runwork 0.25.0 → 0.25.2

package/dist/index.js

@@ -1020,26 +1020,36 @@ function buildHelperValue(execPath, scriptPath) {
   return `!"${normalised}" git-credential-helper`;
 }
 async function configureGitCredentials(remoteUrl) {
-  const origin = new URL(remoteUrl).origin;
+  let origin;
+  try {
+    origin = new URL(remoteUrl).origin;
+  } catch {
+    const message = `"${remoteUrl}" is not a valid URL.`;
+    console.warn(`Note: ${message}`);
+    return { ok: false, reason: "invalid-url", message };
+  }
   const key = `credential.${origin}.helper`;
   const helperValue = buildHelperValue(process.execPath, process.argv[1]);
   try {
     try {
       execFileSync("git", ["config", "--global", "--unset-all", key], { stdio: "pipe" });
-    } catch (unsetErr) {
-      if (unsetErr?.code === "ENOENT")
-        throw unsetErr;
-    }
+    } catch {}
     execFileSync("git", ["config", "--global", "--add", key, ""], { stdio: "pipe" });
     execFileSync("git", ["config", "--global", "--add", key, helperValue], { stdio: "pipe" });
+    return { ok: true };
   } catch (err) {
     const code = err?.code;
     if (code === "ENOENT") {
-      console.warn("Note: git is not installed. Skipping git credential helper setup.");
-      console.warn("Install git before running `runwork init`, `clone`, `dev`, or `deploy`.");
-      return;
+      const message2 = "git is not installed. Install git before running `runwork init`, `clone`, `dev`, or `deploy`.";
+      console.warn(`Note: ${message2}`);
+      return { ok: false, reason: "missing", message: message2 };
     }
-    throw err;
+    const detail = err instanceof Error ? err.message.split(`
+`)[0] : String(err);
+    const xcodeHint = process.platform === "darwin" ? " On macOS this usually means the Xcode Command Line Tools are missing; run `xcode-select --install`." : "";
+    const message = `git is installed but could not be run (${detail}).${xcodeHint}`;
+    console.warn(`Note: ${message}`);
+    return { ok: false, reason: "unusable", message };
   }
 }
 function lookupCredentialHelper(origin) {
@@ -1097,13 +1107,13 @@ async function ensureGitCredentialHelper(baseUrl) {
   try {
     origin = new URL(baseUrl).origin;
   } catch {
-    return;
+    return { ok: false, reason: "invalid-url", message: `"${baseUrl}" is not a valid URL.` };
   }
   const lookup = lookupCredentialHelper(origin);
   if (lookup.status === "registered" && helperBinaryStatus(lookup.value).ok && lookup.hasReset) {
-    return;
+    return { ok: true };
   }
-  await configureGitCredentials(baseUrl);
+  return configureGitCredentials(baseUrl);
 }
 async function removeGitCredentials(baseUrl) {
   const origin = new URL(baseUrl).origin;
@@ -1380,8 +1390,154 @@ var init_identity = __esm(() => {
   init_subprocess();
 });
 
+// src/utils/ignore-matcher.ts
+import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
+import { basename, join as join4 } from "path";
+function defaultIgnoreSets() {
+  return {
+    dirs: new Set(DEFAULT_DIR_NAMES),
+    files: new Set(DEFAULT_FILE_NAMES),
+    extensions: new Set(DEFAULT_EXTENSIONS)
+  };
+}
+function parseGitignoreContent(content) {
+  const dirs = new Set;
+  const files = new Set;
+  for (const rawLine of content.split(`
+`)) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#"))
+      continue;
+    if (line.startsWith("!"))
+      continue;
+    if (GLOB_CHARS.test(line))
+      continue;
+    let pattern = line;
+    const isDirOnly = pattern.endsWith("/");
+    if (isDirOnly)
+      pattern = pattern.slice(0, -1);
+    if (pattern.startsWith("/"))
+      pattern = pattern.slice(1);
+    if (!pattern)
+      continue;
+    if (pattern.includes("/"))
+      continue;
+    if (isDirOnly) {
+      dirs.add(pattern);
+    } else {
+      dirs.add(pattern);
+      files.add(pattern);
+    }
+  }
+  return { dirs, files };
+}
+function loadGitignoreFromDir(dir) {
+  const path = join4(dir, ".gitignore");
+  if (!existsSync4(path))
+    return { dirs: new Set, files: new Set };
+  try {
+    return parseGitignoreContent(readFileSync4(path, "utf-8"));
+  } catch {
+    return { dirs: new Set, files: new Set };
+  }
+}
+function buildIgnoreSets(dir) {
+  const sets = defaultIgnoreSets();
+  const parsed = loadGitignoreFromDir(dir);
+  for (const name of parsed.dirs)
+    sets.dirs.add(name);
+  for (const name of parsed.files)
+    sets.files.add(name);
+  return sets;
+}
+function isPathIgnored(filePath, sets) {
+  const name = basename(filePath);
+  if (sets.dirs.has(name))
+    return true;
+  if (sets.files.has(name))
+    return true;
+  const dotIndex = name.lastIndexOf(".");
+  if (dotIndex >= 0) {
+    const ext = name.slice(dotIndex);
+    if (sets.extensions.has(ext))
+      return true;
+  }
+  return false;
+}
+function isRelPathIgnored(relPath, sets) {
+  const segments = relPath.split("/");
+  for (let i = 0;i < segments.length - 1; i++) {
+    if (sets.dirs.has(segments[i]))
+      return true;
+  }
+  return isPathIgnored(relPath, sets);
+}
+var ALWAYS_IGNORED_DIRS, DEFAULT_DIR_NAMES, DEFAULT_FILE_NAMES, DEFAULT_EXTENSIONS, GLOB_CHARS;
+var init_ignore_matcher = __esm(() => {
+  ALWAYS_IGNORED_DIRS = [
+    ".git",
+    "node_modules",
+    ".runwork",
+    ".bun-cache",
+    ".npm-cache",
+    ".pnpm-store",
+    ".turbo",
+    ".vite",
+    ".cache",
+    "coverage",
+    "dist"
+  ];
+  DEFAULT_DIR_NAMES = ALWAYS_IGNORED_DIRS;
+  DEFAULT_FILE_NAMES = [
+    ".dev.vars",
+    ".env"
+  ];
+  DEFAULT_EXTENSIONS = [
+    ".log"
+  ];
+  GLOB_CHARS = /[*?\[\]]/;
+});
+
+// src/git/repo-config.ts
+function hardenRepoForRestrictedFs(cwd) {
+  for (const [key, value] of HARDENING) {
+    try {
+      execFileSync("git", ["config", key, value], { cwd, stdio: "pipe" });
+    } catch {}
+  }
+}
+function buildInitialGitignore() {
+  const dirs = ALWAYS_IGNORED_DIRS.filter((dir) => dir !== ".git").map((dir) => `${dir}/`);
+  return [
+    "# Dependencies, caches and build output",
+    ...dirs,
+    "",
+    "# Local secrets. Never commit these.",
+    ".dev.vars",
+    ".dev.vars*",
+    ".env",
+    ".env.*",
+    "",
+    "# Logs and tool state",
+    "*.log",
+    "*.tsbuildinfo",
+    ".eslintcache",
+    ""
+  ].join(`
+`);
+}
+var HARDENING;
+var init_repo_config = __esm(() => {
+  init_subprocess();
+  init_ignore_matcher();
+  HARDENING = [
+    ["gc.auto", "0"],
+    ["maintenance.auto", "false"]
+  ];
+});
+
 // src/git/preflight.ts
-import { existsSync as existsSync4 } from "fs";
+import { existsSync as existsSync5 } from "fs";
 import { win32 as winPath } from "path";
 import { homedir as homedir3 } from "os";
 function tryRun(bin) {
@@ -1403,9 +1559,9 @@ function whereGit() {
     const out = buf.toString("utf-8");
     const lines = out.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
     const exe = lines.find((line) => /\.exe$/i.test(line));
-    if (exe && existsSync4(exe))
+    if (exe && existsSync5(exe))
       return exe;
-    const fallback = lines.find((line) => existsSync4(line));
+    const fallback = lines.find((line) => existsSync5(line));
     return fallback ?? null;
   } catch {
     return null;
@@ -1430,7 +1586,7 @@ function registryGit() {
         continue;
       const installRoot = match[1].trim();
       const gitExe = winPath.join(installRoot, "cmd", "git.exe");
-      if (existsSync4(gitExe))
+      if (existsSync5(gitExe))
         return gitExe;
     } catch {}
   }
@@ -1498,7 +1654,7 @@ function probeGit() {
       }
     }
     for (const candidate of canonicalGitCandidates()) {
-      if (!existsSync4(candidate))
+      if (!existsSync5(candidate))
         continue;
       const verify = tryRun(candidate);
       if (verify.ok) {
@@ -1636,106 +1792,6 @@ async function resolveApp(client, nameOrId, workspaceId) {
   process.exit(1);
 }
 
-// src/utils/ignore-matcher.ts
-import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
-import { basename, join as join4 } from "path";
-function defaultIgnoreSets() {
-  return {
-    dirs: new Set(DEFAULT_DIR_NAMES),
-    files: new Set(DEFAULT_FILE_NAMES),
-    extensions: new Set(DEFAULT_EXTENSIONS)
-  };
-}
-function parseGitignoreContent(content) {
-  const dirs = new Set;
-  const files = new Set;
-  for (const rawLine of content.split(`
-`)) {
-    const line = rawLine.trim();
-    if (!line || line.startsWith("#"))
-      continue;
-    if (line.startsWith("!"))
-      continue;
-    if (GLOB_CHARS.test(line))
-      continue;
-    let pattern = line;
-    const isDirOnly = pattern.endsWith("/");
-    if (isDirOnly)
-      pattern = pattern.slice(0, -1);
-    if (pattern.startsWith("/"))
-      pattern = pattern.slice(1);
-    if (!pattern)
-      continue;
-    if (pattern.includes("/"))
-      continue;
-    if (isDirOnly) {
-      dirs.add(pattern);
-    } else {
-      dirs.add(pattern);
-      files.add(pattern);
-    }
-  }
-  return { dirs, files };
-}
-function loadGitignoreFromDir(dir) {
-  const path = join4(dir, ".gitignore");
-  if (!existsSync5(path))
-    return { dirs: new Set, files: new Set };
-  try {
-    return parseGitignoreContent(readFileSync4(path, "utf-8"));
-  } catch {
-    return { dirs: new Set, files: new Set };
-  }
-}
-function buildIgnoreSets(dir) {
-  const sets = defaultIgnoreSets();
-  const parsed = loadGitignoreFromDir(dir);
-  for (const name of parsed.dirs)
-    sets.dirs.add(name);
-  for (const name of parsed.files)
-    sets.files.add(name);
-  return sets;
-}
-function isPathIgnored(filePath, sets) {
-  const name = basename(filePath);
-  if (sets.dirs.has(name))
-    return true;
-  if (sets.files.has(name))
-    return true;
-  const dotIndex = name.lastIndexOf(".");
-  if (dotIndex >= 0) {
-    const ext = name.slice(dotIndex);
-    if (sets.extensions.has(ext))
-      return true;
-  }
-  return false;
-}
-function isRelPathIgnored(relPath, sets) {
-  const segments = relPath.split("/");
-  for (let i = 0;i < segments.length - 1; i++) {
-    if (sets.dirs.has(segments[i]))
-      return true;
-  }
-  return isPathIgnored(relPath, sets);
-}
-var DEFAULT_DIR_NAMES, DEFAULT_FILE_NAMES, DEFAULT_EXTENSIONS, GLOB_CHARS;
-var init_ignore_matcher = __esm(() => {
-  DEFAULT_DIR_NAMES = [
-    ".git",
-    "node_modules",
-    ".runwork",
-    ".bun-cache"
-  ];
-  DEFAULT_FILE_NAMES = [
-    ".dev.vars",
-    ".env"
-  ];
-  DEFAULT_EXTENSIONS = [
-    ".log"
-  ];
-  GLOB_CHARS = /[*?\[\]]/;
-});
-
 // src/template/manifest.ts
 import { createHash } from "crypto";
 import { readFileSync as readFileSync5, writeFileSync as writeFileSync2, existsSync as existsSync6, readdirSync, mkdirSync as mkdirSync2 } from "fs";
@@ -1782,17 +1838,39 @@ async function saveManifest(dir, manifest) {
   }
   writeFileSync2(join5(manifestDir, "template-manifest.json"), JSON.stringify(manifest, null, 2));
 }
+function loadManifestSync(dir) {
+  const manifestPath = join5(dir, ".runwork", "template-manifest.json");
+  if (!existsSync6(manifestPath))
+    return null;
+  try {
+    return normalizeManifest(JSON.parse(readFileSync5(manifestPath, "utf-8")));
+  } catch {
+    return null;
+  }
+}
+function isPristineTemplateFile(dir, relPath, manifest) {
+  const expectedHash = manifest?.files[relPath];
+  if (!expectedHash)
+    return false;
+  try {
+    return sha256(readFileSync5(join5(dir, relPath))) === expectedHash;
+  } catch {
+    return false;
+  }
+}
+function normalizeManifest(manifest) {
+  const files = {};
+  for (const [relPath, hash] of Object.entries(manifest.files)) {
+    files[relPath.split("\\").join("/")] = hash;
+  }
+  return { ...manifest, files };
+}
 async function loadManifest(dir) {
   const manifestPath = join5(dir, ".runwork", "template-manifest.json");
   if (!existsSync6(manifestPath))
     return null;
   try {
-    const manifest = JSON.parse(readFileSync5(manifestPath, "utf-8"));
-    const files = {};
-    for (const [relPath, hash] of Object.entries(manifest.files)) {
-      files[relPath.split("\\").join("/")] = hash;
-    }
-    return { ...manifest, files };
+    return normalizeManifest(JSON.parse(readFileSync5(manifestPath, "utf-8")));
   } catch {
     return null;
   }
@@ -2251,10 +2329,7 @@ async function execInit(client, appName, workspace, options = {}, creds) {
     execFileSync("git", ["remote", "set-url", "runwork", remoteUrl], { cwd: dir, stdio: "pipe" });
   }
   if (!existsSync7(join8(dir, ".gitignore"))) {
-    writeFileSync4(join8(dir, ".gitignore"), `node_modules/
-.runwork/
-.dev.vars
-`);
+    writeFileSync4(join8(dir, ".gitignore"), buildInitialGitignore());
   }
   execFileSync("git", ["add", "--", ".runwork.json", ".gitignore"], { cwd: dir, stdio: "pipe" });
   try {
@@ -2335,6 +2410,7 @@ var init_init = __esm(() => {
   init_store();
   init_client();
   init_identity();
+  init_repo_config();
   init_preflight();
   init_prompt();
   init_manifest();
@@ -2396,23 +2472,6 @@ var init_remote = __esm(() => {
   init_subprocess();
 });
 
-// src/git/repo-config.ts
-function hardenRepoForRestrictedFs(cwd) {
-  for (const [key, value] of HARDENING) {
-    try {
-      execFileSync("git", ["config", key, value], { cwd, stdio: "pipe" });
-    } catch {}
-  }
-}
-var HARDENING;
-var init_repo_config = __esm(() => {
-  init_subprocess();
-  HARDENING = [
-    ["gc.auto", "0"],
-    ["maintenance.auto", "false"]
-  ];
-});
-
 // src/git/classify-sync-error.ts
 function classifySyncError(raw) {
   if (!raw)
@@ -2420,6 +2479,9 @@ function classifySyncError(raw) {
   const s = raw.toLowerCase();
   if (raw === STASH_CONFLICT)
     return "conflict";
+  if (s.includes("[remote rejected]") || s.includes("[rejected]") || s.includes("pre-receive hook declined") || s.includes("push declined")) {
+    return "rejected";
+  }
   if (s.includes("does not appear to be a git repository") || s.includes("'runwork' does not appear") || s.includes("no such remote") || s.includes("remote") && s.includes("not found")) {
     return "no-remote";
   }
@@ -2467,6 +2529,19 @@ function diagnoseSyncError(raw) {
           "Confirm outbound access to runwork.ai, then run `runwork dev` again"
         ]
       };
+    case "rejected":
+      return {
+        reason,
+        message: "the server refused the push",
+        diagnosis: `The runwork remote rejected this push, so nothing was updated on the server. It said:
+${(raw ?? "").trim()}`,
+        suggestions: [
+          'Read the "remote:" lines above: they name the exact reason and the fix',
+          "If an oversized file was rejected, remove it from the commit and add it to .gitignore",
+          "If the history is reported as damaged, contact support to rebuild it",
+          "Retrying without changing anything will fail the same way"
+        ]
+      };
     case "conflict":
       return {
         reason,
@@ -2942,26 +3017,61 @@ function hasTrackedChanges(cwd) {
   }
 }
 function removeConflictingUntrackedFiles(cwd) {
+  const kept = [];
   try {
     const remoteFiles = execFileSync("git", ["ls-tree", "-r", "--name-only", "runwork/main"], {
       cwd,
       encoding: "utf-8"
     }).trim().split(`
 `);
-    const untrackedOutput = execFileSync("git", ["ls-files", "--others", "--exclude-standard"], {
+    const untrackedOutput = execFileSync("git", ["-c", "core.quotePath=false", "ls-files", "--others", "--exclude-standard"], {
       cwd,
       encoding: "utf-8"
     }).trim();
     const untracked = new Set(untrackedOutput.split(`
 `).filter(Boolean));
+    const manifest = loadManifestSync(cwd);
     for (const file of remoteFiles) {
-      if (untracked.has(file)) {
+      if (!untracked.has(file))
+        continue;
+      if (matchesRemote(cwd, file) || isPristineTemplateFile(cwd, file, manifest)) {
         try {
           unlinkSync2(join11(cwd, file));
         } catch {}
+      } else {
+        kept.push(file);
       }
     }
   } catch {}
+  return { kept };
+}
+function matchesRemote(cwd, file) {
+  try {
+    const remoteOid = execFileSync("git", ["rev-parse", `runwork/main:${file}`], {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    const localOid = execFileSync("git", ["hash-object", "--", file], {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    return Boolean(remoteOid) && remoteOid === localOid;
+  } catch {
+    return false;
+  }
+}
+function conflictedPaths(cwd) {
+  try {
+    return execFileSync("git", ["-c", "core.quotePath=false", "diff", "--name-only", "--diff-filter=U"], {
+      cwd,
+      encoding: "utf-8"
+    }).trim().split(`
+`).filter(Boolean);
+  } catch {
+    return [];
+  }
 }
 function extractGitError(err) {
   if (err && typeof err === "object") {
@@ -2996,9 +3106,11 @@ function syncWithRemote(cwd) {
   }
   let status = "synced";
   let syncError;
+  let keptUntracked = [];
+  let remoteOverwrote = [];
   try {
     execFileSync("git", ["fetch", "runwork", "main"], { cwd, stdio: "pipe" });
-    removeConflictingUntrackedFiles(cwd);
+    keptUntracked = removeConflictingUntrackedFiles(cwd).kept;
     try {
       execFileSync("git", ["rebase", "runwork/main"], { cwd, stdio: "pipe" });
     } catch (rebaseErr) {
@@ -3009,6 +3121,7 @@ function syncWithRemote(cwd) {
         execFileSync("git", ["merge", "runwork/main", "--allow-unrelated-histories", "--no-edit"], { cwd, stdio: "pipe" });
         status = "merged";
       } catch {
+        remoteOverwrote = conflictedPaths(cwd);
         try {
           execFileSync("git", ["merge", "--abort"], { cwd, stdio: "pipe" });
         } catch {}
@@ -3019,6 +3132,7 @@ function syncWithRemote(cwd) {
           try {
             execFileSync("git", ["merge", "--abort"], { cwd, stdio: "pipe" });
           } catch {}
+          remoteOverwrote = [];
           status = "sync-failed";
           syncError = extractGitError(mergeErr);
         }
@@ -3032,21 +3146,25 @@ function syncWithRemote(cwd) {
     try {
       execFileSync("git", ["stash", "pop"], { cwd, stdio: "pipe" });
     } catch {
-      return { status, pushed: false, error: "stash-conflict" };
+      return { status, pushed: false, error: "stash-conflict", keptUntracked, remoteOverwrote };
     }
   }
   if (status === "sync-failed") {
-    return { status, pushed: false, error: syncError };
+    return { status, pushed: false, error: syncError, keptUntracked, remoteOverwrote };
   }
   let pushed = false;
+  let pushError;
   try {
     execFileSync("git", ["push", "runwork", "HEAD:main"], { cwd, stdio: "pipe" });
     pushed = true;
-  } catch {}
-  return { status, pushed };
+  } catch (pushErr) {
+    pushError = extractGitError(pushErr);
+  }
+  return { status, pushed, pushError, keptUntracked, remoteOverwrote };
 }
 var init_sync = __esm(() => {
   init_subprocess();
+  init_manifest();
 });
 
 // src/git/critical-files.ts
@@ -4982,6 +5100,31 @@ export interface ClientErrorReport {
     level?: 'error' | 'warning' | 'info';
     category?: string;
 }
+/**
+ * Decide whether to send the permissive \`Permissions-Policy\` header for an app
+ * that is being embedded in an iframe.
+ *
+ * A document's own Permissions-Policy can only restrict, never grant: the grant
+ * comes from the embedding page's policy plus the iframe \`allow\` attribute. This
+ * header's job is therefore to stop the app self-restricting the features the
+ * platform preview delegates to it, and this predicate decides who is trusted
+ * enough to be handed that.
+ *
+ * Hostnames are parsed and compared exactly, never substring-matched against the
+ * raw header. The difference is not cosmetic: \`origin.endsWith('runwork.ai')\`
+ * also matches \`https://notrunwork.ai\`, and \`origin.includes(domain)\` matches
+ * \`https://evil-acme.com.attacker.net\` against a tenant's \`acme.com\`, which would
+ * hand an attacker's page camera, microphone, geolocation and screen capture over
+ * an embedded app.
+ *
+ * @param origin  The \`Origin\` header, or the \`Referer\` as a fallback. Origin is a
+ *                bare origin and Referer is a full URL; both parse the same way.
+ *                Empty means direct (non-embedded) access.
+ * @param allowedOrigins Comma-separated exact hostnames from \`ALLOWED_ORIGINS\`,
+ *                injected by the platform as the workspace's active custom
+ *                domains. Matched exactly; subdomains are deliberately excluded.
+ */
+export declare function shouldGrantIframePermissions(origin: string, allowedOrigins?: string): boolean;
 /**
  * Mount all core platform routes on the Hono app
  * Called from index.ts before user-defined routes
@@ -7840,7 +7983,7 @@ function createKeyboardListener() {
 }
 
 // src/generated/version.ts
-var VERSION = "0.25.0";
+var VERSION = "0.25.2";
 
 // src/commands/dev.ts
 var exports_dev = {};
@@ -8068,6 +8211,36 @@ async function execDev(options) {
         }
       }
     }
+    if (syncResult.remoteOverwrote && syncResult.remoteOverwrote.length > 0) {
+      if (useJson) {
+        jsonLine({ event: "sync_remote_overwrote", files: syncResult.remoteOverwrote, timestamp: ts() });
+      } else {
+        console.warn(yellow(`  Sync resolved conflicts in the remote's favour; local changes were replaced in: ${syncResult.remoteOverwrote.join(", ")}`));
+        console.warn(dim("  Recover them with `git reflog` / `git diff ORIG_HEAD` if that was wrong."));
+      }
+    }
+    if (syncResult.keptUntracked && syncResult.keptUntracked.length > 0) {
+      if (useJson) {
+        jsonLine({ event: "sync_kept_untracked", files: syncResult.keptUntracked, timestamp: ts() });
+      } else {
+        console.warn(yellow(`  Kept your untracked file(s) over the remote's copy: ${syncResult.keptUntracked.join(", ")}`));
+        console.warn(dim("  Commit or remove them so the sync can reconcile that path."));
+      }
+    }
+    if (!syncResult.pushed && syncResult.pushError) {
+      const diag = diagnoseSyncError(syncResult.pushError);
+      if (useJson) {
+        jsonLine({
+          event: "error",
+          phase: "push",
+          timestamp: ts(),
+          error: { reason: diag.reason, message: diag.message, diagnosis: diag.diagnosis, suggestions: diag.suggestions }
+        });
+      } else {
+        console.warn(yellow(`  Push failed: ${diag.message}`));
+        console.warn(dim(`  ${diag.diagnosis}`));
+      }
+    }
     if (useJson) {
       jsonLine({ event: "startup", phase: "sync", status: syncResult.status, pushed: syncResult.pushed, timestamp: ts() });
       if (syncResult.status === "sync-failed") {
@@ -8942,7 +9115,10 @@ var init_resolve = __esm(() => {
 
 // ../../shared/skill/skill-canonical.ts
 function toSkillSlug(value) {
-  return value.trim().replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  return transliterateLatin(value.trim()).replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+}
+function transliterateLatin(value) {
+  return value.replace(/[ıßøØłŁđĐæÆœŒþÞðÐ]/g, (ch) => NON_DECOMPOSABLE_LATIN[ch] ?? ch).normalize("NFD").replace(/[\u0300-\u036f]/g, "");
 }
 function isStructuredYamlValue(value) {
   if (value.includes(`
@@ -8987,11 +9163,13 @@ function parseSkillMd(content) {
   const lines = content.split(`
 `);
   if (lines[0]?.trim() !== "---") {
-    const rawName = lines[0]?.replace(/^#\s*/, "").trim() || "Untitled Skill";
+    const firstLine = lines[0]?.trim() ?? "";
+    const isHeading = /^#+\s/.test(firstLine);
+    const rawName = firstLine.replace(/^#+\s*/, "").trim() || "Untitled Skill";
     return {
       frontmatter: {
         name: toSkillSlug(rawName) || "untitled-skill",
-        description: ""
+        description: isHeading ? rawName : ""
       },
       orderedKeys: [],
       body: content,
@@ -9078,6 +9256,27 @@ function buildSkillMd(parts) {
   return lines.join(`
 `);
 }
+var NON_DECOMPOSABLE_LATIN;
+var init_skill_canonical = __esm(() => {
+  NON_DECOMPOSABLE_LATIN = {
+    "ı": "i",
+    "ß": "ss",
+    "ø": "o",
+    "Ø": "O",
+    "ł": "l",
+    "Ł": "L",
+    "đ": "d",
+    "Đ": "D",
+    "æ": "ae",
+    "Æ": "AE",
+    "œ": "oe",
+    "Œ": "OE",
+    "þ": "th",
+    "Þ": "TH",
+    "ð": "d",
+    "Ð": "D"
+  };
+});
 
 // src/agents/registry-data.ts
 function chatgptConnectorSteps(confirmLead) {
@@ -10716,6 +10915,7 @@ function buildSkillMd2(skill) {
 }
 var RUNWORK_MCP_PREFIX = "Runwork: ", RUNWORK_MCP_PREFIX_LEGACY = "runwork-", RUNWORK_WORKSPACE_MCP_NAME = "Runwork", RUNWORK_PLUGIN_MARKETPLACE = "runwork", toSlug;
 var init_types = __esm(() => {
+  init_skill_canonical();
   toSlug = toSkillSlug;
 });
 
@@ -17964,12 +18164,28 @@ var deployCommand = new Command5("deploy").description("Deploy the current app t
       console.error(`  - ${s}`);
     process.exit(1);
   }
+  if (syncResult.remoteOverwrote && syncResult.remoteOverwrote.length > 0) {
+    const files = syncResult.remoteOverwrote.join(", ");
+    if (useJson) {
+      jsonLine({ event: "sync_remote_overwrote", files: syncResult.remoteOverwrote, timestamp: new Date().toISOString() });
+    } else {
+      console.warn(`Sync resolved conflicts in the remote's favour; local changes were replaced in: ${files}`);
+      console.warn("  Recover them with `git reflog` / `git diff ORIG_HEAD` before deploying again if that was wrong.");
+    }
+  }
+  if (syncResult.keptUntracked && syncResult.keptUntracked.length > 0 && !useJson) {
+    console.warn(`Kept your untracked file(s) over the remote's copy: ${syncResult.keptUntracked.join(", ")}`);
+  }
   if (!syncResult.pushed) {
+    const diag = diagnoseSyncError(syncResult.pushError ?? syncResult.error);
     if (useJson) {
-      jsonOut(buildErrorResponse("deploy", "Failed to push before deployment", "Local commits were synced but could not be pushed to the remote.", ["Check your network connection", "Run runwork dev to retry syncing", "Then retry runwork deploy"]));
+      jsonOut(buildErrorResponse("deploy", `Failed to push before deployment: ${diag.message}`, diag.diagnosis, [...diag.suggestions, "Then retry runwork deploy"]));
       process.exit(1);
     }
-    console.error("Push failed. Check your connection and retry `runwork deploy`.");
+    console.error(`Push failed: ${diag.message}`);
+    console.error(diag.diagnosis);
+    for (const suggestion of diag.suggestions)
+      console.error(`  - ${suggestion}`);
     process.exit(1);
   }
   if (!useJson)
@@ -19646,6 +19862,7 @@ var infoCommand = new Command12("info").description("Show app context, registrie
 init_store();
 init_client();
 init_resolve();
+init_skill_canonical();
 import { Command as Command13 } from "commander";
 import { readFileSync as readFileSync22, existsSync as existsSync25 } from "fs";
 function truncate(text2, max) {
@@ -19720,7 +19937,7 @@ function buildSkillPushPayload(fileContent, nameArg) {
   const name = toSkillSlug(nameArg || "") || docName;
   if (!name)
     return null;
-  const description = parsed.hadFrontmatter ? parsed.frontmatter.description : "";
+  const description = parsed.frontmatter.description;
   const extra = {};
   for (const key of parsed.orderedKeys) {
     if (key === "name" || key === "description")
@@ -22392,8 +22609,8 @@ init_resolve();
 init_prompt();
 await init_detect();
 import { Command as Command27 } from "commander";
-import { join as join48 } from "path";
-import { homedir as homedir27 } from "os";
+import { join as join49 } from "path";
+import { homedir as homedir28 } from "os";
 
 // src/commands/sync.ts
 init_store();
@@ -22404,9 +22621,9 @@ await __promiseAll([
   init_codex()
 ]);
 import { Command as Command26 } from "commander";
-import { readFileSync as readFileSync40, existsSync as existsSync51 } from "fs";
-import { join as join47 } from "path";
-import { homedir as homedir26 } from "os";
+import { readFileSync as readFileSync41, existsSync as existsSync52 } from "fs";
+import { join as join48 } from "path";
+import { homedir as homedir27 } from "os";
 
 // src/commands/mcp-entries.ts
 init_types();
@@ -23265,6 +23482,91 @@ function sameStringSet(a, b) {
   return true;
 }
 
+// src/utils/sync-lock.ts
+import { existsSync as existsSync51, mkdirSync as mkdirSync28, readFileSync as readFileSync40, unlinkSync as unlinkSync8, writeFileSync as writeFileSync30 } from "fs";
+import { join as join47 } from "path";
+import { homedir as homedir26 } from "os";
+var LOCK_PATH = join47(homedir26(), ".runwork", "sync.lock");
+var STALE_LOCK_MS = 5 * 60 * 1000;
+var DEFAULT_WAIT_MS = 30000;
+var exitHandlerRegistered = false;
+function ensureExitHandler() {
+  if (exitHandlerRegistered)
+    return;
+  exitHandlerRegistered = true;
+  process.once("exit", releaseSyncLock);
+}
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err?.code === "EPERM";
+  }
+}
+function readLock() {
+  try {
+    return JSON.parse(readFileSync40(LOCK_PATH, "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function writeLockExclusive() {
+  try {
+    if (!existsSync51(join47(homedir26(), ".runwork"))) {
+      mkdirSync28(join47(homedir26(), ".runwork"), { recursive: true });
+    }
+    writeFileSync30(LOCK_PATH, JSON.stringify({ pid: process.pid, startedAt: Date.now() }), {
+      flag: "wx"
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function tryAcquireOnce() {
+  if (writeLockExclusive()) {
+    ensureExitHandler();
+    return true;
+  }
+  const existing = readLock();
+  const stale = !existing || Date.now() - existing.startedAt > STALE_LOCK_MS || !isProcessAlive(existing.pid);
+  if (!stale)
+    return false;
+  try {
+    unlinkSync8(LOCK_PATH);
+  } catch {}
+  if (writeLockExclusive()) {
+    ensureExitHandler();
+    return true;
+  }
+  return false;
+}
+function sleep2(ms) {
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
+}
+async function acquireSyncLock(waitMs = DEFAULT_WAIT_MS) {
+  const deadline = Date.now() + waitMs;
+  let delay = 250;
+  for (;; ) {
+    if (tryAcquireOnce())
+      return true;
+    const remaining = deadline - Date.now();
+    if (remaining <= 0)
+      return false;
+    await sleep2(Math.min(delay, remaining));
+    delay = Math.min(delay * 2, 5000);
+  }
+}
+function releaseSyncLock() {
+  const existing = readLock();
+  if (existing?.pid === process.pid) {
+    try {
+      unlinkSync8(LOCK_PATH);
+    } catch {}
+  }
+}
+
 // src/commands/sync.ts
 async function printAdoptionHint(credentials, workspaceId) {
   if (!workspaceId)
@@ -23281,10 +23583,10 @@ Tip: ${hint.title}`);
   } catch {}
 }
 function loadSetupState(filePath) {
-  if (!existsSync51(filePath))
+  if (!existsSync52(filePath))
     return null;
   try {
-    return JSON.parse(readFileSync40(filePath, "utf-8"));
+    return JSON.parse(readFileSync41(filePath, "utf-8"));
   } catch {
     return null;
   }
@@ -23305,15 +23607,15 @@ function readLocalSkills(state) {
     if (!baseDir)
       continue;
     for (const skillName of state.skills) {
-      const skillMdPath = join47(baseDir, skillName, "SKILL.md");
-      if (existsSync51(skillMdPath)) {
-        results.push({ name: skillName, content: readFileSync40(skillMdPath, "utf-8") });
+      const skillMdPath = join48(baseDir, skillName, "SKILL.md");
+      if (existsSync52(skillMdPath)) {
+        results.push({ name: skillName, content: readFileSync41(skillMdPath, "utf-8") });
         continue;
       }
       const filename = skillName.toLowerCase().replace(/[^a-z0-9]+/g, "-");
-      const flatPath = join47(baseDir, `${filename}.md`);
-      if (existsSync51(flatPath)) {
-        results.push({ name: skillName, content: readFileSync40(flatPath, "utf-8") });
+      const flatPath = join48(baseDir, `${filename}.md`);
+      if (existsSync52(flatPath)) {
+        results.push({ name: skillName, content: readFileSync41(flatPath, "utf-8") });
       }
     }
     if (results.length > 0)
@@ -23367,6 +23669,19 @@ function ensureWorkspacePointer(state, statePath2, credentials) {
   return true;
 }
 async function syncFromState(state, statePath2, credentials, opts) {
+  const acquired = await acquireSyncLock();
+  if (!acquired) {
+    console.log("  Another sync appears to be in progress on this machine; proceeding anyway.");
+    await runSyncFromState(state, statePath2, credentials, opts);
+    return;
+  }
+  try {
+    await runSyncFromState(state, statePath2, credentials, opts);
+  } finally {
+    releaseSyncLock();
+  }
+}
+async function runSyncFromState(state, statePath2, credentials, opts) {
   const client = new ApiClient(credentials);
   setVerbose(!!opts.verbose);
   if (!ensureWorkspacePointer(state, statePath2, credentials)) {
@@ -23554,9 +23869,9 @@ This account is not a member of "${state.workspaceName || state.workspaceId}".`)
     persona: state.persona
   });
   let projectAppSkillFilter = null;
-  if (existsSync51(".runwork.json")) {
+  if (existsSync52(".runwork.json")) {
     try {
-      const config = JSON.parse(readFileSync40(".runwork.json", "utf-8"));
+      const config = JSON.parse(readFileSync41(".runwork.json", "utf-8"));
       if (config.appName) {
         projectAppSkillFilter = config.appName.toLowerCase().replace(/[^a-z0-9]+/g, "-");
       }
@@ -23793,7 +24108,7 @@ This account is not a member of "${state.workspaceName || state.workspaceId}".`)
   }
   for (const adapter2 of adapters) {
     if (adapter2 instanceof CodexAdapter) {
-      const runworkDir = join47(homedir26(), ".runwork");
+      const runworkDir = join48(homedir27(), ".runwork");
       const result = adapter2.registerDesktopWorkspace(runworkDir, "Runwork");
       if (result === "written") {
         vlog(`  [${adapter2.name}] Registered workspace in Codex desktop app`);
@@ -23935,8 +24250,8 @@ var syncCommand = new Command26("sync").description("Sync skills bidirectionally
     verbose: !!opts.verbose,
     redetect: !!opts.redetect
   };
-  const projectStatePath = join47(process.cwd(), ".runwork", "setup.json");
-  const userStatePath = join47(homedir26(), ".runwork", "setup.json");
+  const projectStatePath = join48(process.cwd(), ".runwork", "setup.json");
+  const userStatePath = join48(homedir27(), ".runwork", "setup.json");
   const projectState = loadSetupState(projectStatePath);
   const userState = loadSetupState(userStatePath);
   if (!projectState && !userState) {
@@ -24005,7 +24320,7 @@ function toSkillFilename(name) {
   return name.toLowerCase().replace(/[^a-z0-9]+/g, "-");
 }
 function loadSetupStateForScope(scope) {
-  const path4 = scope === "project" ? join48(process.cwd(), ".runwork", "setup.json") : join48(homedir27(), ".runwork", "setup.json");
+  const path4 = scope === "project" ? join49(process.cwd(), ".runwork", "setup.json") : join49(homedir28(), ".runwork", "setup.json");
   return readJsonOrNull(path4);
 }
 async function parkAndTeardownWorkspace(previous, scopes) {
@@ -24174,8 +24489,8 @@ Re-run without --dry-run to sync workspace data.`);
   }
   persistDefaultWorkspace(workspaceId, workspaceName);
   for (const s of scopes) {
-    const dir = s === "project" ? ".runwork" : join48(homedir27(), ".runwork");
-    writeJsonAtomic(join48(dir, "setup.json"), state);
+    const dir = s === "project" ? ".runwork" : join49(homedir28(), ".runwork");
+    writeJsonAtomic(join49(dir, "setup.json"), state);
   }
   if (restored)
     clearParkedState(workspaceId);
@@ -24183,7 +24498,7 @@ Re-run without --dry-run to sync workspace data.`);
 Syncing workspace data...
 `);
   for (const s of scopes) {
-    const statePath2 = s === "project" ? join48(process.cwd(), ".runwork", "setup.json") : join48(homedir27(), ".runwork", "setup.json");
+    const statePath2 = s === "project" ? join49(process.cwd(), ".runwork", "setup.json") : join49(homedir28(), ".runwork", "setup.json");
     await syncFromState(state, statePath2, credentials, {
       dryRun: false,
       pullOnly: true,
@@ -24203,16 +24518,16 @@ init_client();
 import { Command as Command28 } from "commander";
 
 // src/utils/setup-state.ts
-import { existsSync as existsSync52, readFileSync as readFileSync41 } from "fs";
-import { join as join49 } from "path";
-import { homedir as homedir28 } from "os";
+import { existsSync as existsSync53, readFileSync as readFileSync42 } from "fs";
+import { join as join50 } from "path";
+import { homedir as homedir29 } from "os";
 function loadSetupState2() {
-  const projectPath = join49(process.cwd(), ".runwork", "setup.json");
-  const userPath = join49(homedir28(), ".runwork", "setup.json");
+  const projectPath = join50(process.cwd(), ".runwork", "setup.json");
+  const userPath = join50(homedir29(), ".runwork", "setup.json");
   for (const p of [projectPath, userPath]) {
-    if (existsSync52(p)) {
+    if (existsSync53(p)) {
       try {
-        return JSON.parse(readFileSync41(p, "utf-8"));
+        return JSON.parse(readFileSync42(p, "utf-8"));
       } catch {
         continue;
       }
@@ -24271,14 +24586,14 @@ init_client();
 init_types();
 await init_detect();
 import { Command as Command29 } from "commander";
-import { existsSync as existsSync53, readFileSync as readFileSync42 } from "fs";
-import { resolve as resolve3, join as join50 } from "path";
-import { homedir as homedir29 } from "os";
+import { existsSync as existsSync54, readFileSync as readFileSync43 } from "fs";
+import { resolve as resolve3, join as join51 } from "path";
+import { homedir as homedir30 } from "os";
 function loadSetupState3(filePath) {
-  if (!existsSync53(filePath))
+  if (!existsSync54(filePath))
     return null;
   try {
-    return JSON.parse(readFileSync42(filePath, "utf-8"));
+    return JSON.parse(readFileSync43(filePath, "utf-8"));
   } catch {
     return null;
   }
@@ -24294,8 +24609,8 @@ var buildPluginCommand = new Command29("build-plugin").description("Build an ins
     process.exit(1);
   }
   const credentials = requireAuth();
-  const projectStatePath = join50(process.cwd(), ".runwork", "setup.json");
-  const userStatePath = join50(homedir29(), ".runwork", "setup.json");
+  const projectStatePath = join51(process.cwd(), ".runwork", "setup.json");
+  const userStatePath = join51(homedir30(), ".runwork", "setup.json");
   const state = loadSetupState3(projectStatePath) ?? loadSetupState3(userStatePath);
   if (!state) {
     console.error("No setup state found. Run `runwork setup` first.");
@@ -24387,21 +24702,21 @@ var buildPluginCommand = new Command29("build-plugin").description("Build an ins
 init_prompt();
 await init_detect();
 import { Command as Command30 } from "commander";
-import { existsSync as existsSync54, readFileSync as readFileSync43, rmSync as rmSync13, unlinkSync as unlinkSync8 } from "fs";
-import { join as join51 } from "path";
-import { homedir as homedir30 } from "os";
+import { existsSync as existsSync55, readFileSync as readFileSync44, rmSync as rmSync13, unlinkSync as unlinkSync9 } from "fs";
+import { join as join52 } from "path";
+import { homedir as homedir31 } from "os";
 function loadSetupState4(filePath) {
-  if (!existsSync54(filePath))
+  if (!existsSync55(filePath))
     return null;
   try {
-    return JSON.parse(readFileSync43(filePath, "utf-8"));
+    return JSON.parse(readFileSync44(filePath, "utf-8"));
   } catch {
     return null;
   }
 }
 var uninstallCommand = new Command30("uninstall").description("Remove all Runwork configuration from local agents (MCP servers, skills, instructions)").option("-y, --yes", "Skip confirmation prompt").option("--keep-auth", "Keep authentication credentials (only remove agent configs)").action(async (opts) => {
-  const projectStatePath = join51(process.cwd(), ".runwork", "setup.json");
-  const userStatePath = join51(homedir30(), ".runwork", "setup.json");
+  const projectStatePath = join52(process.cwd(), ".runwork", "setup.json");
+  const userStatePath = join52(homedir31(), ".runwork", "setup.json");
   const projectState = loadSetupState4(projectStatePath);
   const userState = loadSetupState4(userStatePath);
   if (!projectState && !userState) {
@@ -24481,19 +24796,19 @@ This will remove all Runwork configuration from your local agents:
         }
       }
     }
-    const stateDir = label === "project" ? join51(process.cwd(), ".runwork") : join51(homedir30(), ".runwork");
+    const stateDir = label === "project" ? join52(process.cwd(), ".runwork") : join52(homedir31(), ".runwork");
     if (opts.keepAuth && label === "user") {
-      const setupFile = join51(stateDir, "setup.json");
-      if (existsSync54(setupFile)) {
+      const setupFile = join52(stateDir, "setup.json");
+      if (existsSync55(setupFile)) {
         try {
-          unlinkSync8(setupFile);
+          unlinkSync9(setupFile);
           console.log(`  Removed ${setupFile} (kept credentials)`);
         } catch (err) {
           console.warn(`  Failed to remove ${setupFile}: ${err instanceof Error ? err.message : err}`);
           errors++;
         }
       }
-    } else if (existsSync54(stateDir)) {
+    } else if (existsSync55(stateDir)) {
       try {
         rmSync13(stateDir, { recursive: true, force: true });
         console.log(`  Removed ${stateDir}`);
@@ -24627,7 +24942,7 @@ var membersCommand = new Command32("members").description("List workspace member
 init_store();
 init_client();
 import { Command as Command33 } from "commander";
-import { readFileSync as readFileSync44 } from "fs";
+import { readFileSync as readFileSync45 } from "fs";
 function normalizeApiPath(rawPath, baseUrl) {
   if (/^https?:\/\//i.test(rawPath)) {
     const target = new URL(rawPath);
@@ -24660,7 +24975,7 @@ to be read or pasted manually. Prefer a dedicated command when one exists
     let curlStr = opts.curl;
     if (opts.curlFile) {
       try {
-        curlStr = readFileSync44(opts.curlFile, "utf-8");
+        curlStr = readFileSync45(opts.curlFile, "utf-8");
       } catch (err) {
         console.error(`Could not read --curl-file: ${err instanceof Error ? err.message : err}`);
         process.exit(1);
@@ -24680,7 +24995,7 @@ to be read or pasted manually. Prefer a dedicated command when one exists
     let raw = opts.body;
     if (raw.startsWith("@")) {
       try {
-        raw = readFileSync44(raw.slice(1), "utf-8");
+        raw = readFileSync45(raw.slice(1), "utf-8");
       } catch (err) {
         console.error(`Could not read body file: ${err instanceof Error ? err.message : err}`);
         process.exit(1);
@@ -24733,9 +25048,9 @@ init_preflight();
 init_credentials();
 await init_detect();
 import { parse as parse2 } from "smol-toml";
-import { existsSync as existsSync55, readFileSync as readFileSync45 } from "fs";
-import { join as join52, sep as sep4 } from "path";
-import { homedir as homedir31, platform as osPlatform2, arch as osArch } from "os";
+import { existsSync as existsSync56, readFileSync as readFileSync46 } from "fs";
+import { join as join53, sep as sep4 } from "path";
+import { homedir as homedir32, platform as osPlatform2, arch as osArch } from "os";
 var BASE_URL2 = process.env.RUNWORK_DOWNLOAD_BASE_URL || "https://runwork.ai";
 var LATEST_JSON_URL2 = `${BASE_URL2}/cli/latest.json`;
 function detectPlatform() {
@@ -24763,10 +25078,10 @@ function buildContext() {
   const credentials = getCredentials();
   const client = credentials ? new ApiClient(credentials) : null;
   let config = null;
-  const configPath = join52(process.cwd(), ".runwork.json");
-  if (existsSync55(configPath)) {
+  const configPath = join53(process.cwd(), ".runwork.json");
+  if (existsSync56(configPath)) {
     try {
-      config = JSON.parse(readFileSync45(configPath, "utf-8"));
+      config = JSON.parse(readFileSync46(configPath, "utf-8"));
     } catch {}
   }
   return { credentials, client, config, cwd: process.cwd() };
@@ -24867,9 +25182,9 @@ async function checkCliArtifactReachable() {
 }
 async function checkCliInstallLocation() {
   const isWindows2 = osPlatform2() === "win32";
-  const home = homedir31();
-  const canonicalDir = join52(home, ".runwork", "bin");
-  const canonicalBinary = isWindows2 ? join52(canonicalDir, "runwork.exe") : join52(canonicalDir, "runwork");
+  const home = homedir32();
+  const canonicalDir = join53(home, ".runwork", "bin");
+  const canonicalBinary = isWindows2 ? join53(canonicalDir, "runwork.exe") : join53(canonicalDir, "runwork");
   const candidates = [process.execPath, process.argv[1] || ""].filter(Boolean);
   const runsFromCanonical = candidates.some((p) => normalizePath(p) === normalizePath(canonicalBinary));
   if (runsFromCanonical) {
@@ -24879,7 +25194,7 @@ async function checkCliInstallLocation() {
       message: `canonical (${canonicalBinary})`
     };
   }
-  if (existsSync55(canonicalBinary)) {
+  if (existsSync56(canonicalBinary)) {
     return {
       name: "cli-install-location",
       status: "warn",
@@ -25001,8 +25316,8 @@ async function checkGitCredentialHelper(ctx) {
   };
 }
 async function checkProjectConfig(ctx) {
-  const configPath = join52(ctx.cwd, ".runwork.json");
-  if (!existsSync55(configPath)) {
+  const configPath = join53(ctx.cwd, ".runwork.json");
+  if (!existsSync56(configPath)) {
     if (!ctx.credentials) {
       return { name: "project-config", status: "skip", message: "no project (not logged in)" };
     }
@@ -25064,7 +25379,7 @@ async function checkGitRemote(ctx) {
   if (!ctx.config) {
     return { name: "git-remote", status: "skip", message: "skipped (no project)" };
   }
-  if (!existsSync55(join52(ctx.cwd, ".git"))) {
+  if (!existsSync56(join53(ctx.cwd, ".git"))) {
     return {
       name: "git-remote",
       status: "fail",
@@ -25118,12 +25433,12 @@ async function checkDeployFreshness(ctx) {
   return { name: "deploy-freshness", status: "skip", message: "local HEAD unknown" };
 }
 function loadSetupState5() {
-  const projectPath = join52(process.cwd(), ".runwork", "setup.json");
-  const userPath = join52(homedir31(), ".runwork", "setup.json");
+  const projectPath = join53(process.cwd(), ".runwork", "setup.json");
+  const userPath = join53(homedir32(), ".runwork", "setup.json");
   for (const p of [projectPath, userPath]) {
-    if (existsSync55(p)) {
+    if (existsSync56(p)) {
       try {
-        return JSON.parse(readFileSync45(p, "utf-8"));
+        return JSON.parse(readFileSync46(p, "utf-8"));
       } catch {
         continue;
       }
@@ -25138,13 +25453,13 @@ async function checkCodexNetwork() {
   if (!state || !state.configuredAgents.includes("codex")) {
     return { name, status: "skip", message: "Codex not configured for Runwork" };
   }
-  const configPath = join52(homedir31(), ".codex", "config.toml");
-  if (!existsSync55(configPath)) {
+  const configPath = join53(homedir32(), ".codex", "config.toml");
+  if (!existsSync56(configPath)) {
     return { name, status: "skip", message: "no Codex config found" };
   }
   let parsed;
   try {
-    parsed = parse2(readFileSync45(configPath, "utf-8"));
+    parsed = parse2(readFileSync46(configPath, "utf-8"));
   } catch {
     return { name, status: "warn", message: "could not parse ~/.codex/config.toml" };
   }
@@ -25197,19 +25512,19 @@ async function checkCodexDesktopProject() {
   if (!usesCodex) {
     return { name, status: "skip", message: "Codex not configured for Runwork" };
   }
-  const statePath2 = join52(homedir31(), ".codex", ".codex-global-state.json");
-  if (!existsSync55(statePath2)) {
+  const statePath2 = join53(homedir32(), ".codex", ".codex-global-state.json");
+  if (!existsSync56(statePath2)) {
     return { name, status: "skip", message: "Codex desktop app not detected" };
   }
   let savedRoots = [];
   try {
-    const parsed = JSON.parse(readFileSync45(statePath2, "utf-8"));
+    const parsed = JSON.parse(readFileSync46(statePath2, "utf-8"));
     const roots = parsed["electron-saved-workspace-roots"];
     savedRoots = Array.isArray(roots) ? roots.filter((r) => typeof r === "string") : [];
   } catch {
     return { name, status: "warn", message: "could not read Codex desktop state" };
   }
-  const runworkDir = join52(homedir31(), ".runwork");
+  const runworkDir = join53(homedir32(), ".runwork");
   if (savedRoots.includes(runworkDir)) {
     return { name, status: "pass", message: "Runwork project added to Codex desktop sidebar" };
   }
@@ -25262,9 +25577,9 @@ async function checkAgentSetup() {
     if (!adapter2 || !adapter2.supportsMcpScope("user"))
       continue;
     const mcpConfigPath = getMcpConfigPath2(slug, "user");
-    if (mcpConfigPath && existsSync55(mcpConfigPath)) {
+    if (mcpConfigPath && existsSync56(mcpConfigPath)) {
       try {
-        const content = readFileSync45(mcpConfigPath, "utf-8");
+        const content = readFileSync46(mcpConfigPath, "utf-8");
         const missingMcp = state.mcpServers.filter((name) => !content.includes(name));
         if (missingMcp.length > 0) {
           details.push(`${missingMcp.length} MCP server(s) missing from ${slug} config`);
@@ -25286,15 +25601,22 @@ async function checkAgentSetup() {
     const skillsDir = getSkillsDir(slug, "user");
     if (!skillsDir)
       continue;
+    const adapter2 = getAdapterBySlug(slug);
+    const mcpCoversAppSkills = !!adapter2?.mcpProvidesSkills && state.mcpServers.length > 0;
+    const isCoveredByMcp = (name) => mcpCoversAppSkills && state.skillHashes?.[name]?.source === "app";
     const missingSkills = state.skills.filter((name) => {
-      const skillPath = join52(skillsDir, name, "SKILL.md");
-      return !existsSync55(skillPath);
+      if (isCoveredByMcp(name))
+        return false;
+      const skillPath = join53(skillsDir, name, "SKILL.md");
+      return !existsSync56(skillPath);
     });
     if (missingSkills.length > 0) {
       details.push(`${missingSkills.length} skill(s) missing from ${slug}`);
       upgrade("warn");
     } else if (state.skills.length > 0) {
-      details.push(`${state.skills.length} skill(s) installed`);
+      const mcpCoveredCount = state.skills.filter(isCoveredByMcp).length;
+      const onDiskCount = state.skills.length - mcpCoveredCount;
+      details.push(mcpCoveredCount > 0 ? `${state.skills.length} skill(s) installed (${onDiskCount} on disk, ${mcpCoveredCount} via MCP)` : `${state.skills.length} skill(s) installed`);
     }
     skillsChecked = true;
     break;
@@ -25313,28 +25635,28 @@ async function checkAgentSetup() {
   };
 }
 function getMcpConfigPath2(slug, scope) {
-  const home = homedir31();
+  const home = homedir32();
   switch (slug) {
     case "claude-code":
-      return scope === "project" ? join52(process.cwd(), ".mcp.json") : join52(home, ".claude", "settings.json");
+      return scope === "project" ? join53(process.cwd(), ".mcp.json") : join53(home, ".claude", "settings.json");
     case "cursor":
-      return scope === "project" ? join52(process.cwd(), ".cursor", "mcp.json") : join52(home, ".cursor", "mcp.json");
+      return scope === "project" ? join53(process.cwd(), ".cursor", "mcp.json") : join53(home, ".cursor", "mcp.json");
     case "windsurf":
-      return scope === "project" ? join52(process.cwd(), ".windsurf", "mcp.json") : join52(home, ".windsurf", "mcp.json");
+      return scope === "project" ? join53(process.cwd(), ".windsurf", "mcp.json") : join53(home, ".windsurf", "mcp.json");
     case "codex":
     case "codex-app":
-      return scope === "user" ? join52(home, ".codex", "config.toml") : null;
+      return scope === "user" ? join53(home, ".codex", "config.toml") : null;
     case "gemini":
-      return scope === "user" ? join52(home, ".gemini", "settings.json") : null;
+      return scope === "user" ? join53(home, ".gemini", "settings.json") : null;
     default:
       return null;
   }
 }
 async function checkWorkspacePointers() {
-  const userStatePath = join52(homedir31(), ".runwork", "setup.json");
-  const state = existsSync55(userStatePath) ? (() => {
+  const userStatePath = join53(homedir32(), ".runwork", "setup.json");
+  const state = existsSync56(userStatePath) ? (() => {
     try {
-      return JSON.parse(readFileSync45(userStatePath, "utf-8"));
+      return JSON.parse(readFileSync46(userStatePath, "utf-8"));
     } catch {
       return null;
     }
@@ -25364,15 +25686,15 @@ async function checkWorkspacePointers() {
   };
 }
 function getSkillsDir(slug, scope) {
-  const home = homedir31();
+  const home = homedir32();
   switch (slug) {
     case "claude-code":
-      return scope === "project" ? join52(process.cwd(), ".claude", "skills") : join52(home, ".claude", "skills");
+      return scope === "project" ? join53(process.cwd(), ".claude", "skills") : join53(home, ".claude", "skills");
     case "codex":
     case "codex-app":
-      return scope === "project" ? join52(process.cwd(), ".agents", "skills") : join52(home, ".agents", "skills");
+      return scope === "project" ? join53(process.cwd(), ".agents", "skills") : join53(home, ".agents", "skills");
     case "gemini":
-      return scope === "project" ? join52(process.cwd(), ".gemini", "skills") : join52(home, ".gemini", "skills");
+      return scope === "project" ? join53(process.cwd(), ".gemini", "skills") : join53(home, ".gemini", "skills");
     default:
       return null;
   }
@@ -25425,18 +25747,18 @@ async function runAllChecks(options) {
 // src/health/fix.ts
 init_credentials();
 init_remote();
-import { existsSync as existsSync56 } from "fs";
-import { join as join53 } from "path";
+import { existsSync as existsSync57 } from "fs";
+import { join as join54 } from "path";
 async function applyDoctorFixes(ctx, failingNames) {
   const failing = new Set(failingNames);
   const outcomes = [];
   if (failing.has("git-credential-helper")) {
     if (ctx.credentials?.baseUrl) {
-      await ensureGitCredentialHelper(ctx.credentials.baseUrl);
+      const result = await ensureGitCredentialHelper(ctx.credentials.baseUrl);
       outcomes.push({
         name: "git-credential-helper",
-        applied: true,
-        message: "registered the runwork git credential helper"
+        applied: result.ok,
+        message: result.ok ? "registered the runwork git credential helper" : result.message
       });
     } else {
       outcomes.push({
@@ -25453,7 +25775,7 @@ async function applyDoctorFixes(ctx, failingNames) {
         applied: false,
         message: "no project config -- run inside an app directory"
       });
-    } else if (!existsSync56(join53(ctx.cwd, ".git"))) {
+    } else if (!existsSync57(join54(ctx.cwd, ".git"))) {
       outcomes.push({
         name: "git-remote",
         applied: false,
@@ -25472,10 +25794,10 @@ async function applyDoctorFixes(ctx, failingNames) {
 }
 
 // src/agents/runtime-detection.ts
-import { existsSync as existsSync57, readFileSync as readFileSync46, statSync as statSync10, readdirSync as readdirSync16 } from "fs";
-import { homedir as homedir32 } from "os";
-import { join as join54 } from "path";
-var RUNWORK_SESSIONS_DIR = join54(homedir32(), ".runwork", "sessions");
+import { existsSync as existsSync58, readFileSync as readFileSync47, statSync as statSync10, readdirSync as readdirSync16 } from "fs";
+import { homedir as homedir33 } from "os";
+import { join as join55 } from "path";
+var RUNWORK_SESSIONS_DIR = join55(homedir33(), ".runwork", "sessions");
 function detectCurrentAgent() {
   const claudeCodeSessionId = process.env.CLAUDE_CODE_SESSION_ID;
   if (claudeCodeSessionId) {
@@ -25538,11 +25860,11 @@ function detectCurrentAgent() {
   return null;
 }
 function readHookSessionInfo(sessionId) {
-  const path4 = join54(RUNWORK_SESSIONS_DIR, `${sessionId}.json`);
-  if (!existsSync57(path4))
+  const path4 = join55(RUNWORK_SESSIONS_DIR, `${sessionId}.json`);
+  if (!existsSync58(path4))
     return null;
   try {
-    const raw = readFileSync46(path4, "utf8");
+    const raw = readFileSync47(path4, "utf8");
     const parsed = JSON.parse(raw);
     return parsed;
   } catch {
@@ -25550,8 +25872,8 @@ function readHookSessionInfo(sessionId) {
   }
 }
 function findClaudeCodeSessionFile(sessionId) {
-  const root = join54(homedir32(), ".claude", "projects");
-  if (!existsSync57(root))
+  const root = join55(homedir33(), ".claude", "projects");
+  if (!existsSync58(root))
     return null;
   let projectDirs;
   try {
@@ -25560,15 +25882,15 @@ function findClaudeCodeSessionFile(sessionId) {
     return null;
   }
   for (const dir of projectDirs) {
-    const candidate = join54(root, dir, `${sessionId}.jsonl`);
-    if (existsSync57(candidate))
+    const candidate = join55(root, dir, `${sessionId}.jsonl`);
+    if (existsSync58(candidate))
       return candidate;
   }
   return null;
 }
 function findCodexRolloutFile(threadId) {
-  const root = join54(homedir32(), ".codex", "sessions");
-  if (!existsSync57(root))
+  const root = join55(homedir33(), ".codex", "sessions");
+  if (!existsSync58(root))
     return null;
   const stack = [root];
   while (stack.length > 0) {
@@ -25580,7 +25902,7 @@ function findCodexRolloutFile(threadId) {
       continue;
     }
     for (const entry of entries) {
-      const full = join54(dir, entry);
+      const full = join55(dir, entry);
       let s;
       try {
         s = statSync10(full);
@@ -25597,8 +25919,8 @@ function findCodexRolloutFile(threadId) {
   return null;
 }
 function findNewestClaudeCodeSession() {
-  const root = join54(homedir32(), ".claude", "projects");
-  if (!existsSync57(root))
+  const root = join55(homedir33(), ".claude", "projects");
+  if (!existsSync58(root))
     return null;
   let projectDirs;
   try {
@@ -25608,7 +25930,7 @@ function findNewestClaudeCodeSession() {
   }
   let best = null;
   for (const dir of projectDirs) {
-    const projectPath = join54(root, dir);
+    const projectPath = join55(root, dir);
     let files;
     try {
       files = readdirSync16(projectPath);
@@ -25618,7 +25940,7 @@ function findNewestClaudeCodeSession() {
     for (const file of files) {
       if (!file.endsWith(".jsonl"))
         continue;
-      const full = join54(projectPath, file);
+      const full = join55(projectPath, file);
       try {
         const s = statSync10(full);
         if (!best || s.mtimeMs > best.mtime) {
@@ -25636,8 +25958,8 @@ function findNewestClaudeCodeSession() {
   return best ? { sessionId: best.sessionId, path: best.path } : null;
 }
 function findNewestCodexRollout() {
-  const root = join54(homedir32(), ".codex", "sessions");
-  if (!existsSync57(root))
+  const root = join55(homedir33(), ".codex", "sessions");
+  if (!existsSync58(root))
     return null;
   const stack = [root];
   let best = null;
@@ -25650,7 +25972,7 @@ function findNewestCodexRollout() {
       continue;
     }
     for (const entry of entries) {
-      const full = join54(dir, entry);
+      const full = join55(dir, entry);
       let s;
       try {
         s = statSync10(full);
@@ -25882,8 +26204,8 @@ init_store();
 init_client();
 init_resolve();
 import { Command as Command35 } from "commander";
-import { readFileSync as readFileSync47, writeFileSync as writeFileSync31, existsSync as existsSync58, mkdtempSync as mkdtempSync4 } from "fs";
-import { join as join55 } from "path";
+import { readFileSync as readFileSync48, writeFileSync as writeFileSync32, existsSync as existsSync59, mkdtempSync as mkdtempSync4 } from "fs";
+import { join as join56 } from "path";
 import { tmpdir as tmpdir4 } from "os";
 import { createHash as createHash6 } from "crypto";
 
@@ -26005,14 +26327,14 @@ function resolveLocalSessionShare(opts, conversation) {
     process.exit(1);
   }
   const title = opts.title ?? conversation.title ?? conversation.project;
-  const markdown = renderTranscriptMarkdown(readFileSync47(conversation.transcriptPath, "utf8"), family, title);
+  const markdown = renderTranscriptMarkdown(readFileSync48(conversation.transcriptPath, "utf8"), family, title);
   if (!markdown) {
     console.error("Error: this conversation has no shareable content.");
     process.exit(1);
   }
-  const tempDir = mkdtempSync4(join55(tmpdir4(), "runwork-share-"));
-  const transcriptFile = join55(tempDir, "transcript.md");
-  writeFileSync31(transcriptFile, markdown);
+  const tempDir = mkdtempSync4(join56(tmpdir4(), "runwork-share-"));
+  const transcriptFile = join56(tempDir, "transcript.md");
+  writeFileSync32(transcriptFile, markdown);
   opts.transcriptFile = transcriptFile;
   opts.nativeFile = opts.nativeFile ?? conversation.transcriptPath;
   opts.sourceAgent = opts.sourceAgent ?? conversation.agentSlug;
@@ -26049,7 +26371,7 @@ async function runShareConvo(opts, command, isPersonalAlias = false) {
     console.error("Error: --transcript-file is required. Pass the path to the LLM-emitted markdown transcript.");
     process.exit(1);
   }
-  if (!existsSync58(opts.transcriptFile)) {
+  if (!existsSync59(opts.transcriptFile)) {
     console.error(`Error: transcript file does not exist: ${opts.transcriptFile}`);
     process.exit(1);
   }
@@ -26070,7 +26392,7 @@ async function runShareConvo(opts, command, isPersonalAlias = false) {
   const credentials = requireAuth();
   const client = new ApiClient(credentials);
   const { workspaceId } = await resolveWorkspace2(client, { workspace: opts.workspace });
-  const transcriptContent = readFileSync47(opts.transcriptFile, "utf8");
+  const transcriptContent = readFileSync48(opts.transcriptFile, "utf8");
   const bundles = [
     {
       format: "transcript",
@@ -26083,19 +26405,19 @@ async function runShareConvo(opts, command, isPersonalAlias = false) {
   const sourceAgent = opts.sourceAgent ?? detected?.slug ?? "generic";
   let nativeFilePath = null;
   if (opts.nativeFile) {
-    if (!existsSync58(opts.nativeFile)) {
+    if (!existsSync59(opts.nativeFile)) {
       console.error(`Error: --native-file path does not exist: ${opts.nativeFile}`);
       process.exit(1);
     }
     nativeFilePath = opts.nativeFile;
-  } else if (detected?.sessionFilePath && existsSync58(detected.sessionFilePath)) {
+  } else if (detected?.sessionFilePath && existsSync59(detected.sessionFilePath)) {
     nativeFilePath = detected.sessionFilePath;
   }
   if (nativeFilePath) {
     const nativeFormat = nativeBundleFormatForAgent(sourceAgent);
     if (nativeFormat) {
       try {
-        const content = readFileSync47(nativeFilePath, "utf8");
+        const content = readFileSync48(nativeFilePath, "utf8");
         bundles.push({
           format: nativeFormat,
           content,
@@ -26111,7 +26433,7 @@ async function runShareConvo(opts, command, isPersonalAlias = false) {
   let metadata = {};
   if (opts.metadataFile) {
     try {
-      metadata = JSON.parse(readFileSync47(opts.metadataFile, "utf8"));
+      metadata = JSON.parse(readFileSync48(opts.metadataFile, "utf8"));
     } catch (err) {
       console.error(`Error: --metadata-file is not valid JSON: ${err instanceof Error ? err.message : err}`);
       process.exit(1);
@@ -26220,9 +26542,9 @@ init_client();
 init_resolve();
 init_registry_data();
 import { Command as Command38 } from "commander";
-import { writeFileSync as writeFileSync32, mkdirSync as mkdirSync28, realpathSync } from "fs";
-import { homedir as homedir33 } from "os";
-import { join as join56 } from "path";
+import { writeFileSync as writeFileSync33, mkdirSync as mkdirSync29, realpathSync } from "fs";
+import { homedir as homedir34 } from "os";
+import { join as join57 } from "path";
 import { spawn as spawn5 } from "child_process";
 init_registry();
 init_which();
@@ -26261,10 +26583,10 @@ function extractCodexUuid(rolloutContent) {
 }
 function placeClaudeJsonl(uuid, content, recipientCwd) {
   const encoded = encodeClaudeCodeCwd(recipientCwd);
-  const projectDir = join56(homedir33(), ".claude", "projects", encoded);
-  mkdirSync28(projectDir, { recursive: true });
-  const placedAt = join56(projectDir, `${uuid}.jsonl`);
-  writeFileSync32(placedAt, content);
+  const projectDir = join57(homedir34(), ".claude", "projects", encoded);
+  mkdirSync29(projectDir, { recursive: true });
+  const placedAt = join57(projectDir, `${uuid}.jsonl`);
+  writeFileSync33(placedAt, content);
   return { placedAt, runFromCwd: recipientCwd };
 }
 function placeCodexRollout(uuid, content) {
@@ -26272,11 +26594,11 @@ function placeCodexRollout(uuid, content) {
   const yyyy = String(now.getUTCFullYear());
   const mm = String(now.getUTCMonth() + 1).padStart(2, "0");
   const dd = String(now.getUTCDate()).padStart(2, "0");
-  const dir = join56(homedir33(), ".codex", "sessions", yyyy, mm, dd);
-  mkdirSync28(dir, { recursive: true });
+  const dir = join57(homedir34(), ".codex", "sessions", yyyy, mm, dd);
+  mkdirSync29(dir, { recursive: true });
   const ts = now.toISOString().replace(/\.\d+Z$/, "").replace(/:/g, "-");
-  const placedAt = join56(dir, `rollout-${ts}-${uuid}.jsonl`);
-  writeFileSync32(placedAt, content);
+  const placedAt = join57(dir, `rollout-${ts}-${uuid}.jsonl`);
+  writeFileSync33(placedAt, content);
   return { placedAt };
 }
 function pickTargetAgent(opts, sourceAgent) {