opencode-agent-skills-md 1.0.0 → 1.1.0

package/packages/core/src/discovery.ts

@@ -1,257 +0,0 @@
-/**
- * Skill discovery across filesystem roots.
- *
- * The core never hard-codes a host's directory layout. Callers pass the list
- * of discovery roots; the default `getDefaultOpencodeRoots` reproduces the
- * legacy OpenCode priority order. PR2 will call `discoverAllSkills` from the
- * OpenCode host adapter with the same default.
- */
-
-import { homedir } from "node:os";
-import * as fs from "node:fs/promises";
-import * as path from "node:path";
-import type { Dirent } from "node:fs";
-import type {
-  DiscoveryPath,
-  FileDiscoveryResult,
-  LabeledDiscoveryResult,
-  Skill,
-  SkillLabel,
-} from "./types";
-import { parseSkillFile } from "./parse";
-import { walkDir } from "./walk";
-import { debugLog } from "./debug";
-
-/**
- * Check if a file exists in a directory and return path info.
- *
- * @param directory - Directory to check
- * @param relativePath - Relative path to use in result (caller-specific)
- * @param filename - Name of file to look for (e.g., 'SKILL.md')
- * @returns Path info if file exists, null otherwise
- */
-export const findFile = async (
-  directory: string,
-  relativePath: string,
-  filename: string
-): Promise<FileDiscoveryResult | null> => {
-  const filePath = path.join(directory, filename);
-  try {
-    await fs.stat(filePath);
-    return { filePath, relativePath };
-  } catch {
-    return null;
-  }
-};
-
-/**
- * Recursively find SKILL.md files in a directory.
- *
- * The base directory itself is checked first: a SKILL.md placed at the root
- * of a discovery root is returned with `relativePath = ""` and wins the
- * shadowing tie-break over same-name skills in subdirectories (first found
- * wins in `discoverAllSkills`).
- *
- * The traversal is delegated to the shared {@link walkDir} utility, which
- * owns hidden-dir / `node_modules` / `.git` skip rules and per-entry error
- * isolation. The visitor only checks each directory entry for SKILL.md and
- * records the labeled result; recursion and skip semantics are the walker's
- * job, not this function's.
- *
- * Output is sorted by `relativePath` so callers see a stable order across
- * runs regardless of the underlying `readdir` enumeration order.
- */
-export const findSkillsRecursive = async (
-  baseDir: string,
-  label: SkillLabel,
-  maxDepth: number = 3
-): Promise<LabeledDiscoveryResult[]> => {
-  const results: LabeledDiscoveryResult[] = [];
-
-  try {
-    await fs.access(baseDir);
-    // Check the baseDir itself before walking its entries so a root-level
-    // SKILL.md is discovered and naturally wins the first-found-wins tie-break.
-    const rootFile = await findFile(baseDir, '', 'SKILL.md');
-    if (rootFile) {
-      results.push({ ...rootFile, label });
-    }
-
-    await walkDir(baseDir, maxDepth, async (entry) => {
-      if (!entry.isDirectory()) return;
-      const fullPath = path.join(entry.parentPath, entry.name);
-      const relPath = path.relative(baseDir, fullPath);
-      const found = await findFile(fullPath, relPath, 'SKILL.md');
-      if (found) {
-        results.push({ ...found, label });
-      }
-    });
-  } catch (error) {
-    debugLog("findSkillsRecursive: cannot access baseDir", baseDir, error);
-  }
-
-  return results.sort((a, b) => a.relativePath.localeCompare(b.relativePath));
-};
-
-/**
- * Default recursion depth for the four priority discovery roots.
- *
- * Pre-refactor commit `c2d8e74` used `maxDepth: 1` for the Claude-side
- * roots; commit `12de52a` ("fix(core): unify maxDepth to 3 across all
- * discovery roots") widened them deliberately so deeply-nested Claude
- * skills surface. The regression net in
- * `tests/integration/skill-discovery.test.ts` pins this value so a
- * future narrowing breaks loudly.
- */
-const DEFAULT_DISCOVERY_MAX_DEPTH = 3;
-
-/**
- * Default discovery roots matching the pre-refactor OpenCode priority order
- * (see commit `c2d8e74`, `src/skills.ts#discoverAllSkills`):
- *   1. .opencode/skills/         (project - OpenCode)
- *   2. .claude/skills/           (project - Claude)
- *   3. ~/.config/opencode/skills/ (user - OpenCode)
- *   4. ~/.claude/skills/         (user - Claude)
- *
- * No shadowing - unique names only. First match wins, duplicates are warned.
- */
-export const getDefaultOpencodeRoots = (directory: string): DiscoveryPath[] => {
-  return [
-    { path: path.join(directory, '.opencode', 'skills'), label: 'project', maxDepth: DEFAULT_DISCOVERY_MAX_DEPTH },
-    { path: path.join(directory, '.claude', 'skills'), label: 'claude-project', maxDepth: DEFAULT_DISCOVERY_MAX_DEPTH },
-    { path: path.join(homedir(), '.config', 'opencode', 'skills'), label: 'user', maxDepth: DEFAULT_DISCOVERY_MAX_DEPTH },
-    { path: path.join(homedir(), '.claude', 'skills'), label: 'claude-user', maxDepth: DEFAULT_DISCOVERY_MAX_DEPTH }
-  ];
-};
-
-/**
- * Default callback for shadowed skill names. Emits a `console.warn` that
- * identifies the surviving (existing) skill and the duplicate that was
- * skipped. Hosts can override by passing `onDuplicate` to `discoverAllSkills`.
- *
- * @internal - exported for testing
- */
-export const defaultOnDuplicate = (
-  existing: Skill,
-  duplicate: Skill
-): void => {
-  console.warn(
-    `Skill name conflict: '${existing.name}' at ${existing.path} shadows duplicate at ${duplicate.path}`
-  );
-};
-
-/**
- * Discover all skills from the provided roots.
- *
- * @param directory - Project directory (used to build the default roots).
- * @param roots - Discovery roots. Defaults to the OpenCode priority order
- *   via `getDefaultOpencodeRoots(directory)`. Hosts pass an explicit list to
- *   override the layout.
- * @param onDuplicate - Optional callback invoked when two roots produce a
- *   skill with the same `name`. Defaults to `console.warn` via
- *   `defaultOnDuplicate`. The first-discovered skill wins; the duplicate
- *   (second one encountered) is passed to the callback but never stored.
- */
-export const discoverAllSkills = async (
-  directory: string,
-  roots: DiscoveryPath[] = getDefaultOpencodeRoots(directory),
-  onDuplicate: (existing: Skill, duplicate: Skill) => void = defaultOnDuplicate
-): Promise<Map<string, Skill>> => {
-  const allResults: LabeledDiscoveryResult[] = [];
-  for (const { path: baseDir, label, maxDepth } of roots) {
-    allResults.push(...await findSkillsRecursive(baseDir, label, maxDepth));
-  }
-
-  const skillsByName = new Map<string, Skill>();
-  for (const { filePath, relativePath, label } of allResults) {
-    const skill = await parseSkillFile(filePath, relativePath, label);
-    if (!skill) continue;
-    if (skillsByName.has(skill.name)) {
-      onDuplicate(skillsByName.get(skill.name)!, skill);
-      continue;
-    }
-    skillsByName.set(skill.name, skill);
-  }
-
-  return skillsByName;
-};
-
-/**
- * Resolve a skill by name, handling namespace prefixes.
- * Supports: "skill-name", "project:skill-name", "user:skill-name", etc.
- */
-export const resolveSkill = (
-  skillName: string,
-  skillsByName: Map<string, Skill>
-): Skill | null => {
-  if (skillName.includes(':')) {
-    const [namespace, name] = skillName.split(':');
-    for (const skill of skillsByName.values()) {
-      if (skill.name === name && (skill.label === namespace || skill.namespace === namespace)) {
-        return skill;
-      }
-    }
-    return null;
-  }
-  return skillsByName.get(skillName) || null;
-};
-
-/**
- * Recursively list all files in a directory, returning relative paths.
- * Excludes SKILL.md since it's already loaded as the main content.
- * Applies the same skip rules as walkDir (hidden dirs, node_modules, .git).
- */
-export const listSkillFiles = async (skillPath: string, maxDepth: number = 3): Promise<string[]> => {
-  const files: string[] = [];
-
-  const walk = async (dir: string, depth: number): Promise<void> => {
-    let entries: Dirent[];
-    try {
-      entries = await fs.readdir(dir, { withFileTypes: true });
-    } catch {
-      return;
-    }
-
-    for (const entry of entries) {
-      if (entry.name.startsWith(".")) continue;
-      if (entry.name === "node_modules" || entry.name === ".git") continue;
-
-      const fullPath = path.join(dir, entry.name);
-      const relPath = path.relative(skillPath, fullPath);
-
-      if (entry.name === "SKILL.md") continue;
-
-      if (entry.isDirectory()) {
-        if (depth < maxDepth) {
-          await walk(fullPath, depth + 1);
-        }
-      } else {
-        files.push(relPath);
-      }
-    }
-  };
-
-  await walk(skillPath, 0);
-  return files.sort();
-};
-
-/**
- * Get summaries of all available skills (name, description, trigger).
- * Used by preflight LLM call to evaluate which skills are relevant and
- * by the plugin's keyword matcher to rank matched skills.
- *
- * The `trigger` frontmatter key (PR 2 of `trigger-aware-skill-discovery`)
- * is threaded through so the keyword matcher can apply the 1.5x trigger
- * tier and the targeted outputs can render trigger text.
- *
- * @param directory - Project directory to discover skills from
- * @returns Array of skill summaries
- */
-export const getSkillSummaries = async (directory: string): Promise<Array<{ name: string; description: string; trigger?: string }>> => {
-  const skillsByName = await discoverAllSkills(directory);
-  return Array.from(skillsByName.values()).map(skill => ({
-    name: skill.name,
-    description: skill.description,
-    trigger: skill.trigger,
-  }));
-};

package/packages/core/src/index.d.ts

@@ -1,20 +0,0 @@
-/**
- * Public entrypoint for the portable skills core.
- *
- * Re-exports every type and function defined under `core/*` so consumers
- * (the host adapter, the test suite, and external harnesses) can
- * import everything from a single path:
- *
- *     import { discoverAllSkills, resolveSkill, type Skill } from "opencode-agent-skills-md/core";
- *
- * The core has zero runtime dependency on any host SDK. Host adapters
- * supply the host-boundary types and client implementations.
- */
-export type { DiscoveryPath, FileDiscoveryResult, LabeledDiscoveryResult, Script, Skill, SkillLabel, SkillSummary, } from "./types";
-export type { SkillFrontmatter } from "./parse";
-export { parseSkillFile, parseYamlFrontmatter } from "./parse";
-export { defaultOnDuplicate, discoverAllSkills, findFile, findSkillsRecursive, getDefaultOpencodeRoots, getSkillSummaries, listSkillFiles, resolveSkill, } from "./discovery";
-export { findScripts, isPathSafe } from "./scripts";
-export { findClosestMatch, levenshtein } from "./match";
-export { formatSkillListing, renderAvailableSkillsBlock } from "./content";
-export { escapeRegex, keywordMatch, scoreSkill, searchSkills, tokenize, } from "./search";

package/packages/core/src/index.ts

@@ -1,55 +0,0 @@
-/**
- * Public entrypoint for the portable skills core.
- *
- * Re-exports every type and function defined under `core/*` so consumers
- * (the host adapter, the test suite, and external harnesses) can
- * import everything from a single path:
- *
- *     import { discoverAllSkills, resolveSkill, type Skill } from "opencode-agent-skills-md/core";
- *
- * The core has zero runtime dependency on any host SDK. Host adapters
- * supply the host-boundary types and client implementations.
- */
-
-export type {
-  DiscoveryPath,
-  FileDiscoveryResult,
-  LabeledDiscoveryResult,
-  Script,
-  Skill,
-  SkillHostClient,
-  SkillHostContext,
-  SkillHostSession,
-  SkillLabel,
-  SkillSummary,
-} from "./types";
-
-export type { SkillFrontmatter } from "./parse";
-export { parseSkillFile, parseYamlFrontmatter } from "./parse";
-
-export {
-  defaultOnDuplicate,
-  discoverAllSkills,
-  findFile,
-  findSkillsRecursive,
-  getDefaultOpencodeRoots,
-  getSkillSummaries,
-  listSkillFiles,
-  resolveSkill,
-} from "./discovery";
-
-export { findScripts, isPathSafe } from "./scripts";
-
-export { debugLog } from "./debug";
-
-export { findClosestMatch, levenshtein } from "./match";
-
-export { formatSkillListing, renderAvailableSkillsBlock } from "./content";
-
-export {
-  escapeRegex,
-  keywordMatch,
-  scoreSkill,
-  searchSkills,
-  tokenize,
-} from "./search";

package/packages/core/src/match.d.ts

@@ -1,19 +0,0 @@
-/**
- * Fuzzy string matching helpers used to suggest the closest skill or script
- * name when a user request does not match exactly.
- *
- * Pure functions: no I/O, no host dependencies.
- */
-/**
- * Calculate Levenshtein edit distance between two strings.
- * Used for fuzzy matching suggestions when skill/script names are not found.
- * @internal - exported for testing
- */
-export declare function levenshtein(a: string, b: string): number;
-/**
- * Find the closest matching string from a list of candidates.
- * Uses combined scoring: prefix match (strongest), substring match, then Levenshtein distance.
- * Returns the best match if similarity is above 0.4 threshold, otherwise null.
- * @internal - exported for testing
- */
-export declare function findClosestMatch(input: string, candidates: string[]): string | null;

package/packages/core/src/match.ts

@@ -1,75 +0,0 @@
-/**
- * Fuzzy string matching helpers used to suggest the closest skill or script
- * name when a user request does not match exactly.
- *
- * Pure functions: no I/O, no host dependencies.
- */
-
-/**
- * Calculate Levenshtein edit distance between two strings.
- * Used for fuzzy matching suggestions when skill/script names are not found.
- * @internal - exported for testing
- */
-export const levenshtein = (a: string, b: string): number => {
-  const m = a.length;
-  const n = b.length;
-  const dp: number[][] = Array.from({ length: m + 1 }, (_, i) =>
-    Array.from({ length: n + 1 }, (_, j) => i || j)
-  );
-  for (let i = 1; i <= m; i++) {
-    for (let j = 1; j <= n; j++) {
-      dp[i]![j] = Math.min(
-        dp[i - 1]![j]! + 1,
-        dp[i]![j - 1]! + 1,
-        dp[i - 1]![j - 1]! + (a[i - 1] !== b[j - 1] ? 1 : 0)
-      );
-    }
-  }
-
-  return dp[m]![n]!;
-};
-
-/**
- * Find the closest matching string from a list of candidates.
- * Uses combined scoring: prefix match (strongest), substring match, then Levenshtein distance.
- * Returns the best match if similarity is above 0.4 threshold, otherwise null.
- * @internal - exported for testing
- */
-export const findClosestMatch = (input: string, candidates: string[]): string | null => {
-  if (candidates.length === 0) return null;
-
-  const inputLower = input.toLowerCase();
-  let bestMatch: string | null = null;
-  let bestScore = 0;
-
-  for (const candidate of candidates) {
-    const candidateLower = candidate.toLowerCase();
-    let score = 0;
-
-    if (candidateLower.startsWith(inputLower)) {
-      score = 0.9 + (inputLower.length / candidateLower.length) * 0.1;
-
-      const nextChar = candidateLower[inputLower.length];
-      if (nextChar && /[-_/.]/.test(nextChar)) {
-        score += 0.05;
-      }
-    } else if (inputLower.startsWith(candidateLower)) {
-      score = 0.8;
-    }
-    else if (candidateLower.includes(inputLower) || inputLower.includes(candidateLower)) {
-      score = 0.7;
-    }
-    else {
-      const distance = levenshtein(inputLower, candidateLower);
-      const maxLength = Math.max(inputLower.length, candidateLower.length);
-      score = 1 - (distance / maxLength);
-    }
-
-    if (score > bestScore) {
-      bestScore = score;
-      bestMatch = candidate;
-    }
-  }
-
-  return bestScore >= 0.4 ? bestMatch : null;
-};

package/packages/core/src/parse.d.ts

@@ -1,26 +0,0 @@
-/**
- * YAML frontmatter parsing and skill frontmatter validation.
- *
- * Pure functions: no I/O, no host dependencies. The script-discovery step
- * that follows parsing is delegated to `core/scripts.ts`.
- */
-import type { Skill, SkillLabel } from "./types";
-/**
- * Parse YAML frontmatter using the yaml library with safe options.
- * Uses strict schema to prevent code execution from malicious YAML.
- * Handles all YAML 1.2 features including multi-line strings (| and >).
- */
-export declare function parseYamlFrontmatter(text: string): Record<string, unknown>;
-export interface SkillFrontmatter {
-    name: string;
-    description: string;
-    trigger?: string;
-    license?: string;
-    "allowed-tools"?: string[];
-    metadata?: Record<string, unknown>;
-}
-/**
- * Parse a SKILL.md file and validate its frontmatter.
- * Returns null if parsing fails (with error logging).
- */
-export declare function parseSkillFile(skillPath: string, relativePath: string, label: SkillLabel): Promise<Skill | null>;

package/packages/core/src/parse.ts

@@ -1,141 +0,0 @@
-/**
- * YAML frontmatter parsing and skill frontmatter validation.
- *
- * Pure functions: no I/O, no host dependencies. The script-discovery step
- * that follows parsing is delegated to `core/scripts.ts`.
- */
-
-import * as fs from "node:fs/promises";
-import * as path from "node:path";
-import YAML from "yaml";
-import type { Skill, SkillLabel } from "./types";
-import { debugLog } from "./debug";
-import { findScripts } from "./scripts";
-
-/**
- * Parse YAML frontmatter using the yaml library with safe options.
- * Uses strict schema to prevent code execution from malicious YAML.
- * Handles all YAML 1.2 features including multi-line strings (| and >).
- *
- * Two distinct failure modes:
- *   - Empty frontmatter (blank / whitespace-only input) returns `{}`
- *     without touching the parser. This is a valid zero-field case.
- *   - Malformed YAML (real syntax error) is caught and logged via the
- *     `debugLog` helper; the function still returns `{}` so callers see
- *     the same graceful fallback as before.
- */
-export const parseYamlFrontmatter = (text: string): Record<string, unknown> => {
-  if (text.trim().length === 0) return {};
-  try {
-    const result = YAML.parse(text, {
-      schema: "core",
-      maxAliasCount: 100,
-    });
-    return typeof result === "object" && result !== null
-      ? (result as Record<string, unknown>)
-      : {};
-  } catch (error) {
-    debugLog("parseYamlFrontmatter: malformed YAML", error);
-    return {};
-  }
-};
-
-export interface SkillFrontmatter {
-  name: string;
-  description: string;
-  trigger?: string;
-  license?: string;
-  "allowed-tools"?: string[];
-  metadata?: Record<string, unknown>;
-}
-
-const NAME_REGEX = /^[\p{Ll}\p{N}-]+$/u;
-
-const validateFrontmatter = (obj: unknown): SkillFrontmatter | null => {
-  if (typeof obj !== "object" || obj === null) return null;
-  const o = obj as Record<string, unknown>;
-  if (typeof o.name !== "string" || !NAME_REGEX.test(o.name) || o.name.length === 0) return null;
-  if (typeof o.description !== "string" || o.description.length === 0) return null;
-  if (o.trigger !== undefined && typeof o.trigger !== "string") return null;
-  if (o.license !== undefined && typeof o.license !== "string") return null;
-  if (o["allowed-tools"] !== undefined && !Array.isArray(o["allowed-tools"])) return null;
-  if (o.metadata !== undefined && typeof o.metadata !== "object") return null;
-
-  // Build SkillFrontmatter from validated fields. Avoids the previous
-  // `as unknown as SkillFrontmatter` double cast so the resulting object
-  // is structurally a SkillFrontmatter at every optional key.
-  const frontmatter: SkillFrontmatter = {
-    name: o.name,
-    description: o.description,
-  };
-  if (o.trigger !== undefined) frontmatter.trigger = o.trigger;
-  if (o.license !== undefined) frontmatter.license = o.license;
-  if (o["allowed-tools"] !== undefined) {
-    frontmatter["allowed-tools"] = o["allowed-tools"] as string[];
-  }
-  if (o.metadata !== undefined) {
-    frontmatter.metadata = o.metadata as Record<string, unknown>;
-  }
-  return frontmatter;
-};
-
-/**
- * Parse a SKILL.md file and validate its frontmatter.
- * Returns null if parsing fails (with error logging).
- */
-export const parseSkillFile = async (
-  skillPath: string,
-  relativePath: string,
-  label: SkillLabel
-): Promise<Skill | null> => {
-  const content = await fs.readFile(skillPath, 'utf-8').catch((error) => {
-    debugLog("parseSkillFile: cannot read", skillPath, error);
-    return null;
-  });
-  if (!content) {
-    return null;
-  }
-
-  const frontmatterMatch = content.match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/);
-  if (!frontmatterMatch?.[1] || !frontmatterMatch[2]) {
-    return null;
-  }
-
-  const frontmatterText = frontmatterMatch[1];
-  const skillContent = frontmatterMatch[2].trim();
-
-  let frontmatterObj: unknown;
-  try {
-    frontmatterObj = parseYamlFrontmatter(frontmatterText);
-  } catch {
-    return null;
-  }
-
-  const frontmatter = validateFrontmatter(frontmatterObj);
-  if (!frontmatter) {
-    return null;
-  }
-
-  const skillDirPath = path.dirname(skillPath);
-  const scripts = await findScripts(skillDirPath);
-
-  const rawNamespace = frontmatter.metadata?.namespace;
-  const namespace =
-    typeof rawNamespace === "string" ? rawNamespace : undefined;
-
-  const rawTags = frontmatter.metadata?.tags;
-  const tags = Array.isArray(rawTags) ? rawTags.filter((t): t is string => typeof t === "string") : [];
-
-  return {
-    name: frontmatter.name,
-    description: frontmatter.description,
-    trigger: frontmatter.trigger,
-    path: skillDirPath,
-    relativePath,
-    namespace,
-    tags,
-    label,
-    scripts,
-    template: skillContent
-  };
-};

package/packages/core/src/scripts.d.ts

@@ -1,17 +0,0 @@
-/**
- * Script discovery and path-safety helpers.
- *
- * Pure functions: filesystem reads only, no host dependencies.
- */
-import type { Script } from "./types";
-/**
- * Recursively find executable scripts in a skill's directory.
- * Skips hidden directories (starting with .) and common dependency dirs.
- * Only files with executable bit set are returned.
- */
-export declare function findScripts(skillPath: string, maxDepth?: number): Promise<Script[]>;
-/**
- * Check if a path is safely within a base directory (no escape via .. or symlink).
- * Uses fs.realpath to canonicalize paths before comparing.
- */
-export declare function isPathSafe(basePath: string, requestedPath: string): Promise<boolean>;

package/packages/core/src/scripts.ts

@@ -1,79 +0,0 @@
-/**
- * Script discovery and path-safety helpers.
- *
- * Pure functions: filesystem reads only, no host dependencies.
- */
-
-import * as fs from "node:fs/promises";
-import * as path from "node:path";
-import type { Script } from "./types";
-import { walkDir } from "./walk";
-
-/**
- * Directory names the script walker skips on top of the unconditional
- * `node_modules` / `.git` / hidden-dir rules owned by {@link walkDir}.
- * These are common dependency / cache directories that never host skill
- * scripts and would otherwise inflate the file scan.
- */
-const SCRIPT_SKIP_DIRS: ReadonlySet<string> = new Set([
-  '__pycache__',
-  '.venv',
-  'venv',
-  '.tox',
-  '.nox',
-]);
-
-/**
- * Recursively find executable scripts in a skill's directory.
- *
- * Traversal is delegated to the shared {@link walkDir} utility, which owns
- * hidden-dir / `node_modules` / `.git` skip rules and per-entry error
- * isolation. The visitor checks each file entry's executable bit (the
- * `0o111` mode mask) and pushes a `Script` record only for files that
- * qualify.
- *
- * Output is sorted by `relativePath` so callers see a stable order
- * regardless of the underlying `readdir` enumeration order.
- */
-export const findScripts = async (skillPath: string, maxDepth: number = 10): Promise<Script[]> => {
-  const scripts: Script[] = [];
-
-  await walkDir(skillPath, maxDepth, async (entry) => {
-    if (!entry.isFile()) return;
-    const fullPath = path.join(entry.parentPath, entry.name);
-    const relPath = path.relative(skillPath, fullPath);
-
-    let stats;
-    try {
-      stats = await fs.stat(fullPath);
-    } catch {
-      return;
-    }
-
-    if (stats.mode & 0o111) {
-      scripts.push({ relativePath: relPath, absolutePath: fullPath });
-    }
-  }, { skipDirs: SCRIPT_SKIP_DIRS });
-
-  return scripts.sort((a, b) => a.relativePath.localeCompare(b.relativePath));
-};
-
-/**
- * Check if a path is safely within a base directory (no escape via .. or symlink).
- *
- * Uses fs.realpath to canonicalize both paths before comparing, which closes
- * the symlink-escape attack: a symlink inside the skill directory that points
- * outside will have its real path resolved and fail the prefix check.
- *
- * @returns Promise<boolean> — true if the resolved real path is within basePath
- */
-export const isPathSafe = async (basePath: string, requestedPath: string): Promise<boolean> => {
-  const resolved = path.resolve(basePath, requestedPath);
-  try {
-    const resolvedReal = await fs.realpath(resolved);
-    const baseReal = await fs.realpath(basePath);
-    return resolvedReal.startsWith(baseReal + path.sep) || resolvedReal === baseReal;
-  } catch {
-    return false;
-  }
-};