deepline 0.3.188 → 0.3.190

package/dist/cli/index.mjs

@@ -3046,7 +3046,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.188",
+  version: "0.3.190",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1
@@ -3271,6 +3271,13 @@ var KNOWN_SKILL_AGENTS = [
   "gemini-cli",
   "windsurf"
 ];
+var DEFAULT_SKILL_AGENTS = [
+  "codex",
+  "claude-code",
+  "cursor",
+  "gemini-cli",
+  "antigravity"
+];
 function skillsAgentPathSegment(agent) {
   if (agent === "*") return "all";
   const slug = agent.replace(/[^a-z0-9]+/gi, "-").replace(/^-+|-+$/g, "");
@@ -3283,6 +3290,13 @@ function sdkSkillsVersionPath(baseUrl, agents = []) {
 function legacySdkSkillsVersionPath(baseUrl) {
   return join2(dirname2(sdkCliStateDirPath(baseUrl)), "sdk-skills", ".version");
 }
+function readSkillsVersionFile(path) {
+  try {
+    return readFileSync2(path, "utf-8").trim();
+  } catch {
+    return "";
+  }
+}
 function resolveAutoSyncSkillAgents() {
   switch (detectAgentRuntime()) {
     case "codex":
@@ -3295,6 +3309,8 @@ function resolveAutoSyncSkillAgents() {
       return ["gemini-cli"];
     case "antigravity":
       return ["antigravity"];
+    case "unknown":
+      return [...DEFAULT_SKILL_AGENTS];
     default:
       return [];
   }
@@ -3303,6 +3319,13 @@ function readSdkSkillsLocalVersion(baseUrl) {
   const pluginVersion = readPluginSkillsVersion();
   if (pluginVersion) return pluginVersion;
   const agents = resolveAutoSyncSkillAgents();
+  if (agents.length > 1) {
+    const versions = agents.map(
+      (agent) => readSkillsVersionFile(sdkSkillsVersionPath(baseUrl, [agent]))
+    );
+    const first = versions[0];
+    return first && versions.every((version) => version === first) ? first : "";
+  }
   const scopedPath = sdkSkillsVersionPath(baseUrl, agents);
   if (agents.length > 0 && existsSync2(scopedPath)) {
     try {
@@ -3329,10 +3352,19 @@ function readSdkSkillsLocalVersion(baseUrl) {
   }
 }
 function writeSdkSkillsLocalVersion(baseUrl, version, agents) {
-  const path = sdkSkillsVersionPath(baseUrl, agents);
-  mkdirSync2(dirname2(path), { recursive: true });
-  writeFileSync2(path, `${version}
+  const targets = agents.length > 1 ? agents.map((agent) => [agent]) : [agents];
+  let complete = true;
+  for (const target of targets) {
+    const path = sdkSkillsVersionPath(baseUrl, target);
+    try {
+      mkdirSync2(dirname2(path), { recursive: true });
+      writeFileSync2(path, `${version}
 `, "utf-8");
+    } catch {
+      complete = false;
+    }
+  }
+  return complete;
 }
 
 // ../play-runtime/coordinator-headers.ts
@@ -42817,7 +42849,7 @@ import {
   realpathSync as realpathSync5,
   writeFileSync as writeFileSync16
 } from "fs";
-import { homedir as homedir9 } from "os";
+import { homedir as homedir10 } from "os";
 import { dirname as dirname16, join as join20, resolve as resolve17 } from "path";
 
 // src/cli/installation-lifecycle.ts
@@ -42951,7 +42983,7 @@ function isOwnedInstallerCommandPath(input2) {
 // src/cli/commands/skills.ts
 import { spawn as spawn3 } from "child_process";
 import { existsSync as existsSync14, mkdirSync as mkdirSync11, readFileSync as readFileSync16, writeFileSync as writeFileSync15 } from "fs";
-import { homedir as homedir8 } from "os";
+import { homedir as homedir9 } from "os";
 import { dirname as dirname15, join as join19 } from "path";
 
 // contracts/install-commands.json
@@ -42987,7 +43019,6 @@ var install_commands_default = {
 
 // src/cli/install-commands.ts
 var INSTALL_COMMANDS = install_commands_default;
-var DEFAULT_SKILL_AGENTS = INSTALL_COMMANDS.skills.default_agents;
 var skillsNpxPackage = INSTALL_COMMANDS.skills.npx_add_args_template.find(
   (arg) => /^skills@\d+\.\d+\.\d+$/.test(arg)
 );
@@ -43038,7 +43069,7 @@ function skillsSourceUrl(baseUrl) {
 function buildSkillsAddArgs(baseUrl, skillName, options = {}) {
   const skillNames = Array.isArray(skillName) ? skillName : [skillName];
   const [firstSkillName, ...extraSkillNames] = skillNames;
-  const agents = options.agents ?? INSTALL_COMMANDS.skills.default_agents;
+  const agents = options.agents ?? DEFAULT_SKILL_AGENTS;
   const values = {
     skills_index_url: skillsIndexUrl(baseUrl),
     skills_source_url: skillsSourceUrl(baseUrl),
@@ -43066,11 +43097,14 @@ function buildSkillsAddArgs(baseUrl, skillName, options = {}) {
 
 // src/cli/skills-sync.ts
 import { spawn as spawn2, spawnSync } from "child_process";
-import { randomUUID as randomUUID8 } from "crypto";
+import { createHash as createHash6, randomUUID as randomUUID8 } from "crypto";
+import { homedir as homedir8 } from "os";
+import { gunzipSync } from "zlib";
 import {
   appendFileSync,
   existsSync as existsSync13,
   mkdirSync as mkdirSync10,
+  readdirSync as readdirSync4,
   readFileSync as readFileSync15,
   renameSync,
   rmSync as rmSync5,
@@ -43432,6 +43466,8 @@ async function maybeReportSdkCliFailure(input2) {
 
 // src/cli/skills-sync.ts
 var CHECK_TIMEOUT_MS2 = 3e3;
+var INSTALLER_PROBE_TIMEOUT_MS = 1500;
+var PUBLISHED_VERIFICATION_RETRY_MS = 5 * 6e4;
 function shouldSkipSkillsSync() {
   if (detectAgentRuntime() === "claude_cowork" || isCiEnvironment()) {
     return true;
@@ -43720,7 +43756,7 @@ function spawnDetachedSkillsSyncChild(argv, onSpawnError) {
 function failedSkillsSyncPath(baseUrl, agents) {
   return join18(
     sdkCliStateDirPath(baseUrl),
-    `skills-sync-failed-${agents.map(agentLeaseSegment).join("-")}-version`
+    `skills-sync-failed-${sortedLeaseAgents(agents).map(agentLeaseSegment).join("-")}-version`
   );
 }
 function hasMarkedSkillsSyncVersion(path, version) {
@@ -43743,13 +43779,15 @@ function writeMarkedSkillsSyncVersion(path, version) {
     return false;
   }
 }
-function writeUnavailableSkillsNotice(baseUrl, remoteVersion, skillNames, notice = writeSdkSkillsStatusLine) {
+function writeUnavailableSkillsNotice(baseUrl, remoteVersion, skillNames, reason, notice = writeSdkSkillsStatusLine, knownProbes) {
   const path = unavailableSkillsNoticePath(baseUrl);
   if (hasMarkedSkillsSyncVersion(path, remoteVersion)) return;
   writeMarkedSkillsSyncVersion(path, remoteVersion);
-  const manualCommand = `npx ${buildSkillsInstallArgs(baseUrl, skillNames).join(" ")}`;
+  const probes = reason === "no-installer" ? knownProbes ?? probeInstallers() : null;
+  const manualCommand = probes?.npx === "missing" && probes.bunx !== "missing" ? `bunx ${buildBunxSkillsInstallArgs(baseUrl, skillNames, DEFAULT_SKILL_AGENTS).map(shellQuote4).join(" ")}` : `npx ${buildSkillsInstallArgs(baseUrl, skillNames).join(" ")}`;
+  const explanation = reason === "unsupported-agent" ? "the detected agent has no automatic skills sync target. Automatic sync was skipped." : probes?.bunx === "missing" && probes.npx === "missing" ? "neither `bunx` nor `npx` was found on PATH. Make one available." : `installer version check failed for ${Object.entries(probes ?? {}).filter(([, result]) => result === "failed").map(([command]) => `\`${command}\``).join(" and ")}. Check those commands with --version.`;
   notice(
-    `Deepline agent skills are out of date, but neither \`bunx\` nor \`npx\` is available. Install Node.js/npm or Bun, then run:
+    `Deepline agent skills are out of date, but ${explanation} To install manually, run:
 ${manualCommand}`
   );
 }
@@ -43760,10 +43798,17 @@ function clearUnavailableSkillsNotice(baseUrl) {
   }
 }
 function hasFailedSkillsSync(baseUrl, remoteVersion, agents) {
-  return hasMarkedSkillsSyncVersion(
-    failedSkillsSyncPath(baseUrl, agents),
-    remoteVersion
+  const marked = readMarkedSkillsSyncVersion(
+    failedSkillsSyncPath(baseUrl, agents)
   );
+  if (marked === remoteVersion) return true;
+  try {
+    const retry = JSON.parse(marked);
+    const now = Date.now();
+    return retry.version === remoteVersion && typeof retry.retryAfter === "number" && retry.retryAfter > now && retry.retryAfter <= now + PUBLISHED_VERIFICATION_RETRY_MS;
+  } catch {
+    return false;
+  }
 }
 function hasFailedAutomaticSkillsSync(baseUrl, agents) {
   return existsSync13(failedSkillsSyncPath(baseUrl, agents));
@@ -43774,6 +43819,15 @@ function markFailedSkillsSync(baseUrl, remoteVersion, agents) {
     remoteVersion
   );
 }
+function deferPublishedVerificationRetry(baseUrl, remoteVersion, agents) {
+  return writeMarkedSkillsSyncVersion(
+    failedSkillsSyncPath(baseUrl, agents),
+    JSON.stringify({
+      version: remoteVersion,
+      retryAfter: Date.now() + PUBLISHED_VERIFICATION_RETRY_MS
+    })
+  );
+}
 function clearFailedSkillsSync(baseUrl, agents) {
   try {
     unlinkSync2(failedSkillsSyncPath(baseUrl, agents));
@@ -43788,7 +43842,7 @@ function sortedUniqueSkillNames(names) {
     (a, b) => a.localeCompare(b)
   );
 }
-async function fetchV1SkillNames(baseUrl) {
+async function fetchV1SkillIndex(baseUrl) {
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), CHECK_TIMEOUT_MS2);
   try {
@@ -43796,20 +43850,175 @@ async function fetchV1SkillNames(baseUrl) {
       new URL("/.well-known/skills/index.json", baseUrl),
       { signal: controller.signal }
     );
-    if (!response.ok) return [];
+    if (!response.ok) return null;
     const data = await response.json().catch(() => null);
-    const names = (data?.skills ?? []).filter((skill) => skill.install_surface === "v1").map((skill) => skill.name).filter(
-      (name) => typeof name === "string" && name.length > 0
-    );
-    return sortedUniqueSkillNames(names);
+    return data;
   } catch {
-    return [];
+    return null;
   } finally {
     clearTimeout(timeout);
   }
 }
-function buildSdkSkillNames(v1SkillNames) {
-  return sortedUniqueSkillNames(v1SkillNames);
+function v1SkillNames(index) {
+  const skills = Array.isArray(index?.skills) ? index.skills : [];
+  return sortedUniqueSkillNames(
+    skills.filter((skill) => skill && skill.install_surface === "v1").map((skill) => skill.name).filter(
+      (name) => typeof name === "string" && name.length > 0
+    )
+  );
+}
+function buildSdkSkillNames(v1SkillNames2) {
+  return sortedUniqueSkillNames(v1SkillNames2);
+}
+function isDefaultAgentSet(agents) {
+  return agents.length === DEFAULT_SKILL_AGENTS.length && agents.every((agent, index) => agent === DEFAULT_SKILL_AGENTS[index]);
+}
+function safeSkillFilePath(value) {
+  if (typeof value !== "string" || !value) return false;
+  return value.split("/").every(
+    (part) => /^[a-zA-Z0-9._-]+$/.test(part) && part !== "." && part !== ".."
+  );
+}
+function installedSkillFiles(root, prefix = "") {
+  const files = [];
+  for (const entry of readdirSync4(join18(root, prefix), {
+    withFileTypes: true
+  })) {
+    const relativePath = prefix ? `${prefix}/${entry.name}` : entry.name;
+    if (entry.isDirectory()) {
+      files.push(...installedSkillFiles(root, relativePath));
+    } else if (entry.isFile()) {
+      files.push(relativePath);
+    } else {
+      throw new Error(`unexpected installed entry in ${root}`);
+    }
+  }
+  return files.sort((a, b) => a.localeCompare(b));
+}
+function publishedArchiveFiles(bytes, expectedFiles, name) {
+  const tar = gunzipSync(bytes, { maxOutputLength: 128 * 1024 * 1024 });
+  const expected = new Set(expectedFiles);
+  const files = /* @__PURE__ */ new Map();
+  let offset = 0;
+  while (offset + 512 <= tar.length) {
+    const header = tar.subarray(offset, offset + 512);
+    if (header.every((byte) => byte === 0)) {
+      if (!tar.subarray(offset).every((byte) => byte === 0)) {
+        throw new Error(`invalid published archive for ${name}`);
+      }
+      break;
+    }
+    const file = header.toString("utf8", 0, 100).split("\0", 1)[0] ?? "";
+    const sizeText = header.toString("ascii", 124, 136).replace(/\0/g, "").trim();
+    const size = /^[0-7]+$/.test(sizeText) ? Number.parseInt(sizeText, 8) : NaN;
+    const type = header[156];
+    if (!safeSkillFilePath(file) || !expected.has(file) || files.has(file) || !Number.isSafeInteger(size) || size < 0 || type !== 0 && type !== 48 || header.subarray(345, 500).some((byte) => byte !== 0)) {
+      throw new Error(`invalid published archive entry for ${name}`);
+    }
+    const start = offset + 512;
+    const end = start + size;
+    if (end > tar.length) {
+      throw new Error(`incomplete published archive for ${name}`);
+    }
+    files.set(file, tar.subarray(start, end));
+    offset = start + Math.ceil(size / 512) * 512;
+  }
+  if (files.size !== expected.size) {
+    throw new Error(`published archive file list differs for ${name}`);
+  }
+  return files;
+}
+var PublishedSkillsVerificationError = class extends Error {
+};
+async function verifyDefaultAgentSkillsInstall(baseUrl, remoteVersion, skillNames, index) {
+  if (index?.version !== remoteVersion) {
+    throw new PublishedSkillsVerificationError(
+      "the published skill index version does not match the server version"
+    );
+  }
+  const published = /* @__PURE__ */ new Map();
+  const entries = Array.isArray(index.skills) ? index.skills : [];
+  for (const name of skillNames) {
+    if (!/^[a-z0-9][a-z0-9-]*$/.test(name)) {
+      throw new PublishedSkillsVerificationError(
+        `unsafe published skill name: ${name}`
+      );
+    }
+    const entry = entries.find(
+      (skill) => skill && skill.name === name && skill.install_surface === "v1"
+    );
+    if (!Array.isArray(entry?.files) || !entry.files.length || !entry.files.every(safeSkillFilePath) || new Set(entry.files).size !== entry.files.length || !entry.files.includes("SKILL.md") || entry.type !== "archive" || entry.url !== `./archives/${name}.tar.gz` || typeof entry.digest !== "string" || !/^sha256:[a-f0-9]{64}$/.test(entry.digest)) {
+      throw new PublishedSkillsVerificationError(
+        `invalid published file list for ${name}`
+      );
+    }
+    published.set(name, {
+      files: [...entry.files].sort((a, b) => a.localeCompare(b)),
+      digest: entry.digest
+    });
+  }
+  const expected = /* @__PURE__ */ new Map();
+  const jobs = [...published];
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 12e4);
+  let cursor = 0;
+  try {
+    await Promise.all(
+      Array.from({ length: Math.min(8, jobs.length) }, async () => {
+        while (cursor < jobs.length) {
+          const job = jobs[cursor++];
+          if (!job) break;
+          const [name, publishedSkill] = job;
+          const url = new URL(
+            `/.well-known/skills/archives/${name}.tar.gz`,
+            baseUrl
+          );
+          const response = await fetch(url, { signal: controller.signal });
+          if (!response.ok) {
+            throw new Error(`published archive is unavailable: ${name}`);
+          }
+          const bytes = Buffer.from(await response.arrayBuffer());
+          const digest = `sha256:${createHash6("sha256").update(bytes).digest("hex")}`;
+          if (digest !== publishedSkill.digest) {
+            throw new Error(`published archive digest differs for ${name}`);
+          }
+          for (const [file, content] of publishedArchiveFiles(
+            bytes,
+            publishedSkill.files,
+            name
+          )) {
+            expected.set(`${name}/${file}`, content);
+          }
+        }
+      })
+    );
+  } catch (error) {
+    throw new PublishedSkillsVerificationError(
+      error instanceof Error ? error.message : String(error)
+    );
+  } finally {
+    clearTimeout(timeout);
+    controller.abort();
+  }
+  const home = homedir8();
+  const claudeConfigDir = process.env.CLAUDE_CONFIG_DIR?.trim() || join18(home, ".claude");
+  for (const [name, { files }] of published) {
+    for (const root of [
+      join18(home, ".agents", "skills", name),
+      join18(claudeConfigDir, "skills", name)
+    ]) {
+      const installed = installedSkillFiles(root);
+      if (installed.length !== files.length || installed.some((file, index2) => file !== files[index2])) {
+        throw new Error(`installed file tree differs for ${name}`);
+      }
+      for (const file of files) {
+        const publishedContent = expected.get(`${name}/${file}`);
+        if (!publishedContent || !readFileSync15(join18(root, file)).equals(publishedContent)) {
+          throw new Error(`installed content differs for ${name}/${file}`);
+        }
+      }
+    }
+  }
 }
 async function fetchSkillsUpdate(baseUrl, localVersion) {
   const controller = new AbortController();
@@ -43850,13 +44059,58 @@ function buildBunxSkillsInstallArgs(baseUrl, skillNames, agents) {
     agents
   });
 }
-function hasCommand(command) {
+var NEGATIVE_INSTALLER_PROBE_TTL_MS = 5 * 60 * 1e3;
+function probeInstallers(timeoutMs) {
+  return {
+    bunx: probeCommand("bunx", timeoutMs),
+    npx: probeCommand("npx", timeoutMs)
+  };
+}
+function noInstallerProbePath(baseUrl) {
+  return join18(
+    sdkCliStateDirPath(baseUrl),
+    "skills-sync-no-installer-unknown.json"
+  );
+}
+function dueUnknownInstallerProbes(baseUrl, remoteVersion) {
+  const path = noInstallerProbePath(baseUrl);
+  try {
+    const cached = JSON.parse(readFileSync15(path, "utf-8"));
+    if (cached.version === remoteVersion && typeof cached.checkedAt === "number" && cached.checkedAt <= Date.now() && Date.now() - cached.checkedAt < NEGATIVE_INSTALLER_PROBE_TTL_MS && (cached.probes?.bunx === "missing" || cached.probes?.bunx === "failed") && (cached.probes?.npx === "missing" || cached.probes?.npx === "failed")) {
+      return cached.probes;
+    }
+  } catch {
+  }
+  const probes = probeInstallers(INSTALLER_PROBE_TIMEOUT_MS);
+  if (probes.bunx !== "available" && probes.npx !== "available") {
+    try {
+      mkdirSync10(dirname14(path), { recursive: true });
+      writeFileSync14(
+        path,
+        JSON.stringify({
+          version: remoteVersion,
+          checkedAt: Date.now(),
+          probes
+        }),
+        "utf-8"
+      );
+    } catch {
+    }
+  }
+  return probes;
+}
+function probeCommand(command, timeoutMs) {
   const plan = resolveShellSpawn(command, ["--version"]);
   const result = spawnSync(plan.command, plan.args, {
     stdio: "ignore",
-    shell: plan.shell
+    shell: plan.shell,
+    timeout: timeoutMs
   });
-  return result.status === 0;
+  if (result.status === 0) return "available";
+  return result.error?.code === "ENOENT" ? "missing" : "failed";
+}
+function hasCommand(command) {
+  return probeCommand(command) === "available";
 }
 function shellQuote4(arg) {
   return `'${arg.replace(/'/g, `'\\''`)}'`;
@@ -43942,7 +44196,7 @@ async function runSkillsInstall(installs, agents, notice = writeSdkSkillsStatusL
   }
   const details = failures.map((failure) => failure.detail).filter(Boolean).join("\n");
   const attemptedCommands = failures.map((failure) => `  ${failure.manualCommand}`).join("\n");
-  const retryAgent = agents.at(0);
+  const retryAgent = agents.length === 1 ? agents[0] : void 0;
   notice(
     `Deepline agent-skills refresh failed for ${agents.join(", ")}. The Deepline command will continue; this only affects optional local agent instructions, not authentication, data, or billing.
 ` + (attemptedCommands ? `Attempted installer command${failures.length === 1 ? "" : "s"}:
@@ -44029,6 +44283,9 @@ async function syncSdkSkillsIfNeeded(baseUrl, options = {}) {
   if (options.mode === "detached" && agents.length > 0) {
     flushDeferredSkillsNotices(baseUrl, agents);
   }
+  if (options.mode === "detached" && options.update === void 0 && isDefaultAgentSet(agents)) {
+    return;
+  }
   const ownsInProgressMarker = options.mode !== "detached" && agents.length > 0 && Boolean(options.claim);
   const leases = ownsInProgressMarker ? readInProgressSkillsSyncLeases(baseUrl, agents) : null;
   if (leases && [...leases.values()].some((lease) => lease.owner !== options.claim)) {
@@ -44061,11 +44318,33 @@ async function syncSdkSkillsIfNeeded(baseUrl, options = {}) {
       writeUnavailableSkillsNotice(
         baseUrl,
         update.remoteVersion,
-        buildSdkSkillNames(DEFAULT_SDK_SKILL_NAMES)
+        buildSdkSkillNames(DEFAULT_SDK_SKILL_NAMES),
+        "unsupported-agent"
       );
       return;
     }
     if (options.mode === "detached" && agents.length > 0) {
+      if (isDefaultAgentSet(agents)) {
+        if (agents.some(
+          (agent) => isFreshInProgressSkillsSync(
+            readInProgressSkillsSyncLease(baseUrl, agent)
+          )
+        )) {
+          return;
+        }
+        const probes = dueUnknownInstallerProbes(baseUrl, update.remoteVersion);
+        if (probes.bunx !== "available" && probes.npx !== "available") {
+          writeUnavailableSkillsNotice(
+            baseUrl,
+            update.remoteVersion,
+            buildSdkSkillNames(DEFAULT_SDK_SKILL_NAMES),
+            "no-installer",
+            writeSdkSkillsStatusLine,
+            probes
+          );
+          return;
+        }
+      }
       const outcome = claimAndSpawnDetachedSkillsSync(
         baseUrl,
         agents,
@@ -44075,10 +44354,11 @@ async function syncSdkSkillsIfNeeded(baseUrl, options = {}) {
       if (outcome === "held") return;
       if (outcome === "claimed") {
         writeSdkSkillsStatusLine(
-          "Deepline skills changed; refreshing agent skills in the background."
+          "Deepline skills are out of date; updating in the background."
         );
         return;
       }
+      if (isDefaultAgentSet(agents)) return;
     }
     await runInlineSkillsSync(
       baseUrl,
@@ -44095,7 +44375,8 @@ async function syncSdkSkillsIfNeeded(baseUrl, options = {}) {
 async function runInlineSkillsSync(baseUrl, remoteVersion, agents, notices) {
   const update = { remoteVersion };
   const notice = notices === "defer" ? deferSkillsNotice(baseUrl, agents) : writeSdkSkillsStatusLine;
-  const remoteSkillNames = await fetchV1SkillNames(baseUrl);
+  const index = await fetchV1SkillIndex(baseUrl);
+  const remoteSkillNames = v1SkillNames(index);
   const skillNames = buildSdkSkillNames(
     remoteSkillNames.length > 0 ? remoteSkillNames : DEFAULT_SDK_SKILL_NAMES
   );
@@ -44105,6 +44386,7 @@ async function runInlineSkillsSync(baseUrl, remoteVersion, agents, notices) {
       baseUrl,
       update.remoteVersion,
       skillNames,
+      "unsupported-agent",
       notice
     );
     return;
@@ -44115,6 +44397,7 @@ async function runInlineSkillsSync(baseUrl, remoteVersion, agents, notices) {
       baseUrl,
       update.remoteVersion,
       skillNames,
+      "no-installer",
       notice
     );
     return;
@@ -44140,10 +44423,47 @@ async function runInlineSkillsSync(baseUrl, remoteVersion, agents, notices) {
       markerWritten,
       attempts: installResult.attempts
     });
+    if (isDefaultAgentSet(agents)) {
+      notice(
+        `After fixing the installer, remove ${failedSkillsSyncPath(baseUrl, agents)} to retry this skills version automatically.`
+      );
+    }
     return;
   }
+  if (isDefaultAgentSet(agents)) {
+    try {
+      await verifyDefaultAgentSkillsInstall(
+        baseUrl,
+        update.remoteVersion,
+        skillNames,
+        index
+      );
+    } catch (error) {
+      const detail = error instanceof Error ? error.message : String(error);
+      const publishedFailure = error instanceof PublishedSkillsVerificationError;
+      const markerWritten = publishedFailure ? deferPublishedVerificationRetry(baseUrl, update.remoteVersion, agents) : markFailedSkillsSync(baseUrl, update.remoteVersion, agents);
+      notice(
+        publishedFailure ? `Deepline could not verify the published skills: ${detail}. The local version remains stale; it will retry automatically on a later command.` : `Deepline agent-skills refresh could not verify the five installed targets: ${detail}. The local version remains stale. After fixing the install, remove ${failedSkillsSyncPath(baseUrl, agents)} to retry this version automatically.`
+      );
+      void maybeReportAutomaticSkillsSyncFailure({
+        baseUrl,
+        remoteSkillsVersion: update.remoteVersion,
+        agents,
+        skillsPackage: SKILLS_NPX_PACKAGE,
+        targetSkillCount: skillNames.length,
+        markerWritten,
+        attempts: []
+      });
+      return;
+    }
+  }
   runLegacySkillsCleanup(agents);
-  writeSdkSkillsLocalVersion(baseUrl, update.remoteVersion, agents);
+  if (!writeSdkSkillsLocalVersion(baseUrl, update.remoteVersion, agents)) {
+    notice(
+      "Deepline agent skills installed, but the local skills version could not be recorded. A later command will retry the refresh."
+    );
+    return;
+  }
   clearUnavailableSkillsNotice(baseUrl);
   clearFailedSkillsSync(baseUrl, agents);
   notice("Deepline agent skills are up to date.");
@@ -44212,7 +44532,7 @@ function detectSkillsAgents(input2) {
   if (knownAgent) return [knownAgent];
   const roots = [
     ...input2.scope === "local" && input2.root ? [input2.root] : [],
-    input2.homeDir ?? homedir8()
+    input2.homeDir ?? homedir9()
   ];
   const detected = AGENT_MARKERS.filter(
     (marker) => roots.some(
@@ -44796,7 +45116,7 @@ function safeRead(path) {
 function removeKnownLegacyPaths(baseUrl) {
   return CliInstallation.forUser({
     baseUrlSlug: baseUrlSlug(baseUrl),
-    home: homedir9()
+    home: homedir10()
   }).removeRetiredArtifacts();
 }
 function resolvePathCommands(command) {
@@ -45559,7 +45879,7 @@ import {
   rmSync as rmSync6,
   writeFileSync as writeFileSync17
 } from "fs";
-import { homedir as homedir10 } from "os";
+import { homedir as homedir11 } from "os";
 import { dirname as dirname17, join as join21 } from "path";
 var UPDATE_PREFERENCES_SCHEMA_VERSION = 1;
 var CLI_UPDATE_MESSAGES = [
@@ -45588,7 +45908,7 @@ function unreadablePreferences(path, error) {
     acknowledgedMessages: CLI_UPDATE_MESSAGES.map(({ id }) => id)
   };
 }
-function cliUpdatePreferencesPath(homeDir2 = homedir10()) {
+function cliUpdatePreferencesPath(homeDir2 = homedir11()) {
   return join21(
     homeDir2,
     ".local",
@@ -45597,7 +45917,7 @@ function cliUpdatePreferencesPath(homeDir2 = homedir10()) {
     "update-preferences.json"
   );
 }
-function readCliUpdatePreferences(homeDir2 = homedir10()) {
+function readCliUpdatePreferences(homeDir2 = homedir11()) {
   const path = cliUpdatePreferencesPath(homeDir2);
   if (!existsSync16(path)) return defaultPreferences();
   try {
@@ -45614,7 +45934,7 @@ function readCliUpdatePreferences(homeDir2 = homedir10()) {
     return unreadablePreferences(path, error);
   }
 }
-function writeCliUpdatePreferences(preferences, homeDir2 = homedir10()) {
+function writeCliUpdatePreferences(preferences, homeDir2 = homedir11()) {
   const path = cliUpdatePreferencesPath(homeDir2);
   const tempPath = `${path}.${process.pid}.tmp`;
   mkdirSync13(dirname17(path), { recursive: true });
@@ -45629,7 +45949,7 @@ function writeCliUpdatePreferences(preferences, homeDir2 = homedir10()) {
     rmSync6(tempPath, { force: true });
   }
 }
-function setCliAutoUpdateEnabled(enabled, homeDir2 = homedir10()) {
+function setCliAutoUpdateEnabled(enabled, homeDir2 = homedir11()) {
   const current = readCliUpdatePreferences(homeDir2);
   const next = {
     ...current,
@@ -45639,7 +45959,7 @@ function setCliAutoUpdateEnabled(enabled, homeDir2 = homedir10()) {
   writeCliUpdatePreferences(next, homeDir2);
   return next;
 }
-function setCliPinnedVersion(version, homeDir2 = homedir10()) {
+function setCliPinnedVersion(version, homeDir2 = homedir11()) {
   const next = {
     ...readCliUpdatePreferences(homeDir2),
     pinnedVersion: version
@@ -45647,18 +45967,18 @@ function setCliPinnedVersion(version, homeDir2 = homedir10()) {
   writeCliUpdatePreferences(next, homeDir2);
   return next;
 }
-function clearCliPinnedVersion(homeDir2 = homedir10()) {
+function clearCliPinnedVersion(homeDir2 = homedir11()) {
   const current = readCliUpdatePreferences(homeDir2);
   if (current.pinnedVersion === null) return current;
   const next = { ...current, pinnedVersion: null };
   writeCliUpdatePreferences(next, homeDir2);
   return next;
 }
-function shouldRunCliAutoUpdate(homeDir2 = homedir10()) {
+function shouldRunCliAutoUpdate(homeDir2 = homedir11()) {
   const preferences = readCliUpdatePreferences(homeDir2);
   return preferences.autoUpdateEnabled && preferences.pinnedVersion === null;
 }
-function consumePendingCliUpdateMessages(homeDir2 = homedir10()) {
+function consumePendingCliUpdateMessages(homeDir2 = homedir11()) {
   const preferences = readCliUpdatePreferences(homeDir2);
   const acknowledged = new Set(preferences.acknowledgedMessages);
   const pending = CLI_UPDATE_MESSAGES.filter(({ id }) => !acknowledged.has(id));
@@ -45686,7 +46006,7 @@ import {
   unlinkSync as unlinkSync3,
   writeFileSync as writeFileSync18
 } from "fs";
-import { homedir as homedir11 } from "os";
+import { homedir as homedir12 } from "os";
 import {
   basename as basename7,
   dirname as dirname18,
@@ -46068,7 +46388,7 @@ function isHomebrewFormulaEntrypoint(entrypoint) {
 }
 function resolveUpdatePlan(options = {}) {
   const env = options.env ?? process.env;
-  const homeDir2 = options.homeDir ?? homedir11();
+  const homeDir2 = options.homeDir ?? homedir12();
   const entrypoint = options.entrypoint ?? (process.argv[1] ? resolve19(process.argv[1]) : "");
   const sourceRoot = entrypoint ? findRepoBackedSdkRoot(dirname18(entrypoint)) : null;
   if (sourceRoot) {
@@ -46126,7 +46446,7 @@ function autoUpdateFailurePath(plan) {
     return join23(plan.stateDir, AUTO_UPDATE_FAILURE_FILE);
   }
   return join23(
-    homedir11(),
+    homedir12(),
     ".local",
     "deepline",
     "sdk-cli",
@@ -47608,7 +47928,7 @@ Examples:
 
 // src/cli/commands/tools.ts
 import { Option as Option4 } from "commander";
-import { createHash as createHash6, randomUUID as randomUUID9 } from "crypto";
+import { createHash as createHash7, randomUUID as randomUUID9 } from "crypto";
 
 // ../plays/row-identity.ts
 function stableValue(value) {
@@ -47648,7 +47968,7 @@ import {
   writeFileSync as writeFileSync19,
   writeSync
 } from "fs";
-import { homedir as homedir12 } from "os";
+import { homedir as homedir13 } from "os";
 import { dirname as dirname19, join as join24 } from "path";
 function isPlainObject(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
@@ -47776,7 +48096,7 @@ function projectRowOutput(conversion) {
   };
 }
 function ensureOutputDir() {
-  const outputDir = join24(homedir12(), ".local", "share", "deepline", "data");
+  const outputDir = join24(homedir13(), ".local", "share", "deepline", "data");
   mkdirSync15(outputDir, { recursive: true });
   return outputDir;
 }
@@ -50135,7 +50455,7 @@ function parseToolExecuteTimeout(raw) {
 }
 function pendingToolExecutionPath(input2) {
   const config = resolveConfig();
-  const fingerprint = createHash6("sha256").update(config.baseUrl).update("\0").update(createHash6("sha256").update(config.apiKey).digest("hex")).update("\0").update(input2.toolId).update("\0").update(stableStringify(input2.params)).update("\0").update(input2.responseIntent).digest("hex");
+  const fingerprint = createHash7("sha256").update(config.baseUrl).update("\0").update(createHash7("sha256").update(config.apiKey).digest("hex")).update("\0").update(input2.toolId).update("\0").update(stableStringify(input2.params)).update("\0").update(input2.responseIntent).digest("hex");
   return join25(
     sdkCliStateDirPath(resolveConfig().baseUrl),
     `pending-tool-execution-${fingerprint}.json`
@@ -50718,7 +51038,7 @@ import { mkdir as mkdir6, readFile as readFile6, writeFile as writeFile5 } from
 import { dirname as dirname21, join as join26, resolve as resolve21 } from "path";
 
 // src/cli/workflow-to-play.ts
-import { createHash as createHash7 } from "crypto";
+import { createHash as createHash8 } from "crypto";
 var HITL_WAIT_FOR_SIGNAL_TOOL = "deepline_workflow_wait_for_signal";
 var HITL_SLACK_TOOL = "slack_message_with_hitl";
 var SUB_WORKFLOW_TOOL_PREFIX = "deepline_workflow_";
@@ -50824,7 +51144,7 @@ function sanitizePlayNameSegment(value) {
 }
 function deriveWorkflowPlayName(workflowName) {
   const base = sanitizePlayNameSegment(workflowName) || "workflow";
-  const suffix = createHash7("sha256").update(workflowName).digest("hex").slice(0, 8);
+  const suffix = createHash8("sha256").update(workflowName).digest("hex").slice(0, 8);
   const reserved = suffix.length + 1;
   const allowedBase = Math.max(1, MAX_PLAY_NAME_LENGTH - reserved);
   let name = `${base.slice(0, allowedBase)}_${suffix}`;