? { channel: manifest.channel } : {}), version: manifest.version, contentHash: manifest.contentHash, dir, files, results, harnesses });
     }
     if (options.dryRun || options.manifests.length === 0)
         return output;
+    pruneBlobs(root, registry, options.blobDir);
     if (selected.has("codex") && detected.get("codex")) {
         const bySlug = regenerateCodexTrust(registry, env, home);
         for (const pack of output) {
@@ -210,6 +215,28 @@ function installPacks(options) {
     }
     return output;
 }
+function pruneBlobs(root, registry, dir = (0, files_1.blobsDir)(root)) {
+    const keep = new Set(Object.values(registry.packs).flatMap((e) => e.blobs ?? []));
+    let removed = 0;
+    let entries = [];
+    try {
+        entries = fs.readdirSync(dir);
+    }
+    catch {
+        return 0;
+    }
+    for (const name of entries) {
+        if (keep.has(name))
+            continue;
+        try {
+            fs.rmSync(path.join(dir, name), { force: true });
+            removed += 1;
+        }
+        catch {
+        }
+    }
+    return removed;
+}
 function regenerateCodexTrust(registry, env, home) {
     const codexDir = (0, harnessDirs_1.codexHome)(env, home);
     const bySlug = codexPackTrustEntries(registry, codexDir);
@@ -256,6 +283,7 @@ function uninstallPacks(options) {
     if (fs.existsSync(codexConfig))
         regenerateCodexTrust(registry, env, home);
     (0, shim_1.writeShim)((0, paths_1.shimPath)(root), shimInputs(registry));
+    pruneBlobs(root, registry);
     return output;
 }
 function formatUninstallLines(results) {

package/dist/packs/localSkills.js

@@ -0,0 +1,120 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findLocalSkills = findLocalSkills;
+exports.rewriteLocalSkills = rewriteLocalSkills;
+exports.skillFolderEntries = skillFolderEntries;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const files_1 = require("./files");
+const manifest_1 = require("./manifest");
+const LOCAL = /^(\.{1,2}\/|~\/|~$|\/)/;
+function pluginDirName(name) {
+    if (/^[A-Za-z0-9][A-Za-z0-9._ -]{0,127}$/.test(name) && !name.includes(".."))
+        return name;
+    const slug = name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 48).replace(/-+$/g, "");
+    return slug || "pack";
+}
+function findLocalSkills(markdown, baseDir, home = os.homedir()) {
+    const lines = markdown.replace(/^/, "").split("\n").map((l) => l.replace(/\r$/, ""));
+    const out = [];
+    let fence = null;
+    let inSkills = false;
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const f = line.match(/^(`{3,})/);
+        if (f) {
+            if (!fence)
+                fence = f[1];
+            else if (f[1].length >= fence.length && /^`+\s*$/.test(line))
+                fence = null;
+            continue;
+        }
+        if (fence)
+            continue;
+        const h2 = line.match(/^##\s+(.+?)\s*$/);
+        if (h2 && !line.startsWith("###")) {
+            inSkills = h2[1].toLowerCase() === "skills";
+            continue;
+        }
+        if (!inSkills)
+            continue;
+        const m = line.match(/^\s*[-*]\s+(.+?)\s*$/);
+        if (!m)
+            continue;
+        const raw = m[1].replace(/^["']|["']$/g, "");
+        if (!LOCAL.test(raw))
+            continue;
+        const abs = path.resolve(baseDir, (0, files_1.expandHome)(raw, home));
+        let stat;
+        try {
+            stat = fs.statSync(abs);
+        }
+        catch {
+            throw new Error(`pack.md line ${i + 1}: ${raw} doesn't exist`);
+        }
+        const dir = stat.isDirectory() ? abs : null;
+        const skillFile = dir ? path.join(dir, "SKILL.md") : abs;
+        if (!fs.existsSync(skillFile))
+            throw new Error(`pack.md line ${i + 1}: no SKILL.md in ${raw}`);
+        const { data } = (0, manifest_1.parseFrontmatter)(fs.readFileSync(skillFile, "utf8"));
+        const name = (data.name ?? "").trim();
+        if (!name || !(data.description ?? "").trim()) {
+            throw new Error(`pack.md line ${i + 1}: ${path.relative(baseDir, skillFile) || skillFile} needs SKILL.md frontmatter with name: and description:`);
+        }
+        out.push({ line: i + 1, source: raw, skillFile, dir, name, pluginDir: `skills/${pluginDirName(name)}` });
+    }
+    const seen = new Map();
+    for (const skill of out) {
+        const prior = seen.get(skill.name.toLowerCase());
+        if (prior)
+            throw new Error(`pack.md lines ${prior.line} and ${skill.line} both add a skill named "${skill.name}"`);
+        seen.set(skill.name.toLowerCase(), skill);
+    }
+    return out;
+}
+function rewriteLocalSkills(markdown, keys) {
+    const lines = markdown.split("\n");
+    for (const [line, key] of keys) {
+        const cr = lines[line - 1].endsWith("\r") ? "\r" : "";
+        const indent = lines[line - 1].match(/^\s*/)?.[0] ?? "";
+        lines[line - 1] = `${indent}- ${key} @me${cr}`;
+    }
+    return lines.join("\n");
+}
+function skillFolderEntries(skills) {
+    return skills.filter((s) => s.dir).map((s) => ({ dest: s.pluginDir, source: s.dir, line: s.line }));
+}

package/dist/packs/manifest.js

@@ -7,6 +7,7 @@ exports.parseManifest = parseManifest;
 exports.cleanLabel = cleanLabel;
 exports.displayName = displayName;
 exports.parseFrontmatter = parseFrontmatter;
+const files_1 = require("./files");
 const SAFE_SEGMENT = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
 function isSafeSegment(value) {
     return typeof value === "string" && SAFE_SEGMENT.test(value) && !value.includes("..");
@@ -41,6 +42,46 @@ function fileList(value, field, safe) {
         return { name: entry.name, content: entry.content, ...(artifactId ? { artifactId } : {}) };
     });
 }
+function bundleFiles(value, reserved) {
+    if (value === undefined || value === null)
+        return [];
+    if (!Array.isArray(value))
+        throw new ManifestError("manifest.files must be an array");
+    if (value.length > files_1.PACK_MAX_FILES)
+        throw new ManifestError(`manifest.files has more than ${files_1.PACK_MAX_FILES} entries`);
+    const seen = new Set();
+    const dirs = new Set();
+    let total = 0;
+    const out = value.map((item, index) => {
+        const f = item;
+        if (!f || typeof f !== "object")
+            throw new ManifestError(`manifest.files[${index}] is not an object`);
+        const problem = (0, files_1.packFilePathProblem)(f.path);
+        if (problem)
+            throw new ManifestError(`manifest.files[${index}] has an unsafe path ${JSON.stringify(f.path)}: ${problem}`);
+        const p = f.path;
+        if (typeof f.sha256 !== "string" || !files_1.SHA256_HEX.test(f.sha256))
+            throw new ManifestError(`manifest.files[${index}].sha256 is not a sha256`);
+        const size = Number(f.size);
+        if (!Number.isInteger(size) || size < 0 || size > files_1.PACK_FILE_MAX_BYTES)
+            throw new ManifestError(`manifest.files[${index}].size is out of range`);
+        total += size;
+        const key = p.toLowerCase();
+        if (seen.has(key) || reserved.has(key))
+            throw new ManifestError(`manifest.files has a clashing path: ${p}`);
+        seen.add(key);
+        const parts = key.split("/");
+        for (let n = 1; n < parts.length; n++)
+            dirs.add(parts.slice(0, n).join("/"));
+        return { path: p, sha256: f.sha256, size, ...(f.executable === true ? { executable: true } : {}) };
+    });
+    for (const key of seen)
+        if (dirs.has(key))
+            throw new ManifestError(`manifest.files has a path that is also a folder: ${key}`);
+    if (total > files_1.PACK_FILES_MAX_TOTAL_BYTES)
+        throw new ManifestError("manifest.files is too large");
+    return out;
+}
 function parseManifest(input) {
     let raw = input;
     if (typeof raw === "string") {
@@ -80,15 +121,23 @@ function parseManifest(input) {
             hooksJson = m.hooksJson;
         }
     }
+    const skills = fileList(m.skills, "skills", isSafeSkillName);
+    const agents = fileList(m.agents, "agents", isSafeSegment);
+    const reserved = new Set([
+        ...skills.map((s) => `skills/${s.name}/skill.md`.toLowerCase()),
+        ...agents.map((a) => `agents/${a.name}.md`.toLowerCase()),
+    ]);
+    const files = bundleFiles(m.files, reserved);
     return {
         slug: m.slug,
         name: typeof m.name === "string" && m.name ? m.name : m.slug,
         description: typeof m.description === "string" ? m.description : "",
         version,
         contentHash: m.contentHash,
-        skills: fileList(m.skills, "skills", isSafeSkillName),
-        agents: fileList(m.agents, "agents", isSafeSegment),
+        skills,
+        agents,
         hooksJson,
+        ...(files.length ? { files } : {}),
         ...(cleanLabel(m.channel, 16) ? { channel: cleanLabel(m.channel, 16) } : {}),
         ...(cleanLabel(m.icon, 16) ? { icon: cleanLabel(m.icon, 16) } : {}),
     };