sneakoscope 7.0.2 → 7.0.3

package/dist/core/codex-native/core-skill-integrity.js

@@ -1,11 +1,13 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
-import { ensureDir, nowIso, readText, sha256, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
-import { CORE_SKILL_TEMPLATE_VERSION, buildSksCoreSkillManifest, currentCoreSkillName, isSksManagedCoreSkillContent, renderCoreSkillTemplate } from './core-skill-manifest.js';
+import { nowIso, sha256, writeJsonAtomic, writeTextAtomic } from '../fsx.js';
+import { ensureConfinedDirectory, inspectConfinedPath, isLexicallyConfined } from '../managed-path-safety.js';
+import { CORE_SKILL_TEMPLATE_VERSION, buildSksCoreSkillManifest, currentCoreSkillName, isCoreSkillName, isSksManagedCoreSkillContent, renderCoreSkillTemplate } from './core-skill-manifest.js';
 import { canonicalSkillName } from './skill-name-canonicalizer.js';
 export async function syncCoreSkillsIntegrity(input) {
     const root = path.resolve(input.root);
-    const skillsRoot = input.skillsRoot || path.join(root, '.agents', 'skills');
+    const skillsRoot = path.resolve(input.skillsRoot || path.join(root, '.agents', 'skills'));
+    const skillsBoundary = coreSkillsBoundary(root, skillsRoot);
     const apply = input.apply === true;
     const manifest = buildSksCoreSkillManifest();
     const rows = [];
@@ -13,19 +15,36 @@ export async function syncCoreSkillsIntegrity(input) {
     const restored = [];
     const skippedUserAuthored = [];
     const blockers = [];
+    const reportPath = input.reportPath === null
+        ? null
+        : path.resolve(input.reportPath || path.join(root, '.sneakoscope', 'reports', 'core-skill-integrity.json'));
+    const backupRoot = path.join(root, '.sneakoscope', 'backups', 'core-skills');
+    const reportPathBlocker = reportPath
+        ? await inspectCoreSkillArtifactTarget(root, reportPath, 'report', 'file')
+        : null;
+    const backupPathBlocker = apply
+        ? await inspectCoreSkillArtifactTarget(root, backupRoot, 'backup', 'directory')
+        : null;
+    const artifactPathBlockers = [reportPathBlocker, backupPathBlocker].filter((value) => Boolean(value));
+    blockers.push(...artifactPathBlockers);
+    const mutationAllowed = apply && artifactPathBlockers.length === 0;
     for (const skill of manifest.skills) {
         const skillDir = path.join(skillsRoot, skill.canonical_name);
         const file = path.join(skillDir, 'SKILL.md');
         const desired = renderCoreSkillTemplate(skill.canonical_name);
-        const current = await readText(file, null);
+        const safeCurrent = await readConfinedCoreSkill(skillsBoundary, skill.canonical_name, skillDir, file);
+        const current = safeCurrent.text;
         const beforeSha = typeof current === 'string' ? sha256(current) : null;
         let action = 'already-current';
         let backupPath = null;
-        let blocker = null;
-        if (current === null) {
+        let blocker = safeCurrent.blocker;
+        if (blocker) {
+            action = 'blocked';
+        }
+        else if (current === null) {
             action = 'install-missing-managed-copy';
-            if (apply) {
-                await ensureDir(skillDir);
+            if (mutationAllowed) {
+                await ensureConfinedDirectory(skillsBoundary, skillDir);
                 await writeTextAtomic(file, desired);
                 installed.push(file);
             }
@@ -35,12 +54,19 @@ export async function syncCoreSkillsIntegrity(input) {
         }
         else if (isSksManagedCoreSkillContent(current)) {
             action = 'restore-corrupted-managed-copy';
-            if (apply) {
-                backupPath = path.join(root, '.sneakoscope', 'backups', 'core-skills', skill.canonical_name, `${Date.now()}-${process.pid}.SKILL.md.bak`);
-                await ensureDir(path.dirname(backupPath));
-                await fs.writeFile(backupPath, current, 'utf8');
-                await writeTextAtomic(file, desired);
-                restored.push(file);
+            if (mutationAllowed) {
+                const candidateBackupPath = path.join(backupRoot, skill.canonical_name, `${Date.now()}-${process.pid}.SKILL.md.bak`);
+                const backupWriteBlocker = await writeConfinedCoreSkillArtifact(root, candidateBackupPath, current, 'backup');
+                if (backupWriteBlocker) {
+                    action = 'blocked';
+                    blocker = backupWriteBlocker;
+                }
+                else {
+                    backupPath = candidateBackupPath;
+                    await ensureConfinedDirectory(skillsBoundary, skillDir);
+                    await writeTextAtomic(file, desired);
+                    restored.push(file);
+                }
             }
         }
         else {
@@ -48,7 +74,14 @@ export async function syncCoreSkillsIntegrity(input) {
             blocker = `user_authored_core_skill_collision:${skill.canonical_name}`;
             skippedUserAuthored.push(file);
         }
-        const after = await readText(file, null);
+        const afterInspection = blocker && action === 'blocked'
+            ? { text: null, blocker }
+            : await readConfinedCoreSkill(skillsBoundary, skill.canonical_name, skillDir, file);
+        if (!blocker && afterInspection.blocker) {
+            action = 'blocked';
+            blocker = afterInspection.blocker;
+        }
+        const after = afterInspection.text;
         const afterSha = typeof after === 'string' ? sha256(after) : null;
         rows.push({
             canonical_name: skill.canonical_name,
@@ -81,13 +114,129 @@ export async function syncCoreSkillsIntegrity(input) {
         skipped_user_authored: skippedUserAuthored,
         blockers
     };
-    const reportPath = input.reportPath === null
-        ? null
-        : input.reportPath || path.join(root, '.sneakoscope', 'reports', 'core-skill-integrity.json');
-    if (reportPath)
-        await writeJsonAtomic(reportPath, report).catch(() => undefined);
+    if (reportPath && !reportPathBlocker) {
+        const reportWriteBlocker = await writeConfinedCoreSkillReport(root, reportPath, report);
+        if (reportWriteBlocker) {
+            blockers.push(reportWriteBlocker);
+            report.ok = false;
+        }
+    }
     return report;
 }
 export function coreSkillPath(skillsRoot, name) {
     return path.join(skillsRoot, currentCoreSkillName(canonicalSkillName(name)), 'SKILL.md');
 }
+function coreSkillsBoundary(root, skillsRoot) {
+    if (isLexicallyConfined(root, skillsRoot))
+        return root;
+    const parent = path.dirname(skillsRoot);
+    return ['.agents', '.codex'].includes(path.basename(parent)) ? path.dirname(parent) : parent;
+}
+async function readConfinedCoreSkill(boundary, skillName, skillDir, file) {
+    try {
+        const dirInspection = await inspectConfinedPath(boundary, skillDir);
+        if (dirInspection.exists && (dirInspection.leafSymlink || !dirInspection.stat?.isDirectory())) {
+            return { text: null, blocker: coreSkillPathBlocker(skillName, 'skill_directory_not_safe') };
+        }
+        const fileInspection = await inspectConfinedPath(boundary, file);
+        if (!fileInspection.exists)
+            return { text: null, blocker: null };
+        if (fileInspection.leafSymlink || !fileInspection.stat?.isFile()) {
+            return { text: null, blocker: coreSkillPathBlocker(skillName, 'skill_file_not_safe') };
+        }
+        return { text: await fs.readFile(file, 'utf8'), blocker: null };
+    }
+    catch (error) {
+        return {
+            text: null,
+            blocker: coreSkillPathBlocker(skillName, coreSkillPathFailureReason(error))
+        };
+    }
+}
+function coreSkillPathBlocker(skillName, reason) {
+    const canonical = canonicalSkillName(skillName);
+    const safeSkillName = isCoreSkillName(canonical) ? canonical : 'unknown';
+    return `core_skill_path_unsafe:${safeSkillName}:${reason}`;
+}
+function coreSkillPathFailureReason(error) {
+    const code = error && typeof error === 'object' && 'code' in error ? error.code : null;
+    if (code === 'managed_path_boundary_missing')
+        return 'boundary_missing';
+    if (code === 'managed_path_boundary_symlink_refused')
+        return 'boundary_symlink';
+    if (code === 'managed_path_boundary_not_directory')
+        return 'boundary_not_directory';
+    if (code === 'managed_path_escape_refused')
+        return 'escape_refused';
+    if (code === 'managed_path_ancestor_symlink_refused')
+        return 'ancestor_symlink';
+    if (code === 'managed_path_ancestor_not_directory')
+        return 'ancestor_not_directory';
+    return 'inspection_failed';
+}
+async function inspectCoreSkillArtifactTarget(root, target, scope, expected) {
+    if (!isLexicallyConfined(root, target))
+        return coreSkillArtifactBlocker(scope, 'escape_refused');
+    try {
+        const inspection = await inspectConfinedPath(root, target);
+        if (!inspection.exists)
+            return null;
+        if (inspection.leafSymlink)
+            return coreSkillArtifactBlocker(scope, 'leaf_symlink');
+        if (expected === 'directory' && !inspection.stat?.isDirectory()) {
+            return coreSkillArtifactBlocker(scope, 'not_directory');
+        }
+        if (expected === 'file' && !inspection.stat?.isFile()) {
+            return coreSkillArtifactBlocker(scope, 'not_file');
+        }
+        return null;
+    }
+    catch (error) {
+        return coreSkillArtifactBlocker(scope, coreSkillArtifactFailureReason(error));
+    }
+}
+async function writeConfinedCoreSkillArtifact(root, target, text, scope) {
+    try {
+        await ensureConfinedDirectory(root, path.dirname(target));
+        const blocker = await inspectCoreSkillArtifactTarget(root, target, scope, 'file');
+        if (blocker)
+            return blocker;
+        await writeTextAtomic(target, text);
+        return null;
+    }
+    catch {
+        return coreSkillArtifactBlocker(scope, 'write_failed');
+    }
+}
+async function writeConfinedCoreSkillReport(root, target, report) {
+    try {
+        await ensureConfinedDirectory(root, path.dirname(target));
+        const blocker = await inspectCoreSkillArtifactTarget(root, target, 'report', 'file');
+        if (blocker)
+            return blocker;
+        await writeJsonAtomic(target, report);
+        return null;
+    }
+    catch {
+        return coreSkillArtifactBlocker('report', 'write_failed');
+    }
+}
+function coreSkillArtifactBlocker(scope, reason) {
+    return `core_skill_artifact_path_unsafe:${scope}:${reason}`;
+}
+function coreSkillArtifactFailureReason(error) {
+    const code = error && typeof error === 'object' && 'code' in error ? error.code : null;
+    if (code === 'managed_path_boundary_missing')
+        return 'boundary_missing';
+    if (code === 'managed_path_boundary_symlink_refused')
+        return 'boundary_symlink';
+    if (code === 'managed_path_boundary_not_directory')
+        return 'boundary_not_directory';
+    if (code === 'managed_path_escape_refused')
+        return 'escape_refused';
+    if (code === 'managed_path_ancestor_symlink_refused')
+        return 'ancestor_symlink';
+    if (code === 'managed_path_ancestor_not_directory')
+        return 'ancestor_not_directory';
+    return 'inspection_failed';
+}

package/dist/core/codex-native/project-skill-dedupe.js

@@ -1,19 +1,20 @@
-import fs from 'node:fs/promises';
 import path from 'node:path';
-import { ensureDir, nowIso, writeJsonAtomic } from '../fsx.js';
+import { nowIso, writeJsonAtomic } from '../fsx.js';
+import { ensureConfinedDirectory, inspectConfinedPath, isLexicallyConfined, moveConfinedPath, removeConfinedDirectoryIfEmpty, removeManagedPathVerified, uniqueConfinedPath } from '../managed-path-safety.js';
 import { buildSkillRegistryLedger, groupByCanonical } from './skill-registry-ledger.js';
+import { writeRootConfinedJsonReport } from './confined-report-writer.js';
 export async function dedupeProjectSkills(input) {
     const root = path.resolve(input.root);
     const fix = input.fix === true;
     const yes = input.yes === true;
-    const ledger = await buildSkillRegistryLedger({ root });
+    const ledger = await buildSkillRegistryLedger({ root, reportPath: null });
     const grouped = groupByCanonical(ledger.entries);
     const actions = [];
     const unresolvedUserDuplicates = [];
     for (const [canonical, group] of grouped.entries()) {
         if (group.length <= 1)
             continue;
-        group.sort(compareSkillPriority);
+        group.sort((a, b) => compareSkillPriority(root, a, b));
         const userEntries = group.filter((entry) => !entry.managed_by_sks);
         const managedEntries = group.filter((entry) => entry.managed_by_sks);
         if (userEntries.length > 0 && managedEntries.length > 0) {
@@ -59,7 +60,9 @@ export async function dedupeProjectSkills(input) {
     const duplicateNames = [...new Set(actions.filter((action) => action.action !== 'kept').map((action) => action.canonical_name))].sort();
     const afterLedger = await buildSkillRegistryLedger({ root, reportPath: null });
     const blockers = [
+        ...ledger.blockers.filter((blocker) => !blocker.startsWith('duplicate_active_skill_name:')),
         ...unresolvedUserDuplicates.map((name) => `user_duplicate_requires_confirmation:${name}`),
+        ...afterLedger.blockers.filter((blocker) => !blocker.startsWith('duplicate_active_skill_name:')),
         ...afterLedger.duplicate_active_canonical_names.map((name) => `duplicate_active_skill_name:${name}`)
     ];
     const report = {
@@ -75,16 +78,25 @@ export async function dedupeProjectSkills(input) {
         duplicate_active_canonical_names: afterLedger.duplicate_active_canonical_names,
         duplicate_canonical_names: duplicateNames,
         unresolved_user_duplicates: unresolvedUserDuplicates,
-        blockers
+        blockers: [...new Set(blockers)].sort()
     };
     const reportPath = input.reportPath === null
         ? null
         : input.reportPath || path.join(root, '.sneakoscope', 'reports', 'project-skill-dedupe.json');
-    if (reportPath)
-        await writeJsonAtomic(reportPath, report).catch(() => undefined);
+    if (reportPath) {
+        const written = await writeRootConfinedJsonReport({ root, reportPath, value: report });
+        if (!written) {
+            report.ok = false;
+            report.blockers = [...new Set([...report.blockers, 'project_skill_dedupe_report_path_unsafe'])].sort();
+        }
+    }
     return report;
 }
-function compareSkillPriority(a, b) {
+function compareSkillPriority(root, a, b) {
+    const confinedA = skillEntryIsLexicallyConfined(root, a) ? 1 : 0;
+    const confinedB = skillEntryIsLexicallyConfined(root, b) ? 1 : 0;
+    if (confinedA !== confinedB)
+        return confinedB - confinedA;
     const currentA = a.status === 'managed-current' ? 1 : 0;
     const currentB = b.status === 'managed-current' ? 1 : 0;
     return currentB - currentA || b.active_priority - a.active_priority || a.path.localeCompare(b.path);
@@ -104,13 +116,23 @@ async function maybeQuarantine(root, canonical, entry, fix, reason) {
     return quarantineSkill(root, canonical, entry, reason);
 }
 async function quarantineSkill(root, canonical, entry, reason) {
+    const boundary = path.resolve(root);
     const sourceDir = path.dirname(entry.path);
+    if (!skillEntryIsProjectOwned(boundary, entry))
+        return null;
+    const sourceInspection = await inspectConfinedPath(boundary, sourceDir);
+    if (!sourceInspection.exists)
+        return null;
+    if (sourceInspection.leafSymlink || !sourceInspection.stat?.isDirectory()) {
+        throw new Error(`project_skill_source_not_safe_directory:${sourceDir}`);
+    }
     const stamp = `${Date.now()}-${process.pid}`;
-    const target = path.join(root, '.sneakoscope', 'quarantine', 'skills', canonical, stamp, path.basename(sourceDir));
-    await ensureDir(path.dirname(target));
-    await fs.cp(sourceDir, target, { recursive: true, force: false });
-    await fs.rm(sourceDir, { recursive: true, force: true });
-    await writeJsonAtomic(path.join(target, 'quarantine-record.json'), {
+    const base = path.join(boundary, '.sneakoscope', 'quarantine', 'skills', canonical, stamp);
+    const container = await uniqueConfinedPath(boundary, base);
+    const target = path.join(container, path.basename(sourceDir));
+    await ensureConfinedDirectory(boundary, container);
+    const recordPath = path.join(container, 'quarantine-record.json');
+    await writeJsonAtomic(recordPath, {
         schema: 'sks.skill-quarantine-record.v1',
         generated_at: nowIso(),
         source_path: sourceDir,
@@ -119,5 +141,25 @@ async function quarantineSkill(root, canonical, entry, reason) {
         reason,
         content_sha256: entry.content_sha256
     });
+    try {
+        await moveConfinedPath(boundary, sourceDir, target);
+    }
+    catch (error) {
+        await removeManagedPathVerified(boundary, recordPath).catch(() => undefined);
+        await removeConfinedDirectoryIfEmpty(boundary, container).catch(() => undefined);
+        throw error;
+    }
     return target;
 }
+function skillEntryIsLexicallyConfined(root, entry) {
+    return isLexicallyConfined(root, path.dirname(entry.path));
+}
+function skillEntryIsProjectOwned(root, entry) {
+    if (entry.scope !== 'project')
+        return false;
+    const sourceDir = path.dirname(entry.path);
+    return [
+        path.join(root, '.agents', 'skills'),
+        path.join(root, '.codex', 'skills')
+    ].some((scanRoot) => isLexicallyConfined(scanRoot, sourceDir));
+}

package/dist/core/codex-native/skill-registry-ledger.js

@@ -1,27 +1,54 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import os from 'node:os';
-import { nowIso, readText, sha256, writeJsonAtomic } from '../fsx.js';
+import { canonicalFilesystemPath, nowIso, readText, sha256 } from '../fsx.js';
+import { inspectConfinedPath, isLexicallyConfined } from '../managed-path-safety.js';
 import { buildSksCoreSkillManifest, isSksManagedCoreSkillContent } from './core-skill-manifest.js';
 import { canonicalSkillName, skillDisplayNameFromMarkdown } from './skill-name-canonicalizer.js';
 import { loadSkillsManifest } from '../init/skills.js';
+import { writeRootConfinedJsonReport } from './confined-report-writer.js';
 export async function buildSkillRegistryLedger(input) {
     const root = path.resolve(input.root);
     const codexHome = process.env.CODEX_HOME || path.join(os.homedir(), '.codex');
-    const scanRoots = [
-        { root: path.join(root, '.agents', 'skills'), scope: 'project', priority: 100 },
-        { root: path.join(root, '.codex', 'skills'), scope: 'project', priority: 80 },
-        { root: path.join(os.homedir(), '.agents', 'skills'), scope: 'global', priority: 60 },
-        { root: path.join(codexHome, 'skills'), scope: 'codex-home', priority: 60 },
+    const home = os.homedir();
+    const codexHomeBoundary = isLexicallyConfined(home, codexHome) ? home : path.dirname(path.resolve(codexHome));
+    const scanRootResolution = await dedupeSkillRegistryScanRoots([
+        { root: path.join(root, '.agents', 'skills'), boundary: root, scope: 'project', priority: 100 },
+        { root: path.join(root, '.codex', 'skills'), boundary: root, scope: 'project', priority: 80 },
+        { root: path.join(home, '.agents', 'skills'), boundary: home, scope: 'global', priority: 60 },
+        { root: path.join(codexHome, 'skills'), boundary: codexHomeBoundary, scope: 'codex-home', priority: 60 },
         ...(input.extraRoots || [])
-    ];
+    ]);
+    const scanRoots = scanRootResolution.roots;
     const manifest = await loadSkillsManifest().catch(() => null);
     const officialNames = new Set((manifest?.skills || []).map((skill) => canonicalSkillName(skill.canonical_name)));
     const aliasNames = new Set((manifest?.skills || []).flatMap((skill) => (skill.deprecated_aliases || []).map((name) => canonicalSkillName(name))));
-    const manifestByName = new Map([
-        ...buildSksCoreSkillManifest().skills.map((skill) => [skill.canonical_name, skill.content_sha256]),
-        ...(manifest?.skills || []).map((skill) => [canonicalSkillName(skill.canonical_name), String(skill.content_sha256 || '')])
-    ]);
+    const manifestByName = new Map();
+    const managedDigestsByName = new Map();
+    const addManagedDigest = (name, digest) => {
+        const canonical = canonicalSkillName(String(name || ''));
+        const boundedDigest = String(digest || '').toLowerCase();
+        if (!canonical || !/^[a-f0-9]{64}$/.test(boundedDigest))
+            return;
+        const digests = managedDigestsByName.get(canonical) || new Set();
+        digests.add(boundedDigest);
+        managedDigestsByName.set(canonical, digests);
+    };
+    for (const skill of buildSksCoreSkillManifest().skills) {
+        manifestByName.set(skill.canonical_name, skill.content_sha256);
+        addManagedDigest(skill.canonical_name, skill.content_sha256);
+    }
+    for (const skill of manifest?.skills || []) {
+        const canonical = canonicalSkillName(skill?.canonical_name);
+        const currentDigest = String(skill?.content_sha256 || '').toLowerCase();
+        if (canonical && /^[a-f0-9]{64}$/.test(currentDigest))
+            manifestByName.set(canonical, currentDigest);
+        for (const name of [canonical, ...(skill?.deprecated_aliases || []).map((alias) => canonicalSkillName(String(alias || '')))]) {
+            addManagedDigest(name, currentDigest);
+            for (const digest of skill?.hash_history || [])
+                addManagedDigest(name, digest);
+        }
+    }
     const entries = [];
     for (const scanRoot of scanRoots) {
         const rows = await fs.readdir(scanRoot.root, { withFileTypes: true }).catch(() => []);
@@ -29,6 +56,11 @@ export async function buildSkillRegistryLedger(input) {
             if (!row.isDirectory())
                 continue;
             const skillPath = path.join(scanRoot.root, row.name, 'SKILL.md');
+            if (scanRoot.boundary) {
+                const inspection = await inspectConfinedPath(scanRoot.boundary, skillPath).catch(() => null);
+                if (!inspection?.exists || inspection.leafSymlink || !inspection.stat?.isFile())
+                    continue;
+            }
             const text = await readText(skillPath, null);
             if (typeof text !== 'string')
                 continue;
@@ -36,7 +68,8 @@ export async function buildSkillRegistryLedger(input) {
             const canonical = canonicalSkillName(displayName || row.name);
             const hash = sha256(text);
             const officialName = officialNames.has(canonical) || aliasNames.has(canonical);
-            const managed = isSksManagedCoreSkillContent(text) || text.includes('BEGIN SKS MANAGED SKILL') || officialName;
+            const managed = isRecognizedSksManagedSkillContent(text)
+                || Boolean(officialName && managedDigestsByName.get(canonical)?.has(hash));
             const expected = manifestByName.get(canonical);
             const status = managed
                 ? expected && expected === hash ? 'managed-current' : 'managed-drift'
@@ -70,11 +103,14 @@ export async function buildSkillRegistryLedger(input) {
     const activeGrouped = groupByCanonical(activeEntries);
     const duplicateActiveNames = [...activeGrouped.entries()].filter(([, group]) => group.length > 1).map(([name]) => name).sort();
     const activeUnique = duplicateActiveNames.length === 0;
-    const blockers = duplicateActiveNames.map((name) => `duplicate_active_skill_name:${name}`);
+    const blockers = [
+        ...scanRootResolution.blockers,
+        ...duplicateActiveNames.map((name) => `duplicate_active_skill_name:${name}`)
+    ];
     const ledger = {
         schema: 'sks.skill-registry-ledger.v1',
         generated_at: nowIso(),
-        ok: activeUnique,
+        ok: activeUnique && blockers.length === 0,
         root,
         entries,
         active_unique_by_canonical_name: activeUnique,
@@ -86,10 +122,95 @@ export async function buildSkillRegistryLedger(input) {
     const reportPath = input.reportPath === null
         ? null
         : input.reportPath || path.join(root, '.sneakoscope', 'reports', 'skill-registry-ledger.json');
-    if (reportPath)
-        await writeJsonAtomic(reportPath, ledger).catch(() => undefined);
+    if (reportPath) {
+        const written = await writeRootConfinedJsonReport({ root, reportPath, value: ledger });
+        if (!written) {
+            ledger.ok = false;
+            ledger.blockers = [...new Set([...ledger.blockers, 'skill_registry_report_path_unsafe'])].sort();
+        }
+    }
     return ledger;
 }
+const SKS_MANAGED_SKILL_MARKER_RE = /BEGIN SKS (?:IMMUTABLE CORE|MANAGED) SKILL/;
+function isRecognizedSksManagedSkillContent(text) {
+    return isSksManagedCoreSkillContent(text) || SKS_MANAGED_SKILL_MARKER_RE.test(text);
+}
+async function dedupeSkillRegistryScanRoots(candidates) {
+    const byPath = new Map();
+    const blockers = [];
+    for (const candidate of candidates) {
+        const normalized = {
+            ...candidate,
+            root: path.resolve(candidate.root),
+            ...(candidate.boundary ? { boundary: path.resolve(candidate.boundary) } : {})
+        };
+        if (normalized.boundary) {
+            try {
+                await fs.lstat(normalized.root);
+            }
+            catch (error) {
+                if (error && typeof error === 'object' && 'code' in error && error.code === 'ENOENT')
+                    continue;
+                blockers.push(unsafeSkillScanRootBlocker(normalized.scope, 'lstat_failed'));
+                continue;
+            }
+            try {
+                const inspection = await inspectConfinedPath(normalized.boundary, normalized.root);
+                if (!inspection.exists)
+                    continue;
+                if (inspection.leafSymlink) {
+                    blockers.push(unsafeSkillScanRootBlocker(normalized.scope, 'leaf_symlink'));
+                    continue;
+                }
+                if (!inspection.stat?.isDirectory()) {
+                    blockers.push(unsafeSkillScanRootBlocker(normalized.scope, 'not_directory'));
+                    continue;
+                }
+            }
+            catch (error) {
+                blockers.push(unsafeSkillScanRootBlocker(normalized.scope, skillScanRootInspectionFailureReason(error)));
+                continue;
+            }
+        }
+        const identity = await canonicalFilesystemPath(candidate.root);
+        const current = byPath.get(identity);
+        if (!current || skillScanScopeRank(normalized.scope) > skillScanScopeRank(current.scope)) {
+            byPath.set(identity, normalized);
+        }
+    }
+    return { roots: [...byPath.values()], blockers: [...new Set(blockers)].sort() };
+}
+function unsafeSkillScanRootBlocker(scope, reason) {
+    return `unsafe_skill_scan_root:${skillScanRootScopeCode(scope)}:${reason}`;
+}
+function skillScanRootScopeCode(scope) {
+    if (scope === 'project' || scope === 'global' || scope === 'codex-home' || scope === 'user')
+        return scope;
+    return 'unknown';
+}
+function skillScanRootInspectionFailureReason(error) {
+    const code = error && typeof error === 'object' && 'code' in error ? error.code : null;
+    if (code === 'managed_path_boundary_missing')
+        return 'boundary_missing';
+    if (code === 'managed_path_boundary_symlink_refused')
+        return 'boundary_symlink';
+    if (code === 'managed_path_boundary_not_directory')
+        return 'boundary_not_directory';
+    if (code === 'managed_path_escape_refused')
+        return 'escape_refused';
+    if (code === 'managed_path_ancestor_symlink_refused')
+        return 'ancestor_symlink';
+    if (code === 'managed_path_ancestor_not_directory')
+        return 'ancestor_not_directory';
+    return 'inspection_failed';
+}
+function skillScanScopeRank(scope) {
+    if (scope === 'global' || scope === 'codex-home')
+        return 3;
+    if (scope === 'project')
+        return 2;
+    return 1;
+}
 function compareRegistryPriority(a, b, official) {
     if (official) {
         const globalA = a.scope === 'global' || a.scope === 'codex-home' ? 1 : 0;