threadnote 1.2.0 → 1.3.0

package/dist/threadnote.cjs

@@ -8598,6 +8598,7 @@ function formatPlanSection(title, lines) {
 var import_promises5 = require("node:fs/promises");
 var import_node_os4 = require("node:os");
 var import_node_path6 = require("node:path");
+var import_node_util = require("node:util");
 var TEAMS_FILE_VERSION = 1;
 var SHARED_SEGMENT = "shared";
 var SHAREABLE_MEMORY_KIND_DIRS = ["durable"];
@@ -8605,6 +8606,15 @@ var SHAREABLE_ARTIFACT_DIR = "agent-artifacts";
 var SHAREABLE_TOP_LEVEL_DIRS = [...SHAREABLE_MEMORY_KIND_DIRS, SHAREABLE_ARTIFACT_DIR];
 var SHAREABLE_ROOT_FILES = ["README.md", "AGENTS.md", "CLAUDE.md", "SKILL.md", ".gitignore"];
 var ARTIFACT_INSTALL_METADATA_VERSION = 1;
+var BUNDLE_MANIFEST_VERSION = 1;
+var BUNDLE_MANIFEST_FILE = ".threadnote-bundle.json";
+var BUNDLE_INSTALL_METADATA_FILE = ".threadnote-bundle-install.json";
+var OV_SUMMARY_FILES = [".abstract.md", ".overview.md"];
+var BUNDLE_IGNORE_DIR_NAMES = [".git", "node_modules", "reviews", "repos"];
+var PACK_INDEX_SUFFIX = ".pack.md";
+var PACK_MANIFEST_SUFFIX = ".pack.json";
+var PACK_FILES_DIR = "files";
+var PACK_ROOT_TOKEN = "${THREADNOTE_PACK_ROOT}";
 var AUTO_SHARE_FETCH_INTERVAL_MS = 5 * 60 * 1e3;
 var DEFAULT_GIT_REMOTE_NAME = "origin";
 var SCRUBBER_PATTERNS = [
@@ -8631,7 +8641,10 @@ var SCRUBBER_PATTERNS = [
   // so redaction collapses an entire path to a single placeholder rather than
   // leaving the subpath visible.
   { name: "macOS home path", placeholder: "<local-path>", regex: /\/Users\/[^\s)>"'`,]+/ },
-  { name: "linux home path", placeholder: "<local-path>", regex: /\b\/home\/[^\s)>"'`,]+/ }
+  // No leading \b: it only matches when a word char precedes the slash, which
+  // misses the common cases (after =, :, whitespace, or line start). Mirror the
+  // macOS pattern so /home/... is caught in every position.
+  { name: "linux home path", placeholder: "<local-path>", regex: /\/home\/[^\s)>"'`,]+/ }
 ];
 function applyScrubber(content, { redact }) {
   let cleaned = content;
@@ -9039,12 +9052,47 @@ async function runShareSyncQuiet(config, state, options) {
   return void 0;
 }
 async function stageShareableChanges(dryRun, git, worktree) {
+  await removeOrphanPackIndexes(dryRun, git, worktree);
   const pathspecs = await existingShareablePathspecs(git, worktree);
   if (pathspecs.length === 0) {
     return;
   }
   await maybeRun(dryRun, git, ["-C", worktree, "add", "-A", "--", ...pathspecs], { allowFailure: true });
 }
+async function removeOrphanPackIndexes(dryRun, git, worktree) {
+  const packsRoot = (0, import_node_path6.join)(worktree, SHAREABLE_ARTIFACT_DIR, "packs");
+  if (!await isDirectory(packsRoot)) {
+    return;
+  }
+  for (const agentEntry of await (0, import_promises5.readdir)(packsRoot, { withFileTypes: true })) {
+    if (!agentEntry.isDirectory()) {
+      continue;
+    }
+    const agentDir = (0, import_node_path6.join)(packsRoot, agentEntry.name);
+    for (const nameEntry of await (0, import_promises5.readdir)(agentDir, { withFileTypes: true })) {
+      if (!nameEntry.isDirectory()) {
+        continue;
+      }
+      const packDir = (0, import_node_path6.join)(agentDir, nameEntry.name);
+      const indexPath = (0, import_node_path6.join)(packDir, `${nameEntry.name}${PACK_INDEX_SUFFIX}`);
+      const manifestPath = (0, import_node_path6.join)(packDir, `${nameEntry.name}${PACK_MANIFEST_SUFFIX}`);
+      if (!await isFile(indexPath) || await isFile(manifestPath)) {
+        continue;
+      }
+      const indexRelative = (0, import_node_path6.relative)(worktree, indexPath).split(import_node_path6.sep).join("/");
+      const tracked = await runCommand(git, ["-C", worktree, "ls-files", "--", indexRelative], { allowFailure: true });
+      if (tracked.exitCode === 0 && tracked.stdout.trim().length > 0) {
+        continue;
+      }
+      console.warn(
+        `${dryRun ? "Would remove" : "Removing"} incomplete shared pack (missing ${nameEntry.name}${PACK_MANIFEST_SUFFIX}): ${indexRelative}`
+      );
+      if (!dryRun) {
+        await (0, import_promises5.rm)(packDir, { force: true, recursive: true });
+      }
+    }
+  }
+}
 async function existingShareablePathspecs(git, worktree) {
   const rootFiles = await Promise.all(
     SHAREABLE_ROOT_FILES.map(
@@ -9071,7 +9119,8 @@ async function publishShareGitChange(worktree, relativePath, commitMessage, opti
   const verb = options.verb ?? "add";
   const git = await requiredExecutable("git");
   const messages = [];
-  const stageArgs = verb === "rm" ? ["-C", worktree, "rm", relativePath] : ["-C", worktree, "add", "--", relativePath];
+  const paths = typeof relativePath === "string" ? [relativePath] : [...relativePath];
+  const stageArgs = verb === "rm" ? ["-C", worktree, "rm", ...paths] : ["-C", worktree, "add", "--", ...paths];
   const stageResult = await runGitCommand(dryRun, git, stageArgs, `git ${verb} failed`);
   if (stageResult) {
     messages.push(`git ${verb}: ${stageResult.stdout.trim() || "ok"}`);
@@ -9190,13 +9239,23 @@ async function runSharePublishArtifact(config, sourcePath, options) {
 }
 async function shareAgentArtifact(config, sourcePath, options) {
   const team = await resolveTeam(config, options.team);
-  const dryRun = options.dryRun === true;
-  const preview = options.preview === true;
   const resolvedSourcePath = expandPath(sourcePath);
   if (!await isRegularFileNoSymlink(resolvedSourcePath)) {
     throw new Error(`Agent artifact source is not a regular file: ${resolvedSourcePath}`);
   }
   const artifact = inferShareArtifact(resolvedSourcePath, options);
+  if (artifact.kind === "skill") {
+    const skillDir = (0, import_node_path6.dirname)(resolvedSourcePath);
+    const members = await collectBundleMemberFiles(skillDir);
+    if (members.length > 1) {
+      return shareBundleArtifact(config, team, artifact, skillDir, members, options);
+    }
+  }
+  return shareSingleArtifact(config, team, resolvedSourcePath, artifact, options);
+}
+async function shareSingleArtifact(config, team, resolvedSourcePath, artifact, options) {
+  const dryRun = options.dryRun === true;
+  const preview = options.preview === true;
   const rawContent = await (0, import_promises5.readFile)(resolvedSourcePath, "utf8");
   if (!rawContent.trim()) {
     throw new Error(`Refusing to share empty agent artifact: ${resolvedSourcePath}`);
@@ -9264,6 +9323,702 @@ async function shareAgentArtifact(config, sourcePath, options) {
   });
   return { artifact, gitMessages, messages, sourcePath: resolvedSourcePath, targetPath, targetUri };
 }
+async function shareBundleArtifact(config, team, artifact, skillDir, members, options) {
+  const dryRun = options.dryRun === true;
+  const preview = options.preview === true;
+  const skillRootRelative = `${SHAREABLE_ARTIFACT_DIR}/skills/${artifact.agent}/${artifact.name}`;
+  const skillRootTargetDir = (0, import_node_path6.join)(team.config.worktree, ...skillRootRelative.split("/"));
+  const skillMdTargetPath = (0, import_node_path6.join)(skillRootTargetDir, "SKILL.md");
+  const skillMdTargetUri = workfileToVikingUri(config, team.config, skillMdTargetPath);
+  const skillRootTargetUri = parentUri(skillMdTargetUri);
+  const skillMdSourcePath = (0, import_node_path6.join)(skillDir, "SKILL.md");
+  const prepared = await Promise.all(
+    members.map((member) => prepareBundleMember(config, team, member, skillRootTargetDir, options))
+  );
+  const skillMd = prepared.find((entry) => entry.relativePath === "SKILL.md");
+  if (skillMd === void 0) {
+    throw new Error(`Skill bundle ${artifact.agent}/${artifact.name} is missing SKILL.md.`);
+  }
+  if (!skillMd.binary && typeof skillMd.content === "string" && !skillMd.content.trim()) {
+    throw new Error(`Refusing to share empty agent artifact: ${skillMdSourcePath}`);
+  }
+  const messages = [
+    `${preview ? "Previewing" : dryRun ? "Would share" : "Sharing"} skill ${artifact.agent}/${artifact.name} bundle (${prepared.length} files)`,
+    `Source: ${portablePath(skillDir)}`,
+    `Destination: ${skillRootTargetUri}/`
+  ];
+  const blockers = prepared.filter((entry) => entry.blocker !== void 0);
+  if (preview) {
+    for (const entry of prepared) {
+      const flags = entry.binary ? ["binary"] : [];
+      for (const redaction of entry.redactions) {
+        flags.push(`redact ${redaction.count}\xD7 ${redaction.name}`);
+      }
+      const note = entry.blocker !== void 0 ? ` BLOCKED: ${entry.blocker}` : "";
+      messages.push(`  ${entry.relativePath}${flags.length > 0 ? ` [${flags.join(", ")}]` : ""}${note}`);
+    }
+    return {
+      artifact,
+      gitMessages: [],
+      messages,
+      previewContent: skillMd.binary ? void 0 : skillMd.content,
+      sourcePath: skillMdSourcePath,
+      targetPath: skillMdTargetPath,
+      targetUri: skillMdTargetUri
+    };
+  }
+  if (blockers.length > 0) {
+    throw new Error(
+      `Refusing to share skill ${artifact.agent}/${artifact.name}: ${blockers.map((entry) => `${entry.relativePath} (${entry.blocker})`).join("; ")}. Strip the value, pass --redact for local paths, or --allow-binary for binary files.`
+    );
+  }
+  for (const entry of prepared) {
+    for (const redaction of entry.redactions) {
+      messages.push(`Redacted ${redaction.count}\xD7 ${redaction.name} in ${entry.relativePath} before sharing.`);
+    }
+  }
+  for (const entry of prepared) {
+    const existing = await readFileBytesIfExists(entry.targetPath);
+    if (existing !== void 0 && sha256(existing) !== entry.sha256 && options.force !== true) {
+      throw new Error(
+        `Shared artifact already exists with different content: ${portablePath(entry.targetPath)}. Pass --force to replace it.`
+      );
+    }
+  }
+  if (dryRun) {
+    messages.push(`Would write ${prepared.length} files under ${portablePath(skillRootTargetDir)}`);
+    return {
+      artifact,
+      gitMessages: [],
+      messages,
+      sourcePath: skillMdSourcePath,
+      targetPath: skillMdTargetPath,
+      targetUri: skillMdTargetUri
+    };
+  }
+  const ov = await openVikingCliForMode(dryRun);
+  const markdownMembers = orderSkillMdFirst(prepared.filter((entry) => entry.relativePath.endsWith(".md")));
+  const otherMembers = prepared.filter((entry) => !entry.relativePath.endsWith(".md"));
+  for (const entry of markdownMembers) {
+    const ovHasResource = await vikingResourceExists(ov, config, entry.targetUri);
+    await ensureSharedDirectoryChain(config, ov, entry.targetUri, dryRun, { quiet: true });
+    await writeMemoryFile(
+      config,
+      ov,
+      entry.targetUri,
+      entry.content,
+      ovHasResource ? "replace" : "create",
+      dryRun,
+      { quiet: true }
+    );
+  }
+  await ensureDirectory(skillRootTargetDir, false);
+  for (const entry of otherMembers) {
+    await ensureDirectory((0, import_node_path6.dirname)(entry.targetPath), false);
+    await (0, import_promises5.writeFile)(entry.targetPath, entry.content, entry.binary ? { mode: 384 } : { encoding: "utf8", mode: 384 });
+  }
+  await (0, import_promises5.writeFile)((0, import_node_path6.join)(skillRootTargetDir, BUNDLE_MANIFEST_FILE), buildBundleManifest(artifact, prepared), {
+    encoding: "utf8",
+    mode: 384
+  });
+  const stagedPaths = [
+    ...prepared.map((entry) => `${skillRootRelative}/${entry.relativePath}`),
+    `${skillRootRelative}/${BUNDLE_MANIFEST_FILE}`
+  ];
+  const message = options.message ?? `share: publish skill ${artifact.agent}/${artifact.name} (${prepared.length} files)`;
+  const gitMessages = await publishShareGitChange(team.config.worktree, stagedPaths, message, {
+    dryRun,
+    push: options.push
+  });
+  return {
+    artifact,
+    gitMessages,
+    messages,
+    sourcePath: skillMdSourcePath,
+    targetPath: skillMdTargetPath,
+    targetUri: skillMdTargetUri
+  };
+}
+async function prepareBundleMember(config, team, member, skillRootTargetDir, options) {
+  const buffer = await (0, import_promises5.readFile)(member.absolutePath);
+  const targetPath = (0, import_node_path6.join)(skillRootTargetDir, ...member.relativePath.split("/"));
+  const targetUri = workfileToVikingUri(config, team.config, targetPath);
+  if (isProbablyBinary(buffer)) {
+    const credential = detectBinaryCredential(buffer);
+    const blocker = credential !== void 0 ? `possible ${credential} embedded in binary file` : options.allowBinary === true ? void 0 : "binary file (pass --allow-binary to include it unscanned)";
+    return {
+      binary: true,
+      blocker,
+      content: buffer,
+      redactions: [],
+      relativePath: member.relativePath,
+      sha256: sha256(buffer),
+      targetPath,
+      targetUri
+    };
+  }
+  const scrub = applyScrubber(buffer.toString("utf8"), { redact: options.redact === true });
+  return {
+    binary: false,
+    blocker: scrub.blocker,
+    content: scrub.cleaned,
+    redactions: scrub.redactions,
+    relativePath: member.relativePath,
+    sha256: sha256(scrub.cleaned),
+    targetPath,
+    targetUri
+  };
+}
+function orderSkillMdFirst(entries) {
+  return [...entries].sort((a, b) => {
+    if (a.relativePath === "SKILL.md") {
+      return -1;
+    }
+    if (b.relativePath === "SKILL.md") {
+      return 1;
+    }
+    return compareStrings(a.relativePath, b.relativePath);
+  });
+}
+function buildBundleManifest(artifact, prepared) {
+  const manifest = {
+    artifact,
+    members: prepared.map((entry) => ({ binary: entry.binary, path: entry.relativePath, sha256: entry.sha256 })).sort((a, b) => compareStrings(a.path, b.path)),
+    version: BUNDLE_MANIFEST_VERSION
+  };
+  return `${JSON.stringify(manifest, void 0, 2)}
+`;
+}
+async function collectBundleMemberFiles(skillDir) {
+  const out = [];
+  async function visit(dir) {
+    const entries = await (0, import_promises5.readdir)(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      if (entry.isSymbolicLink()) {
+        continue;
+      }
+      const full = (0, import_node_path6.join)(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (!BUNDLE_IGNORE_DIR_NAMES.includes(entry.name)) {
+          await visit(full);
+        }
+        continue;
+      }
+      if (!entry.isFile() || isIgnoredBundleFile(entry.name)) {
+        continue;
+      }
+      out.push({ absolutePath: full, relativePath: (0, import_node_path6.relative)(skillDir, full).split(import_node_path6.sep).join("/") });
+    }
+  }
+  await visit(skillDir);
+  return out.sort((a, b) => compareStrings(a.relativePath, b.relativePath));
+}
+function isIgnoredBundleFile(name) {
+  if (name === ".DS_Store" || name === BUNDLE_MANIFEST_FILE || name === BUNDLE_INSTALL_METADATA_FILE) {
+    return true;
+  }
+  if (OV_SUMMARY_FILES.includes(name)) {
+    return true;
+  }
+  return name.endsWith(".log") || name.endsWith(".threadnote-install.json");
+}
+function isProbablyBinary(buffer) {
+  if (buffer.includes(0)) {
+    return true;
+  }
+  try {
+    new import_node_util.TextDecoder("utf-8", { fatal: true }).decode(buffer);
+    return false;
+  } catch (_err) {
+    return true;
+  }
+}
+function detectBinaryCredential(buffer) {
+  const latin1 = buffer.toString("latin1");
+  for (const pattern of SCRUBBER_PATTERNS) {
+    if (pattern.placeholder === void 0 && pattern.regex.test(latin1)) {
+      return pattern.name;
+    }
+  }
+  return void 0;
+}
+function detectBinaryLocalPath(buffer, rewriteRoots) {
+  const latin1 = buffer.toString("latin1");
+  for (const root of rewriteRoots) {
+    if (root.length > 0 && latin1.includes(root)) {
+      return "machine-local path";
+    }
+  }
+  for (const pattern of SCRUBBER_PATTERNS) {
+    if (pattern.placeholder !== void 0 && pattern.regex.test(latin1)) {
+      return pattern.name;
+    }
+  }
+  return void 0;
+}
+async function readFileBytesIfExists(path) {
+  try {
+    return await (0, import_promises5.readFile)(path);
+  } catch (_err) {
+    return void 0;
+  }
+}
+function isBundleArtifact(artifact) {
+  if (artifact.artifact.kind === "pack") {
+    return true;
+  }
+  return artifact.members !== void 0 && artifact.members.length > 1;
+}
+function compareStrings(a, b) {
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+async function runSharePublishBundle(config, manifestPath, options) {
+  const result = await shareBundlePack(config, manifestPath, options);
+  printShareArtifactResult(result, options.preview === true);
+}
+function parsePackManifest(raw, manifestPath) {
+  const parsed = parseJsonConfigObject(raw);
+  if (parsed === void 0) {
+    throw new Error(`Invalid pack manifest (not a JSON object): ${manifestPath}`);
+  }
+  const name = parsed.name;
+  if (typeof name !== "string" || name.trim().length === 0) {
+    throw new Error(`Pack manifest must set a non-empty "name": ${manifestPath}`);
+  }
+  const agent = parsed.agent;
+  if (agent !== "codex" && agent !== "claude") {
+    throw new Error(`Pack manifest "agent" must be "codex" or "claude": ${manifestPath}`);
+  }
+  const stringArray2 = (value) => Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+  const skills = stringArray2(parsed.skills);
+  if (skills.length === 0) {
+    throw new Error(`Pack manifest must list at least one skill in "skills": ${manifestPath}`);
+  }
+  const depsValue = parsed.deps ?? {};
+  const pathRewrites = Array.isArray(parsed.pathRewrites) ? parsed.pathRewrites.map((entry) => typeof entry === "string" ? entry : entry?.from).filter((item) => typeof item === "string").map((rewrite) => rewrite.replace(/\/+$/, "")) : [];
+  for (const rewrite of pathRewrites) {
+    if (!(0, import_node_path6.isAbsolute)(rewrite) || rewrite.split("/").filter(Boolean).length < 2) {
+      throw new Error(
+        `Pack manifest pathRewrites entry must be an absolute repo-root path (got "${rewrite}"): ${manifestPath}`
+      );
+    }
+  }
+  return {
+    agent,
+    deps: {
+      cli: stringArray2(depsValue.cli),
+      mcp: stringArray2(depsValue.mcp),
+      os: stringArray2(depsValue.os),
+      runtime: stringArray2(depsValue.runtime)
+    },
+    description: typeof parsed.description === "string" ? parsed.description : void 0,
+    include: stringArray2(parsed.include),
+    name,
+    pathRewrites,
+    skills
+  };
+}
+async function collectPackMembers(manifestDir, manifest) {
+  const members = /* @__PURE__ */ new Map();
+  const addEntry = async (entry) => {
+    const normalized = entry.split("/").filter(Boolean).join("/");
+    if (normalized.split("/").includes("..")) {
+      throw new Error(`Pack manifest entries must stay within the pack root (got "${entry}").`);
+    }
+    const absolute = (0, import_node_path6.join)(manifestDir, ...normalized.split("/"));
+    if (absolute !== manifestDir && !absolute.startsWith(manifestDir + import_node_path6.sep)) {
+      throw new Error(`Pack manifest entry escapes the pack root: ${entry}`);
+    }
+    if (await isDirectory(absolute)) {
+      for (const member of await collectBundleMemberFiles(absolute)) {
+        const relativePath = `${normalized}/${member.relativePath}`;
+        members.set(relativePath, { absolutePath: member.absolutePath, relativePath });
+      }
+      return;
+    }
+    if (await isRegularFileNoSymlink(absolute)) {
+      members.set(normalized, { absolutePath: absolute, relativePath: normalized });
+      return;
+    }
+    throw new Error(`Pack manifest references a missing path: ${entry}`);
+  };
+  for (const skill of manifest.skills) {
+    const skillRel = skill.replace(/\/SKILL\.md$/i, "");
+    const skillDir = (0, import_node_path6.join)(manifestDir, ...skillRel.split("/"));
+    if (!await isFile((0, import_node_path6.join)(skillDir, "SKILL.md"))) {
+      throw new Error(`Pack skill "${skill}" must be a directory containing SKILL.md.`);
+    }
+    await addEntry(skillRel);
+  }
+  for (const include of manifest.include) {
+    await addEntry(include);
+  }
+  return [...members.values()].sort((a, b) => compareStrings(a.relativePath, b.relativePath));
+}
+function escapeRegExp2(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function tokenizePackPaths(text, rewriteRoots) {
+  let out = text;
+  for (const root of rewriteRoots) {
+    if (root.length > 0) {
+      out = out.replace(
+        new RegExp(`(?<![A-Za-z0-9/._~-])${escapeRegExp2(root)}(?=[/\\\\]|["'\`\\s),>:\\]};=]|$)`, "g"),
+        PACK_ROOT_TOKEN
+      );
+    }
+  }
+  return out;
+}
+function residualRewriteRoot(content, rewriteRoots) {
+  return rewriteRoots.find((root) => root.length > 0 && content.includes(root));
+}
+var PORTABLE_PATH_PREFIXES = [
+  "/usr/",
+  "/bin/",
+  "/sbin/",
+  "/lib/",
+  "/lib64/",
+  "/etc/",
+  "/opt/homebrew/",
+  "/tmp/",
+  "/var/",
+  "/private/var/",
+  "/dev/",
+  "/proc/",
+  "/run/",
+  "/sys/",
+  "/Library/",
+  "/System/",
+  "/Applications/"
+];
+function unportableAbsolutePaths(content) {
+  const scan = content.split(`${PACK_ROOT_TOKEN}/`).join("").split(PACK_ROOT_TOKEN).join("");
+  const found = /* @__PURE__ */ new Set();
+  for (const path of scan.match(/(?<![A-Za-z0-9._~$-])\/[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)+/g) ?? []) {
+    if (!PORTABLE_PATH_PREFIXES.some((prefix) => path.startsWith(prefix))) {
+      found.add(path);
+    }
+  }
+  for (const path of scan.match(/[A-Za-z]:\\[^\s"']+/g) ?? []) {
+    found.add(path);
+  }
+  return [...found].sort((a, b) => compareStrings(a, b));
+}
+async function preparePackMember(config, team, member, filesTargetDir, rewriteRoots, options) {
+  const buffer = await (0, import_promises5.readFile)(member.absolutePath);
+  const targetPath = (0, import_node_path6.join)(filesTargetDir, ...member.relativePath.split("/"));
+  const targetUri = workfileToVikingUri(config, team.config, targetPath);
+  if (isProbablyBinary(buffer)) {
+    const credential = detectBinaryCredential(buffer);
+    const localPath = credential === void 0 ? detectBinaryLocalPath(buffer, rewriteRoots) : void 0;
+    let blocker2;
+    if (credential !== void 0) {
+      blocker2 = `possible ${credential} embedded in binary file`;
+    } else if (options.allowBinary !== true) {
+      blocker2 = "binary file (pass --allow-binary to include it unscanned)";
+    } else if (localPath !== void 0) {
+      blocker2 = `possible ${localPath} embedded in binary file (cannot be rewritten)`;
+    }
+    return {
+      binary: true,
+      blocker: blocker2,
+      content: buffer,
+      redactions: [],
+      relativePath: member.relativePath,
+      sha256: sha256(buffer),
+      targetPath,
+      targetUri
+    };
+  }
+  const text = buffer.toString("utf8");
+  if (text.includes(PACK_ROOT_TOKEN)) {
+    return {
+      binary: false,
+      blocker: `contains the reserved ${PACK_ROOT_TOKEN} token`,
+      content: text,
+      redactions: [],
+      relativePath: member.relativePath,
+      sha256: sha256(text),
+      targetPath,
+      targetUri
+    };
+  }
+  const tokenized = tokenizePackPaths(text, rewriteRoots);
+  const isMarkdown = member.relativePath.toLowerCase().endsWith(".md");
+  const scrub = applyScrubber(tokenized, { redact: isMarkdown && options.redact === true });
+  const residual = residualRewriteRoot(scrub.cleaned, rewriteRoots);
+  const blocker = scrub.blocker ?? (residual !== void 0 ? `machine-local path "${residual}" not rewritten` : void 0);
+  return {
+    binary: false,
+    blocker,
+    content: scrub.cleaned,
+    redactions: scrub.redactions,
+    relativePath: member.relativePath,
+    sha256: sha256(scrub.cleaned),
+    targetPath,
+    targetUri
+  };
+}
+function buildPackIndex(artifact, manifest, skillNames, memberCount) {
+  const lines = [
+    "---",
+    `name: ${artifact.name}`,
+    `agent: ${artifact.agent}`,
+    "kind: pack",
+    `skills: [${skillNames.join(", ")}]`,
+    "---",
+    "",
+    `# ${artifact.name} (skill pack)`,
+    "",
+    manifest.description ?? `A Threadnote skill pack bundling ${skillNames.length} skill(s) and their shared support files (${memberCount} files total).`,
+    "",
+    "## Skills",
+    ...skillNames.map((skill) => `- ${skill}`),
+    "",
+    "## Requirements",
+    "Threadnote installs files only. Ensure these exist on the target machine before running:"
+  ];
+  if (manifest.deps.runtime.length > 0) {
+    lines.push(`- runtime: ${manifest.deps.runtime.join(", ")}`);
+  }
+  if (manifest.deps.cli.length > 0) {
+    lines.push(`- CLI: ${manifest.deps.cli.join(", ")}`);
+  }
+  if (manifest.deps.os.length > 0) {
+    lines.push(`- OS: ${manifest.deps.os.join(", ")}`);
+  }
+  if (manifest.deps.mcp.length > 0) {
+    lines.push(`- MCP (configure separately): ${manifest.deps.mcp.join(", ")}`);
+  }
+  lines.push("", `Install: threadnote share install-artifacts --kind pack --name ${artifact.name} --apply`, "");
+  return lines.join("\n");
+}
+function buildPackManifestJson(artifact, manifest, prepared) {
+  const data = {
+    artifact,
+    deps: manifest.deps,
+    members: prepared.map((entry) => ({ binary: entry.binary, path: entry.relativePath, sha256: entry.sha256 })).sort((a, b) => compareStrings(a.path, b.path)),
+    version: BUNDLE_MANIFEST_VERSION
+  };
+  return `${JSON.stringify(data, void 0, 2)}
+`;
+}
+function packSkillName(skillEntry) {
+  const trimmed = skillEntry.replace(/\/SKILL\.md$/i, "");
+  return (0, import_node_path6.basename)(trimmed);
+}
+async function shareBundlePack(config, manifestPath, options) {
+  const team = await resolveTeam(config, options.team);
+  const dryRun = options.dryRun === true;
+  const preview = options.preview === true;
+  const resolvedManifest = expandPath(manifestPath);
+  if (!await isRegularFileNoSymlink(resolvedManifest)) {
+    throw new Error(`Pack manifest is not a regular file: ${resolvedManifest}`);
+  }
+  const manifest = parsePackManifest(await (0, import_promises5.readFile)(resolvedManifest, "utf8"), resolvedManifest);
+  const manifestDir = (0, import_node_path6.dirname)(resolvedManifest);
+  const artifact = { agent: manifest.agent, kind: "pack", name: uriSegment(manifest.name) };
+  const skillNames = manifest.skills.map(packSkillName);
+  const members = await collectPackMembers(manifestDir, manifest);
+  const autoRoots = manifestDir.split("/").filter(Boolean).length >= 2 ? [manifestDir] : [];
+  const rewriteRoots = [.../* @__PURE__ */ new Set([...autoRoots, ...manifest.pathRewrites])].sort((a, b) => b.length - a.length);
+  const packRootRelative = `${SHAREABLE_ARTIFACT_DIR}/packs/${artifact.agent}/${artifact.name}`;
+  const filesRelative = `${packRootRelative}/${PACK_FILES_DIR}`;
+  const indexRelative = `${packRootRelative}/${artifact.name}${PACK_INDEX_SUFFIX}`;
+  const manifestRelative = `${packRootRelative}/${artifact.name}${PACK_MANIFEST_SUFFIX}`;
+  const filesTargetDir = (0, import_node_path6.join)(team.config.worktree, ...filesRelative.split("/"));
+  const packRootTargetDir = (0, import_node_path6.join)(team.config.worktree, ...packRootRelative.split("/"));
+  const indexTargetPath = (0, import_node_path6.join)(team.config.worktree, ...indexRelative.split("/"));
+  const indexTargetUri = workfileToVikingUri(config, team.config, indexTargetPath);
+  const prepared = await Promise.all(
+    members.map((member) => preparePackMember(config, team, member, filesTargetDir, rewriteRoots, options))
+  );
+  const indexContent = tokenizePackPaths(buildPackIndex(artifact, manifest, skillNames, prepared.length), rewriteRoots);
+  const indexScrub = applyScrubber(indexContent, { redact: options.redact === true });
+  const messages = [
+    `${preview ? "Previewing" : dryRun ? "Would share" : "Sharing"} pack ${artifact.agent}/${artifact.name} (${prepared.length} files, ${skillNames.length} skills)`,
+    `Source: ${portablePath(manifestDir)}`,
+    `Destination: ${indexTargetUri}`
+  ];
+  const blockers = prepared.filter((entry) => entry.blocker !== void 0);
+  if (preview) {
+    for (const entry of prepared) {
+      const flags = entry.binary ? ["binary"] : [];
+      for (const redaction of entry.redactions) {
+        flags.push(`redact ${redaction.count}\xD7 ${redaction.name}`);
+      }
+      const note = entry.blocker !== void 0 ? ` BLOCKED: ${entry.blocker}` : "";
+      messages.push(`  ${entry.relativePath}${flags.length > 0 ? ` [${flags.join(", ")}]` : ""}${note}`);
+    }
+    return {
+      artifact,
+      gitMessages: [],
+      messages,
+      previewContent: indexScrub.cleaned,
+      sourcePath: resolvedManifest,
+      targetPath: indexTargetPath,
+      targetUri: indexTargetUri
+    };
+  }
+  const indexResidual = residualRewriteRoot(indexScrub.cleaned, rewriteRoots);
+  if (indexScrub.blocker !== void 0 || indexResidual !== void 0) {
+    throw new Error(
+      `Refusing to share pack ${artifact.agent}/${artifact.name}: index ${indexScrub.blocker ?? `machine-local path "${indexResidual}" not rewritten`}.`
+    );
+  }
+  if (blockers.length > 0) {
+    throw new Error(
+      `Refusing to share pack ${artifact.agent}/${artifact.name}: ${blockers.map((entry) => `${entry.relativePath} (${entry.blocker})`).join("; ")}. Strip the value, pass --redact for local paths, or --allow-binary for binary files.`
+    );
+  }
+  const packJson = applyScrubber(tokenizePackPaths(buildPackManifestJson(artifact, manifest, prepared), rewriteRoots), {
+    redact: options.redact === true
+  });
+  const packJsonResidual = residualRewriteRoot(packJson.cleaned, rewriteRoots);
+  if (packJson.blocker !== void 0 || packJsonResidual !== void 0) {
+    throw new Error(
+      `Refusing to share pack ${artifact.agent}/${artifact.name}: manifest ${packJson.blocker ?? `machine-local path "${packJsonResidual}" not rewritten`}.`
+    );
+  }
+  for (const entry of prepared) {
+    for (const redaction of entry.redactions) {
+      messages.push(`Redacted ${redaction.count}\xD7 ${redaction.name} in ${entry.relativePath} before sharing.`);
+    }
+  }
+  const unportable = /* @__PURE__ */ new Set();
+  for (const entry of prepared) {
+    if (!entry.binary && typeof entry.content === "string") {
+      for (const path of unportableAbsolutePaths(entry.content)) {
+        unportable.add(`${entry.relativePath}: ${path}`);
+      }
+    }
+  }
+  for (const path of unportableAbsolutePaths(indexScrub.cleaned)) {
+    unportable.add(`${artifact.name}${PACK_INDEX_SUFFIX}: ${path}`);
+  }
+  for (const path of unportableAbsolutePaths(packJson.cleaned)) {
+    unportable.add(`${artifact.name}${PACK_MANIFEST_SUFFIX}: ${path}`);
+  }
+  if (unportable.size > 0) {
+    messages.push(
+      `Warning: possible machine-local absolute path(s) that will not resolve on a teammate's machine (declare in pathRewrites or strip if not portable): ${[...unportable].join("; ")}`
+    );
+  }
+  for (const entry of prepared) {
+    const existing = await readFileBytesIfExists(entry.targetPath);
+    if (existing !== void 0 && sha256(existing) !== entry.sha256 && options.force !== true) {
+      throw new Error(
+        `Shared pack file already exists with different content: ${portablePath(entry.targetPath)}. Pass --force to replace it.`
+      );
+    }
+  }
+  if (dryRun) {
+    messages.push(`Would write ${prepared.length} files under ${portablePath(packRootTargetDir)}`);
+    return {
+      artifact,
+      gitMessages: [],
+      messages,
+      sourcePath: resolvedManifest,
+      targetPath: indexTargetPath,
+      targetUri: indexTargetUri
+    };
+  }
+  const ov = await openVikingCliForMode(dryRun);
+  const rollbacks = [];
+  const manifestTargetPath = (0, import_node_path6.join)(team.config.worktree, ...manifestRelative.split("/"));
+  try {
+    const writeMarkdownMember = async (uri, content, worktreePath) => {
+      const priorBytes = await readFileBytesIfExists(worktreePath);
+      const hadResource = await vikingResourceExists(ov, config, uri);
+      await ensureSharedDirectoryChain(config, ov, uri, dryRun, { quiet: true });
+      await writeMemoryFile(config, ov, uri, content, hadResource ? "replace" : "create", dryRun, { quiet: true });
+      rollbacks.push(async () => {
+        if (priorBytes !== void 0) {
+          await writeMemoryFile(config, ov, uri, priorBytes.toString("utf8"), "replace", false, { quiet: true });
+        } else if (await vikingResourceExists(ov, config, uri)) {
+          await removeMemoryUri(config, ov, uri, false, { quiet: true });
+        }
+      });
+    };
+    await writeMarkdownMember(indexTargetUri, indexScrub.cleaned, indexTargetPath);
+    for (const entry of prepared.filter((member) => member.relativePath.endsWith(".md"))) {
+      await writeMarkdownMember(entry.targetUri, entry.content, entry.targetPath);
+    }
+    await ensureDirectory(filesTargetDir, false);
+    for (const entry of prepared.filter((member) => !member.relativePath.endsWith(".md"))) {
+      const priorBytes = await readFileBytesIfExists(entry.targetPath);
+      await ensureDirectory((0, import_node_path6.dirname)(entry.targetPath), false);
+      await (0, import_promises5.writeFile)(entry.targetPath, entry.content, entry.binary ? { mode: 384 } : { encoding: "utf8", mode: 384 });
+      rollbacks.push(async () => {
+        if (priorBytes !== void 0) {
+          await (0, import_promises5.writeFile)(entry.targetPath, priorBytes, { mode: 384 });
+        } else {
+          await (0, import_promises5.rm)(entry.targetPath, { force: true });
+        }
+      });
+    }
+    await ensureDirectory(packRootTargetDir, false);
+    const priorManifest = await readFileBytesIfExists(manifestTargetPath);
+    await (0, import_promises5.writeFile)(manifestTargetPath, packJson.cleaned, { encoding: "utf8", mode: 384 });
+    rollbacks.push(async () => {
+      if (priorManifest !== void 0) {
+        await (0, import_promises5.writeFile)(manifestTargetPath, priorManifest, { mode: 384 });
+      } else {
+        await (0, import_promises5.rm)(manifestTargetPath, { force: true });
+      }
+    });
+    const currentFiles = new Set(prepared.map((entry) => `${filesRelative}/${entry.relativePath}`));
+    const git = await requiredExecutable("git");
+    const tracked = await runCommand(git, ["-C", team.config.worktree, "ls-files", "--", filesRelative], {
+      allowFailure: true
+    });
+    const stalePaths = tracked.exitCode === 0 ? tracked.stdout.split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && !currentFiles.has(line)) : [];
+    for (const stale of stalePaths) {
+      await runCommand(git, ["-C", team.config.worktree, "rm", "-f", "--ignore-unmatch", "--", stale], {
+        allowFailure: true
+      });
+      if (stale.endsWith(".md")) {
+        const staleUri = workfileToVikingUri(config, team.config, (0, import_node_path6.join)(team.config.worktree, ...stale.split("/")));
+        try {
+          if (await vikingResourceExists(ov, config, staleUri)) {
+            await removeMemoryUri(config, ov, staleUri, dryRun, { quiet: true });
+          }
+        } catch (pruneErr) {
+          messages.push(
+            `Warning: could not remove stale OpenViking resource ${staleUri}: ${pruneErr instanceof Error ? pruneErr.message : String(pruneErr)}`
+          );
+        }
+      }
+    }
+  } catch (publishErr) {
+    for (const undo of rollbacks.reverse()) {
+      try {
+        await undo();
+      } catch (_cleanupErr) {
+      }
+    }
+    throw publishErr;
+  }
+  const stagedPaths = [
+    indexRelative,
+    manifestRelative,
+    ...prepared.map((entry) => `${filesRelative}/${entry.relativePath}`)
+  ];
+  const message = options.message ?? `share: publish pack ${artifact.agent}/${artifact.name} (${prepared.length} files)`;
+  const gitMessages = await publishShareGitChange(team.config.worktree, stagedPaths, message, {
+    dryRun,
+    push: options.push
+  });
+  return {
+    artifact,
+    gitMessages,
+    messages,
+    sourcePath: resolvedManifest,
+    targetPath: indexTargetPath,
+    targetUri: indexTargetUri
+  };
+}
 async function runShareInstallArtifacts(config, options) {
   const result = await installSharedAgentArtifacts(config, options);
   if (result.syncedTeams.length > 0) {
@@ -9303,6 +10058,10 @@ async function installSharedAgentArtifacts(config, options) {
   }
   let installedCount = 0;
   for (const artifact of artifacts) {
+    if (isBundleArtifact(artifact)) {
+      installedCount += await installBundleArtifact(artifact, options, dryRun, messages);
+      continue;
+    }
     const label = sharedArtifactLabel(artifact.artifact);
     const state = await sharedArtifactInstallState(artifact);
     if (dryRun) {
@@ -9828,6 +10587,9 @@ function sharedArtifactFromRelativePath(relativePath) {
   if (parts.length === 4 && parts[1] === "commands" && parts[2] === "claude" && parts[3].endsWith(".md")) {
     return { agent: "claude", kind: "command", name: parts[3].slice(0, -".md".length) };
   }
+  if (parts.length === 5 && parts[1] === "packs" && (parts[2] === "codex" || parts[2] === "claude") && parts[4] === `${parts[3]}${PACK_INDEX_SUFFIX}`) {
+    return { agent: parts[2], kind: "pack", name: parts[3] };
+  }
   return void 0;
 }
 async function collectSharedArtifacts(worktree, team) {
@@ -9852,18 +10614,95 @@ async function collectSharedArtifacts(worktree, team) {
       if (artifact === void 0) {
         continue;
       }
-      out.push({
-        artifact,
-        installPath: sharedArtifactInstallPath(team, artifact),
-        sourcePath: full,
-        sourceRelativePath: relativePath,
-        team
-      });
+      const artifactDir = (0, import_node_path6.dirname)(full);
+      if (artifact.kind === "pack" && !await isFile((0, import_node_path6.join)(artifactDir, `${artifact.name}${PACK_MANIFEST_SUFFIX}`))) {
+        console.warn(
+          `Skipping incomplete shared pack (missing ${artifact.name}${PACK_MANIFEST_SUFFIX}): ${relativePath}`
+        );
+        continue;
+      }
+      try {
+        out.push({
+          artifact,
+          installPath: sharedArtifactInstallPath(team, artifact),
+          members: await collectArtifactMembers(artifact, artifactDir),
+          sourcePath: full,
+          sourceRelativePath: relativePath,
+          team
+        });
+      } catch (err) {
+        console.warn(`Skipping shared artifact ${relativePath}: ${err instanceof Error ? err.message : String(err)}`);
+      }
     }
   }
   await visit(root);
   return out.sort((a, b) => a.sourcePath.localeCompare(b.sourcePath));
 }
+async function collectArtifactMembers(artifact, artifactDir) {
+  if (artifact.kind === "skill") {
+    return collectSharedBundleMembers(artifactDir);
+  }
+  if (artifact.kind === "pack") {
+    return collectSharedPackMembers(artifact, artifactDir);
+  }
+  return void 0;
+}
+function isContainedMemberPath(baseDir, relativePath) {
+  if ((0, import_node_path6.isAbsolute)(relativePath) || relativePath.split("/").includes("..")) {
+    return false;
+  }
+  const resolved = (0, import_node_path6.join)(baseDir, ...relativePath.split("/"));
+  return resolved === baseDir || resolved.startsWith(baseDir + import_node_path6.sep);
+}
+async function collectSharedPackMembers(artifact, packDir) {
+  const filesDir = (0, import_node_path6.join)(packDir, PACK_FILES_DIR);
+  if (!await isDirectory(filesDir)) {
+    return [];
+  }
+  const manifestRaw = await readFileIfExists((0, import_node_path6.join)(packDir, `${artifact.name}${PACK_MANIFEST_SUFFIX}`));
+  if (manifestRaw !== void 0) {
+    const rawMembers = parseJsonConfigObject(manifestRaw)?.members;
+    if (Array.isArray(rawMembers)) {
+      const fromManifest = [];
+      for (const entry of rawMembers) {
+        const path = entry?.path;
+        if (typeof path === "string" && path.length > 0) {
+          if (!isContainedMemberPath(filesDir, path)) {
+            throw new Error(`Refusing pack member with an unsafe path that escapes the pack root: ${path}`);
+          }
+          fromManifest.push({ absolutePath: (0, import_node_path6.join)(filesDir, ...path.split("/")), relativePath: path });
+        }
+      }
+      if (fromManifest.length > 0) {
+        return fromManifest.sort((a, b) => compareStrings(a.relativePath, b.relativePath));
+      }
+    }
+  }
+  return collectBundleMemberFiles(filesDir);
+}
+async function collectSharedBundleMembers(skillDir) {
+  const manifestRaw = await readFileIfExists((0, import_node_path6.join)(skillDir, BUNDLE_MANIFEST_FILE));
+  if (manifestRaw !== void 0) {
+    const parsed = parseJsonConfigObject(manifestRaw);
+    const rawMembers = parsed?.members;
+    if (Array.isArray(rawMembers)) {
+      const fromManifest = [];
+      for (const entry of rawMembers) {
+        const path = entry?.path;
+        if (typeof path === "string" && path.length > 0) {
+          if (!isContainedMemberPath(skillDir, path)) {
+            throw new Error(`Refusing skill member with an unsafe path that escapes the skill root: ${path}`);
+          }
+          fromManifest.push({ absolutePath: (0, import_node_path6.join)(skillDir, ...path.split("/")), relativePath: path });
+        }
+      }
+      if (fromManifest.length > 0) {
+        return fromManifest.sort((a, b) => compareStrings(a.relativePath, b.relativePath));
+      }
+    }
+  }
+  return collectBundleMemberFiles(skillDir);
+}
 function filterSharedArtifacts(artifacts, options) {
   const name = options.name === void 0 ? void 0 : uriSegment(options.name);
   return artifacts.filter((artifact) => {
@@ -9885,6 +10724,218 @@ async function maybeSyncSharedArtifacts(config, options) {
   }
   return syncSharedReposBeforeAgentRead(config);
 }
+function bundleInstallRoot(artifact) {
+  return artifact.artifact.kind === "pack" ? artifact.installPath : (0, import_node_path6.dirname)(artifact.installPath);
+}
+function bundleInstallMetadataPath(artifact) {
+  return (0, import_node_path6.join)(bundleInstallRoot(artifact), BUNDLE_INSTALL_METADATA_FILE);
+}
+async function readBundleInstallMetadata(artifact) {
+  const raw = await readFileIfExists(bundleInstallMetadataPath(artifact));
+  if (raw === void 0) {
+    return void 0;
+  }
+  const parsed = parseJsonConfigObject(raw);
+  if (parsed === void 0 || parsed.version !== ARTIFACT_INSTALL_METADATA_VERSION || !Array.isArray(parsed.members)) {
+    return void 0;
+  }
+  const recordedArtifact = parsed.artifact;
+  if (recordedArtifact?.agent !== artifact.artifact.agent || recordedArtifact?.kind !== artifact.artifact.kind || recordedArtifact?.name !== artifact.artifact.name || parsed.team !== artifact.team) {
+    return void 0;
+  }
+  const map2 = /* @__PURE__ */ new Map();
+  for (const entry of parsed.members) {
+    const path = entry?.path;
+    const sourceSha256 = entry?.sourceSha256;
+    const installedSha256 = entry?.installedSha256;
+    if (typeof path === "string" && typeof sourceSha256 === "string" && typeof installedSha256 === "string") {
+      map2.set(path, { installedSha256, sourceSha256 });
+    }
+  }
+  return map2;
+}
+async function sharedBundleInstallStatus(artifact) {
+  const members = artifact.members ?? [];
+  const installRoot = bundleInstallRoot(artifact);
+  const metadata = await readBundleInstallMetadata(artifact);
+  const expanded = await prepareInstallMembers(members, installRoot, artifact.artifact.kind === "pack");
+  const expectedByPath = new Map(expanded.map((entry) => [entry.relativePath, entry]));
+  let installedCount = 0;
+  let localChanged = false;
+  let remoteChanged = false;
+  const memberPaths = /* @__PURE__ */ new Set();
+  for (const member of members) {
+    memberPaths.add(member.relativePath);
+    const expected = expectedByPath.get(member.relativePath);
+    if (expected === void 0) {
+      remoteChanged = true;
+      continue;
+    }
+    const installedBytes = await readFileBytesIfExists((0, import_node_path6.join)(installRoot, ...member.relativePath.split("/")));
+    if (installedBytes === void 0) {
+      remoteChanged = true;
+      continue;
+    }
+    installedCount += 1;
+    const installedSha = sha256(installedBytes);
+    const recorded = metadata?.get(member.relativePath);
+    if (recorded === void 0) {
+      if (installedSha !== expected?.installedSha256) {
+        localChanged = true;
+      }
+      continue;
+    }
+    if (installedSha !== recorded.installedSha256) {
+      localChanged = true;
+    }
+    if (expected?.sourceSha256 !== recorded.sourceSha256) {
+      remoteChanged = true;
+    }
+  }
+  if (metadata !== void 0) {
+    for (const [recordedPath, recorded] of metadata) {
+      if (memberPaths.has(recordedPath)) {
+        continue;
+      }
+      remoteChanged = true;
+      const installedBytes = await readFileBytesIfExists((0, import_node_path6.join)(installRoot, ...recordedPath.split("/")));
+      if (installedBytes !== void 0 && sha256(installedBytes) !== recorded.installedSha256) {
+        localChanged = true;
+      }
+    }
+  }
+  if (installedCount === 0 && metadata === void 0) {
+    return "not_installed";
+  }
+  if (localChanged && remoteChanged) {
+    return "remote_changed_and_local_modified";
+  }
+  if (remoteChanged) {
+    return "update_available";
+  }
+  if (localChanged) {
+    return "local_modified";
+  }
+  return "current";
+}
+function expandPackRoot(text, installRoot) {
+  return text.split(PACK_ROOT_TOKEN).join(installRoot);
+}
+async function prepareInstallMembers(members, installRoot, expandTokens) {
+  const prepared = await Promise.all(
+    members.map(async (member) => {
+      const sourceBytes = await readFileBytesIfExists(member.absolutePath);
+      if (sourceBytes === void 0) {
+        return void 0;
+      }
+      const installedBytes = expandTokens && !isProbablyBinary(sourceBytes) ? Buffer.from(expandPackRoot(sourceBytes.toString("utf8"), installRoot), "utf8") : sourceBytes;
+      return {
+        installedBytes,
+        installedSha256: sha256(installedBytes),
+        relativePath: member.relativePath,
+        sourceSha256: sha256(sourceBytes)
+      };
+    })
+  );
+  return prepared.filter((member) => member !== void 0);
+}
+function serializeInstallMetadata(artifact, prepared) {
+  const metadata = {
+    artifact: artifact.artifact,
+    installedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    members: prepared.map((entry) => ({
+      installedSha256: entry.installedSha256,
+      path: entry.relativePath,
+      sourceSha256: entry.sourceSha256
+    })).sort((a, b) => compareStrings(a.path, b.path)),
+    team: artifact.team,
+    version: ARTIFACT_INSTALL_METADATA_VERSION
+  };
+  return `${JSON.stringify(metadata, void 0, 2)}
+`;
+}
+async function installBundleArtifact(artifact, options, dryRun, messages) {
+  const members = artifact.members ?? [];
+  const installRoot = bundleInstallRoot(artifact);
+  const kindLabel = artifact.artifact.kind === "pack" ? "pack" : "bundle";
+  const label = `${sharedArtifactLabel(artifact.artifact)} ${kindLabel} (${members.length} files)`;
+  const status = await sharedBundleInstallStatus(artifact);
+  if (dryRun) {
+    const verb = sharedArtifactDryRunVerb(status, options.force === true);
+    const suffix = sharedArtifactDryRunSuffix(status, options.force === true);
+    messages.push(`${verb} ${label}: ${portablePath(installRoot)}${suffix}`);
+    return 0;
+  }
+  if ((status === "local_modified" || status === "remote_changed_and_local_modified") && options.force !== true) {
+    throw new Error(`Refusing to overwrite ${portablePath(installRoot)}. Pass force=true or --force.`);
+  }
+  const prepared = await prepareInstallMembers(members, installRoot, artifact.artifact.kind === "pack");
+  if (prepared.length < members.length && options.force !== true) {
+    throw new Error(
+      `Refusing to install ${portablePath(installRoot)}: ${members.length - prepared.length} declared member(s) are unreadable in the shared pack (the shared worktree may be mid-sync). Retry after sync, or pass force=true / --force.`
+    );
+  }
+  if (status === "current") {
+    await (0, import_promises5.writeFile)(bundleInstallMetadataPath(artifact), serializeInstallMetadata(artifact, prepared), { mode: 384 });
+    messages.push(`Already installed ${label}: ${portablePath(installRoot)}`);
+    await surfacePackRequirements(artifact, messages);
+    return 0;
+  }
+  const stagingRoot = `${installRoot}.threadnote-staging`;
+  await (0, import_promises5.rm)(stagingRoot, { force: true, recursive: true });
+  for (const entry of prepared) {
+    const dest = (0, import_node_path6.join)(stagingRoot, ...entry.relativePath.split("/"));
+    await ensureDirectory((0, import_node_path6.dirname)(dest), false);
+    await (0, import_promises5.writeFile)(dest, entry.installedBytes, { mode: 384 });
+  }
+  await (0, import_promises5.writeFile)((0, import_node_path6.join)(stagingRoot, BUNDLE_INSTALL_METADATA_FILE), serializeInstallMetadata(artifact, prepared), {
+    mode: 384
+  });
+  await ensureDirectory((0, import_node_path6.dirname)(installRoot), false);
+  const backupRoot = `${installRoot}.threadnote-old`;
+  await (0, import_promises5.rm)(backupRoot, { force: true, recursive: true });
+  const hadPriorInstall = await exists(installRoot);
+  if (hadPriorInstall) {
+    await (0, import_promises5.rename)(installRoot, backupRoot);
+  }
+  try {
+    await (0, import_promises5.rename)(stagingRoot, installRoot);
+  } catch (swapErr) {
+    if (hadPriorInstall) {
+      await (0, import_promises5.rename)(backupRoot, installRoot);
+    }
+    throw swapErr;
+  }
+  await (0, import_promises5.rm)(backupRoot, { force: true, recursive: true });
+  messages.push(`${sharedArtifactInstallVerb(status, options.force === true)} ${label}: ${portablePath(installRoot)}`);
+  await surfacePackRequirements(artifact, messages);
+  return 1;
+}
+async function surfacePackRequirements(artifact, messages) {
+  if (artifact.artifact.kind !== "pack") {
+    return;
+  }
+  const raw = await readFileIfExists(
+    (0, import_node_path6.join)((0, import_node_path6.dirname)(artifact.sourcePath), `${artifact.artifact.name}${PACK_MANIFEST_SUFFIX}`)
+  );
+  if (raw === void 0) {
+    return;
+  }
+  const deps = parseJsonConfigObject(raw)?.deps;
+  if (deps === void 0 || typeof deps !== "object") {
+    return;
+  }
+  const stringList = (value) => Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+  const depsRecord = deps;
+  const tooling = [...stringList(depsRecord.runtime), ...stringList(depsRecord.cli), ...stringList(depsRecord.os)];
+  const mcp = stringList(depsRecord.mcp);
+  if (tooling.length > 0) {
+    messages.push(`This pack will NOT run until these exist (Threadnote installs files only): ${tooling.join(", ")}.`);
+  }
+  if (mcp.length > 0) {
+    messages.push(`Configure these MCP server(s) separately: ${mcp.join(", ")}.`);
+  }
+}
 async function sharedArtifactInstallState(artifact) {
   const sourceContent = await (0, import_promises5.readFile)(artifact.sourcePath, "utf8");
   const sourceSha = sha256(sourceContent);
@@ -10007,11 +11058,12 @@ function sharedArtifactLabel(artifact) {
   return `${artifact.kind} ${artifact.agent}/${artifact.name}`;
 }
 function sharedArtifactInstallPath(team, artifact) {
-  if (artifact.kind === "skill" && artifact.agent === "codex") {
-    return (0, import_node_path6.join)((0, import_node_os4.homedir)(), ".codex", "skills", "threadnote", team, artifact.name, "SKILL.md");
+  const agentDir = artifact.agent === "codex" ? ".codex" : ".claude";
+  if (artifact.kind === "pack") {
+    return (0, import_node_path6.join)((0, import_node_os4.homedir)(), agentDir, "skills", "threadnote-packs", team, artifact.name);
   }
-  if (artifact.kind === "skill" && artifact.agent === "claude") {
-    return (0, import_node_path6.join)((0, import_node_os4.homedir)(), ".claude", "skills", "threadnote", team, artifact.name, "SKILL.md");
+  if (artifact.kind === "skill") {
+    return (0, import_node_path6.join)((0, import_node_os4.homedir)(), agentDir, "skills", "threadnote", team, artifact.name, "SKILL.md");
   }
   return (0, import_node_path6.join)((0, import_node_os4.homedir)(), ".claude", "commands", "threadnote", team, `${artifact.name}.md`);
 }
@@ -12384,7 +13436,7 @@ function parseGithubRelease(value) {
 }
 function titleFromReleaseName(name, version) {
   const trimmed = name.trim();
-  const withoutPrefix = trimmed.replace(new RegExp(`^v?${escapeRegExp2(version)}:\\s*`, "i"), "");
+  const withoutPrefix = trimmed.replace(new RegExp(`^v?${escapeRegExp3(version)}:\\s*`, "i"), "");
   return withoutPrefix || trimmed || "Release notes";
 }
 function bodyLines(body) {
@@ -12402,7 +13454,7 @@ function bodyLines(body) {
   }
   return out;
 }
-function escapeRegExp2(value) {
+function escapeRegExp3(value) {
   return value.replace(/[\\^$+?.()|[\]{}]/g, "\\$&");
 }
 
@@ -15435,12 +16487,18 @@ async function main() {
   ).action(async (uri, options) => {
     await runSharePublish(getRuntimeConfig(program2), uri, options);
   });
-  share.command("publish-artifact").description("Publish a local Codex/Claude skill or Claude command into the shared team repo").argument("<path>", "Path to SKILL.md or a Claude command markdown file").option("--team <name>", "Team name; defaults to the configured default team").option("--agent <agent>", "Agent owner when path inference is ambiguous: codex or claude").option("--kind <kind>", "Artifact kind when path inference is ambiguous: skill or command").option("--name <name>", "Shared artifact name; defaults to skill directory or command file stem").option("--message <text>", "Commit message override").option("--force", "Replace an existing shared artifact with different content").option("--no-push", "Skip the push step").option("--dry-run", "Print actions without running them").option("--preview", "Print the exact artifact bytes that would land in the shared git repo").option(
+  share.command("publish-artifact").description("Publish a local Codex/Claude skill or Claude command into the shared team repo").argument("<path>", "Path to SKILL.md or a Claude command markdown file").option("--team <name>", "Team name; defaults to the configured default team").option("--agent <agent>", "Agent owner when path inference is ambiguous: codex or claude").option("--kind <kind>", "Artifact kind when path inference is ambiguous: skill or command").option("--name <name>", "Shared artifact name; defaults to skill directory or command file stem").option("--message <text>", "Commit message override").option("--force", "Replace an existing shared artifact with different content").option("--allow-binary", "Include binary skill files (unscannable by the scrubber); blocked by default").option("--no-push", "Skip the push step").option("--dry-run", "Print actions without running them").option("--preview", "Print what would land in the shared git repo without writing or committing").option(
     "--redact",
     "Replace soft-leak matches (local paths) with placeholders and continue; credentials still block"
   ).action(async (path, options) => {
     await runSharePublishArtifact(getRuntimeConfig(program2), path, options);
   });
+  share.command("publish-bundle").description("Publish a multi-skill constellation (pack) declared by a threadnote-bundle.json manifest").argument("<manifest>", "Path to a threadnote-bundle.json manifest").option("--team <name>", "Team name; defaults to the configured default team").option("--message <text>", "Commit message override").option("--force", "Replace existing shared pack files with different content").option("--allow-binary", "Include binary files (unscannable by the scrubber); blocked by default").option("--no-push", "Skip the push step").option("--dry-run", "Print actions without running them").option("--preview", "Print what would land in the shared git repo without writing or committing").option(
+    "--redact",
+    "Replace soft-leak matches (local paths) with placeholders and continue; credentials still block"
+  ).action(async (manifest, options) => {
+    await runSharePublishBundle(getRuntimeConfig(program2), manifest, options);
+  });
   share.command("install-artifacts").description("Install shared Codex/Claude skills and Claude commands from a team repo").option("--team <name>", "Team name; defaults to the configured default team").option("--agent <agent>", "Install only artifacts for this agent: codex or claude").option("--kind <kind>", "Install only artifacts of this kind: skill or command").option("--name <name>", "Install only this shared artifact name").option("--apply", "Actually write files into local agent skill/command directories").option("--force", "Replace existing installed artifacts with different content").option("--no-sync", "Skip pulling shared team updates before listing/installing artifacts").option("--dry-run", "Preview install actions without writing files").action(async (options) => {
     await runShareInstallArtifacts(getRuntimeConfig(program2), options);
   });