sshlg-skills 1.63.3 → 1.65.0

package/CHANGELOG.md

@@ -1,3 +1,159 @@
+## v1.65.0 — foreign text no longer stops an update; WebKit-first members; OpenClaw opt-in
+
+From the 2026-10-16 host validation ([report](docs/reports/2026-10-16-coding-agent-compatibility/README.md),
+brief `docs/evidence/briefs/2026-10-16-host-validation-release.md`).
+
+- **Members — WebKit (Safari) first in every browser check.** task-pipeline 1.97.1 (`references/browser.md`
+  § Engine order, `companion-skills.md`, DEC-0007), sheleg-design 1.65.0 (visual review, capture record `engine`),
+  seo-aeo-audit 0.27.0 (Lighthouse/PSI/CrUX stated as Chrome-only measurement; its validator reads number words
+  past forty), sheleg-dev 0.14.0 (frontend-performance), super-ux 0.60.0 (ux-audit `references/browser-engine.md`).
+  Chromium stays a stated exception; an own Chrome runs on a temporary profile and is closed when done.
+- **Operator text inside a managed block no longer stops the whole run (B-201).** Text placed inside
+  the `wait-is-not-a-stop` block made `update`/`install` exit 2 on every host and name no file.
+  Now that one host is refused, its file is left untouched, the message names `file:line` and the
+  remedy (move the text outside the markers), every other step runs, and the run exits 1 (partial).
+  `blocks` reports `FOREIGN_TEXT_INSIDE <marker> lines a-b` without printing the text.
+- **A router section you edited is kept, never silently deleted (B-202).** `routers` records what it
+  wrote (`~/.sshlg-skills/routers-rendered.json`); a section that matches neither that record nor the
+  new text is kept and recorded as `authored` (`--diff`, `--adopt` work on it); an edited
+  MAP/PROTOCOL/TABLE region is refused with `file:line` until the lines move out.
+- **The wait rule names a host it has not reached (B-208).** With `rules.wait=on`, `update` prints the
+  instruction file and the exact `rules --apply --agent <host>` command for a supported host without a
+  receipt, instead of staying silent; consent is not widened automatically.
+- **Claude Code 2.2 and later no longer stop plugin updates (B-203)**: the pin transaction accepts any
+  version from 2.1.296 on by numeric comparison. **No stray `~/.claude/.claude.json` (B-220)**:
+  `CLAUDE_CONFIG_DIR` is passed to `claude plugin` only for a non-default profile.
+- **Gemini relocation follows `GEMINI_CLI_HOME` (B-204)**, a HOME replacement (`<home>/.gemini`,
+  `<home>/.agents/skills`); the non-existent `GEMINI_CONFIG_DIR` is no longer read.
+- **OpenClaw is opt-in (B-219):** out of `defaultAgents` (the skills CLI detects it by folder only, and
+  its prompt caps — 150 skills, 18,000 characters — would hide most of the family); `--agent openclaw`
+  still works.
+- **Continue copies only when Continue is there (B-213):** `update` adds the `--agent continue --copy`
+  pass only when Continue is installed and in the requested scope.
+- **README corrections (B-215):** which hosts read which instruction file, that Cursor and the
+  Continue CLI can import the Claude hooks, Cursor rules load by ancestor walk, universal adapters
+  install into `~/.agents/skills` only, `skillOverrides` does not hide plugin skills, Codex invokes
+  skills as `$name`.
+
+- **A credential printed under its label is named in the same turn (I-6 remainder, OPS-002).**
+  `secrets.scan` knew vendor prefixes only, so a key with none — a 40-character hex token, a
+  webhook secret, a JWT — printed as `x-api-key: …`, `FOO_API_KEY=…`, `"apiKey": "…"` or
+  `Authorization: Bearer …` went unreported. `lib/labelledsecrets.js` reads the label and the
+  value's shape: the label's noun must name a credential (token, secret, password, or `key`
+  with a credential qualifier such as api, client or an `x-` header), and the value must look
+  generated (16–4,096 characters, a letter and a digit, at least 3 bits of entropy per
+  character, not a placeholder, path, URL, number, timestamp, snake_case name, sequential
+  example or code). The `PostToolUse` note names the label, the tool and the file or program —
+  never the value or any slice of it — and the remedy: rotate through the owner's door
+  (Observatory), and the step for a machine without Observatory.
+- `PostToolUse` now runs on `Read` and `Grep` as well as `Bash`, so a config file read whole
+  is scanned like `cat`. MCP results are not matched (every MCP call would pay a spawn);
+  `update` refreshes the matcher on a machine that already has the hook.
+- Also read: escaped-quote JSON in a string (an `aws secretsmanager` SecretString),
+  `.netrc`, URL userinfo (`scheme://user:PASSWORD@host`, `DATABASE_URL=…`), labels starting
+  with `_` (`.npmrc` `:_authToken=`), base64 values starting with `/`, and Laravel's
+  `APP_KEY=base64:…`. Left out on purpose: a short password with symbols under a label (the
+  token alphabet stops at a symbol; widening it reads prose and code as values).
+- **A local proxy's token is not a vendor key.** Switchboard's managed sessions (SB-118) put
+  `ANTHROPIC_AUTH_TOKEN` beside `ANTHROPIC_BASE_URL=http://127.0.0.1:…` in every project's
+  `.claude/settings.local.json` (93 of the 150 such files under the operator's projects). A
+  `<P>_AUTH_TOKEN` or `<P>_API_KEY` on an active line is not reported only when, in the same
+  file (a Grep `path:line:` prefix, a `grep --heading` path line, a `==> path <==` header or a
+  heredoc body starts another), an active line within 20 lines sets `<P>_BASE_URL` to 127.x,
+  `localhost` or `[::1]` with an optional port and a path free of `@`, `\`, quotes, `,` and
+  `}` (a quoted URL ends at its quote, and what follows the quote must close the value), no
+  other `<P>_BASE_URL` of that prefix appears at all, and there are no more such key lines,
+  commented ones included, than loopback base URLs. A commented key always reports. A
+  commented loopback, an override, concatenated `.env` files, Grep lines from two files, a
+  key 30 lines away, a heredoc then an export, and `@`-, quote- and brace-tailed hosts all
+  report (rounds 2 and 3: they hid legacy `sk-`, DeepSeek, Groq and Stripe keys that
+  `secrets.scan` has no literal for). Disclosed limit: output that concatenates files with no
+  marker between them is one file to this rule; the count and distance rules keep a second
+  file's key reported there.
+- Round 2 also: the one-identifier skip needs a real case transition (`nM` in
+  `AuthenticationMD5Password`), so base32, lower-case alphanumerics and word-digit-word
+  passwords are never skipped, and a quoted flag value is never skipped. Helm/Kubernetes
+  object names (`s3-backup-credentials-prod`) are names. A URL password is reported under
+  the assignment's name only when it names a credential or a connection (`*_URL`, `*_URI`,
+  `*_DSN`), else as `<scheme>-url-password`. A long key with no digit (about one Stripe key in
+  70) is read when it breaks into short case runs. Labels are captured atomically: `-a-a…`
+  filler 174 → 60 ms a MiB. A push registration token (`deviceToken`) is not reported; a
+  session's `resumeToken` is; a URL password under 12 characters (`p4ssw0rd` in docs) is not.
+  The PARTIAL note names its cause: a field over 1 MiB, or the 4 MiB budget across fields.
+- Measured before shipping on 29,827 files, 440 MB (this repository with its members,
+  Observatory's docs and tools, and eight other repositories on the operator's machine),
+  scanned in 17 s. The false-positive classes found are fixtures now: a registry's
+  `credential:<name>` ids, a vault slot name `project/env/NAME`, a publishable `pk_` key in
+  an image URL, a function name or a one-identifier value (`AuthenticationMD5Password`) as a
+  value, a URL whose user and host say it is fake, a k8s object name. 13 files still report. One is a disclosed
+  residual class: a git SHA under a name ending in `_token` cannot be told from a hex token by
+  its shape. The other 12 hold a generated-looking value under a credential label: configs,
+  documentation examples and test sentinels. The detector reads shape, not provenance, and
+  its note says so.
+- Round 3 also: values up to 4,096 characters (RS256 bearers and `id_token`s of 600–2,500,
+  an 800-character `aws_session_token`); an `ENV_VAR_NAME_2` is a name; a label segment of
+  eight or more characters is printed whole only when every word in it is known label
+  vocabulary, otherwise as its first three characters and `*` (a label can be glued to its
+  value), and a URL password's scheme only from a list of known schemes.
+- The note leads with the step that needs no Observatory, as `test/remedies_test.js` holds
+  every refusal to; that suite now reads this note through the real hook process too (B-195).
+- **Bounded, and the vendor scan unchanged.** `secrets.scan` reads every byte of every string
+  of the response, as before; only the labelled detector windows each string (1 MiB whole,
+  else its first 768 KiB and last 256 KiB; 4 MiB in all), and its note says when a scan was
+  partial, also when it found nothing, or when its 5 s time budget in the hook ran out — the
+  vendor note is never lost to it. Values and labels are captured without backtracking: a MiB
+  of `token … =a=a…` takes 13 ms (2.4 s in the first cut). The file-scope reader is linear:
+  a `_BASE_URL` beside a MiB of colon-free, slash-dense output took 101 s in round 3 (past the
+  host's 60 s hook timeout, losing the vendor note) and now takes milliseconds. The note names the program by argv[0]
+  only, so a second word of the command (which can be a short secret) is never repeated. A
+  detector that throws costs neither the turn nor the vendor scan.
+
+## v1.64.0 — fewer tokens before the first word; work stops at its finish line
+
+- `npx sshlg-skills context` measures what every host loads before the first user word:
+  bytes, approximate tokens and lines per instruction file, the hub's blocks against other
+  text, and documented caps. It reports a Codex instruction chain over `project_doc_max_bytes`
+  (Codex stops adding instruction files there; the default is 32 KiB) as an error and a
+  `CLAUDE.md` over Claude Code's 200-line target as a note. Read-only; prints sizes, never text.
+- The routing text may fall and never grow by accident: `routing-registry-total` in DOCMAP is
+  checked on every run. The per-prompt routing note is one header line shorter.
+- The wait rule gains the finish line (revision wait-v2): continuing is not polishing — a unit
+  ends when its exit checks are green and two rounds found nothing blocking; a finding that
+  blocks nothing becomes a board row. It also says a board row addressed to you is a next
+  task, never to end a turn on "shall I continue?", to release a lease as soon as the wait
+  clears, and lists spend above the limit and the operator's recorded decisions as human gates
+  (B-196, B-197). Profiles that applied wait-v1 are upgraded in place, and
+  a crash left by a wait-v1 launcher still recovers. A record from a newer launcher names
+  `npx --yes sshlg-skills@latest` as the remedy. Launchers up to 1.63.3 cannot read a wait-v2
+  receipt; update with `@latest`.
+- task-pipeline is pinned at 1.96.0 (`2674147`): an iteration fixes its finish line at intake,
+  triages every finding as blocking, deferred or noise, and stops after two rounds with nothing
+  blocking or when its round and release budget is spent; `waves.py finish` computes the verdict.
+- New working rule: [context economy](docs/working-rules/context-economy.md) — what belongs in
+  always-loaded instructions, one home per rule, host caps, and stopping by contract.
+- **`blocks install` / `uninstall` / `resolve` — a writer other tools can call for their
+  own block (managed-blocks/1).** Preview by default; with `--apply` the host file is
+  copied to `~/.sshlg-skills/backups/`, only the named block changes, and every step is
+  journaled in `~/.sshlg-skills/managed-blocks/journal.jsonl` (hash-chained, no block
+  text). It refuses the hub's own blocks, `SSHLG:REPOSITORY-HANDOFF` (owner undecided,
+  B-174), other `SSHLG:` names and an `--owner` that differs from the marker's prefix.
+  A `journal.head` beside the journal catches cut-off trailing records; every failure
+  answers in one JSON/text shape that names `blocks resolve` when a write may have landed.
+  Install adds exactly the block and its line ending (CRLF in CRLF files) and uninstall
+  takes exactly those back; a result that would not parse, a read-only file and a
+  dropped in-block edit are refused or warned about before the write.
+  The convention is `docs/working-rules/managed-blocks.md`. `blocks --json` now names each
+  block's registered owner and writer; `OBSERVATORY:AGENT-UPDATES` is registered as
+  Observatory's. `blocks --help` and `blocks <verb> --help` answer.
+- **`blocks` ignores markers inside closed Markdown code fences:** an example of a block
+  in prose is no longer listed or treated as a stray marker.
+- **The DigitalOcean credential refusal leads with the step that needs no Observatory**
+  (a file with mode 600), with the vault named as the alternative. A new suite,
+  `test/remedies_test.js`, holds every secret-guard refusal to an Observatory-free step
+  before any Observatory step (USR-011); it reads only the remedy part of each refusal, every
+  `rule` key, bare or quoted, refusing a spelling it cannot read (a variable, the
+  `{ rule }` shorthand), and every deny site of the PreToolUse hook.
+
 ## v1.63.3 — pinned sources for every Claude member; blocked members no longer stop the run
 
 - A Claude member whose installed bytes already equal the pin is now rebound to the hub's

package/README.md

@@ -20,10 +20,13 @@ every routing rule verbatim, and [`llms.txt`](https://skills.sshlg.me/llms.txt)
 for the machines. · **[Follow @sshlg93 on X](https://x.com/intent/follow?screen_name=sshlg93)**
 
 Works with **Claude Code** (as plugins) and **DeepSeek Harness** (`dsh`), plus
-Cursor, OpenCode, Codex, Kilo, Kimi, Hermes, OpenClaw, Gemini CLI, Windsurf, Zed
+Cursor, OpenCode, Codex, Kilo, Kimi, Hermes, Gemini CLI, Windsurf, Zed
 and other targets among the 79+ agents the vercel `skills` CLI supports.
-The pinned snapshot has 77 global targets; native extension support is checked
-separately in the [compatibility report](docs/reports/2026-10-09-coding-agent-compatibility/README.md).
+Kimi gets the skills only: the hub has no instruction target for it, so the
+routing block reaches it only through a file you keep yourself
+([which](#routing--making-the-family-engage-by-default)). OpenClaw is opt-in (`--agent openclaw`,
+[why](#install)). The pinned snapshot has 77 global targets; native extension
+support is checked separately in the [compatibility report](docs/reports/2026-10-16-coding-agent-compatibility/README.md).
 
 ---
 
@@ -43,13 +46,13 @@ scripts. No services, no telemetry, no API keys.
 
 | Skill | Version | What it does |
 |---|---|---|
-| **[super-ux](https://github.com/ssheleg/super-ux)** | 0.59.3 | Scenario-driven UI development. A versioned design chain in `docs/ux/` — the product vision → personas and jobs → user flows → a screens-and-states map with Figma frames → traced scenarios → evidence-backed audits → fix plans, plus `docs/brand/` for how the product speaks. One `/ux` entry point that reaches every skill, two doc-drift linters and a contract doctor. |
-| **[task-pipeline](https://github.com/ssheleg/task-pipeline)** | 1.95.0 | Full-cycle delivery orchestrator. An intake grill interrogates the request into a complete brief, then **ten gated stages** carry it — docs, brainstorm and decompose, spec, plan, build, tests, deploy, post-deploy, wiki, acceptance — refusing to advance until each gate passes. Documentation is a deliverable with its own portable gate, and the retrospective it leaves behind is traceable to the commit that earned each lesson. Ships `project-audit`: a cold-start audit of a whole project — discovery, probes whose unmet needs read `blind` rather than clean, production evidence including one artefact served under two channels, and an HTML report beside a JSON sidecar that says what moved. |
+| **[super-ux](https://github.com/ssheleg/super-ux)** | 0.60.0 | Scenario-driven UI development. A versioned design chain in `docs/ux/` — the product vision → personas and jobs → user flows → a screens-and-states map with Figma frames → traced scenarios → evidence-backed audits → fix plans, plus `docs/brand/` for how the product speaks. One `/ux` entry point that reaches every skill, two doc-drift linters and a contract doctor. |
+| **[task-pipeline](https://github.com/ssheleg/task-pipeline)** | 1.97.1 | Full-cycle delivery orchestrator. An intake grill interrogates the request into a complete brief, then **ten gated stages** carry it — docs, brainstorm and decompose, spec, plan, build, tests, deploy, post-deploy, wiki, acceptance — refusing to advance until each gate passes. Documentation is a deliverable with its own portable gate, and the retrospective it leaves behind is traceable to the commit that earned each lesson. Ships `project-audit`: a cold-start audit of a whole project — discovery, probes whose unmet needs read `blind` rather than clean, production evidence including one artefact served under two channels, and an HTML report beside a JSON sidecar that says what moved. |
 | **[agent-sync](https://github.com/ssheleg/agent-sync)** | 1.22.2 | Several agents, one repository, no collisions. Leases with a TTL so two agents cannot claim the same work, race-free id reservation, a run journal and a generated board — over a pluggable knowledge cloud. The answer to "two sessions just committed over each other". |
 | **[make-skill](https://github.com/ssheleg/make-skill)** | 0.31.2 | A skill that builds skills. Create, retrofit, audit and publish agent skills and Claude Code plugins: conformance to the [Agent Skills](https://agentskills.io/specification) open standard, [Anthropic's platform rules](https://platform.claude.com/docs/en/agents-and-tools/agent-skills/overview) (per-surface runtime limits, the Skills API, evals) and the [Claude Code plugin reference](https://code.claude.com/docs/en/plugins-reference), marketplace layout, version sync, validator + CI, every distribution channel, the review checklist for third-party skills, and what a *skill author* must know about MCP and A2A — the protocols themselves live in `agent-stack`. |
-| **[sheleg-design](https://github.com/ssheleg/sheleg-design-skill)** | 1.64.2 | The taste layer. Cinematic scroll-driven landing pages — one scroll clock, motion that degrades to calm, WebGL particle formations — plus product-UI style packs each shipping a ready token layer, and the Figma border: tokens as variables, design to code without hand-copied values. |
-| **[seo-aeo-audit](https://github.com/ssheleg/seo-aeo-audit)** | 0.26.6 | Evidence-first website audit for search **and** answer engines. Ten tracks from crawl access to AI citation mechanics; every finding carries an observation, every recommendation an evidence tier, and the output is a prioritized change plan plus a link-building brief — not a score. |
-| **[sheleg-dev](https://github.com/ssheleg/sheleg-dev)** | 0.13.4 | The integration layer a product reaches once it has users: **money in, tracking, sign-in, speed**. Stripe subscription billing reconciled into your own database — webhook idempotency, renewals, seats and proration, refunds, price drift, and the coupon offered at the cancel step, where a `duration=once` discount leaves `subscription.discounts` the moment its invoice finalizes and the offer can be taken every cycle; crypto payments that survive under-payment, duplicate webhooks and rate drift; GA4, Google Ads, Meta and LinkedIn under Consent Mode v2; Google sign-in with the account pre-hijacking guard, and the server-side auth surface behind it; Core Web Vitals work that moves the score rather than the report; and Sentry error tracking wired so it does not forward your own credentials to a third party and so a stack trace names the commit that caused it. |
+| **[sheleg-design](https://github.com/ssheleg/sheleg-design-skill)** | 1.65.0 | The taste layer. Cinematic scroll-driven landing pages — one scroll clock, motion that degrades to calm, WebGL particle formations — plus product-UI style packs each shipping a ready token layer, and the Figma border: tokens as variables, design to code without hand-copied values. |
+| **[seo-aeo-audit](https://github.com/ssheleg/seo-aeo-audit)** | 0.27.0 | Evidence-first website audit for search **and** answer engines. Ten tracks from crawl access to AI citation mechanics; every finding carries an observation, every recommendation an evidence tier, and the output is a prioritized change plan plus a link-building brief — not a score. |
+| **[sheleg-dev](https://github.com/ssheleg/sheleg-dev)** | 0.14.0 | The integration layer a product reaches once it has users: **money in, tracking, sign-in, speed**. Stripe subscription billing reconciled into your own database — webhook idempotency, renewals, seats and proration, refunds, price drift, and the coupon offered at the cancel step, where a `duration=once` discount leaves `subscription.discounts` the moment its invoice finalizes and the offer can be taken every cycle; crypto payments that survive under-payment, duplicate webhooks and rate drift; GA4, Google Ads, Meta and LinkedIn under Consent Mode v2; Google sign-in with the account pre-hijacking guard, and the server-side auth surface behind it; Core Web Vitals work that moves the score rather than the report; and Sentry error tracking wired so it does not forward your own credentials to a third party and so a stack trace names the commit that caused it. |
 | **[agent-stack](https://github.com/ssheleg/agent-stack)** | 0.28.2 | Production patterns for agent systems, in four skills. **The orchestrator** — tool-calling loops that survive their own context pressure, pipelines with human checkpoints and resume, provider routing with fallback and health checks, memory architecture — form, function and dynamics, the four-stage retrieval pipeline, and what a layer table alone cannot say, and **the shape of the work decided before the work**: an edge that carries no data is no edge, a plan that declares its dependencies is executed in layers rather than in list order, and a parallel layer gets a checker before the node that consumes it. **The harness** — what the agent is *told*: system prompts at the right altitude, tool descriptions the model can act on, technique choice with a verdict each, workflow versus agent and static versus dynamic, plus a seven-track audit of an agent somebody else built and a scanner for the defects that are mechanically visible. **The evals** — suites that measure whether it actually works: judging trajectories, regression fixtures grown from production, judges calibrated before they are trusted. **The interop layer** — MCP at revision 2026-07-28 and the four features it deprecated, running many servers at once, the registry, A2A 1.0, and the gateway, every reference carrying the spec revision it was read against. Plus the wallet side of reselling LLM access: tiered balances, one markup boundary, two-phase commit against a provider API. |
 | **[telegram-dev](https://github.com/ssheleg/telegram-dev)** | 0.2.4 | Telegram, split by the API each surface actually speaks. **`telegram-bots`** — the official HTTP Bot API: `update_id` as the only idempotency key an update carries, the `allowed_updates` default that subscribes you to everything *except* `chat_member` and the two reaction types while answering `ok: true`, the webhook secret header that is the real check, rate limits as a design constraint (1/sec per chat, 20/min per group, ~30/sec bulk), and Telegram Stars with a **ten-second** pre-checkout window and a grant that belongs to `successful_payment`. **`telegram-userbots`** — MTProto and Telethon: the session file as a credential equal to the password, `FloodWaitError` as the API telling you exactly how long to wait, pinning across minor releases that move session and entity-cache behaviour, and the account-ban risk a bot token does not carry — the skill opens with whether a user account is needed at all. **`telegram-miniapps`** — the web layer, whose entire security model is one signed query string: verifying `initData` server-side, the `auth_date` window, the Ed25519 path for a third party, and the SDK package whose name moved while the organisation's own page still fronts the old one. Both the verifier and the delivery invariants ship as runnable fixtures with their mutants. |
 | **[xr-dev](https://github.com/ssheleg/xr-dev)** | 0.3.4 | **`quest-lifecycle`** maps the product from platform choice through design, build, testing, Store, monetization, launch and operation. The existing owners cover native OpenXR, Kotlin Spatial/hybrid apps, measured rendering optimization, current-source/tool discovery, commercial and asset readiness, and WebXR/PWA. Every stage names evidence and a next action; Meta engine companions and official Godot XR documentation supply implementation detail. |
@@ -132,14 +135,24 @@ Flags: `--agent a,b` picks valid global targets, `--all` selects the pinned CLI
 77 globally supported targets (76 while Claude uses plugins),
 `--no-claude` skips the plugin step, `--claude-only` does nothing else.
 
+**OpenClaw is opt-in:** `--agent openclaw` (or `--all`) installs for it; a plain
+`install` or `update` does not. The skills CLI counts OpenClaw as present whenever
+a `~/.openclaw` folder exists, so a leftover folder kept a dead host in every run.
+And OpenClaw's caps would show only part of the family even where it runs: at most
+150 skills and 18,000 characters in the prompt, and 300 candidates and 200 loaded
+skills per root. Raise its `skills.limits.*` before you opt in.
+
 ### What `install` actually does
 
 - **Claude Code** → each skill as a **plugin** (`claude plugin marketplace add` +
   `claude plugin install`), never as a plain `~/.claude/skills/` copy.
 - **Other installer targets** → the vercel
-  [`skills`](https://github.com/vercel-labs/skills) CLI, using shared storage and
-  each adapter’s global destination, with repeated `--agent` flags. Hermes and
-  Kiro use native roots; shared `~/.agents/skills` loading is host-specific.
+  [`skills`](https://github.com/vercel-labs/skills) CLI, using shared storage, with
+  repeated `--agent` flags. A *universal* adapter (Cursor, Gemini CLI, OpenCode,
+  Kilo, GitHub Copilot, Droid and the like) installs into `~/.agents/skills` only,
+  never into its own declared global folder (skills@1.7.2 `dist/cli.mjs:2337-2341`),
+  so such a host sees the family only if it reads `~/.agents/skills`. Other adapters
+  get their own global destination; Hermes and Kiro use native roots.
 - **Unsupported global targets** → Eve and PromptScript are excluded from
   `--all`; explicit unknown or project-only names fail before installation.
   The [dated compatibility report](docs/reports/2026-10-09-coding-agent-compatibility/README.md)
@@ -439,10 +452,15 @@ Five channels get it, and each only where that agent is actually installed:
 | Agent | Where |
 |---|---|
 | Claude Code | `~/.claude/CLAUDE.md` |
-| Codex | `~/.codex/AGENTS.md` |
-| Gemini CLI | `~/.gemini/GEMINI.md` |
+| Codex | `~/.codex/AGENTS.md` (Codex invokes a skill as `$name`; the block's `/name` is Claude's syntax) |
+| Gemini CLI | `~/.gemini/GEMINI.md` (or `$GEMINI_CLI_HOME/.gemini/GEMINI.md`) |
 | Pi | `~/.pi/agent/AGENTS.md` (or `$PI_CODING_AGENT_DIR/AGENTS.md` — the writer, `uninstall` and the write guard all follow it) |
-| Cursor | `~/.cursor/rules/sshlg-routing.mdc` — one file per rule, `alwaysApply: true` |
+| Cursor | `~/.cursor/rules/sshlg-routing.mdc` — one file per rule, `alwaysApply: true`. Cursor finds it by walking up from the workspace, so it loads only for workspaces under `$HOME` |
+
+Other hosts read these files without the hub writing for them. OpenCode and VS Code
+Copilot read `~/.claude/CLAUDE.md` as a fallback; OpenCode stops as soon as a
+`~/.config/opencode/AGENTS.md` exists. `~/.agents/AGENTS.md` is read by Kimi, Goose,
+Warp and Droid; the hub does not write it, so today it holds what you put there.
 
 **Pi** (`@earendil-works/pi-coding-agent`, command `pi`) reads skills from `~/.pi/agent/skills`,
 `~/.agents/skills` and, per project, `.pi/skills` and `.agents/skills` up to the repository root;
@@ -514,6 +532,19 @@ back the wrong text. Your word still wins; silence stops being the decision.
 out and which survives a reinstall and a restored dotfile. Everything outside
 the sentinels is preserved byte for byte.
 
+**Text you put inside the block is kept, not refreshed away.** Each write records
+a hash of every section and of the map, protocol and table regions it wrote, in
+`~/.sshlg-skills/routers-rendered.json`. A later refresh that finds a section or
+region matching neither that record nor the new text, and that would drop a
+non-blank line, leaves it as it stands and names `file:line` in the preview and
+the run. A kept **section** becomes your authored text for that router, so
+`routers --diff <name>` and `--adopt <name>` apply to it. A kept **region** is a
+refused refresh: the run exits 1 until you move those lines outside the block.
+Without a record (a block an older release wrote), any section or region that
+would lose a line is kept the same way, so an older packaged wording can stay
+until you adopt the current one. `npx sshlg-skills blocks` reports such text as
+`FOREIGN_TEXT_INSIDE` with its line range, without printing it.
+
 ### Turning routers off
 
 ```bash
@@ -542,8 +573,17 @@ npx sshlg-skills rules --apply --agent codex
 Supported destinations are existing Claude Code, Codex, Gemini, Pi and Cursor
 instruction roots. Use `--claude-only` for Claude Code; `--agent` selects other
 hosts. A later `update` refreshes only profiles with a prior ownership receipt.
+It does not extend the rule to a host added later: with `rules.wait` on, `update`
+names each such host's instruction file and the command that applies it there
+(`npx sshlg-skills rules --apply --agent pi`; `--claude-only` for Claude Code).
+That stays a named gap rather than an automatic write because consent to the rule
+is recorded per host, and an update never creates it for a new one.
 Set `rules.wait off` and apply the same scope to remove its owned text. Surrounding
 content is preserved; malformed, edited or retargeted state stops for recovery.
+Text placed inside an applied block refuses that block on that host only:
+`install`, `update` and `uninstall` name `file:line` and the remedy (move the text
+outside the markers), run every other step and exit 1. An explicit `rules --apply`
+still refuses as a whole and writes nothing.
 The rule describes continuation and durable handoff. It creates no watcher or job,
 and sign-ins, consent, payment and action-specific authority keep their own gates.
 
@@ -614,7 +654,9 @@ hides every other installed pack; an existing file is replaced only with `--repl
 
 **Which switch each host gets, and what decides it:**
 
-- **Claude Code and Codex** hide every skill outside the usage core, as since v1.55.0.
+- **Claude Code and Codex** hide every skill outside the usage core, as since v1.55.0,
+  with one exception on Claude Code: `skillOverrides` does not apply to plugin skills,
+  so a plugin's skills stay listed (switch a foreign plugin off with `enabledPlugins`).
   The pack marks and the overrides below do not change them; `--keep <skill>` keeps a
   skill listed there.
 - **Gemini, Pi, OpenCode and Hermes** hide the skills of marked packs, except the usage
@@ -634,7 +676,7 @@ npx sshlg-skills visibility --revert   # remove exactly what --apply wrote; with
 
 | Host | The switch `visibility` writes | Source | A hidden skill can still |
 |---|---|---|---|
-| Claude Code | `skillOverrides: "user-invocable-only"` in `~/.claude/settings.json` | since v1.55.0 | be run from the `/` menu by a person |
+| Claude Code | `skillOverrides: "user-invocable-only"` in `~/.claude/settings.json`; plugin skills are out of its reach | since v1.55.0; Claude Code settings reference: overrides do not apply to plugin skills | be run from the `/` menu by a person |
 | Codex | `enabled = false` entries in `~/.codex/config.toml` `[skills] config` | since v1.55.0 | be read from its SKILL.md path when asked |
 | Gemini CLI 0.63.0 | `skills.disabled` in `~/.gemini/settings.json`, the list `gemini skills disable <name> --scope user` writes; read back with `gemini skills list` (`[Disabled]`) | `packages/cli/src/utils/skillSettings.ts`; `SkillManager.getSkills()` drops disabled skills | come back with `gemini skills enable <name>` |
 | Pi 1.1.0 | `-<path>` exact exclusions in the `skills` array of `~/.pi/agent/settings.json`, one per folder holding the skill (`~/.agents/skills`, `~/.pi/agent/skills`); the file is created if absent and removed again by `--revert` | Pi's own docs, settings → Resources; `isEnabledByOverrides` in its `dist/core/package-manager.js` | be loaded for one session with `pi --skill <path>` |
@@ -643,9 +685,10 @@ npx sshlg-skills visibility --revert   # remove exactly what --apply wrote; with
 | Cursor agent CLI 2026.09.02 | **cannot hide on cursor**: no setting switches a skill off. The only model-side filter is the skill's own `disable-model-invocation` front matter, and editing a third-party SKILL.md is ruled out | the bundled `index.js` (`filterModelDisabledSkills`, `disable-model-invocation`) | (not hidden) |
 | Kimi 2.1.1 | **cannot hide on kimi**: `[[permission.rules]] decision = "deny"`, `pattern = "Skill(<name>)"` in `~/.kimi-code/config.toml` refuses the call, but the listing keeps the skill, so it is not applied as hiding | the `kimi` 2.1.1 bundle (`features/skill/catalog` filters built-in skills only) | (not hidden) |
 
-Visibility follows the active host directories, including `CLAUDE_CONFIG_DIR` and
-`CODEX_HOME`. New ownership records bind to the canonical settings files; changing a
-profile or retargeting its symlink refuses apply/revert until the original target is
+Visibility follows the active host directories, including `CLAUDE_CONFIG_DIR`,
+`CODEX_HOME` and `GEMINI_CLI_HOME` (Gemini's HOME replacement: its files sit under
+`$GEMINI_CLI_HOME/.gemini`). New ownership records bind to the canonical settings
+files; changing a profile or retargeting its symlink refuses apply/revert until the original target is
 restored. Malformed or unreadable policy and incomplete skill inventories refuse apply
 before writing an ownership journal. Revert can still restore owned settings without a
 working discovery inventory. Legacy records without file bindings are accepted only
@@ -679,7 +722,12 @@ never extended: `update` prints one line asking for one `visibility --apply [--k
 
 The routing block loads in every session and is still routed around, because
 prose in a long file loses to whatever spoke last. Hooks are what speak first —
-and, since v0.42.0, what **holds**:
+and, since v0.42.0, what **holds**.
+
+The hub wires hooks into one target: Claude Code's `~/.claude/settings.json`. Two
+other hosts can import them from that file: Cursor (its third-party hooks import,
+on by default) and the Continue CLI. Neither is tested here, so the family claims
+nothing about how its hooks behave there:
 
 ```bash
 npx sshlg-skills hooks                    # what would be wired, and what holds it now
@@ -715,7 +763,7 @@ npx sshlg-skills humanizers               # anti-AI-writing skills here, with th
 | `SessionStart` | one note saying the block is not advisory; the session's title and the ledger to watch; **and, since v0.48.0, one line naming any other enabled plugin that also injects here** — silent when there is none, and since v1.56.0 printed only when that set differs from the one recorded in `state.json` — a machine-wide record, so a second session with the same set is not told again | ~90 tokens per session |
 | `UserPromptSubmit` | names the route this prompt asks for — **once per route per session** since v1.56.0 (a route already named is not repeated; `clear` and `compact` reset the record, `resume` keeps it, a fork is a new session id and starts without one; a payload with no session id keeps no turn record at all — its note always prints and it is never escalated). One exception: a facet route printed for the first time on a prompt that writes brings the `task-pipeline` line with it, even when delivery was named earlier | nothing on the turns that don't need it |
 | `PreToolUse` | **copies before any write** to `~/.claude/CLAUDE.md`, `~/.codex/AGENTS.md`, `~/.gemini/GEMINI.md`, `~/.pi/agent/AGENTS.md`, `~/.cursor/rules/sshlg-routing.mdc` and `~/.claude/settings.json` — and **refuses the write** if the copy cannot be taken. Also refuses a bare `npx skills update <member>` | nothing until one of those files is touched |
-| `PostToolUse` | after any skills-CLI run, names the plain copies shadowing a plugin; after `obsidian-wiki setup`, puts back the config keys it truncates | nothing on any other command |
+| `PostToolUse` | on `Bash`, `Read` and `Grep`: names a credential the tool printed — a vendor-shaped key, or a generated-looking value under a label that names one (`x-api-key: …`, `FOO_API_KEY=…`, `Authorization: Bearer …`, `.netrc`, a URL's `user:password@`) — by its label, the tool and the file or program, **never the value**, with the rotation remedy; hashes, ids and fingerprints under neutral names, placeholders, paths and code stay silent. After any skills-CLI run, names the plain copies shadowing a plugin; after `obsidian-wiki setup`, puts back the config keys it truncates | one scan of the output (each field whole up to 1 MiB, else its first 768 KiB and last 256 KiB; it says when a scan was partial), silent when it finds nothing; a local proxy's token (an active loopback `*_BASE_URL` of the same prefix, in the same file, with no other) is not reported; MCP results are not read |
 | `Notification` | a desktop ping when a long run goes idle or a background agent finishes | nothing — it emits a terminal sequence |
 | `ConfigChange` | notices when something else rewrites these entries (a field this pack writes changed; a field you added is not a change, and an entry that is gone looks like one you removed, so `hooks` lists it on demand instead) | nothing — it records; `SessionStart` reports |
 | `FileChanged` | says when the run ledger advances a stage | nothing — one line, when it moves |
@@ -861,6 +909,17 @@ Credentials go through Project Observatory (`observatory_credentials`, `use_secr
 --vault-only`); the family's secret guard names an Observatory-free route in every refusal
 as well. Observatory: <https://github.com/passioncode-ai/project-observatory-dashboard>.
 
+### What every agent loads — `context`
+
+```bash
+npx sshlg-skills context          # per host: bytes, ~tokens, lines, hub-managed vs other text, caps
+npx sshlg-skills context --json
+```
+
+Read-only. Exits 1 when a host file is over a documented cap (Codex stops adding instruction
+files at `project_doc_max_bytes`, 32 KiB by default) and notes a `CLAUDE.md` above Claude Code's
+200-line target. The rules behind it: [context economy](docs/working-rules/context-economy.md).
+
 ## Other commands
 
 ```bash
@@ -1001,18 +1060,6 @@ GitHub release from the matching changelog section.
 Contributions are welcome — see [CONTRIBUTING.md](CONTRIBUTING.md). To report a
 vulnerability, see [SECURITY.md](SECURITY.md).
 
-## Author
-
-Built by ssheleg — [sshlg.me](https://sshlg.me)
-
-- X / Twitter — [@sshlg93](https://x.com/sshlg93) ·
-  [follow in one click](https://x.com/intent/follow?screen_name=sshlg93)
-- Telegram — [@sshlg](https://t.me/sshlg)
-
-## License
-
-MIT © 2026 ssheleg.
-
 ### Inspect instruction blocks
 
 `npx sshlg-skills blocks --agent codex --json` reads marker metadata from the
@@ -1028,3 +1075,35 @@ The source must contain one complete matching outer block. Output contains only
 the selected block's before/after text, so treat that output as local material.
 The command does not apply the diff. Unknown/foreign blocks remain inspectable;
 REPOSITORY-HANDOFF ownership is still a separate operator decision.
+
+### Write another tool's block (managed-blocks/1)
+
+A tool that keeps its own block in a host instruction file — Observatory's
+`OBSERVATORY:AGENT-UPDATES`, for one — can let the hub write it:
+
+```bash
+npx sshlg-skills blocks install OBSERVATORY:AGENT-UPDATES --owner OBSERVATORY --agent claude --from ./block.md
+npx sshlg-skills blocks install OBSERVATORY:AGENT-UPDATES --owner OBSERVATORY --agent claude --from ./block.md --apply
+npx sshlg-skills blocks uninstall OBSERVATORY:AGENT-UPDATES --owner OBSERVATORY --agent claude --apply
+```
+
+Without `--apply` it previews and writes nothing. With it, the file is copied to
+`~/.sshlg-skills/backups/` first, only the named block changes, and each step is
+recorded in `~/.sshlg-skills/managed-blocks/journal.jsonl`. It writes `claude`,
+`codex`, `gemini` and `pi` files, never installs a host, and refuses the hub's own
+blocks (they have their own writers), `SSHLG:REPOSITORY-HANDOFF` (no owner decided)
+and any block whose owner prefix differs from `--owner`. An interrupted write is
+classified with `npx sshlg-skills blocks resolve <operation-id>`. The convention:
+[docs/working-rules/managed-blocks.md](docs/working-rules/managed-blocks.md).
+
+## Author
+
+Built by ssheleg — [sshlg.me](https://sshlg.me)
+
+- X / Twitter — [@sshlg93](https://x.com/sshlg93) ·
+  [follow in one click](https://x.com/intent/follow?screen_name=sshlg93)
+- Telegram — [@sshlg](https://t.me/sshlg)
+
+## License
+
+MIT © 2026 ssheleg.

package/bin/sshlg-skills.js

@@ -293,6 +293,7 @@ Usage:
                                                       # Pi, OpenCode, Hermes; not Claude/Codex)
   npx sshlg-skills hooks   [status]                   # what is wired, and what holds it
   npx sshlg-skills hooks   install [--force] [--dry-run]
+  npx sshlg-skills context [--json]                    # what each host loads before the first word; caps
   npx sshlg-skills hooks   recovery inspect [--json]
   npx sshlg-skills hooks   recovery recover --expect <digest|absent> [--json]
   npx sshlg-skills hooks   remove
@@ -312,7 +313,7 @@ Usage:
   npx sshlg-skills visibility marks [--init --show <owner/repo,…> [--replace] [--apply]]
                                                       # this machine's pack marks
                                                       # (~/.sshlg-skills/pack-marks.json)
-  npx sshlg-skills blocks [--agent claude|codex|gemini|pi|cursor] [--json]\n  npx sshlg-skills blocks diff OWNER:NAME --from <local-file> --agent <host>\n                                                      # read-only markers and selected local diff\n  npx sshlg-skills rules [--apply] [--agent codex|gemini|pi|cursor] [--claude-only]\n                                                      # opt-in wait rule; preview unless --apply\n  npx sshlg-skills rules recovery inspect [--json]\n  npx sshlg-skills rules recovery finalize --operation <id> [--apply] [--json]\n                                                      # metadata only; never restores host instructions\n  npx sshlg-skills domains [--apply | --revert] [--root <dir>] [--no-usage]
+  npx sshlg-skills blocks [--agent claude|codex|gemini|pi|cursor] [--json]\n  npx sshlg-skills blocks diff OWNER:NAME --from <local-file> --agent <host>\n                                                      # read-only markers and selected local diff\n  npx sshlg-skills blocks install|uninstall OWNER:NAME --owner OWNER --agent <host> [--from <file>] [--apply]\n  npx sshlg-skills blocks resolve <operation-id>\n                                                      # managed-blocks/1 writer for a tool's own block; preview unless --apply\n  npx sshlg-skills rules [--apply] [--agent codex|gemini|pi|cursor] [--claude-only]\n                                                      # opt-in wait rule; preview unless --apply\n  npx sshlg-skills rules recovery inspect [--json]\n  npx sshlg-skills rules recovery finalize --operation <id> [--apply] [--json]\n                                                      # metadata only; never restores host instructions\n  npx sshlg-skills domains [--apply | --revert] [--root <dir>] [--no-usage]
   npx sshlg-skills domains --enable|--disable <member> [--project <dir>]
                                                       # xr-dev, web3d-dev, telegram-dev; hook-bearing members stay global
                                                       # load only in projects that call for them
@@ -374,7 +375,7 @@ function plainSkillsPlan(f, update = false) {
   if (f.claudeOnly) return [];
   if (cliSpec() !== 'skills@1.7.2') throw new Error('immutable source contract requires verified skills@1.7.2');
   return require('../lib/installer-pins').build(SKILLS, skillsCliAgents(f),
-    { continueCopies: update && continueHasFamilyCopies() });
+    { continueCopies: update && continueRestoreWanted(f) });
 }
 
 function planInstall(f) {
@@ -1482,7 +1483,17 @@ function cmdRouters(f) {
     }
   }
 
+  // B-202: what this hub last wrote into each file, so a refresh can tell its own
+  // bytes from a hand edit inside a section or region. Hub metadata, not an
+  // operator file: no backup; a damaged record reads as none, which keeps MORE.
+  const store = require('../lib/store.js');
+  const renderedFile = path.join(home, '.sshlg-skills', 'routers-rendered.json');
+  const renderedRecord = store.readJson(renderedFile);
+  const renderedFiles = renderedRecord.schema === 1 && renderedRecord.files && typeof renderedRecord.files === 'object'
+    ? renderedRecord.files : {};
+
   const res = apply.apply({
+    rendered: renderedFiles,
     home, mode, consent: decision, routers: packaged,
     // Only the selected host files are written; the rest stay byte-identical.
     hostTargets: scoped.hostTargets, includeCursor: scoped.includeCursor,
@@ -1518,6 +1529,38 @@ function cmdRouters(f) {
     for (const name of restored) configLib.stashClear(home, name);
   }
 
+  // Hand edits the refresh kept (B-202). Named by file:line in the preview and the run,
+  // every time, until resolved: a section becomes the operator's authored text (so
+  // `--diff` / `--adopt` apply); a region is a refused refresh and the run is partial.
+  const keptRegions = [];
+  const lines = (k) => (k.startLine === k.endLine ? `${k.startLine}` : `${k.startLine}-${k.endLine}`);
+  for (const r of res.targets) {
+    for (const k of r.kept || []) {
+      if (k.kind === 'section') {
+        log(`routers: ${r.file}:${lines(k)} — section "${k.name}" holds text the pack did not write; kept as it is and ${f.dryRun ? 'would be ' : ''}recorded as your authored text for ${k.name}.`);
+        log(`  Compare: npx sshlg-skills routers --diff ${k.name}   Take the packaged text: npx sshlg-skills routers --update --adopt ${k.name}`);
+        if (!f.dryRun && decision === 'yes' && configLib.authoredGet(configLib.readConfig(home), k.name) === undefined) {
+          configLib.authoredSet(home, k.name, k.body);
+        }
+      } else {
+        keptRegions.push(k);
+        log(`routers: ${r.file}:${lines(k)} — the ${k.name} region holds text the pack did not write; the region was left as it is, not refreshed.`);
+        log('  Move those lines outside the block (above its BEGIN or below its END marker), then run: npx sshlg-skills routers --update');
+      }
+    }
+  }
+  if (!f.dryRun && decision === 'yes') {
+    const next = Object.assign({}, renderedFiles);
+    for (const r of res.targets) {
+      if (r.rendered && ['unchanged', 'updated', 'created'].includes(r.action)) next[r.file] = r.rendered;
+    }
+    // Written only when it changes, so a run that changed nothing writes nothing.
+    if (JSON.stringify(next) !== JSON.stringify(renderedFiles) || renderedRecord.schema !== 1) {
+      try { store.writeJson(renderedFile, () => ({ schema: 1, files: next })); }
+      catch (e) { log(`routers: the record of what was written (${renderedFile}) was not saved: ${e.message}; the next refresh keeps more, never less`); }
+    }
+  }
+
   // A copy of every file this run modified, taken before it was modified. Said
   // once rather than per target: four identical lines about the same directory
   // is how a useful line becomes noise the operator learns to skip.
@@ -1571,7 +1614,9 @@ function cmdRouters(f) {
     log('  Посмотреть разницу:  npx sshlg-skills routers --diff <имя>');
     log('  Принять пакетный:    npx sshlg-skills routers --update --adopt <имя>');
   }
-  return true;
+  // A refused region refresh makes a real run partial (exit 1), like a refused wait
+  // block; a preview is a render and exits 0, as `update --dry-run` does.
+  return f.dryRun || !keptRegions.length;
 }
 
 /**
@@ -1591,17 +1636,29 @@ function attachWaitPlan(steps, f, options = {}) {
   if (f.member) return opres.buildPlan(steps);
   const pending = waitPlan(f, { automatic: true, ...options });
   steps.push(opres.step('working-rule', 'home', 'refresh only previously applied wait-rule profiles', {
-    changes: pending.rows.map(r => `${r.agent}: ${r.action} (${r.file})`),
+    changes: pending.rows.map(waitRowLine),
   }));
   const planned = opres.buildPlan(steps);
   WAIT_PLANS.set(planned, pending);
   return planned;
 }
+// One wording for the plan and the run. A refused block names `file:line` and its remedy
+// (B-201); a host the enabled rule has not reached names the command that applies it (B-208).
+function waitRowLine(r) {
+  if (r.action === 'refused') return `${r.agent}: refused — ${r.reason}; ${r.remedy}`;
+  if (r.command) return `${r.agent}: not applied — ${r.file}: rules.wait is on, this host has no ownership receipt; apply it here: ${r.command}`;
+  return `${r.agent}: ${r.action} (${r.file})`;
+}
 function executeWaitPlan(planned) {
   const pending = WAIT_PLANS.get(planned);
   if (!pending) return true;
   const result = require('../lib/wait-rules.js').execute(pending);
-  for (const r of result.results) log(`rules.wait: ${r.agent} ${r.action}${r.error ? ': ' + r.error : ''}`);
+  for (const r of result.results) {
+    if (r.action === 'refused') log(`rules.wait: ${r.agent} refused — ${r.error}; ${r.remedy}. Every other step of this run continues; the run reports partial (exit 1).`);
+    else if (r.command) log(`rules.wait: ${r.agent} not applied — ${r.file}: rules.wait is on and this host has no ownership receipt (an update never extends it to a new host); apply it here: ${r.command}`);
+    else if (r.action === 'agent-absent') continue;
+    else log(`rules.wait: ${r.agent} ${r.action}${r.error ? ': ' + r.error : ''}`);
+  }
   return result.ok;
 }
 function parseRuleFlags(args) {
@@ -1982,6 +2039,36 @@ function cmdToolkit(argv) {
   log(toolkit.report(skills, family, { for: forQuery, expand, limit, seeds, protect }));
 }
 
+/**
+ * Should `update` add the Continue `--copy` restore pass (B-213)? Only when the run's
+ * scope includes Continue (no --agent filter, or --agent names it), Continue itself is
+ * installed, and its directory holds family copies to keep current. Copies alone are
+ * not a host: a leftover ~/.continue/skills on a machine without Continue gets nothing.
+ */
+function continueRestoreWanted(f) {
+  if (f.agents && f.agents.length && !f.agents.includes('continue')) return false;
+  return continueInstalled() && continueHasFamilyCopies();
+}
+
+/** Continue is installed: its `cn` CLI is on PATH, or ~/.continue holds a config.* file. */
+function continueInstalled() {
+  const home = process.env.HOME || os.homedir();
+  try {
+    if (fs.readdirSync(path.join(home, '.continue')).some((n) => /^config\.[A-Za-z0-9]+$/.test(n))) return true;
+  } catch (e) { /* no ~/.continue: decided by PATH alone */ }
+  const names = process.platform === 'win32' ? ['cn.cmd', 'cn.exe', 'cn'] : ['cn'];
+  for (const dir of (process.env.PATH || '').split(path.delimiter)) {
+    if (!dir) continue;
+    for (const n of names) {
+      try {
+        const file = path.join(dir, n);
+        if (fs.statSync(file).isFile()) { fs.accessSync(file, fs.constants.X_OK); return true; }
+      } catch (e) { /* not here */ }
+    }
+  }
+  return false;
+}
+
 /**
  * Does this machine hold family skills in Continue's directory? Continue reads only
  * real directories, so `update` restores them as copies (lib/plan.js updatePlan).
@@ -3217,6 +3304,30 @@ function cmdMaterialised(argv) {
   return rows.some((r) => !r.satisfied) ? 2 : 0;
 }
 
+/** Read-only: sizes of the instruction files each host loads, and documented caps. */
+function cmdContext(argv) {
+  const json = argv.includes('--json');
+  if (argv.some(a => a !== '--json')) { log('usage: npx sshlg-skills context [--json]'); return 2; }
+  const pathMod = require('path'), C = require('../lib/context.js'), A = require('../lib/apply.js'), home = os.homedir();
+  const hosts = A.TARGETS.map(t => C.host(t.agent, pathMod.join(A.hostRoot(t, home), t.file)));
+  const codex = A.TARGETS.find(t => t.agent === 'codex'), codexRoot = A.hostRoot(codex, home);
+  // Codex reads AGENTS.override.md in place of AGENTS.md when it exists.
+  const override = C.host('codex', pathMod.join(codexRoot, 'AGENTS.override.md'));
+  if (override.text != null || override.error) { const main = hosts.find(h => h.agent === 'codex'); if (main && override.text != null) main.shadowed = true; hosts.push(override); }
+  for (const name of ['sshlg-routing.mdc', 'sshlg-wait.mdc']) hosts.push(C.host('cursor', pathMod.join(home, '.cursor', 'rules', name)));
+  const config = C.read(pathMod.join(codexRoot, 'config.toml'));
+  const r = C.report(hosts, config);
+  if (json) { console.log(JSON.stringify(r)); return r.findings.some(f => f.severity === 'error') ? 1 : 0; }
+  log('Always-loaded instruction files (' + r.estimate + '):');
+  for (const row of r.rows) {
+    if (!row.present) { log(`  ${row.agent.padEnd(7)} ${row.error ? 'unreadable (' + row.error + ')' : 'absent'}  ${row.file}`); continue; }
+    log(`  ${row.agent.padEnd(7)} ${String(row.bytes).padStart(7)} B  ~${String(row.approxTokens).padStart(6)} tok  ${String(row.lines).padStart(5)} lines  hub ${row.managedBytes} B · other ${row.operatorBytes} B${row.shadowed ? '  (shadowed by AGENTS.override.md)' : row.cap ? `  cap ${row.cap} (${row.capSource})` : ''}`);
+  }
+  for (const f of r.findings) log(`  ${f.severity}: ${f.message}`);
+  if (!r.findings.length) log('  no host is over a documented cap');
+  return r.findings.some(f => f.severity === 'error') ? 1 : 0;
+}
+
 function cmdHooks(argv) {
   const fs = require('fs');
   const pathMod = require('path');
@@ -3770,6 +3881,7 @@ function main(argv) {
   // Also before parseFlags: `hooks` takes a positional subcommand.
   if (cmd === 'hooks') { const r = cmdHooks(rest); return typeof r === 'number' ? r : (r ? 0 : 1); }
   if (cmd === 'injectors') { cmdInjectors(); return 0; }
+  if (cmd === 'context') return cmdContext(rest);
   if (cmd === 'conflicts') { cmdConflicts(); return 0; }
   if (cmd === 'toolkit') { return cmdToolkit(argv) || 0; }
   if (cmd === 'visibility') return cmdVisibility(argv);