rshow 0.0.1 → 0.0.3

package/dist/main.js

@@ -1,8 +1,115 @@
 #!/usr/bin/env node
 
 // src/main.ts
-import path21 from "node:path";
-import process15 from "node:process";
+import path25 from "node:path";
+import process23 from "node:process";
+
+// src/binary.ts
+import { mkdir, mkdtemp, rename, rm, stat, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import path from "node:path";
+import process from "node:process";
+
+// src/version.ts
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+var VERSION = true ? "0.0.3" : versionFromPackage();
+
+// src/binary.ts
+var ASSET_MANIFEST = "assets.json";
+var COMPLETE_MARKER = ".complete";
+var sea;
+function seaModule() {
+  if (sea === void 0) {
+    sea = import("node:sea").then(
+      (mod) => mod,
+      () => void 0
+    );
+  }
+  return sea;
+}
+async function isBinary() {
+  const mod = await seaModule();
+  if (mod === void 0 || typeof mod.isSea !== "function") return false;
+  try {
+    return mod.isSea();
+  } catch {
+    return false;
+  }
+}
+function cacheRoot(env = process.env) {
+  const xdg = (env.XDG_CACHE_HOME ?? "").trim();
+  if (xdg !== "") return path.resolve(xdg);
+  const home = (env.HOME ?? "").trim();
+  return path.join(home !== "" ? home : homedir(), ".cache");
+}
+function binaryCacheDir(env = process.env, version = VERSION) {
+  return path.join(cacheRoot(env), "rshow", version);
+}
+async function exists(file) {
+  return await stat(file).catch(() => void 0) !== void 0;
+}
+async function extractAssets(bundle, dir) {
+  if (await exists(path.join(dir, COMPLETE_MARKER))) return;
+  const parent = path.dirname(dir);
+  await mkdir(parent, { recursive: true });
+  const tmp = await mkdtemp(path.join(parent, `${path.basename(dir)}.tmp-`));
+  try {
+    for (const key2 of bundle.keys) {
+      const file = path.join(tmp, ...key2.split("/"));
+      await mkdir(path.dirname(file), { recursive: true });
+      await writeFile(file, bundle.read(key2));
+    }
+    await writeFile(path.join(tmp, COMPLETE_MARKER), `${VERSION}
+`);
+    await rm(dir, { recursive: true, force: true });
+    await rename(tmp, dir);
+  } catch (err) {
+    await rm(tmp, { recursive: true, force: true });
+    throw err;
+  }
+}
+function safeKey(key2) {
+  return key2 !== "" && !path.isAbsolute(key2) && !key2.split("/").includes("..");
+}
+function manifestKeys(read4) {
+  try {
+    const doc = JSON.parse(new TextDecoder().decode(read4(ASSET_MANIFEST)));
+    if (doc !== null && typeof doc === "object" && Array.isArray(doc.keys)) {
+      const keys = doc.keys.filter((key2) => typeof key2 === "string");
+      if (keys.length > 0) return keys.filter(safeKey);
+    }
+  } catch {
+  }
+  return [];
+}
+function bundleOf(mod) {
+  const raw = mod.getRawAsset;
+  const read4 = (key2) => new Uint8Array(raw(key2));
+  const withManifest = manifestKeys(read4);
+  return { keys: withManifest.length > 0 ? withManifest : (mod.getAssetKeys?.() ?? []).filter(safeKey), read: read4 };
+}
+async function unpack(env) {
+  if (!await isBinary()) return void 0;
+  const mod = await seaModule();
+  if (mod?.getRawAsset === void 0) throw new Error("this rshow binary carries no assets");
+  const dir = binaryCacheDir(env);
+  await extractAssets(bundleOf(mod), dir);
+  return dir;
+}
+var root;
+function binaryRoot(env = process.env) {
+  if (root === void 0) root = unpack(env);
+  return root;
+}
+async function binaryThemeBases(env = process.env) {
+  const dir = await binaryRoot(env);
+  return dir === void 0 ? [] : [path.join(dir, "themes")];
+}
+async function binarySkillBases(env = process.env) {
+  const dir = await binaryRoot(env);
+  return dir === void 0 ? [] : [path.join(dir, "skills")];
+}
 
 // src/exit.ts
 var EXIT = { ok: 0, usage: 2, auth: 4, api: 5, build: 5, check: 6, compare: 7 };
@@ -14,18 +121,18 @@ var UsageError = class extends Error {
 };
 var AuthError = class extends Error {
   status;
-  constructor(message, status) {
+  constructor(message, status2) {
     super(message);
     this.name = "AuthError";
-    this.status = status;
+    this.status = status2;
   }
 };
 var ApiError = class extends Error {
   status;
-  constructor(message, status = 0) {
+  constructor(message, status2 = 0) {
     super(message);
     this.name = "ApiError";
-    this.status = status;
+    this.status = status2;
   }
 };
 var BuildError = class extends Error {
@@ -41,20 +148,150 @@ var CheckError = class extends Error {
   }
 };
 
-// src/version.ts
-import { readFileSync } from "node:fs";
-import { fileURLToPath } from "node:url";
-var VERSION = true ? "0.0.1" : versionFromPackage();
+// src/network.ts
+import { readFile } from "node:fs/promises";
+import process3 from "node:process";
+import tls from "node:tls";
 
-// src/client.ts
+// src/warn.ts
+import process2 from "node:process";
+function warn(message) {
+  process2.stderr.write(`rshow: warning: ${message}
+`);
+}
+
+// src/network.ts
+var PROXY_VARIABLES = ["https_proxy", "HTTPS_PROXY", "http_proxy", "HTTP_PROXY"];
+var TRUST_HINT = "your network may inspect HTTPS: set RSHOW_EXTRA_CA_FILE to its root certificate, or check that the system store has it";
+var PROXY_HINT = "if a proxy stands between you and that host, set https_proxy and run with NODE_USE_ENV_PROXY=1";
+var DNS_HINT = "check the url in rshow config and your DNS";
+var TRUSTED = { reason: "certificate not trusted", hint: TRUST_HINT };
+var REASONS = {
+  UNABLE_TO_GET_ISSUER_CERT_LOCALLY: TRUSTED,
+  UNABLE_TO_VERIFY_LEAF_SIGNATURE: TRUSTED,
+  SELF_SIGNED_CERT_IN_CHAIN: TRUSTED,
+  DEPTH_ZERO_SELF_SIGNED_CERT: TRUSTED,
+  CERT_HAS_EXPIRED: TRUSTED,
+  ERR_TLS_CERT_ALTNAME_INVALID: TRUSTED,
+  ENOTFOUND: { reason: "host not found", hint: DNS_HINT },
+  EAI_AGAIN: { reason: "host not found", hint: DNS_HINT },
+  ECONNREFUSED: { reason: "connection refused" },
+  ETIMEDOUT: { reason: "connection timed out", proxyHint: true },
+  UND_ERR_CONNECT_TIMEOUT: { reason: "connection timed out", proxyHint: true },
+  ECONNRESET: { reason: "connection reset", proxyHint: true }
+};
 function messageOf(err) {
   return err instanceof Error ? err.message : String(err);
 }
-function errorText(body, status) {
+function pemCertificatesOf(text) {
+  return text.match(/-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g) ?? [];
+}
+async function extraCertificates(env) {
+  const file = (env.RSHOW_EXTRA_CA_FILE ?? "").trim();
+  if (file === "") return [];
+  let text;
+  try {
+    text = await readFile(file, "utf8");
+  } catch (err) {
+    warn(`cannot read RSHOW_EXTRA_CA_FILE ${file}: ${messageOf(err)}`);
+    return [];
+  }
+  const certs = pemCertificatesOf(text);
+  if (certs.length === 0) warn(`RSHOW_EXTRA_CA_FILE ${file} holds no PEM certificate`);
+  return certs;
+}
+async function installCaCertificates(env = process3.env) {
+  const extra = await extraCertificates(env);
+  const api = tls;
+  if (typeof api.getCACertificates !== "function" || typeof api.setDefaultCACertificates !== "function") return;
+  try {
+    const certs = [...api.getCACertificates("default")];
+    if (env.RSHOW_SYSTEM_CA !== "0") certs.push(...api.getCACertificates("system"));
+    certs.push(...extra);
+    api.setDefaultCACertificates([...new Set(certs)]);
+  } catch {
+  }
+}
+function proxyVariableOf(env) {
+  return PROXY_VARIABLES.find((name) => (env[name] ?? "").trim() !== "");
+}
+function envProxyEnabled(env) {
+  const flag = (env.NODE_USE_ENV_PROXY ?? "").trim();
+  if (flag !== "" && flag !== "0") return true;
+  return process3.execArgv.includes("--use-env-proxy");
+}
+var proxyNoticed = false;
+function noticeProxy(env) {
+  if (proxyNoticed) return;
+  proxyNoticed = true;
+  const name = proxyVariableOf(env);
+  if (name === void 0 || envProxyEnabled(env)) return;
+  warn(`${name} is set; run with NODE_USE_ENV_PROXY=1 (Node 24+) so rshow uses it`);
+}
+var installed;
+function readyNetwork(env = process3.env) {
+  installed ??= installCaCertificates(env);
+  noticeProxy(env);
+  return installed;
+}
+function codesOf(err, depth = 0) {
+  if (depth > 5 || err === null || typeof err !== "object") return [];
+  const out = [];
+  const code = err.code;
+  if (typeof code === "string" && code !== "") out.push(code);
+  const inner = err.errors;
+  if (Array.isArray(inner)) for (const one of inner) out.push(...codesOf(one, depth + 1));
+  out.push(...codesOf(err.cause, depth + 1));
+  return out;
+}
+function deepestMessageOf(err, depth = 0) {
+  if (depth > 5 || err === null || typeof err !== "object") return "";
+  const cause = deepestMessageOf(err.cause, depth + 1);
+  if (cause !== "") return cause;
+  const message = messageOf(err);
+  return message === "" ? "" : message;
+}
+function hostOf(url) {
+  try {
+    return new URL(url).host;
+  } catch {
+    return url;
+  }
+}
+function faultOf(err, env = process3.env) {
+  const codes = codesOf(err).reverse();
+  for (const code of codes) {
+    const known = REASONS[code];
+    if (known === void 0) continue;
+    const hint = known.proxyHint === true ? proxyVariableOf(env) === void 0 ? PROXY_HINT : void 0 : known.hint;
+    return hint === void 0 ? { reason: known.reason } : { reason: known.reason, hint };
+  }
+  return { reason: codes[0] ?? deepestMessageOf(err) };
+}
+function networkDetail(err, url, env = process3.env) {
+  return `network error: ${hostOf(url)}: ${faultOf(err, env).reason}`;
+}
+function networkText(err, url, env = process3.env) {
+  const fault = faultOf(err, env);
+  const line = `network error: ${hostOf(url)}: ${fault.reason}`;
+  return fault.hint === void 0 ? line : `${line}
+hint: ${fault.hint}`;
+}
+async function sendRequest(fetchImpl, url, init, env = process3.env) {
+  await readyNetwork(env);
+  try {
+    return await fetchImpl(url, init);
+  } catch (err) {
+    throw new ApiError(networkText(err, url, env));
+  }
+}
+
+// src/client.ts
+function errorText(body, status2) {
   if (body !== null && typeof body === "object" && typeof body.error === "string") {
     return body.error;
   }
-  return `HTTP ${status}`;
+  return `HTTP ${status2}`;
 }
 function parseBody(text) {
   if (text.trim() === "") return void 0;
@@ -87,12 +324,7 @@ var Client = class {
       headers["content-type"] = opts.contentType ?? "application/octet-stream";
       body = opts.bytes;
     }
-    let res;
-    try {
-      res = await this.fetchImpl(this.baseUrl + pathname, { method, headers, body });
-    } catch (err) {
-      throw new ApiError(`network error: ${messageOf(err)}`);
-    }
+    const res = await sendRequest(this.fetchImpl, this.baseUrl + pathname, { method, headers, body });
     const text = await res.text();
     const parsed = parseBody(text);
     if (opts.allow404 === true && res.status === 404) return { status: 404, body: void 0 };
@@ -178,73 +410,9 @@ var Client = class {
 };
 
 // src/config.ts
-import { readFile } from "node:fs/promises";
-import { homedir } from "node:os";
-import path from "node:path";
-
-// src/keychain.ts
-import { spawn } from "node:child_process";
-import process from "node:process";
-var SERVICE = "rshow";
-var MISSING = 44;
-var NO_MACOS = "the keychain needs macOS; set RSHOW_TOKEN instead";
-function bin() {
-  return process.env.RSHOW_SECURITY_BIN ?? "security";
-}
-function usable() {
-  return process.platform === "darwin" || process.env.RSHOW_SECURITY_BIN !== void 0;
-}
-function run(args, input) {
-  return new Promise((resolve2, reject) => {
-    const child = spawn(bin(), args, { stdio: ["pipe", "pipe", "pipe"] });
-    let stdout = "";
-    let stderr = "";
-    child.stdout.setEncoding("utf8");
-    child.stdout.on("data", (chunk2) => {
-      stdout += chunk2;
-    });
-    child.stderr.setEncoding("utf8");
-    child.stderr.on("data", (chunk2) => {
-      stderr += chunk2;
-    });
-    child.stdin.on("error", () => {
-    });
-    child.on("error", (err) => {
-      if (err.code === "ENOENT") resolve2({ code: -1, stdout, stderr, absent: true });
-      else reject(new ApiError(`keychain: ${err.message}`));
-    });
-    child.on("close", (code) => resolve2({ code: code ?? -1, stdout, stderr, absent: false }));
-    child.stdin.end(input ?? "");
-  });
-}
-function failure(doing, result, secret) {
-  const text = secret === void 0 ? result.stderr : result.stderr.split(secret).join("[redacted]");
-  const detail = text.trim();
-  return new ApiError(`${doing}: ${detail === "" ? `exit ${result.code}` : detail}`);
-}
-async function save(url, token) {
-  if (!usable()) throw new UsageError(NO_MACOS);
-  const line = `add-generic-password -U -s ${SERVICE} -a ${url} -w ${token}
-`;
-  const result = await run(["-i"], line);
-  if (result.code !== 0) throw failure("cannot save the token in the keychain", result, token);
-  if (await read(url) !== token) throw failure("cannot save the token in the keychain", result, token);
-}
-async function read(url) {
-  if (!usable()) return void 0;
-  const result = await run(["find-generic-password", "-s", SERVICE, "-a", url, "-w"]);
-  if (result.absent || result.code === MISSING) return void 0;
-  if (result.code !== 0) throw failure("cannot read the token from the keychain", result);
-  const token = result.stdout.trim();
-  return token === "" ? void 0 : token;
-}
-async function remove(url) {
-  if (!usable()) throw new UsageError(NO_MACOS);
-  const result = await run(["delete-generic-password", "-s", SERVICE, "-a", url]);
-  if (result.absent || result.code === MISSING) return false;
-  if (result.code !== 0) throw failure("cannot remove the token from the keychain", result);
-  return true;
-}
+import { readFile as readFile3 } from "node:fs/promises";
+import { homedir as homedir3 } from "node:os";
+import path3 from "node:path";
 
 // ../shared/src/index.ts
 var SLUG_PATTERN = /^[a-z0-9][a-z0-9-]{0,62}$/;
@@ -291,8 +459,8 @@ function tagsOf(value) {
   if (!Array.isArray(value)) return [];
   return value.filter((tag) => typeof tag === "string").map((tag) => tag.toLowerCase());
 }
-function withTags(current, add2, remove3) {
-  const next = unique(tagsOf(current)).filter((tag) => !remove3.includes(tag));
+function withTags(current, add2, remove5) {
+  const next = unique(tagsOf(current)).filter((tag) => !remove5.includes(tag));
   for (const tag of add2) {
     if (!next.includes(tag)) next.push(tag);
   }
@@ -304,16 +472,306 @@ function sameTags(left, right) {
   return a.length === b.length && a.every((tag, index) => tag === b[index]);
 }
 
+// src/tokenstore.ts
+import process8 from "node:process";
+
+// src/credfile.ts
+import { chmod, mkdir as mkdir2, readFile as readFile2, rename as rename2, stat as stat2, unlink, writeFile as writeFile2 } from "node:fs/promises";
+import { homedir as homedir2 } from "node:os";
+import path2 from "node:path";
+import process4 from "node:process";
+var DIR = "rshow";
+var FILE = "credentials";
+var VERSION2 = 1;
+var FILE_MODE = 384;
+var DIR_MODE = 448;
+var SHARED = 63;
+var fixed = /* @__PURE__ */ new Set();
+function messageOf2(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function credentialsPath(env) {
+  const xdg = (env.XDG_CONFIG_HOME ?? "").trim();
+  const home = (env.HOME ?? "").trim();
+  const base = xdg !== "" ? xdg : path2.join(home !== "" ? home : homedir2(), ".config");
+  return path2.join(base, DIR, FILE);
+}
+async function tighten(file) {
+  await chmod(file, FILE_MODE).catch(() => {
+  });
+  if (fixed.has(file)) return;
+  fixed.add(file);
+  warn(`${file} was readable by group or other; its mode is now 600`);
+}
+async function load(file) {
+  const info = await stat2(file).catch(() => void 0);
+  if (info === void 0) return {};
+  if ((info.mode & SHARED) !== 0) await tighten(file);
+  let text;
+  try {
+    text = await readFile2(file, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") return {};
+    throw new UsageError(`cannot read ${file}: ${messageOf2(err)}`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw new UsageError(`invalid JSON in ${file}`);
+  }
+  if (!isRecord(parsed)) throw new UsageError(`${file} must hold a JSON object`);
+  if (parsed.version !== void 0 && parsed.version !== VERSION2) {
+    throw new UsageError(`${file}: version must be ${VERSION2}`);
+  }
+  const raw = parsed.tokens ?? {};
+  if (!isRecord(raw)) throw new UsageError(`${file}: tokens must be an object`);
+  const tokens = {};
+  for (const [url, token] of Object.entries(raw)) {
+    if (typeof token !== "string") throw new UsageError(`${file}: tokens.${url} must be a string`);
+    tokens[url] = token;
+  }
+  return tokens;
+}
+async function store(file, tokens) {
+  const dir = path2.dirname(file);
+  let created;
+  try {
+    created = await mkdir2(dir, { recursive: true, mode: DIR_MODE });
+  } catch (err) {
+    throw new UsageError(`cannot make ${dir}: ${messageOf2(err)}`);
+  }
+  if (created !== void 0) await chmod(dir, DIR_MODE).catch(() => {
+  });
+  const temp = path2.join(dir, `.${path2.basename(file)}.${process4.pid}.${Date.now()}.tmp`);
+  const body = `${JSON.stringify({ version: VERSION2, tokens }, null, 2)}
+`;
+  try {
+    await writeFile2(temp, body, { mode: FILE_MODE, flag: "wx" });
+    await chmod(temp, FILE_MODE);
+    await rename2(temp, file);
+  } catch (err) {
+    await unlink(temp).catch(() => {
+    });
+    throw new UsageError(`cannot write ${file}: ${messageOf2(err)}`);
+  }
+}
+async function read(file, url) {
+  return (await load(file))[url];
+}
+async function save(file, url, token) {
+  const tokens = await load(file);
+  tokens[url] = token;
+  await store(file, tokens);
+}
+async function remove(file, url) {
+  const tokens = await load(file);
+  if (tokens[url] === void 0) return false;
+  delete tokens[url];
+  if (Object.keys(tokens).length === 0) {
+    await unlink(file).catch((err) => {
+      if (err.code !== "ENOENT") throw new UsageError(`cannot remove ${file}: ${messageOf2(err)}`);
+    });
+    return true;
+  }
+  await store(file, tokens);
+  return true;
+}
+
+// src/keychain.ts
+import process6 from "node:process";
+
+// src/tool.ts
+import { spawn } from "node:child_process";
+import process5 from "node:process";
+function childEnv(env) {
+  const out = { ...process5.env };
+  for (const [key2, value] of Object.entries(env ?? {})) {
+    if (value === void 0) delete out[key2];
+    else out[key2] = value;
+  }
+  return out;
+}
+function runTool(bin3, args, input, env) {
+  return new Promise((resolve2, reject) => {
+    const child = spawn(bin3, args, { stdio: ["pipe", "pipe", "pipe"], env: childEnv(env) });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.setEncoding("utf8");
+    child.stdout.on("data", (chunk2) => {
+      stdout += chunk2;
+    });
+    child.stderr.setEncoding("utf8");
+    child.stderr.on("data", (chunk2) => {
+      stderr += chunk2;
+    });
+    child.stdin.on("error", () => {
+    });
+    child.on("error", (err) => {
+      if (err.code === "ENOENT") resolve2({ code: -1, stdout, stderr, absent: true });
+      else reject(new ApiError(`${bin3}: ${err.message}`));
+    });
+    child.on("close", (code) => resolve2({ code: code ?? -1, stdout, stderr, absent: false }));
+    child.stdin.end(input ?? "");
+  });
+}
+function toolFailure(doing, result, secret) {
+  const text = secret === void 0 ? result.stderr : result.stderr.split(secret).join("[redacted]");
+  const detail = text.trim();
+  return new ApiError(`${doing}: ${detail === "" ? `exit ${result.code}` : detail}`);
+}
+
+// src/keychain.ts
+var SERVICE = "rshow";
+var MISSING = 44;
+function bin(env) {
+  const set = (env.RSHOW_SECURITY_BIN ?? "").trim();
+  return set === "" ? "security" : set;
+}
+function canSave(platform = process6.platform, securityBin = process6.env.RSHOW_SECURITY_BIN) {
+  return platform === "darwin" || (securityBin ?? "").trim() !== "";
+}
+async function save2(url, token, env = process6.env) {
+  if (!canSave(process6.platform, env.RSHOW_SECURITY_BIN)) {
+    throw new UsageError("the keychain needs macOS; set RSHOW_TOKEN instead");
+  }
+  const line = `add-generic-password -U -s ${SERVICE} -a ${url} -w ${token}
+`;
+  const result = await runTool(bin(env), ["-i"], line, env);
+  if (result.code !== 0) throw toolFailure("cannot save the token in the keychain", result, token);
+  if (await read2(url, env) !== token) {
+    throw toolFailure("cannot save the token in the keychain", result, token);
+  }
+}
+async function read2(url, env = process6.env) {
+  if (!canSave(process6.platform, env.RSHOW_SECURITY_BIN)) return void 0;
+  const args = ["find-generic-password", "-s", SERVICE, "-a", url, "-w"];
+  const result = await runTool(bin(env), args, void 0, env);
+  if (result.absent || result.code === MISSING) return void 0;
+  if (result.code !== 0) throw toolFailure("cannot read the token from the keychain", result);
+  const token = result.stdout.trim();
+  return token === "" ? void 0 : token;
+}
+async function remove2(url, env = process6.env) {
+  if (!canSave(process6.platform, env.RSHOW_SECURITY_BIN)) return false;
+  const args = ["delete-generic-password", "-s", SERVICE, "-a", url];
+  const result = await runTool(bin(env), args, void 0, env);
+  if (result.absent || result.code === MISSING) return false;
+  if (result.code !== 0) throw toolFailure("cannot remove the token from the keychain", result);
+  return true;
+}
+
+// src/keyring.ts
+import process7 from "node:process";
+var SERVICE2 = "rshow";
+var PROBE_SERVICE = "rshow-probe";
+var PROBE_ACCOUNT = "probe";
+var NOT_FOUND = 1;
+function bin2(env) {
+  const set = (env.RSHOW_SECRET_TOOL_BIN ?? "").trim();
+  return set === "" ? "secret-tool" : set;
+}
+function canUse(env, platform = process7.platform) {
+  return platform === "linux" || (env.RSHOW_SECRET_TOOL_BIN ?? "").trim() !== "";
+}
+async function usable(env = process7.env) {
+  const args = ["lookup", "service", PROBE_SERVICE, "account", PROBE_ACCOUNT];
+  const result = await runTool(bin2(env), args, void 0, env);
+  return !result.absent && (result.code === 0 || result.code === NOT_FOUND);
+}
+async function save3(url, token, env = process7.env) {
+  const args = ["store", "--label", `rshow ${url}`, "service", SERVICE2, "account", url];
+  const result = await runTool(bin2(env), args, token, env);
+  if (result.code !== 0) throw toolFailure("cannot save the token in the keyring", result, token);
+  if (await read3(url, env) !== token) {
+    throw toolFailure("cannot save the token in the keyring", result, token);
+  }
+}
+async function read3(url, env = process7.env) {
+  const args = ["lookup", "service", SERVICE2, "account", url];
+  const result = await runTool(bin2(env), args, void 0, env);
+  if (result.absent || result.code === NOT_FOUND) return void 0;
+  if (result.code !== 0) throw toolFailure("cannot read the token from the keyring", result);
+  const token = result.stdout.trim();
+  return token === "" ? void 0 : token;
+}
+async function remove3(url, env = process7.env) {
+  const args = ["clear", "service", SERVICE2, "account", url];
+  const result = await runTool(bin2(env), args, void 0, env);
+  if (result.absent || result.code === NOT_FOUND) return false;
+  if (result.code !== 0) throw toolFailure("cannot remove the token from the keyring", result);
+  return true;
+}
+
+// src/tokenstore.ts
+var BACKENDS = ["keychain", "keyring", "file"];
+function storeOf(backend, env) {
+  if (backend === "keychain") {
+    return {
+      backend,
+      detail: "keychain",
+      description: "the macOS Keychain",
+      read: (url) => read2(url, env),
+      save: (url, token) => save2(url, token, env),
+      remove: (url) => remove2(url, env)
+    };
+  }
+  if (backend === "keyring") {
+    return {
+      backend,
+      detail: "keyring",
+      description: "the Linux keyring",
+      read: (url) => read3(url, env),
+      save: (url, token) => save3(url, token, env),
+      remove: (url) => remove3(url, env)
+    };
+  }
+  const file = credentialsPath(env);
+  return {
+    backend,
+    detail: `file ${file}`,
+    description: `${file} (mode 600)`,
+    read: (url) => read(file, url),
+    save: (url, token) => save(file, url, token),
+    remove: (url) => remove(file, url)
+  };
+}
+function forced(env) {
+  const text = (env.RSHOW_TOKEN_STORE ?? "").trim();
+  if (text === "") return void 0;
+  for (const backend of BACKENDS) {
+    if (backend === text) return backend;
+  }
+  throw new UsageError(`RSHOW_TOKEN_STORE must be keychain, keyring or file, not ${text}`);
+}
+async function choose(env = process8.env, platform = process8.platform) {
+  const forcedBackend = forced(env);
+  if (forcedBackend !== void 0) return storeOf(forcedBackend, env);
+  if (canSave(platform, env.RSHOW_SECURITY_BIN)) return storeOf("keychain", env);
+  if (canUse(env, platform) && await usable(env)) return storeOf("keyring", env);
+  return storeOf("file", env);
+}
+async function every(env = process8.env, platform = process8.platform) {
+  const stores = [];
+  if (canSave(platform, env.RSHOW_SECURITY_BIN)) stores.push(storeOf("keychain", env));
+  if (canUse(env, platform) && await usable(env)) stores.push(storeOf("keyring", env));
+  stores.push(storeOf("file", env));
+  return stores;
+}
+
 // src/config.ts
 var DEFAULT_OUT = "dist";
 var GLOBAL_DIR = "rshow";
 var GLOBAL_FILE = "config.json";
 var LOCAL_FILE = "rshow.json";
 var NO_SERVER = "no server configured: run rshow init --url <admin-url> --art <viewer-url>";
-function messageOf2(err) {
+function messageOf3(err) {
   return err instanceof Error ? err.message : String(err);
 }
-function isRecord(value) {
+function isRecord2(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function withoutSlash(value) {
@@ -322,14 +780,14 @@ function withoutSlash(value) {
 function globalConfigPath(env) {
   const xdg = (env.XDG_CONFIG_HOME ?? "").trim();
   const home = (env.HOME ?? "").trim();
-  const base = xdg !== "" ? xdg : path.join(home !== "" ? home : homedir(), ".config");
-  return path.join(base, GLOBAL_DIR, GLOBAL_FILE);
+  const base = xdg !== "" ? xdg : path3.join(home !== "" ? home : homedir3(), ".config");
+  return path3.join(base, GLOBAL_DIR, GLOBAL_FILE);
 }
 function localConfigPath(dir) {
-  return path.join(path.resolve(dir), LOCAL_FILE);
+  return path3.join(path3.resolve(dir), LOCAL_FILE);
 }
 function layerOf(file, value) {
-  if (!isRecord(value)) throw new UsageError(`${file} must hold a JSON object`);
+  if (!isRecord2(value)) throw new UsageError(`${file} must hold a JSON object`);
   const fieldOf = (key2) => {
     const raw = value[key2];
     if (raw === void 0 || raw === null) return void 0;
@@ -349,7 +807,7 @@ function layerOf(file, value) {
   };
   const rawTokens = value.tokens;
   if (rawTokens !== void 0 && rawTokens !== null) {
-    if (!isRecord(rawTokens)) throw new UsageError(`${file}: tokens must be an object`);
+    if (!isRecord2(rawTokens)) throw new UsageError(`${file}: tokens must be an object`);
     const tokens = {};
     for (const [key2, raw] of Object.entries(rawTokens)) {
       if (typeof raw !== "string") throw new UsageError(`${file}: tokens.${key2} must be a string`);
@@ -371,10 +829,10 @@ function layerOf(file, value) {
 async function readConfigFile(file) {
   let text;
   try {
-    text = await readFile(file, "utf8");
+    text = await readFile3(file, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return {};
-    throw new UsageError(`cannot read ${file}: ${messageOf2(err)}`);
+    throw new UsageError(`cannot read ${file}: ${messageOf3(err)}`);
   }
   let parsed;
   try {
@@ -436,13 +894,14 @@ function requireArt(config) {
 async function readToken(env, url) {
   const token = (env.RSHOW_TOKEN ?? "").trim();
   if (token !== "") return token;
-  const saved = await read(url);
+  const store2 = await choose(env);
+  const saved = await store2.read(url);
   if (saved !== void 0) return saved;
   throw new UsageError("no token: run rshow login, or set RSHOW_TOKEN");
 }
 
 // src/output.ts
-import process2 from "node:process";
+import process9 from "node:process";
 var Output = class {
   json;
   constructor(json) {
@@ -450,16 +909,16 @@ var Output = class {
   }
   data(value) {
     if (!this.json) return;
-    process2.stdout.write(`${JSON.stringify(value ?? null, null, 2)}
+    process9.stdout.write(`${JSON.stringify(value ?? null, null, 2)}
 `);
   }
   line(text) {
     if (this.json) return;
-    process2.stdout.write(`${text}
+    process9.stdout.write(`${text}
 `);
   }
   raw(text) {
-    process2.stdout.write(`${text}
+    process9.stdout.write(`${text}
 `);
   }
 };
@@ -475,12 +934,13 @@ commands:
   preview <dir>           serve a folder on 127.0.0.1 for a look, offline
   config [dir]            print the merged config as JSON
   init --url u --art a    write the global config file
-  doctor [dir]            check node, config, token, api, art and theme
+  doctor [dir]            check node, config, token, api, art, theme, skills
   theme new <name>        write a preset folder from a built-in theme
   theme check <dir>       check a theme folder, preset or full
   theme preview <dir>     build a theme, serve it on 127.0.0.1 for a look
   theme publish <dir>     publish a theme folder as theme-<name>
   theme list              list theme artifacts
+  skills <cmd>            install, remove or show the agent skills, per target
   project <cmd>           create, list, show, share or delete a project
   tag <slug>              add or remove tags on an artifact
   list [filters]          list artifacts you own or share
@@ -488,7 +948,7 @@ commands:
   share <slug>            set mode or change shares
   pin <slug> <n|live>     serve version n, or live for the newest
   delete <slug> --yes     delete an artifact
-  login [--url u]         save the API token in the macOS Keychain
+  login [--url u]         save the API token for this account
   logout [--url u]        remove the saved token for a server
 
 global:
@@ -499,9 +959,13 @@ global:
 environment:
   RSHOW_URL               API base URL, overrides the config file
   RSHOW_ART               art base URL, overrides the config file
-  RSHOW_TOKEN             the API token, else the token saved by rshow login
-                          in the macOS Keychain; never read from a file
-  XDG_CONFIG_HOME         where to find rshow/config.json (default ~/.config)
+  RSHOW_TOKEN             the API token, else the token rshow login saved in
+                          the macOS Keychain, the Linux keyring or a 0600 file
+  RSHOW_TOKEN_STORE       force the keychain, keyring or file token store
+  XDG_CONFIG_HOME         where rshow keeps config.json and credentials
+  RSHOW_SYSTEM_CA         set to 0 to trust only the roots node bundles
+  RSHOW_EXTRA_CA_FILE     a PEM file of extra roots, such as a cluster's CA
+  NODE_USE_ENV_PROXY      set to 1 so fetch uses https_proxy (Node 24+)
 
 Start here: rshow init --url <admin-url> --art <viewer-url>, then rshow login.
 
@@ -599,8 +1063,8 @@ files win. Run rshow init to write url and art.
 A theme with no version, or @latest, is looked up on the art host and printed
 as <name>@<n>; when that fails a warning goes to stderr. --offline skips it, and
 so does a config with no art host.
-The token is RSHOW_TOKEN, else the token saved by rshow login in the macOS
-Keychain; never read from a file.`;
+The token is RSHOW_TOKEN, else the token rshow login saved in the macOS
+Keychain, the Linux keyring or a file with mode 600.`;
 var INIT_USAGE = `usage: rshow init --url <admin-url> --art <viewer-url> [--theme <name>] [--force]
 
 Writes the global config file that rshow reads first:
@@ -616,9 +1080,11 @@ Prints the path it wrote and the next step: rshow login. --json prints
 var DOCTOR_USAGE = `usage: rshow doctor [dir] [--json]
 
 Checks the rshow version, the node version against the engines.node of the
-package, the config files, the token, the api, the art host and the theme, one
-line each: ok|warn|fail  <check>  <detail>. With [dir] it reads <dir>/rshow.json too.
+package, the config files, the token, the api, the art host, the theme and the
+skills, one line each: ok|warn|fail  <check>  <detail>. With [dir] it reads
+<dir>/rshow.json too. A skill line warns and never fails.
 Network calls time out after 5 s. Exit 0 when no check failed, 6 when one did.
+The token line names its source: env, keychain, keyring, or file and its path.
 The token is never printed.`;
 var THEME_USAGE = `usage: rshow theme <new|check|preview|publish|list> [options]
 
@@ -676,6 +1142,54 @@ Prints /_themes/<name>@<n>/.`;
 var THEME_LIST_USAGE = `usage: rshow theme list
 
 Lists artifacts whose slug starts with theme- and their served version.`;
+var SKILLS_USAGE = `usage: rshow skills <install|uninstall|status> [target ...] [options]
+
+  skills install [target ...]    link or copy the three skills into an agent
+  skills uninstall [target ...]  remove the links and copies rshow made
+  skills status [target ...]     say what each target holds, per skill
+
+A target is where an agent reads its skills from:
+  claude   $HOME/.claude/skills
+  pi       $HOME/.pi/agent/skills
+  codex    $HOME/.codex/skills
+With no target, every target whose parent folder exists is used.`;
+var SKILLS_INSTALL_USAGE = `usage: rshow skills install [target ...] [--link|--copy] [--dry-run]
+
+Puts the three skills rshow ships, rshow, rshow-slides and rshow-implement, in
+the skills folder of every target, so that claude, pi and codex read them:
+$HOME/.claude/skills, $HOME/.pi/agent/skills and $HOME/.codex/skills. With no
+target, every target whose parent folder exists is used; naming one of claude,
+pi and codex picks it, and a usage error names them when none is detected.
+Each skill is a symlink to the folder rshow reads it from, so an upgrade of
+rshow is nothing to do. --copy copies the folder and writes a .rshow-skill
+marker in it, {"version": <rshow version>, "source": "rshow"}, which is how a
+newer rshow knows the copy is its own. The default is a link, and a copy when
+that folder sits in an npx cache, which npm may delete under a link, or when
+rshow runs as a single executable, whose files live in a per-version cache.
+A skill that is ours and current prints ok, and one of ours from another path or
+another version is replaced and prints updated. Anything else, a folder, a file
+or a link that rshow did not make, is left alone: skip goes to stderr, the rest
+is still installed, and the run exits 6.
+--dry-run prints what would happen, with would, and changes nothing.
+Prints one line per skill, then installed <n> skills for <targets>; --json
+prints {targets, actions: [{target, skill, action, path}]}.
+RSHOW_SKILLS_DIR reads the skills from another folder.`;
+var SKILLS_UNINSTALL_USAGE = `usage: rshow skills uninstall [target ...] [--dry-run]
+
+Removes the skills rshow put in every target: a symlink into a skills folder
+that holds rshow skills, and a copy that carries the .rshow-skill marker.
+It removes nothing else, with no line and no error. With no target, every
+target whose parent folder exists is used.
+Prints removed <path> per skill, then removed <n> skills for <targets>, and
+--dry-run prints what would happen, with would, and changes nothing.`;
+var SKILLS_STATUS_USAGE = `usage: rshow skills status [target ...] [--json]
+
+Prints one line per target and skill, <target>  <skill>  <state>, where the
+state is link -> <path>, copy v<version>, missing or foreign. It prints nothing
+for a target whose parent folder does not exist, and --json prints {targets,
+actions: [{target, skill, action, path}]}.
+A copy of another version also warns on stderr, because rshow skills install
+replaces it.`;
 var LIST_USAGE = `usage: rshow list [--project p] [--tag t] [--q text]
 
 Lists artifacts you own or that are shared with you.
@@ -697,14 +1211,19 @@ var DELETE_USAGE = `usage: rshow delete <slug> --yes
 Deletes the artifact and needs --yes.`;
 var LOGIN_USAGE = `usage: rshow login [--url u]
 
-Reads the token from stdin, checks it against the API, then saves it in the
-macOS Keychain. On a terminal it asks for the token with echo off, so it is
-never typed on a command line or pasted anywhere. The API base URL is the
-account, so each server keeps its own token; --url logs in to another one.
-RSHOW_TOKEN still wins over the saved token.`;
+Reads the token from stdin, checks it with the API, then saves it in the macOS
+Keychain, in the Linux keyring, or in $XDG_CONFIG_HOME/rshow/credentials with
+mode 600: the first store this machine has, and it reads it back to confirm.
+On a terminal it asks for the token with echo off, so it is never typed on a
+command line or pasted anywhere. The API base URL is the account, so each
+server keeps its own token; --url logs in to another one.
+Prints the email, the scope and where the token went.
+RSHOW_TOKEN still wins over the saved token, and RSHOW_TOKEN_STORE forces one
+of keychain, keyring or file.`;
 var LOGOUT_USAGE = `usage: rshow logout [--url u]
 
-Removes the token this server has in the macOS Keychain.`;
+Removes the token this server has from every store that holds it: the macOS
+Keychain, the Linux keyring and the 0600 credentials file.`;
 var PROJECT_USAGE = `usage: rshow project <create|list|show|share|delete> [options]
 
   project create <slug> [--title t] [--description d]
@@ -830,14 +1349,14 @@ function usageLine(usage) {
 }
 
 // src/commands/publish.ts
-import { stat as stat3 } from "node:fs/promises";
-import path6 from "node:path";
+import { stat as stat5 } from "node:fs/promises";
+import path8 from "node:path";
 
 // src/args.ts
 import { parseArgs } from "node:util";
 var LIST_FLAGS = /* @__PURE__ */ new Set(["--add", "--editor", "--remove", "--tag"]);
 var LOWERCASE_TAG = new RegExp(TAG_PATTERN.source, "i");
-function messageOf3(err) {
+function messageOf4(err) {
   return err instanceof Error ? err.message : String(err);
 }
 function isListValue(token) {
@@ -873,7 +1392,7 @@ function parseCommandArgs(argv, options, minPositionals, maxPositionals, hint) {
   try {
     parsed = parseArgs({ args: expanded, options, allowPositionals: true, strict: true });
   } catch (err) {
-    throw new UsageError(`${messageOf3(err)} (try: ${usageLine(hint)})`);
+    throw new UsageError(`${messageOf4(err)} (try: ${usageLine(hint)})`);
   }
   const count = parsed.positionals.length;
   if (count < minPositionals || count > maxPositionals) {
@@ -905,21 +1424,21 @@ function emailList(args, name) {
 
 // src/build.ts
 import { spawn as spawn2 } from "node:child_process";
-import process3 from "node:process";
-function messageOf4(err) {
+import process10 from "node:process";
+function messageOf5(err) {
   return err instanceof Error ? err.message : String(err);
 }
 function shellPath(env) {
   const shell = (env.SHELL ?? "").trim();
   return shell === "" ? "/bin/sh" : shell;
 }
-async function runBuild(dir, command, env = process3.env) {
+async function runBuild(dir, command, env = process10.env) {
   const code = await new Promise((resolve2, reject) => {
     const child = spawn2(shellPath(env), ["-c", command], { cwd: dir, stdio: "inherit" });
     child.once("error", reject);
     child.once("close", (value) => resolve2(value));
   }).catch((err) => {
-    throw new BuildError(`build failed: ${messageOf4(err)}`);
+    throw new BuildError(`build failed: ${messageOf5(err)}`);
   });
   if (code !== 0) {
     throw new BuildError(`build failed: ${code === null ? "killed by a signal" : `exit ${code}`}`);
@@ -927,12 +1446,12 @@ async function runBuild(dir, command, env = process3.env) {
 }
 
 // src/check.ts
-import { readFile as readFile4, readdir, stat } from "node:fs/promises";
-import path4 from "node:path";
+import { readFile as readFile6, readdir, stat as stat3 } from "node:fs/promises";
+import path6 from "node:path";
 
 // src/mockup.ts
-import { readFile as readFile2 } from "node:fs/promises";
-import path2 from "node:path";
+import { readFile as readFile4 } from "node:fs/promises";
+import path4 from "node:path";
 var MAX_SCAN_BYTES = 4 * 1024 * 1024;
 var HTML_EXTENSIONS = /* @__PURE__ */ new Set([".html", ".htm"]);
 var MIN_COLS = 80;
@@ -1002,20 +1521,20 @@ function idOf(value) {
   const id = String(value ?? "").trim().replace(/^#/, "");
   return id === "" ? void 0 : id;
 }
-function warn(scan, line, message) {
+function warn2(scan, line, message) {
   scan.out.push({ path: scan.path, line, message });
 }
 function keyHint(scan, masked, from, to, line) {
   const hit = TERMINAL_KEYS.exec(masked.slice(from, to).replace(ANY_TAG, ""));
   if (hit === null) return;
-  warn(scan, line, `key hint binds the terminal's key: ${hit[0].trim()}`);
+  warn2(scan, line, `key hint binds the terminal's key: ${hit[0].trim()}`);
 }
 function sizeGate(scan, attrs, line) {
   if (attrs.has("data-allow-small")) return;
   const cols = sizeOf(attrs, "data-cols", MIN_COLS);
   const rows = sizeOf(attrs, "data-rows", MIN_ROWS);
   if (cols >= MIN_COLS && rows >= MIN_ROWS) return;
-  warn(scan, line, `tui below the 80x24 minimum (${cols}x${rows}), or mark it with data-allow-small`);
+  warn2(scan, line, `tui below the 80x24 minimum (${cols}x${rows}), or mark it with data-allow-small`);
 }
 function walk(scan, masked) {
   const stack = [];
@@ -1095,25 +1614,25 @@ function resolve(scan) {
     ids.add(item.id);
     const count = (seen.get(item.id) ?? 0) + 1;
     seen.set(item.id, count);
-    if (count === 2) warn(scan, item.line, `duplicate artboard id: ${item.id}`);
+    if (count === 2) warn2(scan, item.line, `duplicate artboard id: ${item.id}`);
   }
   const unknown = /* @__PURE__ */ new Set();
   for (const flow of scan.flows) {
     if (ids.has(flow.id) || unknown.has(flow.id)) continue;
     unknown.add(flow.id);
-    warn(scan, flow.line, `flow to #${flow.id} is not an artboard id in this file`);
+    warn2(scan, flow.line, `flow to #${flow.id} is not an artboard id in this file`);
   }
   for (const item of scan.boards) {
-    if (!item.title) warn(scan, item.line, `artboard ${item.label} has no data-title`);
+    if (!item.title) warn2(scan, item.line, `artboard ${item.label} has no data-title`);
     for (const block of item.blocks) {
       const missing = block.states.filter((state) => state !== "default" && !item.states.includes(state));
       if (missing.length === 0) continue;
-      warn(scan, block.line, `block data-state "${missing.join(",")}" is not in the artboard data-states`);
+      warn2(scan, block.line, `block data-state "${missing.join(",")}" is not in the artboard data-states`);
     }
     for (const state of item.states) {
       if (state === "default") continue;
       if (item.blocks.some((block) => block.states.includes(state))) continue;
-      warn(scan, item.line, `artboard ${item.label} lists state "${state}" that no block uses`);
+      warn2(scan, item.line, `artboard ${item.label} lists state "${state}" that no block uses`);
     }
   }
 }
@@ -1127,9 +1646,9 @@ function htmlWarnings(rel, text) {
 async function mockupWarnings(entries) {
   const out = [];
   for (const entry of entries) {
-    const ext = path2.extname(entry.rel).toLowerCase();
+    const ext = path4.extname(entry.rel).toLowerCase();
     if (!HTML_EXTENSIONS.has(ext) || entry.size > MAX_SCAN_BYTES) continue;
-    const text = await readFile2(entry.abs, "utf8").catch(() => void 0);
+    const text = await readFile4(entry.abs, "utf8").catch(() => void 0);
     if (text === void 0) continue;
     out.push(...htmlWarnings(entry.rel, text));
   }
@@ -1137,8 +1656,8 @@ async function mockupWarnings(entries) {
 }
 
 // src/style.ts
-import { readFile as readFile3 } from "node:fs/promises";
-import path3 from "node:path";
+import { readFile as readFile5 } from "node:fs/promises";
+import path5 from "node:path";
 var MAX_SCAN_BYTES2 = 4 * 1024 * 1024;
 var STYLE_EXTENSIONS = /* @__PURE__ */ new Set([".html", ".htm", ".css"]);
 var GENERIC_FAMILIES = /* @__PURE__ */ new Set([
@@ -1535,9 +2054,9 @@ async function styleWarnings(entries) {
   const loaded = /* @__PURE__ */ new Set();
   const used = [];
   for (const entry of entries) {
-    const ext = path3.extname(entry.rel).toLowerCase();
+    const ext = path5.extname(entry.rel).toLowerCase();
     if (!STYLE_EXTENSIONS.has(ext) || entry.size > MAX_SCAN_BYTES2) continue;
-    const text = await readFile3(entry.abs, "utf8").catch(() => void 0);
+    const text = await readFile5(entry.abs, "utf8").catch(() => void 0);
     if (text === void 0) continue;
     collectLoaded(text, loaded);
     if (stylePathSkipped(entry.rel)) continue;
@@ -1588,9 +2107,6 @@ var CONNECT_PATTERNS = [
     pattern: /\.open\s*\(\s*["'`][A-Za-z]+["'`]\s*,\s*["'`](https?:\/\/[^"'`\s)]+)/g
   }
 ];
-function messageOf5(err) {
-  return err instanceof Error ? err.message : String(err);
-}
 function add(scan, file, line, severity, message) {
   scan.findings.push({ path: file, line, severity, message });
 }
@@ -1641,7 +2157,7 @@ function attributes2(raw) {
   }
   return found;
 }
-function hostOf(value) {
+function hostOf2(value) {
   if (!EXTERNAL.test(value) || IGNORED.test(value)) return void 0;
   try {
     const host = new URL(value, BASE_URL).hostname;
@@ -1665,7 +2181,7 @@ function resolvePath(file, ref) {
     decoded = ref;
   }
   const wantsIndex = decoded.endsWith("/");
-  const base = path4.posix.dirname(file);
+  const base = path6.posix.dirname(file);
   const parts2 = base === "." ? [] : base.split("/");
   for (const segment of decoded.split("/")) {
     if (segment === "" || segment === ".") continue;
@@ -1716,7 +2232,7 @@ function resolveRef(scan, file, raw, line) {
 }
 function checkScript(scan, file, line, attrs) {
   const value = (attrs.get("src") ?? "").trim();
-  const host = hostOf(value);
+  const host = hostOf2(value);
   if (host === void 0) return;
   if (!SCRIPT_HOSTS.includes(host)) {
     add(scan, file, line, "error", `script host not allowed: ${value} (allowed: ${SCRIPT_HOSTS.join(", ")})`);
@@ -1732,7 +2248,7 @@ function checkLink(scan, file, line, attrs) {
   const rel = (attrs.get("rel") ?? "").toLowerCase().split(/\s+/);
   if (!rel.includes("stylesheet")) return;
   const value = (attrs.get("href") ?? "").trim();
-  const host = hostOf(value);
+  const host = hostOf2(value);
   if (host === void 0 || STYLE_HOSTS.includes(host)) return;
   add(scan, file, line, "error", `stylesheet host not allowed: ${value} (allowed: ${STYLE_HOSTS.join(", ")})`);
 }
@@ -1788,9 +2304,9 @@ function scanHtml(scan, file, text, facts) {
   scanConnect(scan, file, masked, at);
 }
 async function scanFile(scan, entry, facts) {
-  const ext = path4.extname(entry.rel).toLowerCase();
+  const ext = path6.extname(entry.rel).toLowerCase();
   if (!SCAN_EXTENSIONS.has(ext) || entry.size > MAX_SCAN_BYTES3) return;
-  const text = await readFile4(entry.abs, "utf8");
+  const text = await readFile6(entry.abs, "utf8");
   if (ext === ".html" || ext === ".htm") {
     scanHtml(scan, entry.rel, text, facts);
     return;
@@ -1805,7 +2321,7 @@ async function collect(scan, dir, prefix, entries) {
   for (const item of items) {
     if (item.name.startsWith(".") || SKIPPED_NAMES.has(item.name)) continue;
     const rel = prefix === "" ? item.name : `${prefix}/${item.name}`;
-    const abs = path4.join(dir, item.name);
+    const abs = path6.join(dir, item.name);
     const problem = pathProblem(rel);
     if (problem !== void 0) add(scan, rel, 1, "error", problem);
     if (item.isDirectory()) {
@@ -1813,54 +2329,56 @@ async function collect(scan, dir, prefix, entries) {
       continue;
     }
     if (!item.isFile()) continue;
-    const info = await stat(abs).catch(() => void 0);
+    const info = await stat3(abs).catch(() => void 0);
     if (info === void 0) continue;
     entries.push({ rel, abs, size: info.size });
   }
 }
 async function checkThemeFile(scan, key2, rel, where) {
   const url = `${scan.art}/_themes/${key2}/${rel}`;
-  let status;
+  let status2;
+  await readyNetwork();
   try {
     const reply = await scan.fetchImpl(url, { method: "HEAD" });
-    status = reply.status;
+    status2 = reply.status;
   } catch (err) {
-    add(scan, where.file, where.line, "warning", `cannot check theme ${key2}/${rel}: ${messageOf5(err)}`);
+    add(scan, where.file, where.line, "warning", `cannot check theme ${key2}/${rel}: ${networkDetail(err, url)}`);
     return;
   }
-  if (status === 404) add(scan, where.file, where.line, "error", `theme ${key2} has no ${rel} (${url})`);
-  else if (status < 200 || status > 399) {
-    add(scan, where.file, where.line, "warning", `cannot check theme ${key2}/${rel}: HTTP ${status}`);
+  if (status2 === 404) add(scan, where.file, where.line, "error", `theme ${key2} has no ${rel} (${url})`);
+  else if (status2 < 200 || status2 > 399) {
+    add(scan, where.file, where.line, "warning", `cannot check theme ${key2}/${rel}: HTTP ${status2}`);
   }
 }
 async function checkTheme(scan, key2, where) {
   if (scan.offline || scan.art === "") return;
   const url = `${scan.art}/_themes/${key2}/tokens.css`;
-  let status;
+  let status2;
+  await readyNetwork();
   try {
     const reply = await scan.fetchImpl(url, { method: "HEAD" });
-    status = reply.status;
+    status2 = reply.status;
   } catch (err) {
-    add(scan, where.file, where.line, "warning", `cannot check theme ${key2}: ${messageOf5(err)}`);
+    add(scan, where.file, where.line, "warning", `cannot check theme ${key2}: ${networkDetail(err, url)}`);
     return;
   }
-  if (status === 404) {
+  if (status2 === 404) {
     add(scan, where.file, where.line, "error", `theme ${key2} is not published (${url})`);
     return;
   }
-  if (status < 200 || status > 399) {
-    add(scan, where.file, where.line, "warning", `cannot check theme ${key2}: HTTP ${status}`);
+  if (status2 < 200 || status2 > 399) {
+    add(scan, where.file, where.line, "warning", `cannot check theme ${key2}: HTTP ${status2}`);
     return;
   }
-  if (status > 299) return;
+  if (status2 > 299) return;
   for (const [rel, ref] of where.files) {
     if (rel === "tokens.css") continue;
     await checkThemeFile(scan, key2, rel, ref);
   }
 }
 async function checkFolder(input, opts = {}) {
-  const root = path4.resolve(input);
-  const info = await stat(root).catch(() => void 0);
+  const root2 = path6.resolve(input);
+  const info = await stat3(root2).catch(() => void 0);
   if (info === void 0 || !info.isDirectory()) throw new UsageError(`no such folder: ${input}`);
   const scan = {
     files: /* @__PURE__ */ new Set(),
@@ -1871,7 +2389,7 @@ async function checkFolder(input, opts = {}) {
     themes: /* @__PURE__ */ new Map()
   };
   const entries = [];
-  await collect(scan, root, "", entries);
+  await collect(scan, root2, "", entries);
   let bytes = 0;
   for (const entry of entries) {
     scan.files.add(entry.rel);
@@ -1952,7 +2470,7 @@ function reportCheck(out, result) {
   out.line(summaryLine(result));
 }
 async function enforceCheck(out, target, opts = {}) {
-  const info = await stat(target).catch(() => void 0);
+  const info = await stat3(target).catch(() => void 0);
   if (info === void 0 || !info.isDirectory()) return;
   const result = await checkFolder(target, opts);
   if (result.findings.length > 0) reportCheck(out, result);
@@ -1960,12 +2478,12 @@ async function enforceCheck(out, target, opts = {}) {
 }
 
 // src/publish.ts
-import { readFile as readFile6 } from "node:fs/promises";
+import { readFile as readFile8 } from "node:fs/promises";
 
 // src/files.ts
 import { createHash } from "node:crypto";
-import { readdir as readdir2, readFile as readFile5, stat as stat2 } from "node:fs/promises";
-import path5 from "node:path";
+import { readdir as readdir2, readFile as readFile7, stat as stat4 } from "node:fs/promises";
+import path7 from "node:path";
 var CONTENT_TYPES = {
   html: "text/html; charset=utf-8",
   css: "text/css; charset=utf-8",
@@ -1997,14 +2515,14 @@ var CONTENT_TYPES = {
 var DEFAULT_CONTENT_TYPE = "application/octet-stream";
 var SKIPPED_NAMES2 = /* @__PURE__ */ new Set(["node_modules"]);
 function contentTypeFor(filePath) {
-  const ext = path5.extname(filePath).replace(/^\./, "").toLowerCase();
+  const ext = path7.extname(filePath).replace(/^\./, "").toLowerCase();
   return CONTENT_TYPES[ext] ?? DEFAULT_CONTENT_TYPE;
 }
 function sha256Hex(bytes) {
   return createHash("sha256").update(bytes).digest("hex");
 }
 async function readEntry(abs, rel) {
-  const bytes = await readFile5(abs);
+  const bytes = await readFile7(abs);
   return {
     path: rel,
     file: abs,
@@ -2013,7 +2531,7 @@ async function readEntry(abs, rel) {
     type: contentTypeFor(rel)
   };
 }
-async function collectPaths(root) {
+async function collectPaths(root2) {
   const found = [];
   async function walk2(dir, prefix) {
     const entries = await readdir2(dir, { withFileTypes: true });
@@ -2022,7 +2540,7 @@ async function collectPaths(root) {
       if (entry.name.startsWith(".")) continue;
       if (SKIPPED_NAMES2.has(entry.name)) continue;
       const rel = prefix === "" ? entry.name : `${prefix}/${entry.name}`;
-      const abs = path5.join(dir, entry.name);
+      const abs = path7.join(dir, entry.name);
       if (entry.isDirectory()) {
         await walk2(abs, rel);
         continue;
@@ -2031,22 +2549,22 @@ async function collectPaths(root) {
       found.push(rel);
     }
   }
-  await walk2(root, "");
+  await walk2(root2, "");
   return found;
 }
 async function buildManifest(input, opts = {}) {
-  const root = path5.resolve(input);
-  const info = await stat2(root).catch(() => void 0);
+  const root2 = path7.resolve(input);
+  const info = await stat4(root2).catch(() => void 0);
   if (info === void 0) throw new UsageError(`no such file or folder: ${input}`);
   const entries = [];
   if (info.isFile()) {
-    entries.push(await readEntry(root, "index.html"));
+    entries.push(await readEntry(root2, "index.html"));
   } else if (info.isDirectory()) {
-    const paths = await collectPaths(root);
+    const paths = await collectPaths(root2);
     if (opts.requireIndex !== false && !paths.includes("index.html")) {
       throw new UsageError(`${input} has no index.html`);
     }
-    for (const rel of paths) entries.push(await readEntry(path5.join(root, rel), rel));
+    for (const rel of paths) entries.push(await readEntry(path7.join(root2, rel), rel));
   } else {
     throw new UsageError(`not a file or folder: ${input}`);
   }
@@ -2164,7 +2682,7 @@ async function publishTarget(api, target, opts) {
   let uploaded = 0;
   await runPool(missing, UPLOAD_CONCURRENCY, async (hash) => {
     const entry = byHash.get(hash);
-    await api.putBlob(hash, await readFile6(entry.file));
+    await api.putBlob(hash, await readFile8(entry.file));
     uploaded += 1;
   });
   const version = await api.createVersion(opts.slug, { label: opts.label, files: manifest.files });
@@ -2192,7 +2710,7 @@ function sameFiles(local, remote) {
   const paths = Object.keys(local);
   const other = remote;
   if (paths.length !== Object.keys(other).length) return false;
-  return paths.every((path22) => other[path22]?.hash === local[path22]?.hash);
+  return paths.every((path26) => other[path26]?.hash === local[path26]?.hash);
 }
 function reportUnchanged(out, result) {
   out.data({ unchanged: true, slug: result.slug, version: result.version.n });
@@ -2220,26 +2738,19 @@ function validateSlug(slug) {
   return slug;
 }
 
-// src/warn.ts
-import process4 from "node:process";
-function warn2(message) {
-  process4.stderr.write(`rshow: warning: ${message}
-`);
-}
-
 // src/commands/publish.ts
 async function directoryOf(input) {
-  const dir = path6.resolve(input);
-  const info = await stat3(dir).catch(() => void 0);
+  const dir = path8.resolve(input);
+  const info = await stat5(dir).catch(() => void 0);
   return info !== void 0 && info.isDirectory() ? dir : void 0;
 }
 async function targetOf(input, dir, built, out) {
-  if (dir === void 0) return path6.resolve(input);
-  if (built) return path6.resolve(dir, out);
+  if (dir === void 0) return path8.resolve(input);
+  if (built) return path8.resolve(dir, out);
   const local = await readConfigFile(localConfigPath(dir));
-  return local.out === void 0 ? dir : path6.resolve(dir, out);
+  return local.out === void 0 ? dir : path8.resolve(dir, out);
 }
-async function run2(argv, ctx) {
+async function run(argv, ctx) {
   const args = parseCommandArgs(
     argv,
     {
@@ -2266,7 +2777,7 @@ async function run2(argv, ctx) {
   }
   const target = await targetOf(input, dir, build !== void 0, config.out);
   const slug = validateSlug(
-    stringValue(args, "slug") ?? config.slug ?? deriveSlug(path6.basename(path6.resolve(input)))
+    stringValue(args, "slug") ?? config.slug ?? deriveSlug(path8.basename(path8.resolve(input)))
   );
   const title = stringValue(args, "title") ?? config.title;
   const label = stringValue(args, "label");
@@ -2277,7 +2788,7 @@ async function run2(argv, ctx) {
   const opts = { slug, title, label, project, tags, force: boolValue(args, "force") };
   if (!boolValue(args, "no-check")) {
     opts.beforeUpload = () => {
-      if (config.art === void 0) warn2("no art host configured; skipping theme checks");
+      if (config.art === void 0) warn("no art host configured; skipping theme checks");
       return enforceCheck(ctx.out, target, { art: config.art, offline: config.art === void 0 });
     };
   }
@@ -2301,9 +2812,9 @@ async function run2(argv, ctx) {
 }
 
 // src/commands/check.ts
-import { stat as stat4 } from "node:fs/promises";
-import path7 from "node:path";
-async function run3(argv, ctx) {
+import { stat as stat6 } from "node:fs/promises";
+import path9 from "node:path";
+async function run2(argv, ctx) {
   const args = parseCommandArgs(
     argv,
     { offline: { type: "boolean" }, "no-style": { type: "boolean" } },
@@ -2312,13 +2823,13 @@ async function run3(argv, ctx) {
     CHECK_USAGE
   );
   const input = args.positionals[0];
-  const dir = path7.resolve(input);
-  const info = await stat4(dir).catch(() => void 0);
+  const dir = path9.resolve(input);
+  const info = await stat6(dir).catch(() => void 0);
   if (info === void 0 || !info.isDirectory()) throw new UsageError(`no such folder: ${input}`);
   const config = await ctx.config(dir);
   const offline = boolValue(args, "offline");
   const art = config.art;
-  if (art === void 0 && !offline) warn2("no art host configured; skipping theme checks");
+  if (art === void 0 && !offline) warn("no art host configured; skipping theme checks");
   const result = await checkFolder(dir, {
     art,
     offline: offline || art === void 0,
@@ -2336,21 +2847,21 @@ async function run3(argv, ctx) {
 }
 
 // src/commands/preview.ts
-import { stat as stat7 } from "node:fs/promises";
-import path10 from "node:path";
+import { stat as stat9 } from "node:fs/promises";
+import path12 from "node:path";
 
 // src/serve.ts
 import { watch } from "node:fs";
-import { mkdtemp, readFile as readFile8, rm as rm2, stat as stat6, writeFile as writeFile2 } from "node:fs/promises";
+import { mkdtemp as mkdtemp2, readFile as readFile10, rm as rm3, stat as stat8, writeFile as writeFile4 } from "node:fs/promises";
 import { createHash as createHash2 } from "node:crypto";
 import { createServer } from "node:http";
 import { tmpdir } from "node:os";
-import path9 from "node:path";
-import process5 from "node:process";
+import path11 from "node:path";
+import process11 from "node:process";
 
 // src/themes.ts
-import { cp, mkdir, readFile as readFile7, rm, stat as stat5, writeFile } from "node:fs/promises";
-import path8 from "node:path";
+import { cp, mkdir as mkdir3, readFile as readFile9, rm as rm2, stat as stat7, writeFile as writeFile3 } from "node:fs/promises";
+import path10 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/color.ts
@@ -2682,11 +3193,21 @@ function flattenDtcg(tree) {
 }
 
 // src/themes.ts
-var HERE = path8.dirname(fileURLToPath2(import.meta.url));
-var BUILTIN_BASES = [
-  path8.resolve(HERE, "../../../themes"),
-  path8.resolve(HERE, "../themes")
-];
+function sourceDir() {
+  try {
+    const url = import.meta.url;
+    return typeof url === "string" && url !== "" ? path10.dirname(fileURLToPath2(url)) : void 0;
+  } catch {
+    return void 0;
+  }
+}
+var HERE = sourceDir();
+function nearSource(...segments) {
+  if (HERE === void 0) return [];
+  return [path10.resolve(HERE, "..", "..", "..", ...segments), path10.resolve(HERE, "..", ...segments)];
+}
+var BUILTIN_BASES = nearSource("themes");
+var BUILTIN_SKILL_BASES = nearSource("skills");
 var ROLE_TOKENS = ["--bg", "--fg", "--muted", "--accent", "--layer-01"];
 var TEXT_ROLES = ["--fg", "--muted", "--accent"];
 var GROUND_TOKENS = ["--bg", "--layer-01"];
@@ -2701,7 +3222,7 @@ var FONT_FORMATS = {
   ".ttf": "truetype",
   ".otf": "opentype"
 };
-function isRecord2(value) {
+function isRecord3(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function stringField(value) {
@@ -2711,16 +3232,16 @@ function messageOf6(err) {
   return err instanceof Error ? err.message : String(err);
 }
 async function isFile(file) {
-  const info = await stat5(file).catch(() => void 0);
+  const info = await stat7(file).catch(() => void 0);
   return info !== void 0 && info.isFile();
 }
 async function isDir(dir) {
-  const info = await stat5(dir).catch(() => void 0);
+  const info = await stat7(dir).catch(() => void 0);
   return info !== void 0 && info.isDirectory();
 }
 function tokenMap(value) {
   const out = {};
-  if (!isRecord2(value)) return out;
+  if (!isRecord3(value)) return out;
   for (const [name, raw] of Object.entries(value)) {
     if (typeof raw === "string" && raw.trim() !== "") out[name] = raw.trim();
   }
@@ -2730,7 +3251,7 @@ function fontList(value) {
   if (!Array.isArray(value)) return [];
   const out = [];
   for (const item of value) {
-    if (!isRecord2(item)) continue;
+    if (!isRecord3(item)) continue;
     const family = stringField(item.family);
     const file = stringField(item.file);
     if (family === void 0 || file === void 0) continue;
@@ -2741,8 +3262,8 @@ function fontList(value) {
   return out;
 }
 function themeValues(json) {
-  const doc = isRecord2(json) ? json : {};
-  const modes = isRecord2(doc.modeTokens) ? doc.modeTokens : {};
+  const doc = isRecord3(json) ? json : {};
+  const modes = isRecord3(doc.modeTokens) ? doc.modeTokens : {};
   return {
     tokens: tokenMap(doc.tokens),
     light: tokenMap(modes.light),
@@ -2750,10 +3271,10 @@ function themeValues(json) {
   };
 }
 async function readThemeJson(dir) {
-  const file = path8.join(dir, "theme.json");
+  const file = path10.join(dir, "theme.json");
   let text;
   try {
-    text = await readFile7(file, "utf8");
+    text = await readFile9(file, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") throw new UsageError(`${dir} has no theme.json`);
     throw new UsageError(`cannot read ${file}: ${messageOf6(err)}`);
@@ -2764,17 +3285,23 @@ async function readThemeJson(dir) {
   } catch {
     throw new UsageError(`invalid JSON in ${file}`);
   }
-  if (!isRecord2(parsed)) throw new UsageError(`${file} must hold a JSON object`);
+  if (!isRecord3(parsed)) throw new UsageError(`${file} must hold a JSON object`);
   return { dir, text, json: parsed };
 }
 async function builtinThemeDir(name, bases = BUILTIN_BASES) {
   if (!THEME_NAME_PATTERN.test(name)) return void 0;
-  for (const base of bases) {
-    const dir = path8.join(base, name);
+  for (const base of [...await binaryThemeBases(), ...bases]) {
+    const dir = path10.join(base, name);
     if (await isDir(dir)) return dir;
   }
   return void 0;
 }
+async function builtinSkillsDir(bases = BUILTIN_SKILL_BASES) {
+  for (const base of [...await binarySkillBases(), ...bases]) {
+    if (await isDir(base)) return base;
+  }
+  return void 0;
+}
 function stripPrint(css) {
   let out = "";
   let index = 0;
@@ -2800,8 +3327,8 @@ function stripPrint(css) {
   return out;
 }
 async function themeTokenSets(dir) {
-  const file = path8.join(dir, "tokens.css");
-  const text = await readFile7(file, "utf8").catch(() => void 0);
+  const file = path10.join(dir, "tokens.css");
+  const text = await readFile9(file, "utf8").catch(() => void 0);
   return extractTokens(text === void 0 ? [] : [stripPrint(text)]);
 }
 function declMap(list3) {
@@ -2823,9 +3350,9 @@ function declarations(values, indent) {
 function presetTokenCss(name, values) {
   const parts2 = [];
   const light = { ...values.tokens, ...values.light };
-  const root = declarations(light, "  ");
-  if (root !== "") parts2.push(`:root {
-${root}
+  const root2 = declarations(light, "  ");
+  if (root2 !== "") parts2.push(`:root {
+${root2}
 }`);
   const dark = declarations(values.dark, "    ");
   if (dark !== "") {
@@ -2854,7 +3381,7 @@ function presetFontCss(fonts) {
     lines.push(`  font-weight: ${font.weight ?? "400"};`);
     lines.push("  font-display: swap;");
     const url = fontUrl(font.file);
-    const format = FONT_FORMATS[path8.extname(url).toLowerCase()];
+    const format = FONT_FORMATS[path10.extname(url).toLowerCase()];
     const source = format === void 0 ? `url("${url}")` : `url("${url}") format("${format}")`;
     lines.push(`  src: ${source};`);
     return `@font-face {
@@ -2879,15 +3406,15 @@ function mergeTheme(base, preset, baseName) {
 }
 async function appendFile(file, addition) {
   if (addition === "") return;
-  const before = await readFile7(file, "utf8").catch(() => "");
+  const before = await readFile9(file, "utf8").catch(() => "");
   const glue = before === "" || before.endsWith("\n") ? "" : "\n";
-  await writeFile(file, `${before}${glue}${addition}`);
+  await writeFile3(file, `${before}${glue}${addition}`);
 }
 async function buildPreset(presetDir, outDir) {
   const preset = await readThemeJson(presetDir);
   const baseName = stringField(preset.json.extends);
-  await rm(outDir, { recursive: true, force: true });
-  await mkdir(outDir, { recursive: true });
+  await rm2(outDir, { recursive: true, force: true });
+  await mkdir3(outDir, { recursive: true });
   if (baseName === void 0) {
     await cp(presetDir, outDir, { recursive: true });
     return;
@@ -2898,15 +3425,15 @@ async function buildPreset(presetDir, outDir) {
   await cp(baseDir, outDir, { recursive: true });
   const values = themeValues(preset.json);
   const name = stringField(preset.json.name) ?? baseName;
-  await appendFile(path8.join(outDir, "tokens.css"), presetTokenCss(name, values));
+  await appendFile(path10.join(outDir, "tokens.css"), presetTokenCss(name, values));
   const fonts = fontList(preset.json.fonts);
   if (fonts.length > 0) {
-    const from = path8.join(presetDir, "fonts");
-    if (await isDir(from)) await cp(from, path8.join(outDir, "fonts"), { recursive: true });
-    await appendFile(path8.join(outDir, "fonts.css"), presetFontCss(fonts));
+    const from = path10.join(presetDir, "fonts");
+    if (await isDir(from)) await cp(from, path10.join(outDir, "fonts"), { recursive: true });
+    await appendFile(path10.join(outDir, "fonts.css"), presetFontCss(fonts));
   }
   const merged = mergeTheme(base.json, preset.json, baseName);
-  await writeFile(path8.join(outDir, "theme.json"), `${JSON.stringify(merged, null, 2)}
+  await writeFile3(path10.join(outDir, "theme.json"), `${JSON.stringify(merged, null, 2)}
 `);
 }
 function keyLine(text, key2, mode) {
@@ -2921,8 +3448,8 @@ function keyLine(text, key2, mode) {
   }
   return 0;
 }
-function finding(path22, line, severity, message) {
-  return { path: path22, line: Math.max(1, line), severity, message };
+function finding(path26, line, severity, message) {
+  return { path: path26, line: Math.max(1, line), severity, message };
 }
 function resolveValue(name, map, fallback) {
   let current = map[name] ?? fallback[name];
@@ -3020,13 +3547,13 @@ async function checkPreset(presetDir) {
   }
   const fonts = fontList(preset.json.fonts);
   for (const font of fonts) {
-    const file = path8.join(presetDir, font.file);
+    const file = path10.join(presetDir, font.file);
     if (!await isFile(file)) {
       findings.push(finding("theme.json", keyLine(text, "file"), "error", `missing font file: ${font.file}`));
     }
   }
   if (fonts.length > 0) {
-    const found = await Promise.all(LICENCE_FILES.map((rel) => isFile(path8.join(presetDir, "fonts", rel))));
+    const found = await Promise.all(LICENCE_FILES.map((rel) => isFile(path10.join(presetDir, "fonts", rel))));
     if (!found.some(Boolean)) {
       findings.push(
         finding(
@@ -3124,7 +3651,7 @@ var SCRIPT_TYPE = "text/javascript; charset=utf-8";
 function messageOf7(err) {
   return err instanceof Error ? err.message : String(err);
 }
-function isRecord3(value) {
+function isRecord4(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function etagOf(text) {
@@ -3144,14 +3671,14 @@ function parseValue(text) {
 function dataLimit(key2) {
   return key2.startsWith(SKETCH_DATA_KEY_PREFIX) ? MAX_SKETCH_DATA_BYTES : MAX_DATA_BYTES;
 }
-function jsonReply(res, status, body, headers = {}) {
-  res.writeHead(status, { "content-type": JSON_TYPE, "cache-control": "no-store", ...headers });
+function jsonReply(res, status2, body, headers = {}) {
+  res.writeHead(status2, { "content-type": JSON_TYPE, "cache-control": "no-store", ...headers });
   res.end(JSON.stringify(body));
 }
-function jsonError(res, message, status) {
-  jsonReply(res, status, { error: message });
+function jsonError(res, message, status2) {
+  jsonReply(res, status2, { error: message });
 }
-async function resolveFile(root, pathname) {
+async function resolveFile(root2, pathname) {
   let decoded;
   try {
     decoded = decodeURIComponent(pathname);
@@ -3159,25 +3686,26 @@ async function resolveFile(root, pathname) {
     return void 0;
   }
   if (decoded.includes("\0")) return void 0;
-  const target = path9.resolve(root, decoded.replace(/^\/+/, ""));
-  const rel = path9.relative(root, target);
-  if (rel.startsWith("..") || path9.isAbsolute(rel)) return void 0;
-  const info = await stat6(target).catch(() => void 0);
+  const target = path11.resolve(root2, decoded.replace(/^\/+/, ""));
+  const rel = path11.relative(root2, target);
+  if (rel.startsWith("..") || path11.isAbsolute(rel)) return void 0;
+  const info = await stat8(target).catch(() => void 0);
   if (info === void 0) return void 0;
   if (info.isFile()) return target;
   if (!info.isDirectory()) return void 0;
-  const index = path9.join(target, "index.html");
-  const indexInfo = await stat6(index).catch(() => void 0);
+  const index = path11.join(target, "index.html");
+  const indexInfo = await stat8(index).catch(() => void 0);
   if (indexInfo === void 0 || !indexInfo.isFile()) return void 0;
   return index;
 }
 async function proxy(art, pathname, method, res) {
   let reply;
+  await readyNetwork();
   try {
     reply = await fetch(art + pathname, { method: method === "HEAD" ? "HEAD" : "GET" });
   } catch (err) {
     res.writeHead(502, { "content-type": TEXT_TYPE, "x-rshow-source": "proxy" });
-    res.end(`proxy error: ${messageOf7(err)}
+    res.end(`proxy error: ${networkText(err, art + pathname)}
 `);
     return;
   }
@@ -3193,10 +3721,10 @@ async function proxy(art, pathname, method, res) {
 async function prepareTheme(dir) {
   const doc = await readThemeJson(dir);
   const declared = typeof doc.json.name === "string" ? doc.json.name.trim() : "";
-  const name = declared === "" ? path9.basename(dir) : declared;
+  const name = declared === "" ? path11.basename(dir) : declared;
   const base = typeof doc.json.extends === "string" ? doc.json.extends.trim() : "";
   if (base === "") return { name, source: dir, built: dir, label: "local" };
-  const built = await mkdtemp(path9.join(tmpdir(), "rshow-theme-"));
+  const built = await mkdtemp2(path11.join(tmpdir(), "rshow-theme-"));
   await buildPreset(dir, built);
   return { name, source: dir, built, label: "preset" };
 }
@@ -3267,9 +3795,9 @@ function createDataStore() {
   const values = /* @__PURE__ */ new Map();
   let dir;
   const persist = async () => {
-    if (dir === void 0) dir = await mkdtemp(path9.join(tmpdir(), "rshow-data-"));
+    if (dir === void 0) dir = await mkdtemp2(path11.join(tmpdir(), "rshow-data-"));
     const doc = Object.fromEntries(values);
-    await writeFile2(path9.join(dir, "data.json"), `${JSON.stringify(doc, null, 2)}
+    await writeFile4(path11.join(dir, "data.json"), `${JSON.stringify(doc, null, 2)}
 `);
   };
   return {
@@ -3283,7 +3811,7 @@ function createDataStore() {
     },
     close: async () => {
       if (dir === void 0) return;
-      await rm2(dir, { recursive: true, force: true });
+      await rm3(dir, { recursive: true, force: true });
       dir = void 0;
     }
   };
@@ -3315,9 +3843,9 @@ async function readBody(req, limit) {
 function valueText(value) {
   return JSON.stringify(value === void 0 ? null : value);
 }
-async function handleData(req, res, store, key2, method) {
+async function handleData(req, res, store2, key2, method) {
   if (method === "GET" || method === "HEAD") {
-    const entry = store.get(key2);
+    const entry = store2.get(key2);
     if (entry === void 0) {
       jsonError(res, "not found", 404);
       return;
@@ -3358,12 +3886,12 @@ async function handleData(req, res, store, key2, method) {
     jsonError(res, "expected a JSON body", 400);
     return;
   }
-  if (!isRecord3(parsed) || !("value" in parsed)) {
+  if (!isRecord4(parsed) || !("value" in parsed)) {
     jsonError(res, "expected {value}", 400);
     return;
   }
   const text = valueText(parsed.value);
-  const existing = store.get(key2);
+  const existing = store2.get(key2);
   const ifMatch = req.headers["if-match"] ?? null;
   if (ifMatch !== null && ifMatch.trim() !== "") {
     if (existing === void 0 || !etagMatches(ifMatch, etagOf(existing.text))) {
@@ -3371,7 +3899,7 @@ async function handleData(req, res, store, key2, method) {
       return;
     }
   }
-  if (existing === void 0 && store.count() >= MAX_DATA_KEYS) {
+  if (existing === void 0 && store2.count() >= MAX_DATA_KEYS) {
     jsonError(res, "too many keys for this artifact", 409);
     return;
   }
@@ -3379,7 +3907,7 @@ async function handleData(req, res, store, key2, method) {
     jsonError(res, "value too large", 413);
     return;
   }
-  const written = await store.write(key2, text);
+  const written = await store2.write(key2, text);
   jsonReply(res, 200, { ok: true, key: key2, updated_at: written.updated_at }, { etag: written.etag });
 }
 function subscribe(res, session) {
@@ -3410,7 +3938,7 @@ function injectReload(html) {
 ${html.slice(at)}`;
 }
 async function sendFile(res, method, session, file, headers = {}) {
-  const bytes = await readFile8(file);
+  const bytes = await readFile10(file);
   const type = contentTypeFor(file);
   const all = { "content-type": type, "cache-control": "no-store", ...headers };
   if (method === "HEAD") {
@@ -3435,7 +3963,7 @@ function startWatchers(session, targets) {
         const done = rebuild ? buildPreset(theme.source, theme.built) : Promise.resolve();
         done.then(
           () => broadcast(session),
-          (err) => warn2(`cannot rebuild ${target.dir}: ${messageOf7(err)}`)
+          (err) => warn(`cannot rebuild ${target.dir}: ${messageOf7(err)}`)
         );
       }, DEBOUNCE_MS);
       timer.unref();
@@ -3445,7 +3973,7 @@ function startWatchers(session, targets) {
       watcher.on("error", () => void 0);
       watchers.push(watcher);
     } catch (err) {
-      warn2(`cannot watch ${target.dir}: ${messageOf7(err)}`);
+      warn(`cannot watch ${target.dir}: ${messageOf7(err)}`);
     }
   }
   return watchers;
@@ -3488,19 +4016,19 @@ async function handle(req, res, session) {
 }
 function closeOnSignals(preview2) {
   const stop = () => {
-    preview2.close().catch(() => void 0).finally(() => process5.exit(0));
+    preview2.close().catch(() => void 0).finally(() => process11.exit(0));
   };
-  process5.once("SIGINT", stop);
-  process5.once("SIGTERM", stop);
+  process11.once("SIGINT", stop);
+  process11.once("SIGTERM", stop);
 }
 async function startPreview(opts) {
-  const dir = path9.resolve(opts.dir);
+  const dir = path11.resolve(opts.dir);
   const art = (opts.art ?? "").replace(/\/+$/, "");
   const host = opts.host ?? "127.0.0.1";
-  const theme = opts.theme === void 0 ? void 0 : await prepareTheme(path9.resolve(opts.theme));
-  const root = opts.root === "theme" && theme !== void 0 ? theme.built : dir;
+  const theme = opts.theme === void 0 ? void 0 : await prepareTheme(path11.resolve(opts.theme));
+  const root2 = opts.root === "theme" && theme !== void 0 ? theme.built : dir;
   const session = {
-    root,
+    root: root2,
     art,
     offline: opts.offline === true,
     reload: opts.reload !== false,
@@ -3509,8 +4037,8 @@ async function startPreview(opts) {
     clients: /* @__PURE__ */ new Set(),
     builtin: /* @__PURE__ */ new Map()
   };
-  const targets = [{ dir: root, rebuild: false }];
-  if (theme !== void 0 && theme.source !== root) targets.push({ dir: theme.source, rebuild: true });
+  const targets = [{ dir: root2, rebuild: false }];
+  if (theme !== void 0 && theme.source !== root2) targets.push({ dir: theme.source, rebuild: true });
   const watchers = startWatchers(session, targets);
   const server = createServer((req, res) => {
     handle(req, res, session).catch((err) => {
@@ -3525,7 +4053,7 @@ async function startPreview(opts) {
     session.clients.clear();
     await session.store.close();
     if (theme !== void 0 && theme.built !== theme.source) {
-      await rm2(theme.built, { recursive: true, force: true });
+      await rm3(theme.built, { recursive: true, force: true });
     }
   };
   try {
@@ -3565,12 +4093,12 @@ function portOf(value) {
   return port;
 }
 async function requireFolder(input, what) {
-  const dir = path10.resolve(input);
-  const info = await stat7(dir).catch(() => void 0);
+  const dir = path12.resolve(input);
+  const info = await stat9(dir).catch(() => void 0);
   if (info === void 0 || !info.isDirectory()) throw new UsageError(`no such ${what}: ${input}`);
   return dir;
 }
-async function run4(argv, ctx) {
+async function run3(argv, ctx) {
   const args = parseCommandArgs(
     argv,
     {
@@ -3589,7 +4117,7 @@ async function run4(argv, ctx) {
   const offline = boolValue(args, "offline");
   const port = portOf(stringValue(args, "port"));
   const config = await ctx.config(dir);
-  if (config.art === void 0 && !offline) warn2("no art host configured; skipping the /_themes proxy");
+  if (config.art === void 0 && !offline) warn("no art host configured; skipping the /_themes proxy");
   const preview2 = await startPreview({
     dir,
     art: offline ? "" : config.art ?? "",
@@ -3613,7 +4141,14 @@ function themeRefOf(theme) {
   return { name: theme.slice(0, at), version: theme.slice(at + 1) };
 }
 async function fetchVersion(art, name) {
-  const reply = await fetch(`${art}/_themes/${name}.json`, { signal: AbortSignal.timeout(THEME_TIMEOUT_MS) });
+  const url = `${art}/_themes/${name}.json`;
+  await readyNetwork();
+  let reply;
+  try {
+    reply = await fetch(url, { signal: AbortSignal.timeout(THEME_TIMEOUT_MS) });
+  } catch (err) {
+    throw new Error(networkDetail(err, url));
+  }
   if (reply.status !== 200) throw new Error(`HTTP ${reply.status}`);
   const body = await reply.json();
   const version = body?.version;
@@ -3632,17 +4167,17 @@ async function resolveTheme2(config) {
   const ref = themeRefOf(theme);
   if (ref.version !== void 0 && ref.version !== "latest") return config;
   if (config.art === void 0) {
-    warn2("no art host configured; skipping theme version lookup");
+    warn("no art host configured; skipping theme version lookup");
     return config;
   }
   try {
     return { ...config, theme: await resolvedTheme(config.art, theme) };
   } catch (err) {
-    warn2(`cannot resolve theme ${ref.name}: ${messageOf8(err)}`);
+    warn(`cannot resolve theme ${ref.name}: ${messageOf8(err)}`);
     return config.theme === void 0 ? config : { ...config, theme: ref.name };
   }
 }
-async function run5(argv, ctx) {
+async function run4(argv, ctx) {
   const args = parseCommandArgs(argv, { offline: { type: "boolean" } }, 0, 1, CONFIG_USAGE);
   const dir = args.positionals[0];
   const loaded = await ctx.config(dir);
@@ -3652,14 +4187,14 @@ async function run5(argv, ctx) {
 }
 
 // src/commands/init.ts
-import { mkdir as mkdir2, readFile as readFile9, writeFile as writeFile3 } from "node:fs/promises";
-import path11 from "node:path";
-import process6 from "node:process";
+import { mkdir as mkdir4, readFile as readFile11, writeFile as writeFile5 } from "node:fs/promises";
+import path13 from "node:path";
+import process12 from "node:process";
 var LOCAL_HOSTS = /* @__PURE__ */ new Set(["127.0.0.1", "localhost"]);
 function messageOf9(err) {
   return err instanceof Error ? err.message : String(err);
 }
-function isRecord4(value) {
+function isRecord5(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function serverUrl(value, flag) {
@@ -3681,16 +4216,16 @@ function serverUrl(value, flag) {
 async function rawConfig(file) {
   let text;
   try {
-    text = await readFile9(file, "utf8");
+    text = await readFile11(file, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return {};
     throw new UsageError(`cannot read ${file}: ${messageOf9(err)}`);
   }
   const parsed = JSON.parse(text);
-  if (!isRecord4(parsed)) throw new UsageError(`${file} must hold a JSON object`);
+  if (!isRecord5(parsed)) throw new UsageError(`${file} must hold a JSON object`);
   return parsed;
 }
-async function run6(argv, ctx) {
+async function run5(argv, ctx) {
   const args = parseCommandArgs(
     argv,
     {
@@ -3706,7 +4241,7 @@ async function run6(argv, ctx) {
   const url = serverUrl(stringValue(args, "url"), "url");
   const art = serverUrl(stringValue(args, "art"), "art");
   const theme = (stringValue(args, "theme") ?? "").trim();
-  const file = globalConfigPath(process6.env);
+  const file = globalConfigPath(process12.env);
   const current = await readConfigFile(file);
   const same = (have, want) => have === void 0 || have.replace(/\/+$/, "") === want;
   if (!boolValue(args, "force")) {
@@ -3721,8 +4256,8 @@ async function run6(argv, ctx) {
   raw.url = url;
   raw.art = art;
   if (theme !== "") raw.theme = theme;
-  await mkdir2(path11.dirname(file), { recursive: true });
-  await writeFile3(file, `${JSON.stringify(raw, null, 2)}
+  await mkdir4(path13.dirname(file), { recursive: true });
+  await writeFile5(file, `${JSON.stringify(raw, null, 2)}
 `, "utf8");
   ctx.out.data({ path: file, url, art });
   ctx.out.line(`wrote ${file}`);
@@ -3730,24 +4265,226 @@ async function run6(argv, ctx) {
 }
 
 // src/commands/doctor.ts
-import { readFile as readFile10, stat as stat8 } from "node:fs/promises";
-import path12 from "node:path";
-import process7 from "node:process";
+import { readFile as readFile13, stat as stat11 } from "node:fs/promises";
+import path15 from "node:path";
+import process13 from "node:process";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
+
+// src/skills.ts
+import { cp as cp2, lstat, mkdir as mkdir5, readFile as readFile12, readdir as readdir3, readlink, rm as rm4, stat as stat10, symlink, writeFile as writeFile6 } from "node:fs/promises";
+import { homedir as homedir4 } from "node:os";
+import path14 from "node:path";
+var SKILL_TARGETS = ["claude", "pi", "codex"];
+var SKILL_MARKER = ".rshow-skill";
+var SKILL_SOURCE = "rshow";
+var TARGET_SEGMENTS = {
+  claude: [".claude"],
+  pi: [".pi", "agent"],
+  codex: [".codex"]
+};
+async function isDir2(dir) {
+  const info = await stat10(dir).catch(() => void 0);
+  return info !== void 0 && info.isDirectory();
+}
+async function isFile2(file) {
+  const info = await stat10(file).catch(() => void 0);
+  return info !== void 0 && info.isFile();
+}
+function isUnder(file, dir) {
+  const rel = path14.relative(dir, file);
+  return rel !== "" && rel !== ".." && !rel.startsWith(`..${path14.sep}`) && !path14.isAbsolute(rel);
+}
+function homeDir(env) {
+  const home = (env.HOME ?? "").trim();
+  return home !== "" ? home : homedir4();
+}
+function targetParent(home, target) {
+  return path14.join(home, ...TARGET_SEGMENTS[target]);
+}
+function targetSkillsDir(home, target) {
+  return path14.join(targetParent(home, target), "skills");
+}
+async function detectedTargets(home) {
+  const out = [];
+  for (const target of SKILL_TARGETS) {
+    if (await isDir2(targetParent(home, target))) out.push(target);
+  }
+  return out;
+}
+function parseTargets(names) {
+  const out = [];
+  for (const name of names) {
+    const target = SKILL_TARGETS.find((item) => item === name);
+    if (target === void 0) {
+      throw new UsageError(`unknown target: ${name} (use ${SKILL_TARGETS.join(", ")})`);
+    }
+    if (!out.includes(target)) out.push(target);
+  }
+  return out;
+}
+function targetHint() {
+  return SKILL_TARGETS.join(", ");
+}
+function defaultModeOf(dir) {
+  return dir.split(path14.sep).join("/").includes("/_npx/") ? "copy" : "link";
+}
+async function skillsSource(env) {
+  const override = (env.RSHOW_SKILLS_DIR ?? "").trim();
+  let dir;
+  if (override !== "") {
+    dir = path14.resolve(override);
+    if (!await isDir2(dir)) throw new UsageError(`RSHOW_SKILLS_DIR is not a folder: ${dir}`);
+  } else {
+    dir = await builtinSkillsDir();
+  }
+  if (dir === void 0) return void 0;
+  const skills = [];
+  for (const entry of await readdir3(dir, { withFileTypes: true }).catch(() => [])) {
+    if (entry.isDirectory() && await isFile2(path14.join(dir, entry.name, "SKILL.md"))) skills.push(entry.name);
+  }
+  skills.sort();
+  return { dir, mode: await isBinary() ? "copy" : defaultModeOf(dir), skills };
+}
+function isOurLink(target, source) {
+  const resolved = path14.resolve(target);
+  if (isUnder(resolved, path14.resolve(source))) return true;
+  return /(^|\/)rshow\/skills\//.test(resolved.split(path14.sep).join("/"));
+}
+async function linkTargetOf(dst) {
+  const value = await readlink(dst);
+  return path14.isAbsolute(value) ? value : path14.resolve(path14.dirname(dst), value);
+}
+async function readMarker(dir) {
+  const text = await readFile12(path14.join(dir, SKILL_MARKER), "utf8").catch(() => void 0);
+  if (text === void 0) return void 0;
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return void 0;
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return void 0;
+  const doc = parsed;
+  if (doc.source !== SKILL_SOURCE || typeof doc.version !== "string" || doc.version === "") return void 0;
+  return { version: doc.version, source: SKILL_SOURCE };
+}
+async function inspectSkill(dst, source, skill) {
+  const info = await lstat(dst).catch(() => void 0);
+  if (info === void 0) return { kind: "missing" };
+  if (info.isSymbolicLink()) {
+    const link = await linkTargetOf(dst);
+    if (!isOurLink(link, source)) return { kind: "foreign" };
+    return { kind: "link", path: link, current: path14.resolve(link) === path14.join(path14.resolve(source), skill) };
+  }
+  if (info.isDirectory()) {
+    const marker = await readMarker(dst);
+    return marker === void 0 ? { kind: "foreign" } : { kind: "copy", version: marker.version };
+  }
+  return { kind: "foreign" };
+}
+function skillIsCurrent(state, version) {
+  if (state.kind === "link") return true;
+  if (state.kind === "copy") return state.version === version;
+  return false;
+}
+function skillStateLabel(state) {
+  switch (state.kind) {
+    case "missing":
+      return "missing";
+    case "foreign":
+      return "foreign";
+    case "link":
+      return `link -> ${state.path}`;
+    case "copy":
+      return `copy v${state.version}`;
+  }
+}
+function actionFor(state, version) {
+  if (state.kind === "missing") return "installed";
+  if (state.kind === "foreign") return "skip";
+  if (state.kind === "link") return state.current ? "ok" : "updated";
+  return state.version === version ? "ok" : "updated";
+}
+async function writeSkill(dst, src, mode, version) {
+  if (mode === "link") {
+    await symlink(src, dst);
+    return;
+  }
+  await cp2(src, dst, { recursive: true });
+  const marker = { version, source: SKILL_SOURCE };
+  await writeFile6(path14.join(dst, SKILL_MARKER), `${JSON.stringify(marker, null, 2)}
+`, "utf8");
+}
+async function installSkills(options) {
+  const entries = [];
+  for (const target of options.targets) {
+    const dir = targetSkillsDir(options.home, target);
+    if (!options.dryRun) await mkdir5(dir, { recursive: true });
+    for (const skill of options.source.skills) {
+      const dst = path14.join(dir, skill);
+      const src = path14.join(options.source.dir, skill);
+      const state = await inspectSkill(dst, options.source.dir, skill);
+      const action = actionFor(state, options.version);
+      if (!options.dryRun && (action === "installed" || action === "updated")) {
+        if (action === "updated") await rm4(dst, { recursive: true, force: true });
+        await writeSkill(dst, src, options.mode, options.version);
+      }
+      entries.push({ target, skill, action, path: dst });
+    }
+  }
+  return entries;
+}
+async function uninstallSkills(options) {
+  const entries = [];
+  for (const target of options.targets) {
+    const dir = targetSkillsDir(options.home, target);
+    for (const skill of (await readdir3(dir).catch(() => [])).sort()) {
+      const dst = path14.join(dir, skill);
+      const state = await inspectSkill(dst, options.source.dir, skill);
+      if (state.kind !== "link" && state.kind !== "copy") continue;
+      if (!options.dryRun) await rm4(dst, { recursive: true, force: true });
+      entries.push({ target, skill, action: "removed", path: dst });
+    }
+  }
+  return entries;
+}
+async function skillsStatus(options) {
+  const out = [];
+  for (const target of options.targets) {
+    const dir = targetSkillsDir(options.home, target);
+    for (const skill of options.source.skills) {
+      const dst = path14.join(dir, skill);
+      out.push({ target, skill, state: await inspectSkill(dst, options.source.dir, skill), path: dst });
+    }
+  }
+  return out;
+}
+
+// src/commands/doctor.ts
 var TIMEOUT_MS = 5e3;
 function messageOf10(err) {
   return err instanceof Error ? err.message : String(err);
 }
-async function isFile2(file) {
-  const info = await stat8(file).catch(() => void 0);
+async function isFile3(file) {
+  const info = await stat11(file).catch(() => void 0);
   return info !== void 0 && info.isFile();
 }
+function sourceDir2() {
+  try {
+    const url = import.meta.url;
+    return typeof url === "string" && url !== "" ? path15.dirname(fileURLToPath3(url)) : void 0;
+  } catch {
+    return void 0;
+  }
+}
 async function packageJsonPath() {
-  let dir = path12.dirname(fileURLToPath3(import.meta.url));
+  const start = sourceDir2();
+  if (start === void 0) return void 0;
+  let dir = start;
   for (let i = 0; i < 6; i += 1) {
-    const file = path12.join(dir, "package.json");
-    if (await isFile2(file)) return file;
-    const up = path12.dirname(dir);
+    const file = path15.join(dir, "package.json");
+    if (await isFile3(file)) return file;
+    const up = path15.dirname(dir);
     if (up === dir) break;
     dir = up;
   }
@@ -3771,36 +4508,41 @@ function minimumOf(range) {
 }
 async function nodeCheck() {
   const name = "node";
-  const current = process7.versions.node;
+  const current = process13.versions.node;
   const file = await packageJsonPath();
-  if (file === void 0) return { name, status: "warn", detail: `v${current} (package.json not found)` };
+  if (file === void 0) {
+    if (await isBinary()) return { name, status: "ok", detail: `v${current} (inside the binary)` };
+    return { name, status: "warn", detail: `v${current} (package.json not found)` };
+  }
   let range;
   try {
-    const body = JSON.parse(await readFile10(file, "utf8"));
+    const body = JSON.parse(await readFile13(file, "utf8"));
     range = typeof body.engines?.node === "string" ? body.engines.node : "";
   } catch (err) {
     return { name, status: "warn", detail: `v${current} (${messageOf10(err)})` };
   }
   const needed = minimumOf(range);
   if (needed === void 0) return { name, status: "warn", detail: `v${current} (no engines.node)` };
-  const status = atLeast(versionParts(current), needed) ? "ok" : "warn";
-  return { name, status, detail: `v${current} (needs ${range})` };
+  const status2 = atLeast(versionParts(current), needed) ? "ok" : "warn";
+  return { name, status: status2, detail: `v${current} (needs ${range})` };
 }
 async function tokenOf(url) {
-  const env = (process7.env.RSHOW_TOKEN ?? "").trim();
+  const env = (process13.env.RSHOW_TOKEN ?? "").trim();
   if (env !== "") return { token: env, source: "env" };
-  if (url === void 0) return { source: "none" };
+  if (url === void 0) return {};
   try {
-    const saved = await read(url);
-    if (saved !== void 0) return { token: saved, source: "keychain" };
-    return { source: "none" };
+    const store2 = await choose(process13.env);
+    const saved = await store2.read(url);
+    if (saved !== void 0) return { token: saved, source: store2.detail };
+    return {};
   } catch (err) {
-    return { source: "none", error: messageOf10(err) };
+    return { error: messageOf10(err) };
   }
 }
 async function getJson(url, token) {
   const headers = {};
   if (token !== void 0) headers.authorization = `Bearer ${token}`;
+  await readyNetwork();
   const reply = await fetch(url, { headers, signal: AbortSignal.timeout(TIMEOUT_MS) });
   if (reply.status !== 200) return { status: reply.status };
   const body = await reply.json().catch(() => void 0);
@@ -3826,7 +4568,7 @@ function tokenCheck(token) {
     const reason = token.error === void 0 ? "" : ` (${token.error})`;
     return { name, status: "fail", detail: `none${reason}: run rshow login, or set RSHOW_TOKEN` };
   }
-  return { name, status: "ok", detail: `source: ${token.source}` };
+  return { name, status: "ok", detail: `source: ${token.source ?? "none"}` };
 }
 async function apiCheck(url, token) {
   const name = "api";
@@ -3840,7 +4582,7 @@ async function apiCheck(url, token) {
     const scope = typeof body.scope === "string" ? body.scope : "";
     return { name, status: "ok", detail: `${email} (scope ${scope})` };
   } catch (err) {
-    return { name, status: "fail", detail: messageOf10(err) };
+    return { name, status: "fail", detail: networkDetail(err, `${url}/api/me`) };
   }
 }
 async function artCheck(art) {
@@ -3855,7 +4597,7 @@ async function artCheck(art) {
     }
     return { name, status: "ok", detail: `version ${version}` };
   } catch (err) {
-    return { name, status: "warn", detail: messageOf10(err) };
+    return { name, status: "warn", detail: networkDetail(err, `${art}/_themes/default.json`) };
   }
 }
 async function themeCheck(config) {
@@ -3872,12 +4614,28 @@ async function themeCheck(config) {
     return { name, status: "warn", detail: messageOf10(err) };
   }
 }
-async function run7(argv, ctx) {
+async function skillsCheck() {
+  const name = "skills";
+  const home = homeDir(process13.env);
+  const targets = await detectedTargets(home);
+  if (targets.length === 0) return { name, status: "ok", detail: "no target detected" };
+  const source = await skillsSource(process13.env).catch(() => void 0);
+  if (source === void 0) return { name, status: "warn", detail: "no skills folder next to rshow" };
+  const list3 = await skillsStatus({ home, source, targets });
+  const problems = [];
+  for (const target of targets) {
+    const bad = list3.filter((item) => item.target === target && !skillIsCurrent(item.state, VERSION)).map((item) => `${item.skill} ${skillStateLabel(item.state)}`);
+    if (bad.length > 0) problems.push(`${target}: ${bad.join(", ")}`);
+  }
+  if (problems.length === 0) return { name, status: "ok", detail: targets.join(", ") };
+  return { name, status: "warn", detail: `${problems.join("; ")} (run rshow skills install)` };
+}
+async function run6(argv, ctx) {
   const args = parseCommandArgs(argv, {}, 0, 1, DOCTOR_USAGE);
   const dir = args.positionals[0];
   const found = [];
-  for (const file of [globalConfigPath(process7.env), dir === void 0 ? void 0 : localConfigPath(dir)]) {
-    if (file !== void 0 && await isFile2(file)) found.push(file);
+  for (const file of [globalConfigPath(process13.env), dir === void 0 ? void 0 : localConfigPath(dir)]) {
+    if (file !== void 0 && await isFile3(file)) found.push(file);
   }
   let config;
   let configError;
@@ -3888,7 +4646,7 @@ async function run7(argv, ctx) {
   }
   const token = await tokenOf(config?.url);
   const checks = [
-    { name: "rshow", status: "ok", detail: VERSION },
+    { name: "rshow", status: "ok", detail: await isBinary() ? `${VERSION} (binary)` : VERSION },
     await nodeCheck(),
     configCheck(found, config, configError),
     tokenCheck(token),
@@ -3897,19 +4655,20 @@ async function run7(argv, ctx) {
   ];
   const theme = await themeCheck(config);
   if (theme !== void 0) checks.push(theme);
+  checks.push(await skillsCheck());
   ctx.out.data({ checks });
   for (const check2 of checks) ctx.out.line(`${check2.status}  ${check2.name}  ${check2.detail}`);
   return checks.some((check2) => check2.status === "fail") ? EXIT.check : EXIT.ok;
 }
 
 // src/commands/theme.ts
-import { mkdir as mkdir3, mkdtemp as mkdtemp2, rm as rm3, stat as stat10, writeFile as writeFile4 } from "node:fs/promises";
+import { mkdir as mkdir6, mkdtemp as mkdtemp3, rm as rm5, stat as stat13, writeFile as writeFile7 } from "node:fs/promises";
 import { tmpdir as tmpdir2 } from "node:os";
-import path14 from "node:path";
+import path17 from "node:path";
 
 // src/theme.ts
-import { readFile as readFile11, stat as stat9 } from "node:fs/promises";
-import path13 from "node:path";
+import { readFile as readFile14, stat as stat12 } from "node:fs/promises";
+import path16 from "node:path";
 function themeSlug(name) {
   return `theme-${name}`;
 }
@@ -3917,10 +4676,10 @@ function themeUrl(name, n) {
   return `/_themes/${name}@${n}/`;
 }
 async function readThemeMeta(dir) {
-  const file = path13.join(dir, "theme.json");
+  const file = path16.join(dir, "theme.json");
   let text;
   try {
-    text = await readFile11(file, "utf8");
+    text = await readFile14(file, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") throw new UsageError(`${dir} has no theme.json`);
     throw new UsageError(`cannot read ${file}: ${err instanceof Error ? err.message : String(err)}`);
@@ -3941,8 +4700,8 @@ async function readThemeMeta(dir) {
   return { name };
 }
 async function requireThemeDir(input) {
-  const dir = path13.resolve(input);
-  const info = await stat9(dir).catch(() => void 0);
+  const dir = path16.resolve(input);
+  const info = await stat12(dir).catch(() => void 0);
   if (info === void 0 || !info.isDirectory()) throw new UsageError(`no such folder: ${input}`);
   return dir;
 }
@@ -3950,7 +4709,7 @@ async function requireThemeDir(input) {
 // src/commands/theme.ts
 async function presetCheck(dir) {
   const findings = await checkPreset(dir);
-  const info = await stat10(path14.join(dir, "theme.json")).catch(() => void 0);
+  const info = await stat13(path17.join(dir, "theme.json")).catch(() => void 0);
   const errors = findings.filter((finding2) => finding2.severity === "error").length;
   return { findings, errors, warnings: findings.length - errors, files: 1, bytes: info?.size ?? 0 };
 }
@@ -3979,14 +4738,14 @@ async function publish(argv, ctx) {
   if (!boolValue(args, "no-check")) {
     if (preset) await enforcePresetCheck(ctx.out, dir);
     else {
-      if (config.art === void 0) warn2("no art host configured; skipping theme checks");
+      if (config.art === void 0) warn("no art host configured; skipping theme checks");
       await enforceCheck(ctx.out, dir, { art: config.art, offline: config.art === void 0 });
     }
   }
   let target = dir;
   let temp;
   if (preset) {
-    temp = await mkdtemp2(path14.join(tmpdir2(), "rshow-theme-"));
+    temp = await mkdtemp3(path17.join(tmpdir2(), "rshow-theme-"));
     await buildPreset(dir, temp);
     target = temp;
   }
@@ -4032,7 +4791,7 @@ async function publish(argv, ctx) {
     reportPublish(ctx.out, { ...result, artifact });
     ctx.out.line(url);
   } finally {
-    if (temp !== void 0) await rm3(temp, { recursive: true, force: true });
+    if (temp !== void 0) await rm5(temp, { recursive: true, force: true });
   }
 }
 async function list(argv, ctx) {
@@ -4074,14 +4833,14 @@ async function create(argv, ctx) {
   const from = stringValue(args, "from") ?? "default";
   const baseDir = await builtinThemeDir(from);
   if (baseDir === void 0) throw new UsageError(`no built-in theme: ${from}`);
-  const parent = path14.resolve(stringValue(args, "dir") ?? ".");
-  const target = path14.join(parent, name);
-  const exists = await stat10(target).catch(() => void 0);
-  if (exists !== void 0) throw new UsageError(`${target} already exists`);
+  const parent = path17.resolve(stringValue(args, "dir") ?? ".");
+  const target = path17.join(parent, name);
+  const exists2 = await stat13(target).catch(() => void 0);
+  if (exists2 !== void 0) throw new UsageError(`${target} already exists`);
   const values = await baseRoleValues(baseDir, ROLE_TOKENS);
   const doc = { name, extends: from, tokens: {}, modeTokens: values };
-  await mkdir3(target, { recursive: true });
-  await writeFile4(path14.join(target, "theme.json"), `${JSON.stringify(doc, null, 2)}
+  await mkdir6(target, { recursive: true });
+  await writeFile7(path17.join(target, "theme.json"), `${JSON.stringify(doc, null, 2)}
 `);
   ctx.out.data({ path: target, name, extends: from });
   ctx.out.line(target);
@@ -4116,7 +4875,7 @@ async function preview(argv, ctx) {
   const port = portOf(stringValue(args, "port"));
   const offline = boolValue(args, "offline");
   const config = await ctx.config(dir);
-  if (config.art === void 0 && !offline) warn2("no art host configured; skipping the /_themes proxy");
+  if (config.art === void 0 && !offline) warn("no art host configured; skipping the /_themes proxy");
   const server = await startPreview({
     dir,
     theme: dir,
@@ -4130,7 +4889,7 @@ async function preview(argv, ctx) {
   ctx.out.raw(`${server.url}/index.html`);
   return EXIT.ok;
 }
-async function run8(argv, ctx) {
+async function run7(argv, ctx) {
   const [sub, ...rest] = argv;
   if (sub === void 0) throw new UsageError(`expected a theme command (try: ${usageLine(THEME_USAGE)})`);
   if (sub === "new") return create(rest, ctx);
@@ -4147,6 +4906,122 @@ async function run8(argv, ctx) {
   throw new UsageError(`unknown theme command: ${sub} (try: ${usageLine(THEME_USAGE)})`);
 }
 
+// src/commands/skills.ts
+import path18 from "node:path";
+import process14 from "node:process";
+var CHANGE_ACTIONS = /* @__PURE__ */ new Set(["installed", "updated", "removed"]);
+async function sourceOf() {
+  const source = await skillsSource(process14.env);
+  if (source === void 0) {
+    throw new UsageError(`no skills folder next to rshow (set RSHOW_SKILLS_DIR to one)`);
+  }
+  return source;
+}
+async function targetsWithDetection(names, home) {
+  const chosen = parseTargets(names);
+  if (chosen.length > 0) return chosen;
+  return detectedTargets(home);
+}
+function noTargetsError(home) {
+  return new UsageError(
+    `no target detected (looked for ${path18.join(home, ".claude")}, ${path18.join(home, ".pi/agent")} and ${path18.join(home, ".codex")}); name one of ${targetHint()}`
+  );
+}
+function actionLine(entry, dryRun) {
+  const would = dryRun && CHANGE_ACTIONS.has(entry.action) ? "would " : "";
+  return `${would}${entry.action} ${entry.path}`;
+}
+function countOf(entries) {
+  return entries.filter((entry) => entry.action !== "skip").length;
+}
+var DRY_RUN_VERB = { installed: "install", removed: "remove" };
+function summaryLine2(verb, entries, targets, dryRun) {
+  const phrase = dryRun ? `would ${DRY_RUN_VERB[verb] ?? verb}` : verb;
+  return `${phrase} ${countOf(entries)} skills for ${targets.join(", ")}`;
+}
+async function install(argv, ctx) {
+  const args = parseCommandArgs(
+    argv,
+    { link: { type: "boolean" }, copy: { type: "boolean" }, "dry-run": { type: "boolean" } },
+    0,
+    3,
+    SKILLS_INSTALL_USAGE
+  );
+  const link = boolValue(args, "link");
+  const copy = boolValue(args, "copy");
+  if (link && copy) throw new UsageError(`--link and --copy cannot be used together (try: ${usageLine(SKILLS_INSTALL_USAGE)})`);
+  const home = homeDir(process14.env);
+  const targets = await targetsWithDetection(args.positionals, home);
+  if (targets.length === 0) throw noTargetsError(home);
+  const source = await sourceOf();
+  const mode = link ? "link" : copy ? "copy" : source.mode;
+  const dryRun = boolValue(args, "dry-run");
+  const entries = await installSkills({ home, source, targets, mode, dryRun, version: VERSION });
+  ctx.out.data({ targets, actions: entries });
+  const skipped = [];
+  for (const entry of entries) {
+    if (entry.action === "skip") skipped.push(entry.path);
+    else ctx.out.line(actionLine(entry, dryRun));
+  }
+  ctx.out.line(summaryLine2("installed", entries, targets, dryRun));
+  for (const dst of skipped) process14.stderr.write(`skip ${dst}: exists and is not from rshow
+`);
+  return skipped.length > 0 ? EXIT.check : EXIT.ok;
+}
+async function uninstall(argv, ctx) {
+  const args = parseCommandArgs(argv, { "dry-run": { type: "boolean" } }, 0, 3, SKILLS_UNINSTALL_USAGE);
+  const home = homeDir(process14.env);
+  const targets = await targetsWithDetection(args.positionals, home);
+  if (targets.length === 0) return EXIT.ok;
+  const source = await sourceOf();
+  const dryRun = boolValue(args, "dry-run");
+  const entries = await uninstallSkills({ home, source, targets, dryRun });
+  ctx.out.data({ targets, actions: entries });
+  for (const entry of entries) ctx.out.line(actionLine(entry, dryRun));
+  ctx.out.line(summaryLine2("removed", entries, targets, dryRun));
+  return EXIT.ok;
+}
+function actionOf(item) {
+  if (item.state.kind === "link") return { action: "link", link: item.state.path };
+  if (item.state.kind === "copy") return { action: "copy", version: item.state.version };
+  return { action: item.state.kind };
+}
+async function status(argv, ctx) {
+  const args = parseCommandArgs(argv, {}, 0, 3, SKILLS_STATUS_USAGE);
+  const home = homeDir(process14.env);
+  const targets = await targetsWithDetection(args.positionals, home);
+  if (targets.length === 0) return EXIT.ok;
+  const source = await sourceOf();
+  const list3 = await skillsStatus({ home, source, targets });
+  const targetWidth = Math.max(...targets.map((target) => target.length));
+  const skillWidth = Math.max(...source.skills.map((skill) => skill.length));
+  ctx.out.data({
+    targets,
+    actions: list3.map((item) => ({ target: item.target, skill: item.skill, path: item.path, ...actionOf(item) }))
+  });
+  for (const item of list3) {
+    const name = `${item.target.padEnd(targetWidth)}  ${item.skill.padEnd(skillWidth)}`;
+    ctx.out.line(`${name}  ${skillStateLabel(item.state)}`);
+    if (item.state.kind === "copy" && !skillIsCurrent(item.state, VERSION)) {
+      warn(`${item.path} is a copy of v${item.state.version}, this rshow is ${VERSION}: run rshow skills install`);
+    }
+  }
+  return EXIT.ok;
+}
+async function run8(argv, ctx) {
+  const [sub, ...rest] = argv;
+  switch (sub) {
+    case "install":
+      return install(rest, ctx);
+    case "uninstall":
+      return uninstall(rest, ctx);
+    case "status":
+      return status(rest, ctx);
+    default:
+      throw new UsageError(`skills needs a subcommand (try: ${usageLine(SKILLS_USAGE)})`);
+  }
+}
+
 // src/commands/list.ts
 async function run9(argv, ctx) {
   const args = parseCommandArgs(
@@ -4390,7 +5265,7 @@ async function share(argv, ctx) {
   for (const member of members) ctx.out.line(`member ${member.email} ${member.role}`);
   for (const email of removals) ctx.out.line(`removed ${email}`);
 }
-async function remove2(argv, ctx) {
+async function remove4(argv, ctx) {
   const args = parseCommandArgs(argv, { yes: { type: "boolean" } }, 1, 1, PROJECT_DELETE_USAGE);
   const slug = validateSlug(args.positionals[0]);
   if (!boolValue(args, "yes")) {
@@ -4410,7 +5285,7 @@ async function run14(argv, ctx) {
   if (sub === "list") return list2(rest, ctx);
   if (sub === "show") return show(rest, ctx);
   if (sub === "share") return share(rest, ctx);
-  if (sub === "delete") return remove2(rest, ctx);
+  if (sub === "delete") return remove4(rest, ctx);
   throw new UsageError(`unknown project command: ${sub} (try: ${usageLine(PROJECT_USAGE)})`);
 }
 
@@ -4425,13 +5300,13 @@ async function run15(argv, ctx) {
   );
   const slug = validateSlug(args.positionals[0]);
   const add2 = normalizeTags(stringList(args, "add"));
-  const remove3 = normalizeTags(stringList(args, "remove"));
-  if (add2.length === 0 && remove3.length === 0) {
+  const remove5 = normalizeTags(stringList(args, "remove"));
+  if (add2.length === 0 && remove5.length === 0) {
     throw new UsageError(`nothing to change (try: ${usageLine(TAG_USAGE)})`);
   }
   const api = await ctx.api();
   const current = await api.artifact(slug);
-  const tags = withTags(tagsOf(current?.tags), add2, remove3);
+  const tags = withTags(tagsOf(current?.tags), add2, remove5);
   const artifact = await api.patchArtifact(slug, { tags });
   ctx.out.data({ artifact, tags });
   ctx.out.line(`slug: ${slug}`);
@@ -4439,20 +5314,20 @@ async function run15(argv, ctx) {
 }
 
 // src/commands/handoff.ts
-import process11 from "node:process";
+import process18 from "node:process";
 
 // src/handoff.ts
-import { mkdir as mkdir4, stat as stat11, writeFile as writeFile6 } from "node:fs/promises";
-import path17 from "node:path";
-import process10 from "node:process";
+import { mkdir as mkdir7, stat as stat14, writeFile as writeFile9 } from "node:fs/promises";
+import path21 from "node:path";
+import process17 from "node:process";
 
 // src/cdp.ts
 import { spawn as spawn3 } from "node:child_process";
 import { existsSync, rmSync } from "node:fs";
-import { mkdtemp as mkdtemp3, rm as rm4 } from "node:fs/promises";
+import { mkdtemp as mkdtemp4, rm as rm6 } from "node:fs/promises";
 import { tmpdir as tmpdir3 } from "node:os";
-import path15 from "node:path";
-import process8 from "node:process";
+import path19 from "node:path";
+import process15 from "node:process";
 var CHROME_CANDIDATES = [
   "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
   "/Applications/Chromium.app/Contents/MacOS/Chromium",
@@ -4472,9 +5347,9 @@ var LOAD_TIMEOUT_MS = 2e4;
 var liveBrowsers = /* @__PURE__ */ new Map();
 var signalHandlersInstalled = false;
 function killBrowser(child, signal) {
-  if (process8.platform !== "win32" && child.pid !== void 0) {
+  if (process15.platform !== "win32" && child.pid !== void 0) {
     try {
-      process8.kill(-child.pid, signal);
+      process15.kill(-child.pid, signal);
       return;
     } catch {
     }
@@ -4499,24 +5374,24 @@ function reapBrowsers() {
 }
 function onInterrupt() {
   reapBrowsers();
-  process8.exit(130);
+  process15.exit(130);
 }
 function onTerminate() {
   reapBrowsers();
-  process8.exit(143);
+  process15.exit(143);
 }
 function dropSignalHandlers() {
   if (!signalHandlersInstalled) return;
   signalHandlersInstalled = false;
-  process8.off("SIGINT", onInterrupt);
-  process8.off("SIGTERM", onTerminate);
+  process15.off("SIGINT", onInterrupt);
+  process15.off("SIGTERM", onTerminate);
 }
 function trackBrowser(child, profile) {
   liveBrowsers.set(child, profile);
   if (!signalHandlersInstalled) {
     signalHandlersInstalled = true;
-    process8.on("SIGINT", onInterrupt);
-    process8.on("SIGTERM", onTerminate);
+    process15.on("SIGINT", onInterrupt);
+    process15.on("SIGTERM", onTerminate);
   }
 }
 function forgetBrowser(child) {
@@ -4527,20 +5402,20 @@ var exitHookInstalled = false;
 function installExitHook() {
   if (exitHookInstalled) return;
   exitHookInstalled = true;
-  process8.once("exit", reapBrowsers);
+  process15.once("exit", reapBrowsers);
 }
 function messageOf11(err) {
   return err instanceof Error ? err.message : String(err);
 }
 function whichInPath(name, pathValue) {
-  for (const dir of String(pathValue ?? "").split(path15.delimiter)) {
+  for (const dir of String(pathValue ?? "").split(path19.delimiter)) {
     if (dir === "") continue;
-    const file = path15.join(dir, name);
+    const file = path19.join(dir, name);
     if (existsSync(file)) return file;
   }
   return void 0;
 }
-function findChrome(env = process8.env) {
+function findChrome(env = process15.env) {
   const explicit = (env.CHROME ?? "").trim();
   if (explicit !== "") {
     if (existsSync(explicit)) return explicit;
@@ -4711,7 +5586,7 @@ var Chrome = class _Chrome {
   static async launch(opts = {}) {
     const binary = opts.binary ?? findChrome();
     if (binary === void 0) throw new UsageError("no Chrome or Chromium found, set CHROME");
-    const profile = await mkdtemp3(path15.join(tmpdir3(), "rshow-chrome-"));
+    const profile = await mkdtemp4(path19.join(tmpdir3(), "rshow-chrome-"));
     const child = spawn3(
       binary,
       [
@@ -4731,7 +5606,7 @@ var Chrome = class _Chrome {
         "--window-size=1440,900",
         "about:blank"
       ],
-      { stdio: ["ignore", "pipe", "pipe"], detached: process8.platform !== "win32" }
+      { stdio: ["ignore", "pipe", "pipe"], detached: process15.platform !== "win32" }
     );
     installExitHook();
     trackBrowser(child, profile);
@@ -4742,7 +5617,7 @@ var Chrome = class _Chrome {
     } catch (err) {
       forgetBrowser(child);
       killBrowser(child, "SIGKILL");
-      await rm4(profile, { recursive: true, force: true }).catch(() => {
+      await rm6(profile, { recursive: true, force: true }).catch(() => {
       });
       if (err instanceof ApiError || err instanceof UsageError) throw err;
       throw new ApiError(`cannot start chrome: ${messageOf11(err)}`);
@@ -4757,7 +5632,7 @@ var Chrome = class _Chrome {
     killBrowser(this.child, "SIGTERM");
     await delay(50);
     if (this.child.exitCode === null) killBrowser(this.child, "SIGKILL");
-    await rm4(this.profile, PROFILE_REMOVE).catch(() => {
+    await rm6(this.profile, PROFILE_REMOVE).catch(() => {
     });
     forgetBrowser(this.child);
   }
@@ -4863,16 +5738,16 @@ var Page = class _Page {
 };
 
 // src/map.ts
-import { readFile as readFile12, writeFile as writeFile5 } from "node:fs/promises";
-import path16 from "node:path";
-import process9 from "node:process";
+import { readFile as readFile15, writeFile as writeFile8 } from "node:fs/promises";
+import path20 from "node:path";
+import process16 from "node:process";
 var MAP_FILE = "rshow.map.json";
-function isRecord5(value) {
+function isRecord6(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function textMap(file, key2, value) {
   if (value === void 0 || value === null) return {};
-  if (!isRecord5(value)) throw new UsageError(`${file}: ${key2} must be an object`);
+  if (!isRecord6(value)) throw new UsageError(`${file}: ${key2} must be an object`);
   const out = {};
   for (const [name, target] of Object.entries(value)) {
     if (typeof target !== "string") throw new UsageError(`${file}: ${key2}.${name} must be a string`);
@@ -4881,12 +5756,12 @@ function textMap(file, key2, value) {
   return out;
 }
 function mapPath(dir) {
-  return path16.resolve(dir ?? process9.cwd(), MAP_FILE);
+  return path20.resolve(dir ?? process16.cwd(), MAP_FILE);
 }
 async function readMapFile(file) {
   let text;
   try {
-    text = await readFile12(file, "utf8");
+    text = await readFile15(file, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return void 0;
     throw new UsageError(`cannot read ${file}: ${err instanceof Error ? err.message : String(err)}`);
@@ -4897,7 +5772,7 @@ async function readMapFile(file) {
   } catch {
     throw new UsageError(`invalid JSON in ${file}`);
   }
-  if (!isRecord5(parsed)) throw new UsageError(`${file} must hold a JSON object`);
+  if (!isRecord6(parsed)) throw new UsageError(`${file} must hold a JSON object`);
   return {
     components: textMap(file, "components", parsed.components),
     tokens: textMap(file, "tokens", parsed.tokens),
@@ -4905,7 +5780,7 @@ async function readMapFile(file) {
   };
 }
 async function writeMapFile(file, map) {
-  await writeFile5(file, `${JSON.stringify(sortMap(map), null, 2)}
+  await writeFile8(file, `${JSON.stringify(sortMap(map), null, 2)}
 `);
 }
 function sortRecord(value) {
@@ -5349,14 +6224,14 @@ function parseTarget(input) {
   if (remote !== null) {
     return { kind: "remote", slug: remote[1], version: Number(remote[2]) };
   }
-  const dir = path17.resolve(input);
-  return { kind: "local", dir, slug: deriveSlug(path17.basename(dir)) || "handoff" };
+  const dir = path21.resolve(input);
+  return { kind: "local", dir, slug: deriveSlug(path21.basename(dir)) || "handoff" };
 }
 async function requireLocalDir(target) {
   if (target.kind !== "local") throw new UsageError("expected a local folder");
-  const info = await stat11(target.dir).catch(() => void 0);
+  const info = await stat14(target.dir).catch(() => void 0);
   if (info === void 0 || !info.isDirectory()) throw new UsageError(`no such folder: ${target.dir}`);
-  const index = await stat11(path17.join(target.dir, "index.html")).catch(() => void 0);
+  const index = await stat14(path21.join(target.dir, "index.html")).catch(() => void 0);
   if (index === void 0 || !index.isFile()) throw new UsageError(`${target.dir} has no index.html`);
   return target.dir;
 }
@@ -5371,10 +6246,10 @@ function safeName(text) {
   return cleaned === "" ? "screen" : cleaned;
 }
 function displayPath(target) {
-  const resolved = path17.resolve(target);
-  const relative = path17.relative(process10.cwd(), resolved);
+  const resolved = path21.resolve(target);
+  const relative = path21.relative(process17.cwd(), resolved);
   if (relative === "") return ".";
-  if (relative.startsWith("..") || path17.isAbsolute(relative)) return resolved;
+  if (relative.startsWith("..") || path21.isAbsolute(relative)) return resolved;
   return relative;
 }
 function baselineName(screen, state, width, mode) {
@@ -5409,10 +6284,11 @@ async function collectStyleTexts(url, fetchImpl = fetch) {
 }
 async function assertPublic(url, art, fetchImpl = fetch) {
   let reply;
+  await readyNetwork();
   try {
     reply = await fetchImpl(url, { headers: { accept: "text/html" }, redirect: "follow" });
   } catch (err) {
-    throw new UsageError(`cannot reach ${url}: ${err instanceof Error ? err.message : String(err)}`);
+    throw new UsageError(`cannot reach ${url}: ${networkDetail(err, url)}`);
   }
   const host = new URL(art).host;
   const wandered = new URL(reply.url === "" ? url : reply.url).host !== host;
@@ -5535,7 +6411,7 @@ async function runHandoff(target, opts) {
   const version = target.kind === "remote" ? target.version : null;
   const slug = target.slug;
   const url = target.kind === "remote" ? `${art}/${slug}/v${version}/` : "";
-  const out = path17.resolve(opts.out);
+  const out = path21.resolve(opts.out);
   let closePreview;
   let pageUrl = url;
   if (target.kind === "remote") {
@@ -5550,8 +6426,8 @@ async function runHandoff(target, opts) {
   const styleTexts = await collectStyleTexts(pageUrl, fetchImpl);
   const tokens = extractTokens(styleTexts);
   say(`tokens: ${tokens.light.length} light, ${tokens.dark.length} dark`);
-  await mkdir4(path17.join(out, "baseline"), { recursive: true });
-  await writeFile6(path17.join(out, "tokens.json"), `${JSON.stringify(dtcgTokens(tokens), null, 2)}
+  await mkdir7(path21.join(out, "baseline"), { recursive: true });
+  await writeFile9(path21.join(out, "tokens.json"), `${JSON.stringify(dtcgTokens(tokens), null, 2)}
 `);
   const screens = [];
   const baselines = [];
@@ -5602,7 +6478,7 @@ async function runHandoff(target, opts) {
             }
             const png = await capture(page, screen);
             const name = baselineName(screen.id, state, width, mode);
-            await writeFile6(path17.join(out, "baseline", name), png);
+            await writeFile9(path21.join(out, "baseline", name), png);
             baselines.push({ screen: screen.id, state, width, mode, file: `baseline/${name}` });
           }
         }
@@ -5631,7 +6507,7 @@ async function runHandoff(target, opts) {
     screens,
     baselines
   };
-  await writeFile6(path17.join(out, "spec.json"), `${JSON.stringify(spec, null, 2)}
+  await writeFile9(path21.join(out, "spec.json"), `${JSON.stringify(spec, null, 2)}
 `);
   const mapFile = MAP_FILE;
   let mapWritten = false;
@@ -5650,7 +6526,7 @@ async function runHandoff(target, opts) {
     createdAt,
     mapFile
   });
-  await writeFile6(path17.join(out, "HANDOFF.md"), markdown);
+  await writeFile9(path21.join(out, "HANDOFF.md"), markdown);
   return {
     out,
     url: pageUrl,
@@ -5707,14 +6583,14 @@ async function run16(argv, ctx) {
     requireUrl(config);
     requireArt(config);
   } else if (config.art === void 0) {
-    warn2("no art host configured; skipping the /_themes proxy");
+    warn("no art host configured; skipping the /_themes proxy");
   }
   const result = await runHandoff(target, {
     out,
     widths: widthList(stringValue(args, "widths")),
     modes: modeList(stringValue(args, "modes")),
     art: config.art ?? "",
-    chrome: process11.env.CHROME,
+    chrome: process18.env.CHROME,
     onProgress: (line) => ctx.out.line(line)
   });
   const display = displayPath(result.out);
@@ -5740,11 +6616,11 @@ async function run16(argv, ctx) {
 }
 
 // src/commands/compare.ts
-import process13 from "node:process";
+import process20 from "node:process";
 
 // src/compare.ts
-import { copyFile, mkdir as mkdir5, readFile as readFile14, writeFile as writeFile7 } from "node:fs/promises";
-import path19 from "node:path";
+import { copyFile, mkdir as mkdir8, readFile as readFile17, writeFile as writeFile10 } from "node:fs/promises";
+import path23 from "node:path";
 
 // src/diff.ts
 var MAX_Y = 35215;
@@ -5906,10 +6782,10 @@ function diffImages(before, after, opts = {}) {
 
 // src/native.ts
 import { spawn as spawn4 } from "node:child_process";
-import { readFile as readFile13, unlink } from "node:fs/promises";
+import { readFile as readFile16, unlink as unlink2 } from "node:fs/promises";
 import { tmpdir as tmpdir4 } from "node:os";
-import path18 from "node:path";
-import process12 from "node:process";
+import path22 from "node:path";
+import process19 from "node:process";
 var FILE_PREFIX = "file:";
 var WINDOW_PREFIX = "window:";
 var TMUX_PREFIX = "tmux:";
@@ -5938,9 +6814,9 @@ function isNative(source) {
 }
 async function captureNative(source, mapDir, deps = {}) {
   if (source.kind === "file") {
-    const file = path18.resolve(mapDir, source.file);
+    const file = path22.resolve(mapDir, source.file);
     try {
-      return new Uint8Array(await readFile13(file));
+      return new Uint8Array(await readFile16(file));
     } catch {
       throw new UsageError(`no screenshot at ${source.file}, which is relative to rshow.map.json`);
     }
@@ -5988,8 +6864,8 @@ function noWindow(title, seen) {
   return new UsageError(`no window matches ${JSON.stringify(title)} (${list3}); use ${WINDOW_PREFIX} with an owner name or a title, or ${NATIVE_HINT}`);
 }
 var systemRunner = {
-  run: (bin2, args) => new Promise((resolve2, reject) => {
-    const child = spawn4(bin2, [...args], { stdio: ["ignore", "pipe", "pipe"] });
+  run: (bin3, args) => new Promise((resolve2, reject) => {
+    const child = spawn4(bin3, [...args], { stdio: ["ignore", "pipe", "pipe"] });
     let stdout = "";
     let stderr = "";
     child.stdout?.setEncoding("utf8");
@@ -6000,10 +6876,10 @@ var systemRunner = {
     child.stderr?.on("data", (chunk2) => {
       stderr += chunk2;
     });
-    child.on("error", (err) => reject(new UsageError(`cannot run ${bin2}: ${err.message}`)));
+    child.on("error", (err) => reject(new UsageError(`cannot run ${bin3}: ${err.message}`)));
     child.on("close", (code) => {
       if (code !== 0) {
-        reject(new UsageError(stderr.trim() === "" ? `${bin2} exited ${code}` : `${bin2}: ${stderr.trim()}`));
+        reject(new UsageError(stderr.trim() === "" ? `${bin3} exited ${code}` : `${bin3}: ${stderr.trim()}`));
         return;
       }
       resolve2(stdout);
@@ -6011,9 +6887,9 @@ var systemRunner = {
   })
 };
 async function captureWindow(title, deps = {}) {
-  const platform = deps.platform ?? process12.platform;
+  const platform = deps.platform ?? process19.platform;
   const runner = deps.runner ?? systemRunner;
-  const scratch = path18.join(tmpdir4(), `rshow-window-${process12.pid}-${Date.now()}.png`);
+  const scratch = path22.join(tmpdir4(), `rshow-window-${process19.pid}-${Date.now()}.png`);
   const wrap = (err) => err instanceof UsageError ? err : new UsageError(`window: ${title}: ${err instanceof Error ? err.message : String(err)}; ${NATIVE_HINT}`);
   try {
     if (platform === "darwin") {
@@ -6029,11 +6905,11 @@ async function captureWindow(title, deps = {}) {
     } else {
       throw new UsageError(`window: capture is not supported on ${platform}; ${NATIVE_HINT}`);
     }
-    return new Uint8Array(await readFile13(scratch));
+    return new Uint8Array(await readFile16(scratch));
   } catch (err) {
     throw wrap(err);
   } finally {
-    await unlink(scratch).catch(() => {
+    await unlink2(scratch).catch(() => {
     });
   }
 }
@@ -6070,23 +6946,23 @@ function extractPalette(image, k = 8) {
       const g = image.data[pos + 1];
       const b = image.data[pos + 2];
       const key2 = r >> BIN_SHIFT << BITS * 2 | g >> BIN_SHIFT << BITS | b >> BIN_SHIFT;
-      const bin2 = bins.get(key2);
-      if (bin2 === void 0) bins.set(key2, { count: 1, r, g, b });
+      const bin3 = bins.get(key2);
+      if (bin3 === void 0) bins.set(key2, { count: 1, r, g, b });
       else {
-        bin2.count += 1;
-        bin2.r += r;
-        bin2.g += g;
-        bin2.b += b;
+        bin3.count += 1;
+        bin3.r += r;
+        bin3.g += g;
+        bin3.b += b;
       }
       used += 1;
     }
   }
   if (used === 0) return [];
   const seeds = [...bins.values()].sort((left, right) => right.count - left.count).slice(0, k);
-  let centers = seeds.map((bin2) => ({ r: bin2.r / bin2.count, g: bin2.g / bin2.count, b: bin2.b / bin2.count }));
-  const points = [...bins.values()].map((bin2) => ({
-    color: { r: bin2.r / bin2.count, g: bin2.g / bin2.count, b: bin2.b / bin2.count },
-    weight: bin2.count
+  let centers = seeds.map((bin3) => ({ r: bin3.r / bin3.count, g: bin3.g / bin3.count, b: bin3.b / bin3.count }));
+  const points = [...bins.values()].map((bin3) => ({
+    color: { r: bin3.r / bin3.count, g: bin3.g / bin3.count, b: bin3.b / bin3.count },
+    weight: bin3.count
   }));
   for (let round2 = 0; round2 < ROUNDS && centers.length > 1; round2 += 1) {
     const sums = centers.map(() => ({ r: 0, g: 0, b: 0, weight: 0 }));
@@ -6801,9 +7677,9 @@ function compareGrid(expected, actual) {
   }
   return { rows, differing, pass: differing.length === 0 };
 }
-function captureTmux(target, bin2 = "tmux") {
+function captureTmux(target, bin3 = "tmux") {
   return new Promise((resolve2, reject) => {
-    const child = spawn5(bin2, ["capture-pane", "-p", "-e", "-t", target], { stdio: ["ignore", "pipe", "pipe"] });
+    const child = spawn5(bin3, ["capture-pane", "-p", "-e", "-t", target], { stdio: ["ignore", "pipe", "pipe"] });
     let stdout = "";
     let stderr = "";
     child.stdout?.setEncoding("utf8");
@@ -6815,11 +7691,11 @@ function captureTmux(target, bin2 = "tmux") {
       stderr += chunk2;
     });
     child.on("error", (err) => {
-      reject(new ApiError(`cannot run ${bin2}: ${err.message}`));
+      reject(new ApiError(`cannot run ${bin3}: ${err.message}`));
     });
     child.on("close", (code) => {
       if (code !== 0) {
-        reject(new ApiError(stderr.trim() === "" ? `${bin2} exited ${code}` : stderr.trim()));
+        reject(new ApiError(stderr.trim() === "" ? `${bin3} exited ${code}` : stderr.trim()));
         return;
       }
       resolve2(stdout);
@@ -6843,9 +7719,9 @@ var EMPTY_MAP = { components: {}, tokens: {}, screens: {} };
 async function readJson(file, what) {
   let text;
   try {
-    text = await readFile14(file, "utf8");
+    text = await readFile17(file, "utf8");
   } catch {
-    throw new UsageError(`${what} is missing ${path19.basename(file)} (run rshow handoff first)`);
+    throw new UsageError(`${what} is missing ${path23.basename(file)} (run rshow handoff first)`);
   }
   try {
     return JSON.parse(text);
@@ -6854,13 +7730,13 @@ async function readJson(file, what) {
   }
 }
 async function readHandoff(dir) {
-  const spec = await readJson(path19.join(dir, "spec.json"), dir);
+  const spec = await readJson(path23.join(dir, "spec.json"), dir);
   if (spec === null || typeof spec !== "object" || !Array.isArray(spec.screens)) {
     throw new UsageError(`${dir}/spec.json does not hold a handoff spec`);
   }
   let tokens = { light: [], dark: [] };
   try {
-    tokens = flattenDtcg(JSON.parse(await readFile14(path19.join(dir, "tokens.json"), "utf8")));
+    tokens = flattenDtcg(JSON.parse(await readFile17(path23.join(dir, "tokens.json"), "utf8")));
   } catch {
     tokens = { light: [], dark: [] };
   }
@@ -6883,15 +7759,15 @@ function clipOf(info, screenId) {
 async function runCompare(opts) {
   const say = opts.onProgress ?? (() => {
   });
-  const dir = path19.resolve(opts.against);
+  const dir = path23.resolve(opts.against);
   const { spec, tokens } = await readHandoff(dir);
-  const mapFile = opts.map === void 0 ? mapPath() : path19.resolve(opts.map);
+  const mapFile = opts.map === void 0 ? mapPath() : path23.resolve(opts.map);
   const map = await readMapFile(mapFile) ?? EMPTY_MAP;
-  const mapDir = path19.dirname(mapFile);
-  const reportDir = path19.join(dir, "compare-report");
-  const imagesDir = path19.join(reportDir, "images");
-  await mkdir5(imagesDir, { recursive: true });
-  await mkdir5(path19.join(dir, "diff"), { recursive: true });
+  const mapDir = path23.dirname(mapFile);
+  const reportDir = path23.join(dir, "compare-report");
+  const imagesDir = path23.join(reportDir, "images");
+  await mkdir8(imagesDir, { recursive: true });
+  await mkdir8(path23.join(dir, "diff"), { recursive: true });
   const results = [];
   const collected = [];
   let skipped = 0;
@@ -6926,16 +7802,16 @@ async function runCompare(opts) {
       throw new UsageError(`tmux capture failed for ${target}: ${err instanceof Error ? err.message : String(err)}`);
     });
     const text = opts.tuiColors ? captured : stripAnsi(captured);
-    const baselineFile = path19.join(dir, "baseline", `${safeName(screen)}.txt`);
+    const baselineFile = path23.join(dir, "baseline", `${safeName(screen)}.txt`);
     let expected;
     try {
-      expected = await readFile14(baselineFile, "utf8");
+      expected = await readFile17(baselineFile, "utf8");
     } catch {
       expected = void 0;
     }
     if (expected === void 0) {
-      await mkdir5(path19.dirname(baselineFile), { recursive: true });
-      await writeFile7(baselineFile, text);
+      await mkdir8(path23.dirname(baselineFile), { recursive: true });
+      await writeFile10(baselineFile, text);
       results.push({
         screen,
         state: "default",
@@ -6980,12 +7856,12 @@ async function runCompare(opts) {
     const raw = (map.screens[screen] ?? "").trim();
     say(`capture: ${raw}`);
     let capture2;
-    let failure2;
+    let failure;
     try {
       capture2 = decodePng(await captureNative(group.source, mapDir));
     } catch (err) {
       if (err instanceof UsageError) throw err;
-      failure2 = err instanceof Error ? err.message : String(err);
+      failure = err instanceof Error ? err.message : String(err);
     }
     const screenSpec = spec.screens.find((item) => item.id === screen);
     const rubricFile = nativeName(screen);
@@ -7004,13 +7880,13 @@ async function runCompare(opts) {
         rubric: rubricFile,
         mismatches: []
       };
-      if (failure2 !== void 0 || capture2 === void 0) {
-        results.push({ ...base, note: `capture failed: ${failure2 ?? "no pixels"}` });
+      if (failure !== void 0 || capture2 === void 0) {
+        results.push({ ...base, note: `capture failed: ${failure ?? "no pixels"}` });
         continue;
       }
       let expectedImage;
       try {
-        expectedImage = decodePng(new Uint8Array(await readFile14(path19.join(dir, baseline.file))));
+        expectedImage = decodePng(new Uint8Array(await readFile17(path23.join(dir, baseline.file))));
       } catch {
         results.push({ ...base, note: `missing baseline ${baseline.file}` });
         continue;
@@ -7022,10 +7898,10 @@ async function runCompare(opts) {
         threshold: opts.threshold
       });
       const diffPng = encodePng(diff.image);
-      await writeFile7(path19.join(imagesDir, `${stem}-diff.png`), diffPng);
-      await writeFile7(path19.join(dir, "diff", `${stem}.png`), diffPng);
-      await writeFile7(path19.join(imagesDir, `${stem}-capture.png`), encodePng(scaled));
-      await copyFile(path19.join(dir, baseline.file), path19.join(imagesDir, `${stem}-baseline.png`));
+      await writeFile10(path23.join(imagesDir, `${stem}-diff.png`), diffPng);
+      await writeFile10(path23.join(dir, "diff", `${stem}.png`), diffPng);
+      await writeFile10(path23.join(imagesDir, `${stem}-capture.png`), encodePng(scaled));
+      await copyFile(path23.join(dir, baseline.file), path23.join(imagesDir, `${stem}-baseline.png`));
       const expected = screenSpec === void 0 ? [] : normativeColors(screenSpec, tokens, baseline.state, baseline.mode);
       const palette = checkPalette(extractPalette(scaled), expected);
       const pixelOk = diff.ratio <= opts.nativeMaxDiffRatio;
@@ -7070,7 +7946,7 @@ async function runCompare(opts) {
       });
     }
     if (screenSpec !== void 0) {
-      await writeFile7(path19.join(reportDir, rubricFile), `${rubricMarkdown({ screen: screenSpec, shots })}
+      await writeFile10(path23.join(reportDir, rubricFile), `${rubricMarkdown({ screen: screenSpec, shots })}
 `);
     }
   }
@@ -7127,12 +8003,12 @@ async function runCompare(opts) {
               }
               const clip = clipOf(info, screenId) ? await screenClip(page, screenId) : null;
               const actual = await page.screenshot(clip ?? void 0);
-              const actualFile = path19.join(imagesDir, `${stem}-actual.png`);
-              await writeFile7(actualFile, actual);
-              const baselineFile = path19.join(dir, baseline.file);
+              const actualFile = path23.join(imagesDir, `${stem}-actual.png`);
+              await writeFile10(actualFile, actual);
+              const baselineFile = path23.join(dir, baseline.file);
               let expected;
               try {
-                expected = new Uint8Array(await readFile14(baselineFile));
+                expected = new Uint8Array(await readFile17(baselineFile));
               } catch {
                 results.push({
                   screen: baseline.screen,
@@ -7147,14 +8023,14 @@ async function runCompare(opts) {
                 });
                 continue;
               }
-              const baselineCopy = path19.join(imagesDir, `${stem}-baseline.png`);
+              const baselineCopy = path23.join(imagesDir, `${stem}-baseline.png`);
               await copyFile(baselineFile, baselineCopy);
               const left = decodePng(expected);
               const right = decodePng(actual);
               const diff = diffImages(left, right, { threshold: opts.threshold });
               const diffPng = encodePng(diff.image);
-              await writeFile7(path19.join(imagesDir, `${stem}-diff.png`), diffPng);
-              await writeFile7(path19.join(dir, "diff", `${stem}.png`), diffPng);
+              await writeFile10(path23.join(imagesDir, `${stem}-diff.png`), diffPng);
+              await writeFile10(path23.join(dir, "diff", `${stem}.png`), diffPng);
               const note = left.width === right.width && left.height === right.height ? void 0 : `size ${left.width}x${left.height} against ${right.width}x${right.height}`;
               results.push({
                 screen: baseline.screen,
@@ -7223,8 +8099,8 @@ async function runCompare(opts) {
   const checked = results.filter((item) => item.source !== "").length;
   const review = results.filter((item) => item.status === "review").length;
   const generatedAt = (/* @__PURE__ */ new Date()).toISOString();
-  await writeFile7(
-    path19.join(reportDir, "report.json"),
+  await writeFile10(
+    path23.join(reportDir, "report.json"),
     `${JSON.stringify(
       {
         schema: 1,
@@ -7260,8 +8136,8 @@ async function runCompare(opts) {
     )}
 `
   );
-  await writeFile7(
-    path19.join(reportDir, "index.html"),
+  await writeFile10(
+    path23.join(reportDir, "index.html"),
     reportHtml({
       spec,
       results,
@@ -7314,15 +8190,15 @@ function reportHtml(input) {
   const nativeLimit = input.nativeMaxDiffRatio ?? 0.15;
   const statusOf = (item) => item.status ?? (item.pass ? "pass" : "fail");
   const rows = results.map((item) => {
-    const status = statusOf(item);
-    const mark = status === "pass" ? '<span class="pass">pass</span>' : status === "review" ? '<span class="review">review</span>' : '<span class="fail">fail</span>';
+    const status2 = statusOf(item);
+    const mark = status2 === "pass" ? '<span class="pass">pass</span>' : status2 === "review" ? '<span class="review">review</span>' : '<span class="fail">fail</span>';
     const ratio2 = item.diffRatio === void 0 ? "-" : item.diffRatio.toFixed(4);
     const rubric = item.rubric === void 0 ? "" : ` <a href="${escapeHtml(item.rubric)}">rubric</a>`;
     return `<tr><td>${escapeHtml(item.screen)}</td><td>${escapeHtml(item.state)}</td><td>${escapeHtml(item.mode)}</td><td>${item.width === 0 ? "-" : item.width}</td><td>${mark}</td><td>${ratio2}</td><td>${item.mismatches.length}</td><td>${escapeHtml(item.note ?? "")}${rubric}</td></tr>`;
   }).join("\n");
   const sections = results.filter((item) => item.images !== void 0 || item.mismatches.length > 0).map((item) => {
-    const status = statusOf(item);
-    const badge = `<span class="badge ${status}">${status}</span>`;
+    const status2 = statusOf(item);
+    const badge = `<span class="badge ${status2}">${status2}</span>`;
     const captureCaption = item.kind === "native" ? "capture" : "actual";
     const shots = item.images === void 0 ? "" : `<div class="shots">
   <figure><img src="${escapeHtml(item.images.baseline)}" alt="baseline"><figcaption>baseline</figcaption></figure>
@@ -7412,7 +8288,7 @@ async function run17(argv, ctx) {
       DEFAULT_NATIVE_MAX_DIFF_RATIO
     ),
     tuiColors: boolValue(args, "tui-colors"),
-    chrome: process13.env.CHROME,
+    chrome: process20.env.CHROME,
     onProgress: (line) => ctx.out.line(line)
   });
   const failing = result.results.filter((item) => !item.pass);
@@ -7427,8 +8303,8 @@ async function run17(argv, ctx) {
     const where = item.width === 0 ? item.mode : `${item.mode} ${item.width}`;
     const ratio2 = item.diffRatio === void 0 ? "" : ` diff ${item.diffRatio.toFixed(4)}`;
     const note = item.note === void 0 ? "" : ` (${item.note})`;
-    const status = item.status ?? (item.pass ? "pass" : "fail");
-    ctx.out.line(`${status} ${item.screen} ${item.state} ${where}${ratio2}${note}`);
+    const status2 = item.status ?? (item.pass ? "pass" : "fail");
+    ctx.out.line(`${status2} ${item.screen} ${item.state} ${where}${ratio2}${note}`);
     for (const mismatch of item.mismatches.slice(0, 20)) {
       ctx.out.line(
         `  mismatch ${item.screen} ${item.state} ${mismatch.component}: ${mismatch.property} expected ${mismatch.expected} actual ${mismatch.actual}`
@@ -7460,8 +8336,8 @@ async function run17(argv, ctx) {
 }
 
 // src/commands/docs.ts
-import { mkdir as mkdir6, readFile as readFile15, rm as rm5, writeFile as writeFile8 } from "node:fs/promises";
-import path20 from "node:path";
+import { mkdir as mkdir9, readFile as readFile18, rm as rm7, writeFile as writeFile11 } from "node:fs/promises";
+import path24 from "node:path";
 var USAGE = {
   publish: PUBLISH_USAGE,
   check: CHECK_USAGE,
@@ -7477,6 +8353,10 @@ var USAGE = {
   "theme preview": THEME_PREVIEW_USAGE,
   "theme publish": THEME_PUBLISH_USAGE,
   "theme list": THEME_LIST_USAGE,
+  skills: SKILLS_USAGE,
+  "skills install": SKILLS_INSTALL_USAGE,
+  "skills uninstall": SKILLS_UNINSTALL_USAGE,
+  "skills status": SKILLS_STATUS_USAGE,
   project: PROJECT_USAGE,
   "project create": PROJECT_CREATE_USAGE,
   "project list": PROJECT_LIST_USAGE,
@@ -7498,7 +8378,7 @@ var WHEN = {
   auth: "the API refused the token with 401 or 403.",
   api: "the API returned another error.",
   build: "the `--build` command failed.",
-  check: "`rshow check`, `rshow publish` or `rshow theme publish` found an error.",
+  check: "`rshow check`, `rshow publish` or `rshow theme publish` found an error, or `rshow skills install` found a skill folder that is not from rshow.",
   compare: "`rshow compare` found a difference."
 };
 var ARG_WORD = /^(?:<[^>]+>|\[[^\]]*\]|[a-z0-9-]+@v<n>|--?\S+)$/;
@@ -7736,7 +8616,7 @@ function heading(label) {
 async function themeTokensPage() {
   const dir = await builtinThemeDir("default");
   if (dir === void 0) throw new Error("no built-in theme: default");
-  const css = await readFile15(path20.join(dir, "tokens.css"), "utf8");
+  const css = await readFile18(path24.join(dir, "tokens.css"), "utf8");
   const end = css.indexOf("*/");
   const roles = parseRoles(end < 0 ? css : css.slice(0, end));
   const sections = parseSections(rootBlock(css));
@@ -7784,28 +8664,28 @@ function exitCodesPage() {
 `;
 }
 async function generate(out) {
-  const dir = path20.join(out, "commands");
-  await rm5(dir, { recursive: true, force: true });
-  await mkdir6(dir, { recursive: true });
+  const dir = path24.join(out, "commands");
+  await rm7(dir, { recursive: true, force: true });
+  await mkdir9(dir, { recursive: true });
   const rows = commandRows();
   const files = [];
   for (const row of rows) {
-    const file = path20.join(dir, row.file);
-    await writeFile8(file, commandPage(row, rows));
+    const file = path24.join(dir, row.file);
+    await writeFile11(file, commandPage(row, rows));
     files.push(file);
   }
-  const index = path20.join(dir, "index.md");
-  await writeFile8(index, indexPage(rows));
+  const index = path24.join(dir, "index.md");
+  await writeFile11(index, indexPage(rows));
   files.push(index);
   for (const [name, text] of [
     ["theme-tokens.md", await themeTokensPage()],
     ["exit-codes.md", exitCodesPage()]
   ]) {
-    const file = path20.join(out, name);
-    await writeFile8(file, text);
+    const file = path24.join(out, name);
+    await writeFile11(file, text);
     files.push(file);
   }
-  return { commands: rows.length, files: files.map((file) => path20.relative(out, file)).sort() };
+  return { commands: rows.length, files: files.map((file) => path24.relative(out, file)).sort() };
 }
 async function run18(argv, ctx) {
   const args = parseCommandArgs(argv, { out: { type: "string" } }, 0, 0, DOCS_USAGE);
@@ -7813,16 +8693,16 @@ async function run18(argv, ctx) {
   if (out === void 0) throw new UsageError(`docs needs --out <dir> (try: ${usageLine(DOCS_USAGE)})`);
   const result = await generate(out);
   ctx.out.data(result);
-  ctx.out.line(`wrote ${result.commands} command pages and the index under ${path20.join(out, "commands")}`);
-  ctx.out.line(`wrote ${path20.join(out, "theme-tokens.md")}`);
-  ctx.out.line(`wrote ${path20.join(out, "exit-codes.md")}`);
+  ctx.out.line(`wrote ${result.commands} command pages and the index under ${path24.join(out, "commands")}`);
+  ctx.out.line(`wrote ${path24.join(out, "theme-tokens.md")}`);
+  ctx.out.line(`wrote ${path24.join(out, "exit-codes.md")}`);
 }
 
 // src/commands/login.ts
-import process14 from "node:process";
+import process21 from "node:process";
 async function hiddenLine() {
-  process14.stderr.write("token: ");
-  const stdin = process14.stdin;
+  process21.stderr.write("token: ");
+  const stdin = process21.stdin;
   stdin.setRawMode(true);
   stdin.resume();
   stdin.setEncoding("utf8");
@@ -7832,7 +8712,7 @@ async function hiddenLine() {
       stdin.off("data", onData);
       stdin.setRawMode(false);
       stdin.pause();
-      process14.stderr.write("\n");
+      process21.stderr.write("\n");
       if (err === void 0) resolve2(text);
       else reject(err);
     };
@@ -7855,16 +8735,16 @@ async function hiddenLine() {
 }
 async function pipedText() {
   const chunks = [];
-  for await (const chunk2 of process14.stdin) chunks.push(chunk2);
+  for await (const chunk2 of process21.stdin) chunks.push(chunk2);
   return Buffer.concat(chunks).toString("utf8").trim();
 }
 async function tokenFromStdin() {
-  const token = process14.stdin.isTTY === true ? await hiddenLine() : await pipedText();
+  const token = process21.stdin.isTTY === true ? await hiddenLine() : await pipedText();
   if (token === "") throw new UsageError("expected a token on stdin");
   if (!token.startsWith(TOKEN_PREFIX)) throw new UsageError(`that is not an rshow token: it must start with ${TOKEN_PREFIX}`);
   return token;
 }
-async function run19(argv, ctx) {
+async function run19(argv, ctx, platform = process21.platform) {
   const args = parseCommandArgs(argv, { url: { type: "string" } }, 0, 0, LOGIN_USAGE);
   const settings = await ctx.config();
   const given = (stringValue(args, "url") ?? "").trim();
@@ -7873,32 +8753,45 @@ async function run19(argv, ctx) {
   const me = (await new Client(url, token).send("GET", "/api/me")).body;
   const email = typeof me?.email === "string" ? me.email : "";
   const scope = typeof me?.scope === "string" ? me.scope : "";
-  await save(url, token);
+  const store2 = await choose(process21.env, platform);
+  await store2.save(url, token);
+  if (await store2.read(url) !== token) {
+    throw new ApiError(`cannot save the token in ${store2.description}`);
+  }
   ctx.out.data({ email, scope, url });
-  ctx.out.line(`logged in as ${email} (scope ${scope}) for ${url}`);
+  ctx.out.line(`logged in as ${email} (scope ${scope}) for ${url}, saved in ${store2.description}`);
 }
 
 // src/commands/logout.ts
-async function run20(argv, ctx) {
+import process22 from "node:process";
+async function run20(argv, ctx, platform = process22.platform) {
   const args = parseCommandArgs(argv, { url: { type: "string" } }, 0, 0, LOGOUT_USAGE);
   const settings = await ctx.config();
   const given = (stringValue(args, "url") ?? "").trim();
   const url = (given === "" ? requireUrl(settings) : given).replace(/\/+$/, "");
-  const removed = await remove(url);
-  ctx.out.line(removed ? `logged out of ${url}` : `no saved token for ${url}`);
+  const removed = [];
+  for (const store2 of await every(process22.env, platform)) {
+    if (await store2.remove(url)) removed.push(store2.description);
+  }
+  if (removed.length === 0) {
+    ctx.out.line(`no saved token for ${url}`);
+    return;
+  }
+  ctx.out.line(`logged out of ${url}, removed from ${removed.join(" and ")}`);
 }
 
 // src/main.ts
 var COMMANDS = {
-  publish: { usage: PUBLISH_USAGE, run: run2 },
-  check: { usage: CHECK_USAGE, run: run3 },
+  publish: { usage: PUBLISH_USAGE, run },
+  check: { usage: CHECK_USAGE, run: run2 },
   handoff: { usage: HANDOFF_USAGE, run: run16 },
   compare: { usage: COMPARE_USAGE, run: run17 },
-  preview: { usage: PREVIEW_USAGE, run: run4 },
-  config: { usage: CONFIG_USAGE, run: run5 },
-  init: { usage: INIT_USAGE, run: run6 },
-  doctor: { usage: DOCTOR_USAGE, run: run7 },
-  theme: { usage: THEME_USAGE, run: run8 },
+  preview: { usage: PREVIEW_USAGE, run: run3 },
+  config: { usage: CONFIG_USAGE, run: run4 },
+  init: { usage: INIT_USAGE, run: run5 },
+  doctor: { usage: DOCTOR_USAGE, run: run6 },
+  theme: { usage: THEME_USAGE, run: run7 },
+  skills: { usage: SKILLS_USAGE, run: run8 },
   project: { usage: PROJECT_USAGE, run: run14 },
   tag: { usage: TAG_USAGE, run: run15 },
   list: { usage: LIST_USAGE, run: run9 },
@@ -7913,7 +8806,7 @@ var COMMANDS = {
 };
 function fail(err) {
   const message = err instanceof Error ? err.message : String(err);
-  process15.stderr.write(`rshow: ${message}
+  process23.stderr.write(`rshow: ${message}
 `);
   if (err instanceof UsageError) return EXIT.usage;
   if (err instanceof CheckError) return EXIT.check;
@@ -7930,17 +8823,18 @@ async function main(argv) {
   const name = args.find((arg) => !arg.startsWith("-"));
   const spec = name === void 0 ? void 0 : COMMANDS[name];
   if (wantsVersion) {
-    process15.stdout.write(`rshow ${VERSION}
+    const suffix = await isBinary() ? " (binary)" : "";
+    process23.stdout.write(`rshow ${VERSION}${suffix}
 `);
     return EXIT.ok;
   }
   if (wantsHelp) {
-    process15.stdout.write(`${spec === void 0 ? GENERAL_USAGE : spec.usage}
+    process23.stdout.write(`${spec === void 0 ? GENERAL_USAGE : spec.usage}
 `);
     return EXIT.ok;
   }
   if (name === void 0) {
-    process15.stderr.write(`${GENERAL_USAGE}
+    process23.stderr.write(`${GENERAL_USAGE}
 `);
     return EXIT.usage;
   }
@@ -7951,12 +8845,12 @@ async function main(argv) {
   const rest = [...args.slice(0, index), ...args.slice(index + 1)];
   const configs = /* @__PURE__ */ new Map();
   const clients = /* @__PURE__ */ new Map();
-  const keyOf = (dir) => dir === void 0 ? "" : path21.resolve(dir);
+  const keyOf = (dir) => dir === void 0 ? "" : path25.resolve(dir);
   const configFor = (dir) => {
     const key2 = keyOf(dir);
     let pending = configs.get(key2);
     if (pending === void 0) {
-      pending = loadConfig(process15.env, dir);
+      pending = loadConfig(process23.env, dir);
       configs.set(key2, pending);
     }
     return pending;
@@ -7969,7 +8863,7 @@ async function main(argv) {
       if (cached !== void 0) return cached;
       const settings = await configFor(dir);
       const url = requireUrl(settings);
-      const client = new Client(url, await readToken(process15.env, url));
+      const client = new Client(url, await readToken(process23.env, url));
       clients.set(key2, client);
       return client;
     },
@@ -7978,4 +8872,11 @@ async function main(argv) {
   const code = await spec.run(rest, ctx);
   return code ?? EXIT.ok;
 }
-process15.exitCode = await main(process15.argv.slice(2)).catch(fail);
+main(process23.argv.slice(2)).then(
+  (code) => {
+    process23.exitCode = code;
+  },
+  (err) => {
+    process23.exitCode = fail(err);
+  }
+);