openpond 0.0.36 → 0.0.37

package/dist/chunks/{chunk-7IPF4X3K.js → chunk-MHBQWGCL.js}

@@ -5,7 +5,7 @@ import {
   SandboxTemplateManifestSchema,
   SandboxTemplateValidationDiagnosticSchema,
   validateConnectedAppToolCallRequest
-} from "./chunk-LHYK6QO2.js";
+} from "./chunk-XEJ7XXUQ.js";
 import {
   external_exports,
   yaml
@@ -113,7 +113,9 @@ async function readProfileSkill(input) {
     path: skill.path,
     sourcePath: skill.sourcePath,
     sourceHash: skill.sourceHash,
-    charCount: skill.charCount
+    charCount: skill.charCount,
+    packagePath: path.dirname(absolutePath),
+    resourceFiles: skill.resourceFiles
   };
 }
 function emptyProfileSkillCatalogState(input = {}) {
@@ -128,12 +130,8 @@ async function loadProfileSkillDirectory(profileSourcePath2, directoryName) {
   const relativePath = path.join(PROFILE_SKILLS_DIR, directoryName, PROFILE_SKILL_FILE).replace(/\\/g, "/");
   const absolutePath = path.join(profileSourcePath2, relativePath);
   const messages = [];
-  const entries = await readdir(path.join(profileSourcePath2, PROFILE_SKILLS_DIR, directoryName), { withFileTypes: true });
-  for (const entry of entries) {
-    if (entry.name === PROFILE_SKILL_FILE && entry.isFile())
-      continue;
-    messages.push(`Profile skills only support ${PROFILE_SKILL_FILE}; unsupported entry: ${entry.name}`);
-  }
+  const packageRoot = path.join(profileSourcePath2, PROFILE_SKILLS_DIR, directoryName);
+  const packageFiles = await listPackageFiles(packageRoot);
   let contents = "";
   if (!existsSync(absolutePath)) {
     messages.push(`Missing ${PROFILE_SKILL_FILE}.`);
@@ -163,9 +161,26 @@ async function loadProfileSkillDirectory(profileSourcePath2, directoryName) {
     charCount: contents.length,
     sourceHash: sha256Hex(contents),
     validationStatus: messages.length > 0 ? "error" : "valid",
-    validationMessages: messages
+    validationMessages: messages,
+    resourceFiles: packageFiles.filter((file) => file !== PROFILE_SKILL_FILE)
   };
 }
+async function listPackageFiles(root) {
+  const files = [];
+  async function visit(directory, prefix) {
+    const entries = await readdir(directory, { withFileTypes: true });
+    await Promise.all(entries.map(async (entry) => {
+      const relativePath = prefix ? `${prefix}/${entry.name}` : entry.name;
+      if (entry.isDirectory()) {
+        await visit(path.join(directory, entry.name), relativePath);
+      } else if (entry.isFile()) {
+        files.push(relativePath);
+      }
+    }));
+  }
+  await visit(root, "");
+  return files.sort();
+}
 function markDuplicateSkillNames(skills) {
   const counts = /* @__PURE__ */ new Map();
   for (const skill of skills) {
@@ -185,10 +200,14 @@ function markDuplicateSkillNames(skills) {
 async function latestSkillMtime(profileSourcePath2, skills) {
   let latest = 0;
   for (const skill of skills) {
-    const fileStat = await stat(path.join(profileSourcePath2, skill.path)).catch(() => null);
-    if (!fileStat?.isFile())
-      continue;
-    latest = Math.max(latest, fileStat.mtimeMs);
+    const packageRoot = path.dirname(path.join(profileSourcePath2, skill.path));
+    const packageFiles = [PROFILE_SKILL_FILE, ...skill.resourceFiles];
+    for (const file of packageFiles) {
+      const fileStat = await stat(path.join(packageRoot, file)).catch(() => null);
+      if (!fileStat?.isFile())
+        continue;
+      latest = Math.max(latest, fileStat.mtimeMs);
+    }
   }
   return latest > 0 ? new Date(latest).toISOString() : null;
 }
@@ -2899,11 +2918,11 @@ function parseProfileSkillCommand(prompt) {
     if (subcommand === "create") {
       if (!args)
         return { action: "help" };
-      const named = splitOptionalSkillName(args);
+      const named2 = splitOptionalSkillName(args);
       return {
         action: "create",
-        objective: named.objective,
-        requestedName: named.name
+        objective: named2.objective,
+        requestedName: named2.name
       };
     }
     if (subcommand === "edit") {
@@ -2914,7 +2933,12 @@ function parseProfileSkillCommand(prompt) {
         return { action: "help" };
       return { action: "edit", name, changeRequest };
     }
-    return { action: "help" };
+    const named = splitOptionalSkillName(rest);
+    return {
+      action: "create",
+      objective: named.objective,
+      requestedName: named.name
+    };
   }
   return null;
 }
@@ -2931,7 +2955,7 @@ function profileSkillHelp(profile) {
       "- /skill create --name <skill-name> <what the skill should help with>",
       "- /skill edit <skill-name> <change request>",
       "",
-      "Create/edit starts a profile-skill goal in the active profile repo. Skills are single-file profile instructions. If the workflow needs scripts, references, tools, or assets, create an agent instead."
+      "Create/edit starts a profile-skill goal in the active profile repo. Skills may include SKILL.md plus focused scripts, references, and assets. Use an agent when the workflow needs durable autonomy, schedules, identity, or its own model loop."
     ].join("\n")
   };
 }
@@ -3053,10 +3077,11 @@ function profileSkillGoalPrompt(goal) {
     "",
     "Rules:",
     modeLine,
-    "- Keep the skill package single-file: only SKILL.md.",
+    "- Keep SKILL.md as the required entry point. Add only scripts, references, assets, or agents/openai.yaml that directly support the workflow.",
     "- SKILL.md must include YAML frontmatter with required name and description fields, followed by a markdown body.",
     "- The body should describe the reusable workflow clearly enough for future chats to apply it.",
-    "- Do not add references, scripts, assets, tool dependencies, or setup files. If those are needed, explain that this should be an agent instead.",
+    "- Use scripts for deterministic repeated operations, references for detailed knowledge, and assets for files consumed by outputs.",
+    "- Do not add README, changelog, installation guide, or other auxiliary documentation.",
     "- Validate the resulting file by reading it back and checking name, description, body, and path consistency.",
     "- Report the final skill name, path, validation status, and explicit invocation such as $skill-name only after the file is written or updated.",
     "- Ask only for missing details that materially change the skill.",
@@ -3543,13 +3568,13 @@ function createSandboxRuntimeHandle(client, runtimeId, initial = null) {
     keepAlive,
     checkpoint: (input) => client.checkpointSandboxRuntime(runtimeId, input),
     files: {
-      write: async (path11, contents) => client.uploadFile((await resume()).id, path11, contents),
-      read: async (path11) => client.downloadFile((await resume()).id, path11),
+      write: async (path13, contents) => client.uploadFile((await resume()).id, path13, contents),
+      read: async (path13) => client.downloadFile((await resume()).id, path13),
       readResponse: async (input) => client.downloadFileResponse((await resume()).id, input),
       list: async (input = {}) => client.listFiles((await resume()).id, input),
-      delete: async (path11, input = {}) => client.deleteFile((await resume()).id, path11, input),
+      delete: async (path13, input = {}) => client.deleteFile((await resume()).id, path13, input),
       search: async (input) => client.searchFiles((await resume()).id, input),
-      stat: async (path11) => client.statFile((await resume()).id, path11),
+      stat: async (path13) => client.statFile((await resume()).id, path13),
       mkdir: async (input) => client.mkdir((await resume()).id, input),
       move: async (input) => client.moveFile((await resume()).id, input)
     },
@@ -4053,20 +4078,20 @@ var OpenPondSandboxInstanceClient = class {
       path: `/${encodeURIComponent(sandboxId)}/pty/${encodeURIComponent(ptyId)}/stream${query.size > 0 ? `?${query.toString()}` : ""}`
     });
   }
-  uploadFile(sandboxId, path11, contents) {
-    return this.uploadFileBase64(sandboxId, path11, Buffer.from(contents, "utf-8").toString("base64"));
+  uploadFile(sandboxId, path13, contents) {
+    return this.uploadFileBase64(sandboxId, path13, Buffer.from(contents, "utf-8").toString("base64"));
   }
-  uploadFileBase64(sandboxId, path11, contentsBase64) {
+  uploadFileBase64(sandboxId, path13, contentsBase64) {
     return this.request(`/${encodeURIComponent(sandboxId)}/files`, {
       method: "POST",
       body: JSON.stringify({
-        path: path11,
+        path: path13,
         contentsBase64
       })
     });
   }
-  async downloadFile(sandboxId, path11) {
-    const payload = await this.downloadFileResponse(sandboxId, path11);
+  async downloadFile(sandboxId, path13) {
+    const payload = await this.downloadFileResponse(sandboxId, path13);
     return Buffer.from(payload.file.contentsBase64, "base64").toString("utf-8");
   }
   downloadFileResponse(sandboxId, input) {
@@ -4090,16 +4115,16 @@ var OpenPondSandboxInstanceClient = class {
       query.set("maxEntries", String(input.maxEntries));
     return this.request(`/${encodeURIComponent(sandboxId)}/files?${query.toString()}`);
   }
-  deleteFile(sandboxId, path11, input = {}) {
-    const query = new URLSearchParams({ path: path11 });
+  deleteFile(sandboxId, path13, input = {}) {
+    const query = new URLSearchParams({ path: path13 });
     if (input.recursive !== void 0)
       query.set("recursive", String(input.recursive));
     return this.request(`/${encodeURIComponent(sandboxId)}/files?${query.toString()}`, {
       method: "DELETE"
     });
   }
-  statFile(sandboxId, path11) {
-    const query = new URLSearchParams({ stat: "1", path: path11 });
+  statFile(sandboxId, path13) {
+    const query = new URLSearchParams({ stat: "1", path: path13 });
     return this.request(`/${encodeURIComponent(sandboxId)}/files?${query.toString()}`);
   }
   mkdir(sandboxId, input) {
@@ -4275,12 +4300,12 @@ var OpenPondSandboxInstanceClient = class {
       body: JSON.stringify({ leaseId })
     });
   }
-  async request(path11, init = {}) {
-    const response = await apiFetch(this.sandboxApiUrl, this.apiKey, path11, init);
+  async request(path13, init = {}) {
+    const response = await apiFetch(this.sandboxApiUrl, this.apiKey, path13, init);
     return readApiJson(response, "Sandbox request");
   }
-  async requestApiRoot(path11, init = {}) {
-    const response = await apiFetch(this.apiRootUrl, this.apiKey, path11, init);
+  async requestApiRoot(path13, init = {}) {
+    const response = await apiFetch(this.apiRootUrl, this.apiKey, path13, init);
     return readApiJson(response, "OpenPond API request");
   }
 };
@@ -5019,8 +5044,841 @@ function responsePayloadData(payload) {
   return null;
 }
 
+// ../../packages/cloud/dist/extensions/types.js
+var GithubExtensionError = class extends Error {
+  code;
+  status;
+  constructor(message, options) {
+    super(message);
+    this.name = "GithubExtensionError";
+    this.code = options.code;
+    this.status = options.status ?? 400;
+  }
+};
+
+// ../../packages/cloud/dist/extensions/github-source.js
+import { createHash as createHash3 } from "node:crypto";
+import path10 from "node:path";
+var DEFAULT_REF = "HEAD";
+var MAX_EXTENSION_SKILLS = 64;
+var MAX_EXTENSION_FILES = 512;
+var MAX_EXTENSION_BYTES = 20 * 1024 * 1024;
+var MAX_EXTENSION_FILE_BYTES = 5 * 1024 * 1024;
+var DOWNLOAD_CONCURRENCY = 8;
+var SKILL_NAME_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+var GITHUB_REPOSITORY_PATTERN = /^[A-Za-z0-9_.-]+$/;
+var ROOT_SKILL_RESOURCE_DIRECTORIES = /* @__PURE__ */ new Set(["agents", "assets", "references", "scripts"]);
+function createGithubSourceClient(options = {}) {
+  const fetchImpl = options.fetch ?? fetch;
+  const githubToken = options.githubToken?.trim() || process.env.GITHUB_TOKEN?.trim() || process.env.GH_TOKEN?.trim() || null;
+  return {
+    async resolve(request) {
+      const source = await resolveSource(request, fetchImpl, githubToken);
+      const preview = await buildPreview(source, fetchImpl, githubToken);
+      return {
+        preview,
+        files: filesToDownload(source)
+      };
+    },
+    async download(resolution, writeFile5) {
+      await downloadFiles({
+        resolution,
+        fetchImpl,
+        githubToken,
+        writeFile: writeFile5
+      });
+    }
+  };
+}
+function parseGithubExtensionSource(source) {
+  const trimmed = source.trim();
+  let owner = "";
+  let repo = "";
+  if (/^(?:https?:\/\/)?github\.com\//i.test(trimmed)) {
+    const url = new URL(trimmed.startsWith("http") ? trimmed : `https://${trimmed}`);
+    if (url.hostname.toLowerCase() !== "github.com") {
+      throw invalidSource(source);
+    }
+    const segments = url.pathname.replace(/^\/+|\/+$/g, "").split("/");
+    if (segments.length !== 2)
+      throw invalidSource(source);
+    [owner = "", repo = ""] = segments;
+  } else {
+    const normalized = trimmed.replace(/^github:/i, "").replace(/^\/+|\/+$/g, "");
+    const segments = normalized.split("/");
+    if (segments.length !== 2)
+      throw invalidSource(source);
+    [owner = "", repo = ""] = segments;
+  }
+  repo = repo.replace(/\.git$/i, "");
+  if (!GITHUB_REPOSITORY_PATTERN.test(owner) || !GITHUB_REPOSITORY_PATTERN.test(repo)) {
+    throw invalidSource(source);
+  }
+  const normalizedOwner = owner.toLowerCase();
+  const normalizedRepo = repo.toLowerCase();
+  return {
+    id: `github:${normalizedOwner}/${normalizedRepo}`,
+    owner: normalizedOwner,
+    repo: normalizedRepo,
+    repositoryUrl: `https://github.com/${normalizedOwner}/${normalizedRepo}`
+  };
+}
+async function resolveSource(request, fetchImpl, githubToken) {
+  const identity = parseGithubExtensionSource(request.source);
+  const requestedRef = request.ref?.trim() || DEFAULT_REF;
+  const repository = await githubJson(fetchImpl, githubToken, `/repos/${identity.owner}/${identity.repo}`);
+  const resolvedRef = requestedRef === DEFAULT_REF ? repository.default_branch?.trim() || "main" : requestedRef;
+  const commit = await githubJson(fetchImpl, githubToken, `/repos/${identity.owner}/${identity.repo}/commits/${encodeURIComponent(resolvedRef)}`);
+  const resolvedCommit = commit.sha?.trim();
+  const treeSha = commit.commit?.tree?.sha?.trim();
+  if (!resolvedCommit || !treeSha) {
+    throw new GithubExtensionError("GitHub returned an incomplete commit response.", {
+      code: "github_invalid_commit",
+      status: 502
+    });
+  }
+  const treePayload = await githubJson(fetchImpl, githubToken, `/repos/${identity.owner}/${identity.repo}/git/trees/${treeSha}?recursive=1`);
+  if (treePayload.truncated) {
+    throw new GithubExtensionError("The GitHub repository tree is too large to install safely.", {
+      code: "github_tree_truncated"
+    });
+  }
+  const tree = (treePayload.tree ?? []).filter(validTreeEntry);
+  const skillPackages = discoverSkillPackages(tree);
+  if (skillPackages.length === 0) {
+    throw new GithubExtensionError("No skills found. Add SKILL.md at the repository root or use a standard agent skills directory.", { code: "extension_no_skills" });
+  }
+  if (skillPackages.length > MAX_EXTENSION_SKILLS) {
+    throw new GithubExtensionError(`Extension contains more than ${MAX_EXTENSION_SKILLS} skills.`, {
+      code: "extension_too_many_skills"
+    });
+  }
+  validateDownloadLimits(skillPackages);
+  const readme = tree.find((entry) => entry.type === "blob" && /^readme(?:\.[^/]+)?$/i.test(entry.path)) ?? null;
+  return { identity, requestedRef, resolvedCommit, tree, skillPackages, readme };
+}
+async function buildPreview(source, fetchImpl, githubToken) {
+  const skills = await mapConcurrent(source.skillPackages, DOWNLOAD_CONCURRENCY, async (skillPackage) => {
+    const contents = await downloadText(source, skillPackage.entry, fetchImpl, githubToken);
+    return previewSkill(skillPackage, contents);
+  });
+  const duplicateNames = duplicateValues(skills.map((skill) => skill.name));
+  for (const skill of skills) {
+    if (!duplicateNames.has(skill.name))
+      continue;
+    skill.validationStatus = "error";
+    skill.validationMessages = [...skill.validationMessages, `Duplicate skill name: ${skill.name}`];
+  }
+  const validationMessages = skills.flatMap((skill) => skill.validationMessages.map((message) => `${skill.relativePath}: ${message}`));
+  const packageFiles = filesToDownload(source);
+  return {
+    ...source.identity,
+    source: "github",
+    requestedRef: source.requestedRef,
+    resolvedCommit: source.resolvedCommit,
+    sourcePath: null,
+    readmePath: source.readme?.path ?? null,
+    packageHash: hashTree(packageFiles),
+    skills: skills.sort((left, right) => left.name.localeCompare(right.name)),
+    validationStatus: validationMessages.length === 0 ? "valid" : "error",
+    validationMessages
+  };
+}
+function previewSkill(skillPackage, contents) {
+  const parsed = parseProfileSkillMarkdown(contents);
+  const directoryName = skillPackage.root === "." ? null : path10.posix.basename(skillPackage.root);
+  const name = parsed.name ?? directoryName ?? "invalid-skill";
+  const messages = [...parsed.messages];
+  if (!SKILL_NAME_PATTERN.test(name))
+    messages.push("Skill name must be lowercase kebab-case.");
+  if (directoryName && name !== directoryName) {
+    messages.push(`Skill name must match its directory name (${directoryName}).`);
+  }
+  const resourceFiles = skillPackage.files.filter((file) => file.path !== skillPackage.entry.path).map((file) => relativeSkillPath(skillPackage.root, file.path)).sort();
+  return {
+    name,
+    description: parsed.description ?? "",
+    relativePath: skillPackage.root === "." ? "SKILL.md" : `${skillPackage.root}/SKILL.md`,
+    sourcePath: "",
+    charCount: contents.length,
+    sourceHash: createHash3("sha256").update(contents).digest("hex"),
+    resourceFiles,
+    validationStatus: messages.length === 0 ? "valid" : "error",
+    validationMessages: [...new Set(messages)]
+  };
+}
+function discoverSkillPackages(tree) {
+  const entries = [];
+  const rootEntry = tree.find((entry) => entry.type === "blob" && entry.path === "SKILL.md");
+  if (rootEntry)
+    entries.push({ root: ".", entry: rootEntry });
+  const skillEntries = tree.filter((entry) => entry.type === "blob" && entry.path.endsWith("/SKILL.md"));
+  const standardEntries = skillEntries.filter((entry) => isStandardAgentSkillsPath(entry.path));
+  const discoveredEntries = standardEntries.length > 0 ? standardEntries : skillEntries;
+  const roots = new Set(discoveredEntries.map((entry) => path10.posix.dirname(entry.path)));
+  for (const entry of discoveredEntries) {
+    const root = path10.posix.dirname(entry.path);
+    if ([...roots].some((candidate) => candidate !== root && root.startsWith(`${candidate}/`)))
+      continue;
+    entries.push({ root, entry });
+  }
+  return entries.map(({ root, entry }) => {
+    const files = tree.filter((candidate) => {
+      if (candidate.type !== "blob")
+        return false;
+      if (root !== ".")
+        return candidate.path.startsWith(`${root}/`);
+      if (candidate.path === "SKILL.md")
+        return true;
+      const firstSegment = candidate.path.split("/", 1)[0] ?? "";
+      return ROOT_SKILL_RESOURCE_DIRECTORIES.has(firstSegment);
+    });
+    const unsafe = tree.find((candidate) => candidate.type !== "blob" && candidate.type !== "tree" && (root === "." ? candidate.path === "SKILL.md" || ROOT_SKILL_RESOURCE_DIRECTORIES.has(candidate.path.split("/", 1)[0] ?? "") : candidate.path.startsWith(`${root}/`)));
+    const symlink2 = files.find((candidate) => candidate.mode === "120000");
+    if (unsafe || symlink2) {
+      throw new GithubExtensionError(`Skill package ${root} contains a symlink or submodule.`, {
+        code: "extension_unsafe_entry"
+      });
+    }
+    return { root, entry, files };
+  });
+}
+function isStandardAgentSkillsPath(skillPath) {
+  const segments = skillPath.split("/");
+  if (segments.at(-1) !== "SKILL.md")
+    return false;
+  const skillDirectorySegments = segments.slice(0, -1);
+  if (skillDirectorySegments.length < 2)
+    return false;
+  const skillsIndex = skillDirectorySegments.lastIndexOf("skills");
+  if (skillsIndex < 0 || skillsIndex > 2)
+    return false;
+  const containerPrefix = skillDirectorySegments.slice(0, skillsIndex);
+  const nestedSkillPath = skillDirectorySegments.slice(skillsIndex + 1);
+  if (nestedSkillPath.length < 1 || nestedSkillPath.length > 2)
+    return false;
+  if (skillsIndex === 0)
+    return true;
+  const first = containerPrefix[0] ?? "";
+  return first.startsWith(".") || first === "agent" || first === "data";
+}
+function filesToDownload(source) {
+  const byPath = /* @__PURE__ */ new Map();
+  if (source.readme)
+    byPath.set(source.readme.path, source.readme);
+  for (const skillPackage of source.skillPackages) {
+    for (const file of skillPackage.files)
+      byPath.set(file.path, file);
+  }
+  return [...byPath.values()].sort((left, right) => left.path.localeCompare(right.path));
+}
+async function downloadFiles(input) {
+  let downloadedBytes = 0;
+  await mapConcurrent(input.resolution.files, DOWNLOAD_CONCURRENCY, async (file) => {
+    const bytes = await downloadBytes({
+      owner: input.resolution.preview.owner,
+      repo: input.resolution.preview.repo,
+      commit: input.resolution.preview.resolvedCommit,
+      file,
+      fetchImpl: input.fetchImpl,
+      githubToken: input.githubToken
+    });
+    downloadedBytes += bytes.byteLength;
+    if (downloadedBytes > MAX_EXTENSION_BYTES) {
+      throw new GithubExtensionError("Extension download exceeds the maximum allowed size.", {
+        code: "extension_too_large"
+      });
+    }
+    await input.writeFile(file.path, bytes, file.mode === "100755");
+  });
+}
+async function downloadText(source, file, fetchImpl, githubToken) {
+  const bytes = await downloadBytes({
+    owner: source.identity.owner,
+    repo: source.identity.repo,
+    commit: source.resolvedCommit,
+    file,
+    fetchImpl,
+    githubToken
+  });
+  return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+}
+async function downloadBytes(input) {
+  const encodedPath = input.file.path.split("/").map(encodeURIComponent).join("/");
+  const url = `https://raw.githubusercontent.com/${input.owner}/${input.repo}/${input.commit}/${encodedPath}`;
+  const response = await input.fetchImpl(url, {
+    headers: githubHeaders(input.githubToken, "application/vnd.github.raw"),
+    redirect: "follow"
+  });
+  if (!response.ok) {
+    throw new GithubExtensionError(`GitHub file download failed (${response.status}): ${input.file.path}`, {
+      code: "github_download_failed",
+      status: response.status
+    });
+  }
+  const contentLength = Number(response.headers.get("content-length"));
+  if (Number.isFinite(contentLength) && contentLength > MAX_EXTENSION_FILE_BYTES) {
+    throw new GithubExtensionError(`Extension file is too large: ${input.file.path}`, {
+      code: "extension_file_too_large"
+    });
+  }
+  const bytes = new Uint8Array(await response.arrayBuffer());
+  if (bytes.byteLength > MAX_EXTENSION_FILE_BYTES) {
+    throw new GithubExtensionError(`Extension file is too large: ${input.file.path}`, {
+      code: "extension_file_too_large"
+    });
+  }
+  return bytes;
+}
+async function githubJson(fetchImpl, githubToken, pathname) {
+  const response = await fetchImpl(`https://api.github.com${pathname}`, {
+    headers: githubHeaders(githubToken, "application/vnd.github+json")
+  });
+  if (!response.ok) {
+    const details = await response.json().catch(() => null);
+    const detail = typeof details?.message === "string" ? `: ${details.message}` : "";
+    throw new GithubExtensionError(`GitHub request failed (${response.status})${detail}`, {
+      code: response.status === 404 ? "github_repository_not_found" : "github_request_failed",
+      status: response.status
+    });
+  }
+  return await response.json();
+}
+function githubHeaders(token, accept) {
+  const headers = new Headers({
+    Accept: accept,
+    "User-Agent": "openpond-extension-installer",
+    "X-GitHub-Api-Version": "2022-11-28"
+  });
+  if (token)
+    headers.set("Authorization", `Bearer ${token}`);
+  return headers;
+}
+function validateDownloadLimits(skillPackages) {
+  const files = /* @__PURE__ */ new Map();
+  for (const skillPackage of skillPackages) {
+    for (const file of skillPackage.files)
+      files.set(file.path, file);
+  }
+  if (files.size > MAX_EXTENSION_FILES) {
+    throw new GithubExtensionError(`Extension contains more than ${MAX_EXTENSION_FILES} skill files.`, {
+      code: "extension_too_many_files"
+    });
+  }
+  let totalBytes = 0;
+  for (const file of files.values()) {
+    if ((file.size ?? 0) > MAX_EXTENSION_FILE_BYTES) {
+      throw new GithubExtensionError(`Extension file is too large: ${file.path}`, {
+        code: "extension_file_too_large"
+      });
+    }
+    totalBytes += file.size ?? 0;
+  }
+  if (totalBytes > MAX_EXTENSION_BYTES) {
+    throw new GithubExtensionError("Extension exceeds the maximum allowed size.", {
+      code: "extension_too_large"
+    });
+  }
+}
+function validTreeEntry(value) {
+  if (!value || typeof value !== "object")
+    return false;
+  const entry = value;
+  return typeof entry.path === "string" && !entry.path.startsWith("/") && !entry.path.split("/").includes("..") && typeof entry.mode === "string" && (entry.type === "blob" || entry.type === "tree" || entry.type === "commit") && typeof entry.sha === "string";
+}
+function hashTree(files) {
+  const hash = createHash3("sha256");
+  for (const file of files)
+    hash.update(`${file.path}\0${file.sha}\0${file.size ?? ""}
+`);
+  return hash.digest("hex");
+}
+function relativeSkillPath(root, filePath) {
+  return root === "." ? filePath : filePath.slice(root.length + 1);
+}
+function duplicateValues(values) {
+  const seen = /* @__PURE__ */ new Set();
+  const duplicates = /* @__PURE__ */ new Set();
+  for (const value of values) {
+    if (seen.has(value))
+      duplicates.add(value);
+    seen.add(value);
+  }
+  return duplicates;
+}
+async function mapConcurrent(values, concurrency, mapper) {
+  const results = new Array(values.length);
+  let nextIndex = 0;
+  async function worker() {
+    while (nextIndex < values.length) {
+      const index = nextIndex;
+      nextIndex += 1;
+      results[index] = await mapper(values[index]);
+    }
+  }
+  await Promise.all(Array.from({ length: Math.min(concurrency, values.length) }, worker));
+  return results;
+}
+function invalidSource(source) {
+  return new GithubExtensionError(`Invalid GitHub extension source: ${source}. Use owner/repo or https://github.com/owner/repo.`, { code: "github_invalid_source" });
+}
+
+// ../../packages/cloud/dist/extensions/extension-manager.js
+import { createHash as createHash4, randomUUID as randomUUID3 } from "node:crypto";
+import { existsSync as existsSync6 } from "node:fs";
+import { mkdir as mkdir2, readFile as readFile6, rename, rm, stat as stat4, writeFile as writeFile3 } from "node:fs/promises";
+import path11 from "node:path";
+var REGISTRY_SCHEMA_VERSION = 1;
+var OPERATION_LOCK_STALE_MS = 2 * 60 * 1e3;
+var OPERATION_LOCK_TIMEOUT_MS = 15e3;
+function createGithubExtensionManager(options = {}) {
+  const rootPath = path11.resolve(options.rootPath ?? path11.join(openPondConfigDirectory(), "extensions"));
+  const registryPath = path11.join(rootPath, "registry.json");
+  const github = createGithubSourceClient({
+    fetch: options.fetch,
+    githubToken: options.githubToken
+  });
+  const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  async function list() {
+    try {
+      const registry = await readRegistry(registryPath);
+      const extensions = await Promise.all(registry.extensions.map((extension) => hydrateExtension(rootPath, extension)));
+      markInstalledSkillConflicts(extensions, await reservedSkillNames(options.reservedSkillNames));
+      return {
+        rootPath,
+        registryPath,
+        extensions: extensions.sort(extensionSort),
+        error: null
+      };
+    } catch (error) {
+      return {
+        rootPath,
+        registryPath,
+        extensions: [],
+        error: error instanceof Error ? error.message : String(error)
+      };
+    }
+  }
+  async function preview(request) {
+    const resolution = await github.resolve(request);
+    const registry = await readRegistry(registryPath);
+    const existing = registry.extensions.find((extension) => extension.id === resolution.preview.id) ?? null;
+    assertSkillNamesAvailable(resolution.preview, registry.extensions.filter((extension) => extension.id !== existing?.id), await reservedSkillNames(options.reservedSkillNames));
+    return resolution.preview;
+  }
+  async function add(request) {
+    const identity = parseGithubExtensionSource(request.source);
+    return withExtensionLock(rootPath, identity.id, async () => {
+      const registry = await readRegistry(registryPath);
+      if (registry.extensions.some((extension) => extension.id === identity.id)) {
+        throw new GithubExtensionError(`${identity.owner}/${identity.repo} is already installed.`, {
+          code: "extension_already_installed",
+          status: 409
+        });
+      }
+      const resolution = await github.resolve(request);
+      assertInstallable(resolution.preview);
+      assertSkillNamesAvailable(resolution.preview, registry.extensions, await reservedSkillNames(options.reservedSkillNames));
+      const timestamp = now().toISOString();
+      const installed = await materializeExtension({
+        rootPath,
+        resolution,
+        installedAt: timestamp,
+        updatedAt: timestamp,
+        github
+      });
+      try {
+        const reserved = await reservedSkillNames(options.reservedSkillNames);
+        await writeRegistry(registryPath, now, (current) => ({
+          ...current,
+          extensions: appendInstalledExtension(current, installed, reserved)
+        }));
+        await finalizeMaterialization(rootPath, installed.id);
+        return installed;
+      } catch (error) {
+        await rollbackMaterialization(rootPath, installed.id);
+        throw error;
+      }
+    });
+  }
+  async function update(request) {
+    const identity = parseGithubExtensionSource(request.source);
+    return withExtensionLock(rootPath, identity.id, async () => {
+      const registry = await readRegistry(registryPath);
+      const existing = requireInstalled(registry, identity.id);
+      const resolution = await github.resolve({
+        source: existing.repositoryUrl,
+        ref: request.ref?.trim() || existing.requestedRef
+      });
+      assertInstallable(resolution.preview);
+      assertSkillNamesAvailable(resolution.preview, registry.extensions.filter((extension) => extension.id !== existing.id), await reservedSkillNames(options.reservedSkillNames));
+      if (existing.resolvedCommit === resolution.preview.resolvedCommit && existing.packageHash === resolution.preview.packageHash && existing.requestedRef === resolution.preview.requestedRef) {
+        return hydrateExtension(rootPath, existing);
+      }
+      const installed = await materializeExtension({
+        rootPath,
+        resolution,
+        installedAt: existing.installedAt,
+        updatedAt: now().toISOString(),
+        github
+      });
+      try {
+        const reserved = await reservedSkillNames(options.reservedSkillNames);
+        await writeRegistry(registryPath, now, (current) => ({
+          ...current,
+          extensions: replaceInstalledExtension(current, installed, reserved)
+        }));
+        await finalizeMaterialization(rootPath, installed.id);
+        return installed;
+      } catch (error) {
+        await rollbackMaterialization(rootPath, installed.id);
+        throw error;
+      }
+    });
+  }
+  async function updateAll() {
+    const catalog = await list();
+    if (catalog.error)
+      throw new GithubExtensionError(catalog.error, { code: "extension_registry_error" });
+    const result = { updated: [], unchanged: [], failed: [] };
+    for (const extension of catalog.extensions) {
+      try {
+        const next = await update({ source: extension.repositoryUrl, ref: extension.requestedRef });
+        if (next.resolvedCommit === extension.resolvedCommit && next.packageHash === extension.packageHash) {
+          result.unchanged.push(next);
+        } else {
+          result.updated.push(next);
+        }
+      } catch (error) {
+        result.failed.push({
+          id: extension.id,
+          error: error instanceof Error ? error.message : String(error)
+        });
+      }
+    }
+    return result;
+  }
+  async function inspect(source) {
+    const identity = parseGithubExtensionSource(source);
+    const registry = await readRegistry(registryPath);
+    return hydrateExtension(rootPath, requireInstalled(registry, identity.id));
+  }
+  async function remove(source) {
+    const identity = parseGithubExtensionSource(source);
+    return withExtensionLock(rootPath, identity.id, async () => {
+      const registry = await readRegistry(registryPath);
+      const existing = requireInstalled(registry, identity.id);
+      const target = extensionDirectory(rootPath, identity.owner, identity.repo);
+      const trash = `${target}.${randomUUID3()}.remove`;
+      if (existsSync6(target))
+        await rename(target, trash);
+      try {
+        await writeRegistry(registryPath, now, (current) => ({
+          ...current,
+          extensions: current.extensions.filter((extension) => extension.id !== existing.id)
+        }));
+        await rm(trash, { recursive: true, force: true });
+        return existing;
+      } catch (error) {
+        if (existsSync6(trash) && !existsSync6(target))
+          await rename(trash, target);
+        throw error;
+      }
+    });
+  }
+  async function readSkill(nameInput) {
+    const name = nameInput.trim();
+    if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(name)) {
+      throw new GithubExtensionError("Extension skill name must be lowercase kebab-case.", {
+        code: "extension_skill_invalid_name"
+      });
+    }
+    const catalog = await list();
+    if (catalog.error) {
+      throw new GithubExtensionError(catalog.error, { code: "extension_registry_error" });
+    }
+    const matches = catalog.extensions.flatMap((extension) => extension.skills.filter((skill) => skill.name === name).map((skill) => ({ extension, skill })));
+    if (matches.length === 0) {
+      throw new GithubExtensionError(`Extension skill not found: ${name}`, {
+        code: "extension_skill_not_found",
+        status: 404
+      });
+    }
+    if (matches.length > 1) {
+      throw new GithubExtensionError(`Extension skill name is ambiguous: ${name}`, {
+        code: "extension_skill_conflict",
+        status: 409
+      });
+    }
+    const match = matches[0];
+    if (match.extension.validationStatus !== "valid" || match.skill.validationStatus !== "valid") {
+      throw new GithubExtensionError(`Extension skill ${name} is not valid.`, {
+        code: "extension_skill_invalid"
+      });
+    }
+    const absolutePath = safeDestination(match.extension.sourcePath, match.skill.relativePath);
+    const markdown = await readFile6(absolutePath, "utf8");
+    const sourceHash = createHash4("sha256").update(markdown).digest("hex");
+    if (sourceHash !== match.skill.sourceHash) {
+      throw new GithubExtensionError(`Extension skill ${name} changed on disk. Update or reinstall its extension before using it.`, { code: "extension_skill_modified" });
+    }
+    const parsed = parseProfileSkillMarkdown(markdown);
+    if (parsed.messages.length > 0 || parsed.name !== name || !parsed.description) {
+      throw new GithubExtensionError(`Extension skill ${name} is not valid. ${parsed.messages.join(" ")}`.trim(), { code: "extension_skill_invalid" });
+    }
+    return {
+      name,
+      description: parsed.description,
+      body: parsed.body,
+      path: match.skill.relativePath,
+      sourcePath: match.extension.sourcePath,
+      sourceHash,
+      charCount: markdown.length,
+      packagePath: path11.dirname(absolutePath),
+      resourceFiles: match.skill.resourceFiles
+    };
+  }
+  return { rootPath, registryPath, list, preview, add, update, updateAll, inspect, remove, readSkill };
+}
+async function materializeExtension(input) {
+  const preview = input.resolution.preview;
+  const target = extensionDirectory(input.rootPath, preview.owner, preview.repo);
+  const temporary = `${target}.${randomUUID3()}.install`;
+  const backup = backupDirectory(input.rootPath, preview.id);
+  const current = path11.join(temporary, "current");
+  await rm(temporary, { recursive: true, force: true });
+  await rm(backup, { recursive: true, force: true });
+  await mkdir2(current, { recursive: true, mode: 448 });
+  try {
+    await input.github.download(input.resolution, async (relativePath, bytes, executable) => {
+      const destination = safeDestination(current, relativePath);
+      await mkdir2(path11.dirname(destination), { recursive: true, mode: 448 });
+      await writeFile3(destination, bytes, { mode: executable ? 448 : 384 });
+    });
+    const extension = installedExtension(preview, target, input.installedAt, input.updatedAt);
+    await writeFile3(path11.join(temporary, "extension.json"), `${JSON.stringify(extension, null, 2)}
+`, { mode: 384 });
+    await mkdir2(path11.dirname(target), { recursive: true, mode: 448 });
+    if (existsSync6(target))
+      await rename(target, backup);
+    await rename(temporary, target);
+    return extension;
+  } catch (error) {
+    await rm(temporary, { recursive: true, force: true });
+    if (existsSync6(backup) && !existsSync6(target))
+      await rename(backup, target);
+    throw error;
+  }
+}
+function installedExtension(preview, target, installedAt, updatedAt) {
+  const sourcePath = path11.join(target, "current");
+  return {
+    ...preview,
+    sourcePath,
+    readmePath: preview.readmePath ? path11.join(sourcePath, preview.readmePath) : null,
+    installedAt,
+    updatedAt,
+    skills: preview.skills.map((skill) => ({
+      ...skill,
+      sourcePath: path11.join(sourcePath, skill.relativePath)
+    }))
+  };
+}
+async function finalizeMaterialization(rootPath, id) {
+  await rm(backupDirectory(rootPath, id), { recursive: true, force: true });
+}
+async function rollbackMaterialization(rootPath, id) {
+  const identity = parseGithubExtensionSource(id.replace(/^github:/, ""));
+  const target = extensionDirectory(rootPath, identity.owner, identity.repo);
+  const backup = backupDirectory(rootPath, id);
+  await rm(target, { recursive: true, force: true });
+  if (existsSync6(backup))
+    await rename(backup, target);
+}
+async function hydrateExtension(rootPath, extension) {
+  const target = extensionDirectory(rootPath, extension.owner, extension.repo);
+  const sourcePath = path11.join(target, "current");
+  const present = (await stat4(path11.join(target, "extension.json")).catch(() => null))?.isFile() ?? false;
+  const validationMessages = extension.validationMessages.filter((message) => message !== "Installed files are missing.");
+  if (!present)
+    validationMessages.push("Installed files are missing.");
+  return {
+    ...extension,
+    sourcePath,
+    readmePath: extension.readmePath ? path11.join(sourcePath, path11.basename(extension.readmePath)) : null,
+    skills: extension.skills.map((skill) => ({
+      ...skill,
+      sourcePath: path11.join(sourcePath, skill.relativePath)
+    })),
+    validationStatus: validationMessages.length === 0 ? "valid" : "error",
+    validationMessages
+  };
+}
+function assertInstallable(preview) {
+  if (preview.validationStatus === "valid")
+    return;
+  throw new GithubExtensionError(`Extension contains invalid skills: ${preview.validationMessages.join(" ")}`, { code: "extension_invalid" });
+}
+function assertSkillNamesAvailable(preview, installed, reserved) {
+  const owners = /* @__PURE__ */ new Map();
+  for (const name of reserved)
+    owners.set(name, "a shipped OpenPond skill");
+  for (const extension of installed) {
+    for (const skill of extension.skills)
+      owners.set(skill.name, extension.id);
+  }
+  const conflicts = preview.skills.map((skill) => ({ name: skill.name, owner: owners.get(skill.name) })).filter((entry) => Boolean(entry.owner));
+  if (conflicts.length === 0)
+    return;
+  throw new GithubExtensionError(`Skill name conflict: ${conflicts.map((entry) => `${entry.name} (${entry.owner})`).join(", ")}.`, { code: "extension_skill_conflict", status: 409 });
+}
+function appendInstalledExtension(registry, installed, reserved) {
+  if (registry.extensions.some((extension) => extension.id === installed.id)) {
+    throw new GithubExtensionError(`${installed.owner}/${installed.repo} is already installed.`, {
+      code: "extension_already_installed",
+      status: 409
+    });
+  }
+  assertSkillNamesAvailable(installed, registry.extensions, reserved);
+  return [...registry.extensions, installed].sort(extensionSort);
+}
+function replaceInstalledExtension(registry, installed, reserved) {
+  requireInstalled(registry, installed.id);
+  assertSkillNamesAvailable(installed, registry.extensions.filter((extension) => extension.id !== installed.id), reserved);
+  return registry.extensions.map((extension) => extension.id === installed.id ? installed : extension).sort(extensionSort);
+}
+function markInstalledSkillConflicts(extensions, reserved) {
+  const owners = /* @__PURE__ */ new Map();
+  for (const name of reserved)
+    owners.set(name, "built-in");
+  for (const extension of extensions) {
+    for (const skill of extension.skills) {
+      const owner = owners.get(skill.name);
+      if (!owner) {
+        owners.set(skill.name, extension.id);
+        continue;
+      }
+      const message = `Skill name conflicts with ${owner}: ${skill.name}`;
+      skill.validationStatus = "error";
+      skill.validationMessages = [.../* @__PURE__ */ new Set([...skill.validationMessages, message])];
+      extension.validationStatus = "error";
+      extension.validationMessages = [.../* @__PURE__ */ new Set([...extension.validationMessages, message])];
+    }
+  }
+}
+async function reservedSkillNames(source) {
+  const values = typeof source === "function" ? await source() : source ?? [];
+  return [...new Set(values.map((value) => value.trim()).filter(Boolean))];
+}
+function requireInstalled(registry, id) {
+  const extension = registry.extensions.find((candidate) => candidate.id === id);
+  if (extension)
+    return extension;
+  throw new GithubExtensionError(`${id.replace(/^github:/, "")} is not installed.`, {
+    code: "extension_not_installed",
+    status: 404
+  });
+}
+async function readRegistry(registryPath) {
+  try {
+    const parsed = JSON.parse(await readFile6(registryPath, "utf8"));
+    if (parsed.schemaVersion !== REGISTRY_SCHEMA_VERSION || !Array.isArray(parsed.extensions)) {
+      throw new Error("Extension registry has an unsupported format.");
+    }
+    return {
+      schemaVersion: REGISTRY_SCHEMA_VERSION,
+      updatedAt: typeof parsed.updatedAt === "string" ? parsed.updatedAt : null,
+      extensions: parsed.extensions.filter(isStoredExtension)
+    };
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return emptyRegistry();
+    throw error;
+  }
+}
+async function writeRegistry(registryPath, now, update) {
+  await updatePrivateJsonFile(registryPath, emptyRegistry, (current) => ({
+    ...update(normalizeRegistry(current)),
+    schemaVersion: REGISTRY_SCHEMA_VERSION,
+    updatedAt: now().toISOString()
+  }));
+}
+function normalizeRegistry(value) {
+  return {
+    schemaVersion: REGISTRY_SCHEMA_VERSION,
+    updatedAt: typeof value?.updatedAt === "string" ? value.updatedAt : null,
+    extensions: Array.isArray(value?.extensions) ? value.extensions.filter(isStoredExtension) : []
+  };
+}
+function emptyRegistry() {
+  return { schemaVersion: REGISTRY_SCHEMA_VERSION, updatedAt: null, extensions: [] };
+}
+function isStoredExtension(value) {
+  if (!value || typeof value !== "object")
+    return false;
+  const extension = value;
+  return extension.source === "github" && typeof extension.id === "string" && typeof extension.owner === "string" && typeof extension.repo === "string" && typeof extension.repositoryUrl === "string" && typeof extension.requestedRef === "string" && typeof extension.resolvedCommit === "string" && Array.isArray(extension.skills);
+}
+function safeDestination(root, relativePath) {
+  if (path11.isAbsolute(relativePath) || relativePath.split(/[\\/]/).includes("..")) {
+    throw new GithubExtensionError(`Unsafe extension path: ${relativePath}`, {
+      code: "extension_unsafe_path"
+    });
+  }
+  const destination = path11.resolve(root, ...relativePath.split("/"));
+  const prefix = `${path11.resolve(root)}${path11.sep}`;
+  if (!destination.startsWith(prefix)) {
+    throw new GithubExtensionError(`Unsafe extension path: ${relativePath}`, {
+      code: "extension_unsafe_path"
+    });
+  }
+  return destination;
+}
+function extensionDirectory(rootPath, owner, repo) {
+  return path11.join(rootPath, "github", owner, repo);
+}
+function backupDirectory(rootPath, id) {
+  const identity = parseGithubExtensionSource(id.replace(/^github:/, ""));
+  return `${extensionDirectory(rootPath, identity.owner, identity.repo)}.previous`;
+}
+async function withExtensionLock(rootPath, id, operation) {
+  const safeId = id.replace(/[^a-z0-9.-]+/gi, "-");
+  const lockPath = path11.join(rootPath, ".locks", `${safeId}.lock`);
+  await mkdir2(path11.dirname(lockPath), { recursive: true, mode: 448 });
+  const deadline = Date.now() + OPERATION_LOCK_TIMEOUT_MS;
+  while (true) {
+    try {
+      await mkdir2(lockPath, { mode: 448 });
+      break;
+    } catch (error) {
+      if (error.code !== "EEXIST")
+        throw error;
+      const lockStat = await stat4(lockPath).catch(() => null);
+      if (lockStat && Date.now() - lockStat.mtimeMs > OPERATION_LOCK_STALE_MS) {
+        await rm(lockPath, { recursive: true, force: true });
+        continue;
+      }
+      if (Date.now() >= deadline) {
+        throw new GithubExtensionError(`Timed out waiting for extension operation: ${id}`, {
+          code: "extension_operation_busy",
+          status: 409
+        });
+      }
+      await new Promise((resolve) => setTimeout(resolve, 30));
+    }
+  }
+  try {
+    return await operation();
+  } finally {
+    await rm(lockPath, { recursive: true, force: true });
+  }
+}
+function extensionSort(left, right) {
+  return left.id.localeCompare(right.id);
+}
+
 // ../../packages/cloud/dist/profile/hosted-run-idempotency.js
-import { createHash as createHash3, randomUUID as randomUUID3 } from "node:crypto";
+import { createHash as createHash5, randomUUID as randomUUID4 } from "node:crypto";
 function buildHostedRunIdempotencyKey(input) {
   const explicit = input.explicitKey?.trim();
   if (explicit)
@@ -5031,10 +5889,10 @@ function buildHostedRunIdempotencyKey(input) {
   const base = `profile-push-run:${input.localHead}:${sourceHead}:${input.runtimeAgentId}:${targetProjectId}:${inputHash}`;
   if (!input.retry)
     return base;
-  return `${base}:retry:${(input.randomId ?? randomUUID3)()}`;
+  return `${base}:retry:${(input.randomId ?? randomUUID4)()}`;
 }
 function hashStableJson(value) {
-  return createHash3("sha256").update(stableJsonStringify(value)).digest("hex");
+  return createHash5("sha256").update(stableJsonStringify(value)).digest("hex");
 }
 function stableJsonStringify(value) {
   if (value === void 0)
@@ -5048,9 +5906,9 @@ function stableJsonStringify(value) {
 }
 
 // ../../packages/cloud/dist/profile/profile-skill-goal-executor.js
-import { existsSync as existsSync6 } from "node:fs";
-import { mkdir as mkdir2, readFile as readFile6, writeFile as writeFile3 } from "node:fs/promises";
-import path10 from "node:path";
+import { existsSync as existsSync7 } from "node:fs";
+import { mkdir as mkdir3, readFile as readFile7, writeFile as writeFile4 } from "node:fs/promises";
+import path12 from "node:path";
 async function executeProfileSkillGoalRequest(goal) {
   if (goal.operation === "edit")
     return executeProfileSkillEdit(goal);
@@ -5061,9 +5919,9 @@ async function executeProfileSkillCreate(goal) {
   const existingNames = new Set(existing.skills.map((skill) => skill.name));
   const skillName = uniqueSkillName(goal.targetSkillName ?? goal.requestedName ?? inferSkillName(goal.userObjective), existingNames, goal.profileSourcePath);
   const skillPath = profileSkillPath(skillName);
-  const absolutePath = path10.join(goal.profileSourcePath, skillPath);
-  await mkdir2(path10.dirname(absolutePath), { recursive: true });
-  await writeFile3(absolutePath, renderSkillMarkdown({
+  const absolutePath = path12.join(goal.profileSourcePath, skillPath);
+  await mkdir3(path12.dirname(absolutePath), { recursive: true });
+  await writeFile4(absolutePath, renderSkillMarkdown({
     name: skillName,
     description: descriptionForObjective(goal.userObjective),
     body: bodyForObjective(goal.userObjective)
@@ -5075,10 +5933,10 @@ async function executeProfileSkillEdit(goal) {
   if (!skillName)
     throw new Error("Profile skill edit requires skillName.");
   const skillPath = profileSkillPath(skillName);
-  const absolutePath = path10.join(goal.profileSourcePath, skillPath);
-  if (!existsSync6(absolutePath))
+  const absolutePath = path12.join(goal.profileSourcePath, skillPath);
+  if (!existsSync7(absolutePath))
     throw new Error(`Profile skill not found: ${skillName}`);
-  const current = await readFile6(absolutePath, "utf8");
+  const current = await readFile7(absolutePath, "utf8");
   const parsed = parseProfileSkillMarkdown(current);
   if (parsed.messages.length > 0 || !parsed.name || !parsed.description) {
     throw new Error(`Profile skill ${skillName} is not valid. ${parsed.messages.join(" ")}`);
@@ -5092,7 +5950,7 @@ async function executeProfileSkillEdit(goal) {
     change,
     ""
   ].join("\n");
-  await writeFile3(absolutePath, renderSkillMarkdown({
+  await writeFile4(absolutePath, renderSkillMarkdown({
     name: parsed.name,
     description: parsed.description,
     body
@@ -5108,7 +5966,7 @@ async function validateExecutedGoal(goal, skillName) {
     ...goal,
     status: "completed",
     targetSkillName: skillName,
-    targetSkillPath: path10.join(goal.profileSourceRelativePath, PROFILE_SKILLS_DIR, skillName, PROFILE_SKILL_FILE).replace(/\\/g, "/")
+    targetSkillPath: path12.join(goal.profileSourceRelativePath, PROFILE_SKILLS_DIR, skillName, PROFILE_SKILL_FILE).replace(/\\/g, "/")
   };
   const validationStatus = skill.validationStatus === "valid" ? "valid" : "error";
   if (validationStatus !== "valid") {
@@ -5241,14 +6099,14 @@ function uniqueSkillName(baseName, existingNames, profileSourcePath2) {
   const base = normalizeSkillName2(baseName) ?? "profile-skill";
   let candidate = base;
   let suffix = 2;
-  while (existingNames.has(candidate) || existsSync6(path10.join(profileSourcePath2, PROFILE_SKILLS_DIR, candidate))) {
+  while (existingNames.has(candidate) || existsSync7(path12.join(profileSourcePath2, PROFILE_SKILLS_DIR, candidate))) {
     candidate = `${base}-${suffix}`;
     suffix += 1;
   }
   return candidate;
 }
 function profileSkillPath(skillName) {
-  return path10.join(PROFILE_SKILLS_DIR, skillName, PROFILE_SKILL_FILE).replace(/\\/g, "/");
+  return path12.join(PROFILE_SKILLS_DIR, skillName, PROFILE_SKILL_FILE).replace(/\\/g, "/");
 }
 function normalizeSkillName2(value) {
   const normalized = value.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").replace(/-{2,}/g, "-");
@@ -8100,7 +8958,8 @@ var OpenPondProfileSkillSchema = external_exports.object({
   charCount: external_exports.number(),
   sourceHash: external_exports.string(),
   validationStatus: external_exports.enum(["valid", "warning", "error"]),
-  validationMessages: external_exports.array(external_exports.string())
+  validationMessages: external_exports.array(external_exports.string()),
+  resourceFiles: external_exports.array(external_exports.string()).optional().default([])
 });
 var OpenPondProfileEvalSchema = external_exports.object({
   id: external_exports.string(),
@@ -8371,6 +9230,82 @@ function emptyOpenPondProfileState() {
   };
 }
 
+// ../../packages/contracts/dist/skills.js
+var CodexPersonalSkillSchema = external_exports.object({
+  name: external_exports.string(),
+  description: external_exports.string(),
+  path: external_exports.string(),
+  sourcePath: external_exports.string(),
+  enabled: external_exports.boolean(),
+  charCount: external_exports.number().int().nonnegative(),
+  sourceHash: external_exports.string(),
+  validationStatus: external_exports.enum(["valid", "error"]),
+  validationMessages: external_exports.array(external_exports.string()),
+  resourceFiles: external_exports.array(external_exports.string()),
+  updatedAt: external_exports.string().nullable()
+});
+var SkillSourceScopeSchema = external_exports.enum(["codex", "profile", "extension"]);
+var SkillSourceFileSchema = external_exports.object({
+  skillName: external_exports.string(),
+  scope: SkillSourceScopeSchema,
+  path: external_exports.string(),
+  byteSize: external_exports.number().int().nonnegative(),
+  isBinary: external_exports.boolean(),
+  content: external_exports.string().nullable()
+});
+
+// ../../packages/contracts/dist/extensions.js
+var SHIPPED_OPENPOND_SKILL_NAMES = [
+  "openpond-cli",
+  "openpond-desktop-harness",
+  "openpond-taskset-authoring"
+];
+var OpenPondExtensionSkillSchema = external_exports.object({
+  name: external_exports.string(),
+  description: external_exports.string(),
+  relativePath: external_exports.string(),
+  sourcePath: external_exports.string(),
+  charCount: external_exports.number().int().nonnegative(),
+  sourceHash: external_exports.string(),
+  resourceFiles: external_exports.array(external_exports.string()),
+  validationStatus: external_exports.enum(["valid", "error"]),
+  validationMessages: external_exports.array(external_exports.string())
+});
+var OpenPondExtensionSchema = external_exports.object({
+  id: external_exports.string(),
+  source: external_exports.literal("github"),
+  owner: external_exports.string(),
+  repo: external_exports.string(),
+  repositoryUrl: external_exports.string().url(),
+  requestedRef: external_exports.string(),
+  resolvedCommit: external_exports.string(),
+  sourcePath: external_exports.string(),
+  readmePath: external_exports.string().nullable(),
+  installedAt: external_exports.string(),
+  updatedAt: external_exports.string(),
+  packageHash: external_exports.string(),
+  skills: external_exports.array(OpenPondExtensionSkillSchema),
+  validationStatus: external_exports.enum(["valid", "error"]),
+  validationMessages: external_exports.array(external_exports.string())
+});
+var OpenPondExtensionPreviewSchema = OpenPondExtensionSchema.omit({
+  installedAt: true,
+  updatedAt: true,
+  sourcePath: true
+}).extend({
+  sourcePath: external_exports.null()
+});
+var OpenPondExtensionCatalogSchema = external_exports.object({
+  rootPath: external_exports.string(),
+  registryPath: external_exports.string(),
+  extensions: external_exports.array(OpenPondExtensionSchema),
+  error: external_exports.string().nullable()
+});
+var OpenPondExtensionSourceRequestSchema = external_exports.object({
+  source: external_exports.string().trim().min(1),
+  ref: external_exports.string().trim().min(1).optional()
+});
+
 // ../../packages/contracts/dist/bootstrap.js
 var BootstrapEventWindowSchema = external_exports.object({
   latestSequence: external_exports.number().int().nonnegative(),
@@ -8394,6 +9329,13 @@ var BootstrapPayloadSchema = external_exports.object({
   localProjects: external_exports.array(LocalProjectSchema).optional().default([]),
   cloudProjects: external_exports.array(CloudProjectSchema).optional().default([]),
   profile: OpenPondProfileStateSchema.optional().default(emptyOpenPondProfileState),
+  codexPersonalSkills: external_exports.array(CodexPersonalSkillSchema).optional().default([]),
+  extensionCatalog: OpenPondExtensionCatalogSchema.optional().default({
+    rootPath: "",
+    registryPath: "",
+    extensions: [],
+    error: null
+  }),
   codexHistorySessions: external_exports.array(SessionSchema).optional().default([]),
   sidebarAppPreferences: SidebarAppPreferencesSchema,
   sidebarFileBookmarks: external_exports.array(SidebarFileBookmarkSchema).optional().default([]),
@@ -11594,8 +12536,11 @@ export {
   normalizeSandboxApiUrl,
   createOpenPondSandboxClient,
   executeConnectedAppToolCall,
-  buildHostedRunIdempotencyKey,
+  GithubExtensionError,
+  parseProfileSkillMarkdown,
   readProfileSkill,
+  createGithubExtensionManager,
+  buildHostedRunIdempotencyKey,
   buildOpenPondProfileSetupGate,
   formatOpenPondProfileSetupRequirement,
   readSourceUploadCache,
@@ -11731,6 +12676,8 @@ export {
   SwitchOpenPondAccountRequestSchema,
   SaveOpenPondAccountRequestSchema,
   UpdateOpenPondAccountConfigRequestSchema,
+  SHIPPED_OPENPOND_SKILL_NAMES,
+  OpenPondExtensionSourceRequestSchema,
   BootstrapPayloadSchema,
   WorkspaceTemplateConfigViewSchema,
   WorkspaceToolRequestSchema,