threadroot 0.1.0

package/dist/index.js

@@ -0,0 +1,4341 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { Command } from "commander";
+
+// src/core/compile/write.ts
+import { mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
+import path6 from "path";
+
+// src/core/harness/schema.ts
+import { z as z2 } from "zod";
+
+// src/types.ts
+import { z } from "zod";
+var profileIdSchema = z.enum([
+  "nextjs",
+  "vite-react",
+  "fastapi",
+  "python-cli",
+  "node-cli",
+  "dbt",
+  "empty"
+]);
+
+// src/core/harness/schema.ts
+var objectScopeSchema = z2.enum(["user", "project"]);
+var riskLevelSchema = z2.enum(["low", "medium", "high"]);
+var adapterIdSchema = z2.enum(["agents", "claude", "copilot", "cursor"]);
+var memoryTypeSchema = z2.enum(["project", "repo-map", "current-focus", "handoff", "pitfalls"]);
+var referenceSchema = z2.object({
+  path: z2.string().min(1),
+  description: z2.string().optional(),
+  load: z2.enum(["link", "eager"]).default("link")
+});
+var harnessManifestSchema = z2.object({
+  name: z2.string().min(1),
+  version: z2.literal(1),
+  profile: profileIdSchema,
+  adapters: z2.array(adapterIdSchema).min(1),
+  references: z2.array(referenceSchema).default([]),
+  memory: z2.object({
+    budget: z2.record(memoryTypeSchema, z2.number().int().positive()).default({})
+  }).default({ budget: {} }),
+  tools: z2.object({
+    allow: z2.array(z2.string()).default([])
+  }).default({ allow: [] })
+});
+var skillFrontmatterSchema = z2.object({
+  name: z2.string().min(1),
+  description: z2.string().min(1).optional(),
+  when: z2.string().min(1).optional(),
+  license: z2.string().min(1).optional(),
+  compatibility: z2.string().max(500).optional(),
+  metadata: z2.record(z2.unknown()).optional(),
+  allowedTools: z2.union([z2.string(), z2.array(z2.string())]).optional(),
+  "allowed-tools": z2.union([z2.string(), z2.array(z2.string())]).optional(),
+  scope: objectScopeSchema.default("project"),
+  tags: z2.array(z2.string()).default([])
+}).refine((skill) => Boolean(skill.description ?? skill.when), {
+  message: "A skill must define `description` or legacy `when`.",
+  path: ["description"]
+}).transform((skill) => {
+  const trigger = skill.description ?? skill.when;
+  const allowedTools = skill.allowedTools ?? skill["allowed-tools"];
+  return {
+    ...skill,
+    description: skill.description ?? trigger,
+    when: skill.when ?? trigger,
+    allowedTools,
+    "allowed-tools": void 0
+  };
+});
+var ruleFrontmatterSchema = z2.object({
+  name: z2.string().min(1),
+  applyTo: z2.string().min(1).optional(),
+  scope: objectScopeSchema.default("project")
+});
+var toolInputParamSchema = z2.object({
+  type: z2.enum(["string", "number", "boolean"]).default("string"),
+  description: z2.string().optional(),
+  default: z2.union([z2.string(), z2.number(), z2.boolean()]).optional()
+});
+var healthcheckSchema = z2.object({
+  run: z2.string().min(1),
+  expectExitCode: z2.number().int().default(0)
+});
+var toolManifestSchema = z2.object({
+  name: z2.string().min(1),
+  description: z2.string().min(1),
+  scope: objectScopeSchema.default("project"),
+  risk: riskLevelSchema.default("low"),
+  confirm: z2.boolean().default(false),
+  connection: z2.string().min(1).optional(),
+  healthcheck: healthcheckSchema.optional(),
+  input: z2.record(z2.string(), toolInputParamSchema).default({}),
+  run: z2.string().min(1).optional(),
+  script: z2.string().min(1).optional()
+}).refine((tool) => Boolean(tool.run) !== Boolean(tool.script), {
+  message: "A tool must define exactly one of `run` or `script`.",
+  path: ["run"]
+});
+var connectionManifestSchema = z2.object({
+  name: z2.string().min(1),
+  provider: z2.string().min(1),
+  kind: z2.literal("cli").default("cli"),
+  command: z2.string().min(1),
+  profile: z2.string().min(1).optional(),
+  description: z2.string().min(1),
+  scope: objectScopeSchema.default("project"),
+  risk: riskLevelSchema.default("medium"),
+  confirm: z2.boolean().default(false),
+  healthcheck: healthcheckSchema.optional(),
+  allow: z2.array(z2.string()).default([]),
+  deny: z2.array(z2.string()).default([])
+});
+
+// src/core/harness/paths.ts
+import os from "os";
+import path2 from "path";
+
+// src/core/paths.ts
+import path from "path";
+function toRepoPath(repoRoot, relativePath) {
+  if (path.isAbsolute(relativePath)) {
+    throw new Error(`Refusing to access an absolute repository path: ${relativePath}`);
+  }
+  const root = path.resolve(repoRoot);
+  const resolved = path.resolve(root, relativePath);
+  const relative = path.relative(root, resolved);
+  if (relative === "" || relative.startsWith("..") || path.isAbsolute(relative)) {
+    throw new Error(`Refusing to access a path outside the repository: ${relativePath}`);
+  }
+  return resolved;
+}
+
+// src/core/harness/paths.ts
+var HARNESS_DIR = ".threadroot";
+var HARNESS_MANIFEST = "harness.yaml";
+var LOCK_FILE = "lock.json";
+var HARNESS_SUBDIRS = {
+  skills: "skills",
+  tools: "tools",
+  connections: "connections",
+  rules: "rules",
+  memory: "memory"
+};
+var HARNESS_OBJECT_EXT = {
+  prose: ".md",
+  tool: ".yaml"
+};
+function projectHarnessDir(repoRoot) {
+  return toRepoPath(repoRoot, HARNESS_DIR);
+}
+function projectManifestPath(repoRoot) {
+  return toRepoPath(repoRoot, path2.join(HARNESS_DIR, HARNESS_MANIFEST));
+}
+function projectLockPath(repoRoot) {
+  return toRepoPath(repoRoot, path2.join(HARNESS_DIR, LOCK_FILE));
+}
+function projectObjectDir(repoRoot, dir) {
+  return toRepoPath(repoRoot, path2.join(HARNESS_DIR, HARNESS_SUBDIRS[dir]));
+}
+function userHarnessDir(home = os.homedir()) {
+  return path2.join(home, HARNESS_DIR);
+}
+function userObjectDir(dir, home = os.homedir()) {
+  return path2.join(userHarnessDir(home), HARNESS_SUBDIRS[dir]);
+}
+function userLockPath(home = os.homedir()) {
+  return path2.join(userHarnessDir(home), LOCK_FILE);
+}
+
+// src/core/harness/frontmatter.ts
+import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
+var FRONTMATTER_RE = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/;
+function parseFrontmatter(raw) {
+  const normalized = raw.replace(/^\uFEFF/, "");
+  const match = FRONTMATTER_RE.exec(normalized);
+  if (!match) {
+    return { data: {}, body: normalized.trim() };
+  }
+  const parsed = parseYaml(match[1] ?? "");
+  const data = parsed && typeof parsed === "object" ? parsed : {};
+  return { data, body: (match[2] ?? "").trim() };
+}
+function serializeFrontmatter(data, body) {
+  const front = stringifyYaml(data).trimEnd();
+  return `---
+${front}
+---
+
+${body.trim()}
+`;
+}
+
+// src/core/harness/load.ts
+import { readFile, readdir } from "fs/promises";
+import path3 from "path";
+import { parse as parseYaml2 } from "yaml";
+var HarnessError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "HarnessError";
+  }
+};
+async function readObjectFiles(dir, ext) {
+  let entries;
+  try {
+    entries = await readdir(dir);
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return [];
+    }
+    throw error;
+  }
+  const files = entries.filter((name) => name.endsWith(ext)).sort();
+  return Promise.all(
+    files.map(async (name) => {
+      const full = path3.join(dir, name);
+      return { path: full, content: await readFile(full, "utf8") };
+    })
+  );
+}
+async function readSkillFiles(dir) {
+  let entries;
+  try {
+    entries = await readdir(dir, { withFileTypes: true });
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return [];
+    }
+    throw error;
+  }
+  const files = [];
+  for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+    if (entry.isFile() && entry.name.endsWith(HARNESS_OBJECT_EXT.prose)) {
+      const full = path3.join(dir, entry.name);
+      files.push({ path: full, content: await readFile(full, "utf8") });
+      continue;
+    }
+    if (entry.isDirectory()) {
+      const full = path3.join(dir, entry.name, "SKILL.md");
+      try {
+        files.push({ path: full, content: await readFile(full, "utf8") });
+      } catch (error) {
+        if (error.code !== "ENOENT") {
+          throw error;
+        }
+      }
+    }
+  }
+  return files;
+}
+function objectDirFor(repoRoot, dir, origin, home) {
+  return origin === "project" ? projectObjectDir(repoRoot, dir) : userObjectDir(dir, home);
+}
+function describe(error) {
+  if (error && typeof error === "object" && "issues" in error) {
+    const issues = error.issues;
+    return issues.map((issue) => `${issue.path.join(".") || "<root>"}: ${issue.message}`).join("; ");
+  }
+  return error instanceof Error ? error.message : String(error);
+}
+async function loadSkillsFrom(dir, origin) {
+  const files = await readSkillFiles(dir);
+  return files.map((file) => {
+    const { data, body } = parseFrontmatter(file.content);
+    const result = skillFrontmatterSchema.safeParse(data);
+    if (!result.success) {
+      throw new HarnessError(`Invalid skill ${file.path}: ${describe(result.error)}`);
+    }
+    return { name: result.data.name, origin, sourcePath: file.path, frontmatter: result.data, body };
+  });
+}
+async function loadRulesFrom(dir, origin) {
+  const files = await readObjectFiles(dir, HARNESS_OBJECT_EXT.prose);
+  return files.map((file) => {
+    const { data, body } = parseFrontmatter(file.content);
+    const result = ruleFrontmatterSchema.safeParse(data);
+    if (!result.success) {
+      throw new HarnessError(`Invalid rule ${file.path}: ${describe(result.error)}`);
+    }
+    return { name: result.data.name, origin, sourcePath: file.path, frontmatter: result.data, body };
+  });
+}
+async function loadToolsFrom(dir, origin) {
+  const files = await readObjectFiles(dir, HARNESS_OBJECT_EXT.tool);
+  return files.map((file) => {
+    const parsed = parseYaml2(file.content);
+    const result = toolManifestSchema.safeParse(parsed);
+    if (!result.success) {
+      throw new HarnessError(`Invalid tool ${file.path}: ${describe(result.error)}`);
+    }
+    return { name: result.data.name, origin, sourcePath: file.path, manifest: result.data };
+  });
+}
+async function loadConnectionsFrom(dir, origin) {
+  const files = await readObjectFiles(dir, HARNESS_OBJECT_EXT.tool);
+  return files.map((file) => {
+    const parsed = parseYaml2(file.content);
+    const result = connectionManifestSchema.safeParse(parsed);
+    if (!result.success) {
+      throw new HarnessError(`Invalid connection ${file.path}: ${describe(result.error)}`);
+    }
+    return { name: result.data.name, origin, sourcePath: file.path, manifest: result.data };
+  });
+}
+async function loadMemoryFrom(dir, origin) {
+  const files = await readObjectFiles(dir, HARNESS_OBJECT_EXT.prose);
+  const memory = [];
+  for (const file of files) {
+    const base = path3.basename(file.path, HARNESS_OBJECT_EXT.prose);
+    const type = memoryTypeSchema.safeParse(base);
+    if (!type.success) {
+      continue;
+    }
+    const { body } = parseFrontmatter(file.content);
+    memory.push({ type: type.data, origin, sourcePath: file.path, body });
+  }
+  return memory;
+}
+function mergeByName(user, project) {
+  const merged = /* @__PURE__ */ new Map();
+  for (const item of user) {
+    merged.set(item.name, item);
+  }
+  for (const item of project) {
+    merged.set(item.name, item);
+  }
+  return [...merged.values()].sort((a, b) => a.name.localeCompare(b.name));
+}
+async function loadManifest(repoRoot) {
+  const manifestPath = projectManifestPath(repoRoot);
+  let raw;
+  try {
+    raw = await readFile(manifestPath, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      throw new HarnessError(`No harness found at ${manifestPath}. Run \`tr init\` first.`);
+    }
+    throw error;
+  }
+  const result = harnessManifestSchema.safeParse(parseYaml2(raw));
+  if (!result.success) {
+    throw new HarnessError(`Invalid ${manifestPath}: ${describe(result.error)}`);
+  }
+  return result.data;
+}
+async function resolveHarness(repoRoot, opts = {}) {
+  const { home } = opts;
+  const manifest = await loadManifest(repoRoot);
+  const [
+    userSkills,
+    projectSkills,
+    userRules,
+    projectRules,
+    userTools,
+    projectTools,
+    userConnections,
+    projectConnections,
+    userMemory,
+    projectMemory
+  ] = await Promise.all([
+    loadSkillsFrom(objectDirFor(repoRoot, "skills", "user", home), "user"),
+    loadSkillsFrom(objectDirFor(repoRoot, "skills", "project", home), "project"),
+    loadRulesFrom(objectDirFor(repoRoot, "rules", "user", home), "user"),
+    loadRulesFrom(objectDirFor(repoRoot, "rules", "project", home), "project"),
+    loadToolsFrom(objectDirFor(repoRoot, "tools", "user", home), "user"),
+    loadToolsFrom(objectDirFor(repoRoot, "tools", "project", home), "project"),
+    loadConnectionsFrom(objectDirFor(repoRoot, "connections", "user", home), "user"),
+    loadConnectionsFrom(objectDirFor(repoRoot, "connections", "project", home), "project"),
+    loadMemoryFrom(objectDirFor(repoRoot, "memory", "user", home), "user"),
+    loadMemoryFrom(objectDirFor(repoRoot, "memory", "project", home), "project")
+  ]);
+  return {
+    manifest,
+    skills: mergeByName(userSkills, projectSkills),
+    rules: mergeByName(userRules, projectRules),
+    tools: mergeByName(userTools, projectTools),
+    connections: mergeByName(userConnections, projectConnections),
+    memory: [...userMemory, ...projectMemory]
+  };
+}
+
+// src/core/harness/context.ts
+function taskTerms(task) {
+  return [
+    ...new Set(
+      task.toLowerCase().split(/[^a-z0-9+#.-]+/).filter((term) => term.length > 2)
+    )
+  ];
+}
+function scoreSkill(haystack, terms) {
+  const lower = haystack.toLowerCase();
+  return terms.reduce((score, term) => score + (lower.includes(term) ? 1 : 0), 0);
+}
+async function assembleContext(repoRoot, task, options = {}) {
+  const harness = options.harness ?? await resolveHarness(repoRoot, { home: options.home });
+  const terms = taskTerms(task);
+  const ranked = harness.skills.map((skill) => ({
+    skill,
+    score: scoreSkill(`${skill.name} ${skill.frontmatter.when} ${skill.frontmatter.tags.join(" ")}`, terms)
+  })).filter((entry) => entry.score > 0).sort((a, b) => b.score - a.score || a.skill.name.localeCompare(b.skill.name)).slice(0, options.limit ?? 8).map(({ skill, score }) => ({
+    name: skill.name,
+    when: skill.frontmatter.when,
+    tags: skill.frontmatter.tags,
+    scope: skill.frontmatter.scope,
+    sourcePath: skill.sourcePath,
+    score
+  }));
+  return {
+    task,
+    skills: ranked,
+    rules: harness.rules.map((rule) => ({ name: rule.name, applyTo: rule.frontmatter.applyTo })),
+    tools: harness.tools.map((tool) => ({
+      name: tool.name,
+      description: tool.manifest.description,
+      confirm: tool.manifest.confirm,
+      risk: tool.manifest.risk,
+      connection: tool.manifest.connection,
+      healthcheck: Boolean(tool.manifest.healthcheck),
+      kind: tool.manifest.run ? "shell" : "script"
+    })),
+    memory: harness.memory.map((entry) => ({ type: entry.type, body: entry.body }))
+  };
+}
+
+// src/core/harness/memory.ts
+import { mkdir, readFile as readFile2, writeFile } from "fs/promises";
+import path4 from "path";
+function assertMemoryType(type) {
+  const parsed = memoryTypeSchema.safeParse(type);
+  if (!parsed.success) {
+    throw new HarnessError(
+      `Unknown memory type \`${type}\`. Expected one of: ${memoryTypeSchema.options.join(", ")}.`
+    );
+  }
+  return parsed.data;
+}
+function memoryDir(repoRoot, scope, home) {
+  return scope === "project" ? projectObjectDir(repoRoot, "memory") : userObjectDir("memory", home);
+}
+function memoryFilePath(repoRoot, type, scope = "project", home) {
+  return path4.join(memoryDir(repoRoot, scope, home), `${type}${HARNESS_OBJECT_EXT.prose}`);
+}
+async function readMemory(repoRoot, type, options = {}) {
+  const memoryType = assertMemoryType(type);
+  const file = memoryFilePath(repoRoot, memoryType, options.scope ?? "project", options.home);
+  try {
+    const raw = await readFile2(file, "utf8");
+    return parseFrontmatter(raw).body;
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return null;
+    }
+    throw error;
+  }
+}
+function headingFor(type) {
+  const title = type.replace(/-/g, " ").replace(/\b\w/g, (c) => c.toUpperCase());
+  return `# ${title}`;
+}
+async function appendMemory(repoRoot, type, note, options = {}) {
+  const memoryType = assertMemoryType(type);
+  const trimmed = note.trim();
+  if (!trimmed) {
+    throw new HarnessError("Cannot append an empty memory note.");
+  }
+  const scope = options.scope ?? "project";
+  const dir = memoryDir(repoRoot, scope, options.home);
+  const file = memoryFilePath(repoRoot, memoryType, scope, options.home);
+  let existing = "";
+  try {
+    existing = await readFile2(file, "utf8");
+  } catch (error) {
+    if (error.code !== "ENOENT") {
+      throw error;
+    }
+  }
+  await mkdir(dir, { recursive: true });
+  const base = existing.trim() ? existing.replace(/\s*$/, "") : headingFor(memoryType);
+  await writeFile(file, `${base}
+- ${trimmed}
+`, "utf8");
+  return { type: memoryType, scope, path: file };
+}
+
+// src/core/compile/index.ts
+import { readFile as readFile3, stat } from "fs/promises";
+import path5 from "path";
+
+// src/core/hash.ts
+import { createHash } from "crypto";
+function hashContent(content) {
+  return createHash("sha256").update(content).digest("hex");
+}
+
+// src/core/compile/adapters/agents.ts
+var agentsAdapter = {
+  id: "agents",
+  compile(ctx) {
+    return [{ path: "AGENTS.md", content: ctx.canonicalAgents }];
+  }
+};
+
+// src/core/compile/adapters/shared.ts
+function slug(name) {
+  return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "rule";
+}
+function ruleBody(rule) {
+  const body = rule.body.trim();
+  if (body.startsWith("#")) {
+    return body;
+  }
+  return `# ${rule.name}
+
+${body}`;
+}
+
+// src/core/compile/adapters/claude.ts
+function claudeRoot() {
+  const lines = [
+    "# CLAUDE.md",
+    "",
+    "@AGENTS.md",
+    "",
+    "<!-- The shared harness lives in AGENTS.md (imported above). Claude-specific",
+    "     guidance can be added below this comment; it is preserved across compiles. -->"
+  ];
+  return `${lines.join("\n")}
+`;
+}
+function ruleFile(name, applyTo, body) {
+  const frontmatter = ["---", `name: ${name}`, "paths:", `  - "${applyTo}"`, "---", ""].join("\n");
+  return { path: `.claude/rules/${slug(name)}.md`, content: `${frontmatter}
+${body}
+` };
+}
+function commandFile(name, description, run2, script) {
+  const frontmatter = ["---", `description: ${description}`, "---", ""].join("\n");
+  const invocation = run2 ? `Run this shell command and report the result:
+
+\`\`\`sh
+${run2}
+\`\`\`` : `Run the script at \`.threadroot/tools/${script}\` and report the result.`;
+  const body = [`# /${slug(name)}`, "", description, "", invocation].join("\n");
+  return { path: `.claude/commands/${slug(name)}.md`, content: `${frontmatter}
+${body}
+` };
+}
+var claudeAdapter = {
+  id: "claude",
+  compile(ctx) {
+    const files = [{ path: "CLAUDE.md", content: claudeRoot() }];
+    for (const rule of ctx.scopedRules) {
+      const applyTo = rule.frontmatter.applyTo;
+      if (applyTo) {
+        files.push(ruleFile(rule.name, applyTo, ruleBody(rule)));
+      }
+    }
+    for (const tool of ctx.tools) {
+      files.push(
+        commandFile(tool.name, tool.manifest.description, tool.manifest.run, tool.manifest.script)
+      );
+    }
+    return files;
+  }
+};
+
+// src/core/compile/adapters/copilot.ts
+function instructionsFile(name, applyTo, body) {
+  const frontmatter = ["---", `name: ${name}`, `applyTo: "${applyTo}"`, "---", ""].join("\n");
+  return {
+    path: `.github/instructions/${slug(name)}.instructions.md`,
+    content: `${frontmatter}
+${body}
+`
+  };
+}
+var copilotAdapter = {
+  id: "copilot",
+  compile(ctx) {
+    const files = [
+      { path: ".github/copilot-instructions.md", content: ctx.canonicalAgents }
+    ];
+    for (const rule of ctx.scopedRules) {
+      const applyTo = rule.frontmatter.applyTo;
+      if (applyTo) {
+        files.push(instructionsFile(rule.name, applyTo, ruleBody(rule)));
+      }
+    }
+    return files;
+  }
+};
+
+// src/core/compile/adapters/cursor.ts
+function mdcFile(name, applyTo, body) {
+  const frontmatter = [
+    "---",
+    `description: ${name}`,
+    `globs: ${applyTo}`,
+    "alwaysApply: false",
+    "---",
+    ""
+  ].join("\n");
+  return { path: `.cursor/rules/${slug(name)}.mdc`, content: `${frontmatter}
+${body}
+` };
+}
+var cursorAdapter = {
+  id: "cursor",
+  compile(ctx) {
+    const files = [];
+    for (const rule of ctx.scopedRules) {
+      const applyTo = rule.frontmatter.applyTo;
+      if (applyTo) {
+        files.push(mdcFile(rule.name, applyTo, ruleBody(rule)));
+      }
+    }
+    return files;
+  }
+};
+
+// src/core/compile/managed.ts
+var MANAGED_BEGIN = "<!-- threadroot:begin (generated \u2014 edit sources in .threadroot/) -->";
+var MANAGED_END = "<!-- threadroot:end -->";
+var BLOCK_RE = new RegExp(
+  `\\n*${escapeRegExp(MANAGED_BEGIN)}[\\s\\S]*?${escapeRegExp(MANAGED_END)}\\n*`,
+  "g"
+);
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function extractHandAuthored(content) {
+  return content.replace(BLOCK_RE, "\n").trim();
+}
+function composeWithManaged(handAuthored, managed) {
+  const head = handAuthored.trim();
+  const block = `${MANAGED_BEGIN}
+${managed.trim()}
+${MANAGED_END}`;
+  return head ? `${head}
+
+${block}
+` : `${block}
+`;
+}
+
+// src/core/compile/sections.ts
+var DEFAULT_PROJECT_BUDGET = 4e3;
+function truncate(text, max) {
+  if (text.length <= max) {
+    return text;
+  }
+  return `${text.slice(0, max).trimEnd()}
+
+_(truncated to fit the memory budget)_`;
+}
+function skillsSection(ctx) {
+  if (ctx.skills.length === 0) {
+    return void 0;
+  }
+  const lines = ctx.skills.map((skill) => `- **${skill.name}** \u2014 ${skill.frontmatter.when}`);
+  return ["## Skills", "Available procedures (load the matching one when its trigger applies):", "", ...lines].join(
+    "\n"
+  );
+}
+function toolsSection(ctx) {
+  if (ctx.tools.length === 0) {
+    return void 0;
+  }
+  const lines = ctx.tools.map((tool) => {
+    const flags = [
+      tool.manifest.risk !== "low" ? tool.manifest.risk : null,
+      tool.manifest.confirm ? "asks before running" : null,
+      tool.manifest.connection ? `connection: ${tool.manifest.connection}` : null
+    ].filter(Boolean).join(", ");
+    const suffix = flags ? ` _(${flags})_` : "";
+    return `- \`${tool.name}\` \u2014 ${tool.manifest.description}${suffix}`;
+  });
+  return [
+    "## Tools",
+    "Callable via the threadroot MCP server or `tr run <tool>`:",
+    "",
+    ...lines
+  ].join("\n");
+}
+function connectionsSection(ctx) {
+  if (ctx.connections.length === 0) {
+    return void 0;
+  }
+  const lines = ctx.connections.map((connection) => {
+    const flags = [
+      connection.manifest.provider,
+      connection.manifest.risk,
+      connection.manifest.confirm ? "asks before running" : null
+    ].filter(Boolean).join(", ");
+    return `- \`${connection.name}\` \u2014 ${connection.manifest.description} _(${flags})_`;
+  });
+  return [
+    "## Connections",
+    "Local CLI bridges available to connection-aware tools. Credentials stay in the user's local CLI configuration.",
+    "",
+    ...lines
+  ].join("\n");
+}
+function conventionsSection(ctx) {
+  if (ctx.globalRules.length === 0) {
+    return void 0;
+  }
+  const blocks = ctx.globalRules.map((rule) => `### ${rule.name}
+
+${rule.body.trim()}`);
+  return ["## Conventions", "", ...blocks].join("\n");
+}
+function referencesSection(ctx) {
+  if (ctx.references.length === 0) {
+    return void 0;
+  }
+  const linked = ctx.references.filter((resolved) => !resolved.inlined);
+  const inlined = ctx.references.filter((resolved) => resolved.inlined);
+  const parts = ["## Additional context", "Existing project docs worth reading when relevant:"];
+  if (linked.length > 0) {
+    const lines = linked.map((resolved) => {
+      const { reference } = resolved;
+      const note = reference.description ? ` \u2014 ${reference.description}` : "";
+      const missing = resolved.exists ? "" : " _(missing)_";
+      return `- [${reference.path}](${reference.path})${note}${missing}`;
+    });
+    parts.push("", ...lines);
+  }
+  for (const resolved of inlined) {
+    const note = resolved.reference.description ? `
+
+${resolved.reference.description}` : "";
+    parts.push("", `### ${resolved.reference.path}${note}`, "", resolved.inlined.trim());
+  }
+  return parts.join("\n");
+}
+function memorySection(ctx) {
+  const project = ctx.memory.find((entry) => entry.type === "project");
+  const others = ctx.memory.filter((entry) => entry.type !== "project");
+  if (!project && others.length === 0) {
+    return void 0;
+  }
+  const parts = ["## Memory"];
+  if (project) {
+    const budget = ctx.manifest.memory.budget.project ?? DEFAULT_PROJECT_BUDGET;
+    parts.push("", truncate(project.body.trim(), budget));
+  }
+  if (others.length > 0) {
+    const links = [...new Set(others.map((entry) => entry.type))].map((type) => `\`.threadroot/memory/${type}.md\``).join(", ");
+    parts.push("", `Task-scoped memory (loaded on demand): ${links}.`);
+  }
+  return parts.join("\n");
+}
+function buildManagedBlock(ctx) {
+  const sections = [
+    skillsSection(ctx),
+    toolsSection(ctx),
+    connectionsSection(ctx),
+    conventionsSection(ctx),
+    referencesSection(ctx),
+    memorySection(ctx)
+  ].filter((section) => Boolean(section));
+  if (sections.length === 0) {
+    return "_No threadroot-managed context yet. Add skills, tools, rules, or references._";
+  }
+  return sections.join("\n\n");
+}
+
+// src/core/compile/index.ts
+var ADAPTERS = {
+  agents: agentsAdapter,
+  claude: claudeAdapter,
+  copilot: copilotAdapter,
+  cursor: cursorAdapter
+};
+var EAGER_INLINE_LIMIT = 8e3;
+var AGENTS_FILE = "AGENTS.md";
+function splitRules(rules) {
+  const global = [];
+  const scoped = [];
+  for (const rule of rules) {
+    if (rule.frontmatter.applyTo) {
+      scoped.push(rule);
+    } else {
+      global.push(rule);
+    }
+  }
+  return { global, scoped };
+}
+function isGlob(value) {
+  return /[*?[\]{}]/.test(value);
+}
+async function readIfExists(filePath) {
+  try {
+    return await readFile3(filePath, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return void 0;
+    }
+    throw error;
+  }
+}
+async function resolveReference(repoRoot, reference) {
+  if (isGlob(reference.path)) {
+    return { reference, exists: true };
+  }
+  const absolute = toRepoPath(repoRoot, reference.path);
+  try {
+    const info = await stat(absolute);
+    if (!info.isFile()) {
+      return { reference, exists: true };
+    }
+    if (reference.load === "eager" && info.size <= EAGER_INLINE_LIMIT) {
+      const inlined = await readFile3(absolute, "utf8");
+      return { reference, exists: true, inlined };
+    }
+    return { reference, exists: true };
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return { reference, exists: false };
+    }
+    throw error;
+  }
+}
+async function buildContext(repoRoot, harness) {
+  const existingAgents = await readIfExists(path5.join(repoRoot, AGENTS_FILE)) ?? "";
+  const handAuthored = extractHandAuthored(existingAgents);
+  const { global, scoped } = splitRules(harness.rules);
+  const references = await Promise.all(
+    harness.manifest.references.map((reference) => resolveReference(repoRoot, reference))
+  );
+  const partial = {
+    repoRoot,
+    manifest: harness.manifest,
+    handAuthored,
+    canonicalAgents: "",
+    skills: harness.skills,
+    globalRules: global,
+    scopedRules: scoped,
+    tools: harness.tools,
+    connections: harness.connections,
+    memory: harness.memory,
+    references
+  };
+  const managed = buildManagedBlock(partial);
+  partial.canonicalAgents = composeWithManaged(handAuthored, managed);
+  return partial;
+}
+async function compile(repoRoot, harness) {
+  const ctx = await buildContext(repoRoot, harness);
+  const files = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const adapterId of harness.manifest.adapters) {
+    const adapter = ADAPTERS[adapterId];
+    if (!adapter) {
+      continue;
+    }
+    for (const file of adapter.compile(ctx)) {
+      if (seen.has(file.path)) {
+        continue;
+      }
+      seen.add(file.path);
+      files.push(file);
+    }
+  }
+  files.sort((a, b) => a.path.localeCompare(b.path));
+  return files;
+}
+async function detectDrift(repoRoot, files) {
+  const entries = await Promise.all(
+    files.map(async (file) => {
+      const existing = await readIfExists(path5.join(repoRoot, file.path));
+      if (existing === void 0) {
+        return { path: file.path, status: "create" };
+      }
+      const status = hashContent(existing) === hashContent(file.content) ? "unchanged" : "drift";
+      return { path: file.path, status };
+    })
+  );
+  return entries;
+}
+
+// src/core/compile/write.ts
+async function writeCompiled(repoRoot, files) {
+  await Promise.all(
+    files.map(async (file) => {
+      const absolute = path6.join(repoRoot, file.path);
+      await mkdir2(path6.dirname(absolute), { recursive: true });
+      await writeFile2(absolute, file.content, "utf8");
+    })
+  );
+  return files.map((file) => file.path);
+}
+async function runCompile(repoRoot, options = {}) {
+  const resolved = options.harness ?? await resolveHarness(repoRoot, { home: options.home });
+  const harness = options.adapter ? { ...resolved, manifest: { ...resolved.manifest, adapters: [options.adapter] } } : resolved;
+  const files = await compile(repoRoot, harness);
+  const drift = await detectDrift(repoRoot, files);
+  const written = await writeCompiled(repoRoot, files);
+  return { written, drift };
+}
+
+// src/commands/compile.ts
+async function runCompileCommand(repoRoot, options) {
+  const adapter = options.adapter ? adapterIdSchema.parse(options.adapter) : void 0;
+  try {
+    const { written, drift } = await runCompile(repoRoot, { adapter });
+    const changed = drift.filter((entry) => entry.status !== "unchanged").length;
+    console.log(`Compiled ${written.length} vendor file(s)${changed > 0 ? ` (${changed} changed)` : ""}.`);
+    for (const file of written) {
+      console.log(`  ${file}`);
+    }
+  } catch (error) {
+    if (error instanceof HarnessError) {
+      console.error(error.message);
+      process.exitCode = 1;
+      return;
+    }
+    throw error;
+  }
+}
+
+// src/commands/context.ts
+async function runContext(repoRoot, task) {
+  let context;
+  try {
+    context = await assembleContext(repoRoot, task);
+  } catch (error) {
+    if (error instanceof HarnessError) {
+      console.log("No harness found. Run `tr init` first.");
+      return;
+    }
+    throw error;
+  }
+  console.log(`task: ${context.task}`);
+  if (context.skills.length > 0) {
+    console.log("\nskills:");
+    for (const skill of context.skills) {
+      console.log(`- ${skill.name} - ${skill.when}`);
+    }
+  }
+  if (context.rules.length > 0) {
+    console.log("\nrules:");
+    for (const rule of context.rules) {
+      console.log(`- ${rule.name}${rule.applyTo ? ` (${rule.applyTo})` : ""}`);
+    }
+  }
+  if (context.tools.length > 0) {
+    console.log("\ntools:");
+    for (const tool of context.tools) {
+      console.log(`- ${tool.name} - ${tool.description}`);
+    }
+  }
+  if (context.memory.length > 0) {
+    console.log("\nmemory:");
+    for (const entry of context.memory) {
+      console.log(`- ${entry.type}`);
+    }
+  }
+  if (context.skills.length === 0 && context.rules.length === 0 && context.tools.length === 0 && context.memory.length === 0) {
+    console.log("\nNo matching harness context for this task yet.");
+  }
+}
+
+// src/commands/diff.ts
+import fs from "fs/promises";
+import path7 from "path";
+async function readIfExists2(filePath) {
+  try {
+    return await fs.readFile(filePath, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return void 0;
+    }
+    throw error;
+  }
+}
+function lineDiff(before, after) {
+  const a = before.length === 0 ? [] : before.split("\n");
+  const b = after.length === 0 ? [] : after.split("\n");
+  const lcs = Array.from({ length: a.length + 1 }, () => new Array(b.length + 1).fill(0));
+  for (let i2 = a.length - 1; i2 >= 0; i2 -= 1) {
+    for (let j2 = b.length - 1; j2 >= 0; j2 -= 1) {
+      lcs[i2][j2] = a[i2] === b[j2] ? lcs[i2 + 1][j2 + 1] + 1 : Math.max(lcs[i2 + 1][j2], lcs[i2][j2 + 1]);
+    }
+  }
+  const lines = [];
+  let i = 0;
+  let j = 0;
+  while (i < a.length && j < b.length) {
+    if (a[i] === b[j]) {
+      i += 1;
+      j += 1;
+    } else if (lcs[i + 1][j] >= lcs[i][j + 1]) {
+      lines.push(`- ${a[i]}`);
+      i += 1;
+    } else {
+      lines.push(`+ ${b[j]}`);
+      j += 1;
+    }
+  }
+  while (i < a.length) {
+    lines.push(`- ${a[i]}`);
+    i += 1;
+  }
+  while (j < b.length) {
+    lines.push(`+ ${b[j]}`);
+    j += 1;
+  }
+  return lines;
+}
+async function runDiff(repoRoot) {
+  let harness;
+  try {
+    harness = await resolveHarness(repoRoot);
+  } catch (error) {
+    if (error instanceof HarnessError) {
+      console.log("No harness found. Run `tr init` first.");
+      return;
+    }
+    throw error;
+  }
+  const files = await compile(repoRoot, harness);
+  let changed = 0;
+  for (const file of files) {
+    const existing = await readIfExists2(path7.join(repoRoot, file.path));
+    if (existing === void 0) {
+      changed += 1;
+      console.log(`+ ${file.path} (new)`);
+      continue;
+    }
+    if (existing === file.content) {
+      continue;
+    }
+    changed += 1;
+    console.log(`~ ${file.path}`);
+    for (const line of lineDiff(existing, file.content)) {
+      console.log(`    ${line}`);
+    }
+  }
+  if (changed === 0) {
+    console.log("No drift: every vendor file matches the canonical harness.");
+  }
+}
+
+// src/core/doctor.ts
+import { stat as stat4 } from "fs/promises";
+import path14 from "path";
+
+// src/core/install/lock.ts
+import { mkdir as mkdir3, readFile as readFile4, writeFile as writeFile3 } from "fs/promises";
+import path8 from "path";
+
+// src/core/install/source.ts
+import { z as z3 } from "zod";
+var objectKindSchema = z3.enum(["skill", "tool", "rule", "connection"]);
+var objectSourceKindSchema = z3.enum(["local", "git", "registry"]);
+function splitRef(body) {
+  const at = body.lastIndexOf("@");
+  if (at > 0) {
+    return { body: body.slice(0, at), ref: body.slice(at + 1) || void 0 };
+  }
+  return { body };
+}
+function parseGithub(raw) {
+  const { body, ref } = splitRef(raw.slice("github:".length));
+  const parts = body.split("/").filter(Boolean);
+  const [owner, repo, ...rest] = parts;
+  if (!owner || !repo) {
+    throw new Error(`Invalid github source: ${raw} (expected github:owner/repo[/path][@ref]).`);
+  }
+  return {
+    kind: "git",
+    raw,
+    provider: "github",
+    owner,
+    repo,
+    objectPath: rest.length > 0 ? rest.join("/") : void 0,
+    ref
+  };
+}
+function isLocalPath(raw) {
+  return raw.startsWith("./") || raw.startsWith("../") || raw.startsWith("/") || raw === "." || raw === "..";
+}
+function parseSourceRef(raw) {
+  const value = raw.trim();
+  if (!value) {
+    throw new Error("Empty source reference.");
+  }
+  if (value.startsWith("github:")) {
+    return parseGithub(value);
+  }
+  if (value.startsWith("registry:")) {
+    const { body: body2, ref: ref2 } = splitRef(value.slice("registry:".length));
+    if (!body2) {
+      throw new Error(`Invalid registry source: ${raw} (expected registry:name[@version]).`);
+    }
+    return { kind: "registry", raw: value, name: body2, version: ref2 };
+  }
+  if (value.startsWith("git+") || /^https?:\/\/.+\.git(@.+)?$/.test(value) || value.startsWith("git@")) {
+    const stripped = value.startsWith("git+") ? value.slice("git+".length) : value;
+    const { body: body2, ref: ref2 } = splitRef(stripped);
+    return { kind: "git", raw: value, provider: "url", url: body2, ref: ref2 };
+  }
+  if (isLocalPath(value)) {
+    return { kind: "local", raw: value, path: value };
+  }
+  const { body, ref } = splitRef(value);
+  return { kind: "registry", raw: value, name: body, version: ref };
+}
+var lockEntrySchema = z3.object({
+  name: z3.string().min(1),
+  kind: objectKindSchema,
+  sourceKind: objectSourceKindSchema,
+  source: z3.string().min(1),
+  /** Path of the object within the source repository, when applicable. */
+  objectPath: z3.string().optional(),
+  /** Human-supplied ref (tag/branch/commit) before resolution. */
+  ref: z3.string().optional(),
+  /** Immutable resolved identifier — the commit SHA for git sources. */
+  resolved: z3.string().optional(),
+  /** `sha256:<hex>` content digest for tamper detection + reproducibility. */
+  integrity: z3.string().optional(),
+  installedAt: z3.string()
+});
+var lockFileSchema = z3.object({
+  version: z3.literal(1),
+  objects: z3.array(lockEntrySchema).default([])
+});
+function emptyLockFile() {
+  return { version: 1, objects: [] };
+}
+
+// src/core/install/lock.ts
+async function readLockFile(lockPath) {
+  let raw;
+  try {
+    raw = await readFile4(lockPath, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return emptyLockFile();
+    }
+    throw error;
+  }
+  return lockFileSchema.parse(JSON.parse(raw));
+}
+async function writeLockFile(lockPath, lock) {
+  const sorted = {
+    version: lock.version,
+    objects: [...lock.objects].sort((a, b) => a.name.localeCompare(b.name))
+  };
+  await mkdir3(path8.dirname(lockPath), { recursive: true });
+  await writeFile3(lockPath, `${JSON.stringify(sorted, null, 2)}
+`, "utf8");
+}
+function upsertLockEntry(lock, entry) {
+  const objects = lock.objects.filter((existing) => !(existing.name === entry.name && existing.kind === entry.kind));
+  objects.push(entry);
+  return { version: lock.version, objects };
+}
+function externalToolNames(lock) {
+  const names = /* @__PURE__ */ new Set();
+  for (const entry of lock.objects) {
+    if (entry.kind === "tool" && entry.sourceKind !== "local") {
+      names.add(entry.name);
+    }
+  }
+  return names;
+}
+function externalSkillNames(lock) {
+  const names = /* @__PURE__ */ new Set();
+  for (const entry of lock.objects) {
+    if (entry.kind === "skill" && entry.sourceKind !== "local") {
+      names.add(entry.name);
+    }
+  }
+  return names;
+}
+
+// src/core/skills.ts
+import { readFile as readFile5, readdir as readdir2, stat as stat2 } from "fs/promises";
+import path9 from "path";
+var SKILL_NAME_RE = /^[a-z0-9][a-z0-9-]{0,62}[a-z0-9]$/;
+var MIN_DESCRIPTION_LENGTH = 40;
+var MAX_DESCRIPTION_LENGTH = 1024;
+var MAX_BODY_LINES = 500;
+var LINK_RE = /\]\(([^)]+)\)/g;
+function finding(severity, skill, message) {
+  return { severity, skill: skill.name, message, path: skill.sourcePath };
+}
+function validateResolvedSkills(harness) {
+  const findings = [];
+  for (const skill of harness.skills) {
+    if (!SKILL_NAME_RE.test(skill.name)) {
+      findings.push(finding("error", skill, "Skill names must use lowercase letters, digits, and hyphens."));
+    }
+    if (path9.basename(skill.sourcePath) === "SKILL.md") {
+      const folderName = path9.basename(path9.dirname(skill.sourcePath));
+      if (folderName !== skill.name) {
+        findings.push(finding("error", skill, "Folder-based skill directory must match frontmatter `name`."));
+      }
+    }
+    if (skill.frontmatter.description.length < MIN_DESCRIPTION_LENGTH) {
+      findings.push(
+        finding(
+          "warning",
+          skill,
+          "Skill description is short; include what the skill does and concrete trigger contexts."
+        )
+      );
+    }
+    if (skill.frontmatter.description.length > MAX_DESCRIPTION_LENGTH) {
+      findings.push(finding("error", skill, "Skill description must be 1024 characters or less."));
+    }
+    if (!/\b(use when|when|reviewing|writing|designing|debugging|creating)\b/i.test(skill.frontmatter.description)) {
+      findings.push(
+        finding(
+          "warning",
+          skill,
+          "Skill description should include trigger language so agents know when to load it."
+        )
+      );
+    }
+    if (skill.body.trim().length === 0) {
+      findings.push(finding("error", skill, "Skill body must not be empty."));
+    }
+    if (skill.body.split(/\r?\n/).length > MAX_BODY_LINES) {
+      findings.push(
+        finding(
+          "warning",
+          skill,
+          "Skill body is long; move variant details into references for progressive disclosure."
+        )
+      );
+    }
+    if (skill.frontmatter.allowedTools) {
+      findings.push(
+        finding(
+          "warning",
+          skill,
+          "Skill declares allowed tools; inspect tool permissions before trusting external installs."
+        )
+      );
+    }
+  }
+  return { ok: findings.every((entry) => entry.severity !== "error"), findings };
+}
+function pushPathFinding(findings, severity, skill, message, pathValue = skill.sourcePath) {
+  findings.push({ severity, skill: skill.name, message, path: pathValue });
+}
+async function exists(filePath) {
+  try {
+    await stat2(filePath);
+    return true;
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return false;
+    }
+    throw error;
+  }
+}
+async function validateSkillDirectory(skill) {
+  if (path9.basename(skill.sourcePath) !== "SKILL.md") {
+    return [];
+  }
+  const findings = [];
+  const skillDir = path9.dirname(skill.sourcePath);
+  const referencesDir = path9.join(skillDir, "references");
+  const scriptsDir = path9.join(skillDir, "scripts");
+  const evalsDir = path9.join(skillDir, "evals");
+  if (await exists(scriptsDir)) {
+    pushPathFinding(
+      findings,
+      "warning",
+      skill,
+      "Skill includes scripts; inspect scripts before trusting external installs.",
+      scriptsDir
+    );
+  }
+  for (const match of skill.body.matchAll(LINK_RE)) {
+    const target = match[1] ?? "";
+    if (/^[a-z]+:\/\//i.test(target) || target.startsWith("#")) {
+      continue;
+    }
+    if (path9.isAbsolute(target) || target.split(/[\\/]/).includes("..")) {
+      pushPathFinding(findings, "error", skill, `Skill link must stay inside the skill directory: ${target}`);
+      continue;
+    }
+    const resolved = path9.join(skillDir, target);
+    if (!await exists(resolved)) {
+      pushPathFinding(findings, "error", skill, `Skill links to missing file: ${target}`);
+    }
+    const segments = target.split(/[\\/]/).filter(Boolean);
+    if (segments[0] === "references" && segments.length > 2) {
+      pushPathFinding(findings, "warning", skill, `Reference links should stay one level deep: ${target}`);
+    }
+  }
+  if (await exists(referencesDir)) {
+    const references = await readdir2(referencesDir, { withFileTypes: true });
+    for (const entry of references) {
+      if (!entry.isFile()) {
+        continue;
+      }
+      const filePath = path9.join(referencesDir, entry.name);
+      const body = await readFile5(filePath, "utf8");
+      if (!body.trim()) {
+        pushPathFinding(findings, "error", skill, "Reference file must not be empty.", filePath);
+      }
+    }
+  }
+  if (await exists(evalsDir)) {
+    const triggersPath = path9.join(evalsDir, "triggers.json");
+    if (!await exists(triggersPath)) {
+      pushPathFinding(findings, "warning", skill, "Skill evals directory should include triggers.json.", evalsDir);
+    } else {
+      const parsed = JSON.parse(await readFile5(triggersPath, "utf8"));
+      const value = parsed;
+      if (!Array.isArray(value.shouldTrigger) || value.shouldTrigger.length === 0) {
+        pushPathFinding(findings, "error", skill, "evals/triggers.json must include non-empty shouldTrigger.");
+      }
+      if (!Array.isArray(value.shouldNotTrigger) || value.shouldNotTrigger.length === 0) {
+        pushPathFinding(findings, "error", skill, "evals/triggers.json must include non-empty shouldNotTrigger.");
+      }
+    }
+  }
+  return findings;
+}
+async function validateResolvedSkillsDeep(harness) {
+  const shallow = validateResolvedSkills(harness);
+  const findings = [...shallow.findings];
+  for (const skill of harness.skills) {
+    findings.push(...await validateSkillDirectory(skill));
+  }
+  return { ok: findings.every((entry) => entry.severity !== "error"), findings };
+}
+async function loadSkillFile(filePath, origin = "project") {
+  const raw = await readFile5(filePath, "utf8");
+  const { data, body } = parseFrontmatter(raw);
+  const result = skillFrontmatterSchema.safeParse(data);
+  if (!result.success) {
+    const detail = result.error.issues.map((issue) => `${issue.path.join(".") || "<root>"}: ${issue.message}`).join("; ");
+    throw new HarnessError(`Invalid skill ${filePath}: ${detail}`);
+  }
+  return {
+    name: result.data.name,
+    origin,
+    sourcePath: filePath,
+    frontmatter: result.data,
+    body
+  };
+}
+async function loadSkillsAtPath(targetPath) {
+  const info = await stat2(targetPath);
+  if (info.isFile()) {
+    return [await loadSkillFile(targetPath)];
+  }
+  const directSkill = path9.join(targetPath, "SKILL.md");
+  try {
+    return [await loadSkillFile(directSkill)];
+  } catch (error) {
+    if (!(error instanceof HarnessError) && error.code !== "ENOENT") {
+      throw error;
+    }
+    if (error instanceof HarnessError) {
+      throw error;
+    }
+  }
+  const entries = await readdir2(targetPath, { withFileTypes: true });
+  const skills = [];
+  for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+    const full = path9.join(targetPath, entry.name);
+    if (entry.isFile() && entry.name.endsWith(".md") && entry.name !== "README.md") {
+      skills.push(await loadSkillFile(full));
+    }
+    if (entry.isDirectory()) {
+      const skillPath = path9.join(full, "SKILL.md");
+      try {
+        skills.push(await loadSkillFile(skillPath));
+      } catch (error) {
+        if (error.code !== "ENOENT") {
+          throw error;
+        }
+      }
+    }
+  }
+  return skills;
+}
+async function listFilesIfDir(dir) {
+  if (!await exists(dir)) {
+    return [];
+  }
+  const entries = await readdir2(dir, { withFileTypes: true });
+  return entries.filter((entry) => entry.isFile()).map((entry) => entry.name).sort();
+}
+async function inspectSkillPath(targetPath) {
+  const skills = await loadSkillsAtPath(targetPath);
+  if (skills.length !== 1) {
+    throw new HarnessError(`Expected exactly one skill at ${targetPath}; found ${skills.length}.`);
+  }
+  const skill = skills[0];
+  const skillDir = path9.dirname(skill.sourcePath);
+  return {
+    name: skill.name,
+    description: skill.frontmatter.description,
+    path: skill.sourcePath,
+    references: await listFilesIfDir(path9.join(skillDir, "references")),
+    scripts: await listFilesIfDir(path9.join(skillDir, "scripts")),
+    assets: await listFilesIfDir(path9.join(skillDir, "assets")),
+    evals: await listFilesIfDir(path9.join(skillDir, "evals")),
+    allowedTools: skill.frontmatter.allowedTools
+  };
+}
+async function validateSkillPath(targetPath) {
+  try {
+    const harness = {
+      manifest: {
+        name: "skill-path",
+        version: 1,
+        profile: "empty",
+        adapters: ["agents"],
+        references: [],
+        memory: { budget: {} },
+        tools: { allow: [] }
+      },
+      skills: await loadSkillsAtPath(targetPath),
+      rules: [],
+      tools: [],
+      connections: [],
+      memory: []
+    };
+    return await validateResolvedSkillsDeep(harness);
+  } catch (error) {
+    if (error instanceof HarnessError || error instanceof Error) {
+      return {
+        ok: false,
+        findings: [
+          {
+            severity: "error",
+            skill: "<path>",
+            path: targetPath,
+            message: error.message
+          }
+        ]
+      };
+    }
+    throw error;
+  }
+}
+async function validateSkills(repoRoot, options = {}) {
+  try {
+    return await validateResolvedSkillsDeep(await resolveHarness(repoRoot, { home: options.home }));
+  } catch (error) {
+    if (error instanceof HarnessError) {
+      return {
+        ok: false,
+        findings: [
+          {
+            severity: "error",
+            skill: "<harness>",
+            path: repoRoot,
+            message: error.message
+          }
+        ]
+      };
+    }
+    throw error;
+  }
+}
+
+// src/core/connections/index.ts
+import { mkdir as mkdir4, writeFile as writeFile4 } from "fs/promises";
+import path11 from "path";
+import { stringify as stringifyYaml2 } from "yaml";
+
+// src/core/tools/execute.ts
+import { spawn } from "child_process";
+import path10 from "path";
+var ToolExecutionError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ToolExecutionError";
+  }
+};
+var DEFAULT_TIMEOUT_MS = 12e4;
+var MAX_OUTPUT_CHARS = 1e6;
+var KILL_GRACE_MS = 2e3;
+var INTERPRETERS = {
+  ".sh": "bash",
+  ".bash": "bash",
+  ".js": "node",
+  ".cjs": "node",
+  ".mjs": "node",
+  ".py": "python3",
+  ".rb": "ruby"
+};
+function cap(text) {
+  if (text.length <= MAX_OUTPUT_CHARS) {
+    return text;
+  }
+  return `${text.slice(0, MAX_OUTPUT_CHARS)}
+\u2026[output truncated]`;
+}
+function runProcess(plan, opts) {
+  return new Promise((resolve, reject) => {
+    const started = Date.now();
+    const child = spawn(plan.file, plan.args, {
+      cwd: opts.cwd,
+      env: opts.env,
+      shell: plan.shell,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    let timedOut = false;
+    let settled = false;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      child.kill("SIGTERM");
+      setTimeout(() => child.kill("SIGKILL"), KILL_GRACE_MS).unref();
+    }, opts.timeoutMs);
+    const onAbort = () => {
+      child.kill("SIGTERM");
+    };
+    opts.signal?.addEventListener("abort", onAbort, { once: true });
+    child.stdout?.on("data", (chunk) => {
+      if (stdout.length < MAX_OUTPUT_CHARS) {
+        stdout += chunk.toString("utf8");
+      }
+    });
+    child.stderr?.on("data", (chunk) => {
+      if (stderr.length < MAX_OUTPUT_CHARS) {
+        stderr += chunk.toString("utf8");
+      }
+    });
+    child.on("error", (error) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      clearTimeout(timer);
+      opts.signal?.removeEventListener("abort", onAbort);
+      reject(new ToolExecutionError(`Failed to start \`${plan.label}\`: ${error.message}`));
+    });
+    child.on("close", (code, signal) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      clearTimeout(timer);
+      opts.signal?.removeEventListener("abort", onAbort);
+      resolve({
+        ok: !timedOut && code === 0,
+        exitCode: code,
+        signal,
+        stdout: cap(stdout),
+        stderr: cap(stderr),
+        durationMs: Date.now() - started,
+        timedOut,
+        command: plan.label
+      });
+    });
+  });
+}
+function planScript(repoRoot, scriptRef) {
+  const resolved = path10.resolve(repoRoot, scriptRef);
+  const projectRoot = projectHarnessDir(repoRoot);
+  const userRoot = userHarnessDir();
+  const withinProject = resolved === projectRoot || resolved.startsWith(`${projectRoot}${path10.sep}`);
+  const withinUser = resolved === userRoot || resolved.startsWith(`${userRoot}${path10.sep}`);
+  if (!withinProject && !withinUser) {
+    throw new ToolExecutionError(`Script must live under the harness directory: ${scriptRef}`);
+  }
+  const interpreter = INTERPRETERS[path10.extname(resolved).toLowerCase()];
+  if (interpreter) {
+    return { file: interpreter, args: [resolved], shell: false, label: `${interpreter} ${scriptRef}` };
+  }
+  return { file: resolved, args: [], shell: false, label: scriptRef };
+}
+function executeShell(command, opts) {
+  return runProcess(
+    { file: command, args: [], shell: true, label: command },
+    {
+      cwd: opts.cwd,
+      env: { ...process.env, ...opts.env },
+      timeoutMs: opts.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+      signal: opts.signal
+    }
+  );
+}
+function executeScript(repoRoot, scriptRef, opts) {
+  let plan;
+  try {
+    plan = planScript(repoRoot, scriptRef);
+  } catch (error) {
+    return Promise.reject(error);
+  }
+  return runProcess(plan, {
+    cwd: opts.cwd,
+    env: { ...process.env, ...opts.env },
+    timeoutMs: opts.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+    signal: opts.signal
+  });
+}
+
+// src/core/connections/index.ts
+var NAME_RE = /^[a-z0-9][a-z0-9-]*$/;
+var ConnectionCreateError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ConnectionCreateError";
+  }
+};
+function shellQuote(value) {
+  if (/^[A-Za-z0-9_./:=@+-]+$/.test(value)) {
+    return value;
+  }
+  return `'${value.replace(/'/g, "'\\''")}'`;
+}
+function commandExists(command) {
+  return executeShell(`command -v ${shellQuote(command)}`, { cwd: process.cwd(), timeoutMs: 1e4 });
+}
+function defaultDescription(input2) {
+  return `Local ${input2.provider} CLI connection using \`${input2.command}\`.`;
+}
+async function createConnection(repoRoot, input2, options = {}) {
+  if (!NAME_RE.test(input2.name)) {
+    throw new ConnectionCreateError(
+      `Invalid connection name \`${input2.name}\`. Use lowercase letters, numbers, and hyphens.`
+    );
+  }
+  const scope = input2.scope ?? "project";
+  const candidate = {
+    name: input2.name,
+    provider: input2.provider,
+    kind: "cli",
+    command: input2.command,
+    description: input2.description ?? defaultDescription(input2),
+    profile: input2.profile,
+    risk: input2.risk ?? "medium",
+    confirm: input2.confirm ?? input2.risk === "high",
+    healthcheck: input2.healthcheck ? { run: input2.healthcheck, expectExitCode: 0 } : void 0,
+    scope
+  };
+  const parsed = connectionManifestSchema.safeParse(candidate);
+  if (!parsed.success) {
+    const detail = parsed.error.issues.map((issue) => issue.message).join("; ");
+    throw new ConnectionCreateError(`Invalid connection definition: ${detail}`);
+  }
+  const dir = scope === "project" ? projectObjectDir(repoRoot, "connections") : userObjectDir("connections", options.home);
+  const filePath = path11.join(dir, `${input2.name}.yaml`);
+  await mkdir4(dir, { recursive: true });
+  await writeFile4(filePath, stringifyYaml2(parsed.data), { encoding: "utf8", flag: options.force ? "w" : "wx" }).catch(
+    (error) => {
+      if (error.code === "EEXIST") {
+        throw new ConnectionCreateError(
+          `Connection \`${input2.name}\` already exists at ${filePath}. Pass force to overwrite.`
+        );
+      }
+      throw error;
+    }
+  );
+  return { path: filePath, manifest: parsed.data };
+}
+async function checkConnection(repoRoot, connection) {
+  const exists6 = await commandExists(connection.manifest.command);
+  if (!exists6.ok) {
+    return {
+      name: connection.name,
+      status: "error",
+      message: `Command \`${connection.manifest.command}\` was not found on PATH.`,
+      sourcePath: connection.sourcePath,
+      command: connection.manifest.command,
+      healthcheck: exists6
+    };
+  }
+  if (!connection.manifest.healthcheck) {
+    return {
+      name: connection.name,
+      status: "warning",
+      message: "No healthcheck configured.",
+      sourcePath: connection.sourcePath,
+      command: connection.manifest.command
+    };
+  }
+  const result = await executeShell(connection.manifest.healthcheck.run, { cwd: repoRoot, timeoutMs: 3e4 });
+  const expected = connection.manifest.healthcheck.expectExitCode;
+  if (result.exitCode !== expected) {
+    return {
+      name: connection.name,
+      status: "error",
+      message: `Healthcheck exited ${result.exitCode}; expected ${expected}.`,
+      sourcePath: connection.sourcePath,
+      command: connection.manifest.command,
+      healthcheck: result
+    };
+  }
+  return {
+    name: connection.name,
+    status: "ok",
+    message: "Connection healthcheck passed.",
+    sourcePath: connection.sourcePath,
+    command: connection.manifest.command,
+    healthcheck: result
+  };
+}
+async function checkConnections(repoRoot, options = {}) {
+  const harness = await resolveHarness(repoRoot, { home: options.home });
+  return Promise.all(harness.connections.map((connection) => checkConnection(repoRoot, connection)));
+}
+
+// src/core/tools/authorize.ts
+function authorizeTool(tool, options) {
+  const trusted = options.trusted ?? true;
+  const allowListed = options.allow.includes(tool.name);
+  if (!trusted && !allowListed) {
+    return {
+      allowed: false,
+      reason: "not-allowed",
+      message: `\`${tool.name}\` is from an untrusted source. Add it to \`tools.allow\` in harness.yaml to permit it.`
+    };
+  }
+  if (tool.manifest.confirm && options.confirmed !== true) {
+    return {
+      allowed: false,
+      reason: "needs-confirmation",
+      message: `\`${tool.name}\` requires confirmation before running.`
+    };
+  }
+  if (tool.manifest.risk === "high" && options.confirmed !== true) {
+    return {
+      allowed: false,
+      reason: "needs-confirmation",
+      message: `\`${tool.name}\` is high risk and requires confirmation before running.`
+    };
+  }
+  if (options.connectionRisk === "high" && tool.manifest.risk !== "low" && options.confirmed !== true) {
+    return {
+      allowed: false,
+      reason: "needs-confirmation",
+      message: `\`${tool.name}\` uses a high-risk connection and requires confirmation before running.`
+    };
+  }
+  return { allowed: true };
+}
+
+// src/core/tools/interpolate.ts
+var ToolInputError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ToolInputError";
+  }
+};
+var INPUT_TOKEN = /\{\{\s*([\w-]+)\s*\}\}/g;
+function shellQuote2(value) {
+  if (value === "") {
+    return "''";
+  }
+  if (/^[A-Za-z0-9_@%+=:,./-]+$/.test(value)) {
+    return value;
+  }
+  return `'${value.replace(/'/g, "'\\''")}'`;
+}
+function coerce(name, type, raw) {
+  if (type === "string") {
+    if (typeof raw === "string") {
+      return raw;
+    }
+    if (typeof raw === "number" || typeof raw === "boolean") {
+      return String(raw);
+    }
+    throw new ToolInputError(`Input \`${name}\` must be a string.`);
+  }
+  if (type === "number") {
+    const value = typeof raw === "number" ? raw : Number(raw);
+    if (typeof raw === "boolean" || Number.isNaN(value)) {
+      throw new ToolInputError(`Input \`${name}\` must be a number.`);
+    }
+    return value;
+  }
+  if (typeof raw === "boolean") {
+    return raw;
+  }
+  if (raw === "true") {
+    return true;
+  }
+  if (raw === "false") {
+    return false;
+  }
+  throw new ToolInputError(`Input \`${name}\` must be a boolean.`);
+}
+function resolveInputs(manifest, provided = {}) {
+  const declared = manifest.input ?? {};
+  const unknown = Object.keys(provided).filter((key) => !(key in declared));
+  if (unknown.length > 0) {
+    throw new ToolInputError(`Unknown input(s) for \`${manifest.name}\`: ${unknown.join(", ")}.`);
+  }
+  const values = {};
+  const missing = [];
+  for (const [name, param] of Object.entries(declared)) {
+    if (name in provided && provided[name] !== void 0) {
+      values[name] = coerce(name, param.type, provided[name]);
+    } else if (param.default !== void 0) {
+      values[name] = param.default;
+    } else {
+      missing.push(name);
+    }
+  }
+  if (missing.length > 0) {
+    throw new ToolInputError(`Missing required input(s) for \`${manifest.name}\`: ${missing.join(", ")}.`);
+  }
+  return values;
+}
+function interpolateRun(run2, values) {
+  const result = run2.replace(INPUT_TOKEN, (_match, name) => {
+    if (!(name in values)) {
+      throw new ToolInputError(`Command references undeclared input \`${name}\`.`);
+    }
+    return shellQuote2(String(values[name]));
+  });
+  if (/\{\{|\}\}/.test(result)) {
+    throw new ToolInputError("Command has malformed interpolation tokens.");
+  }
+  return result;
+}
+function inputEnv(values) {
+  const env = { TR_INPUT_JSON: JSON.stringify(values) };
+  for (const [name, value] of Object.entries(values)) {
+    env[`TR_INPUT_${name.toUpperCase().replace(/-/g, "_")}`] = String(value);
+  }
+  return env;
+}
+
+// src/core/tools/create.ts
+import { mkdir as mkdir5, writeFile as writeFile5 } from "fs/promises";
+import path12 from "path";
+import { stringify as stringifyYaml3 } from "yaml";
+var ToolCreateError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ToolCreateError";
+  }
+};
+var NAME_RE2 = /^[a-z0-9][a-z0-9-]*$/;
+function assertSafeName(name) {
+  if (!NAME_RE2.test(name)) {
+    throw new ToolCreateError(
+      `Invalid tool name \`${name}\`. Use lowercase letters, numbers, and hyphens.`
+    );
+  }
+}
+function assertSafeScript(script) {
+  if (path12.isAbsolute(script) || script.split(/[\\/]/).includes("..")) {
+    throw new ToolCreateError(`Script path must be inside the harness directory: ${script}`);
+  }
+}
+async function createTool(repoRoot, input2, options) {
+  assertSafeName(input2.name);
+  if (input2.script) {
+    assertSafeScript(input2.script);
+  }
+  const confirm = input2.confirm ?? options.actor === "agent";
+  const scope = input2.scope ?? "project";
+  const candidate = {
+    name: input2.name,
+    description: input2.description,
+    scope,
+    risk: input2.risk ?? "low",
+    confirm,
+    ...input2.connection ? { connection: input2.connection } : {},
+    ...input2.healthcheck ? { healthcheck: input2.healthcheck } : {},
+    input: input2.input ?? {},
+    ...input2.run ? { run: input2.run } : {},
+    ...input2.script ? { script: input2.script } : {}
+  };
+  const parsed = toolManifestSchema.safeParse(candidate);
+  if (!parsed.success) {
+    const detail = parsed.error.issues.map((issue) => issue.message).join("; ");
+    throw new ToolCreateError(`Invalid tool definition: ${detail}`);
+  }
+  const dir = scope === "project" ? projectObjectDir(repoRoot, "tools") : userObjectDir("tools", options.home);
+  const filePath = path12.join(dir, `${input2.name}.yaml`);
+  await mkdir5(dir, { recursive: true });
+  await writeFile5(filePath, stringifyYaml3(parsed.data), { encoding: "utf8", flag: options.force ? "w" : "wx" }).catch(
+    (error) => {
+      if (error.code === "EEXIST") {
+        throw new ToolCreateError(`Tool \`${input2.name}\` already exists at ${filePath}. Pass force to overwrite.`);
+      }
+      throw error;
+    }
+  );
+  return { path: filePath, scope, manifest: parsed.data };
+}
+
+// src/core/tools/catalog.ts
+import { readFile as readFile6, stat as stat3 } from "fs/promises";
+import path13 from "path";
+var NAME_RE3 = /^[a-z0-9][a-z0-9-]*$/;
+var DESTRUCTIVE_RE = /\b(migrate|deploy|publish|release|prune|reset|destroy|drop|delete|rm|push|seed|wipe)\b/i;
+function looksDestructive(name, command) {
+  return DESTRUCTIVE_RE.test(name) || DESTRUCTIVE_RE.test(command);
+}
+function sanitize(name) {
+  const slug2 = name.toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "");
+  return NAME_RE3.test(slug2) ? slug2 : void 0;
+}
+async function exists2(file) {
+  try {
+    await stat3(file);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function detectPackageManager(repoRoot) {
+  if (await exists2(path13.join(repoRoot, "pnpm-lock.yaml"))) {
+    return "pnpm";
+  }
+  if (await exists2(path13.join(repoRoot, "yarn.lock"))) {
+    return "yarn";
+  }
+  if (await exists2(path13.join(repoRoot, "bun.lockb"))) {
+    return "bun";
+  }
+  return "npm";
+}
+var SCRIPT_PRIORITY = ["dev", "start", "build", "test", "lint", "typecheck", "format"];
+var HEALTHCHECK_NAMES = /* @__PURE__ */ new Set(["build", "test", "lint", "typecheck", "format"]);
+function healthcheckFor(name, command) {
+  return HEALTHCHECK_NAMES.has(name) && !looksDestructive(name, command) ? command : void 0;
+}
+function orderScripts(names) {
+  return [...names].sort((a, b) => {
+    const ai = SCRIPT_PRIORITY.indexOf(a);
+    const bi = SCRIPT_PRIORITY.indexOf(b);
+    if (ai !== -1 || bi !== -1) {
+      return (ai === -1 ? Infinity : ai) - (bi === -1 ? Infinity : bi);
+    }
+    return a.localeCompare(b);
+  });
+}
+async function fromPackageJson(repoRoot) {
+  const file = path13.join(repoRoot, "package.json");
+  let raw;
+  try {
+    raw = await readFile6(file, "utf8");
+  } catch {
+    return [];
+  }
+  let scripts = {};
+  try {
+    const parsed = JSON.parse(raw);
+    scripts = parsed.scripts ?? {};
+  } catch {
+    return [];
+  }
+  const pm = await detectPackageManager(repoRoot);
+  const candidates = [];
+  for (const scriptName of orderScripts(Object.keys(scripts))) {
+    const name = sanitize(scriptName);
+    if (!name) {
+      continue;
+    }
+    const command = scripts[scriptName] ?? "";
+    candidates.push({
+      name,
+      description: `Run the \`${scriptName}\` package script`,
+      run: `${pm} run ${scriptName}`,
+      risk: looksDestructive(scriptName, command) ? "high" : "low",
+      confirm: looksDestructive(scriptName, command),
+      healthcheck: healthcheckFor(scriptName, `${pm} run ${scriptName}`),
+      source: "package.json"
+    });
+  }
+  return candidates;
+}
+async function fromTargets(repoRoot, fileName, runner, source) {
+  let raw;
+  try {
+    raw = await readFile6(path13.join(repoRoot, fileName), "utf8");
+  } catch {
+    return [];
+  }
+  const candidates = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const line of raw.split(/\r?\n/)) {
+    const match = /^([a-zA-Z][\w-]*)\s*:/.exec(line);
+    if (!match) {
+      continue;
+    }
+    const target = match[1];
+    if (target === "PHONY" || seen.has(target)) {
+      continue;
+    }
+    seen.add(target);
+    const name = sanitize(target);
+    if (!name) {
+      continue;
+    }
+    candidates.push({
+      name,
+      description: `Run the \`${target}\` ${source === "makefile" ? "Make target" : "recipe"}`,
+      run: `${runner} ${target}`,
+      risk: looksDestructive(target, "") ? "high" : "low",
+      confirm: looksDestructive(target, ""),
+      healthcheck: healthcheckFor(target, `${runner} ${target}`),
+      source
+    });
+  }
+  return candidates;
+}
+var PROFILE_STARTERS = {
+  nextjs: [
+    starter("dev", "Start the Next.js dev server", "next dev"),
+    starter("build", "Build the Next.js app", "next build"),
+    starter("lint", "Lint with Next.js ESLint", "next lint")
+  ],
+  "vite-react": [
+    starter("dev", "Start the Vite dev server", "vite"),
+    starter("build", "Build the app", "vite build"),
+    starter("test", "Run the test suite", "vitest run")
+  ],
+  fastapi: [
+    starter("dev", "Run the FastAPI dev server", "uvicorn app.main:app --reload"),
+    starter("test", "Run the test suite", "pytest"),
+    starter("lint", "Lint with Ruff", "ruff check .")
+  ],
+  "python-cli": [
+    starter("test", "Run the test suite", "pytest"),
+    starter("lint", "Lint with Ruff", "ruff check ."),
+    starter("format", "Format with Ruff", "ruff format .")
+  ],
+  "node-cli": [
+    starter("build", "Build the project", "npm run build"),
+    starter("test", "Run the test suite", "npm test"),
+    starter("lint", "Lint the project", "npm run lint")
+  ],
+  dbt: [
+    starter("build", "Build dbt models", "dbt build"),
+    starter("run", "Run dbt models", "dbt run"),
+    starter("test", "Test dbt models", "dbt test")
+  ],
+  empty: []
+};
+function starter(name, description, run2) {
+  const destructive = looksDestructive(name, run2);
+  return {
+    name,
+    description,
+    run: run2,
+    risk: destructive ? "high" : "low",
+    confirm: destructive,
+    healthcheck: healthcheckFor(name, run2),
+    source: "profile"
+  };
+}
+function dedupeByName(candidates) {
+  const seen = /* @__PURE__ */ new Set();
+  const result = [];
+  for (const candidate of candidates) {
+    if (seen.has(candidate.name)) {
+      continue;
+    }
+    seen.add(candidate.name);
+    result.push(candidate);
+  }
+  return result;
+}
+function profileStarterTools(profile) {
+  return PROFILE_STARTERS[profile] ?? [];
+}
+async function detectToolCandidates(repoRoot, profile = "empty") {
+  const detected = dedupeByName([
+    ...await fromPackageJson(repoRoot),
+    ...await fromTargets(repoRoot, "Makefile", "make", "makefile"),
+    ...await fromTargets(repoRoot, "justfile", "just", "justfile")
+  ]);
+  if (detected.length > 0) {
+    return detected;
+  }
+  return profileStarterTools(profile);
+}
+
+// src/core/tools/index.ts
+var ToolNotFoundError = class extends Error {
+  constructor(name) {
+    super(`Unknown tool: \`${name}\`.`);
+    this.name = "ToolNotFoundError";
+  }
+};
+async function runTool(repoRoot, options) {
+  const harness = options.harness ?? await resolveHarness(repoRoot, { home: options.home });
+  const tool = harness.tools.find((entry) => entry.name === options.name);
+  if (!tool) {
+    throw new ToolNotFoundError(options.name);
+  }
+  const [projectLock, userLock] = await Promise.all([
+    readLockFile(projectLockPath(repoRoot)),
+    readLockFile(userLockPath(options.home))
+  ]);
+  const external = /* @__PURE__ */ new Set([...externalToolNames(projectLock), ...externalToolNames(userLock)]);
+  const connection = tool.manifest.connection ? harness.connections.find((entry) => entry.name === tool.manifest.connection) : void 0;
+  if (tool.manifest.connection && !connection) {
+    return {
+      status: "blocked",
+      tool: tool.name,
+      reason: "not-allowed",
+      message: `\`${tool.name}\` references unknown connection \`${tool.manifest.connection}\`.`
+    };
+  }
+  const decision = authorizeTool(tool, {
+    allow: harness.manifest.tools.allow,
+    confirmed: options.confirmed,
+    trusted: !external.has(tool.name),
+    connectionRisk: connection?.manifest.risk
+  });
+  if (!decision.allowed) {
+    return { status: "blocked", tool: tool.name, reason: decision.reason, message: decision.message };
+  }
+  const values = resolveInputs(tool.manifest, options.input);
+  const env = inputEnv(values);
+  const execOptions = { cwd: repoRoot, env, timeoutMs: options.timeoutMs, signal: options.signal };
+  const result = tool.manifest.run ? await executeShell(interpolateRun(tool.manifest.run, values), execOptions) : await executeScript(repoRoot, tool.manifest.script, execOptions);
+  return { status: "ran", tool: tool.name, result };
+}
+async function checkToolHealth(repoRoot, tool) {
+  if (!tool.manifest.healthcheck) {
+    return { status: "skipped", tool: tool.name, message: "No healthcheck configured." };
+  }
+  const result = await executeShell(tool.manifest.healthcheck.run, { cwd: repoRoot, timeoutMs: 3e4 });
+  const expected = tool.manifest.healthcheck.expectExitCode;
+  if (result.exitCode !== expected) {
+    return {
+      status: "error",
+      tool: tool.name,
+      message: `Healthcheck exited ${result.exitCode}; expected ${expected}.`,
+      result
+    };
+  }
+  return { status: "ok", tool: tool.name, result };
+}
+
+// src/core/doctor.ts
+async function exists3(filePath) {
+  try {
+    await stat4(filePath);
+    return true;
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return false;
+    }
+    throw error;
+  }
+}
+function finding2(severity, code, message, pathValue) {
+  return pathValue ? { severity, code, message, path: pathValue } : { severity, code, message };
+}
+async function mcpConfigWarnings(repoRoot) {
+  const configs = [".vscode/mcp.json", ".cursor/mcp.json", ".mcp.json"];
+  const present = await Promise.all(configs.map((config) => exists3(path14.join(repoRoot, config))));
+  if (present.some(Boolean)) {
+    return [];
+  }
+  return [
+    finding2(
+      "warning",
+      "mcp_config_missing",
+      "No project-local MCP config found. Run `threadroot mcp setup --write` if this repo should expose Threadroot tools to local agents."
+    )
+  ];
+}
+async function doctor(repoRoot, options = {}) {
+  const findings = [];
+  let harness;
+  try {
+    harness = await resolveHarness(repoRoot, { home: options.home });
+  } catch (error) {
+    if (error instanceof HarnessError) {
+      findings.push(finding2("error", "harness_invalid", error.message));
+      return summarize(findings);
+    }
+    throw error;
+  }
+  try {
+    const files = await compile(repoRoot, harness);
+    const drift = await detectDrift(repoRoot, files);
+    for (const entry of drift) {
+      if (entry.status === "create") {
+        findings.push(finding2("error", "compiled_output_missing", `Missing compiled output: ${entry.path}`, entry.path));
+      } else if (entry.status === "drift") {
+        findings.push(
+          finding2(
+            "warning",
+            "compiled_output_drift",
+            `Compiled output differs from the canonical harness: ${entry.path}`,
+            entry.path
+          )
+        );
+      }
+    }
+  } catch (error) {
+    findings.push(
+      finding2(
+        "error",
+        "compile_failed",
+        `Cannot compile harness: ${error instanceof Error ? error.message : String(error)}`
+      )
+    );
+  }
+  for (const tool of harness.tools) {
+    if (tool.manifest.confirm) {
+      findings.push(
+        finding2(
+          "warning",
+          "tool_requires_confirmation",
+          `Tool \`${tool.name}\` requires explicit confirmation before running.`,
+          tool.sourcePath
+        )
+      );
+    }
+    if (tool.manifest.risk === "high" && !tool.manifest.confirm) {
+      findings.push(
+        finding2(
+          "warning",
+          "high_risk_tool_without_confirm",
+          `High-risk tool \`${tool.name}\` does not set confirm:true. Runtime execution will still require confirmation.`,
+          tool.sourcePath
+        )
+      );
+    }
+    if (tool.manifest.connection && !harness.connections.some((connection) => connection.name === tool.manifest.connection)) {
+      findings.push(
+        finding2(
+          "error",
+          "unknown_tool_connection",
+          `Tool \`${tool.name}\` references unknown connection \`${tool.manifest.connection}\`.`,
+          tool.sourcePath
+        )
+      );
+    }
+    const toolHealth = await checkToolHealth(repoRoot, tool);
+    if (toolHealth.status === "error") {
+      findings.push(
+        finding2("error", "tool_healthcheck_failed", `Tool \`${tool.name}\`: ${toolHealth.message}`, tool.sourcePath)
+      );
+    }
+  }
+  for (const connection of harness.connections) {
+    if (connection.manifest.risk === "high" && !connection.manifest.confirm) {
+      findings.push(
+        finding2(
+          "warning",
+          "high_risk_connection_without_confirm",
+          `High-risk connection \`${connection.name}\` should set confirm:true.`,
+          connection.sourcePath
+        )
+      );
+    }
+    const check = await checkConnection(repoRoot, connection);
+    if (check.status === "error") {
+      findings.push(
+        finding2(
+          "error",
+          "connection_check_failed",
+          `Connection \`${connection.name}\`: ${check.message}`,
+          connection.sourcePath
+        )
+      );
+    } else if (check.status === "warning") {
+      findings.push(
+        finding2(
+          "warning",
+          "connection_check_warning",
+          `Connection \`${connection.name}\`: ${check.message}`,
+          connection.sourcePath
+        )
+      );
+    }
+  }
+  const skillReport = await validateResolvedSkillsDeep(harness);
+  for (const skillFinding of skillReport.findings) {
+    findings.push(
+      finding2(
+        skillFinding.severity,
+        `skill_${skillFinding.severity}`,
+        `Skill \`${skillFinding.skill}\`: ${skillFinding.message}`,
+        skillFinding.path
+      )
+    );
+  }
+  const [projectLock, userLock] = await Promise.all([
+    readLockFile(projectLockPath(repoRoot)),
+    readLockFile(userLockPath(options.home))
+  ]);
+  const externalTools = /* @__PURE__ */ new Set([...externalToolNames(projectLock), ...externalToolNames(userLock)]);
+  const externalSkills = /* @__PURE__ */ new Set([...externalSkillNames(projectLock), ...externalSkillNames(userLock)]);
+  for (const name of externalTools) {
+    if (!harness.manifest.tools.allow.includes(name)) {
+      findings.push(
+        finding2(
+          "error",
+          "external_tool_not_allowed",
+          `External installed tool \`${name}\` is not listed in tools.allow.`
+        )
+      );
+    }
+  }
+  for (const skill of harness.skills) {
+    if (!externalSkills.has(skill.name)) {
+      continue;
+    }
+    if (skill.frontmatter.allowedTools) {
+      findings.push(
+        finding2(
+          "warning",
+          "external_skill_allowed_tools",
+          `External installed skill \`${skill.name}\` declares allowed tools; inspect it before trusting.`,
+          skill.sourcePath
+        )
+      );
+    }
+    const scriptsDir = path14.join(path14.dirname(skill.sourcePath), "scripts");
+    if (await exists3(scriptsDir)) {
+      findings.push(
+        finding2(
+          "warning",
+          "external_skill_scripts",
+          `External installed skill \`${skill.name}\` includes scripts; inspect them before trusting.`,
+          scriptsDir
+        )
+      );
+    }
+  }
+  findings.push(...await mcpConfigWarnings(repoRoot));
+  return summarize(findings);
+}
+function summarize(findings) {
+  const errors = findings.filter((entry) => entry.severity === "error").length;
+  const warnings = findings.filter((entry) => entry.severity === "warning").length;
+  return { ok: errors === 0, findings, summary: { errors, warnings } };
+}
+
+// src/commands/doctor.ts
+async function runDoctor(repoRoot) {
+  const report = await doctor(repoRoot);
+  if (report.findings.length === 0) {
+    console.log("Threadroot doctor: clean");
+    return;
+  }
+  console.log(`Threadroot doctor: ${report.summary.errors} error(s), ${report.summary.warnings} warning(s)`);
+  for (const finding3 of report.findings) {
+    const label = finding3.severity === "error" ? "error" : "warning";
+    const suffix = finding3.path ? ` (${finding3.path})` : "";
+    console.log(`- ${label} ${finding3.code}: ${finding3.message}${suffix}`);
+  }
+  if (!report.ok) {
+    process.exitCode = 1;
+  }
+}
+
+// src/core/init/index.ts
+import { mkdir as mkdir7, stat as stat6, writeFile as writeFile6 } from "fs/promises";
+import path19 from "path";
+
+// src/core/scan/package.ts
+import fs2 from "fs/promises";
+import path15 from "path";
+
+// src/core/scan/rules.ts
+var ignoredDirectories = /* @__PURE__ */ new Set([
+  ".git",
+  ".threadroot",
+  "node_modules",
+  "dist",
+  "coverage",
+  ".next",
+  "target",
+  "dbt_packages",
+  "__pycache__"
+]);
+
+// src/core/scan/package.ts
+async function readJson(repoRoot, relativePath) {
+  try {
+    return JSON.parse(await fs2.readFile(path15.join(repoRoot, relativePath), "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+function inferProfile(files, packageJson) {
+  if (files.some((file) => path15.basename(file) === "dbt_project.yml" || path15.basename(file) === "dbt_project.yaml")) {
+    return "dbt";
+  }
+  const packageMeta = packageJson && typeof packageJson === "object" ? packageJson : void 0;
+  const dependencies = packageJson && typeof packageJson === "object" ? {
+    ...packageJson.dependencies,
+    ...packageJson.devDependencies
+  } : {};
+  if ("next" in dependencies) {
+    return "nextjs";
+  }
+  if ("vite" in dependencies || files.some((file) => file.startsWith("vite.config."))) {
+    return "vite-react";
+  }
+  if (packageMeta?.bin || "commander" in dependencies || "ink" in dependencies || "tsup" in dependencies || files.some((file) => file.startsWith("src/commands/"))) {
+    return "node-cli";
+  }
+  if (files.includes("pyproject.toml")) {
+    return "python-cli";
+  }
+  return "unknown";
+}
+
+// src/core/scan/walk.ts
+import fs3 from "fs/promises";
+import path16 from "path";
+function toPosix(relativePath) {
+  return relativePath.split(path16.sep).join("/");
+}
+async function walkRepo(repoRoot, directory = repoRoot) {
+  let entries;
+  try {
+    entries = await fs3.readdir(directory, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const files = [];
+  for (const entry of entries) {
+    const absolutePath = path16.join(directory, entry.name);
+    const relativePath = toPosix(path16.relative(repoRoot, absolutePath));
+    if (entry.isDirectory()) {
+      if (!ignoredDirectories.has(entry.name)) {
+        files.push(...await walkRepo(repoRoot, absolutePath));
+      }
+      continue;
+    }
+    if (entry.isFile()) {
+      files.push(relativePath);
+    }
+  }
+  return files;
+}
+
+// src/core/init/index.ts
+import { stringify as stringifyYaml4 } from "yaml";
+
+// src/core/init/builtins.ts
+import { cp, mkdir as mkdir6, readdir as readdir3, stat as stat5 } from "fs/promises";
+import path17 from "path";
+import { fileURLToPath } from "url";
+var DIST_DIR = path17.dirname(fileURLToPath(import.meta.url));
+var PACKAGE_ROOT_FROM_BUNDLE = path17.resolve(DIST_DIR, "..");
+var PACKAGE_ROOT_FROM_DIST = path17.resolve(DIST_DIR, "../../..");
+var PACKAGE_ROOT_FROM_SRC = path17.resolve(DIST_DIR, "../../../..");
+var SKILL_PACK_CANDIDATES = [
+  path17.join(PACKAGE_ROOT_FROM_BUNDLE, "skills"),
+  path17.join(PACKAGE_ROOT_FROM_DIST, "skills"),
+  path17.join(PACKAGE_ROOT_FROM_SRC, "skills")
+];
+var PROJECT_MEMORY_TEMPLATE = [
+  "# Project",
+  "",
+  "<!-- Stable, rarely-changing facts about this project. Keep it short. -->",
+  "",
+  "- What it is:",
+  "- Key technologies:",
+  "- How to run it:"
+].join("\n");
+async function exists4(target) {
+  try {
+    const info = await stat5(target);
+    return info.isDirectory();
+  } catch {
+    return false;
+  }
+}
+async function bundledSkillsDir() {
+  for (const candidate of SKILL_PACK_CANDIDATES) {
+    if (await exists4(candidate)) {
+      return candidate;
+    }
+  }
+  throw new Error("Bundled Threadroot skills were not found in this package.");
+}
+async function writeBuiltinSkills(repoRoot) {
+  const sourceDir = await bundledSkillsDir();
+  const targetDir = projectObjectDir(repoRoot, "skills");
+  await mkdir6(targetDir, { recursive: true });
+  const written = [];
+  const entries = await readdir3(sourceDir, { withFileTypes: true });
+  for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+    if (!entry.isDirectory()) {
+      continue;
+    }
+    const sourceSkill = path17.join(sourceDir, entry.name);
+    const sourceSkillFile = path17.join(sourceSkill, "SKILL.md");
+    if (!await exists4(sourceSkill) || !await stat5(sourceSkillFile).then((info) => info.isFile()).catch(() => false)) {
+      continue;
+    }
+    const targetSkill = path17.join(targetDir, entry.name);
+    const targetSkillFile = path17.join(targetSkill, "SKILL.md");
+    try {
+      await cp(sourceSkill, targetSkill, { recursive: true, force: false, errorOnExist: true });
+      written.push(targetSkillFile);
+    } catch (error) {
+      if (error.code !== "ERR_FS_CP_EEXIST" && error.code !== "EEXIST") {
+        throw error;
+      }
+    }
+  }
+  return written;
+}
+
+// src/core/init/import.ts
+import { readFile as readFile7, readdir as readdir4 } from "fs/promises";
+import path18 from "path";
+var PROSE_PRECEDENCE = ["AGENTS.md", "CLAUDE.md", ".github/copilot-instructions.md"];
+var CURSOR_RULES_DIR = ".cursor/rules";
+var NAME_RE4 = /^[a-z0-9][a-z0-9-]*$/;
+async function readIfExists3(filePath) {
+  try {
+    return await readFile7(filePath, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return void 0;
+    }
+    throw error;
+  }
+}
+function normalize(text) {
+  return text.toLowerCase().replace(/\s+/g, " ").trim();
+}
+function splitSections(markdown) {
+  const sections = [];
+  let heading = "";
+  let buffer = [];
+  const flush = () => {
+    const text = buffer.join("\n").trim();
+    if (text) {
+      sections.push({ heading, text });
+    }
+  };
+  for (const line of markdown.split(/\r?\n/)) {
+    if (/^#{1,6}\s/.test(line)) {
+      flush();
+      heading = normalize(line.replace(/^#+\s*/, ""));
+      buffer = [line];
+    } else {
+      buffer.push(line);
+    }
+  }
+  flush();
+  return sections;
+}
+function novelSections(canonical, other) {
+  const haystack = normalize(canonical);
+  const seenHeadings = new Set(splitSections(canonical).map((section) => section.heading).filter(Boolean));
+  return splitSections(other).filter((section) => {
+    if (section.heading && seenHeadings.has(section.heading)) {
+      return false;
+    }
+    return !haystack.includes(normalize(section.text));
+  });
+}
+async function listCursorRules(repoRoot) {
+  const dir = path18.join(repoRoot, CURSOR_RULES_DIR);
+  let entries;
+  try {
+    entries = await readdir4(dir);
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return [];
+    }
+    throw error;
+  }
+  const files = entries.filter((name) => name.endsWith(".mdc")).sort();
+  return Promise.all(
+    files.map(async (name) => ({
+      file: `${CURSOR_RULES_DIR}/${name}`,
+      content: await readFile7(path18.join(dir, name), "utf8")
+    }))
+  );
+}
+function globsToApplyTo(value) {
+  if (typeof value === "string") {
+    const first = value.split(",")[0]?.trim();
+    return first || void 0;
+  }
+  if (Array.isArray(value) && value.length > 0 && typeof value[0] === "string") {
+    return value[0].trim() || void 0;
+  }
+  return void 0;
+}
+function ruleName(fileName) {
+  const base = path18.basename(fileName, ".mdc").toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "");
+  return NAME_RE4.test(base) ? base : "imported-rule";
+}
+async function importVendorFiles(repoRoot, options = {}) {
+  const include = options.include ? new Set(options.include) : void 0;
+  const wanted = (file) => !include || include.has(file);
+  const prose = [];
+  for (const file of PROSE_PRECEDENCE) {
+    if (!wanted(file)) {
+      continue;
+    }
+    const content = await readIfExists3(path18.join(repoRoot, file));
+    if (content && content.trim()) {
+      prose.push({ file, content });
+    }
+  }
+  const cursorRules = (await listCursorRules(repoRoot)).filter((rule) => wanted(rule.file));
+  let canonicalSource;
+  let canonicalBody = "";
+  let rest = [];
+  if (prose.length > 0) {
+    canonicalSource = prose[0].file;
+    canonicalBody = extractHandAuthored(prose[0].content);
+    rest = prose.slice(1);
+  } else if (cursorRules.length > 0) {
+    canonicalSource = CURSOR_RULES_DIR;
+    canonicalBody = cursorRules.map((rule) => parseFrontmatter(rule.content).body).join("\n\n").trim();
+  }
+  const foldedFrom = [];
+  const skippedDuplicates = [];
+  let body = canonicalBody;
+  for (const file of rest) {
+    const hand = extractHandAuthored(file.content);
+    const novel = novelSections(body, hand);
+    if (novel.length === 0) {
+      skippedDuplicates.push(file.file);
+      continue;
+    }
+    body = `${body}
+
+<!-- imported from ${file.file} -->
+${novel.map((section) => section.text).join("\n\n")}`.trim();
+    foldedFrom.push(file.file);
+  }
+  const importedRules = cursorRules.map((rule) => {
+    const { data, body: ruleBody2 } = parseFrontmatter(rule.content);
+    return {
+      name: ruleName(rule.file),
+      applyTo: globsToApplyTo(data.globs ?? data.applyTo),
+      body: ruleBody2.trim()
+    };
+  });
+  return { canonicalSource, canonicalBody: body, foldedFrom, importedRules, skippedDuplicates };
+}
+
+// src/core/init/index.ts
+var DEFAULT_ADAPTERS = ["agents", "claude", "copilot", "cursor"];
+var AGENTS_FILE2 = "AGENTS.md";
+var InitError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "InitError";
+  }
+};
+async function pathExists(target) {
+  try {
+    await stat6(target);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function detectProfile(repoRoot, override) {
+  if (override) {
+    return override;
+  }
+  const files = await walkRepo(repoRoot);
+  const packageJson = await readJson(repoRoot, "package.json");
+  const inferred = inferProfile(files, packageJson);
+  return inferred === "unknown" ? "empty" : inferred;
+}
+async function detectName(repoRoot) {
+  const packageJson = await readJson(repoRoot, "package.json");
+  if (packageJson && typeof packageJson.name === "string" && packageJson.name.trim()) {
+    return packageJson.name.trim();
+  }
+  return path19.basename(repoRoot);
+}
+async function writeManifest(repoRoot, manifest) {
+  const body = {
+    name: manifest.name,
+    version: manifest.version,
+    profile: manifest.profile,
+    adapters: manifest.adapters
+  };
+  if (manifest.tools.allow.length > 0) {
+    body.tools = { allow: manifest.tools.allow };
+  }
+  await mkdir7(projectHarnessDir(repoRoot), { recursive: true });
+  await writeFile6(projectManifestPath(repoRoot), stringifyYaml4(body), "utf8");
+}
+async function writeProjectMemory(repoRoot) {
+  const dir = projectObjectDir(repoRoot, "memory");
+  await mkdir7(dir, { recursive: true });
+  const filePath = path19.join(dir, "project.md");
+  try {
+    await writeFile6(filePath, `${PROJECT_MEMORY_TEMPLATE}
+`, { encoding: "utf8", flag: "wx" });
+    return [filePath];
+  } catch (error) {
+    if (error.code === "EEXIST") {
+      return [];
+    }
+    throw error;
+  }
+}
+async function writeImportedRules(repoRoot, report) {
+  if (report.importedRules.length === 0) {
+    return [];
+  }
+  const dir = projectObjectDir(repoRoot, "rules");
+  await mkdir7(dir, { recursive: true });
+  const written = [];
+  for (const rule of report.importedRules) {
+    const filePath = path19.join(dir, `${rule.name}.md`);
+    const data = { name: rule.name, scope: "project" };
+    if (rule.applyTo) {
+      data.applyTo = rule.applyTo;
+    }
+    try {
+      await writeFile6(filePath, serializeFrontmatter(data, rule.body), { encoding: "utf8", flag: "wx" });
+      written.push(filePath);
+    } catch (error) {
+      if (error.code !== "EEXIST") {
+        throw error;
+      }
+    }
+  }
+  return written;
+}
+async function writeStarterTools(repoRoot, profile, force) {
+  const candidates = await detectToolCandidates(repoRoot, profile);
+  const names = [];
+  for (const candidate of candidates) {
+    try {
+      await createTool(
+        repoRoot,
+        {
+          name: candidate.name,
+          description: candidate.description,
+          run: candidate.run,
+          risk: candidate.risk,
+          confirm: candidate.confirm
+        },
+        { actor: "human", force }
+      );
+      names.push(candidate.name);
+    } catch (error) {
+      if (error instanceof ToolCreateError) {
+        continue;
+      }
+      throw error;
+    }
+  }
+  return names;
+}
+async function initHarness(repoRoot, options = {}) {
+  if (!options.force && await pathExists(projectManifestPath(repoRoot))) {
+    throw new InitError(
+      `A harness already exists at ${path19.join(".threadroot", "harness.yaml")}. Re-run with --force to overwrite.`
+    );
+  }
+  const profile = await detectProfile(repoRoot, options.profile);
+  const name = await detectName(repoRoot);
+  const adapters = options.adapters ?? DEFAULT_ADAPTERS;
+  const tools2 = await writeStarterTools(repoRoot, profile, options.force ?? false);
+  const skills = await writeBuiltinSkills(repoRoot);
+  const memory = await writeProjectMemory(repoRoot);
+  const manifest = harnessManifestSchema.parse({
+    name,
+    version: 1,
+    profile,
+    adapters,
+    tools: { allow: tools2 }
+  });
+  await writeManifest(repoRoot, manifest);
+  let report;
+  let rules = [];
+  if (options.import !== false) {
+    report = await importVendorFiles(repoRoot, { include: options.importFiles });
+    if (report.canonicalBody.trim()) {
+      await writeFile6(path19.join(repoRoot, AGENTS_FILE2), `${report.canonicalBody.trim()}
+`, "utf8");
+    }
+    rules = await writeImportedRules(repoRoot, report);
+  }
+  const { written } = await runCompile(repoRoot, { home: options.home });
+  return { name, profile, adapters, skills, tools: tools2, memory, rules, import: report, compiled: written };
+}
+
+// src/commands/init.ts
+function parseAdapters(value) {
+  if (!value) {
+    return void 0;
+  }
+  return value.split(",").map((entry) => entry.trim()).filter(Boolean).map((entry) => adapterIdSchema.parse(entry));
+}
+async function runInit(repoRoot, options) {
+  const initOptions = {
+    force: options.force,
+    import: options.import,
+    profile: options.profile ? profileIdSchema.parse(options.profile) : void 0,
+    adapters: parseAdapters(options.adapters)
+  };
+  try {
+    const report = await initHarness(repoRoot, initOptions);
+    console.log(`Initialized harness \`${report.name}\` (profile: ${report.profile}).`);
+    console.log(`adapters: ${report.adapters.join(", ")}`);
+    console.log(`skills: ${report.skills.length}, tools: ${report.tools.length}, memory: ${report.memory.length}`);
+    if (report.import?.canonicalSource) {
+      console.log(`imported canonical prose from ${report.import.canonicalSource}`);
+      if (report.import.foldedFrom.length > 0) {
+        console.log(`  folded novel sections from: ${report.import.foldedFrom.join(", ")}`);
+      }
+      if (report.import.skippedDuplicates.length > 0) {
+        console.log(`  skipped duplicates: ${report.import.skippedDuplicates.join(", ")}`);
+      }
+    }
+    if (report.rules.length > 0) {
+      console.log(`imported ${report.rules.length} cursor rule(s)`);
+    }
+    console.log(`compiled ${report.compiled.length} vendor file(s).`);
+  } catch (error) {
+    if (error instanceof InitError) {
+      console.error(error.message);
+      process.exitCode = 1;
+      return;
+    }
+    throw error;
+  }
+}
+
+// src/commands/install.ts
+import path22 from "path";
+
+// src/core/install/fetch.ts
+import { execFile } from "child_process";
+import { mkdtemp, rm } from "fs/promises";
+import os2 from "os";
+import path20 from "path";
+import { promisify } from "util";
+var run = promisify(execFile);
+function cloneUrl(ref) {
+  if (ref.provider === "github") {
+    return `https://github.com/${ref.owner}/${ref.repo}.git`;
+  }
+  if (!ref.url) {
+    throw new Error(`Git source ${ref.raw} has no URL.`);
+  }
+  return ref.url;
+}
+async function git(cwd, args) {
+  const { stdout } = await run("git", args, {
+    cwd,
+    env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
+  });
+  return stdout.trim();
+}
+async function fetchGitSource(ref) {
+  const url = cloneUrl(ref);
+  const dir = await mkdtemp(path20.join(os2.tmpdir(), "threadroot-fetch-"));
+  const cleanup = () => rm(dir, { recursive: true, force: true });
+  try {
+    if (ref.ref) {
+      try {
+        await git(void 0, ["clone", "--depth", "1", "--branch", ref.ref, url, dir]);
+      } catch {
+        await git(void 0, ["clone", url, dir]);
+        await git(dir, ["checkout", ref.ref]);
+      }
+    } else {
+      await git(void 0, ["clone", "--depth", "1", url, dir]);
+    }
+    const sha = await git(dir, ["rev-parse", "HEAD"]);
+    return { dir, sha, cleanup };
+  } catch (error) {
+    await cleanup();
+    throw error;
+  }
+}
+
+// src/core/install/install.ts
+import { cp as cp2, mkdir as mkdir8, readFile as readFile8, readdir as readdir5, stat as stat7, writeFile as writeFile7 } from "fs/promises";
+import { createHash as createHash2 } from "crypto";
+import path21 from "path";
+var NAME_RE5 = /^[a-z0-9][a-z0-9-]*$/;
+var KIND_DIR = {
+  skill: "skills",
+  tool: "tools",
+  connection: "connections",
+  rule: "rules"
+};
+function objectExt(kind) {
+  return kind === "tool" || kind === "connection" ? ".yaml" : ".md";
+}
+function safeRepoPath(objectPath) {
+  const normalized = path21.normalize(objectPath);
+  if (path21.isAbsolute(normalized) || normalized === ".." || normalized.startsWith(`..${path21.sep}`)) {
+    throw new Error(`Unsafe object path: ${objectPath}`);
+  }
+  return normalized;
+}
+function inferKind(objectPath, override) {
+  if (override) {
+    return override;
+  }
+  const segments = objectPath.split(/[\\/]/);
+  if (segments.includes("skills")) return "skill";
+  if (segments.includes("tools")) return "tool";
+  if (segments.includes("connections")) return "connection";
+  if (segments.includes("rules")) return "rule";
+  const ext = path21.extname(objectPath).toLowerCase();
+  if (ext === ".yaml" || ext === ".yml") return "tool";
+  if (ext === ".md") return "skill";
+  throw new Error(
+    `Cannot infer object kind from ${objectPath}; pass an explicit kind (skill, tool, rule, or connection).`
+  );
+}
+function deriveName(objectPath) {
+  const base = path21.basename(objectPath, path21.extname(objectPath));
+  if (!NAME_RE5.test(base)) {
+    throw new Error(`Invalid object name \`${base}\` (use lowercase letters, digits, and dashes).`);
+  }
+  return base;
+}
+async function hashDirectory(root) {
+  const hash = createHash2("sha256");
+  hash.update("threadroot-directory-v1\n");
+  async function walk(dir) {
+    const entries = (await readdir5(dir, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name));
+    for (const entry of entries) {
+      const full = path21.join(dir, entry.name);
+      const rel = path21.relative(root, full).split(path21.sep).join("/");
+      if (entry.isSymbolicLink()) {
+        throw new Error(`Refusing to install skill directory with symlink: ${rel}`);
+      }
+      if (entry.isDirectory()) {
+        await walk(full);
+        continue;
+      }
+      if (entry.isFile()) {
+        hash.update(`file:${rel}
+`);
+        hash.update(await readFile8(full));
+        hash.update("\n");
+      }
+    }
+  }
+  await walk(root);
+  return hash.digest("hex");
+}
+async function validateSkillDirectory2(sourcePath, expectedName) {
+  const skillPath = path21.join(sourcePath, "SKILL.md");
+  const parsed = parseFrontmatter(await readFile8(skillPath, "utf8"));
+  const result = skillFrontmatterSchema.safeParse(parsed.data);
+  if (!result.success) {
+    const detail = result.error.issues.map((issue) => issue.message).join("; ");
+    throw new Error(`Invalid skill directory ${sourcePath}: ${detail}`);
+  }
+  if (result.data.name !== expectedName) {
+    throw new Error(`Skill directory name \`${expectedName}\` must match SKILL.md name \`${result.data.name}\`.`);
+  }
+  return await hashDirectory(sourcePath);
+}
+async function installObject(repoRoot, rawSource, options = {}) {
+  const ref = parseSourceRef(rawSource);
+  if (ref.kind === "registry") {
+    throw new Error(`Registry sources are not available yet: ${rawSource}`);
+  }
+  let objectPath;
+  let resolved;
+  let refLabel;
+  let sourcePath;
+  let cleanup;
+  if (ref.kind === "git") {
+    const within = options.objectPath ?? ref.objectPath;
+    if (!within) {
+      throw new Error(`Git source ${rawSource} needs an object path (e.g. github:owner/repo/skills/x.md).`);
+    }
+    objectPath = safeRepoPath(within);
+    refLabel = ref.ref;
+    const fetched = await fetchGitSource(ref);
+    sourcePath = path21.join(fetched.dir, objectPath);
+    resolved = fetched.sha;
+    cleanup = fetched.cleanup;
+  } else {
+    objectPath = options.objectPath ?? ref.path;
+    sourcePath = toRepoPath(repoRoot, objectPath);
+  }
+  try {
+    const kind = inferKind(objectPath, options.kind);
+    const name = deriveName(objectPath);
+    const scope = options.scope ?? "project";
+    const dirKey = KIND_DIR[kind];
+    const destDir = scope === "user" ? userObjectDir(dirKey, options.home) : projectObjectDir(repoRoot, dirKey);
+    let destPath;
+    let integrity;
+    const info = await stat7(sourcePath);
+    if (info.isDirectory()) {
+      if (kind !== "skill") {
+        throw new Error("Only skill objects may be installed from a directory.");
+      }
+      integrity = `sha256:${await validateSkillDirectory2(sourcePath, name)}`;
+      destPath = path21.join(destDir, name);
+      await mkdir8(destDir, { recursive: true });
+      await cp2(sourcePath, destPath, { recursive: true, force: true });
+    } else {
+      const content = await readFile8(sourcePath, "utf8");
+      destPath = path21.join(destDir, `${name}${objectExt(kind)}`);
+      await mkdir8(destDir, { recursive: true });
+      await writeFile7(destPath, content, "utf8");
+      integrity = `sha256:${hashContent(content)}`;
+    }
+    const entry = {
+      name,
+      kind,
+      sourceKind: ref.kind,
+      source: ref.raw,
+      objectPath,
+      ref: refLabel,
+      resolved,
+      integrity,
+      installedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    const lockPath = scope === "user" ? userLockPath(options.home) : projectLockPath(repoRoot);
+    const lock = await readLockFile(lockPath);
+    await writeLockFile(lockPath, upsertLockEntry(lock, entry));
+    return { name, kind, scope, path: destPath, entry };
+  } finally {
+    await cleanup?.();
+  }
+}
+
+// src/commands/install.ts
+var KINDS = /* @__PURE__ */ new Set(["skill", "tool", "rule"]);
+async function runInstall(repoRoot, source, options) {
+  if (options.kind && !KINDS.has(options.kind)) {
+    console.error(`Invalid --kind \`${options.kind}\` (expected skill, tool, or rule).`);
+    process.exitCode = 1;
+    return;
+  }
+  const scope = options.user ? "user" : "project";
+  try {
+    const installed = await installObject(repoRoot, source, {
+      kind: options.kind,
+      objectPath: options.path,
+      scope
+    });
+    console.log(`installed ${installed.kind} \`${installed.name}\` (${scope})`);
+    console.log(`  path: ${installed.path}`);
+    if (installed.entry.resolved) {
+      console.log(`  commit: ${installed.entry.resolved}`);
+    }
+    if (installed.entry.integrity) {
+      console.log(`  integrity: ${installed.entry.integrity}`);
+    }
+    if (installed.kind === "tool" && installed.entry.sourceKind !== "local") {
+      console.log("  note: installed tools are untrusted; add to `tools.allow` in harness.yaml to run.");
+    }
+    if (installed.kind === "skill" && installed.entry.sourceKind !== "local") {
+      console.log("  note: inspect external skills before trusting bundled scripts, assets, or allowed tools.");
+      if (scope === "project") {
+        console.log(`  inspect: threadroot skills inspect ${path22.relative(repoRoot, installed.path)}`);
+      }
+    }
+  } catch (error) {
+    console.error(`Install failed: ${error.message}`);
+    process.exitCode = 1;
+  }
+}
+
+// src/mcp/server.ts
+import readline from "readline";
+import { stdin as input, stdout as output } from "process";
+import { z as z4 } from "zod";
+
+// src/core/status.ts
+async function harnessStatus(repoRoot, options = {}) {
+  let harness;
+  try {
+    harness = await resolveHarness(repoRoot, { home: options.home });
+  } catch (error) {
+    if (error instanceof HarnessError) {
+      return { exists: false };
+    }
+    throw error;
+  }
+  const files = await compile(repoRoot, harness);
+  const drift = await detectDrift(repoRoot, files);
+  return {
+    exists: true,
+    manifest: {
+      name: harness.manifest.name,
+      profile: harness.manifest.profile,
+      adapters: harness.manifest.adapters,
+      toolsAllow: harness.manifest.tools.allow
+    },
+    counts: {
+      skills: harness.skills.length,
+      rules: harness.rules.length,
+      tools: harness.tools.length,
+      memory: harness.memory.length
+    },
+    drift
+  };
+}
+
+// src/mcp/server.ts
+function defineTool(spec) {
+  return spec;
+}
+var toolRegistry = [
+  defineTool({
+    name: "context",
+    description: "Return the task-relevant harness slice: ranked skills, rules, tools, and memory.",
+    inputSchema: objectSchema(
+      { task: { type: "string", description: "The coding task to assemble context for." } },
+      ["task"]
+    ),
+    args: z4.object({ task: z4.string().min(1) }),
+    run: async (repoRoot, args) => {
+      const harness = await loadHarnessOrNull(repoRoot);
+      if (!harness) {
+        return { note: "No harness found. Run `tr init` first." };
+      }
+      return assembleContext(repoRoot, args.task, { harness });
+    }
+  }),
+  defineTool({
+    name: "skills_list",
+    description: "List the skills defined in this repo's harness (name, when, tags).",
+    inputSchema: objectSchema({}),
+    args: z4.object({}),
+    run: async (repoRoot) => {
+      const harness = await loadHarnessOrNull(repoRoot);
+      if (!harness) {
+        return { skills: [], note: "No harness found. Run `tr init` first." };
+      }
+      return {
+        skills: harness.skills.map((skill) => ({
+          name: skill.name,
+          when: skill.frontmatter.when,
+          tags: skill.frontmatter.tags,
+          scope: skill.frontmatter.scope
+        }))
+      };
+    }
+  }),
+  defineTool({
+    name: "skills_get",
+    description: "Return a harness skill's full body and metadata by name.",
+    inputSchema: objectSchema({ name: { type: "string", description: "Skill name." } }, ["name"]),
+    args: z4.object({ name: z4.string().min(1) }),
+    run: async (repoRoot, args) => {
+      const harness = await loadHarnessOrNull(repoRoot);
+      const skill = harness?.skills.find((entry) => entry.name === args.name);
+      if (!skill) {
+        throw new Error(`Unknown skill: ${args.name}`);
+      }
+      return { name: skill.name, frontmatter: skill.frontmatter, body: skill.body, sourcePath: skill.sourcePath };
+    }
+  }),
+  defineTool({
+    name: "tools_list",
+    description: "List the executable tools defined in this repo's harness (name, inputs, confirm).",
+    inputSchema: objectSchema({}),
+    args: z4.object({}),
+    run: async (repoRoot) => {
+      const harness = await loadHarnessOrNull(repoRoot);
+      if (!harness) {
+        return { tools: [], note: "No harness found. Run `tr init` to create one." };
+      }
+      return {
+        tools: harness.tools.map((tool) => ({
+          name: tool.name,
+          description: tool.manifest.description,
+          scope: tool.manifest.scope,
+          confirm: tool.manifest.confirm,
+          kind: tool.manifest.run ? "shell" : "script",
+          input: tool.manifest.input
+        }))
+      };
+    }
+  }),
+  defineTool({
+    name: "tools_check",
+    description: "Run configured harness tool healthchecks without running primary tool actions.",
+    inputSchema: objectSchema({}),
+    args: z4.object({}),
+    run: async (repoRoot) => {
+      const harness = await loadHarnessOrNull(repoRoot);
+      if (!harness) {
+        return { checks: [], note: "No harness found. Run `tr init` first." };
+      }
+      return { checks: await Promise.all(harness.tools.map((tool) => checkToolHealth(repoRoot, tool))) };
+    }
+  }),
+  defineTool({
+    name: "tools_run",
+    description: "Execute a harness tool locally. Tools marked confirm:true require `confirm: true` after user approval.",
+    inputSchema: objectSchema(
+      {
+        name: { type: "string", description: "Tool name." },
+        input: { type: "object", description: "Tool inputs as key/value pairs.", additionalProperties: true },
+        confirm: { type: "boolean", description: "Confirm running a tool that requires confirmation." }
+      },
+      ["name"]
+    ),
+    args: z4.object({
+      name: z4.string().min(1),
+      input: z4.record(z4.unknown()).optional(),
+      confirm: z4.boolean().optional()
+    }),
+    run: async (repoRoot, args) => {
+      const outcome = await runTool(repoRoot, {
+        name: args.name,
+        input: args.input,
+        confirmed: args.confirm
+      });
+      if (outcome.status === "blocked") {
+        return { ok: false, blocked: outcome.reason, message: outcome.message };
+      }
+      const { result } = outcome;
+      return {
+        ok: result.ok,
+        exitCode: result.exitCode,
+        timedOut: result.timedOut,
+        durationMs: result.durationMs,
+        command: result.command,
+        stdout: result.stdout,
+        stderr: result.stderr
+      };
+    }
+  }),
+  defineTool({
+    name: "tools_create",
+    description: "Author a new harness tool (writes a validated manifest; never executes). Agent-created tools default to confirm:true.",
+    inputSchema: objectSchema(
+      {
+        name: { type: "string", description: "Tool name (lowercase, hyphenated)." },
+        description: { type: "string", description: "What the tool does." },
+        run: { type: "string", description: "Shell command (use {{param}} for inputs)." },
+        script: { type: "string", description: "Harness-relative script path (alternative to run)." },
+        confirm: { type: "boolean", description: "Ask before running. Defaults to true for agents." },
+        scope: { type: "string", enum: ["user", "project"], description: "Tool scope." },
+        input: {
+          type: "object",
+          description: "Declared inputs (name -> {type, description, default}).",
+          additionalProperties: true
+        }
+      },
+      ["name", "description"]
+    ),
+    args: z4.object({
+      name: z4.string().min(1),
+      description: z4.string().min(1),
+      run: z4.string().optional(),
+      script: z4.string().optional(),
+      confirm: z4.boolean().optional(),
+      scope: z4.enum(["user", "project"]).optional(),
+      input: z4.record(z4.unknown()).optional()
+    }),
+    run: async (repoRoot, args) => {
+      const created = await createTool(
+        repoRoot,
+        {
+          name: args.name,
+          description: args.description,
+          run: args.run,
+          script: args.script,
+          confirm: args.confirm,
+          scope: args.scope,
+          input: args.input
+        },
+        { actor: "agent" }
+      );
+      return { path: created.path, scope: created.scope, tool: created.manifest };
+    }
+  }),
+  defineTool({
+    name: "tools_detect",
+    description: "Propose starter tools from the repo's existing command surface (scripts, Make/just targets).",
+    inputSchema: objectSchema({}),
+    args: z4.object({}),
+    run: async (repoRoot) => {
+      const harness = await loadHarnessOrNull(repoRoot);
+      const profile = harness?.manifest.profile ?? "empty";
+      return { candidates: await detectToolCandidates(repoRoot, profile) };
+    }
+  }),
+  defineTool({
+    name: "connections_list",
+    description: "List local CLI connections defined in this repo's harness.",
+    inputSchema: objectSchema({}),
+    args: z4.object({}),
+    run: async (repoRoot) => {
+      const harness = await loadHarnessOrNull(repoRoot);
+      if (!harness) {
+        return { connections: [], note: "No harness found. Run `tr init` first." };
+      }
+      return {
+        connections: harness.connections.map((connection) => ({
+          name: connection.name,
+          provider: connection.manifest.provider,
+          command: connection.manifest.command,
+          profile: connection.manifest.profile,
+          risk: connection.manifest.risk,
+          confirm: connection.manifest.confirm,
+          healthcheck: Boolean(connection.manifest.healthcheck)
+        }))
+      };
+    }
+  }),
+  defineTool({
+    name: "connections_check",
+    description: "Check local CLI connections and their configured healthchecks.",
+    inputSchema: objectSchema({}),
+    args: z4.object({}),
+    run: (repoRoot) => checkConnections(repoRoot)
+  }),
+  defineTool({
+    name: "memory_read",
+    description: "Read durable harness memory. Returns one type, or all when no type is given.",
+    inputSchema: objectSchema({
+      type: { type: "string", description: "Memory type (project, repo-map, current-focus, handoff, pitfalls)." }
+    }),
+    args: z4.object({ type: z4.string().optional() }),
+    run: async (repoRoot, args) => {
+      if (args.type) {
+        return { type: args.type, body: await readMemory(repoRoot, args.type) };
+      }
+      const harness = await loadHarnessOrNull(repoRoot);
+      return { memory: (harness?.memory ?? []).map((entry) => ({ type: entry.type, body: entry.body })) };
+    }
+  }),
+  defineTool({
+    name: "memory_append",
+    description: "Append a durable note to a harness memory file (creates it if missing).",
+    inputSchema: objectSchema(
+      {
+        type: { type: "string", description: "Memory type (project, repo-map, current-focus, handoff, pitfalls)." },
+        note: { type: "string", description: "The note to append." }
+      },
+      ["type", "note"]
+    ),
+    args: z4.object({ type: z4.string().min(1), note: z4.string().min(1) }),
+    run: (repoRoot, args) => appendMemory(repoRoot, args.type, args.note)
+  }),
+  defineTool({
+    name: "status",
+    description: "Return harness state: manifest, object counts, and drift between canonical and compiled outputs.",
+    inputSchema: objectSchema({}),
+    args: z4.object({}),
+    run: (repoRoot) => harnessStatus(repoRoot)
+  }),
+  defineTool({
+    name: "doctor",
+    description: "Check harness validity, compiled output health, MCP hints, and tool trust.",
+    inputSchema: objectSchema({}),
+    args: z4.object({}),
+    run: (repoRoot) => doctor(repoRoot)
+  })
+];
+var tools = toolRegistry.map(({ name, description, inputSchema }) => ({ name, description, inputSchema }));
+async function runMcpServer(repoRoot) {
+  const lines = readline.createInterface({ input, crlfDelay: Infinity });
+  for await (const line of lines) {
+    if (!line.trim()) {
+      continue;
+    }
+    const request = parseRequest(line);
+    if (!request) {
+      write({ jsonrpc: "2.0", id: null, error: { code: -32700, message: "Parse error" } });
+      continue;
+    }
+    const response = await handleMessage(repoRoot, request);
+    if (response) {
+      write(response);
+    }
+  }
+}
+async function handleMessage(repoRoot, request) {
+  try {
+    if (request.method === "initialize") {
+      return resultResponse(request, {
+        protocolVersion: "2024-11-05",
+        serverInfo: { name: "threadroot", version: "0.1.0" },
+        capabilities: { tools: {} }
+      });
+    }
+    if (request.method === "notifications/initialized") {
+      return void 0;
+    }
+    if (request.method === "tools/list") {
+      return resultResponse(request, { tools });
+    }
+    if (request.method === "tools/call") {
+      const params = request.params;
+      const result = await callTool(repoRoot, params?.name, params?.arguments ?? {});
+      return resultResponse(request, {
+        content: [{ type: "text", text: typeof result === "string" ? result : JSON.stringify(result, null, 2) }]
+      });
+    }
+    return errorResponse(request, -32601, `Unknown method: ${request.method ?? "<missing>"}`);
+  } catch (error) {
+    return errorResponse(request, -32e3, error instanceof Error ? error.message : String(error));
+  }
+}
+async function callTool(repoRoot, name, rawArgs) {
+  const tool = toolRegistry.find((entry) => entry.name === name);
+  if (!tool) {
+    throw new Error(`Unknown tool: ${name ?? "<missing>"}`);
+  }
+  const parsed = tool.args.safeParse(rawArgs);
+  if (!parsed.success) {
+    throw new Error(`Invalid arguments for ${tool.name}: ${formatZodIssues(parsed.error)}`);
+  }
+  return tool.run(repoRoot, parsed.data);
+}
+function formatZodIssues(error) {
+  return error.issues.map((issue) => `${issue.path.join(".") || "(root)"} ${issue.message}`).join("; ");
+}
+async function loadHarnessOrNull(repoRoot) {
+  try {
+    return await resolveHarness(repoRoot);
+  } catch (error) {
+    if (error instanceof HarnessError) {
+      return null;
+    }
+    throw error;
+  }
+}
+function objectSchema(properties, required = []) {
+  return {
+    type: "object",
+    properties,
+    required,
+    additionalProperties: false
+  };
+}
+function parseRequest(line) {
+  try {
+    return JSON.parse(line);
+  } catch {
+    return void 0;
+  }
+}
+function resultResponse(request, result) {
+  if (request.id === void 0) {
+    return void 0;
+  }
+  return { jsonrpc: "2.0", id: request.id, result };
+}
+function errorResponse(request, code, message) {
+  return { jsonrpc: "2.0", id: request.id ?? null, error: { code, message } };
+}
+function write(payload) {
+  output.write(`${JSON.stringify(payload)}
+`);
+}
+
+// src/core/mcp-setup.ts
+function mcpSetupGuide(input2) {
+  const agent = parseAgent(input2.agent);
+  const command = input2.executable ?? process.execPath;
+  const scriptPath = input2.scriptPath ?? process.argv[1] ?? "threadroot";
+  const nodeConfig = {
+    mcpServers: {
+      threadroot: {
+        command,
+        args: [scriptPath, "mcp"],
+        cwd: input2.repoRoot
+      }
+    }
+  };
+  const installedConfig = {
+    mcpServers: {
+      threadroot: {
+        command: "threadroot",
+        args: ["mcp"],
+        cwd: input2.repoRoot
+      }
+    }
+  };
+  return `Threadroot MCP setup
+
+Project root:
+${input2.repoRoot}
+
+What "waiting" means:
+MCP tools appear only after your coding-agent client is configured to launch this stdio server and the agent surface reloads or starts a new session.
+
+Server command:
+\`\`\`bash
+threadroot mcp
+\`\`\`
+
+Source checkout fallback:
+\`\`\`bash
+${command} ${scriptPath} mcp
+\`\`\`
+
+Generic MCP JSON for installed Threadroot:
+\`\`\`json
+${JSON.stringify(installedConfig, null, 2)}
+\`\`\`
+
+Generic MCP JSON for this checkout:
+\`\`\`json
+${JSON.stringify(nodeConfig, null, 2)}
+\`\`\`
+
+Agent notes:
+${agentNotes(agent)}
+
+Pasteable agent bootstrap prompt:
+\`\`\`text
+${agentLaunchPrompt(input2.repoRoot, `${command} ${scriptPath}`)}
+\`\`\`
+`;
+}
+function agentLaunchPrompt(repoRoot, localCommand = "node /path/to/threadroot/dist/index.js") {
+  return `You are setting up Threadroot in this repository.
+
+Repository:
+${repoRoot}
+
+Goal:
+Initialize Threadroot so this repo has portable AI-agent instructions, durable memory, curated skills, executable tools, and vendor-specific adapter files generated from one canonical harness.
+
+Rules:
+- Prefer deterministic CLI commands.
+- Do not overwrite user-owned files without checking Threadroot status/diff.
+- Keep context small. Use Threadroot context output before reading broad project files.
+
+Steps:
+1. Check whether Threadroot is available with \`threadroot --version\`.
+2. If it is not available, try \`npm exec threadroot -- --help\` or \`pnpm dlx threadroot --help\`. If this is a local checkout, use \`${localCommand} --help\`.
+3. Run \`threadroot status\` to check whether a harness already exists.
+4. If no harness exists, run \`threadroot init\`. Use \`--no-import\` only when the user explicitly wants a blank-slate harness.
+5. Run \`threadroot status\` again.
+6. If status reports drift, run \`threadroot diff\` and summarize the drift before changing generated files.
+7. Run \`threadroot context "current task"\` with the user's actual task to find relevant skills, rules, tools, and memory.
+8. If project-local MCP config is useful, run \`threadroot mcp setup --write\` and tell the user to reload their agent surface.
+
+Final response:
+Say exactly:
+"Success: Threadroot is initialized. Run \`threadroot status\` or \`threadroot context "<task>"\` to use it."
+
+If using a local checkout instead of an installed package, say:
+"Success: Threadroot is initialized. Run \`${localCommand} status\` or \`${localCommand} context "<task>"\` to use it."`;
+}
+function parseAgent(value) {
+  if (value === "codex" || value === "copilot" || value === "cursor" || value === "claude" || value === "generic") {
+    return value;
+  }
+  return "all";
+}
+function agentNotes(agent) {
+  const generic = [
+    "- Add an MCP server named `threadroot`.",
+    '- Use command `threadroot` with args `["mcp"]` when Threadroot is installed.',
+    "- Use the source checkout fallback when testing this repo before publishing.",
+    "- Set cwd to the project root, not to the Threadroot package source unless those are the same project."
+  ];
+  const notes = {
+    generic,
+    codex: [
+      ...generic,
+      "- In Codex, configure the MCP server in the MCP/client configuration available to your Codex environment.",
+      "- MCP tools will not appear inside an already-running session until that environment has loaded the server."
+    ],
+    copilot: [
+      ...generic,
+      "- In VS Code/Copilot-capable MCP clients, add the JSON server config to the workspace or user MCP configuration.",
+      "- Restart or reload the agent surface after adding the server."
+    ],
+    cursor: [
+      ...generic,
+      "- In Cursor, add the JSON server config to Cursor's MCP settings for this project or user profile.",
+      "- Reload the agent surface after saving the MCP config."
+    ],
+    claude: [
+      ...generic,
+      '- In Claude MCP clients, add a local stdio server with command `threadroot` and args `["mcp"]`.',
+      "- Restart the client session after adding the server."
+    ]
+  };
+  if (agent === "all") {
+    return [
+      "Generic:",
+      ...generic,
+      "",
+      "Codex:",
+      ...notes.codex,
+      "",
+      "Copilot / VS Code:",
+      ...notes.copilot,
+      "",
+      "Cursor:",
+      ...notes.cursor,
+      "",
+      "Claude:",
+      ...notes.claude
+    ].join("\n");
+  }
+  return notes[agent].join("\n");
+}
+
+// src/core/mcp-config.ts
+import { mkdir as mkdir9, readFile as readFile9, writeFile as writeFile8 } from "fs/promises";
+import path23 from "path";
+var TARGETS = [
+  { agent: "copilot", file: path23.join(".vscode", "mcp.json"), key: "servers" },
+  { agent: "cursor", file: path23.join(".cursor", "mcp.json"), key: "mcpServers" },
+  { agent: "claude", file: ".mcp.json", key: "mcpServers" }
+];
+function mcpServerEntry(command, scriptPath) {
+  return scriptPath ? { command, args: [scriptPath, "mcp"] } : { command, args: ["mcp"] };
+}
+async function mergeConfig(filePath, key, entry) {
+  let config = {};
+  try {
+    const raw = await readFile9(filePath, "utf8");
+    const parsed = JSON.parse(raw);
+    if (parsed && typeof parsed === "object") {
+      config = parsed;
+    }
+  } catch (error) {
+    if (error.code !== "ENOENT") {
+      throw new Error(`Refusing to overwrite unparseable ${filePath}: ${error.message}`);
+    }
+  }
+  const servers = config[key] && typeof config[key] === "object" ? config[key] : {};
+  servers.threadroot = { ...entry };
+  config[key] = servers;
+  await mkdir9(path23.dirname(filePath), { recursive: true });
+  await writeFile8(filePath, `${JSON.stringify(config, null, 2)}
+`, "utf8");
+}
+async function writeProjectMcpConfigs(input2) {
+  const agents = input2.agents;
+  const targets = agents ? TARGETS.filter((target) => agents.includes(target.agent)) : TARGETS;
+  const written = [];
+  for (const target of targets) {
+    const filePath = path23.join(input2.repoRoot, target.file);
+    await mergeConfig(filePath, target.key, input2.entry);
+    written.push(target.file);
+  }
+  return {
+    written,
+    notes: [
+      "Codex reads ~/.codex/config.toml (global) \u2014 add a [mcp_servers.threadroot] entry manually.",
+      "Reload each agent after writing config for the server to appear."
+    ]
+  };
+}
+
+// src/commands/mcp.ts
+async function runMcp(repoRoot) {
+  await runMcpServer(repoRoot);
+}
+async function runMcpSetup(repoRoot, options) {
+  if (options.write) {
+    const command = process.execPath;
+    const scriptPath = process.argv[1];
+    const entry = mcpServerEntry(command, scriptPath);
+    const result = await writeProjectMcpConfigs({ repoRoot, entry });
+    console.log("Wrote project MCP config:");
+    for (const file of result.written) {
+      console.log(`- ${file}`);
+    }
+    for (const note of result.notes) {
+      console.log(`note: ${note}`);
+    }
+    return;
+  }
+  console.log(mcpSetupGuide({ repoRoot, agent: options.agent }));
+}
+
+// src/commands/memory.ts
+async function runMemoryRead(repoRoot, type) {
+  const body = await readMemory(repoRoot, type);
+  if (body === null) {
+    console.log(`No ${type} memory yet.`);
+    return;
+  }
+  console.log(body);
+}
+async function runMemoryAppend(repoRoot, type, note) {
+  const result = await appendMemory(repoRoot, type, note);
+  console.log(`Appended to ${result.scope} ${result.type} memory (${result.path}).`);
+}
+async function runRemember(repoRoot, note, options = {}) {
+  await runMemoryAppend(repoRoot, options.type ?? "handoff", note);
+}
+
+// src/commands/skills.ts
+async function runSkillsList(repoRoot) {
+  try {
+    const harness = await resolveHarness(repoRoot);
+    if (harness.skills.length === 0) {
+      console.log("No skills defined. Add folder skills under `.threadroot/skills/<name>/SKILL.md`.");
+      return;
+    }
+    for (const skill of harness.skills) {
+      console.log(`${skill.name}  [${skill.origin}]  - ${skill.frontmatter.description}`);
+    }
+  } catch (error) {
+    if (error instanceof HarnessError) {
+      console.log("No harness found. Run `tr init` first.");
+      return;
+    }
+    throw error;
+  }
+}
+async function runSkillsValidate(repoRoot, options = {}) {
+  const report = options.path ? await validateSkillPath(toRepoPath(repoRoot, options.path)) : await validateSkills(repoRoot);
+  if (report.findings.length === 0) {
+    console.log("Skills valid.");
+    return;
+  }
+  const errors = report.findings.filter((entry) => entry.severity === "error").length;
+  const warnings = report.findings.filter((entry) => entry.severity === "warning").length;
+  console.log(`Skills validation: ${errors} error(s), ${warnings} warning(s)`);
+  for (const finding3 of report.findings) {
+    console.log(`- ${finding3.severity} ${finding3.skill}: ${finding3.message} (${finding3.path})`);
+  }
+  if (!report.ok) {
+    process.exitCode = 1;
+  }
+}
+async function runSkillsInspect(repoRoot, targetPath) {
+  const inspection = await inspectSkillPath(toRepoPath(repoRoot, targetPath));
+  console.log(`${inspection.name}`);
+  console.log(`description: ${inspection.description}`);
+  console.log(`path: ${inspection.path}`);
+  console.log(`references: ${inspection.references.length > 0 ? inspection.references.join(", ") : "none"}`);
+  console.log(`scripts: ${inspection.scripts.length > 0 ? inspection.scripts.join(", ") : "none"}`);
+  console.log(`assets: ${inspection.assets.length > 0 ? inspection.assets.join(", ") : "none"}`);
+  console.log(`evals: ${inspection.evals.length > 0 ? inspection.evals.join(", ") : "none"}`);
+  if (inspection.allowedTools) {
+    const tools2 = Array.isArray(inspection.allowedTools) ? inspection.allowedTools.join(", ") : inspection.allowedTools;
+    console.log(`allowed-tools: ${tools2}`);
+  }
+}
+
+// src/commands/status.ts
+async function runStatus(repoRoot) {
+  const status = await harnessStatus(repoRoot);
+  if (!status.exists) {
+    console.log("No harness found. Run `tr init` first.");
+    return;
+  }
+  console.log(`harness: ${status.manifest.name} (${status.manifest.profile})`);
+  console.log(`adapters: ${status.manifest.adapters.join(", ")}`);
+  console.log(
+    `objects: ${status.counts.skills} skills, ${status.counts.rules} rules, ${status.counts.tools} tools, ${status.counts.memory} memory`
+  );
+  const changed = status.drift.filter((entry) => entry.status !== "unchanged");
+  if (changed.length === 0) {
+    console.log("compiled outputs: up to date");
+    return;
+  }
+  console.log("compiled outputs:");
+  for (const entry of changed) {
+    console.log(`- ${entry.status}: ${entry.path}`);
+  }
+}
+
+// src/core/packs/index.ts
+import { cp as cp3, mkdir as mkdir10, readFile as readFile10, readdir as readdir6, stat as stat8 } from "fs/promises";
+import path24 from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+import { parse as parseYaml3 } from "yaml";
+import { z as z5 } from "zod";
+var packManifestSchema = z5.object({
+  name: z5.string().min(1),
+  version: z5.literal(1),
+  description: z5.string().min(1),
+  skills: z5.array(z5.string()).default([]),
+  tools: z5.array(z5.string()).default([]),
+  rules: z5.array(z5.string()).default([]),
+  connections: z5.array(z5.string()).default([])
+});
+var DIST_DIR2 = path24.dirname(fileURLToPath2(import.meta.url));
+var PACKAGE_ROOT_FROM_BUNDLE2 = path24.resolve(DIST_DIR2, "..");
+var PACKAGE_ROOT_FROM_DIST2 = path24.resolve(DIST_DIR2, "../../..");
+var PACKAGE_ROOT_FROM_SRC2 = path24.resolve(DIST_DIR2, "../../../..");
+var PACK_CANDIDATES = [
+  path24.join(PACKAGE_ROOT_FROM_BUNDLE2, "packs"),
+  path24.join(PACKAGE_ROOT_FROM_DIST2, "packs"),
+  path24.join(PACKAGE_ROOT_FROM_SRC2, "packs")
+];
+async function exists5(target) {
+  try {
+    await stat8(target);
+    return true;
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return false;
+    }
+    throw error;
+  }
+}
+async function firstExisting(candidates) {
+  for (const candidate of candidates) {
+    if (await isPackRoot(candidate)) {
+      return candidate;
+    }
+  }
+  return void 0;
+}
+async function bundledPacksDir() {
+  return firstExisting(PACK_CANDIDATES);
+}
+async function isPackRoot(candidate) {
+  let entries;
+  try {
+    entries = await readdir6(candidate, { withFileTypes: true });
+  } catch {
+    return false;
+  }
+  for (const entry of entries) {
+    if (entry.isDirectory() && await exists5(path24.join(candidate, entry.name, "pack.yaml"))) {
+      return true;
+    }
+  }
+  return false;
+}
+function safeRelative(ref) {
+  const normalized = path24.normalize(ref);
+  if (path24.isAbsolute(normalized) || normalized === ".." || normalized.startsWith(`..${path24.sep}`)) {
+    throw new Error(`Unsafe pack reference: ${ref}`);
+  }
+  return normalized;
+}
+async function readPackManifest(packDir) {
+  const file = path24.join(packDir, "pack.yaml");
+  const parsed = packManifestSchema.safeParse(parseYaml3(await readFile10(file, "utf8")));
+  if (!parsed.success) {
+    const detail = parsed.error.issues.map((issue) => issue.message).join("; ");
+    throw new Error(`Invalid pack manifest ${file}: ${detail}`);
+  }
+  return parsed.data;
+}
+async function packDirFor(repoRoot, nameOrPath) {
+  if (path24.isAbsolute(nameOrPath)) {
+    return nameOrPath;
+  }
+  if (nameOrPath.startsWith(".") || nameOrPath.includes("/") || nameOrPath.includes("\\")) {
+    return toRepoPath(repoRoot, nameOrPath);
+  }
+  const bundled = await bundledPacksDir();
+  if (bundled) {
+    return path24.join(bundled, nameOrPath);
+  }
+  return toRepoPath(repoRoot, path24.join("packs", nameOrPath));
+}
+async function directFiles(dir, ext) {
+  try {
+    const entries = await readdir6(dir, { withFileTypes: true });
+    return entries.filter((entry) => entry.isFile() && entry.name.endsWith(ext)).map((entry) => path24.join(dir, entry.name)).sort();
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return [];
+    }
+    throw error;
+  }
+}
+async function skillEntries(dir) {
+  try {
+    const entries = await readdir6(dir, { withFileTypes: true });
+    const result = [];
+    for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+      const full = path24.join(dir, entry.name);
+      if (entry.isFile() && entry.name.endsWith(".md")) {
+        result.push(full);
+      }
+      if (entry.isDirectory() && await exists5(path24.join(full, "SKILL.md"))) {
+        result.push(full);
+      }
+    }
+    return result;
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return [];
+    }
+    throw error;
+  }
+}
+async function collectObjects(packDir, manifest) {
+  async function resolveRef(ref) {
+    const safe = safeRelative(ref);
+    const local = path24.resolve(packDir, safe);
+    if (await exists5(local)) {
+      return local;
+    }
+    return path24.resolve(packDir, "..", "..", safe);
+  }
+  return {
+    skills: [
+      ...await Promise.all(manifest.skills.map(resolveRef)),
+      ...await skillEntries(path24.join(packDir, "skills"))
+    ],
+    tools: [
+      ...await Promise.all(manifest.tools.map(resolveRef)),
+      ...await directFiles(path24.join(packDir, "tools"), ".yaml")
+    ],
+    rules: [
+      ...await Promise.all(manifest.rules.map(resolveRef)),
+      ...await directFiles(path24.join(packDir, "rules"), ".md")
+    ],
+    connections: [
+      ...await Promise.all(manifest.connections.map(resolveRef)),
+      ...await directFiles(path24.join(packDir, "connections"), ".yaml")
+    ]
+  };
+}
+function baseName(source) {
+  const parsed = path24.basename(source) === "SKILL.md" ? path24.dirname(source) : source;
+  return path24.basename(parsed, path24.extname(parsed));
+}
+async function listPacks(repoRoot) {
+  const dirs = [toRepoPath(repoRoot, "packs"), await bundledPacksDir()].filter((dir) => Boolean(dir));
+  const seen = /* @__PURE__ */ new Set();
+  const packs = [];
+  for (const root of dirs) {
+    let entries;
+    try {
+      entries = await readdir6(root, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (!entry.isDirectory() || seen.has(entry.name)) {
+        continue;
+      }
+      const packDir = path24.join(root, entry.name);
+      if (!await exists5(path24.join(packDir, "pack.yaml"))) {
+        continue;
+      }
+      seen.add(entry.name);
+      packs.push(await inspectPack(repoRoot, packDir));
+    }
+  }
+  return packs.sort((a, b) => a.name.localeCompare(b.name));
+}
+async function inspectPack(repoRoot, nameOrPath) {
+  const packDir = await packDirFor(repoRoot, nameOrPath);
+  const manifest = await readPackManifest(packDir);
+  const objects = await collectObjects(packDir, manifest);
+  return {
+    name: manifest.name,
+    description: manifest.description,
+    path: packDir,
+    skills: objects.skills.map(baseName),
+    tools: objects.tools.map(baseName),
+    rules: objects.rules.map(baseName),
+    connections: objects.connections.map(baseName)
+  };
+}
+async function validateProse(file, kind) {
+  const target = path24.basename(file) === "SKILL.md" ? file : file;
+  const content = await readFile10(target, "utf8");
+  const parsed = parseFrontmatter(content);
+  const schema = kind === "skill" ? skillFrontmatterSchema : ruleFrontmatterSchema;
+  schema.parse(parsed.data);
+}
+async function validateYaml(file, kind) {
+  const content = await readFile10(file, "utf8");
+  const schema = kind === "tool" ? toolManifestSchema : connectionManifestSchema;
+  schema.parse(parseYaml3(content));
+}
+async function validatePack(repoRoot, nameOrPath) {
+  const findings = [];
+  try {
+    const packDir = await packDirFor(repoRoot, nameOrPath);
+    const manifest = await readPackManifest(packDir);
+    const objects = await collectObjects(packDir, manifest);
+    for (const skill of objects.skills) {
+      await validateProse(path24.basename(skill) === "SKILL.md" ? skill : path24.join(skill, "SKILL.md"), "skill");
+    }
+    for (const rule of objects.rules) await validateProse(rule, "rule");
+    for (const tool of objects.tools) await validateYaml(tool, "tool");
+    for (const connection of objects.connections) await validateYaml(connection, "connection");
+    if (Object.values(objects).every((items) => items.length === 0)) {
+      findings.push({ severity: "warning", message: "Pack does not include any objects." });
+    }
+  } catch (error) {
+    findings.push({ severity: "error", message: error instanceof Error ? error.message : String(error) });
+  }
+  return { ok: !findings.some((finding3) => finding3.severity === "error"), findings };
+}
+async function copyObject(source, destDir) {
+  const info = await stat8(source);
+  const name = baseName(source);
+  const dest = info.isDirectory() ? path24.join(destDir, name) : path24.join(destDir, path24.basename(source));
+  await mkdir10(destDir, { recursive: true });
+  await cp3(source, dest, { recursive: true, force: true });
+  return dest;
+}
+async function installPack(repoRoot, nameOrPath) {
+  const validation = await validatePack(repoRoot, nameOrPath);
+  if (!validation.ok) {
+    throw new Error(validation.findings.map((finding3) => finding3.message).join("; "));
+  }
+  const packDir = await packDirFor(repoRoot, nameOrPath);
+  const manifest = await readPackManifest(packDir);
+  const objects = await collectObjects(packDir, manifest);
+  await Promise.all([
+    ...objects.skills.map((source) => copyObject(source, projectObjectDir(repoRoot, "skills"))),
+    ...objects.tools.map((source) => copyObject(source, projectObjectDir(repoRoot, "tools"))),
+    ...objects.rules.map((source) => copyObject(source, projectObjectDir(repoRoot, "rules"))),
+    ...objects.connections.map((source) => copyObject(source, projectObjectDir(repoRoot, "connections")))
+  ]);
+  return inspectPack(repoRoot, packDir);
+}
+
+// src/commands/packs.ts
+function printList(label, values) {
+  console.log(`${label}: ${values.length > 0 ? values.join(", ") : "none"}`);
+}
+async function runPacksList(repoRoot) {
+  const packs = await listPacks(repoRoot);
+  if (packs.length === 0) {
+    console.log("No packs found.");
+    return;
+  }
+  for (const pack of packs) {
+    console.log(`${pack.name} - ${pack.description}`);
+  }
+}
+async function runPacksInspect(repoRoot, nameOrPath) {
+  const pack = await inspectPack(repoRoot, nameOrPath);
+  console.log(pack.name);
+  console.log(`description: ${pack.description}`);
+  console.log(`path: ${pack.path}`);
+  printList("skills", pack.skills);
+  printList("tools", pack.tools);
+  printList("rules", pack.rules);
+  printList("connections", pack.connections);
+}
+async function runPacksValidate(repoRoot, nameOrPath) {
+  const report = await validatePack(repoRoot, nameOrPath);
+  if (report.findings.length === 0) {
+    console.log("Pack valid.");
+    return;
+  }
+  for (const finding3 of report.findings) {
+    console.log(`${finding3.severity}: ${finding3.message}`);
+  }
+  if (!report.ok) {
+    process.exitCode = 1;
+  }
+}
+async function runPacksInstall(repoRoot, nameOrPath) {
+  const pack = await installPack(repoRoot, nameOrPath);
+  console.log(`Installed pack \`${pack.name}\`.`);
+  printList("skills", pack.skills);
+  printList("tools", pack.tools);
+  printList("rules", pack.rules);
+  printList("connections", pack.connections);
+}
+
+// src/commands/tools.ts
+function parseInputs(pairs = []) {
+  const input2 = {};
+  for (const pair of pairs) {
+    const eq = pair.indexOf("=");
+    if (eq === -1) {
+      throw new Error(`Invalid --input \`${pair}\`. Expected key=value.`);
+    }
+    input2[pair.slice(0, eq)] = pair.slice(eq + 1);
+  }
+  return input2;
+}
+async function runToolsList(repoRoot) {
+  let harness;
+  try {
+    harness = await resolveHarness(repoRoot);
+  } catch (error) {
+    if (error instanceof HarnessError) {
+      console.log("No harness found. Run `tr init` first.");
+      return;
+    }
+    throw error;
+  }
+  if (harness.tools.length === 0) {
+    console.log("No tools defined. Add one with `tr tools add` or `tr tools detect`.");
+    return;
+  }
+  for (const tool of harness.tools) {
+    const flags = [
+      tool.manifest.risk,
+      tool.manifest.confirm ? "confirm" : null,
+      tool.manifest.connection ? `connection:${tool.manifest.connection}` : null,
+      tool.manifest.healthcheck ? "healthcheck" : null,
+      tool.manifest.run ? "shell" : "script"
+    ].filter(Boolean).join(", ");
+    console.log(`${tool.name}  [${flags}]  - ${tool.manifest.description}`);
+  }
+}
+async function runToolRun(repoRoot, name, options) {
+  const outcome = await runTool(repoRoot, {
+    name,
+    input: parseInputs(options.input),
+    confirmed: options.yes === true,
+    timeoutMs: options.timeout ? Number(options.timeout) : void 0
+  });
+  if (outcome.status === "blocked") {
+    if (outcome.reason === "needs-confirmation") {
+      console.log(`${outcome.message} Re-run with --yes to confirm.`);
+    } else {
+      console.log(outcome.message);
+    }
+    process.exitCode = 1;
+    return;
+  }
+  const { result } = outcome;
+  if (result.stdout) {
+    process.stdout.write(result.stdout.endsWith("\n") ? result.stdout : `${result.stdout}
+`);
+  }
+  if (result.stderr) {
+    process.stderr.write(result.stderr.endsWith("\n") ? result.stderr : `${result.stderr}
+`);
+  }
+  if (result.timedOut) {
+    console.error(`Tool \`${name}\` timed out after ${result.durationMs}ms.`);
+  }
+  if (!result.ok) {
+    process.exitCode = result.exitCode ?? 1;
+  }
+}
+async function runToolsAdd(repoRoot, name, options) {
+  if (!options.description) {
+    throw new Error("`tr tools add` requires --description.");
+  }
+  if (!options.run && !options.script) {
+    throw new Error("Provide either --run <command> or --script <path>.");
+  }
+  const created = await createTool(
+    repoRoot,
+    {
+      name,
+      description: options.description,
+      run: options.run,
+      script: options.script,
+      risk: options.risk,
+      connection: options.connection,
+      healthcheck: options.healthcheck ? { run: options.healthcheck, expectExitCode: 0 } : void 0,
+      confirm: options.confirm,
+      scope: options.scope
+    },
+    { actor: "human", force: options.force }
+  );
+  console.log(`Created ${created.scope} tool \`${name}\` at ${created.path}.`);
+}
+function deriveNameFromCommand(command) {
+  const first = command.trim().split(/\s+/)[0] ?? "tool";
+  return first.toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "") || "tool";
+}
+async function runToolsCreate(repoRoot, options) {
+  const run2 = options.run ?? options.fromCommand;
+  const name = options.fromCommand ? deriveNameFromCommand(options.fromCommand) : void 0;
+  if (!name) {
+    throw new Error("`tr tools create` currently requires --from-command <command>.");
+  }
+  await runToolsAdd(repoRoot, name, {
+    ...options,
+    run: run2,
+    description: options.description ?? `Run \`${run2}\`.`,
+    healthcheck: options.healthcheck ?? run2,
+    confirm: options.confirm ?? options.risk === "high"
+  });
+}
+async function runToolsCheck(repoRoot) {
+  const harness = await resolveHarness(repoRoot);
+  if (harness.tools.length === 0) {
+    console.log("No tools defined.");
+    return;
+  }
+  let failures = 0;
+  for (const tool of harness.tools) {
+    const check = await checkToolHealth(repoRoot, tool);
+    if (check.status === "ok") {
+      console.log(`${tool.name}: ok`);
+    } else if (check.status === "skipped") {
+      console.log(`${tool.name}: skipped - ${check.message}`);
+    } else {
+      failures += 1;
+      console.log(`${tool.name}: error - ${check.message}`);
+    }
+  }
+  if (failures > 0) {
+    process.exitCode = 1;
+  }
+}
+async function runToolsDetect(repoRoot) {
+  let profile;
+  try {
+    profile = (await resolveHarness(repoRoot)).manifest.profile;
+  } catch (error) {
+    if (!(error instanceof HarnessError)) {
+      throw error;
+    }
+  }
+  const candidates = await detectToolCandidates(repoRoot, profile ?? "empty");
+  if (candidates.length === 0) {
+    console.log("No starter tools detected.");
+    return;
+  }
+  console.log("Proposed starter tools (materialize with `tr tools add`):");
+  for (const candidate of candidates) {
+    const confirm = candidate.confirm ? " (confirm)" : "";
+    const healthcheck = candidate.healthcheck ? ", healthcheck suggested" : "";
+    console.log(`- ${candidate.name}${confirm}: ${candidate.run}  [${candidate.source}, ${candidate.risk}${healthcheck}]`);
+  }
+}
+
+// src/commands/connections.ts
+async function runConnectionsList(repoRoot) {
+  let harness;
+  try {
+    harness = await resolveHarness(repoRoot);
+  } catch (error) {
+    if (error instanceof HarnessError) {
+      console.log("No harness found. Run `tr init` first.");
+      return;
+    }
+    throw error;
+  }
+  if (harness.connections.length === 0) {
+    console.log("No connections defined. Add one with `tr connections add`.");
+    return;
+  }
+  for (const connection of harness.connections) {
+    const flags = [
+      connection.manifest.provider,
+      connection.manifest.risk,
+      connection.manifest.confirm ? "confirm" : null,
+      connection.manifest.healthcheck ? "healthcheck" : null
+    ].filter(Boolean).join(", ");
+    console.log(`${connection.name}  [${flags}]  - ${connection.manifest.description}`);
+  }
+}
+async function runConnectionsAdd(repoRoot, name, options) {
+  const created = await createConnection(
+    repoRoot,
+    {
+      name,
+      provider: options.provider,
+      command: options.command,
+      description: options.description,
+      profile: options.profile,
+      risk: options.risk,
+      confirm: options.confirm,
+      healthcheck: options.healthcheck,
+      scope: options.scope
+    },
+    { force: options.force }
+  );
+  console.log(`Created ${created.manifest.scope} connection \`${name}\` at ${created.path}.`);
+}
+async function runConnectionsCheck(repoRoot) {
+  const checks = await checkConnections(repoRoot);
+  if (checks.length === 0) {
+    console.log("No connections defined.");
+    return;
+  }
+  let failures = 0;
+  for (const check of checks) {
+    console.log(`${check.name}: ${check.status} - ${check.message}`);
+    if (check.status === "error") {
+      failures += 1;
+    }
+  }
+  if (failures > 0) {
+    process.exitCode = 1;
+  }
+}
+
+// src/cli.ts
+function createProgram(repoRoot = process.cwd()) {
+  const program = new Command();
+  program.name("threadroot").description("Git for your AI agent harness: one canonical source, compiled to every vendor format.").version("0.1.0");
+  program.command("init").description("Scaffold a Threadroot harness, import existing vendor files once, and compile.").option("--force", "Re-initialize over an existing harness.").option("--no-import", "Skip importing existing vendor files (blank-slate init).").option("--profile <profile>", "Override the detected project profile.").option("--adapters <list>", "Comma-separated adapters: agents,claude,copilot,cursor.").action((options) => runInit(repoRoot, options));
+  program.command("status").description("Show harness state, object counts, and compiled-output drift.").action(() => runStatus(repoRoot));
+  program.command("diff").description("Show the diff between the canonical harness and each compiled vendor file.").action(() => runDiff(repoRoot));
+  program.command("doctor").description("Check harness validity, compiled output health, MCP hints, and tool trust.").action(() => runDoctor(repoRoot));
+  program.command("compile").option("--adapter <adapter>", "Restrict output to one adapter: agents, claude, copilot, or cursor.").description("Compile the canonical harness into vendor files.").action((options) => runCompileCommand(repoRoot, options));
+  program.command("context").argument("<task>", "Task to assemble a relevant harness slice for.").description("Assemble the task-relevant harness slice: skills, rules, tools, and memory.").action((task) => runContext(repoRoot, task));
+  program.command("run").argument("<tool>", "Harness tool name.").option("--input <pair...>", "Tool input as key=value (repeatable).").option("-y, --yes", "Confirm running a tool marked confirm:true.").option("--timeout <ms>", "Override the execution timeout in milliseconds.").description("Execute a harness tool locally.").action((tool, options) => runToolRun(repoRoot, tool, options));
+  program.command("install").argument("<source>", "Object source: local path or git (github:owner/repo/path[@ref]).").option("--kind <kind>", "Object kind: skill, tool, rule, or connection (inferred when omitted).").option("--path <path>", "Path to the object within a git source repo.").option("--user", "Install into the user harness (~/.threadroot) instead of the project.").description("Install a harness object from a local path or git source.").action((source, options) => runInstall(repoRoot, source, options));
+  program.command("remember").argument("<note>", "Durable note to record.").option("--type <type>", "Memory type: project, current-focus, handoff, or pitfalls.").description("Append a durable note to harness memory (defaults to handoff).").action((note, options) => runRemember(repoRoot, note, options));
+  const memory = program.command("memory").description("Read and append durable harness memory.");
+  memory.command("read").argument("<type>", "Memory type: project, repo-map, current-focus, handoff, or pitfalls.").description("Print a memory file.").action((type) => runMemoryRead(repoRoot, type));
+  memory.command("append").argument("<type>", "Memory type: project, repo-map, current-focus, handoff, or pitfalls.").argument("<note>", "Note to append.").description("Append a durable note to memory.").action((type, note) => runMemoryAppend(repoRoot, type, note));
+  const tools2 = program.command("tools").description("Manage executable harness tools.");
+  tools2.command("list").description("List harness tools.").action(() => runToolsList(repoRoot));
+  tools2.command("check").description("Run configured tool healthchecks.").action(() => runToolsCheck(repoRoot));
+  tools2.command("detect").description("Propose starter tools from the repo's existing command surface.").action(() => runToolsDetect(repoRoot));
+  tools2.command("add").argument("<name>", "Tool name (lowercase, hyphenated).").requiredOption("--description <text>", "What the tool does.").option("--run <command>", "Shell command (use {{param}} for inputs).").option("--script <path>", "Harness-relative script path (alternative to --run).").option("--risk <risk>", "Risk level: low, medium, or high.").option("--connection <name>", "Connection this tool depends on.").option("--healthcheck <command>", "Command that verifies the tool is available.").option("--confirm", "Require confirmation before running.").option("--scope <scope>", "user or project.").option("--force", "Overwrite an existing tool.").description("Author a new harness tool.").action((name, options) => runToolsAdd(repoRoot, name, options));
+  tools2.command("create").option("--from-command <command>", "Create a tool around an existing command.").option("--description <text>", "What the tool does.").option("--risk <risk>", "Risk level: low, medium, or high.").option("--connection <name>", "Connection this tool depends on.").option("--healthcheck <command>", "Command that verifies the tool is available.").option("--confirm", "Require confirmation before running.").option("--scope <scope>", "user or project.").option("--force", "Overwrite an existing tool.").description("Guided safe tool builder.").action((options) => runToolsCreate(repoRoot, options));
+  const connections = program.command("connections").description("Manage local CLI connections.");
+  connections.command("list").description("List harness connections.").action(() => runConnectionsList(repoRoot));
+  connections.command("check").description("Run configured connection healthchecks.").action(() => runConnectionsCheck(repoRoot));
+  connections.command("add").argument("<name>", "Connection name (lowercase, hyphenated).").requiredOption("--provider <provider>", "Provider name, such as aws, github, azure, or snowflake.").requiredOption("--command <command>", "Local CLI command, such as aws, gh, az, or snow.").option("--description <text>", "What this connection is for.").option("--profile <profile>", "Local CLI profile/account label.").option("--risk <risk>", "Risk level: low, medium, or high.").option("--confirm", "Require confirmation before connection-backed tools run.").option("--healthcheck <command>", "Command that verifies the connection works.").option("--scope <scope>", "user or project.").option("--force", "Overwrite an existing connection.").description("Author a local CLI connection manifest.").action((name, options) => runConnectionsAdd(repoRoot, name, options));
+  const packs = program.command("packs").description("Inspect, validate, and install capability packs.");
+  packs.command("list").description("List built-in and repo-local packs.").action(() => runPacksList(repoRoot));
+  packs.command("inspect").argument("<name-or-path>", "Built-in pack name or repo-relative pack path.").description("Inspect a capability pack.").action((nameOrPath) => runPacksInspect(repoRoot, nameOrPath));
+  packs.command("validate").argument("<name-or-path>", "Built-in pack name or repo-relative pack path.").description("Validate a capability pack.").action((nameOrPath) => runPacksValidate(repoRoot, nameOrPath));
+  packs.command("install").argument("<name-or-path>", "Built-in pack name or repo-relative pack path.").description("Install a capability pack into the project harness.").action((nameOrPath) => runPacksInstall(repoRoot, nameOrPath));
+  const skills = program.command("skills").description("Inspect and validate harness skills.");
+  skills.command("list").description("List harness skills.").action(() => runSkillsList(repoRoot));
+  skills.command("inspect").argument("<path>", "Repo-relative skill file or skill directory.").description("Inspect a skill's metadata, references, scripts, assets, and eval files.").action((targetPath) => runSkillsInspect(repoRoot, targetPath));
+  skills.command("validate").option("--path <path>", "Validate a repo-relative skill file, skill directory, or skill collection.").description("Validate skill frontmatter, naming, trigger descriptions, and progressive-disclosure hygiene.").action((options) => runSkillsValidate(repoRoot, options));
+  const mcp = program.command("mcp").description("Run or configure the local Threadroot MCP server.");
+  mcp.action(() => runMcp(repoRoot));
+  mcp.command("setup").option("--agent <agent>", "all, generic, codex, copilot, cursor, or claude.").option("--write", "Write project-local MCP config files for the agents.").description("Print MCP config snippets and a pasteable agent bootstrap prompt.").action((options) => runMcpSetup(repoRoot, options));
+  return program;
+}
+
+// src/index.ts
+function normalizeArgv(argv) {
+  if (argv[2] === "--") {
+    return [argv[0] ?? "node", argv[1] ?? "threadroot", ...argv.slice(3)];
+  }
+  return argv;
+}
+createProgram().parseAsync(normalizeArgv(process.argv)).catch((error) => {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exitCode = 1;
+});