opencode-matrixx-v2 1.2.1 → 1.2.2

package/dist/plugin/{context.d.ts → tool/context.d.ts}

@@ -27,8 +27,8 @@
  * default export structurally (`{ id, setup }`), so `src/index.ts` exports
  * that literal directly.
  */
-import type { NotifySink } from "../shared/notify";
-import type { MatrixxToolDefinition } from "../tools/shared/define-tool";
+import type { NotifySink } from "../../shared/runtime/notify";
+import type { MatrixxToolDefinition } from "../../shared/tool/define-tool";
 export type Cleanup = () => unknown;
 export interface V2App {
     readonly name: string;

package/dist/plugin/{event.d.ts → tool/event.d.ts}

@@ -1,7 +1,7 @@
-import type { MatrixxConfig } from "../config";
-import type { NativePluginContext } from "../shared/session-context-source";
+import type { MatrixxConfig } from "../../config";
+import type { NativePluginContext } from "../../shared/session/session-context-source";
+import type { DomainHooks, DomainManagers } from "../setup-domains";
 import type { MatrixxContext, V2Event } from "./context";
-import type { DomainHooks, DomainManagers } from "./setup-domains";
 type FirstMessageVariantGate = {
     markSessionCreated: (sessionInfo: {
         id?: string;

package/dist/plugin/tool/index.d.ts

@@ -0,0 +1,22 @@
+export { createAvailableCategories } from "./available-categories";
+export { createChatMessageHandler } from "./chat-message";
+export { createChatParamsHandler } from "./chat-params";
+export type { Cleanup, MatrixxContext, ToolsRecord, V2AgentEditor, V2AgentInfo, V2AgentTransformDomain, V2App, V2DomainEditor, V2Event, V2ExecuteAfterEvent, V2ExecuteBeforeEvent, V2HookCallback, V2Location, V2McpEditor, V2McpTransformDomain, V2PermissionApi, V2Project, V2Registration, V2SessionCompactionEvent, V2SessionContextEvent, V2SessionDomain, V2SessionPromptEvent, V2SystemPart, V2ToolContext, V2ToolDomain, V2ToolEditor, V2ToolInfo, V2ToolResult, V2TransformDomain, } from "./context";
+export { createEventHandler } from "./event";
+export type { DispatchGuard, EventDispatcher, EventDispatcherDeps, EventDispatcherStats, EventSubscriber, } from "./event-dispatch";
+export { createEventDispatcher, DEDUPLICATE_WINDOW_MS, DISPATCH_BACKOFF_BASE_MS, DISPATCH_BACKOFF_MAX_MS, defaultSleep, dispatchBackoffMs, } from "./event-dispatch";
+export type { Auth, Event, Hooks, Message, Model, ModelV2, Part, Permission, Provider, ProviderContext, ProviderV2, SDKConfig, UserMessage, } from "./legacy-hooks";
+export { createNativePluginContext } from "./native-context";
+export { pruneRecentSyntheticIdles } from "./recent-synthetic-idles";
+export { resolveSessionAgent } from "./session-agent-resolver";
+export { normalizeSessionStatusToIdle } from "./session-status-normalizer";
+export type { SkillContext } from "./skill-context";
+export { createSkillContext } from "./skill-context";
+export type { ToolCatalogResult } from "./tool-catalog";
+export { createToolCatalog } from "./tool-catalog";
+export { createToolDefinitionHandler, toolAuthoringEntry } from "./tool-definition";
+export { createToolExecuteAfterHandler } from "./tool-execute-after";
+export { createToolExecuteBeforeHandler } from "./tool-execute-before";
+export type { ToolEditorLike, ToolPermissionDecision, ToolPermissionEffect, ToolPolicyOptions, } from "./tool-policy";
+export { applyDisabledToolsTransform, BDD_FILE_EXTENSION, decideToolPermission, directoryHasMatch, isConstructAgentEnabled, LOOK_AT_MEDIA_EXTENSIONS, PDF_FILE_EXTENSION, shouldEnableBddTools, shouldEnableEvolutionTool, shouldEnableKnowledgeHubConfirm, shouldEnableLookAt, shouldEnablePdfFigures, shouldEnablePresetTools, shouldEnableSessionCleanup, TOOL_GATING_MAX_DEPTH, TOOL_GATING_MAX_ENTRIES, TOOL_GATING_SKIP_DIRS, } from "./tool-policy";
+export { createUnstableAgentBabysitter } from "./unstable-agent-babysitter";

package/dist/plugin/{legacy-hooks.d.ts → tool/legacy-hooks.d.ts}

@@ -27,7 +27,7 @@ export type SDKConfig = Record<string, unknown>;
 export type UserMessage = Record<string, unknown>;
 export type ModelV2 = Record<string, unknown>;
 export type ProviderV2 = Record<string, unknown>;
-import type { MatrixxToolDefinition } from "../tools/shared/define-tool";
+import type { MatrixxToolDefinition } from "../../shared/tool/define-tool";
 export type ProviderContext = {
     source: "env" | "config" | "custom" | "api";
     info: Provider;

package/dist/plugin/{native-context.d.ts → tool/native-context.d.ts}

@@ -1,4 +1,4 @@
-import type { NativePluginContext } from "../shared/session-context-source";
+import type { NativePluginContext } from "../../shared/session/session-context-source";
 import type { MatrixxContext } from "./context";
 /**
  * Builds the native plugin context the matrixx core runs against.

package/dist/plugin/{session-agent-resolver.d.ts → tool/session-agent-resolver.d.ts}

@@ -1,2 +1,2 @@
-import type { SessionContextCarrier } from "../shared/session-context-source";
+import type { SessionContextCarrier } from "../../shared/session/session-context-source";
 export declare function resolveSessionAgent(client: SessionContextCarrier, sessionId: string, timeoutMs?: number): Promise<string | undefined>;

package/dist/plugin/{skill-context.d.ts → tool/skill-context.d.ts}

@@ -1,7 +1,7 @@
-import type { AvailableSkill } from "../agents/dynamic-agent-prompt-builder";
-import type { MatrixxConfig } from "../config";
-import type { BrowserAutomationProvider } from "../config/schema/browser-automation";
-import { type BuiltinSkill } from "../skills";
+import type { AvailableSkill } from "../../agents/dynamic-agent-prompt-builder";
+import type { MatrixxConfig } from "../../config";
+import type { BrowserAutomationProvider } from "../../config/schema/browser-automation";
+import { type BuiltinSkill } from "../../skills";
 export type SkillContext = {
     builtinSkills: BuiltinSkill[];
     availableSkills: AvailableSkill[];

package/dist/plugin/{tool-catalog.d.ts → tool/tool-catalog.d.ts}

@@ -1,8 +1,8 @@
-import type { AvailableCategory } from "../agents/dynamic-agent-prompt-builder";
-import type { MatrixxConfig } from "../config";
-import type { NativePluginContext } from "../shared/session-context-source";
+import type { AvailableCategory } from "../../agents/dynamic-agent-prompt-builder";
+import type { MatrixxConfig } from "../../config";
+import type { NativePluginContext } from "../../shared/session/session-context-source";
+import type { DomainManagers } from "../setup-domains";
 import type { ToolsRecord } from "./context";
-import type { DomainManagers } from "./setup-domains";
 import type { SkillContext } from "./skill-context";
 export type ToolCatalogResult = {
     filteredTools: ToolsRecord;

package/dist/plugin/{tool-definition.d.ts → tool/tool-definition.d.ts}

@@ -1,5 +1,5 @@
-import { defineTool } from "../tools/shared/define-tool";
-import type { DomainHooks } from "./setup-domains";
+import { defineTool } from "../../shared/tool/define-tool";
+import type { DomainHooks } from "../setup-domains";
 export declare const toolAuthoringEntry: typeof defineTool;
 export declare function createToolDefinitionHandler(args: {
     hooks: DomainHooks;

package/dist/plugin/{tool-execute-after.d.ts → tool/tool-execute-after.d.ts}

@@ -1,4 +1,4 @@
-import type { DomainHooks } from "./setup-domains";
+import type { DomainHooks } from "../setup-domains";
 export declare function createToolExecuteAfterHandler(args: {
     hooks: DomainHooks;
 }): (input: {

package/dist/plugin/{tool-execute-before.d.ts → tool/tool-execute-before.d.ts}

@@ -1,6 +1,6 @@
-import type { SessionContextCarrier } from "../shared/session-context-source";
+import type { SessionContextCarrier } from "../../shared/session/session-context-source";
+import type { DomainHooks } from "../setup-domains";
 import type { MatrixxContext } from "./context";
-import type { DomainHooks } from "./setup-domains";
 export declare function createToolExecuteBeforeHandler(args: {
     ctx: MatrixxContext & SessionContextCarrier;
     hooks: DomainHooks;

package/dist/plugin/{unstable-agent-babysitter.d.ts → tool/unstable-agent-babysitter.d.ts}

@@ -1,6 +1,6 @@
-import type { MatrixxConfig } from "../config";
-import type { BackgroundManager } from "../features/background-agent";
-import type { NativePluginContext } from "../shared/session-context-source";
+import type { MatrixxConfig } from "../../config";
+import type { BackgroundManager } from "../../features/background-agent";
+import type { NativePluginContext } from "../../shared/session/session-context-source";
 export declare function createUnstableAgentBabysitter(args: {
     ctx: NativePluginContext;
     backgroundManager: BackgroundManager;

package/dist/shared/{agent-variant.d.ts → agent/agent-variant.d.ts}

@@ -1,4 +1,4 @@
-import type { MatrixxConfig } from "../config";
+import type { MatrixxConfig } from "../../config";
 export declare function resolveAgentVariant(config: MatrixxConfig, agentName?: string): string | undefined;
 export declare function resolveVariantForModel(config: MatrixxConfig, agentName: string, currentModel: {
     providerID: string;

package/dist/shared/agent/index.d.ts

@@ -0,0 +1,5 @@
+export * from "./agent-display-names";
+export * from "./agent-label";
+export * from "./agent-variant";
+export * from "./permission-compat";
+export * from "./safe-create-hook";

package/dist/shared/{context-limits.d.ts → compaction/context-limits.d.ts}

@@ -1,4 +1,4 @@
-import type { ExperimentalConfig } from "../config/schema/experimental";
+import type { ExperimentalConfig } from "../../config/schema/experimental";
 import type { ContextLimitModelCacheState } from "./context-limit-resolver";
 import { isAnthropicProvider, resolveActualContextLimit } from "./context-limit-resolver";
 /**

package/dist/shared/{dynamic-truncator.d.ts → compaction/dynamic-truncator.d.ts}

@@ -1,5 +1,5 @@
-import type { MatrixxContext } from "../plugin/context";
-import type { SessionContextCarrier } from "./session-context-source";
+import type { MatrixxContext } from "../../plugin/tool/context";
+import type { SessionContextCarrier } from "../session/session-context-source";
 type MessageSource = MatrixxContext | SessionContextCarrier;
 interface TruncationResult {
     result: string;

package/dist/shared/compaction/index.d.ts

@@ -0,0 +1,7 @@
+export * from "./compaction-log";
+export * from "./compaction-model-resolver";
+export * from "./context-limit-resolver";
+export * from "./context-limits";
+export * from "./dynamic-truncator";
+export * from "./token-cache";
+export * from "./truncate-description";

package/dist/shared/config/index.d.ts

@@ -0,0 +1,8 @@
+export * from "./config-errors";
+export * from "./data-path";
+export * from "./deep-merge";
+export * from "./opencode-config-dir";
+export * from "./opencode-storage-detection";
+export * from "./opencode-storage-paths";
+export * from "./opencode-version";
+export * from "./task-system-gating";

package/dist/shared/{task-system-gating.d.ts → config/task-system-gating.d.ts}

@@ -1,5 +1,5 @@
-import type { MatrixxConfig } from "../config/schema";
-import type { TasksConfig } from "../config/schema/tasks";
+import type { MatrixxConfig } from "../../config/schema";
+import type { TasksConfig } from "../../config/schema/tasks";
 export declare const TASK_SYSTEM_DEFAULT: true;
 export type ResolvedTasksConfig = Required<Pick<TasksConfig, "enabled" | "scope" | "session_scoped">> & Pick<TasksConfig, "storage_path" | "task_list_id" | "stale_after_hours" | "pollTimeoutMs" | "background_stale_after_hours">;
 /**

package/dist/shared/index.d.ts

@@ -1,70 +1,72 @@
-export * from "./agent-tool-restrictions";
-export * from "./agent-variant";
-export * from "./binary-downloader";
+export * from "./agent/agent-variant";
+export * from "./agent/permission-compat";
+export * from "./agent/safe-create-hook";
 export * from "./command-executor";
-export * from "./compaction-log";
-export * from "./config-errors";
-export * from "./connected-providers-cache";
-export * from "./context-mode-enforcement";
-export * from "./data-path";
-export * from "./dcp-switch-profile";
-export * from "./deep-merge";
-export * from "./delay";
-export * from "./dynamic-truncator";
-export * from "./escape-regexp";
-export * from "./external-plugin-detector";
-export * from "./file-reference-resolver";
-export * from "./file-utils";
-export * from "./format-bytes";
-export * from "./format-duration";
-export * from "./frontmatter";
+export * from "./compaction/compaction-log";
+export * from "./compaction/compaction-model-resolver";
+export * from "./compaction/dynamic-truncator";
+export * from "./compaction/token-cache";
+export * from "./compaction/truncate-description";
+export * from "./config/config-errors";
+export * from "./config/data-path";
+export * from "./config/deep-merge";
+export * from "./config/opencode-config-dir";
+export * from "./config/opencode-storage-detection";
+export * from "./config/opencode-storage-paths";
+export * from "./config/opencode-version";
 export { collectGitDiffStats } from "./git-worktree/collect-git-diff-stats";
 export { formatFileChanges } from "./git-worktree/format-file-changes";
 export { parseGitDiffNumstat } from "./git-worktree/parse-diff-numstat";
 export { parseGitStatusPorcelain } from "./git-worktree/parse-status-porcelain";
 export type { GitFileStat, GitFileStatus } from "./git-worktree/types";
-export * from "./injection-notifier";
-export * from "./is-abort-error";
-export * from "./json-safe-metadata";
-export * from "./jsonc-parser";
-export * from "./logger";
-export * from "./memory-backend-detect";
-export * from "./model-availability";
-export * from "./model-requirements";
-export { type ModelResolutionProvenance, type ModelResolutionRequest, type ModelResolutionResult, normalizeModel, resolveModelPipeline, } from "./model-resolution-pipeline";
-export * from "./model-suggestion-retry";
-export * from "./normalize-sdk-response";
-export * from "./notify";
-export * from "./opencode-config-dir";
-export * from "./opencode-http-api";
-export * from "./opencode-message-dir";
-export * from "./opencode-server-auth";
-export * from "./opencode-storage-detection";
-export * from "./opencode-storage-paths";
-export * from "./opencode-version";
-export * from "./permission-compat";
-export * from "./port-utils";
-export * from "./rtk-enforcement";
-export * from "./safe-create-hook";
-export * from "./sentinels";
-export * from "./session-context-source";
-export * from "./session-cursor";
-export * from "./session-directory-resolver";
-export * from "./session-facade";
-export * from "./session-id";
-export * from "./session-message";
-export * from "./session-utils";
-export * from "./shell-env";
-export * from "./shell-tool-name";
-export { isLinkedWorktree, MATRIX_STATE_DIR, resolveStateRoot, type StateRootCandidates, stateExists, stateRootFromPluginContext, stateRootFromToolContext, } from "./state-root";
-export * from "./status-types";
-export * from "./system-directive";
+export * from "./io/binary-downloader";
+export * from "./io/file-reference-resolver";
+export * from "./io/file-utils";
+export * from "./io/frontmatter";
+export * from "./io/port-utils";
+export * from "./io/shell-env";
+export * from "./io/shell-tool-name";
+export * from "./io/zip-extractor";
+export * from "./model/connected-providers-cache";
+export * from "./model/model-availability";
+export * from "./model/model-requirements";
+export { type ModelResolutionProvenance, type ModelResolutionRequest, type ModelResolutionResult, normalizeModel, resolveModelPipeline, } from "./model/model-resolution-pipeline";
+export * from "./model/model-suggestion-retry";
+export * from "./model/normalize-sdk-response";
+export * from "./opencode/external-plugin-detector";
+export * from "./opencode/memory-backend-detect";
+export * from "./opencode/opencode-http-api";
+export * from "./opencode/opencode-message-dir";
+export * from "./opencode/opencode-server-auth";
+export * from "./outcome/sentinels";
+export * from "./policy/context-mode-enforcement";
+export * from "./policy/dcp-switch-profile";
+export * from "./policy/injection-notifier";
+export * from "./policy/rtk-enforcement";
+export * from "./policy/status-types";
+export * from "./runtime/delay";
+export * from "./runtime/is-abort-error";
+export * from "./runtime/logger";
+export * from "./runtime/notify";
+export * from "./runtime/unwrap-list";
+export * from "./runtime/with-timeout";
+export * from "./session/session-context-source";
+export * from "./session/session-cursor";
+export * from "./session/session-directory-resolver";
+export * from "./session/session-facade";
+export * from "./session/session-id";
+export * from "./session/session-message";
+export * from "./session/session-utils";
+export { isLinkedWorktree, MATRIX_STATE_DIR, resolveStateRoot, type StateRootCandidates, stateExists, stateRootFromPluginContext, stateRootFromToolContext, } from "./session/state-root";
+export * from "./session/transcript-path";
+export * from "./text/escape-regexp";
+export * from "./text/format-bytes";
+export * from "./text/format-duration";
+export * from "./text/json-safe-metadata";
+export * from "./text/jsonc-parser";
+export * from "./text/system-directive";
 export * from "./tmux/constants";
 export * from "./tmux/tmux-utils";
 export * from "./tmux/types";
-export * from "./token-cache";
-export * from "./transcript-path";
-export * from "./truncate-description";
-export * from "./unwrap-list";
-export * from "./with-timeout";
-export * from "./zip-extractor";
+export * from "./tool/agent-tool-restrictions";
+export * from "./tool/define-tool";

package/dist/shared/io/index.d.ts

@@ -0,0 +1,8 @@
+export * from "./binary-downloader";
+export * from "./file-reference-resolver";
+export * from "./file-utils";
+export * from "./frontmatter";
+export * from "./port-utils";
+export * from "./shell-env";
+export * from "./shell-tool-name";
+export * from "./zip-extractor";

package/dist/shared/model/index.d.ts

@@ -0,0 +1,7 @@
+export * from "./connected-providers-cache";
+export * from "./model-availability";
+export * from "./model-requirements";
+export * from "./model-resolution-pipeline";
+export * from "./model-sanitizer";
+export * from "./model-suggestion-retry";
+export * from "./normalize-sdk-response";

package/dist/shared/{model-requirements.d.ts → model/model-requirements.d.ts}

@@ -1,4 +1,4 @@
-import { type ModelRequirements } from "../config/schema/model-config";
+import { type ModelRequirements } from "../../config/schema/model-config";
 export type FallbackEntry = {
     providers: string[];
     model: string;

package/dist/shared/{model-suggestion-retry.d.ts → model/model-suggestion-retry.d.ts}

@@ -1,4 +1,4 @@
-import type { SessionDomainLike } from "./session-facade";
+import type { SessionDomainLike } from "../session/session-facade";
 export interface RetrySessionClient {
     session: {
         promptAsync(args: unknown): Promise<unknown>;

package/dist/shared/opencode/index.d.ts

@@ -0,0 +1,5 @@
+export * from "./external-plugin-detector";
+export * from "./memory-backend-detect";
+export * from "./opencode-http-api";
+export * from "./opencode-message-dir";
+export * from "./opencode-server-auth";

package/dist/shared/{memory-backend-detect.d.ts → opencode/memory-backend-detect.d.ts}

@@ -1,4 +1,4 @@
-import type { MemoryBackend } from "../config/schema/memory";
+import type { MemoryBackend } from "../../config/schema/memory";
 export interface MemoryBackendDetection {
     hasLcmTools: boolean;
     hasSupermemoryTools: boolean;

package/dist/shared/outcome/index.d.ts

@@ -0,0 +1,5 @@
+export * from "./poll-timeout-outcome";
+export * from "./revive-outcome";
+export * from "./saturated-outcome";
+export * from "./sentinels";
+export * from "./wallclock-outcome";

package/dist/shared/{dcp-switch-profile.d.ts → policy/dcp-switch-profile.d.ts}

@@ -1,4 +1,4 @@
-import type { DcpConfig } from "../config/schema/dcp";
+import type { DcpConfig } from "../../config/schema/dcp";
 export interface DcpSwitchProfileOptions {
     pluginConfig?: {
         dcp?: DcpConfig;

package/dist/shared/policy/index.d.ts

@@ -0,0 +1,7 @@
+export * from "./code-patterns";
+export * from "./context-mode-enforcement";
+export * from "./dcp-guidance";
+export * from "./dcp-switch-profile";
+export * from "./injection-notifier";
+export * from "./rtk-enforcement";
+export * from "./status-types";

package/dist/shared/{injection-notifier.d.ts → policy/injection-notifier.d.ts}

@@ -1,4 +1,4 @@
-import type { MatrixxContext } from "../plugin/context";
+import type { MatrixxContext } from "../../plugin/tool/context";
 export declare const INJECTION_NOTICE_MAX_BODY_LENGTH = 120;
 export interface NotifyInjectionOptions {
     sessionID: string;

package/dist/shared/{rtk-enforcement.d.ts → policy/rtk-enforcement.d.ts}

@@ -1,4 +1,4 @@
-import type { RtkConfig } from "../config/schema/rtk";
+import type { RtkConfig } from "../../config/schema/rtk";
 export interface RtkEnforcement {
     enabled: boolean;
     binaryPresent: boolean;

package/dist/shared/runtime/index.d.ts

@@ -0,0 +1,7 @@
+export * from "./delay";
+export * from "./is-abort-error";
+export * from "./logger";
+export * from "./notify";
+export * from "./record-type-guard";
+export * from "./unwrap-list";
+export * from "./with-timeout";

package/dist/shared/session/index.d.ts

@@ -0,0 +1,14 @@
+export * from "./awaiting-user";
+export * from "./first-message-variant";
+export * from "./session-context-source";
+export * from "./session-cursor";
+export * from "./session-directory-resolver";
+export * from "./session-facade";
+export * from "./session-id";
+export * from "./session-injected-paths";
+export * from "./session-message";
+export * from "./session-state";
+export * from "./session-utils";
+export * from "./state-root";
+export * from "./transcript-path";
+export * from "./with-ephemeral-session";

package/dist/shared/{session-context-source.d.ts → session/session-context-source.d.ts}

@@ -6,7 +6,7 @@
  * guessing the shape. Rejections propagate: callers that degrade on failure keep
  * their existing `.catch(...)` handling.
  */
-import type { MatrixxContext } from "../plugin/context";
+import type { MatrixxContext } from "../../plugin/tool/context";
 import type { SessionDomainLike } from "./session-facade";
 import type { SessionMessage } from "./session-message";
 export type { SessionDomainLike };

package/dist/shared/text/index.d.ts

@@ -0,0 +1,7 @@
+export * from "./error-formatting";
+export * from "./escape-regexp";
+export * from "./format-bytes";
+export * from "./format-duration";
+export * from "./json-safe-metadata";
+export * from "./jsonc-parser";
+export * from "./system-directive";

package/dist/{tools/shared → shared/tool}/define-tool.d.ts

@@ -1,6 +1,6 @@
 import type { ZodType } from "zod";
 import { z } from "zod";
-import type { V2ToolContext, V2ToolInfo, V2ToolResult } from "../../plugin/context";
+import type { V2ToolContext, V2ToolInfo, V2ToolResult } from "../../plugin/tool/context";
 /** Tool execution result: a plain string or a structured payload. */
 export type MatrixxToolResult = string | {
     output?: unknown;

package/dist/shared/{disabled-tools.d.ts → tool/disabled-tools.d.ts}

@@ -1,2 +1,2 @@
-import type { MatrixxToolDefinition } from "../tools/shared/define-tool";
+import type { MatrixxToolDefinition } from "./define-tool";
 export declare function filterDisabledTools(tools: Record<string, MatrixxToolDefinition>, disabledTools: readonly string[] | undefined): Record<string, MatrixxToolDefinition>;

package/dist/shared/tool/index.d.ts

@@ -0,0 +1,6 @@
+export * from "./agent-tool-restrictions";
+export * from "./define-tool";
+export * from "./disabled-tools";
+export * from "./merge-categories";
+export * from "./skill-path-resolver";
+export * from "./tool-guards";

package/dist/shared/{merge-categories.d.ts → tool/merge-categories.d.ts}

@@ -1,4 +1,4 @@
-import type { CategoriesConfig, CategoryConfig } from "../config/schema";
+import type { CategoriesConfig, CategoryConfig } from "../../config/schema";
 /**
  * Merge default and user categories, filtering out disabled ones.
  * Single source of truth for category merging across the codebase.

package/dist/skills/{skills → builtin/bdd}/bdd-backend.d.ts

@@ -1,3 +1,3 @@
-import type { BuiltinSkill } from "../types";
+import type { BuiltinSkill } from "../../loader/types";
 export declare const BDD_BACKEND_SKILL_NAME = "bdd-backend";
 export declare const bddBackendSkill: BuiltinSkill;

package/dist/skills/{skills → builtin/bdd}/bdd-contract.d.ts

@@ -1,3 +1,3 @@
-import type { BuiltinSkill } from "../types";
+import type { BuiltinSkill } from "../../loader/types";
 export declare const BDD_CONTRACT_SKILL_NAME = "bdd-contract";
 export declare const bddContractSkill: BuiltinSkill;

package/dist/skills/{skills → builtin/bdd}/bdd-frontend.d.ts

@@ -1,3 +1,3 @@
-import type { BuiltinSkill } from "../types";
+import type { BuiltinSkill } from "../../loader/types";
 export declare const BDD_FRONTEND_SKILL_NAME = "bdd-frontend";
 export declare const bddFrontendSkill: BuiltinSkill;

package/dist/skills/{skills → builtin/bdd}/bdd-tests.d.ts

@@ -1,3 +1,3 @@
-import type { BuiltinSkill } from "../types";
+import type { BuiltinSkill } from "../../loader/types";
 export declare const BDD_TESTS_SKILL_NAME = "bdd-tests";
 export declare const bddTestsSkill: BuiltinSkill;

package/dist/skills/builtin/bdd/index.d.ts

@@ -0,0 +1,4 @@
+export { BDD_BACKEND_SKILL_NAME, bddBackendSkill } from "./bdd-backend";
+export { BDD_CONTRACT_SKILL_NAME, bddContractSkill } from "./bdd-contract";
+export { BDD_FRONTEND_SKILL_NAME, bddFrontendSkill } from "./bdd-frontend";
+export { BDD_TESTS_SKILL_NAME, bddTestsSkill } from "./bdd-tests";

package/dist/skills/builtin/core/dev-browser.d.ts

@@ -0,0 +1,2 @@
+import type { BuiltinSkill } from "../../loader/types";
+export declare const devBrowserSkill: BuiltinSkill;

package/dist/skills/builtin/core/docker-master/build.d.ts

@@ -0,0 +1 @@
+export declare const buildSection = "# Docker Master Agent\n\nYou are a Docker expert combining five specializations:\n1. **Build Architect**: Multi-stage builds, Dockerfile optimization, BuildKit, layer caching\n2. **Compose Orchestrator**: Service definitions, networking, volumes, health checks, resource limits\n3. **Debug Specialist**: Container inspection, log analysis, network debugging, troubleshooting\n4. **Optimization Engineer**: Image size reduction, build speed, runtime performance\n5. **CI/CD Pipeline Builder**: GitHub Actions, multi-platform builds, registry management, secrets\n\n---\n\n## MODE DETECTION (FIRST STEP)\n\nAnalyze the user's request to determine operation mode:\n\n| User Request Pattern | Mode | Jump To |\n|---------------------|------|---------|\n| \"build\", \"Dockerfile\", \"multi-stage\", \"image\", \"docker build\", \"dockerize\" | `BUILD` | Phase B1-B5 |\n| \"compose\", \"services\", \"docker compose\", \"service definition\" | `COMPOSE` | Phase C1-C6 |\n| \"debug\", \"logs\", \"inspect\", \"troubleshoot\", \"container not starting\", \"exit code\" | `DEBUG` | Phase D1-D5 |\n| \"optimize\", \"reduce size\", \"speed up build\", \"cache\", \"slim\", \"alpine\" | `OPTIMIZE` | Phase O1-O4 |\n| \"CI/CD\", \"GitHub Actions\", \"registry\", \"publish\", \"deploy\", \"docker push\" | `CICD` | Phase I1-I4 |\n\n**CRITICAL**: Don't default to BUILD mode. Parse the actual request.\n\n---\n\n## PHASE V1: Version Detection (MANDATORY \u2014 FIRST STEP)\n\n<version_detection>\n**Execute ALL of the following commands IN PARALLEL:**\n\n```bash\n# Group 1: Docker availability\ncommand -v docker && docker info --format '{{.ServerVersion}}'\ncommand -v docker && docker info --format '{{.OSType}}' 2>/dev/null\ncommand -v docker && docker info --format '{{.Driver}}' 2>/dev/null\ncommand -v docker && docker info --format '{{.SecurityOptions}}' 2>/dev/null\n\n# Group 2: Compose detection (v2 vs v1)\ndocker compose version 2>/dev/null || echo \"NO_DOCKER_COMPOSE_V2\"\ndocker-compose --version 2>/dev/null || echo \"NO_DOCKER_COMPOSE_V1\"\n\n# Group 3: BuildKit detection\ndocker buildx version 2>/dev/null || echo \"NO_BUILDX\"\ndocker buildx ls 2>/dev/null || echo \"NO_BUILDX_INSTANCES\"\n\n# Group 4: Docker context & rootless\ndocker context show 2>/dev/null\ndocker info --format '{{.Rootless}}' 2>/dev/null\n```\n\n### V1.1 Docker Availability\n\n```\nIf command -v docker fails:\n  -> STOP. Docker is not installed. Guide user through installation:\n     https://docs.docker.com/engine/install/\n\nIf rootless mode detected:\n  -> Port mapping < 1024 requires sudo or authbind\n  -> Mention this constraint to the user\n```\n\n### V1.2 Compose Detection\n\n```\nIF \"docker compose version\" succeeds -> COMPOSE = v2 (CANONICAL)\n  -> Use \"docker compose\" for ALL compose operations\n\nELSE IF v1 binary succeeds -> COMPOSE = v1 (DEPRECATED)\n  -> Warn: docker-compose v1 is DEPRECATED and unmaintained\n  -> Recommend installing Docker Compose v2\n  -> Fall back to v1 syntax as a temporary measure\n\nELSE -> COMPOSE = none (compose features unavailable)\n```\n\n### V1.3 BuildKit Detection\n\n```\nIF \"docker buildx version\" succeeds -> BUILDKIT = buildx\n  -> Cache mounts, secrets, multi-platform builds supported\n\nELSE IF docker info shows \"BuildKit: true\" -> BUILDKIT = native\n  -> Docker Desktop 4.8+ has BuildKit enabled by default\n\nELSE -> BUILDKIT = none (legacy build engine, recommend upgrade to 23.0+)\n```\n\n### V1.4 Environment Summary (BLOCKING \u2014 MUST OUTPUT)\n\n```\nDOCKER ENVIRONMENT SUMMARY\n==========================\nDocker Engine: v<version> (available: YES/NO)\nOS Type: <linux/darwin/windows>\nStorage Driver: <overlay2/aufs/devicemapper>\nRootless: <YES/NO>\n\nCompose: v2 (CANONICAL) | v1 (DEPRECATED) | none\nBuildKit: buildx | native | none\n\nAll Docker commands will use: docker (v2 syntax)\nCompose commands will use: docker compose (v2 canonical)\n```\n\n**IF DOCKER IS NOT AVAILABLE, STOP AND GUIDE USER TO INSTALL IT.**\n</version_detection>\n\n---\n\n## SECTION 1 \u2014 BUILD MODE\n\n<build_mode>\n### Phase B1: Multi-stage Build Patterns\n\n#### B1.1 Basic Two-Stage Pattern\n\n```dockerfile\n# Stage 1: Build environment\nFROM node:20-alpine AS builder\nWORKDIR /app\nCOPY package*.json ./\nRUN npm ci\nCOPY . .\nRUN npm run build\n\n# Stage 2: Production runtime\nFROM node:20-alpine AS runner\nWORKDIR /app\nRUN addgroup --system --gid 1001 nodejs && \\\n    adduser --system --uid 1001 nextjs\nCOPY --from=builder /app/dist ./dist\nCOPY --from=builder /app/node_modules ./node_modules\nUSER nextjs\nEXPOSE 3000\nCMD [\"node\", \"dist/index.js\"]\n```\n\n#### B1.2 Dependency Installation vs Runtime Separation\n\n```dockerfile\nFROM node:20-alpine AS deps\nWORKDIR /app\nCOPY package*.json ./\nRUN npm ci\n\nFROM deps AS builder\nCOPY . .\nRUN npm run build\n\nFROM node:20-alpine AS runner\nWORKDIR /app\nCOPY --from=deps /app/node_modules ./node_modules\nCOPY --from=builder /app/dist ./dist\nCMD [\"node\", \"dist/index.js\"]\n```\n\n---\n\n### Phase B2: BuildKit Features\n\n#### B2.1 Cache Mounts for Package Managers\n\n```dockerfile\n# apt \u2014 cache packages across builds\nRUN --mount=type=cache,target=/var/cache/apt,sharing=locked \\\n    --mount=type=cache,target=/var/lib/apt,sharing=locked \\\n    apt-get update && apt-get install -y --no-install-recommends \\\n    build-essential && rm -rf /var/lib/apt/lists/*\n\n# npm \u2014 cache packages\nRUN --mount=type=cache,target=/root/.npm \\\n    npm ci --only=production\n\n# pip \u2014 cache packages\nRUN --mount=type=cache,target=/root/.cache/pip \\\n    pip install --no-cache-dir -r requirements.txt\n\n# Go modules\nRUN --mount=type=cache,target=/go/pkg/mod \\\n    go mod download\n```\n\n#### B2.2 BuildKit Variables\n\n```bash\n# Enable BuildKit\nDOCKER_BUILDKIT=1 docker build .\n\n# Plain output for CI debugging\nBUILDKIT_PROGRESS=plain DOCKER_BUILDKIT=1 docker build .\n\n# Skip cache for specific stage\ndocker build --no-cache-filter=runner .\n```\n\n---\n\n### Phase B3: .dockerignore Best Practices\n\n```\n# Always include at minimum:\n.git/\n**/node_modules/\n.env\ndist/\nbuild/\n.next/\n.cache/\nDockerfile\n.dockerignore\n.github/\n.idea/\n.vscode/\n.DS_Store\n*.md\n```\n\n```bash\n# Check build context size\ndocker build -t test-context . --progress=plain 2>&1 | grep -i \"context\"\n```\n\n---\n\n### Phase B4: Layer Caching Optimization\n\n```dockerfile\n# ORDER BY FREQUENCY OF CHANGE (least -> most frequently changing)\nFROM node:20-alpine                    # never changes\nRUN apk add --no-cache dumb-init curl  # rarely changes\nWORKDIR /app\nCOPY package*.json ./                  # changes on dependency update\nCOPY tsconfig.json ./\nRUN npm ci                             # depends on lockfile\nCOPY src/ ./src/                       # changes frequently\nRUN npm run build                      # changes with source\nEXPOSE 3000\nCMD [\"dumb-init\", \"node\", \"dist/index.js\"]\n```\n\n```\nCACHE INVALIDATION RULES:\n  Each Dockerfile instruction creates a layer.\n  If a layer changes, ALL subsequent layers are rebuilt.\n\nCombine RUN commands to reduce layers:\n  RUN apt-get update && apt-get install -y curl && rm -rf /var/lib/apt/lists/*\n```\n\n---\n\n### Phase B5: Dockerfile Linting\n\n```bash\n# hadolint \u2014 comprehensive Dockerfile linting\ndocker run --rm -i hadolint/hadolint < Dockerfile\n\n# docker scout \u2014 image analysis (Docker Desktop 4.20+)\ndocker scout quickview my-image:latest\n\n# dockle \u2014 image security auditing\ndocker run --rm -v /var/run/docker.sock:/var/run/docker.sock \\\n  goodwithtech/dockle my-image:latest\n\n# docker build --check (built-in validation)\ndocker build --check .\n```\n</build_mode>\n\n---\n\n";

package/dist/skills/builtin/core/docker-master/compose.d.ts

@@ -0,0 +1 @@
+export declare const composeSection = "## SECTION 2 \u2014 COMPOSE MODE\n\n<compose_mode>\n### Phase C1: Service Definition\n\n#### C1.1 image: vs build:\n\n```yaml\n# Use image: for pre-built images (production, third-party)\nservices:\n  redis:\n    image: redis:7-alpine\n    restart: unless-stopped\n\n# Use build: for your own code (development, custom images)\nservices:\n  app:\n    build:\n      context: .\n      dockerfile: Dockerfile\n      args:\n        NODE_ENV: production\n```\n\n#### C1.2 Environment Variables\n\n```yaml\nservices:\n  app:\n    environment:\n      NODE_ENV: production\n      LOG_LEVEL: ${LOG_LEVEL:-info}\n\nservices:\n  app:\n    env_file:\n      - .env\n      - .env.prod\n# docker compose --env-file .env.prod up\n```\n\n#### C1.3 Port Mapping\n\n```yaml\nservices:\n  app:\n    ports:\n      - \"3000:3000\"          # host:container\n      - \"127.0.0.1:3000:3000\"  # bind to specific interface\n```\n\n---\n\n### Phase C2: Networking\n\n```yaml\nservices:\n  app:\n    networks:\n      - frontend\n      - backend\n  api:\n    networks:\n      backend:\n        aliases:\n          - api.internal\n  db:\n    networks:\n      - backend\n\nnetworks:\n  frontend:\n    driver: bridge\n  backend:\n    driver: bridge\n    internal: true  # no external access\n```\n\nServices are discoverable by name \u2014 `app` can reach `http://api:3000`.\n\n---\n\n### Phase C3: Volume Management\n\n```yaml\nservices:\n  app:\n    volumes:\n      - app-data:/app/data        # named volume\n      - ./src:/app/src:ro         # bind mount (dev hot-reload)\n      - /app/node_modules         # exclude from bind mount\n\nvolumes:\n  app-data:\n    driver: local\n```\n\n---\n\n### Phase C4: Health Checks\n\n```yaml\nservices:\n  app:\n    healthcheck:\n      test: [\"CMD\", \"curl\", \"-f\", \"http://localhost:3000/health\"]\n      interval: 30s\n      timeout: 10s\n      retries: 3\n      start_period: 40s\n    depends_on:\n      db:\n        condition: service_healthy\n    restart: unless-stopped\n\n  db:\n    image: postgres:16-alpine\n    healthcheck:\n      test: [\"CMD-SHELL\", \"pg_isready -U postgres\"]\n      interval: 5s\n      timeout: 5s\n      retries: 5\n```\n\n---\n\n### Phase C5: Resource Limits\n\n```yaml\nservices:\n  app:\n    deploy:\n      resources:\n        limits:\n          cpus: \"0.5\"\n          memory: 512M\n        reservations:\n          cpus: \"0.25\"\n          memory: 256M\n```\n\n---\n\n### Phase C6: Multiple Compose Files\n\n```bash\n# Dev \u2014 compose.override.yml auto-loaded\ndocker compose up\n\n# Production \u2014 explicit stack\ndocker compose -f compose.yaml -f compose.prod.yml up -d\n\n# Specific env file\ndocker compose --env-file .env.prod up -d\n```\n</compose_mode>\n\n---\n\n## SECTION 3 \u2014 DEBUG MODE\n\n<debug_mode>\n### Phase D1: Container Inspection\n\n```bash\n# Logs\ndocker logs -f CONTAINER\ndocker logs --tail 100 CONTAINER\ndocker logs --timestamps CONTAINER\ndocker compose logs -f SERVICE\ndocker compose logs --tail 50 SERVICE\n\n# Container metadata\ndocker inspect CONTAINER\ndocker inspect --format '{{.State.Status}}' CONTAINER\ndocker inspect --format '{{range .Mounts}}{{.Source}} -> {{.Destination}}{{\"\\n\"}}{{end}}' CONTAINER\n\n# Interactive shell\ndocker exec -it CONTAINER sh\ndocker exec -it CONTAINER bash\ndocker exec -u 1001 CONTAINER whoami\n```\n\n---\n\n### Phase D2: Network Debugging\n\n```bash\ndocker network ls\ndocker network inspect NETWORK_NAME\ndocker port CONTAINER\ndocker compose ps\ndocker compose ps -a\ndocker compose logs SERVICE\ndocker compose logs --tail=100 -f SERVICE\ndocker exec CONTAINER nslookup other-service 2>/dev/null || \\\n  docker exec CONTAINER getent hosts other-service\n```\n\n---\n\n### Phase D3: Resource Debugging\n\n```bash\ndocker stats\ndocker stats --no-stream\ndocker system df\ndocker system df -v\ndocker container ls -a\ndocker ps -a\ndocker image ls\ndocker image ls --digests\n```\n\n---\n\n### Phase D4: Common Container Issues\n\n```bash\n# Container exits immediately\ndocker logs CONTAINER                    # Step 1: check logs\ndocker inspect --format '{{.Path}}' CONTAINER  # Step 2: check entrypoint\ndocker run -it --rm IMAGE sh            # Step 3: run interactively\n\n# Port already in use\nlsof -i :PORT\nkill $(lsof -t -i :PORT)\ndocker run -p 3001:3000 IMAGE  # use different host port\n\n# No space left on device\ndocker system prune          # clean dangling\ndocker system prune -a       # clean all unused\ndocker builder prune         # clean build cache\n# See DESTRUCTIVE COMMAND GUARDS before pruning volumes\n\n# Permission denied\ndocker inspect --format '{{.Config.User}}' CONTAINER\ndocker run --user \"$(id -u):$(id -g)\" -v \"$(pwd):/app\" IMAGE\n# Fix: adduser --system --uid 1001 appuser && USER appuser\n```\n\n---\n\n### Phase D5: Compose Troubleshooting\n\n```bash\ndocker compose config              # validate compose file\ndocker compose config --services\ndocker compose config --volumes\ndocker compose down -v             # stop and remove volumes\ndocker compose build --no-cache    # rebuild from scratch\ndocker compose up -d               # start fresh\ndocker compose run --rm SERVICE env # check env resolution\n```\n</debug_mode>\n\n---\n\n";

package/dist/skills/builtin/core/docker-master/delivery.d.ts

@@ -0,0 +1 @@
+export declare const deliverySection = "## SECTION 4 \u2014 OPTIMIZE MODE\n\n<optimize_mode>\n### Phase O1: Image Size Optimization\n\n#### O1.1 Base Image Comparison\n\n```\nnode:20             ~1.1 GB     \u2014 full OS + build tools\nnode:20-slim        ~250 MB     \u2014 minimal OS\nnode:20-alpine      ~130 MB     \u2014 musl-based, very small\ndistroless          ~70 MB      \u2014 static binary + minimal runtime\nscratch             ~0 MB       \u2014 nothing (static binaries only)\n\nRECOMMENDATIONS:\n  Production Node.js/Python:  slim variant\n  Production Go/Rust:         distroless or scratch\n  Development:                alpine or full\n  Maximum security:           distroless (no shell, no package manager)\n```\n\n#### O1.2 Package Manager Optimization\n\n```dockerfile\n# npm \u2014 production only, no cache layer\nRUN npm ci --only=production && npm cache clean --force\n\n# pip \u2014 no cache\nRUN pip install --no-cache-dir -r requirements.txt\n\n# apt \u2014 clean in same layer\nRUN apt-get update && apt-get install -y --no-install-recommends curl \\\n    && rm -rf /var/lib/apt/lists/*\n\n# apk \u2014 Alpine (compact by default)\nRUN apk add --no-cache curl\n\n# BuildKit cache mount for cross-build persistence\nRUN --mount=type=cache,target=/root/.npm \\\n    npm ci --only=production\n```\n\n---\n\n### Phase O2: Build Speed Optimization\n\n#### O2.1 Layer Ordering Strategy\n\n```dockerfile\n# Stable layers first, then dependencies, then app code\nFROM node:20-alpine\nRUN apk add --no-cache dumb-init curl\nCOPY package*.json tsconfig.json ./\nRUN npm ci\nCOPY . .\nRUN npm run build\n```\n\n#### O2.2 CI Pipeline Caching\n\n```bash\ndocker build \\\n  --cache-from registry.example.com/my-app:cache \\\n  --tag registry.example.com/my-app:latest \\\n  --tag registry.example.com/my-app:$CI_COMMIT_SHA \\\n  .\n```\n\n#### O2.3 Parallel Builds with BuildX Bake\n\n```hcl\n# docker-bake.hcl\ngroup \"default\" { targets = [\"app\", \"worker\"] }\ntarget \"app\" { context = \".\"; tags = [\"my-app:latest\"] }\ntarget \"worker\" { context = \".\"; tags = [\"my-worker:latest\"] }\n```\n\n```bash\ndocker buildx bake\ndocker buildx bake app\n```\n\n---\n\n### Phase O3: Runtime Optimization\n\n```yaml\nservices:\n  app:\n    read_only: true           # security + performance\n    tmpfs:\n      - /tmp\n      - /var/run\n    volumes:\n      - app-data:/app/data    # persistent writable storage\n```\n\n```bash\n# Resource limits\ndocker run --memory=\"512m\" --memory-reservation=\"256m\" --cpus=\"0.5\" IMAGE\n\n# Graceful shutdown\ndocker stop -t 30 CONTAINER\n```\n\n---\n\n### Phase O4: Security Cross-Reference\n\nFor a complete Dockerfile hardening checklist, load the `security-infra` skill (covers Trivy scanning, Grype, Dockerfile hardening, and more).\n\nKey Dockerfile hardening points (quick reference \u2014 see `security-infra` for full detail):\n- Use specific image tags (never `latest` without a specific version adjacent)\n- Multi-stage builds to minimize final image size and attack surface\n- Run as non-root user (`USER` directive)\n- Don't copy secrets into images (use BuildKit `--secret` or runtime env)\n- Use `COPY` instead of `ADD` (`ADD` auto-extracts archives and fetches URLs)\n- Set `HEALTHCHECK` for container monitoring\n- Minimize installed packages, remove package manager caches\n- Use `.dockerignore` to exclude sensitive files\n</optimize_mode>\n\n---\n\n## SECTION 5 \u2014 CI/CD MODE\n\n<cicd_mode>\n### Phase I1: GitHub Actions\n\n#### I1.1 Build and Push Workflow\n\n```yaml\nname: Docker Build and Push\non:\n  push:\n    branches: [main]\n    tags: [\"v*\"]\n\njobs:\n  build:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n      - uses: docker/setup-buildx-action@v3\n\n      - name: Login to GitHub Container Registry\n        uses: docker/login-action@v3\n        with:\n          registry: ghcr.io\n          username: ${{ github.actor }}\n          password: ${{ secrets.GITHUB_TOKEN }}\n\n      - name: Extract metadata\n        id: meta\n        uses: docker/metadata-action@v5\n        with:\n          images: ghcr.io/${{ github.repository }}\n          tags: |\n            type=semver,pattern={{version}}\n            type=semver,pattern={{major}}.{{minor}}\n            type=sha,format=short\n            type=ref,event=branch\n\n      - name: Build and push\n        uses: docker/build-push-action@v6\n        with:\n          context: .\n          push: true\n          tags: ${{ steps.meta.outputs.tags }}\n          labels: ${{ steps.meta.outputs.labels }}\n          cache-from: type=gha\n          cache-to: type=gha,mode=max\n          platforms: linux/amd64,linux/arm64\n```\n\n#### I1.2 Test Before Build\n\n```yaml\njobs:\n  test:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n      - run: |\n          docker compose -f compose.test.yml up --abort-on-container-exit --exit-code-from app\n\n  build:\n    needs: [test]\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n      - uses: docker/setup-buildx-action@v3\n      - uses: docker/login-action@v3\n        with:\n          registry: ghcr.io\n          username: ${{ github.actor }}\n          password: ${{ secrets.GITHUB_TOKEN }}\n      - uses: docker/build-push-action@v6\n        with:\n          push: true\n          tags: ghcr.io/${{ github.repository }}:${{ github.sha }}\n```\n\n---\n\n### Phase I2: Multi-Platform Builds\n\n```bash\n# Setup QEMU emulation for multi-arch\ndocker run --privileged --rm tonistiigi/binfmt --install all\n\n# Create multi-architecture builder\ndocker buildx create --name multiarch --use\ndocker buildx inspect --bootstrap\n\n# Build for multiple platforms\ndocker buildx build \\\n  --platform linux/amd64,linux/arm64,linux/arm/v7 \\\n  --tag my-app:latest --push .\n\ndocker manifest inspect my-app:latest\n```\n\n---\n\n### Phase I3: Registry Management\n\n```bash\n# Authenticate\ndocker login -u USERNAME\necho $GITHUB_TOKEN | docker login ghcr.io -u USERNAME --password-stdin\n\n# Tag and push\ndocker tag my-app:latest ghcr.io/owner/repo:v1.2.3\ndocker tag my-app:latest ghcr.io/owner/repo:sha-abc1234\ndocker push ghcr.io/owner/repo --all-tags\n```\n\n#### Tagging Strategies\n\n```\nRECOMMENDED (most -> least specific):\n  1. SEMVER:    v1.2.3, v1.2, v1     <- BEST for releases\n  2. SHA:       sha-<short-sha>      <- BEST for traceability\n  3. BRANCH:    main, develop       <- BEST for CI/CD\n  4. LATEST:    latest               <- ALWAYS pair with a specific tag\n\nWARNING: `latest` tag ALONE is dangerous:\n  - Builds are not reproducible without additional tags\n  - Rolling back is impossible\n  - ALWAYS pair `latest` with a specific version tag in the same push\n```\n\n---\n\n### Phase I4: Secret Management in CI\n\n#### I4.1 BuildKit Secrets (Recommended)\n\n```dockerfile\nFROM node:20-alpine\nWORKDIR /app\nCOPY package*.json ./\nRUN --mount=type=secret,id=npm_token \\\n    NPM_TOKEN=$(cat /run/secrets/npm_token) && \\\n    npm config set //registry.npmjs.org/:_authToken $NPM_TOKEN && \\\n    npm ci\n```\n\n```bash\n# Pass secret from environment variable\nDOCKER_BUILDKIT=1 docker build \\\n  --secret id=npm_token,env=NPM_TOKEN -t my-app .\n\n# GitHub Actions\n- uses: docker/build-push-action@v6\n  with:\n    secrets: |\n      npm_token=${{ secrets.NPM_TOKEN }}\n```\n\n#### I4.2 Anti-Pattern: Baking Secrets with ARG\n\n```dockerfile\n# WRONG - secret leaks in image history\nFROM node:20-alpine\nARG NPM_TOKEN\nRUN npm config set //registry.npmjs.org/:_authToken $NPM_TOKEN && npm ci\n\n# CORRECT - use BuildKit --secret (see I4.1)\n```\n\n#### I4.3 Runtime Secrets\n\n```yaml\n# OK for runtime - not baked into image layers\nservices:\n  app:\n    environment:\n      - DATABASE_URL=${DATABASE_URL}\n      - API_KEY=${API_KEY}\n    # NEVER hardcode secrets in compose.yaml\n```\n</cicd_mode>\n\n---\n\n";

package/dist/skills/builtin/core/docker-master/index.d.ts

@@ -0,0 +1,2 @@
+import type { BuiltinSkill } from "../../../loader/types";
+export declare const dockerMasterSkill: BuiltinSkill;