mindgraph-mcp 0.17.0 → 0.19.0

package/dist/cli.js

@@ -65,8 +65,8 @@ var init_dist = __esm({
         this.retryBackoffMs = config.retryBackoffMs ?? 1e3;
       }
       // ---- HTTP helpers ----
-      async request(method, path6, body) {
-        const url = `${this.baseUrl}${path6}`;
+      async request(method, path8, body) {
+        const url = `${this.baseUrl}${path8}`;
         const requestId = createRequestId();
         const init = {
           method,
@@ -91,13 +91,14 @@ var init_dist = __esm({
               parsed = text2;
             }
             const err5 = new MindGraphError(
-              `${method} ${path6} failed: ${res.status}`,
+              `${method} ${path8} failed: ${res.status}`,
               res.status,
               parsed
             );
             if (res.status === 503 && attempt < this.maxRetries) {
               lastError = err5;
-              const delay = this.retryBackoffMs * 2 ** attempt;
+              const retryAfterSecs = Number(res.headers.get("retry-after"));
+              const delay = Number.isFinite(retryAfterSecs) && retryAfterSecs > 0 ? Math.min(retryAfterSecs * 1e3, 1e4) : this.retryBackoffMs * 2 ** attempt;
               await new Promise((r) => setTimeout(r, delay));
               continue;
             }
@@ -109,17 +110,17 @@ var init_dist = __esm({
         }
         throw lastError;
       }
-      get(path6) {
-        return this.request("GET", path6);
+      get(path8) {
+        return this.request("GET", path8);
       }
-      post(path6, body) {
-        return this.request("POST", path6, body);
+      post(path8, body) {
+        return this.request("POST", path8, body);
       }
-      patch(path6, body) {
-        return this.request("PATCH", path6, body);
+      patch(path8, body) {
+        return this.request("PATCH", path8, body);
       }
-      del(path6) {
-        return this.request("DELETE", path6);
+      del(path8) {
+        return this.request("DELETE", path8);
       }
       // ---- Health ----
       async health() {
@@ -148,6 +149,52 @@ var init_dist = __esm({
       async entity(req) {
         return this.post("/reality/entity", req);
       }
+      async series(req) {
+        return this.post("/reality/series", req);
+      }
+      async createSeries(req) {
+        return this.post("/reality/series", { action: "create", ...req });
+      }
+      async appendSeries(req) {
+        return this.post("/reality/series", { action: "append", ...req });
+      }
+      async seriesWindow(req) {
+        return this.post("/reality/series", { action: "window", ...req });
+      }
+      async aggregateSeries(req) {
+        return this.post("/reality/series", { action: "aggregate", ...req });
+      }
+      async latestSeries(seriesUid, options) {
+        return this.post("/reality/series", {
+          action: "latest",
+          series_uid: seriesUid,
+          ...options
+        });
+      }
+      async listSeriesForEntity(entityUid, options) {
+        return this.post("/reality/series", {
+          action: "list_for_entity",
+          entity_uid: entityUid,
+          ...options
+        });
+      }
+      async batchLatestSeries(entityUids, options) {
+        return this.post("/reality/series", {
+          action: "batch_latest",
+          entity_uids: entityUids,
+          ...options
+        });
+      }
+      async batchAggregateSeries(req) {
+        return this.post("/reality/series", { action: "batch_aggregate", ...req });
+      }
+      async deleteSeries(seriesUid, options) {
+        return this.post("/reality/series", {
+          action: "delete_series",
+          series_uid: seriesUid,
+          ...options
+        });
+      }
       /** Convenience: create or find an entity by label. */
       async findOrCreateEntity(label, props, agentId) {
         return this.post("/reality/entity", {
@@ -717,6 +764,20 @@ var init_dist = __esm({
       async getOntologySchema(id) {
         return this.get(`/v1/ontology/schemas/${seg(id)}`);
       }
+      async createOntologySeriesBinding(schemaId, request) {
+        return this.post(`/v1/ontology/schemas/${seg(schemaId)}/series-bindings`, request);
+      }
+      async syncOntologySeriesBinding(bindingId, mode) {
+        return this.post(
+          `/v1/ontology/series-bindings/${seg(bindingId)}/sync`,
+          mode ? { mode } : {}
+        );
+      }
+      async archiveOntologySeriesBinding(schemaId, bindingId) {
+        return this.del(
+          `/v1/ontology/schemas/${seg(schemaId)}/series-bindings/${seg(bindingId)}`
+        );
+      }
       async createOntologySchema(req) {
         return this.post("/v1/ontology/schemas", req);
       }
@@ -971,6 +1032,14 @@ var init_hook_env = __esm({
 });
 
 // src/codegraph.ts
+function invocationCwd(args) {
+  const context = args.invocation_context;
+  if (context && typeof context === "object" && !Array.isArray(context)) {
+    const cwd = context.cwd;
+    if (typeof cwd === "string" && cwd) return cwd;
+  }
+  return process.cwd();
+}
 function unavailabilityCaveats(reason, message) {
   const caveats = [message || "codegraph status failed"];
   if (reason === "absent") {
@@ -980,14 +1049,14 @@ function unavailabilityCaveats(reason, message) {
   }
   return caveats;
 }
-function normalizePath(path6) {
-  return path6.replaceAll("\\", "/").replace(/^\.\//, "");
+function normalizePath(path8) {
+  return path8.replaceAll("\\", "/").replace(/^\.\//, "");
 }
 function normalizeSignature(signature) {
   return signature.replace(/\s+/g, " ").trim();
 }
-function languageFromPath(path6) {
-  const extension = (0, import_node_path2.extname)(path6).toLowerCase();
+function languageFromPath(path8) {
+  const extension = (0, import_node_path2.extname)(path8).toLowerCase();
   return {
     ".c": "c",
     ".cc": "cpp",
@@ -1150,7 +1219,7 @@ function codeRefIdentityKey(ref) {
     }
   };
 }
-var import_node_child_process, import_node_fs2, import_promises, import_node_os2, import_node_path2, import_node_crypto2, DEFAULT_TIMEOUT_MS, DEFAULT_STATUS_TTL_MS, MAX_OUTPUT_BYTES, CodegraphAdapter;
+var import_node_child_process, import_node_fs2, import_promises, import_node_os2, import_node_path2, import_node_crypto3, UnknownRepositoryError, DEFAULT_TIMEOUT_MS, DEFAULT_STATUS_TTL_MS, MAX_OUTPUT_BYTES, CodegraphAdapter;
 var init_codegraph = __esm({
   "src/codegraph.ts"() {
     "use strict";
@@ -1159,7 +1228,17 @@ var init_codegraph = __esm({
     import_promises = require("fs/promises");
     import_node_os2 = require("os");
     import_node_path2 = require("path");
-    import_node_crypto2 = require("crypto");
+    import_node_crypto3 = require("crypto");
+    UnknownRepositoryError = class extends Error {
+      constructor(repo) {
+        super(
+          `unknown repository "${repo}": not declared in .mindgraph/workspace.json, not the current repository, and no such path exists`
+        );
+        this.repo = repo;
+        this.name = "UnknownRepositoryError";
+      }
+      repo;
+    };
     DEFAULT_TIMEOUT_MS = 5e3;
     DEFAULT_STATUS_TTL_MS = 6e4;
     MAX_OUTPUT_BYTES = 5 * 1024 * 1024;
@@ -1195,7 +1274,26 @@ var init_codegraph = __esm({
             selected.spaceUid
           ) : selected;
         }
-        const requestedRoot = repo || this.env.MINDGRAPH_REPO_ROOT || this.cwd;
+        if (repo) {
+          const requestedPath = await (0, import_promises.realpath)((0, import_node_path2.resolve)(this.cwd, repo)).catch(
+            () => (0, import_node_path2.resolve)(this.cwd, repo)
+          );
+          if (!(0, import_node_fs2.existsSync)(requestedPath)) {
+            const current = await this.currentRepository(fallbackSpaceUid);
+            if (current.repoId === repo) return current;
+            throw new UnknownRepositoryError(repo);
+          }
+          const repoRoot = await this.gitRoot(requestedPath) ?? requestedPath;
+          return this.resolveRepositoryIdentity(
+            repoRoot,
+            this.env.MINDGRAPH_REPO_ID,
+            this.env.MINDGRAPH_CODE_SPACE_UID || fallbackSpaceUid
+          );
+        }
+        return this.currentRepository(fallbackSpaceUid);
+      }
+      async currentRepository(fallbackSpaceUid) {
+        const requestedRoot = this.env.MINDGRAPH_REPO_ROOT || this.cwd;
         const requestedPath = await (0, import_promises.realpath)((0, import_node_path2.resolve)(this.cwd, requestedRoot)).catch(
           () => (0, import_node_path2.resolve)(this.cwd, requestedRoot)
         );
@@ -1259,7 +1357,7 @@ var init_codegraph = __esm({
         } catch {
         }
         (0, import_node_fs2.mkdirSync)(identityDir, { recursive: true, mode: 448 });
-        const generated = (0, import_node_crypto2.randomUUID)();
+        const generated = (0, import_node_crypto3.randomUUID)();
         try {
           (0, import_node_fs2.writeFileSync)(identityFile, `${generated}
 `, {
@@ -1285,6 +1383,14 @@ var init_codegraph = __esm({
         ).catch(() => "");
         return raw.trim() ? (0, import_node_path2.resolve)(start, raw.trim()) : void 0;
       }
+      /** Why the workspace map yielded no repositories — for callers that were
+       * explicitly asked to fan out and would otherwise return silently empty. */
+      workspaceDiagnostic() {
+        if (!this.workspaceFile || !(0, import_node_fs2.existsSync)(this.workspaceFile)) {
+          return "no .mindgraph/workspace.json was found between the working directory and the filesystem root";
+        }
+        return `${this.workspaceFile} is malformed or declares no repositories`;
+      }
       async availability(repository) {
         const cached = this.statusCache.get(repository.repoRoot);
         if (cached && cached.expiresAt > this.now()) return cached.availability;
@@ -1698,13 +1804,13 @@ var init_error_detail = __esm({
 });
 
 // src/code-tool.ts
-async function handleCodeTool(client2, args, adapter = new CodegraphAdapter()) {
+async function handleCodeTool(client2, args, adapter = new CodegraphAdapter({ cwd: invocationCwd(args) })) {
   const codeClient = client2;
   const action = args.action;
   const refs = Array.isArray(args.code_refs) ? args.code_refs : [];
   const anchorUids = Array.isArray(args.anchor_uids) ? args.anchor_uids : [];
   const agentId = typeof args.agent_id === "string" ? args.agent_id : "mcp";
-  const fallbackSpaceUid = typeof args.repo_space_uid === "string" ? args.repo_space_uid : `space:agent:${agentId}`;
+  const fallbackSpaceUid = typeof args.repo_space_uid === "string" ? args.repo_space_uid : void 0;
   const options = {
     repo: typeof args.repo === "string" ? args.repo : void 0,
     fallbackSpaceUid
@@ -1828,6 +1934,7 @@ async function handleCodeTool(client2, args, adapter = new CodegraphAdapter()) {
         const targetUid = typeof args.task_uid === "string" ? args.task_uid : typeof args.execution_uid === "string" ? args.execution_uid : void 0;
         let graphContext;
         const graphRefs = [];
+        let unavailableRepositories = [];
         if (targetUid) {
           graphContext = await codeClient.traverse({
             action: "neighborhood",
@@ -1835,9 +1942,13 @@ async function handleCodeTool(client2, args, adapter = new CodegraphAdapter()) {
             depth: 2,
             max_nodes: 50
           });
-          graphRefs.push(
-            ...await codeRefsFromGraphContext(codeClient, adapter, graphContext)
+          const fromGraph = await codeRefsFromGraphContext(
+            codeClient,
+            adapter,
+            graphContext
           );
+          graphRefs.push(...fromGraph.refs);
+          unavailableRepositories = fromGraph.unavailable;
         }
         if (refs.length > 0 || anchorUids.length > 0) {
           const target = await resolveSingleTarget(
@@ -1856,7 +1967,8 @@ async function handleCodeTool(client2, args, adapter = new CodegraphAdapter()) {
             target_uid: targetUid,
             graph_context: graphContext,
             affected: [],
-            degradation: "no materialized code anchors were attached"
+            degradation: unavailableRepositories.length > 0 ? `attached code anchors reference repositories unavailable here: ${unavailableRepositories.join(", ")}` : "no materialized code anchors were attached",
+            ...unavailableRepositories.length > 0 ? { unavailable_repositories: unavailableRepositories } : {}
           });
         }
         const impacts = await Promise.all(
@@ -1873,13 +1985,17 @@ async function handleCodeTool(client2, args, adapter = new CodegraphAdapter()) {
           target_uid: targetUid,
           graph_context: graphContext,
           impacts,
-          materialized: joined
+          materialized: joined,
+          ...unavailableRepositories.length > 0 ? { unavailable_repositories: unavailableRepositories } : {}
         });
       }
       default:
         return err("unknown_action", `unknown mindgraph_code action: ${action}`);
     }
   } catch (cause) {
+    if (cause instanceof UnknownRepositoryError) {
+      return err("unknown_repository", cause.message);
+    }
     return err("code_tool_failed", errorDetail(cause));
   }
 }
@@ -1905,7 +2021,10 @@ async function attachCodeRefsToToolResult(client2, result, args, adapter) {
       code_refs: args.code_refs,
       repo: args.repo,
       repo_space_uid: args.repo_space_uid,
-      agent_id: args.agent_id
+      agent_id: args.agent_id,
+      // Keeps the default adapter anchored to the live session directory
+      // rather than wherever the MCP server process was launched.
+      invocation_context: args.invocation_context
     },
     adapter
   );
@@ -1915,17 +2034,33 @@ async function attachCodeRefsToToolResult(client2, result, args, adapter) {
     const anchorUids = (anchors.anchors ?? []).flatMap(
       (anchor) => anchor.uid ? [anchor.uid] : []
     );
+    const relateFailures = [];
     for (const targetUid of targetUids) {
       for (const anchorUid of anchorUids) {
-        await codeClient.entity({
-          action: "relate",
-          source_uid: targetUid,
-          target_uid: anchorUid,
-          edge_type: args.action === "lesson" ? "ABOUT" : "RELEVANT_TO",
-          agent_id: args.agent_id
-        });
+        try {
+          await codeClient.entity({
+            action: "relate",
+            source_uid: targetUid,
+            target_uid: anchorUid,
+            edge_type: args.action === "lesson" ? "ABOUT" : "RELEVANT_TO",
+            agent_id: args.agent_id
+          });
+        } catch (cause) {
+          relateFailures.push(
+            `${targetUid} -> ${anchorUid}: ${errorDetail(cause)}`
+          );
+        }
       }
     }
+    if (relateFailures.length > 0) {
+      return ok({
+        result: original,
+        code_anchors: {
+          ...anchors,
+          caveat: `anchors written, but ${relateFailures.length} relate edge(s) failed: ${relateFailures.join("; ")}`
+        }
+      });
+    }
   }
   return ok({ result: original, code_anchors: anchors });
 }
@@ -1998,16 +2133,34 @@ async function codeRefFromAnchor(client2, adapter, uid) {
   if (!attributes || typeof attributes !== "object") return void 0;
   const codeRef = attributes.code_ref;
   if (!isStoredCodeRef(codeRef)) return void 0;
-  const repository = await adapter.resolveRepository(codeRef.repoId);
-  return { ...codeRef, repoRoot: repository.repoRoot };
+  try {
+    const repository = await adapter.resolveRepository(codeRef.repoId);
+    return { ref: { ...codeRef, repoRoot: repository.repoRoot } };
+  } catch (cause) {
+    if (cause instanceof UnknownRepositoryError) {
+      return { missingRepo: codeRef.repoId };
+    }
+    throw cause;
+  }
 }
 async function resolveSingleTarget(client2, adapter, refs, anchorUids, options) {
   if (refs.length > 1 || anchorUids.length > 1) {
     return { error: err("ambiguous_target", "expand/affected accepts exactly one code target") };
   }
   if (anchorUids.length === 1) {
-    const ref = await codeRefFromAnchor(client2, adapter, anchorUids[0]);
-    return ref ? { ref } : { error: err("invalid_anchor", "anchor UID does not contain a typed code_ref") };
+    const outcome = await codeRefFromAnchor(client2, adapter, anchorUids[0]);
+    if (!outcome) {
+      return { error: err("invalid_anchor", "anchor UID does not contain a typed code_ref") };
+    }
+    if ("missingRepo" in outcome) {
+      return {
+        error: err(
+          "repository_unavailable",
+          `repository ${outcome.missingRepo} is not checked out here or declared in .mindgraph/workspace.json; expand/affected need its local index`
+        )
+      };
+    }
+    return { ref: outcome.ref };
   }
   if (refs.length !== 1) {
     return { error: err("missing_code_ref", "one code_ref or anchor_uid is required") };
@@ -2046,7 +2199,7 @@ async function joinMaterialized(client2, refs, agentId, limit) {
 async function codeRefsFromGraphContext(client2, adapter, context) {
   const uids = /* @__PURE__ */ new Set();
   collectUids(context, uids);
-  if (uids.size === 0) return [];
+  if (uids.size === 0) return { refs: [], unavailable: [] };
   const nodes = client2.getNodesBatch ? await client2.getNodesBatch([...uids]) : await Promise.all([...uids].map((uid) => client2.getNode(uid).catch(() => void 0)));
   const stored = nodes.flatMap((node) => {
     if (!node) return [];
@@ -2055,12 +2208,21 @@ async function codeRefsFromGraphContext(client2, adapter, context) {
     const codeRef = attributes.code_ref;
     return isStoredCodeRef(codeRef) ? [codeRef] : [];
   });
-  return Promise.all(
-    stored.map(async (ref) => {
+  const refs = [];
+  const unavailable = /* @__PURE__ */ new Set();
+  for (const ref of stored) {
+    try {
       const repository = await adapter.resolveRepository(ref.repoId);
-      return { ...ref, repoRoot: repository.repoRoot };
-    })
-  );
+      refs.push({ ...ref, repoRoot: repository.repoRoot });
+    } catch (cause) {
+      if (cause instanceof UnknownRepositoryError) {
+        unavailable.add(ref.repoId);
+      } else {
+        throw cause;
+      }
+    }
+  }
+  return { refs, unavailable: [...unavailable].sort() };
 }
 function collectUids(value, uids) {
   if (Array.isArray(value)) {
@@ -2136,7 +2298,7 @@ var init_code_tool = __esm({
     });
     CODE_TOOL = {
       name: "mindgraph_code",
-      description: "Resolve typed code references through the local codegraph index and join them to persistent MindGraph memory/work. anchor creates exact repository/code anchors; recall reads attached graph context; expand reads callers/callees; affected reads impact for a code ref or Task/Execution. Ambiguous refs return candidates without writing.",
+      description: "Resolve typed code references through the local codegraph index and join them to persistent MindGraph memory/work. anchor creates exact repository/code anchors; recall reads attached graph context; expand reads callers/callees; affected reads impact for a code ref or Task/Execution. Ambiguous refs return candidates without writing. Refs with a path route to the repository defining that file (nearest declared root in .mindgraph/workspace.json); bare symbols resolve against the current repository only \u2014 pass path or repo to target a sibling.",
       inputSchema: {
         type: "object",
         properties: {
@@ -2178,7 +2340,7 @@ var init_code_tool = __esm({
           },
           repo_space_uid: {
             type: "string",
-            description: "Writable shared Project/repository Space for new anchors"
+            description: "Writable shared Project/repository Space for new anchors (anchor requires this, a workspace space_uid, or MINDGRAPH_CODE_SPACE_UID)"
           },
           task_uid: { type: "string" },
           execution_uid: { type: "string" },
@@ -2197,179 +2359,469 @@ var init_code_tool = __esm({
   }
 });
 
-// src/sync-tool.ts
-function safePath(root, candidate) {
-  const absolute = import_node_path5.default.resolve(root, candidate);
-  const relative2 = import_node_path5.default.relative(root, absolute);
-  if (relative2.startsWith("..") || import_node_path5.default.isAbsolute(relative2)) {
-    throw new Error(`path escapes repository root: ${candidate}`);
+// src/hook-installer.ts
+function command(harness) {
+  return `node "$HOME/${RUNNER_RELATIVE}" hook --harness ${harness} --owner mindgraph`;
+}
+function windowsCommand(harness) {
+  return `node "%USERPROFILE%\\.mindgraph\\bin\\mindgraph-hook.cjs" hook --harness ${harness} --owner mindgraph`;
+}
+function installHookRunner(sourceFile, homeDir, version) {
+  const target = import_node_path4.default.join(homeDir || import_node_os4.default.homedir(), RUNNER_RELATIVE);
+  import_node_fs4.default.mkdirSync(import_node_path4.default.dirname(target), { recursive: true });
+  const temporary = `${target}.${process.pid}.${import_node_crypto5.default.randomUUID()}.tmp`;
+  import_node_fs4.default.copyFileSync(sourceFile, temporary);
+  import_node_fs4.default.renameSync(temporary, target);
+  const versionPath = import_node_path4.default.join(homeDir || import_node_os4.default.homedir(), RUNNER_VERSION_RELATIVE);
+  if (version) {
+    import_node_fs4.default.writeFileSync(versionPath, `${version}
+`);
+  } else {
+    import_node_fs4.default.rmSync(versionPath, { force: true });
   }
-  return absolute;
+  return target;
 }
-function markdownFiles(target) {
-  if (!import_node_fs5.default.existsSync(target)) return [];
-  const stat = import_node_fs5.default.statSync(target);
-  if (stat.isFile()) return target.endsWith(".md") ? [target] : [];
-  if (!stat.isDirectory()) return [];
-  return import_node_fs5.default.readdirSync(target, { withFileTypes: true }).flatMap((entry) => markdownFiles(import_node_path5.default.join(target, entry.name)));
+function installedHookRunnerVersion(homeDir) {
+  try {
+    const raw = import_node_fs4.default.readFileSync(
+      import_node_path4.default.join(homeDir || import_node_os4.default.homedir(), RUNNER_VERSION_RELATIVE),
+      "utf8"
+    ).trim();
+    return raw || void 0;
+  } catch {
+    return void 0;
+  }
 }
-function fileDescriptor(root, absolute) {
-  const content = import_node_fs5.default.readFileSync(absolute, "utf8");
-  return {
-    logical_path: import_node_path5.default.relative(root, absolute).split(import_node_path5.default.sep).join("/"),
-    content_hash: import_node_crypto5.default.createHash("sha256").update(content).digest("hex"),
-    bytes: Buffer.byteLength(content),
-    content
-  };
+function parseSemver(value) {
+  if (!value) return void 0;
+  const match = /^(\d+)\.(\d+)\.(\d+)$/.exec(value.trim());
+  if (!match) return void 0;
+  return [Number(match[1]), Number(match[2]), Number(match[3])];
 }
-async function handleSyncTool(client2, args) {
+function semverNewer(a, b) {
+  for (let index = 0; index < 3; index += 1) {
+    if (a[index] !== b[index]) return a[index] > b[index];
+  }
+  return false;
+}
+function refreshHookRunner(serverVersion, sourceBundle, homeDir) {
   try {
-    const action = String(args.action || "");
-    const context = args.invocation_context || {};
-    const adapter = new CodegraphAdapter({
-      cwd: context.cwd || process.cwd()
-    });
-    const requestedRepo = typeof args.repo === "string" ? args.repo : typeof args.repo_id === "string" ? args.repo_id : context.repoId;
-    const repository = await adapter.resolveRepository(requestedRepo);
-    const root = repository.repoRoot;
-    const repoId = repository.repoId;
-    const provider = String(args.provider || "claude_project");
-    const remote = client2;
-    if (action === "scan") {
-      const repositories = args.workspace === true ? await adapter.resolveRepositories() : [repository];
-      const requested = Array.isArray(args.paths) && args.paths.length > 0 ? args.paths.map(String) : [".claude/agent-memory", "memory"];
-      const scans = [];
-      for (const selected of repositories) {
-        scans.push(
-          await scanRepository(
-            remote,
-            selected,
-            requested,
-            provider,
-            args.agent_id
-          )
-        );
-      }
-      if (args.workspace === true) {
-        return ok2({
-          provider,
-          workspace: true,
-          repositories: scans,
-          one_way: "files_to_graph"
-        });
-      }
-      return ok2(scans[0]);
+    if (process.env.MINDGRAPH_HOOK_AUTOUPDATE === "off") {
+      return { refreshed: false, reason: "disabled" };
     }
-    const request = {
-      ...args,
-      provider,
-      repo_id: repoId
-    };
-    delete request.invocation_context;
-    delete request.paths;
-    delete request.repo;
-    delete request.workspace;
-    if (action === "begin" && !request.content) {
-      if (!request.logical_path) {
-        return err2("missing_field", "logical_path is required for begin");
-      }
-      const file = fileDescriptor(
-        root,
-        safePath(root, String(request.logical_path))
-      );
-      request.content = file.content;
-      request.content_hash ||= file.content_hash;
+    const home = homeDir || import_node_os4.default.homedir();
+    if (!import_node_fs4.default.existsSync(import_node_path4.default.join(home, RUNNER_RELATIVE))) {
+      return { refreshed: false, reason: "no_runner" };
     }
-    if (action === "status" && request.logical_path && request.file_present !== false) {
-      const absolute = safePath(root, String(request.logical_path));
-      request.file_present = import_node_fs5.default.existsSync(absolute);
-      if (request.file_present && !request.content_hash) {
-        request.content_hash = fileDescriptor(root, absolute).content_hash;
+    if (!import_node_fs4.default.existsSync(sourceBundle)) {
+      return { refreshed: false, reason: "no_source" };
+    }
+    const server2 = parseSemver(serverVersion);
+    if (!server2) return { refreshed: false, reason: "unparseable" };
+    const runnerVersion = installedHookRunnerVersion(home);
+    if (runnerVersion !== void 0) {
+      const pinned = parseSemver(runnerVersion);
+      if (!pinned) {
+        return { refreshed: false, reason: "unparseable", runnerVersion };
+      }
+      if (!semverNewer(server2, pinned)) {
+        return {
+          refreshed: false,
+          reason: runnerVersion === serverVersion ? "current" : "downgrade",
+          runnerVersion
+        };
       }
     }
-    return ok2(await remote.memorySync(request));
-  } catch (error) {
-    return err2("sync_failed", errorDetail(error));
+    installHookRunner(sourceBundle, home, serverVersion);
+    return { refreshed: true, reason: "updated", runnerVersion };
+  } catch {
+    return { refreshed: false, reason: "error" };
   }
 }
-async function scanRepository(remote, repository, requested, provider, agentId) {
-  const files = [
-    ...new Set(
-      requested.flatMap(
-        (candidate) => markdownFiles(safePath(repository.repoRoot, candidate))
-      )
-    )
-  ].sort();
-  const results = [];
-  for (const absolute of files) {
-    const file = fileDescriptor(repository.repoRoot, absolute);
-    const status = await remote.memorySync({
-      action: "scan",
-      provider,
-      repo_id: repository.repoId,
-      logical_path: file.logical_path,
-      content_hash: file.content_hash,
-      file_present: true,
-      agent_id: agentId
-    });
-    results.push({
-      logical_path: file.logical_path,
-      content_hash: file.content_hash,
-      bytes: file.bytes,
-      status
-    });
+function refreshOwnedClaudeHooks(projectDir = process.cwd(), homeDir) {
+  const refreshed = [];
+  const scopes = ["user", "project"];
+  for (const scope of scopes) {
+    try {
+      const file = settingsPath("claude-code", scope, projectDir, void 0, homeDir);
+      if (!import_node_fs4.default.existsSync(file)) continue;
+      if (!import_node_fs4.default.readFileSync(file, "utf8").includes(OWNER_MARKER)) continue;
+      installHooks("claude-code", scope, projectDir, void 0, homeDir);
+      refreshed.push(file);
+    } catch {
+    }
   }
+  return refreshed;
+}
+function versionSkewNote(serverVersion, homeDir) {
+  const runnerVersion = installedHookRunnerVersion(homeDir);
+  if (!runnerVersion || runnerVersion === serverVersion) return void 0;
+  return `NOTE: the installed MindGraph hook runner is v${runnerVersion} but this MCP server is v${serverVersion} \u2014 hook behavior and tool contracts may be out of sync. Tell the user to run: npx -y mindgraph-mcp@latest install-hooks (refreshes the pinned runner).`;
+}
+function settingsPath(harness, scope, projectDir = process.cwd(), codexHomeDir = process.env.CODEX_HOME || import_node_path4.default.join(import_node_os4.default.homedir(), ".codex"), homeDir) {
+  if (harness === "codex") {
+    return scope === "user" ? import_node_path4.default.join(codexHomeDir, "hooks.json") : import_node_path4.default.join(projectDir, ".codex", "hooks.json");
+  }
+  return scope === "user" ? import_node_path4.default.join(homeDir || import_node_os4.default.homedir(), ".claude", "settings.json") : import_node_path4.default.join(projectDir, ".claude", "settings.json");
+}
+function readSettings(file) {
+  if (!import_node_fs4.default.existsSync(file)) return {};
+  return JSON.parse(import_node_fs4.default.readFileSync(file, "utf8"));
+}
+function ownedHook(harness, timeout, additionalContextLimit) {
   return {
-    repo_id: repository.repoId,
-    root: ".",
-    files: results
+    type: "command",
+    command: command(harness),
+    ...harness === "codex" ? { commandWindows: windowsCommand(harness) } : {},
+    timeout,
+    statusMessage: "Syncing MindGraph session context",
+    ...additionalContextLimit === void 0 ? {} : { additionalContextLimit }
   };
 }
-var import_node_crypto5, import_node_fs5, import_node_path5, ok2, err2, SYNC_TOOL;
-var init_sync_tool = __esm({
-  "src/sync-tool.ts"() {
-    "use strict";
-    import_node_crypto5 = __toESM(require("crypto"));
-    import_node_fs5 = __toESM(require("fs"));
-    import_node_path5 = __toESM(require("path"));
-    init_codegraph();
-    init_error_detail();
-    ok2 = (data) => ({
-      content: [{ type: "text", text: JSON.stringify(data) }]
-    });
-    err2 = (code, message) => ({
-      content: [{ type: "text", text: JSON.stringify({ code, error: message }) }],
-      isError: true
-    });
-    SYNC_TOOL = {
-      name: "mindgraph_sync",
-      description: "Transactional one-way project memory-file sync. scan/status are reads; begin/record/finalize/abandon are writes. Discovery and hashing are automatic; semantic assertions are deliberately supplied through record. This never writes graph state back to files.",
-      annotations: {
-        readOnlyHint: false,
-        destructiveHint: false,
-        idempotentHint: true,
-        openWorldHint: true
-      },
-      inputSchema: {
-        type: "object",
-        properties: {
-          action: {
-            type: "string",
-            enum: ["scan", "begin", "record", "finalize", "status", "abandon"]
-          },
-          paths: { type: "array", items: { type: "string" } },
-          workspace: {
-            type: "boolean",
-            description: "For scan only: fan out across repositories explicitly listed in .mindgraph/workspace.json"
-          },
-          repo: {
-            type: "string",
-            description: "Configured repository id, name, or root"
-          },
-          logical_path: { type: "string" },
-          content: { type: "string" },
-          content_hash: { type: "string" },
-          source_uid: { type: "string" },
+function desiredEntries(harness) {
+  const common = {
+    SessionStart: [
+      {
+        matcher: harness === "claude-code" ? "startup|resume|clear|compact|fork" : "startup|resume|clear|compact",
+        // B7 live acceptance caught cold SessionStart calls crossing the
+        // inherited 20s edge in both harnesses: the hooks correctly failed
+        // open, but no brief reached the model. The same installed runner
+        // completed in 16.84s once warm. Keep a 30s cold-tenant margin.
+        // The declared Codex context limit must not undercut the brief's own
+        // 9,000-char budget: at 3,000 the harness applied a SECOND, tighter
+        // truncation the renderer knew nothing about.
+        hooks: [
+          ownedHook(
+            harness,
+            30,
+            harness === "codex" ? 1e4 : void 0
+          )
+        ]
+      }
+    ],
+    PreToolUse: [
+      {
+        matcher: "mcp__mindgraph__.*",
+        // Repository resolution over a large multi-repo workspace plus three
+        // git probes can exceed 3s on the first (uncached) call; a killed
+        // PreToolUse means the call goes through untagged.
+        hooks: [ownedHook(harness, 5)]
+      }
+    ],
+    // PostToolUse awaits the lease renewal round-trip, which fires exactly
+    // when the tenant is cold (post-idle reclaim) — 5s killed it mid-claim.
+    PostToolUse: [{ matcher: ".*", hooks: [ownedHook(harness, 10)] }],
+    Stop: [{ hooks: [ownedHook(harness, 5)] }],
+    // SessionEnd makes up to two sequential cloud calls (abandon_iteration +
+    // session close) — the SAME cold-tenant latency SessionStart needs 30s
+    // for. Claude honors the configured budget; Codex clamps SessionEnd to a
+    // 3s platform cap regardless of this value (see codex-hooks.ts wire
+    // map), so the codex adapter instead makes at most ONE call there.
+    SessionEnd: [
+      { hooks: [ownedHook(harness, harness === "codex" ? 3 : 30)] }
+    ]
+  };
+  return harness === "claude-code" ? {
+    ...common,
+    TaskCreated: [{ hooks: [ownedHook(harness, 3)] }],
+    TaskCompleted: [{ hooks: [ownedHook(harness, 3)] }]
+  } : common;
+}
+function hookCommand(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const command2 = value.command;
+  return typeof command2 === "string" ? command2 : void 0;
+}
+function entryHasOwnedHook(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const hooks = value.hooks;
+  return Array.isArray(hooks) && hooks.some((hook) => hookCommand(hook)?.includes(OWNER_MARKER));
+}
+function writeSettings(file, settings) {
+  import_node_fs4.default.mkdirSync(import_node_path4.default.dirname(file), { recursive: true });
+  const temporary = `${file}.${process.pid}.${import_node_crypto5.default.randomUUID()}.tmp`;
+  import_node_fs4.default.writeFileSync(temporary, `${JSON.stringify(settings, null, 2)}
+`, {
+    mode: 384
+  });
+  import_node_fs4.default.renameSync(temporary, file);
+}
+function installHooks(harness, scope, projectDir = process.cwd(), codexHomeDir, homeDir) {
+  const file = settingsPath(harness, scope, projectDir, codexHomeDir, homeDir);
+  const settings = readSettings(file);
+  const hooks = settings.hooks && typeof settings.hooks === "object" && !Array.isArray(settings.hooks) ? settings.hooks : {};
+  let added = 0;
+  let updated = 0;
+  for (const [event, wanted] of Object.entries(desiredEntries(harness))) {
+    const current = Array.isArray(hooks[event]) ? [...hooks[event]] : [];
+    const kept = current.filter((entry) => !entryHasOwnedHook(entry));
+    const hadOwned = kept.length !== current.length;
+    for (const entry of wanted) {
+      kept.push(entry);
+      if (hadOwned) updated += 1;
+      else added += 1;
+    }
+    hooks[event] = kept;
+  }
+  settings.hooks = hooks;
+  writeSettings(file, settings);
+  return { path: file, added, updated };
+}
+function uninstallHooks(harness, scope, projectDir = process.cwd(), codexHomeDir) {
+  const file = settingsPath(harness, scope, projectDir, codexHomeDir);
+  if (!import_node_fs4.default.existsSync(file)) return { path: file, removed: 0 };
+  const settings = readSettings(file);
+  const hooks = settings.hooks && typeof settings.hooks === "object" && !Array.isArray(settings.hooks) ? settings.hooks : {};
+  let removed = 0;
+  for (const [event, value] of Object.entries(hooks)) {
+    if (!Array.isArray(value)) continue;
+    const retainedEntries = [];
+    for (const rawEntry of value) {
+      if (!rawEntry || typeof rawEntry !== "object" || Array.isArray(rawEntry)) {
+        retainedEntries.push(rawEntry);
+        continue;
+      }
+      const entry = { ...rawEntry };
+      if (!Array.isArray(entry.hooks)) {
+        retainedEntries.push(entry);
+        continue;
+      }
+      const retainedHooks = entry.hooks.filter((hook) => {
+        const owned = hookCommand(hook)?.includes(OWNER_MARKER) || false;
+        if (owned) removed += 1;
+        return !owned;
+      });
+      if (retainedHooks.length > 0) {
+        entry.hooks = retainedHooks;
+        retainedEntries.push(entry);
+      }
+    }
+    if (retainedEntries.length > 0) hooks[event] = retainedEntries;
+    else delete hooks[event];
+  }
+  settings.hooks = hooks;
+  writeSettings(file, settings);
+  return { path: file, removed };
+}
+function installClaudeHooks(scope, projectDir = process.cwd()) {
+  return installHooks("claude-code", scope, projectDir);
+}
+function uninstallClaudeHooks(scope, projectDir = process.cwd()) {
+  return uninstallHooks("claude-code", scope, projectDir);
+}
+function installCodexHooks(scope, projectDir = process.cwd(), codexHomeDir) {
+  return installHooks("codex", scope, projectDir, codexHomeDir);
+}
+function uninstallCodexHooks(scope, projectDir = process.cwd(), codexHomeDir) {
+  return uninstallHooks("codex", scope, projectDir, codexHomeDir);
+}
+var import_node_fs4, import_node_os4, import_node_path4, import_node_crypto5, OWNER_MARKER, RUNNER_RELATIVE, RUNNER_VERSION_RELATIVE;
+var init_hook_installer = __esm({
+  "src/hook-installer.ts"() {
+    "use strict";
+    import_node_fs4 = __toESM(require("fs"));
+    import_node_os4 = __toESM(require("os"));
+    import_node_path4 = __toESM(require("path"));
+    import_node_crypto5 = __toESM(require("crypto"));
+    OWNER_MARKER = "--owner mindgraph";
+    RUNNER_RELATIVE = ".mindgraph/bin/mindgraph-hook.cjs";
+    RUNNER_VERSION_RELATIVE = `${RUNNER_RELATIVE}.version`;
+  }
+});
+
+// src/sync-tool.ts
+function safePath(root, candidate) {
+  const absolute = import_node_path5.default.resolve(root, candidate);
+  const relative2 = import_node_path5.default.relative(root, absolute);
+  if (relative2.startsWith("..") || import_node_path5.default.isAbsolute(relative2)) {
+    throw new Error(`path escapes repository root: ${candidate}`);
+  }
+  if (import_node_fs5.default.existsSync(absolute)) {
+    if (!pathContains(realPathOf(root), realPathOf(absolute))) {
+      throw new Error(`path escapes repository root via symlink: ${candidate}`);
+    }
+  }
+  return absolute;
+}
+function realPathOf(target) {
+  try {
+    return import_node_fs5.default.realpathSync(target);
+  } catch {
+    return import_node_path5.default.resolve(target);
+  }
+}
+function markdownFiles(target, realRoot, visited = /* @__PURE__ */ new Set()) {
+  if (!import_node_fs5.default.existsSync(target)) return [];
+  const real = realPathOf(target);
+  if (!pathContains(realRoot, real)) return [];
+  const stat = import_node_fs5.default.statSync(target);
+  if (stat.isFile()) return target.endsWith(".md") ? [target] : [];
+  if (!stat.isDirectory() || visited.has(real)) return [];
+  visited.add(real);
+  return import_node_fs5.default.readdirSync(target, { withFileTypes: true }).flatMap((entry) => markdownFiles(import_node_path5.default.join(target, entry.name), realRoot, visited));
+}
+function fileDescriptor(root, absolute) {
+  const content = import_node_fs5.default.readFileSync(absolute, "utf8");
+  return {
+    logical_path: import_node_path5.default.relative(root, absolute).split(import_node_path5.default.sep).join("/"),
+    content_hash: import_node_crypto6.default.createHash("sha256").update(content).digest("hex"),
+    bytes: Buffer.byteLength(content),
+    content
+  };
+}
+async function handleSyncTool(client2, args) {
+  try {
+    const action = String(args.action || "");
+    const context = args.invocation_context || {};
+    const adapter = new CodegraphAdapter({ cwd: invocationCwd(args) });
+    const requestedRepo = typeof args.repo === "string" ? args.repo : typeof args.repo_id === "string" ? args.repo_id : context.repoId;
+    const repository = await adapter.resolveRepository(requestedRepo);
+    const root = repository.repoRoot;
+    const repoId = repository.repoId;
+    const provider = String(args.provider || "claude_project");
+    const remote = client2;
+    if (action === "scan") {
+      const repositories = args.workspace === true ? await adapter.resolveRepositories() : [repository];
+      if (args.workspace === true && repositories.length === 0) {
+        return err2(
+          "workspace_not_configured",
+          `workspace scan found no declared repositories: ${adapter.workspaceDiagnostic()}`
+        );
+      }
+      const requested = Array.isArray(args.paths) && args.paths.length > 0 ? args.paths.map(String) : [".claude/agent-memory", "memory"];
+      const scans = [];
+      for (const selected of repositories) {
+        scans.push(
+          await scanRepository(
+            remote,
+            selected,
+            requested,
+            provider,
+            args.agent_id
+          )
+        );
+      }
+      if (args.workspace === true) {
+        return ok2({
+          provider,
+          workspace: true,
+          repositories: scans,
+          one_way: "files_to_graph"
+        });
+      }
+      return ok2(scans[0]);
+    }
+    const request = {
+      ...args,
+      provider,
+      repo_id: repoId
+    };
+    delete request.invocation_context;
+    delete request.paths;
+    delete request.repo;
+    delete request.workspace;
+    if (action === "begin" && !request.content) {
+      if (!request.logical_path) {
+        return err2("missing_field", "logical_path is required for begin");
+      }
+      const file = fileDescriptor(
+        root,
+        safePath(root, String(request.logical_path))
+      );
+      request.content = file.content;
+      request.content_hash ||= file.content_hash;
+    }
+    if (action === "status" && request.logical_path && request.file_present !== false) {
+      const absolute = safePath(root, String(request.logical_path));
+      request.file_present = import_node_fs5.default.existsSync(absolute);
+      if (request.file_present && !request.content_hash) {
+        request.content_hash = fileDescriptor(root, absolute).content_hash;
+      }
+    }
+    return ok2(await remote.memorySync(request));
+  } catch (error) {
+    return err2("sync_failed", errorDetail(error));
+  }
+}
+async function scanRepository(remote, repository, requested, provider, agentId) {
+  const realRoot = realPathOf(repository.repoRoot);
+  const files = [
+    ...new Set(
+      requested.flatMap(
+        (candidate) => markdownFiles(safePath(repository.repoRoot, candidate), realRoot)
+      )
+    )
+  ].sort();
+  const results = [];
+  for (const absolute of files) {
+    const file = fileDescriptor(repository.repoRoot, absolute);
+    const status = await remote.memorySync({
+      action: "scan",
+      provider,
+      repo_id: repository.repoId,
+      logical_path: file.logical_path,
+      content_hash: file.content_hash,
+      file_present: true,
+      agent_id: agentId
+    });
+    results.push({
+      logical_path: file.logical_path,
+      content_hash: file.content_hash,
+      bytes: file.bytes,
+      status
+    });
+  }
+  return {
+    repo_id: repository.repoId,
+    root: ".",
+    files: results
+  };
+}
+var import_node_crypto6, import_node_fs5, import_node_path5, ok2, err2, SYNC_TOOL;
+var init_sync_tool = __esm({
+  "src/sync-tool.ts"() {
+    "use strict";
+    import_node_crypto6 = __toESM(require("crypto"));
+    import_node_fs5 = __toESM(require("fs"));
+    import_node_path5 = __toESM(require("path"));
+    init_codegraph();
+    init_error_detail();
+    ok2 = (data) => ({
+      content: [{ type: "text", text: JSON.stringify(data) }]
+    });
+    err2 = (code, message) => ({
+      content: [{ type: "text", text: JSON.stringify({ code, error: message }) }],
+      isError: true
+    });
+    SYNC_TOOL = {
+      name: "mindgraph_sync",
+      description: "Transactional one-way project memory-file sync. scan/status are reads; begin/record/finalize/abandon are writes. Discovery and hashing are automatic; semantic assertions are deliberately supplied through record. This never writes graph state back to files.",
+      annotations: {
+        readOnlyHint: false,
+        destructiveHint: false,
+        idempotentHint: true,
+        openWorldHint: true
+      },
+      inputSchema: {
+        type: "object",
+        properties: {
+          action: {
+            type: "string",
+            enum: ["scan", "begin", "record", "finalize", "status", "abandon"]
+          },
+          paths: { type: "array", items: { type: "string" } },
+          workspace: {
+            type: "boolean",
+            description: "For scan only: fan out across repositories explicitly listed in .mindgraph/workspace.json"
+          },
+          repo: {
+            type: "string",
+            description: "Configured repository id, name, or root"
+          },
+          logical_path: { type: "string" },
+          content: { type: "string" },
+          content_hash: { type: "string" },
+          source_uid: { type: "string" },
           execution_uid: { type: "string" },
           assertion_fingerprint: { type: "string" },
           planned_fingerprints: { type: "array", items: { type: "string" } },
@@ -2730,15 +3182,15 @@ function renderTraversal(response) {
   const labelByUid = /* @__PURE__ */ new Map();
   for (const node of nodes) labelByUid.set(str(node.uid), str(node.label) || "?");
   if (paths.length > 0) {
-    const items = paths.map((raw) => obj(raw)).filter((path6) => Boolean(path6)).map((path6, index) => {
-      const uids = Array.isArray(path6.node_uids) ? path6.node_uids.map(String) : [];
-      const labels = Array.isArray(path6.labels) ? path6.labels.map(String) : Array.isArray(path6.nodes) ? path6.nodes.map((hop) => {
+    const items = paths.map((raw) => obj(raw)).filter((path8) => Boolean(path8)).map((path8, index) => {
+      const uids = Array.isArray(path8.node_uids) ? path8.node_uids.map(String) : [];
+      const labels = Array.isArray(path8.labels) ? path8.labels.map(String) : Array.isArray(path8.nodes) ? path8.nodes.map((hop) => {
         const hopNode = obj(hop);
         return str(hopNode?.label) || labelByUid.get(str(hopNode?.uid) || "") || str(hop) || "?";
       }) : [];
       const route = labels.length > 0 ? labels.join(" \u2192 ") : uids.join(" \u2192 ") || "(path)";
-      const cost = num(path6.cost) ?? num(path6.path_cost);
-      const confidence = num(path6.path_confidence);
+      const cost = num(path8.cost) ?? num(path8.path_cost);
+      const confidence = num(path8.path_confidence);
       const meta = [
         cost !== void 0 ? `cost ${cost}` : void 0,
         confidence !== void 0 ? `confidence ${confidence}` : void 0
@@ -2971,6 +3423,9 @@ async function handleTool(client2, name, args) {
       case "mindgraph_retrieve":
         result = await handleRetrieve(client2, args);
         break;
+      case "mindgraph_series_query":
+        result = await handleSeriesQuery(client2, args);
+        break;
       case "mindgraph_ingest":
         result = await handleIngest(client2, args);
         break;
@@ -3015,12 +3470,36 @@ async function handleTool(client2, name, args) {
     return err3(errorDetail(e));
   }
 }
+async function handleSeriesQuery(client2, args) {
+  const action = typeof args.action === "string" ? args.action : "";
+  if (!["list_for_entity", "latest", "window", "aggregate"].includes(action)) {
+    return err3(`Unknown series query action: ${action}`);
+  }
+  if (action === "list_for_entity" && typeof args.entity_uid !== "string") {
+    return err3("entity_uid is required for action='list_for_entity'");
+  }
+  if (action !== "list_for_entity" && typeof args.series_uid !== "string") {
+    return err3(`series_uid is required for action='${action}'`);
+  }
+  if ((action === "window" || action === "aggregate") && (typeof args.from !== "number" || typeof args.to !== "number")) {
+    return err3(`from and to are required for action='${action}'`);
+  }
+  if (action === "aggregate" && (typeof args.bucket !== "string" || typeof args.agg !== "string")) {
+    return err3("bucket and agg are required for action='aggregate'");
+  }
+  return ok3(
+    await client2.series(args)
+  );
+}
 async function handleCapture(client2, args) {
   const {
     action,
     label,
     summary,
     content,
+    name,
+    description,
+    license,
     session_uid,
     work_uid,
     execution_uid,
@@ -3055,6 +3534,41 @@ async function handleCapture(client2, args) {
           agent_id
         })
       );
+    case "skill": {
+      if (!name) return err3("name is required for action=skill");
+      if (!description) return err3("description is required for action=skill");
+      if (content === void 0) return err3("content is required for action=skill");
+      const hasProvenance = [session_uid, work_uid, execution_uid].some(
+        (uid) => typeof uid === "string" && uid.length > 0
+      ) || Array.isArray(summarizes_uids) && summarizes_uids.some((uid) => typeof uid === "string" && uid.length > 0);
+      if (!hasProvenance) {
+        return err3(
+          "at least one of session_uid, work_uid, execution_uid, or summarizes_uids is required for action=skill"
+        );
+      }
+      return ok3(
+        await client2.distill({
+          label,
+          output_type: "skill",
+          summary,
+          confidence,
+          salience,
+          session_uid,
+          work_uid,
+          execution_uid,
+          idempotency_key,
+          supersedes_uid,
+          summarizes_uids,
+          props: {
+            name,
+            description,
+            content,
+            ...license ? { license } : {}
+          },
+          agent_id
+        })
+      );
+    }
     case "journal": {
       if (!content) return err3("content is required for action=journal");
       const journalProps = { content };
@@ -4042,7 +4556,7 @@ var init_tools = __esm({
     TOOLS = [
       {
         name: "mindgraph_capture",
-        description: "Capture knowledge into the graph. Use 'entity' for people/orgs/places/events/nations/concepts (auto-deduplicates \u2014 safe to call even if already exists), 'observation' for factual statements, 'source' for documents/URLs, 'snippet' for quotes from a source, and 'concept' for abstract ideas. Use 'journal' for quick personal notes and 'lesson' for a durable learning attributable to a session or source nodes. Prefer 'entity'/'observation' for objective facts, 'journal' for informal notes, and 'lesson' only for reusable knowledge.",
+        description: "Capture knowledge into the graph. Use 'entity' for people/orgs/places/events/nations/concepts (auto-deduplicates \u2014 safe to call even if already exists), 'observation' for factual statements, 'source' for documents/URLs, 'snippet' for quotes from a source, and 'concept' for abstract ideas. Use 'journal' for quick personal notes, 'lesson' for a durable learning, and 'skill' for a reusable procedure authored from completed work. Skill capture always creates a candidate requiring admin review; it never publishes. Skill names must be 1-64 lowercase a-z, digits, or hyphens, with no leading/trailing/consecutive hyphens and no 'anthropic' or 'claude'. Provide at least one provenance field and write instructions, not a transcript dump.",
         inputSchema: {
           type: "object",
           properties: {
@@ -4055,7 +4569,8 @@ var init_tools = __esm({
                 "snippet",
                 "concept",
                 "journal",
-                "lesson"
+                "lesson",
+                "skill"
               ],
               description: "Type of knowledge to capture"
             },
@@ -4069,11 +4584,30 @@ var init_tools = __esm({
             },
             content: {
               type: "string",
-              description: "Journal content/body text (for action=journal)"
+              maxLength: 65536,
+              description: "Journal body (action=journal) or complete SKILL.md instructions, at most 64 KiB UTF-8 (action=skill)"
+            },
+            name: {
+              type: "string",
+              minLength: 1,
+              maxLength: 64,
+              pattern: "^(?!.*(?:anthropic|claude))(?!-)(?!.*--)[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$",
+              description: "Stable skill identifier using lowercase a-z, digits, and hyphens (for action=skill)"
+            },
+            description: {
+              type: "string",
+              minLength: 1,
+              maxLength: 1024,
+              description: "When the skill should be used; XML tags are rejected (for action=skill)"
+            },
+            license: {
+              type: "string",
+              description: "Optional skill license (for action=skill)"
             },
             session_uid: {
               type: "string",
-              description: "Session UID that produced a lesson (for action=lesson)"
+              minLength: 1,
+              description: "Session UID that produced a lesson or skill"
             },
             work_uid: {
               type: "string",
@@ -4094,7 +4628,8 @@ var init_tools = __esm({
             summarizes_uids: {
               type: "array",
               items: { type: "string" },
-              description: "Source node UIDs the lesson was learned from (for action=lesson)"
+              minItems: 1,
+              description: "Source node UIDs the lesson or skill was learned from"
             },
             entity_type: {
               type: "string",
@@ -4161,7 +4696,24 @@ var init_tools = __esm({
               description: "Agent identity"
             }
           },
-          required: ["action", "label"]
+          required: ["action", "label"],
+          allOf: [
+            {
+              if: {
+                properties: { action: { const: "skill" } },
+                required: ["action"]
+              },
+              then: {
+                required: ["name", "description", "content"],
+                anyOf: [
+                  { required: ["session_uid"] },
+                  { required: ["work_uid"] },
+                  { required: ["execution_uid"] },
+                  { required: ["summarizes_uids"] }
+                ]
+              }
+            }
+          ]
         }
       },
       {
@@ -4747,6 +5299,42 @@ var init_tools = __esm({
           required: ["action"]
         }
       },
+      {
+        name: "mindgraph_series_query",
+        description: "Read dense numeric time series without placing raw points in general retrieval context. Use list_for_entity to discover series, latest for cached statistics, window for [from,to) keyset pages, and aggregate for bounded calendar buckets.",
+        inputSchema: {
+          type: "object",
+          additionalProperties: false,
+          properties: {
+            action: {
+              type: "string",
+              enum: ["list_for_entity", "latest", "window", "aggregate"]
+            },
+            entity_uid: { type: "string" },
+            series_uid: { type: "string" },
+            from: { type: "number" },
+            to: { type: "number" },
+            cursor: { type: "number" },
+            limit: { type: "number", minimum: 1, maximum: 1e4 },
+            bucket: {
+              type: "string",
+              enum: ["year", "quarter", "month", "week", "day", "hour"]
+            },
+            agg: {
+              type: "string",
+              enum: ["sum", "mean", "min", "max", "count", "std_dev", "last"]
+            },
+            fill: { type: "string", enum: ["none", "null", "prev"] }
+          },
+          required: ["action"]
+        },
+        annotations: {
+          readOnlyHint: true,
+          destructiveHint: false,
+          idempotentHint: true,
+          openWorldHint: false
+        }
+      },
       {
         name: "mindgraph_ingest",
         description: "Ingest long-form content (articles, transcripts, documents, meeting notes) into the knowledge graph. The pipeline automatically chunks the text, extracts entities/claims/relationships via LLM, and deduplicates against existing nodes. Use 'chunk' for a single passage (synchronous), 'document' for full documents (async \u2014 returns a job ID), 'session' for conversation transcripts. Use 'job_status' to check progress. For short individual facts, use the specific cognitive tools instead.",
@@ -5233,7 +5821,7 @@ function isTransientStatus(status) {
   return status === 408 || status === 425 || status === 429 || status >= 500;
 }
 function sleep(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
 function headers(apiKey, orgId) {
   const value = {
@@ -5251,6 +5839,7 @@ function unsupportedResponse(status, body) {
 }
 function toolMutability(toolName, action) {
   if (toolName === "mindgraph_retrieve") return "read";
+  if (toolName === "mindgraph_series_query") return "read";
   if (toolName === "mindgraph_plan") {
     return action && PLAN_READ_ACTIONS.has(action) ? "read" : "write";
   }
@@ -5343,7 +5932,7 @@ async function checkMcpGovernance(toolName, args, config) {
   if (!response) {
     return {
       allowed: false,
-      message: `MindGraph governance could not establish permission after ${retryDelays.length + 1} attempts (${lastFailure}). Set MINDGRAPH_GOVERNANCE=off to run this adapter ungoverned.`
+      message: `MindGraph at ${config.baseUrl} is unreachable (${lastFailure}; ${retryDelays.length + 1} attempts). The tool call was NOT evaluated against policy and NOT executed \u2014 this is a connectivity failure, not a governance denial. Check the network and MINDGRAPH_BASE_URL, then retry.`
     };
   }
   if (!response.ok) {
@@ -5435,6 +6024,8 @@ var init_governance = __esm({
     UID_FIELDS = [
       "uid",
       "source_uid",
+      "entity_uid",
+      "series_uid",
       "session_uid",
       "work_uid",
       "goal_uid",
@@ -5587,10 +6178,10 @@ async function main() {
   const transport = new import_stdio.StdioServerTransport();
   await server.connect(transport);
   console.error(
-    `MindGraph MCP server v${"0.17.0"} running on stdio (${BASE_URL})`
+    `MindGraph MCP server v${"0.19.0"} running on stdio (${BASE_URL})`
   );
 }
-var import_server, import_stdio, import_types, API_KEY, BASE_URL, AGENT_ID, ORG_ID, PROFILE, HARNESS, client, INSTRUCTIONS, server, GOVERNANCE_CONFIG, PROMPTS;
+var import_server, import_stdio, import_types, import_node_path6, API_KEY, BASE_URL, AGENT_ID, ORG_ID, PROFILE, HARNESS, client, INSTRUCTIONS, RUNNER_REFRESH, HOOK_SKEW_NOTE, server, GOVERNANCE_CONFIG, PROMPTS;
 var init_src = __esm({
   "src/index.ts"() {
     "use strict";
@@ -5603,6 +6194,8 @@ var init_src = __esm({
     init_generated_tools();
     init_governance();
     init_resources();
+    import_node_path6 = __toESM(require("path"));
+    init_hook_installer();
     API_KEY = process.env.MINDGRAPH_API_KEY;
     BASE_URL = process.env.MINDGRAPH_BASE_URL || "https://api.mindgraph.cloud";
     AGENT_ID = process.env.MINDGRAPH_AGENT_ID || loadHookEnv().agentId || stableAgentId();
@@ -5724,10 +6317,42 @@ Capture knowledge when the user shares something worth remembering:
         (line) => !line.includes("mindgraph_code") && !line.includes("`code`") && !line.includes("Typed code anchors")
       ).join("\n");
     }
+    RUNNER_REFRESH = (() => {
+      try {
+        return refreshHookRunner("0.19.0", import_node_path6.default.join(__dirname, "cli.js"));
+      } catch {
+        return void 0;
+      }
+    })();
+    if (RUNNER_REFRESH?.refreshed) {
+      const refreshedSettings = (() => {
+        try {
+          return refreshOwnedClaudeHooks();
+        } catch {
+          return [];
+        }
+      })();
+      console.error(
+        `[mindgraph-mcp] refreshed pinned hook runner ${RUNNER_REFRESH.runnerVersion ? `v${RUNNER_REFRESH.runnerVersion}` : "(pre-sidecar)"} \u2192 v${"0.19.0"}` + (refreshedSettings.length > 0 ? `; refreshed owned hook entries in ${refreshedSettings.join(", ")}` : "")
+      );
+    }
+    HOOK_SKEW_NOTE = (() => {
+      try {
+        return versionSkewNote("0.19.0");
+      } catch {
+        return void 0;
+      }
+    })();
+    if (HOOK_SKEW_NOTE) {
+      INSTRUCTIONS += `
+
+${HOOK_SKEW_NOTE}`;
+      console.error(`[mindgraph-mcp] ${HOOK_SKEW_NOTE}`);
+    }
     server = new import_server.Server(
       {
         name: "mindgraph",
-        version: "0.17.0"
+        version: "0.19.0"
       },
       {
         capabilities: {
@@ -5945,8 +6570,8 @@ ${conversation}`
 });
 
 // src/cli.ts
-var fs5 = __toESM(require("fs"));
-var path5 = __toESM(require("path"));
+var fs6 = __toESM(require("fs"));
+var path7 = __toESM(require("path"));
 var os4 = __toESM(require("os"));
 var crypto5 = __toESM(require("crypto"));
 var import_child_process = require("child_process");
@@ -5964,6 +6589,8 @@ function parseArgs(argv) {
   let harness;
   let hooks = false;
   let agentId = process.env.MINDGRAPH_AGENT_ID;
+  const positionals = [];
+  let dir;
   for (let i = 0; i < args.length; i++) {
     const arg = args[i];
     switch (arg) {
@@ -5984,6 +6611,9 @@ function parseArgs(argv) {
       case "--project-dir":
         projectDir = args[++i];
         break;
+      case "--dir":
+        dir = args[++i];
+        break;
       case "--harness":
         harness = args[++i];
         break;
@@ -6002,33 +6632,416 @@ function parseArgs(argv) {
         break;
       default:
         if (!arg.startsWith("-")) {
-          command2 = arg;
+          if (command2 === "serve") {
+            command2 = arg;
+          } else {
+            positionals.push(arg);
+          }
+        }
+        break;
+    }
+  }
+  return {
+    command: command2,
+    apiKey,
+    baseUrl,
+    scope,
+    projectDir,
+    harness,
+    hooks,
+    agentId,
+    positionals,
+    dir
+  };
+}
+function mcpAddFailureOutput(e) {
+  const err5 = e;
+  return `${err5.stdout ?? ""}${err5.stderr ?? ""}`.trim();
+}
+function classifyMcpAddFailure(e) {
+  if (e?.code === "ENOENT") return "missing-cli";
+  if (mcpAddFailureOutput(e).toLowerCase().includes("already exists")) {
+    return "already-exists";
+  }
+  return "other";
+}
+
+// src/skills-cli.ts
+var import_node_crypto2 = require("crypto");
+var fs2 = __toESM(require("fs"));
+var path2 = __toESM(require("path"));
+function httpSkillsApi(baseUrl, apiKey, agentId) {
+  const endpoint = `${baseUrl.replace(/\/$/, "")}/action/skill`;
+  const call = async (body) => {
+    const response = await fetch(endpoint, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        authorization: `Bearer ${apiKey}`
+      },
+      body: JSON.stringify(
+        agentId ? { agent_id: agentId, ...body } : body
+      )
+    });
+    let parsed = {};
+    try {
+      parsed = await response.json();
+    } catch {
+      parsed = { error: `non-JSON response (HTTP ${response.status})` };
+    }
+    return { status: response.status, body: parsed };
+  };
+  return {
+    async list(grantedTo) {
+      const { status, body } = await call({
+        action: "list",
+        ...grantedTo ? { granted_to: grantedTo } : {}
+      });
+      if (status !== 200) {
+        throw new Error(
+          `skill list failed (HTTP ${status}): ${String(body.error ?? "")}`
+        );
+      }
+      return body.skills ?? [];
+    },
+    async get(uid) {
+      const { status, body } = await call({ action: "get", uid });
+      if (status === 404) return null;
+      if (status !== 200) {
+        throw new Error(
+          `skill get failed (HTTP ${status}): ${String(body.error ?? "")}`
+        );
+      }
+      const props = body.props ?? {};
+      return {
+        uid: String(body.uid ?? uid),
+        name: String(props.name ?? ""),
+        description: String(props.description ?? ""),
+        content: String(props.content ?? ""),
+        license: props.license ?? null,
+        status: String(props.status ?? "candidate"),
+        status_reason: props.status_reason ?? null,
+        content_hash: String(props.content_hash ?? ""),
+        version: Number(body.version ?? 0)
+      };
+    },
+    send: call
+  };
+}
+function isValidSkillName(name) {
+  return name.length >= 1 && name.length <= 64 && /^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(name);
+}
+function renderSkillMd(skill) {
+  const lines = [
+    "---",
+    `name: ${JSON.stringify(skill.name)}`,
+    `description: ${JSON.stringify(skill.description)}`
+  ];
+  if (skill.license) {
+    lines.push(`license: ${JSON.stringify(skill.license)}`);
+  }
+  lines.push(
+    "metadata:",
+    `  mindgraph-uid: ${JSON.stringify(skill.uid)}`,
+    `  mindgraph-version: ${JSON.stringify(String(skill.version))}`,
+    `  mindgraph-content-hash: ${JSON.stringify(skill.content_hash)}`,
+    "---",
+    "",
+    skill.content
+  );
+  return `${lines.join("\n")}
+`;
+}
+function scalar(raw) {
+  const trimmed = raw.trim();
+  try {
+    const parsed = JSON.parse(trimmed);
+    if (typeof parsed === "string") return parsed;
+  } catch {
+  }
+  return trimmed;
+}
+function parseSkillMd(text) {
+  if (!text.startsWith("---\n")) return null;
+  const end = text.indexOf("\n---\n", 4);
+  if (end < 0) return null;
+  const frontmatter = text.slice(4, end + 1);
+  const body = text.slice(end + 5).replace(/^\n/, "").replace(/\n$/, "");
+  const entries = [];
+  for (const line of frontmatter.split("\n")) {
+    const top = /^([A-Za-z0-9_-]+):(.*)$/.exec(line);
+    if (top) {
+      entries.push({ key: top[1], raw: top[2] });
+    } else if (entries.length > 0) {
+      entries[entries.length - 1].raw += `
+${line}`;
+    }
+  }
+  const result = { unknown: {}, body };
+  for (const { key, raw } of entries) {
+    switch (key) {
+      case "name":
+        result.name = scalar(raw);
+        break;
+      case "description":
+        result.description = scalar(raw);
+        break;
+      case "license":
+        result.license = scalar(raw);
+        break;
+      case "metadata": {
+        const uid = /mindgraph-uid:\s*(.+)/.exec(raw);
+        const version = /mindgraph-version:\s*(.+)/.exec(raw);
+        const hash = /mindgraph-content-hash:\s*(.+)/.exec(raw);
+        if (uid) {
+          result.pin = {
+            uid: scalar(uid[1]),
+            version: version ? scalar(version[1]) : void 0,
+            contentHash: hash ? scalar(hash[1]) : void 0
+          };
+        } else if (raw.trim().length > 0) {
+          result.unknown[key] = raw;
         }
         break;
+      }
+      default:
+        result.unknown[key] = raw;
+        break;
+    }
+  }
+  return result;
+}
+var STATE_FILE = ".mindgraph-skills-state.json";
+function sha256(text) {
+  return (0, import_node_crypto2.createHash)("sha256").update(text).digest("hex");
+}
+function loadState(dir) {
+  try {
+    return JSON.parse(
+      fs2.readFileSync(path2.join(dir, STATE_FILE), "utf8")
+    );
+  } catch {
+    return {};
+  }
+}
+function saveState(dir, state) {
+  fs2.writeFileSync(
+    path2.join(dir, STATE_FILE),
+    `${JSON.stringify(state, null, 2)}
+`
+  );
+}
+function isSymlink(target) {
+  try {
+    return fs2.lstatSync(target).isSymbolicLink();
+  } catch {
+    return false;
+  }
+}
+function safeSkillPaths(dir, name) {
+  if (!isValidSkillName(name)) {
+    return `invalid skill name ${JSON.stringify(name)}`;
+  }
+  const root = path2.resolve(dir);
+  const skillDir = path2.resolve(root, name);
+  if (skillDir !== path2.join(root, name) || !skillDir.startsWith(root + path2.sep)) {
+    return "resolved path escapes the target directory";
+  }
+  if (isSymlink(skillDir)) {
+    return "target directory is a symlink";
+  }
+  const skillFile = path2.join(skillDir, "SKILL.md");
+  if (isSymlink(skillFile)) {
+    return "target SKILL.md is a symlink";
+  }
+  return { skillDir, skillFile };
+}
+async function skillsPull(api, dir, grantedTo) {
+  const report = {
+    written: [],
+    unchanged: [],
+    locallyEdited: [],
+    conflicts: [],
+    removed: [],
+    refused: []
+  };
+  fs2.mkdirSync(dir, { recursive: true });
+  const state = loadState(dir);
+  const summaries = await api.list(grantedTo);
+  const fetched = /* @__PURE__ */ new Set();
+  for (const summary of summaries) {
+    const detail = await api.get(summary.uid);
+    if (!detail || detail.status !== "published") continue;
+    fetched.add(detail.name);
+    const paths = safeSkillPaths(dir, detail.name);
+    if (typeof paths === "string") {
+      report.refused.push({ name: detail.name, reason: paths });
+      continue;
+    }
+    const { skillDir, skillFile } = paths;
+    const rendered2 = renderSkillMd(detail);
+    let existing = null;
+    try {
+      existing = fs2.readFileSync(skillFile, "utf8");
+    } catch {
+      existing = null;
+    }
+    if (existing === rendered2) {
+      state[detail.name] = {
+        uid: detail.uid,
+        content_hash: detail.content_hash,
+        file_sha256: sha256(rendered2)
+      };
+      report.unchanged.push(detail.name);
+      continue;
+    }
+    const recorded = state[detail.name];
+    const locallyModified = existing !== null && (!recorded || sha256(existing) !== recorded.file_sha256);
+    if (locallyModified) {
+      if (recorded && recorded.content_hash === detail.content_hash) {
+        report.locallyEdited.push(detail.name);
+        continue;
+      }
+      fs2.writeFileSync(`${skillFile}.conflict`, rendered2);
+      report.conflicts.push(detail.name);
+      continue;
     }
+    fs2.mkdirSync(skillDir, { recursive: true });
+    fs2.writeFileSync(skillFile, rendered2);
+    state[detail.name] = {
+      uid: detail.uid,
+      content_hash: detail.content_hash,
+      file_sha256: sha256(rendered2)
+    };
+    report.written.push(detail.name);
   }
-  return { command: command2, apiKey, baseUrl, scope, projectDir, harness, hooks, agentId };
-}
-function mcpAddFailureOutput(e) {
-  const err5 = e;
-  return `${err5.stdout ?? ""}${err5.stderr ?? ""}`.trim();
+  for (const [name, recorded] of Object.entries(state)) {
+    if (fetched.has(name)) continue;
+    const paths = safeSkillPaths(dir, name);
+    if (typeof paths === "string") {
+      delete state[name];
+      continue;
+    }
+    const { skillDir, skillFile } = paths;
+    let statusReason = null;
+    try {
+      const gone = await api.get(recorded.uid);
+      statusReason = gone?.status_reason ?? (gone ? `status: ${gone.status}` : null);
+    } catch {
+      statusReason = null;
+    }
+    let existing = null;
+    try {
+      existing = fs2.readFileSync(skillFile, "utf8");
+    } catch {
+      existing = null;
+    }
+    if (existing === null) {
+      delete state[name];
+      continue;
+    }
+    const locallyModified = sha256(existing) !== recorded.file_sha256;
+    if (locallyModified) {
+      fs2.renameSync(skillFile, `${skillFile}.conflict`);
+      report.removed.push({ name, statusReason, kept: true });
+    } else {
+      fs2.rmSync(skillDir, { recursive: true, force: true });
+      report.removed.push({ name, statusReason, kept: false });
+    }
+    delete state[name];
+  }
+  saveState(dir, state);
+  return report;
 }
-function classifyMcpAddFailure(e) {
-  if (e?.code === "ENOENT") return "missing-cli";
-  if (mcpAddFailureOutput(e).toLowerCase().includes("already exists")) {
-    return "already-exists";
+async function skillsPush(api, skillPath) {
+  const resolved = path2.resolve(skillPath);
+  const file = resolved.endsWith("SKILL.md") ? resolved : path2.join(resolved, "SKILL.md");
+  if (isSymlink(file)) {
+    return { outcome: "error", message: `${file} is a symlink; refusing` };
   }
-  return "other";
+  let text;
+  try {
+    text = fs2.readFileSync(file, "utf8");
+  } catch {
+    return { outcome: "error", message: `could not read ${file}` };
+  }
+  const parsed = parseSkillMd(text);
+  if (!parsed) {
+    return {
+      outcome: "error",
+      message: "SKILL.md must start with a --- frontmatter block"
+    };
+  }
+  if (!parsed.name || !parsed.description) {
+    return {
+      outcome: "error",
+      message: "SKILL.md frontmatter requires name and description"
+    };
+  }
+  if (parsed.pin?.uid) {
+    const { status: status2, body: body2 } = await api.send({
+      action: "update",
+      uid: parsed.pin.uid,
+      name: parsed.name,
+      description: parsed.description,
+      content: parsed.body,
+      ...parsed.license ? { license: parsed.license } : {}
+    });
+    if (status2 === 200) {
+      return {
+        outcome: "updated",
+        message: `updated candidate ${parsed.name} (${parsed.pin.uid})`,
+        uid: parsed.pin.uid
+      };
+    }
+    return {
+      outcome: status2 === 409 ? "conflict" : "error",
+      message: `update failed (HTTP ${status2}): ${String(body2.error ?? "")}`,
+      existingUid: body2.existing_uid ?? void 0,
+      existingStatus: body2.existing_status ?? void 0
+    };
+  }
+  const { status, body } = await api.send({
+    action: "create",
+    skill_source: "imported",
+    name: parsed.name,
+    description: parsed.description,
+    content: parsed.body,
+    ...parsed.license ? { license: parsed.license } : {},
+    ...Object.keys(parsed.unknown).length > 0 ? { imported_frontmatter: parsed.unknown } : {},
+    import_origin: `skills-push:${path2.basename(resolved)}`
+  });
+  if (status === 200 && body.replayed === true) {
+    return {
+      outcome: "replayed",
+      message: `unchanged: ${parsed.name} already imported (${String(body.uid)})`,
+      uid: String(body.uid)
+    };
+  }
+  if (status === 200) {
+    return {
+      outcome: "created",
+      message: `imported ${parsed.name} as a candidate (${String(body.uid)}) \u2014 review and publish in the dashboard`,
+      uid: String(body.uid)
+    };
+  }
+  return {
+    outcome: status === 409 ? "conflict" : "error",
+    message: `import failed (HTTP ${status}): ${String(body.error ?? "")}`,
+    existingUid: body.existing_uid ?? void 0,
+    existingStatus: body.existing_status ?? void 0
+  };
 }
 
 // src/hook-core.ts
-var import_node_crypto3 = __toESM(require("crypto"));
+var import_node_crypto4 = __toESM(require("crypto"));
 var import_node_fs3 = __toESM(require("fs"));
 var import_node_os3 = __toESM(require("os"));
 var import_node_path3 = __toESM(require("path"));
 var import_node_child_process2 = require("child_process");
 init_codegraph();
 init_code_tool();
+init_error_detail();
 init_hook_env();
 var NOOP = { kind: "noop" };
 function defaultLedger(sessionId, options) {
@@ -6051,7 +7064,7 @@ function runtimeDir(options) {
 }
 function ledgerPath(sessionId, options) {
   const harness = "harness" in options ? options.harness : "claude-code";
-  const key = import_node_crypto3.default.createHash("sha256").update(`${harness}\0${sessionId}`).digest("hex");
+  const key = import_node_crypto4.default.createHash("sha256").update(`${harness}\0${sessionId}`).digest("hex");
   return import_node_path3.default.join(runtimeDir(options), `${key}.json`);
 }
 function waitBriefly(ms) {
@@ -6093,7 +7106,7 @@ function withLedger(sessionId, options, update) {
     }
     const result = update(ledger);
     ledger.updatedAt = Date.now();
-    const temporary = `${file}.${process.pid}.${import_node_crypto3.default.randomUUID()}.tmp`;
+    const temporary = `${file}.${process.pid}.${import_node_crypto4.default.randomUUID()}.tmp`;
     import_node_fs3.default.writeFileSync(temporary, `${JSON.stringify(ledger)}
 `, { mode: 384 });
     import_node_fs3.default.renameSync(temporary, file);
@@ -6360,6 +7373,51 @@ function isOwnPriorWork(brief, agentId, harness) {
   const owner = string(object(brief?.lease)?.lease_owner_agent_id);
   return owner === agentId || owner === harness;
 }
+function hasMindgraphServer(servers) {
+  if (!servers || typeof servers !== "object") return false;
+  for (const [name, entry] of Object.entries(servers)) {
+    if (name === "mindgraph") return true;
+    const cfg = entry && typeof entry === "object" ? entry : void 0;
+    const text = [
+      String(cfg?.command ?? ""),
+      Array.isArray(cfg?.args) ? cfg.args.join(" ") : "",
+      String(cfg?.url ?? "")
+    ].join(" ");
+    if (text.includes("mindgraph-mcp")) return true;
+  }
+  return false;
+}
+function pathIsWithin(ancestor, descendant) {
+  const base = import_node_path3.default.resolve(ancestor);
+  const target = import_node_path3.default.resolve(descendant);
+  return target === base || target.startsWith(base + import_node_path3.default.sep);
+}
+function claudeMcpRegistrationNote(input, options) {
+  if (options.harness !== "claude-code") return void 0;
+  if (process.env.MINDGRAPH_SKIP_MCP_REGISTRATION_CHECK === "1") return void 0;
+  try {
+    const configPath = options.claudeConfigPath || import_node_path3.default.join(import_node_os3.default.homedir(), ".claude.json");
+    if (!import_node_fs3.default.existsSync(configPath)) return void 0;
+    const config = JSON.parse(import_node_fs3.default.readFileSync(configPath, "utf8"));
+    if (hasMindgraphServer(config.mcpServers)) return void 0;
+    const cwd = import_node_path3.default.resolve(input.cwd || ".");
+    for (const [projectDir, project] of Object.entries(config.projects || {})) {
+      if (!pathIsWithin(projectDir, cwd)) continue;
+      if (hasMindgraphServer(project?.mcpServers)) return void 0;
+    }
+    for (let dir = cwd; ; dir = import_node_path3.default.dirname(dir)) {
+      const candidate = import_node_path3.default.join(dir, ".mcp.json");
+      if (import_node_fs3.default.existsSync(candidate)) {
+        const parsed = JSON.parse(import_node_fs3.default.readFileSync(candidate, "utf8"));
+        if (hasMindgraphServer(parsed.mcpServers)) return void 0;
+      }
+      if (dir === import_node_path3.default.dirname(dir)) break;
+    }
+  } catch {
+    return void 0;
+  }
+  return "NOTE: no MindGraph MCP server appears to be registered for Claude Code, so this brief's continuity actions (claim, checkpoint, capture) have no mcp__mindgraph__* tools to run through and durable memory cannot be written this session. Tell the user to run: npx -y mindgraph-mcp@latest install-code \u2014 then start a new session.";
+}
 async function sessionStart(input, client2, options) {
   const agentId = resolveAgentId(options);
   const harnessLabel = options.harness === "claude-code" ? "Claude Code" : "Codex";
@@ -6449,7 +7507,14 @@ async function sessionStart(input, client2, options) {
     claimFailed: claimFailed && !stillHeld,
     scopeNote
   });
-  const briefHash = import_node_crypto3.default.createHash("sha256").update(briefText).digest("hex");
+  const registrationNote = claudeMcpRegistrationNote(input, options);
+  if (registrationNote) {
+    console.error(`mindgraph-hook: ${registrationNote}`);
+  }
+  const contextText = registrationNote ? `${registrationNote}
+
+${briefText}` : briefText;
+  const briefHash = import_node_crypto4.default.createHash("sha256").update(contextText).digest("hex");
   const shouldInject = withLedger(input.session_id, options, (ledger) => {
     const changed = ledger.lastBriefHash !== briefHash;
     const reinjectCompact = options.reinjectUnchangedCompact && input.source === "compact";
@@ -6482,7 +7547,7 @@ async function sessionStart(input, client2, options) {
     ledger.lastBriefHash = briefHash;
     return changed || reinjectCompact;
   });
-  return shouldInject ? { kind: "context", context: briefText } : NOOP;
+  return shouldInject ? { kind: "context", context: contextText } : NOOP;
 }
 async function preTool(input, options) {
   const original = { ...input.tool_input || {} };
@@ -6548,7 +7613,7 @@ async function postTool(input, client2, options) {
       ledger.mutatingOperations += 1;
     }
     if (!payload?.error) {
-      if (name.includes("mindgraph_capture") && ["lesson", "journal"].includes(action || "") || name.includes("mindgraph_commit") && action === "resolve_decision" || name.includes("mindgraph_plan") && action === "assess_risk") {
+      if (name.includes("mindgraph_capture") && ["lesson", "journal", "skill"].includes(action || "") || name.includes("mindgraph_commit") && action === "resolve_decision" || name.includes("mindgraph_plan") && action === "assess_risk") {
         ledger.memoryWritten = true;
       }
     }
@@ -6589,9 +7654,7 @@ async function postTool(input, client2, options) {
           }
         }
       } else if (aboutLedgerTask) {
-        ledger.taskVersion = number(payload?.current_version) ?? ledger.taskVersion;
-        ledger.leaseEpoch = number(payload?.current_epoch) ?? ledger.leaseEpoch;
-        ledger.leaseExpiresAt = number(payload?.lease_expires_at) ?? ledger.leaseExpiresAt;
+        adoptConflictFence(ledger, payload);
       }
     }
     if (ledger.taskUid && ledger.sessionUid && ledger.taskVersion !== void 0 && ledger.leaseEpoch !== void 0 && ledger.leaseExpiresAt !== void 0 && // Only ledgers whose lease state was written by a claim THIS code made
@@ -6648,19 +7711,35 @@ async function postTool(input, client2, options) {
         })
       );
       withLedger(input.session_id, options, (ledger) => {
-        if (payloadIsError(response)) return void 0;
         if (ledger.taskUid !== active.taskUid) return void 0;
+        if (payloadIsError(response)) {
+          adoptConflictFence(ledger, response);
+          return void 0;
+        }
         ledger.taskVersion = number(response?.task_version) ?? ledger.taskVersion;
         ledger.leaseEpoch = number(response?.lease_epoch) ?? ledger.leaseEpoch;
         ledger.leaseExpiresAt = number(response?.lease_expires_at) ?? ledger.leaseExpiresAt;
         ledger.lastLeaseRenewalAt = nowSeconds;
         return void 0;
       });
-    } catch {
+    } catch (cause) {
+      const conflict = conflictState(cause);
+      if (Object.keys(conflict).length > 0) {
+        withLedger(input.session_id, options, (ledger) => {
+          if (ledger.taskUid !== active.taskUid) return void 0;
+          adoptConflictFence(ledger, conflict);
+          return void 0;
+        });
+      }
     }
   }
   return NOOP;
 }
+function adoptConflictFence(ledger, payload) {
+  ledger.taskVersion = number(payload?.current_version) ?? ledger.taskVersion;
+  ledger.leaseEpoch = number(payload?.current_epoch) ?? ledger.leaseEpoch;
+  ledger.leaseExpiresAt = number(payload?.lease_expires_at) ?? ledger.leaseExpiresAt;
+}
 function payloadIsError(payload) {
   return Boolean(payload && payload.error);
 }
@@ -6813,195 +7892,19 @@ async function runCodexHook(input, client2, options = {}) {
   }
 }
 
-// src/hook-installer.ts
-var import_node_fs4 = __toESM(require("fs"));
-var import_node_os4 = __toESM(require("os"));
-var import_node_path4 = __toESM(require("path"));
-var import_node_crypto4 = __toESM(require("crypto"));
-var OWNER_MARKER = "--owner mindgraph";
-var RUNNER_RELATIVE = ".mindgraph/bin/mindgraph-hook.cjs";
-function command(harness) {
-  return `node "$HOME/${RUNNER_RELATIVE}" hook --harness ${harness} --owner mindgraph`;
-}
-function windowsCommand(harness) {
-  return `node "%USERPROFILE%\\.mindgraph\\bin\\mindgraph-hook.cjs" hook --harness ${harness} --owner mindgraph`;
-}
-function installHookRunner(sourceFile, homeDir) {
-  const target = import_node_path4.default.join(homeDir || import_node_os4.default.homedir(), RUNNER_RELATIVE);
-  import_node_fs4.default.mkdirSync(import_node_path4.default.dirname(target), { recursive: true });
-  import_node_fs4.default.copyFileSync(sourceFile, target);
-  return target;
-}
-function settingsPath(harness, scope, projectDir = process.cwd(), codexHomeDir = process.env.CODEX_HOME || import_node_path4.default.join(import_node_os4.default.homedir(), ".codex")) {
-  if (harness === "codex") {
-    return scope === "user" ? import_node_path4.default.join(codexHomeDir, "hooks.json") : import_node_path4.default.join(projectDir, ".codex", "hooks.json");
-  }
-  return scope === "user" ? import_node_path4.default.join(import_node_os4.default.homedir(), ".claude", "settings.json") : import_node_path4.default.join(projectDir, ".claude", "settings.json");
-}
-function readSettings(file) {
-  if (!import_node_fs4.default.existsSync(file)) return {};
-  return JSON.parse(import_node_fs4.default.readFileSync(file, "utf8"));
-}
-function ownedHook(harness, timeout, additionalContextLimit) {
-  return {
-    type: "command",
-    command: command(harness),
-    ...harness === "codex" ? { commandWindows: windowsCommand(harness) } : {},
-    timeout,
-    statusMessage: "Syncing MindGraph session context",
-    ...additionalContextLimit === void 0 ? {} : { additionalContextLimit }
-  };
-}
-function desiredEntries(harness) {
-  const common = {
-    SessionStart: [
-      {
-        matcher: harness === "claude-code" ? "startup|resume|clear|compact|fork" : "startup|resume|clear|compact",
-        // B7 live acceptance caught cold SessionStart calls crossing the
-        // inherited 20s edge in both harnesses: the hooks correctly failed
-        // open, but no brief reached the model. The same installed runner
-        // completed in 16.84s once warm. Keep a 30s cold-tenant margin.
-        // The declared Codex context limit must not undercut the brief's own
-        // 9,000-char budget: at 3,000 the harness applied a SECOND, tighter
-        // truncation the renderer knew nothing about.
-        hooks: [
-          ownedHook(
-            harness,
-            30,
-            harness === "codex" ? 1e4 : void 0
-          )
-        ]
-      }
-    ],
-    PreToolUse: [
-      {
-        matcher: "mcp__mindgraph__.*",
-        // Repository resolution over a large multi-repo workspace plus three
-        // git probes can exceed 3s on the first (uncached) call; a killed
-        // PreToolUse means the call goes through untagged.
-        hooks: [ownedHook(harness, 5)]
-      }
-    ],
-    // PostToolUse awaits the lease renewal round-trip, which fires exactly
-    // when the tenant is cold (post-idle reclaim) — 5s killed it mid-claim.
-    PostToolUse: [{ matcher: ".*", hooks: [ownedHook(harness, 10)] }],
-    Stop: [{ hooks: [ownedHook(harness, 5)] }],
-    // SessionEnd makes up to two sequential cloud calls (abandon_iteration +
-    // session close) — the SAME cold-tenant latency SessionStart needs 30s
-    // for. Claude honors the configured budget; Codex clamps SessionEnd to a
-    // 3s platform cap regardless of this value (see codex-hooks.ts wire
-    // map), so the codex adapter instead makes at most ONE call there.
-    SessionEnd: [
-      { hooks: [ownedHook(harness, harness === "codex" ? 3 : 30)] }
-    ]
-  };
-  return harness === "claude-code" ? {
-    ...common,
-    TaskCreated: [{ hooks: [ownedHook(harness, 3)] }],
-    TaskCompleted: [{ hooks: [ownedHook(harness, 3)] }]
-  } : common;
-}
-function hookCommand(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
-  const command2 = value.command;
-  return typeof command2 === "string" ? command2 : void 0;
-}
-function entryHasOwnedHook(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
-  const hooks = value.hooks;
-  return Array.isArray(hooks) && hooks.some((hook) => hookCommand(hook)?.includes(OWNER_MARKER));
-}
-function writeSettings(file, settings) {
-  import_node_fs4.default.mkdirSync(import_node_path4.default.dirname(file), { recursive: true });
-  const temporary = `${file}.${process.pid}.${import_node_crypto4.default.randomUUID()}.tmp`;
-  import_node_fs4.default.writeFileSync(temporary, `${JSON.stringify(settings, null, 2)}
-`, {
-    mode: 384
-  });
-  import_node_fs4.default.renameSync(temporary, file);
-}
-function installHooks(harness, scope, projectDir = process.cwd(), codexHomeDir) {
-  const file = settingsPath(harness, scope, projectDir, codexHomeDir);
-  const settings = readSettings(file);
-  const hooks = settings.hooks && typeof settings.hooks === "object" && !Array.isArray(settings.hooks) ? settings.hooks : {};
-  let added = 0;
-  let updated = 0;
-  for (const [event, wanted] of Object.entries(desiredEntries(harness))) {
-    const current = Array.isArray(hooks[event]) ? [...hooks[event]] : [];
-    const kept = current.filter((entry) => !entryHasOwnedHook(entry));
-    const hadOwned = kept.length !== current.length;
-    for (const entry of wanted) {
-      kept.push(entry);
-      if (hadOwned) updated += 1;
-      else added += 1;
-    }
-    hooks[event] = kept;
-  }
-  settings.hooks = hooks;
-  writeSettings(file, settings);
-  return { path: file, added, updated };
-}
-function uninstallHooks(harness, scope, projectDir = process.cwd(), codexHomeDir) {
-  const file = settingsPath(harness, scope, projectDir, codexHomeDir);
-  if (!import_node_fs4.default.existsSync(file)) return { path: file, removed: 0 };
-  const settings = readSettings(file);
-  const hooks = settings.hooks && typeof settings.hooks === "object" && !Array.isArray(settings.hooks) ? settings.hooks : {};
-  let removed = 0;
-  for (const [event, value] of Object.entries(hooks)) {
-    if (!Array.isArray(value)) continue;
-    const retainedEntries = [];
-    for (const rawEntry of value) {
-      if (!rawEntry || typeof rawEntry !== "object" || Array.isArray(rawEntry)) {
-        retainedEntries.push(rawEntry);
-        continue;
-      }
-      const entry = { ...rawEntry };
-      if (!Array.isArray(entry.hooks)) {
-        retainedEntries.push(entry);
-        continue;
-      }
-      const retainedHooks = entry.hooks.filter((hook) => {
-        const owned = hookCommand(hook)?.includes(OWNER_MARKER) || false;
-        if (owned) removed += 1;
-        return !owned;
-      });
-      if (retainedHooks.length > 0) {
-        entry.hooks = retainedHooks;
-        retainedEntries.push(entry);
-      }
-    }
-    if (retainedEntries.length > 0) hooks[event] = retainedEntries;
-    else delete hooks[event];
-  }
-  settings.hooks = hooks;
-  writeSettings(file, settings);
-  return { path: file, removed };
-}
-function installClaudeHooks(scope, projectDir = process.cwd()) {
-  return installHooks("claude-code", scope, projectDir);
-}
-function uninstallClaudeHooks(scope, projectDir = process.cwd()) {
-  return uninstallHooks("claude-code", scope, projectDir);
-}
-function installCodexHooks(scope, projectDir = process.cwd(), codexHomeDir) {
-  return installHooks("codex", scope, projectDir, codexHomeDir);
-}
-function uninstallCodexHooks(scope, projectDir = process.cwd(), codexHomeDir) {
-  return uninstallHooks("codex", scope, projectDir, codexHomeDir);
-}
-
 // src/cli.ts
+init_hook_installer();
 function recordHookHealth(harness, error) {
   try {
-    const dir = process.env.MINDGRAPH_RUNTIME_DIR || path5.join(os4.homedir(), ".mindgraph", "runtime");
-    fs5.mkdirSync(dir, { recursive: true, mode: 448 });
-    const file = path5.join(dir, "hook-health.json");
+    const dir = process.env.MINDGRAPH_RUNTIME_DIR || path7.join(os4.homedir(), ".mindgraph", "runtime");
+    fs6.mkdirSync(dir, { recursive: true, mode: 448 });
+    const file = path7.join(dir, "hook-health.json");
     let failures = 0;
     try {
-      failures = Number(JSON.parse(fs5.readFileSync(file, "utf8")).consecutiveFailures) || 0;
+      failures = Number(JSON.parse(fs6.readFileSync(file, "utf8")).consecutiveFailures) || 0;
     } catch {
     }
-    fs5.writeFileSync(
+    fs6.writeFileSync(
       file,
       `${JSON.stringify({
         harness,
@@ -7017,14 +7920,14 @@ function recordHookHealth(harness, error) {
 }
 function clearHookHealth(harness) {
   try {
-    const file = path5.join(
-      process.env.MINDGRAPH_RUNTIME_DIR || path5.join(os4.homedir(), ".mindgraph", "runtime"),
+    const file = path7.join(
+      process.env.MINDGRAPH_RUNTIME_DIR || path7.join(os4.homedir(), ".mindgraph", "runtime"),
       "hook-health.json"
     );
-    if (!fs5.existsSync(file)) return;
-    const current = JSON.parse(fs5.readFileSync(file, "utf8"));
+    if (!fs6.existsSync(file)) return;
+    const current = JSON.parse(fs6.readFileSync(file, "utf8"));
     if (!Number(current.consecutiveFailures)) return;
-    fs5.writeFileSync(
+    fs6.writeFileSync(
       file,
       `${JSON.stringify({
         harness,
@@ -7040,7 +7943,7 @@ function clearHookHealth(harness) {
 function getClaudeDesktopConfigPath() {
   switch (process.platform) {
     case "darwin":
-      return path5.join(
+      return path7.join(
         os4.homedir(),
         "Library",
         "Application Support",
@@ -7048,13 +7951,13 @@ function getClaudeDesktopConfigPath() {
         "claude_desktop_config.json"
       );
     case "win32":
-      return path5.join(
-        process.env.APPDATA || path5.join(os4.homedir(), "AppData", "Roaming"),
+      return path7.join(
+        process.env.APPDATA || path7.join(os4.homedir(), "AppData", "Roaming"),
         "Claude",
         "claude_desktop_config.json"
       );
     case "linux":
-      return path5.join(
+      return path7.join(
         os4.homedir(),
         ".config",
         "Claude",
@@ -7065,16 +7968,16 @@ function getClaudeDesktopConfigPath() {
   }
 }
 function readJsonFile(filePath) {
-  if (!fs5.existsSync(filePath)) return {};
-  const content = fs5.readFileSync(filePath, "utf-8");
+  if (!fs6.existsSync(filePath)) return {};
+  const content = fs6.readFileSync(filePath, "utf-8");
   return JSON.parse(content);
 }
 function writeJsonFile(filePath, data) {
-  const dir = path5.dirname(filePath);
-  if (!fs5.existsSync(dir)) {
-    fs5.mkdirSync(dir, { recursive: true });
+  const dir = path7.dirname(filePath);
+  if (!fs6.existsSync(dir)) {
+    fs6.mkdirSync(dir, { recursive: true });
   }
-  fs5.writeFileSync(filePath, JSON.stringify(data, null, 2) + "\n");
+  fs6.writeFileSync(filePath, JSON.stringify(data, null, 2) + "\n");
 }
 function getMcpServerEntry(apiKey, baseUrl) {
   const env = { MINDGRAPH_API_KEY: apiKey };
@@ -7161,7 +8064,7 @@ function installClaudeCode(apiKey, baseUrl, agentId) {
 }
 function uninstallClaudeDesktop() {
   const configPath = getClaudeDesktopConfigPath();
-  if (!fs5.existsSync(configPath)) {
+  if (!fs6.existsSync(configPath)) {
     console.log("Claude Desktop config not found. Nothing to remove.");
     return;
   }
@@ -7188,7 +8091,7 @@ function uninstallClaudeCode() {
 }
 function printStatus() {
   const desktopPath = getClaudeDesktopConfigPath();
-  if (fs5.existsSync(desktopPath)) {
+  if (fs6.existsSync(desktopPath)) {
     const config = readJsonFile(desktopPath);
     const servers = config.mcpServers;
     if (servers && "mindgraph" in servers) {
@@ -7206,12 +8109,12 @@ function printStatus() {
     `MINDGRAPH_BASE_URL: ${process.env.MINDGRAPH_BASE_URL || "https://api.mindgraph.cloud (default)"}`
   );
   try {
-    const healthFile = path5.join(
-      process.env.MINDGRAPH_RUNTIME_DIR || path5.join(os4.homedir(), ".mindgraph", "runtime"),
+    const healthFile = path7.join(
+      process.env.MINDGRAPH_RUNTIME_DIR || path7.join(os4.homedir(), ".mindgraph", "runtime"),
       "hook-health.json"
     );
-    if (fs5.existsSync(healthFile)) {
-      const health = JSON.parse(fs5.readFileSync(healthFile, "utf8"));
+    if (fs6.existsSync(healthFile)) {
+      const health = JSON.parse(fs6.readFileSync(healthFile, "utf8"));
       const failures = Number(health.consecutiveFailures) || 0;
       console.log(
         failures > 0 ? `Hooks: FAILING (${failures} consecutive; last: ${health.lastError} at ${health.lastFailureAt})` : `Hooks: healthy (last recovery ${health.lastOkAt || "unknown"})`
@@ -7228,7 +8131,7 @@ function withHooksFlag() {
 }
 function finishCodeInstall(apiKey, baseUrl, withHooks, agentId) {
   if (withHooks) {
-    const runner = installHookRunner(__filename);
+    const runner = installHookRunner(__filename, void 0, "0.19.0");
     console.log(`Installed pinned hook runner at ${runner}`);
     const result = installClaudeHooks("user");
     console.log(
@@ -7276,6 +8179,20 @@ USAGE:
   mindgraph-mcp install-hooks --harness claude-code|codex [--scope user|project]
   mindgraph-mcp uninstall-hooks --harness claude-code|codex [--scope user|project]
   mindgraph-mcp status           Show installation status
+  mindgraph-mcp skills pull [--dir .claude/skills]
+                                 Write your org's published+granted skills as
+                                 SKILL.md directories (allowlisted frontmatter
+                                 only). Revoked/archived skills are withdrawn;
+                                 local edits are never overwritten (.conflict
+                                 sidecars). NOTE: coding harnesses hot-reload
+                                 skill files \u2014 running sessions adopt pulled
+                                 changes immediately; session pinning exists
+                                 on the managed-agent leg only.
+  mindgraph-mcp skills push <path>
+                                 Import a SKILL.md directory as a review
+                                 candidate (nothing auto-publishes). A
+                                 previously pulled directory routes to the
+                                 candidate-only update path.
 
 OPTIONS:
   --api-key <key>     MindGraph API key (or set MINDGRAPH_API_KEY env var)
@@ -7339,7 +8256,7 @@ async function pollForKey(code) {
     } catch (e) {
       if (e instanceof Error && e.message.includes("Session")) throw e;
     }
-    await new Promise((resolve2) => setTimeout(resolve2, POLL_INTERVAL));
+    await new Promise((resolve3) => setTimeout(resolve3, POLL_INTERVAL));
   }
   throw new Error("Timed out waiting for authorization.");
 }
@@ -7349,7 +8266,7 @@ async function interactiveInit(baseUrl) {
     input: process.stdin,
     output: process.stdout
   });
-  const ask = (q) => new Promise((resolve2) => rl.question(q, resolve2));
+  const ask = (q) => new Promise((resolve3) => rl.question(q, resolve3));
   console.log("\nMindGraph MCP Server Setup\n");
   console.log("  1. Sign in via browser (recommended)");
   console.log("  2. Enter API key manually");
@@ -7420,8 +8337,79 @@ async function interactiveInit(baseUrl) {
   console.log("\nDone! Your knowledge graph is now connected.");
 }
 async function main2() {
-  const { command: command2, apiKey, baseUrl, scope, projectDir, harness, hooks, agentId } = parseArgs(process.argv);
+  const {
+    command: command2,
+    apiKey,
+    baseUrl,
+    scope,
+    projectDir,
+    harness,
+    hooks,
+    agentId,
+    positionals,
+    dir
+  } = parseArgs(process.argv);
   switch (command2) {
+    case "skills": {
+      if (!apiKey) {
+        console.error(
+          "API key required. Use --api-key or set MINDGRAPH_API_KEY."
+        );
+        process.exit(1);
+      }
+      const sub = positionals[0];
+      const api = httpSkillsApi(
+        baseUrl ?? "https://api.mindgraph.cloud",
+        apiKey,
+        agentId
+      );
+      if (sub === "pull") {
+        if (!agentId) {
+          console.error(
+            "note: no --agent-id/MINDGRAPH_AGENT_ID \u2014 pulling ALL published skills; bind an agent identity to scope the set by its grants."
+          );
+        }
+        const report = await skillsPull(api, dir ?? ".claude/skills", agentId);
+        for (const name of report.written) console.log(`  written    ${name}`);
+        for (const name of report.unchanged)
+          console.log(`  unchanged  ${name}`);
+        for (const name of report.locallyEdited)
+          console.log(`  local-edit ${name} \u2014 upstream unchanged; left alone`);
+        for (const name of report.conflicts)
+          console.log(
+            `  CONFLICT   ${name} \u2014 local edits kept; new upstream saved as SKILL.md.conflict`
+          );
+        for (const removal of report.removed)
+          console.log(
+            `  withdrawn  ${removal.name}${removal.kept ? " (local edits kept as SKILL.md.conflict)" : ""}${removal.statusReason ? ` \u2014 ${removal.statusReason}` : ""}`
+          );
+        for (const refusal of report.refused)
+          console.log(`  REFUSED    ${refusal.name} \u2014 ${refusal.reason}`);
+        const total = report.written.length + report.unchanged.length + report.locallyEdited.length + report.conflicts.length;
+        console.log(`
+${total} skill(s) synced.`);
+      } else if (sub === "push") {
+        const target = positionals[1];
+        if (!target) {
+          console.error("Usage: mindgraph-mcp skills push <path>");
+          process.exit(1);
+        }
+        const report = await skillsPush(api, target);
+        console.log(report.message);
+        if (report.existingUid) {
+          console.log(
+            `  existing skill: ${report.existingUid}${report.existingStatus ? ` (${report.existingStatus})` : ""}`
+          );
+        }
+        if (report.outcome === "error" || report.outcome === "conflict") {
+          process.exit(1);
+        }
+      } else {
+        console.error("Usage: mindgraph-mcp skills pull|push [...]");
+        process.exit(1);
+      }
+      break;
+    }
     case "help":
       printUsage();
       break;
@@ -7458,7 +8446,7 @@ async function main2() {
       if (hookHarness !== "claude-code" && hookHarness !== "codex") {
         throw new Error("--harness must be claude-code or codex");
       }
-      const runner = installHookRunner(__filename);
+      const runner = installHookRunner(__filename, void 0, "0.19.0");
       console.log(`Installed pinned hook runner at ${runner}`);
       const result = hookHarness === "codex" ? installCodexHooks(scope, projectDir) : installClaudeHooks(scope, projectDir);
       console.log(