hyperframes 0.8.81 → 0.8.82

package/dist/backgroundChecksWorker.js

@@ -0,0 +1,890 @@
+import { createRequire as __hf_createRequire } from "node:module";
+import { fileURLToPath as __hf_fileURLToPath } from "node:url";
+import { dirname as __hf_dirname } from "node:path";
+var require = __hf_createRequire(import.meta.url);
+var __filename = __hf_fileURLToPath(import.meta.url);
+var __dirname = __hf_dirname(__filename);
+
+// src/utils/updateCheck.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { join as join2 } from "path";
+import { compareVersions } from "compare-versions";
+
+// src/telemetry/config.ts
+import * as fs from "fs";
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
+import { randomUUID } from "crypto";
+
+// src/utils/errorMessage.ts
+function normalizeErrorMessage(error) {
+  if (error instanceof Error) return error.message;
+  if (typeof error === "string") return error;
+  if (typeof error === "object" && error !== null) {
+    const msg = error.message;
+    if (typeof msg === "string") return msg;
+    try {
+      return JSON.stringify(error);
+    } catch {
+      try {
+        return `{${Object.keys(error).join(", ")}}`;
+      } catch {
+      }
+    }
+  }
+  return String(error ?? "unknown error");
+}
+
+// src/utils/env.ts
+function isDevMode() {
+  try {
+    const url = new URL(import.meta.url);
+    return url.pathname.endsWith(".ts");
+  } catch {
+    return false;
+  }
+}
+
+// src/telemetry/posthogKey.ts
+var POSTHOG_API_KEY = "phc_zjjbX0PnWxERXrMHhkEJWj9A9BhGVLRReICgsfTMmpx";
+
+// src/telemetry/policy.ts
+var ENV_OPT_OUT_VALUES = /* @__PURE__ */ new Set(["1", "true", "yes", "on"]);
+function isEnvOptOutValue(value) {
+  return value !== void 0 && ENV_OPT_OUT_VALUES.has(value.trim().toLowerCase());
+}
+function telemetryRuntimeOverride() {
+  if (isEnvOptOutValue(process.env["HYPERFRAMES_NO_TELEMETRY"])) {
+    return "HYPERFRAMES_NO_TELEMETRY";
+  }
+  if (isEnvOptOutValue(process.env["DO_NOT_TRACK"])) {
+    return "DO_NOT_TRACK";
+  }
+  if (isDevMode()) {
+    return "dev_mode";
+  }
+  if (!POSTHOG_API_KEY.startsWith("phc_")) {
+    return "telemetry_disabled_build";
+  }
+  return null;
+}
+
+// src/utils/attendedTerminal.ts
+function envFlagEnabled(name) {
+  const value = process.env[name]?.trim().toLowerCase();
+  return Boolean(value && value !== "0" && value !== "false" && value !== "no");
+}
+function isAttendedTerminal() {
+  return !envFlagEnabled("CI") && process.stdin.isTTY === true && process.stdout.isTTY === true;
+}
+
+// src/media-use/lib/config-lock.mjs
+function withFileLock(lockPath, fs2, task) {
+  const token = `${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+  const started = Date.now();
+  for (; ; ) {
+    let fd;
+    try {
+      fd = fs2.openSync(lockPath, "wx");
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      let leftover = false;
+      try {
+        leftover = Date.now() - fs2.statSync(lockPath).mtimeMs > 5e3;
+      } catch {
+      }
+      if (leftover || Date.now() - started > 1e4)
+        throw Object.assign(
+          new Error(
+            `Settings are locked by another hyperframes process. If none is running, delete ${lockPath}`
+          ),
+          { code: "HF_SETTINGS_LOCKED" }
+        );
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 25);
+      continue;
+    }
+    try {
+      fs2.writeSync(fd, token);
+    } catch (error) {
+      fs2.rmSync(lockPath, { force: true });
+      throw error;
+    } finally {
+      fs2.closeSync(fd);
+    }
+    break;
+  }
+  try {
+    return task();
+  } finally {
+    try {
+      fs2.rmSync(lockPath);
+    } catch {
+    }
+  }
+}
+
+// src/telemetry/config.ts
+var CONFIG_DIR = join(homedir(), ".hyperframes");
+var CONFIG_FILE = join(CONFIG_DIR, "config.json");
+var STATE_FILE = join(CONFIG_DIR, "install-state.json");
+var LEGACY_STATE_FILE = join(homedir(), ".local", "state", "hyperframes", "install-state.json");
+function salvageInstallState(parsed) {
+  const markerAt = typeof parsed.markerAt === "string" ? parsed.markerAt : void 0;
+  const bucketSeed = parseNonEmptyString(parsed.bucketSeed);
+  const fired = parsed.deParallelRouterTrialFired === true ? true : void 0;
+  if (markerAt === void 0 && bucketSeed === void 0 && fired === void 0) return "corrupt";
+  return {
+    markerAt: markerAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+    deParallelRouterTrialFired: fired,
+    bucketSeed
+  };
+}
+function parseInstallState(file) {
+  if (!existsSync(file)) return "absent";
+  try {
+    return salvageInstallState(JSON.parse(readFileSync(file, "utf-8")));
+  } catch {
+    return "corrupt";
+  }
+}
+var seedBackfillWarned = false;
+function warnSeedBackfillFailed(error) {
+  if (seedBackfillWarned) return;
+  seedBackfillWarned = true;
+  if (telemetryRuntimeOverride() !== null) return;
+  console.warn(
+    `[hyperframes] Could not persist telemetry config${error ? `: ${error}` : ""}. Canary cohort assignment will not be stable across runs.`
+  );
+}
+function backfillBucketSeed(config) {
+  const recorded = readInstallState();
+  config.bucketSeed = (isInstallState(recorded) ? recorded.bucketSeed : void 0) ?? randomUUID();
+  const write = writeConfigWithResult(config);
+  if (!write.ok) warnSeedBackfillFailed(write.error);
+  return write;
+}
+var latchedFiredSeen = false;
+function installStateLatchedFired() {
+  if (latchedFiredSeen) return true;
+  const state = readInstallState();
+  latchedFiredSeen = isInstallState(state) && state.deParallelRouterTrialFired === true;
+  return latchedFiredSeen;
+}
+function installStateSeed() {
+  const state = readInstallState();
+  return isInstallState(state) ? state.bucketSeed : void 0;
+}
+function isInstallState(value) {
+  return typeof value !== "string";
+}
+function readInstallState() {
+  const current = parseInstallState(STATE_FILE);
+  if (isInstallState(current)) {
+    removeLegacyStateFile();
+    return current;
+  }
+  const legacy = parseInstallState(LEGACY_STATE_FILE);
+  if (!isInstallState(legacy)) {
+    if (legacy === "corrupt") removeLegacyStateFile();
+    return current === "corrupt" || legacy === "corrupt" ? "corrupt" : "absent";
+  }
+  try {
+    writeInstallState(legacy);
+    removeLegacyStateFile();
+  } catch {
+  }
+  return legacy;
+}
+function removeLegacyStateFile() {
+  try {
+    if (existsSync(LEGACY_STATE_FILE)) rmSync(LEGACY_STATE_FILE, { force: true });
+  } catch {
+  }
+}
+var stateMarkerSynced = false;
+var stateFiredSynced = false;
+function writeInstallState(next) {
+  mkdirSync(CONFIG_DIR, { recursive: true, mode: 448 });
+  const tmpFile = `${STATE_FILE}.${process.pid}.tmp`;
+  writeFileSync(tmpFile, JSON.stringify(next, null, 2) + "\n", { mode: 384 });
+  renameSync(tmpFile, STATE_FILE);
+}
+function sameInstallState(a, b) {
+  return a.deParallelRouterTrialFired === b.deParallelRouterTrialFired && a.bucketSeed === b.bucketSeed;
+}
+function latchedFired(state, config) {
+  return state?.deParallelRouterTrialFired === true || config.deParallelRouterTrialFired === true || void 0;
+}
+function nextInstallState(state, config) {
+  const next = {
+    markerAt: state?.markerAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+    deParallelRouterTrialFired: latchedFired(state, config),
+    // Write-once: an existing seed always wins, so cohorts stay
+    // anchored to the FIRST install in this config dir, not the latest one.
+    bucketSeed: state?.bucketSeed ?? config.bucketSeed
+  };
+  if (state !== null && sameInstallState(state, next)) return null;
+  return next;
+}
+function applyInstallState(config, wantFired) {
+  const read = readInstallState();
+  const state = isInstallState(read) ? read : null;
+  const next = nextInstallState(state, config);
+  if (next !== null) writeInstallState(next);
+  stateMarkerSynced = true;
+  stateFiredSynced = wantFired || state?.deParallelRouterTrialFired === true;
+  if (wantFired) latchedFiredSeen = true;
+}
+function syncInstallState(config) {
+  const wantFired = config.deParallelRouterTrialFired === true;
+  if (stateMarkerSynced && !existsSync(STATE_FILE)) {
+    stateMarkerSynced = false;
+    stateFiredSynced = false;
+  }
+  if (stateMarkerSynced && (stateFiredSynced || !wantFired)) return true;
+  try {
+    applyInstallState(config, wantFired);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function mintAndCacheConfig() {
+  const config = mintConfig();
+  const write = writeConfigWithResult(config);
+  if (!write.ok) warnSeedBackfillFailed(write.error);
+  classifyIdentity(
+    config.anonymousId,
+    write.ok ? "unknown" : "process_only",
+    writeOutcomeOf(write)
+  );
+  cachedConfig = { ...config };
+  return { ...config };
+}
+function mintConfig() {
+  const read = readInstallState();
+  const state = isInstallState(read) ? read : null;
+  return {
+    ...DEFAULT_CONFIG,
+    anonymousId: randomUUID(),
+    // A corrupt record still means this machine had an install — reporting it
+    // as `false` would count a partial disk write as a brand-new machine and
+    // understate recoverable churn, which is the one thing this field exists
+    // to measure. `undefined` on configs minted before the field existed.
+    predecessorFound: state !== null || read === "corrupt",
+    stateFileCorrupt: read === "corrupt" ? true : void 0,
+    // The rollover itself: a breaker tripped by a previous install on this
+    // machine stays tripped for the new one, and the canary bucketing seed is
+    // inherited so cohorts hold across a config.json re-mint.
+    deParallelRouterTrialFired: state?.deParallelRouterTrialFired === true ? true : void 0,
+    bucketSeed: state?.bucketSeed ?? randomUUID()
+  };
+}
+var MAX_RECENT_RENDERS = 5;
+var DEFAULT_CONFIG = {
+  telemetryEnabled: true,
+  anonymousId: "",
+  telemetryNoticeShown: false,
+  commandCount: 0,
+  renderSuccessCount: 0,
+  lastFeedbackPromptAt: 0
+};
+var cachedConfig = null;
+var identityClassification;
+function classifyIdentity(anonymousId, persistence, writeOutcome) {
+  if (identityClassification?.anonymousId === anonymousId) return;
+  identityClassification = { anonymousId, persistence, writeOutcome };
+}
+function writeOutcomeOf(write) {
+  if (!write.ok) return "failed";
+  return write.mirrored === false ? "ok_unmirrored" : "ok";
+}
+function parseNonEmptyString(value) {
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function parseRecentRenders(value) {
+  if (!Array.isArray(value)) return void 0;
+  return value.filter(
+    (r) => typeof r === "object" && r !== null && typeof r.id === "string" && typeof r.at === "string" && typeof r.ok === "boolean"
+  ).slice(-MAX_RECENT_RENDERS);
+}
+function passthroughFields(parsed) {
+  return {
+    lastUpdateCheck: parsed.lastUpdateCheck,
+    latestVersion: parsed.latestVersion,
+    lastStalePinNoticeAt: parsed.lastStalePinNoticeAt,
+    lastUpdateAttemptAt: parsed.lastUpdateAttemptAt,
+    lastSkillsAttemptAt: parsed.lastSkillsAttemptAt,
+    pendingUpdate: parsed.pendingUpdate,
+    completedUpdate: parsed.completedUpdate,
+    lastSkillsCheck: parsed.lastSkillsCheck,
+    skillsUpdateAvailable: parsed.skillsUpdateAvailable,
+    skillsOutdatedCount: parsed.skillsOutdatedCount,
+    skillsMissingCount: parsed.skillsMissingCount,
+    skillsRemovedCount: parsed.skillsRemovedCount,
+    localEmbeddingEnabled: consentFrom(parsed.localEmbeddingEnabled)
+  };
+}
+function guardedFields(parsed) {
+  return {
+    // Explicit `=== true`/typeof-number checks rather than a truthy/nullish
+    // read — a hand-edited or corrupted config could plausibly carry a
+    // non-boolean/non-number JSON value (e.g. the STRING "false", which is
+    // truthy in JS) for these two fields specifically, since they're read
+    // with a bare truthy check at the call site (review finding).
+    // `|| installStateLatchedFired()` — a latch recorded in install-state
+    // wins over an untripped config.json, never the reverse.
+    deParallelRouterTrialFired: parsed.deParallelRouterTrialFired === true || installStateLatchedFired() ? true : void 0,
+    deParallelRouterTrialRenderCount: typeof parsed.deParallelRouterTrialRenderCount === "number" ? parsed.deParallelRouterTrialRenderCount : void 0,
+    predecessorFound: typeof parsed.predecessorFound === "boolean" ? parsed.predecessorFound : void 0,
+    stateFileCorrupt: parsed.stateFileCorrupt === true ? true : void 0,
+    // Install-state wins, exactly as it does for the latch. Without this the
+    // two stores could hold different seeds indefinitely: nextInstallState
+    // is write-once (state's seed always survives), but the read took
+    // config.json's blindly — so restoring or syncing only config.json left
+    // the install bucketing on A while install-state kept B, and the next
+    // re-mint silently flipped every cohort at once.
+    bucketSeed: installStateSeed() ?? parseNonEmptyString(parsed.bucketSeed)
+  };
+}
+function materializeConfig(parsed) {
+  return {
+    ...passthroughFields(parsed),
+    telemetryEnabled: parsed.telemetryEnabled ?? DEFAULT_CONFIG.telemetryEnabled,
+    anonymousId: parsed.anonymousId || randomUUID(),
+    telemetryNoticeShown: parsed.telemetryNoticeShown ?? DEFAULT_CONFIG.telemetryNoticeShown,
+    commandCount: parsed.commandCount ?? DEFAULT_CONFIG.commandCount,
+    renderSuccessCount: parsed.renderSuccessCount ?? DEFAULT_CONFIG.renderSuccessCount,
+    lastFeedbackPromptAt: parsed.lastFeedbackPromptAt ?? DEFAULT_CONFIG.lastFeedbackPromptAt,
+    ...guardedFields(parsed),
+    recentRenders: parseRecentRenders(parsed.recentRenders)
+  };
+}
+function readConfig() {
+  if (cachedConfig) return { ...cachedConfig };
+  if (!existsSync(CONFIG_FILE)) return mintAndCacheConfig();
+  try {
+    const raw = readFileSync(CONFIG_FILE, "utf-8");
+    const parsed = JSON.parse(raw);
+    const config = materializeConfig(parsed);
+    const idFromDisk = parseNonEmptyString(parsed.anonymousId) !== void 0;
+    if (config.bucketSeed === void 0) {
+      const write = backfillBucketSeed(config);
+      if (idFromDisk) classifyIdentity(config.anonymousId, "durable");
+      else
+        classifyIdentity(
+          config.anonymousId,
+          write.ok ? "unknown" : "process_only",
+          writeOutcomeOf(write)
+        );
+      cachedConfig = config;
+      return { ...config };
+    }
+    classifyIdentity(config.anonymousId, idFromDisk ? "durable" : "process_only");
+    cachedConfig = config;
+    return { ...config };
+  } catch {
+    const config = { ...mintConfig(), telemetryEnabled: false, localEmbeddingEnabled: false };
+    const write = writeConfigWithResult(config);
+    classifyIdentity(
+      config.anonymousId,
+      write.ok ? "unknown" : "process_only",
+      writeOutcomeOf(write)
+    );
+    return config;
+  }
+}
+function readConfigFresh() {
+  cachedConfig = null;
+  return readConfig();
+}
+function writeConfig(config) {
+  return writeConfigWithResult(config).ok;
+}
+function writeConfigWithResult(config) {
+  try {
+    return withConfigLock(
+      () => persistConfig({ ...config, localEmbeddingEnabled: localModelConsentOnDisk() })
+    );
+  } catch (error) {
+    warnSettingsLockedOnce(error);
+    return { ok: false, error: normalizeErrorMessage(error) };
+  }
+}
+var warnedSettingsLocked = false;
+function warnSettingsLockedOnce(error) {
+  if (warnedSettingsLocked || error?.code !== "HF_SETTINGS_LOCKED")
+    return;
+  warnedSettingsLocked = true;
+  if (!isAttendedTerminal() || process.argv.some((arg) => arg === "--json" || arg.startsWith("--json=")))
+    return;
+  console.error(`${error.message} (see \`hyperframes doctor\`).`);
+}
+function consentFrom(value) {
+  return value === void 0 ? void 0 : value === true;
+}
+function localModelConsentOnDisk() {
+  try {
+    return consentFrom(JSON.parse(readFileSync(CONFIG_FILE, "utf-8")).localEmbeddingEnabled);
+  } catch (error) {
+    return error.code === "ENOENT" ? void 0 : false;
+  }
+}
+var holdingConfigLock = false;
+function withConfigLock(task) {
+  if (holdingConfigLock) return task();
+  mkdirSync(CONFIG_DIR, { recursive: true, mode: 448 });
+  return withFileLock(`${CONFIG_FILE}.lock`, fs, () => {
+    holdingConfigLock = true;
+    try {
+      return task();
+    } finally {
+      holdingConfigLock = false;
+    }
+  });
+}
+function persistConfig(config) {
+  try {
+    mkdirSync(CONFIG_DIR, { recursive: true, mode: 448 });
+    const tmpFile = `${CONFIG_FILE}.${process.pid}.tmp`;
+    writeFileSync(tmpFile, JSON.stringify(config, null, 2) + "\n", { mode: 384 });
+    renameSync(tmpFile, CONFIG_FILE);
+    cachedConfig = { ...config };
+    const mirrored = syncInstallState(config);
+    return mirrored ? { ok: true } : { ok: true, mirrored: false };
+  } catch (error) {
+    return { ok: false, error: normalizeErrorMessage(error) };
+  }
+}
+
+// src/version.ts
+var VERSION = true ? "0.8.82" : "0.0.0-dev";
+
+// src/utils/hostAnswers.ts
+import { promises as dns } from "dns";
+var PROBE_TIMEOUT_MS = 1e3;
+function fetchGoesThroughEnvProxy() {
+  if (!(process.env["HTTPS_PROXY"] ?? process.env["https_proxy"])?.trim()) return false;
+  const flags = [...process.execArgv, ...process.env["NODE_OPTIONS"]?.split(/\s+/u) ?? []];
+  return process.env["NODE_USE_ENV_PROXY"] === "1" || flags.includes("--use-env-proxy");
+}
+async function hostAnswers(host) {
+  if (fetchGoesThroughEnvProxy()) return true;
+  try {
+    const resolver = new dns.Resolver({ timeout: PROBE_TIMEOUT_MS, tries: 1 });
+    const results = await Promise.allSettled([resolver.resolve4(host), resolver.resolve6(host)]);
+    const anyFamilyTimedOut = results.some(
+      (r) => r.status === "rejected" && r.reason.code === "ETIMEOUT"
+    );
+    return !anyFamilyTimedOut && results.some((r) => r.status === "fulfilled");
+  } catch {
+    return false;
+  }
+}
+
+// src/utils/installerDetection.ts
+import { realpathSync } from "fs";
+import { posix } from "path";
+
+// src/utils/safeVersion.ts
+function isSafeVersion(v) {
+  return /^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(v);
+}
+
+// src/utils/updateCheck.ts
+var NPM_REGISTRY_URL = "https://registry.npmjs.org/hyperframes/latest";
+var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
+var FETCH_TIMEOUT_MS = 3e3;
+function isNewerSemver(a, b) {
+  try {
+    return compareVersions(a, b) > 0;
+  } catch {
+    return a !== b;
+  }
+}
+async function checkForUpdate(force) {
+  const config = readConfig();
+  if (!force && !updateCheckDue(config)) return fallbackResult(config.latestVersion);
+  try {
+    if (!force && !await hostAnswers(new URL(NPM_REGISTRY_URL).hostname)) {
+      return fallbackResult(config.latestVersion);
+    }
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+    let data;
+    try {
+      const res = await fetch(NPM_REGISTRY_URL, {
+        signal: controller.signal,
+        headers: { Connection: "close" }
+      });
+      if (!res.ok) return fallbackResult(config.latestVersion);
+      data = await res.json();
+    } finally {
+      clearTimeout(timeout);
+    }
+    if (typeof data.version !== "string" || !isSafeVersion(data.version)) {
+      return fallbackResult(config.latestVersion);
+    }
+    const latest = data.version;
+    const freshConfig = readConfigFresh();
+    freshConfig.lastUpdateCheck = (/* @__PURE__ */ new Date()).toISOString();
+    freshConfig.latestVersion = latest;
+    writeConfig(freshConfig);
+    return { current: VERSION, latest, updateAvailable: isNewerSemver(latest, VERSION) };
+  } catch {
+    return fallbackResult(config.latestVersion);
+  }
+}
+function updateCheckDue(config = readConfig()) {
+  if (updateCheckDisabled()) return false;
+  if (!config.lastUpdateCheck || !config.latestVersion || !isSafeVersion(config.latestVersion)) {
+    return true;
+  }
+  const fresh = Date.now() - new Date(config.lastUpdateCheck).getTime() < CHECK_INTERVAL_MS;
+  return !fresh;
+}
+function fallbackResult(cachedLatest) {
+  const safeCached = cachedLatest && isSafeVersion(cachedLatest) ? cachedLatest : void 0;
+  return {
+    current: VERSION,
+    latest: safeCached ?? VERSION,
+    updateAvailable: safeCached ? isNewerSemver(safeCached, VERSION) : false
+  };
+}
+function updateCheckDisabled() {
+  if (isDevMode()) return true;
+  if (process.env["CI"] === "true" || process.env["CI"] === "1") return true;
+  return process.env["HYPERFRAMES_NO_UPDATE_CHECK"] === "1";
+}
+var STALE_PIN_THROTTLE_MS = 24 * 60 * 60 * 1e3;
+
+// src/utils/skillsManifest.ts
+import { execFile } from "child_process";
+import { createHash } from "crypto";
+import {
+  existsSync as existsSync3,
+  readdirSync,
+  readFileSync as readFileSync3,
+  renameSync as renameSync2,
+  statSync,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { homedir as homedir2 } from "os";
+import { isAbsolute, join as join3, relative, resolve, sep } from "path";
+import { promisify } from "util";
+var execFileAsync = promisify(execFile);
+var TEXT_EXT = /* @__PURE__ */ new Set([
+  ".md",
+  ".txt",
+  ".mjs",
+  ".js",
+  ".ts",
+  ".jsx",
+  ".tsx",
+  ".html",
+  ".css",
+  ".json",
+  ".svg",
+  ".csv",
+  ".yml",
+  ".yaml"
+]);
+var DEFAULT_REPO_SLUG = "heygen-com/hyperframes";
+var MANIFEST_FILE = "skills-manifest.json";
+var FETCH_TIMEOUT_MS2 = 4e3;
+var ENTRY_SKILL = "hyperframes";
+function isCoreSkill(name) {
+  return name === ENTRY_SKILL || name.startsWith("hyperframes-") || name === "media-use";
+}
+function listFilesSorted(dir) {
+  const out = [];
+  const walk = (d) => {
+    for (const name of readdirSync(d)) {
+      if (name === ".DS_Store") continue;
+      const p = join3(d, name);
+      if (statSync(p).isDirectory()) walk(p);
+      else out.push(p);
+    }
+  };
+  walk(dir);
+  return out.sort();
+}
+function hashSkillBundle(skillDir) {
+  const files = listFilesSorted(skillDir);
+  const h = createHash("sha256");
+  for (const f of files) {
+    const rel = relative(skillDir, f).split(sep).join("/");
+    h.update(rel);
+    h.update("\0");
+    const ext = rel.slice(rel.lastIndexOf("."));
+    const buf = readFileSync3(f);
+    if (TEXT_EXT.has(ext)) h.update(buf.toString("utf8").replace(/\r\n/g, "\n"), "utf8");
+    else h.update(buf);
+    h.update("\0");
+  }
+  return { hash: h.digest("hex").slice(0, 16), files: files.length };
+}
+function buildManifest(skillsRoot, meta) {
+  const names = readdirSync(skillsRoot).filter((n) => existsSync3(join3(skillsRoot, n, "SKILL.md"))).sort();
+  const skills = {};
+  for (const name of names) skills[name] = hashSkillBundle(join3(skillsRoot, name));
+  return { source: meta.source, skills };
+}
+function agentLabel(hostDir) {
+  const name = hostDir.replace(/^\.+/, "");
+  return name === "claude" ? "claude-code" : name || "unknown";
+}
+function agentFromDir(dir) {
+  const parts = dir.split(sep).filter(Boolean);
+  const i = parts.lastIndexOf("skills");
+  return agentLabel(i > 0 ? parts[i - 1] : parts[parts.length - 1] ?? "");
+}
+function listSubdirs(dir) {
+  try {
+    return readdirSync(dir, { withFileTypes: true }).filter((e) => e.isDirectory() || e.isSymbolicLink()).map((e) => e.name);
+  } catch {
+    return [];
+  }
+}
+function discoverSkillRoots(base, scope) {
+  const candidates = [];
+  const add = (hostBase, host) => {
+    const dir = join3(hostBase, host, "skills");
+    if (existsSync3(dir) && statSync(dir).isDirectory())
+      candidates.push({ dir, agent: agentLabel(host), scope });
+  };
+  for (const host of listSubdirs(base)) add(base, host);
+  const xdg = join3(base, ".config");
+  for (const host of listSubdirs(xdg)) add(xdg, host);
+  return candidates.sort((a, b) => {
+    if (a.agent !== b.agent) {
+      if (a.agent === "claude-code") return -1;
+      if (b.agent === "claude-code") return 1;
+      return a.agent.localeCompare(b.agent);
+    }
+    return a.dir.localeCompare(b.dir);
+  });
+}
+function scopeForDir(dir, home, cwd) {
+  const norm = (p) => {
+    const r = resolve(p);
+    return r.endsWith(sep) ? r : r + sep;
+  };
+  const d = norm(dir);
+  if (d.startsWith(norm(cwd))) return "project";
+  if (d.startsWith(norm(home))) return "global";
+  return "project";
+}
+function locateInstall(skillNames, opts = {}) {
+  if (opts.dir) {
+    return existsSync3(opts.dir) ? {
+      dir: opts.dir,
+      agent: agentFromDir(opts.dir),
+      scope: scopeForDir(opts.dir, opts.home ?? homedir2(), opts.cwd ?? process.cwd())
+    } : null;
+  }
+  const roots = [
+    ...discoverSkillRoots(opts.home ?? homedir2(), "global"),
+    ...discoverSkillRoots(opts.cwd ?? process.cwd(), "project")
+  ];
+  for (const root of roots) {
+    if (skillNames.some((n) => existsSync3(join3(root.dir, n, "SKILL.md")))) return root;
+  }
+  return null;
+}
+function hashInstalled(root, skillNames) {
+  const out = {};
+  for (const name of skillNames) {
+    const skillDir = join3(root.dir, name);
+    if (existsSync3(join3(skillDir, "SKILL.md"))) out[name] = hashSkillBundle(skillDir);
+  }
+  return out;
+}
+function diffSkills(installed, latest) {
+  const skills = [];
+  const summary = { current: 0, outdated: 0, missing: 0, coreMissing: 0 };
+  for (const name of Object.keys(latest.skills).sort()) {
+    const latestEntry = latest.skills[name];
+    const installedEntry = installed[name];
+    let status;
+    if (!installedEntry) status = "missing";
+    else if (installedEntry.hash === latestEntry.hash) status = "current";
+    else status = "outdated";
+    if (status === "current") summary.current++;
+    else if (status === "outdated") summary.outdated++;
+    else {
+      summary.missing++;
+      if (isCoreSkill(name)) summary.coreMissing++;
+    }
+    skills.push({
+      name,
+      status,
+      installedHash: installedEntry?.hash,
+      latestHash: latestEntry.hash
+    });
+  }
+  return {
+    // "Update available" means the install is stale, not merely partial:
+    // anything installed-but-outdated, or a missing CORE skill (the entry
+    // router + shared domain skills every workflow needs). A missing
+    // on-demand skill is NOT an update — it installs when its workflow is
+    // triggered (`hyperframes skills update <name>`). Counting it here is what
+    // used to make `init` re-pull the full skill set onto machines that
+    // deliberately installed a subset.
+    updateAvailable: summary.outdated > 0 || summary.coreMissing > 0,
+    summary,
+    skills
+  };
+}
+function repoSlug(s) {
+  return (s ?? "").replace(/^git\+/, "").replace(/^https?:\/\/github\.com\//, "").replace(/\.git$/, "").toLowerCase();
+}
+function skillsAttributedToSource(lock, source) {
+  const want = repoSlug(source);
+  if (!want || !lock?.skills) return [];
+  return Object.entries(lock.skills).filter(([, e]) => repoSlug(e.source) === want || repoSlug(e.sourceUrl) === want).map(([name]) => name);
+}
+function lockPathForScope(scope, opts) {
+  if (scope === "project") return join3(opts.cwd ?? process.cwd(), "skills-lock.json");
+  const xdgStateHome = process.env.XDG_STATE_HOME;
+  if (xdgStateHome) return join3(xdgStateHome, "skills", ".skill-lock.json");
+  return join3(opts.home ?? homedir2(), ".agents", ".skill-lock.json");
+}
+function readSkillLock(path) {
+  try {
+    return JSON.parse(readFileSync3(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+var MANIFEST_COVERAGE_ROOT = "skills/";
+function manifestCoversSkill(entry) {
+  const path = entry?.skillPath;
+  return typeof path === "string" && path.startsWith(MANIFEST_COVERAGE_ROOT);
+}
+function detectRemoved(root, latest, opts) {
+  const lock = readSkillLock(lockPathForScope(root.scope, opts));
+  const removed = skillsAttributedToSource(lock, latest.source).filter((name) => manifestCoversSkill(lock?.skills?.[name])).filter((name) => !(name in latest.skills)).sort().map((name) => ({ name, status: "removed" }));
+  return { removed, lockMissing: lock === null };
+}
+function findRepoManifest(cwd = process.cwd()) {
+  let dir = cwd;
+  for (let i = 0; i < 16; i++) {
+    const p = join3(dir, MANIFEST_FILE);
+    if (existsSync3(p)) return p;
+    const parent = join3(dir, "..");
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+}
+function asSkillsManifest(data, sourceLabel) {
+  const m = data;
+  if (!m || typeof m !== "object" || typeof m.skills !== "object" || m.skills === null) {
+    throw new Error(`Malformed skills manifest from ${sourceLabel}`);
+  }
+  return m;
+}
+async function fetchManifest(url) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS2);
+  try {
+    const res = await fetch(url, { signal: controller.signal, headers: { Connection: "close" } });
+    if (!res.ok) throw new Error(`HTTP ${res.status} fetching ${url}`);
+    return asSkillsManifest(await res.json(), url);
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+async function remoteHeadSha(repoSlug2) {
+  try {
+    const { stdout } = await execFileAsync(
+      "git",
+      ["ls-remote", `https://github.com/${repoSlug2}.git`, "refs/heads/main"],
+      {
+        timeout: FETCH_TIMEOUT_MS2,
+        env: { ...process.env, GIT_TERMINAL_PROMPT: "0" },
+        windowsHide: true
+      }
+    );
+    const sha = stdout.split(/\s+/)[0]?.trim() ?? "";
+    return /^[0-9a-f]{40}$/.test(sha) ? sha : null;
+  } catch {
+    return null;
+  }
+}
+function resolveLocalManifest(source) {
+  const direct = source.endsWith(".json") ? source : join3(source, MANIFEST_FILE);
+  if (existsSync3(direct)) return JSON.parse(readFileSync3(direct, "utf8"));
+  const skillsRoot = source.endsWith("skills") ? source : join3(source, "skills");
+  if (existsSync3(skillsRoot)) return buildManifest(skillsRoot, { source: skillsRoot });
+  throw new Error(`No skills manifest found at: ${source}`);
+}
+async function fetchRemoteManifest(source) {
+  if (source?.startsWith("http")) return fetchManifest(source);
+  const repoSlug2 = source ?? DEFAULT_REPO_SLUG;
+  const sha = await remoteHeadSha(repoSlug2);
+  if (sha) {
+    try {
+      return await fetchManifest(
+        `https://raw.githubusercontent.com/${repoSlug2}/${sha}/${MANIFEST_FILE}`
+      );
+    } catch {
+    }
+  }
+  return fetchManifest(`https://raw.githubusercontent.com/${repoSlug2}/main/${MANIFEST_FILE}`);
+}
+async function resolveLatestManifest(source, cwd = process.cwd(), opts = {}) {
+  if (source && (source.startsWith(".") || isAbsolute(source))) {
+    return resolveLocalManifest(source);
+  }
+  if (!source && !opts.canonical) {
+    const repoManifest = findRepoManifest(cwd);
+    if (repoManifest) return JSON.parse(readFileSync3(repoManifest, "utf8"));
+  }
+  return fetchRemoteManifest(source);
+}
+async function checkSkills(opts = {}) {
+  const latest = await resolveLatestManifest(opts.source, opts.cwd, { canonical: opts.canonical });
+  const skillNames = Object.keys(latest.skills);
+  const root = locateInstall(skillNames, { dir: opts.dir, cwd: opts.cwd, home: opts.home });
+  const installed = root ? hashInstalled(root, skillNames) : {};
+  const diff = diffSkills(installed, latest);
+  const removedResult = root ? detectRemoved(root, latest, { cwd: opts.cwd, home: opts.home }) : { removed: [], lockMissing: false };
+  const { removed, lockMissing } = removedResult;
+  return {
+    location: root?.dir ?? null,
+    agent: root?.agent ?? null,
+    scope: root?.scope ?? null,
+    // Removed skills also mean the install isn't reconciled with the manifest —
+    // `skills update` now prunes them, so they count toward "update available".
+    updateAvailable: diff.updateAvailable || removed.length > 0,
+    summary: { ...diff.summary, removed: removed.length },
+    skills: [...diff.skills, ...removed],
+    lockMissing
+  };
+}
+
+// src/utils/skillsUpdateCheck.ts
+var CHECK_INTERVAL_MS2 = 24 * 60 * 60 * 1e3;
+async function refreshSkillsCache() {
+  if (!await hostAnswers("github.com")) return;
+  const result = await checkSkills({ canonical: true });
+  if (result.location) {
+    const config = readConfigFresh();
+    config.lastSkillsCheck = (/* @__PURE__ */ new Date()).toISOString();
+    config.skillsUpdateAvailable = result.updateAvailable;
+    config.skillsOutdatedCount = result.summary.outdated;
+    config.skillsMissingCount = result.summary.coreMissing;
+    config.skillsRemovedCount = result.summary.removed;
+    writeConfig(config);
+  }
+}
+
+// src/backgroundChecksWorker.ts
+var due = process.argv.slice(2);
+await Promise.allSettled([
+  due.includes("update") && checkForUpdate(),
+  due.includes("skills") && refreshSkillsCache()
+]);