cyber-sdd 0.6.0 → 0.7.0

package/skills/discover-specs/scripts/discover-specs.bundle.mjs

@@ -0,0 +1,319 @@
+#!/usr/bin/env node
+import { existsSync, readFileSync, readdirSync, realpathSync } from "node:fs";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+//#region skills/discover-specs/scripts/discover-specs.mts
+const LIFECYCLE_STATUSES = /* @__PURE__ */ new Set([
+	"draft",
+	"approved",
+	"implemented",
+	"deprecated"
+]);
+const ROOT_PROJECT_NAME = "repo";
+const SKIP_DIRS = /* @__PURE__ */ new Set([
+	"node_modules",
+	".git",
+	"dist",
+	".turbo",
+	".next",
+	"coverage"
+]);
+/**
+* A directory that is itself a checkout is a DIFFERENT repository's tree, not part of this corpus.
+*
+* A name blocklist cannot express this: it can only say "this is called X", never "this is a
+* boundary". `SKIP_DIRS` already holds `.git`, so the walk skipped the METADATA directory while
+* descending straight into the checkout that directory marks — one level off from where the guard
+* was needed. Agent-harness worktree isolation checks this repo out inside itself, and the scan then
+* found the whole corpus once per worktree: 38 spec files where 10 exist, and every corpus-wide
+* guard silently auditing a tree nobody has.
+*
+* `.git` is a DIRECTORY in a clone and a FILE in a worktree or submodule, so both forms count.
+*/
+function isNestedCheckout(abs) {
+	return existsSync(join(abs, ".git"));
+}
+const ANCHORS_CONFIG = ".agents/sdd/spec-anchors.toml";
+function parseFrontmatter(text) {
+	const m = /^---\r?\n([\s\S]*?)\r?\n---\s*(?:\r?\n|$)/.exec(text);
+	if (!m) return null;
+	const fm = { approval: {} };
+	let gate = null;
+	for (const raw of m[1].split("\n")) {
+		const line = raw.replace(/\r$/, "");
+		if (line.trim() === "" || line.trim().startsWith("#")) continue;
+		const indent = line.length - line.trimStart().length;
+		const [key, ...rest] = line.trim().split(":");
+		const value = rest.join(":").trim();
+		if (indent === 0) {
+			gate = null;
+			if (key === "status") fm.status = unquote(value);
+			else if (key === "project-path") fm.projectPath = unquote(value);
+			else if (key === "name") fm.name = unquote(value);
+			else if (key === "approval") gate = null;
+		} else if (indent === 2 && value === "" && insideApproval(m[1], line)) gate = key;
+		else if (indent >= 4 && key === "verdict" && gate) fm.approval[gate] = unquote(value);
+	}
+	return fm;
+}
+function insideApproval(block, line) {
+	const lines = block.split("\n");
+	const idx = lines.indexOf(line);
+	for (let i = idx - 1; i >= 0; i--) {
+		const l = lines[i].replace(/\r$/, "");
+		if (l.trim() === "" || l.trim().startsWith("#")) continue;
+		if (l.length - l.trimStart().length === 0) return l.trim().replace(/:.*$/, "") === "approval";
+	}
+	return false;
+}
+function unquote(v) {
+	return v.replace(/^["']|["']$/g, "");
+}
+function classifyLocation(relPath) {
+	const p = relPath.replace(/\\/g, "/");
+	if (p === ".agents/spec/spec.md") return {
+		pattern: "root-single",
+		locationDir: ""
+	};
+	const multi = /^\.agents\/specs\/([^/]+)\/spec\.md$/.exec(p);
+	if (multi) return {
+		pattern: "root-multi",
+		locationDir: multi[1]
+	};
+	const nested = /^(.+)\/\.agents\/spec\/spec\.md$/.exec(p);
+	if (nested) return {
+		pattern: "nested",
+		locationDir: nested[1]
+	};
+	return null;
+}
+function deriveName(loc, fm) {
+	if (fm.name) return {
+		name: fm.name,
+		nameSource: "declared"
+	};
+	if (loc.pattern === "root-single") return {
+		name: ROOT_PROJECT_NAME,
+		nameSource: "derived"
+	};
+	if (loc.pattern === "root-multi") return {
+		name: loc.locationDir,
+		nameSource: "derived"
+	};
+	if (loc.pattern === "extra" && loc.capturedName) return {
+		name: loc.capturedName,
+		nameSource: "derived"
+	};
+	return {
+		name: loc.locationDir.split("/").pop() ?? loc.locationDir,
+		nameSource: "guessed"
+	};
+}
+function discoverSpecFiles(root) {
+	const found = [];
+	const walk = (relDir) => {
+		let entries;
+		try {
+			entries = readdirSync(join(root, relDir), { withFileTypes: true });
+		} catch {
+			return;
+		}
+		for (const e of entries) {
+			if (!e.isDirectory() || SKIP_DIRS.has(e.name)) continue;
+			const childRel = relDir ? `${relDir}/${e.name}` : e.name;
+			if (isNestedCheckout(join(root, childRel))) continue;
+			if (e.name === ".agents") {
+				probeAgents(root, childRel, found);
+				continue;
+			}
+			walk(childRel);
+		}
+	};
+	walk("");
+	return found;
+}
+function probeAgents(root, agentsRel, found) {
+	const single = `${agentsRel}/spec/spec.md`;
+	if (existsSync(join(root, single))) found.push(single);
+	if (agentsRel === ".agents") {
+		const specsDir = join(root, ".agents", "specs");
+		let projects;
+		try {
+			projects = readdirSync(specsDir, { withFileTypes: true });
+		} catch {
+			projects = [];
+		}
+		for (const p of projects) {
+			if (!p.isDirectory()) continue;
+			const rel = `.agents/specs/${p.name}/spec.md`;
+			if (existsSync(join(root, rel))) found.push(rel);
+		}
+	}
+}
+function parseAnchorsToml(text) {
+	const m = /(^|\n)\s*anchors\s*=\s*\[([\s\S]*?)\]/.exec(text);
+	if (!m) return [];
+	const out = [];
+	for (const q of m[2].matchAll(/"([^"]*)"|'([^']*)'/g)) out.push((q[1] ?? q[2]).trim());
+	return out.filter((s) => s !== "");
+}
+function readAnchors(root) {
+	const file = join(root, ANCHORS_CONFIG);
+	if (!existsSync(file)) return [];
+	try {
+		return parseAnchorsToml(readFileSync(file, "utf8"));
+	} catch {
+		process.stderr.write(`discover-specs: ignoring unreadable ${ANCHORS_CONFIG}\n`);
+		return [];
+	}
+}
+function collectDescendants(root, startDir) {
+	const out = [startDir];
+	let entries;
+	try {
+		entries = readdirSync(join(root, startDir), { withFileTypes: true });
+	} catch {
+		return out;
+	}
+	for (const e of entries) {
+		if (!e.isDirectory() || SKIP_DIRS.has(e.name)) continue;
+		const childRel = startDir ? `${startDir}/${e.name}` : e.name;
+		if (isNestedCheckout(join(root, childRel))) continue;
+		out.push(...collectDescendants(root, childRel));
+	}
+	return out;
+}
+function expandAnchor(root, pattern) {
+	const segs = pattern.replace(/\\/g, "/").replace(/^\/+|\/+$/g, "").split("/").filter(Boolean);
+	let frontier = [{ dir: "" }];
+	for (const seg of segs) {
+		const next = [];
+		if (seg === "**") {
+			for (const node of frontier) for (const dir of collectDescendants(root, node.dir)) next.push({
+				dir,
+				capturedName: node.capturedName
+			});
+			frontier = next;
+			continue;
+		}
+		const isGlob = seg === "*" || seg === "<project>";
+		for (const node of frontier) if (isGlob) {
+			let entries;
+			try {
+				entries = readdirSync(join(root, node.dir), { withFileTypes: true });
+			} catch {
+				continue;
+			}
+			for (const e of entries) {
+				if (!e.isDirectory() || SKIP_DIRS.has(e.name)) continue;
+				const childRel = node.dir ? `${node.dir}/${e.name}` : e.name;
+				if (isNestedCheckout(join(root, childRel))) continue;
+				next.push({
+					dir: childRel,
+					capturedName: seg === "<project>" ? e.name : node.capturedName
+				});
+			}
+		} else next.push({
+			dir: node.dir ? `${node.dir}/${seg}` : seg,
+			capturedName: node.capturedName
+		});
+		frontier = next;
+	}
+	const out = [];
+	for (const node of frontier) {
+		const rel = node.dir ? `${node.dir}/spec.md` : "spec.md";
+		if (existsSync(join(root, rel))) out.push({
+			rel,
+			capturedName: node.capturedName
+		});
+	}
+	return out;
+}
+function recordFor(root, rel, loc) {
+	let fm;
+	try {
+		fm = parseFrontmatter(readFileSync(join(root, rel), "utf8"));
+	} catch {
+		return null;
+	}
+	if (!fm?.status || !LIFECYCLE_STATUSES.has(fm.status)) return null;
+	const { name, nameSource } = deriveName(loc, fm);
+	return {
+		path: rel.replace(/\/spec\.md$/, ""),
+		name,
+		nameSource,
+		status: fm.status,
+		projectPath: fm.projectPath ?? "",
+		approvals: Object.entries(fm.approval).map(([gate, verdict]) => `${gate}:${verdict}`).join(";")
+	};
+}
+function collectSpecs(root) {
+	const out = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const rel of discoverSpecFiles(root)) {
+		const loc = classifyLocation(rel);
+		if (!loc) continue;
+		const rec = recordFor(root, rel, loc);
+		if (rec) {
+			out.push(rec);
+			seen.add(rel);
+		}
+	}
+	for (const pattern of readAnchors(root)) for (const { rel, capturedName } of expandAnchor(root, pattern)) {
+		if (seen.has(rel)) continue;
+		const rec = recordFor(root, rel, {
+			pattern: "extra",
+			locationDir: rel.replace(/\/spec\.md$/, ""),
+			capturedName
+		});
+		if (rec) {
+			out.push(rec);
+			seen.add(rel);
+		}
+	}
+	return out.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+}
+function resolveByName(specs, name) {
+	const want = name.trim().toLowerCase();
+	const hits = specs.filter((s) => s.name.toLowerCase() === want);
+	if (hits.length === 0) return { kind: "none" };
+	if (hits.length === 1) return {
+		kind: "match",
+		spec: hits[0]
+	};
+	return {
+		kind: "ambiguous",
+		candidates: hits
+	};
+}
+const COLUMNS = [
+	"path",
+	"name",
+	"nameSource",
+	"status",
+	"projectPath",
+	"approvals"
+];
+function toonField(v) {
+	if (v === "" || /[",]/.test(v) || v !== v.trim()) return `"${v.replace(/"/g, "\"\"")}"`;
+	return v;
+}
+function toToon(specs) {
+	return [`specs[${specs.length}]{${COLUMNS.join(",")}}:`, ...specs.map((s) => `  ${COLUMNS.map((c) => toonField(s[c])).join(",")}`)].join("\n");
+}
+function main(argv) {
+	const root = argv.includes("--root") ? argv[argv.indexOf("--root") + 1] ?? "." : ".";
+	const format = argv.includes("--format") ? argv[argv.indexOf("--format") + 1] : "toon";
+	let specs = collectSpecs(root);
+	if (argv.includes("--resolve")) {
+		const name = argv[argv.indexOf("--resolve") + 1] ?? "";
+		const r = resolveByName(specs, name);
+		specs = r.kind === "match" ? [r.spec] : r.kind === "ambiguous" ? r.candidates : [];
+	}
+	const out = format === "json" ? JSON.stringify(specs, null, 2) : toToon(specs);
+	process.stdout.write(`${out}\n`);
+	return 0;
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href) process.exit(main(process.argv.slice(2)));
+//#endregion
+export { LIFECYCLE_STATUSES, classifyLocation, collectSpecs, deriveName, discoverSpecFiles, expandAnchor, main, parseAnchorsToml, parseFrontmatter, readAnchors, resolveByName, toToon };

package/skills/discover-specs/scripts/discover-specs.mjs

@@ -0,0 +1,12 @@
+// Launcher for the engine of the same name. Run it as `node <skill>/scripts/<engine>.mjs`.
+// A checkout runs the .mts source. An npm install keeps the skill under node_modules, where Node
+// will not strip types, so it runs the self-contained bundle built for the package.
+import { spawnSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+
+const self = fileURLToPath(import.meta.url)
+const installed = /[\\/]node_modules[\\/]/.test(self)
+const target = self.replace(/\.mjs$/, installed ? '.bundle.mjs' : '.mts')
+const run = spawnSync(process.execPath, [...process.execArgv, target, ...process.argv.slice(2)], { stdio: 'inherit' })
+if (run.error) throw run.error
+process.exitCode = run.status ?? 1

package/skills/doctrine-loop/SKILL.md

@@ -58,11 +58,11 @@ recorded as distilled).
 **Determine distilled-ness by a structured JSONL parse, never a substring or regex text match.**
 The ledger shards are JSONL (one JSON object per line). **Reuse the existing parse contract** rather
 than hand-rolling one: run the exported **`distilledCrRefs`** engine from
-`../plan-retirement/scripts/retire-plans.mts` over the project `ledger/` directory and membership-test
+`../plan-retirement/scripts/retire-plans.mts` (its `--distilled` flag) over the project `ledger/` directory and membership-test
 the mission's `<cr-ref>` against the set it returns, e.g.
 
 ```
-node -e 'import("../plan-retirement/scripts/retire-plans.mts").then(m => console.log([...m.distilledCrRefs(process.argv[1])].join("\n")))' <ledger-dir>
+node "<plan-retirement skill>/scripts/retire-plans.mjs" --distilled <ledger-dir>
 ```
 
 `distilledCrRefs` parses **each line** with `JSON.parse` (keying only on `kind === "strategy"` with a

package/skills/formation-loop/SKILL.md

@@ -58,6 +58,16 @@ misplaced only when it **neither** follows the declared strategy **nor** matches
 — judging on the strategy alone raises false findings against placements a human already adjudicated. A declared layout settles *where a node goes*; it never licenses a capability to
 scatter across nodes. (Strategy is policy — read it; homes are data — derive them.)
 
+**Depth on capability nodes; `design/` by its own shape** (`sdd:spec-structure-governance`). The
+two-level cap covers capability nodes: one three levels deep is a depth finding naming it, its
+sub-grouping owed to a `concept:` tag. `design/` is judged by its own shape instead — current design
+at the top, one file per perspective, the `decisions/` ADR log, and at most one version folder
+holding the next design. The placement map names that version folder and its cut trigger; the named
+folder and its files raise no finding, any other `design/` sub-folder besides `decisions/` is a
+perspective-folder finding, a named version with no cut trigger is a finding, and so is a named
+version whose folder does not exist (a stale record the cut left behind). Tell the two
+apart by the map, never by the folder's contents.
+
 ## The intra-spec structural acts
 
 It acts on each spec's **structure**, not its content — one project is **one spec**, so structural
@@ -91,10 +101,7 @@ shares one boundary.
   axis is wrong), not a granularity split to carve as-proposed.
 
 An oversize can be a symptom of the **wrong axis**, not just wrong granularity: turn "this node is too
-big" into "too big **along which axis** — and is that axis real?" (Precedent: a killed
-`identity/`→`presence/` split proposed a plausible-but-unreal axis and was superseded by a realignment
-that split along the package's actual command boundary; the producer/consumer boundary had even been
-validated as sound, yet the *split axis* was never checked against a real command boundary.)
+big" into "too big **along which axis** — and is that axis real?"
 
 Alongside its findings a pass surfaces an **advisory layout-quality signal** — the scheduler's
 **false-conflict rate** doubles as a **partition-quality metric**: a layout that keeps node↔folder

package/skills/gate-validation-governance/SKILL.md

@@ -14,7 +14,7 @@ conductor's autonomy bar (baked into `start-mission`), a hard floor + a three-di
 ## Legal-state tuples
 
 The mechanical authority is `spec-gate/scripts/check-spec-state.mts` — run it
-(`node <skill>/scripts/check-spec-state.mts`) to enforce; if `node` is unavailable, apply the same
+(`node <skill>/scripts/check-spec-state.mjs`) to enforce; if `node` is unavailable, apply the same
 rules by reading frontmatter. The `(status, markers, .feature, approval)` tuple of the root
 `spec.md` — plus the durable gate lines globbed from its sibling `ledger/` shards (a legacy `ledger.jsonl` still counts) — is **illegal** when:
 

package/skills/init/README.md

@@ -11,9 +11,9 @@ and invokes no gate.
 - **Tests:** [`scripts/wire-statusline.test.mts`](./scripts/wire-statusline.test.mts) (`node:test`)
 
 ```bash
-node scripts/wire-statusline.mts --root . --detect
-node scripts/wire-statusline.mts --root . --wire --mode own-line
-node scripts/wire-statusline.mts --root . --wire --mode same-line   # --no-global-base to shadow deliberately
+node scripts/wire-statusline.mjs --root . --detect
+node scripts/wire-statusline.mjs --root . --wire --mode own-line
+node scripts/wire-statusline.mjs --root . --wire --mode same-line   # --no-global-base to shadow deliberately
 ```
 
 The engine writes only project `.claude/settings.json` (never the global settings file) and, in a

package/skills/init/SKILL.md

@@ -29,7 +29,7 @@ On enable, ask whether the mission status should render:
 Before wiring, run the read-only detection — Claude Code's project `statusLine` **replaces** the global one (no merge), so a fresh project wiring would silently shadow a status line living in `~/.claude/settings.json`:
 
 ```bash
-node "<skill>/scripts/wire-statusline.mts" --root . --detect
+node "<skill>/scripts/wire-statusline.mjs" --root . --detect
 ```
 
 It reports the project statusLine (absent | wired | foreign), the global statusLine (present | absent), and the shadow risk. On a shadow risk (project absent, global present), tell the user wiring will shadow their global status line and ask:
@@ -44,8 +44,8 @@ No shadow risk → proceed straight to wiring.
 Run the engine to compose the reader into project settings and (in a git repo) gitignore the status file:
 
 ```bash
-node "<skill>/scripts/wire-statusline.mts" --root . --wire --mode own-line
-node "<skill>/scripts/wire-statusline.mts" --root . --wire --mode same-line   # add --no-global-base to shadow deliberately
+node "<skill>/scripts/wire-statusline.mjs" --root . --wire --mode own-line
+node "<skill>/scripts/wire-statusline.mjs" --root . --wire --mode same-line   # add --no-global-base to shadow deliberately
 ```
 
 The engine:

package/skills/init/scripts/wire-statusline.bundle.mjs

@@ -0,0 +1,166 @@
+#!/usr/bin/env node
+import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { pathToFileURL } from "node:url";
+//#region skills/init/scripts/wire-statusline.mts
+const STATUS_FILE = ".agents/sdd/statusline";
+const SETTINGS_FILE = ".claude/settings.json";
+const GITIGNORE_FILE = ".gitignore";
+const GLOBAL_SETTINGS_FILE = join(homedir(), ".claude", "settings.json");
+const MARKER_BEGIN = "# sdd-statusline:begin";
+const MARKER_END = "# sdd-statusline:end";
+const MODE_PREFIX = "# sdd-statusline:mode:";
+const ORIG_OPEN = "__sdd_orig() {";
+const ORIG_CLOSE = "}";
+const NO_BASE = ":";
+function buildCommand(base, mode) {
+	const origBody = base && base.trim() !== "" ? base : NO_BASE;
+	const render = mode === "own-line" ? `if [ -s "$__sdd_file" ]; then\n  __sdd_val="$(cat "$__sdd_file")"\n  printf '%s\\n%s\\n' "$__sdd_base" "$__sdd_val"\nelse\n  printf '%s\\n' "$__sdd_base"\nfi` : `if [ -s "$__sdd_file" ]; then\n  __sdd_val="$(cat "$__sdd_file")"\n  printf '%s | %s\\n' "$__sdd_base" "$__sdd_val"\nelse\n  printf '%s\\n' "$__sdd_base"\nfi`;
+	return [
+		MARKER_BEGIN,
+		`${MODE_PREFIX}${mode}`,
+		ORIG_OPEN,
+		origBody,
+		ORIG_CLOSE,
+		"__sdd_base=\"$(__sdd_orig 2>/dev/null)\"",
+		`__sdd_file="${STATUS_FILE}"`,
+		render,
+		MARKER_END
+	].join("\n");
+}
+function parseCommand(command) {
+	if (!command?.includes(MARKER_BEGIN)) return { wired: false };
+	const modeMatch = new RegExp(`${MODE_PREFIX}(own-line|same-line)`).exec(command);
+	const origMatch = /__sdd_orig\(\) \{\n([\s\S]*?)\n\}/.exec(command);
+	const mode = modeMatch?.[1] ?? "own-line";
+	const origBody = origMatch?.[1] ?? NO_BASE;
+	return {
+		wired: true,
+		base: origBody === NO_BASE ? void 0 : origBody,
+		mode
+	};
+}
+function baseToWrap(existingCommand) {
+	const parsed = parseCommand(existingCommand);
+	return parsed.wired ? parsed.base : existingCommand;
+}
+function readSettingsFile(file) {
+	if (!existsSync(file)) return {};
+	try {
+		return JSON.parse(readFileSync(file, "utf8"));
+	} catch {
+		return {};
+	}
+}
+function readSettings(root) {
+	return readSettingsFile(join(root, SETTINGS_FILE));
+}
+function readStatusLineCommand(file) {
+	const command = readSettingsFile(file).statusLine?.command;
+	if (typeof command !== "string" || command.trim() === "") return void 0;
+	return command;
+}
+function writeSettings(root, settings) {
+	const file = join(root, SETTINGS_FILE);
+	mkdirSync(dirname(file), { recursive: true });
+	writeFileSync(file, `${JSON.stringify(settings, null, 2)}\n`);
+}
+function composeStatusLine(root, mode, globalCommand) {
+	const settings = readSettings(root);
+	const existing = settings.statusLine?.command;
+	const hasProjectStatusLine = typeof existing === "string" && existing.trim() !== "";
+	const globalBaseComposed = !hasProjectStatusLine && globalCommand !== void 0;
+	const command = buildCommand(hasProjectStatusLine ? baseToWrap(existing) : globalCommand, mode);
+	if (existing === command) return {
+		changed: false,
+		command,
+		globalBaseComposed: false
+	};
+	settings.statusLine = {
+		...settings.statusLine,
+		type: "command",
+		command
+	};
+	writeSettings(root, settings);
+	return {
+		changed: true,
+		command,
+		globalBaseComposed
+	};
+}
+function isGitRepo(root) {
+	return existsSync(join(root, ".git"));
+}
+function splitLines(text) {
+	const lines = text.split("\n");
+	if (lines.length > 0 && lines[lines.length - 1] === "") lines.pop();
+	return lines;
+}
+function addGitignoreEntry(root) {
+	const file = join(root, GITIGNORE_FILE);
+	const lines = existsSync(file) ? splitLines(readFileSync(file, "utf8")) : [];
+	if (lines.some((l) => l.trim() === ".agents/sdd/statusline")) return { changed: false };
+	const next = [...lines, STATUS_FILE];
+	writeFileSync(file, `${next.join("\n")}\n`);
+	return { changed: true };
+}
+function detectStatusLines(root, globalSettingsFile) {
+	const projectCommand = readStatusLineCommand(join(root, SETTINGS_FILE));
+	const project = projectCommand === void 0 ? "absent" : parseCommand(projectCommand).wired ? "wired" : "foreign";
+	const global = readStatusLineCommand(globalSettingsFile ?? GLOBAL_SETTINGS_FILE) !== void 0 ? "present" : "absent";
+	return {
+		project,
+		global,
+		shadow: project === "absent" && global === "present"
+	};
+}
+function wireStatusline(root, mode, opts) {
+	return {
+		settings: composeStatusLine(root, mode, opts?.globalBase ?? true ? readStatusLineCommand(opts?.globalSettingsFile ?? GLOBAL_SETTINGS_FILE) : void 0),
+		gitignore: isGitRepo(root) ? {
+			...addGitignoreEntry(root),
+			skipped: false
+		} : {
+			changed: false,
+			skipped: true
+		}
+	};
+}
+function flag(argv, name) {
+	const i = argv.indexOf(name);
+	return i === -1 ? void 0 : argv[i + 1];
+}
+function main(argv) {
+	const root = flag(argv, "--root") ?? ".";
+	const globalSettingsFile = flag(argv, "--global-settings");
+	const w = (s) => process.stdout.write(`${s}\n`);
+	if (argv.includes("--detect")) {
+		const result = detectStatusLines(root, globalSettingsFile);
+		w(`project statusLine: ${result.project}`);
+		w(`global statusLine: ${result.global}`);
+		w(result.shadow ? "shadow risk: yes — wiring would shadow the global statusline; compose it as the base (default) or pass --no-global-base to shadow deliberately" : "shadow risk: no");
+		return 0;
+	}
+	if (argv.includes("--wire")) {
+		const mode = flag(argv, "--mode");
+		if (mode !== "own-line" && mode !== "same-line") {
+			w("refused: --mode must be own-line or same-line");
+			return 1;
+		}
+		const result = wireStatusline(root, mode, {
+			globalSettingsFile,
+			globalBase: !argv.includes("--no-global-base")
+		});
+		w(result.settings.changed ? `wired statusLine (${mode})` : "statusLine already wired (unchanged)");
+		if (result.settings.globalBaseComposed) w("composed the global statusLine command as the wrapped base");
+		if (result.gitignore.skipped) w("not a git repo — gitignore skipped");
+		else w(result.gitignore.changed ? `added ${STATUS_FILE} to .gitignore` : ".gitignore already up to date");
+		return 0;
+	}
+	w("usage: wire-statusline --root <dir> --wire --mode own-line|same-line [--global-settings <file>] [--no-global-base]\n       wire-statusline --root <dir> --detect [--global-settings <file>]");
+	return 0;
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href) process.exit(main(process.argv.slice(2)));
+//#endregion
+export { GITIGNORE_FILE, GLOBAL_SETTINGS_FILE, SETTINGS_FILE, STATUS_FILE, addGitignoreEntry, buildCommand, composeStatusLine, detectStatusLines, isGitRepo, main, parseCommand, readStatusLineCommand, wireStatusline };

package/skills/init/scripts/wire-statusline.mjs

@@ -0,0 +1,12 @@
+// Launcher for the engine of the same name. Run it as `node <skill>/scripts/<engine>.mjs`.
+// A checkout runs the .mts source. An npm install keeps the skill under node_modules, where Node
+// will not strip types, so it runs the self-contained bundle built for the package.
+import { spawnSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+
+const self = fileURLToPath(import.meta.url)
+const installed = /[\\/]node_modules[\\/]/.test(self)
+const target = self.replace(/\.mjs$/, installed ? '.bundle.mjs' : '.mts')
+const run = spawnSync(process.execPath, [...process.execArgv, target, ...process.argv.slice(2)], { stdio: 'inherit' })
+if (run.error) throw run.error
+process.exitCode = run.status ?? 1

package/skills/manage-ignore/README.md

@@ -11,9 +11,9 @@ file. Order is meaningful (last-match-wins), so rules are never re-sorted.
 - **Tests:** [`scripts/manage-ignore.test.mts`](./scripts/manage-ignore.test.mts) (`node:test`)
 
 ```bash
-node scripts/manage-ignore.mts --list
-node scripts/manage-ignore.mts --induce build/output/app.log
-node scripts/manage-ignore.mts --preview '*.log'
-node scripts/manage-ignore.mts --preview '!keep.log'
-node scripts/manage-ignore.mts --add '*.log'
+node scripts/manage-ignore.mjs --list
+node scripts/manage-ignore.mjs --induce build/output/app.log
+node scripts/manage-ignore.mjs --preview '*.log'
+node scripts/manage-ignore.mjs --preview '!keep.log'
+node scripts/manage-ignore.mjs --add '*.log'
 ```

package/skills/manage-ignore/SKILL.md

@@ -25,7 +25,7 @@ engine therefore **never re-sorts**: `--add` appends, `--remove` preserves the o
 ## Run an operation
 
 ```bash
-node "<skill>/scripts/manage-ignore.mts" [--root .] <operation>
+node "<skill>/scripts/manage-ignore.mjs" [--root .] <operation>
 ```
 
 | Operation | Effect |