zidane 5.14.4 → 6.0.0

package/dist/{interpolate-BtIgcCuz.js → resolve-Cr8JSL_O.js}

@@ -1,63 +1,115 @@
 import { a as AgentToolNotAllowedError, l as errorMessage } from "./errors-DJUxZg9b.js";
-import { basename, dirname, join, resolve } from "node:path";
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { basename, delimiter, dirname, join, resolve, sep } from "node:path";
+import { existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { realpath } from "node:fs/promises";
+import { execFile } from "node:child_process";
 import { homedir, tmpdir } from "node:os";
-//#region src/xml.ts
+//#region src/chat/project-root.ts
 /**
-* Minimal XML helpers used by catalog/result builders that emit
-* model-facing pseudo-XML (skills catalog, searchable_tools, tool_search
-* results, skill_content wrappers).
+* Git root detection — walks parents from `cwd` looking for a `.git`
+* entry, returning the absolute path of the repo root or `null` when
+* the search reaches the filesystem root.
 *
-* Scope: attribute / text-node escaping only — we do NOT emit a full XML
-* document, the model sees these strings as free-form text. Centralised
-* here so the four near-identical copies in `agent.ts`, `skills/catalog.ts`,
-* `tools/skills-use.ts`, and `tools/tool-search.ts` don't drift.
+* Why parent-walk over `git rev-parse --show-toplevel`:
+*
+*   - Zero dependencies (no shell-out, no git binary requirement,
+*     works even when `git` is missing from `PATH`).
+*   - Pure-sync, deterministic, easy to test against tmp dirs.
+*   - Equally fast in practice — most lookups are a single `existsSync`.
+*
+* Recognizes `.git` as either:
+*
+*   - A directory (standard repo layout).
+*   - A file containing `gitdir: …` (worktrees + submodules).
+*
+* Bare repos (no working tree) are intentionally NOT detected here —
+* the TUI's data dir contract is "project working tree", and a bare
+* repo has no working files to scope sessions against.
 */
-const RE_AMP = /&/g;
-const RE_LT = /</g;
-const RE_GT = />/g;
-const RE_QUOT = /"/g;
-function escapeXml(str) {
-	return str.replace(RE_AMP, "&amp;").replace(RE_LT, "&lt;").replace(RE_GT, "&gt;").replace(RE_QUOT, "&quot;");
+/**
+* Walk parents of `cwd` looking for a `.git` entry. Returns the
+* absolute path of the directory containing `.git`, or `null` when no
+* git repo is found above `cwd`.
+*
+* Stops at the filesystem root (`/`) — no infinite loop on `dirname`'s
+* idempotent root case (`dirname('/')` returns `/`).
+*/
+function findGitRoot(cwd = process.cwd()) {
+	let dir = resolve(cwd);
+	for (let depth = 0; depth < 64; depth++) {
+		if (hasGitMarker(dir)) return dir;
+		const parent = dirname(dir);
+		if (parent === dir) return null;
+		dir = parent;
+	}
+	return null;
+}
+/**
+* `.git` exists as a directory (standard repo) OR as a file containing
+* a `gitdir:` pointer (worktree / submodule). Tolerant on stat failures
+* — a permission error on a parent directory shouldn't crash the walk.
+*/
+function hasGitMarker(dir) {
+	const candidate = resolve(dir, ".git");
+	try {
+		if (!existsSync(candidate)) return false;
+		const stat = statSync(candidate);
+		return stat.isDirectory() || stat.isFile();
+	} catch {
+		return false;
+	}
 }
 //#endregion
-//#region src/skills/activation.ts
-function createSkillActivationState(options = {}) {
-	const byName = /* @__PURE__ */ new Map();
-	const maxActive = typeof options.maxActive === "number" && options.maxActive > 0 ? options.maxActive : void 0;
-	return {
-		active() {
-			return [...byName.values()];
-		},
-		isActive(name) {
-			return byName.has(name);
-		},
-		get(name) {
-			return byName.get(name);
+//#region src/chat/project-user-paths.ts
+/**
+* Shared search-path builder for project + user config discovery.
+*
+* Both Skills (`skills/<name>/SKILL.md`) and MCP servers (`mcps.json`)
+* follow the same first-found-wins order:
+*
+*   1. `{project-root}/.agents/<sub>`   — project, agnostic convention
+*   2. `{project-root}/.{prefix}/<sub>` — project, zidane (`.zidane` default)
+*   3. `~/.agents/<sub>`                — user, agnostic
+*   4. `~/.{prefix}/<sub>`              — user, zidane
+*
+* `{project-root}` is the git root walked up from `cwd` when present,
+* else `cwd` itself. This pairs with the project-scoped session
+* storage (`resolveStoragePaths`) so all three project-aware surfaces
+* — sessions, mcps, skills — anchor at the same `.{prefix}/`.
+*
+* Centralizing the pattern keeps the four paths in one place — a third
+* discovery surface (hooks, rules, …) gets the same convention for free
+* and stays in lock-step on a prefix bump.
+*/
+/**
+* Resolve the four search paths for a given subdirectory (`skills`,
+* `mcps.json`, …). Returns absolute paths regardless of whether they
+* exist — the caller chooses to `existsSync`-filter or feed straight
+* into a tolerant discovery routine.
+*/
+function projectUserPaths(opts) {
+	const cwd = opts.cwd ?? process.cwd();
+	const home = opts.home ?? homedir();
+	const projectRoot = findGitRoot(cwd) ?? cwd;
+	const prefix = (opts.prefix ?? ".zidane").replace(/^\./, "");
+	return [
+		{
+			path: resolve(projectRoot, `.agents/${opts.subPath}`),
+			source: "project"
 		},
-		activate(skill, via) {
-			if (byName.has(skill.name)) return "already-active";
-			if (maxActive !== void 0 && byName.size >= maxActive) return "cap-reached";
-			byName.set(skill.name, {
-				skill,
-				activatedAt: Date.now(),
-				activatedVia: via
-			});
-			return "ok";
+		{
+			path: resolve(projectRoot, `.${prefix}/${opts.subPath}`),
+			source: "project"
 		},
-		deactivate(name) {
-			const existing = byName.get(name);
-			if (!existing) return void 0;
-			byName.delete(name);
-			return existing;
+		{
+			path: resolve(home, `.agents/${opts.subPath}`),
+			source: "user"
 		},
-		clear() {
-			const snapshot = [...byName.values()];
-			byName.clear();
-			return snapshot;
+		{
+			path: resolve(home, `.${prefix}/${opts.subPath}`),
+			source: "user"
 		}
-	};
+	];
 }
 //#endregion
 //#region src/skills/validate.ts
@@ -274,6 +326,466 @@ function isToolAllowedByUnion(displayName, input, union) {
 	return union.some((pattern) => matchesAllowedTool(displayName, input, pattern));
 }
 //#endregion
+//#region src/skills/interpolate.ts
+/** Regex to match !`command` patterns in skill instructions */
+const SHELL_INTERPOLATION_RE = /!`([^`]+)`/g;
+/**
+* Replace every !\`command\` pattern with a static placeholder, without
+* executing anything. Used when shell interpolation is disabled
+* (`SkillsConfig.allowShellInterpolation: false`): skill content can be
+* third-party input, and running its embedded commands on activation
+* bypasses the allowed-tools gate.
+*/
+function stripShellInterpolations(instructions) {
+	return instructions.replace(SHELL_INTERPOLATION_RE, "[shell interpolation disabled]");
+}
+/**
+* Interpolate shell commands in skill instructions.
+*
+* Runs each !\`command\` through the execution context and replaces
+* the placeholder with the command's stdout. If a command fails,
+* the placeholder is replaced with an error message (and
+* `options.onFailure` is notified when provided).
+*
+* @param instructions - Raw skill instructions with potential !\`command\` patterns
+* @param execution - The execution context to run commands in
+* @param handle - The active execution handle
+* @returns Instructions with all !\`command\` patterns replaced by output
+*/
+async function interpolateShellCommands(instructions, execution, handle, options = {}) {
+	const matches = [...instructions.matchAll(SHELL_INTERPOLATION_RE)];
+	if (matches.length === 0) return instructions;
+	const replacements = [];
+	for (const match of matches) {
+		const command = match[1];
+		const index = match.index;
+		const length = match[0].length;
+		if (options.approve) {
+			let approved = false;
+			try {
+				approved = await options.approve(command);
+			} catch {
+				approved = false;
+			}
+			if (!approved) {
+				const placeholder = "[shell interpolation not approved]";
+				options.onFailure?.(command, placeholder);
+				replacements.push({
+					index,
+					length,
+					output: placeholder
+				});
+				continue;
+			}
+		}
+		try {
+			const result = await execution.exec(handle, command, { timeout: 30 });
+			if (result.exitCode === 0) replacements.push({
+				index,
+				length,
+				output: result.stdout.trim()
+			});
+			else {
+				const placeholder = `[command failed (exit ${result.exitCode}): ${result.stderr.trim() || result.stdout.trim()}]`;
+				options.onFailure?.(command, placeholder);
+				replacements.push({
+					index,
+					length,
+					output: placeholder
+				});
+			}
+		} catch (err) {
+			const placeholder = `[command error: ${errorMessage(err)}]`;
+			options.onFailure?.(command, placeholder);
+			replacements.push({
+				index,
+				length,
+				output: placeholder
+			});
+		}
+	}
+	let result = instructions;
+	for (let i = replacements.length - 1; i >= 0; i--) {
+		const { index, length, output } = replacements[i];
+		result = result.slice(0, index) + output + result.slice(index + length);
+	}
+	return result;
+}
+//#endregion
+//#region src/xml.ts
+/**
+* Minimal XML helpers used by catalog/result builders that emit
+* model-facing pseudo-XML (skills catalog, searchable_tools, tool_search
+* results, skill_content wrappers).
+*
+* Scope: attribute / text-node escaping only — we do NOT emit a full XML
+* document, the model sees these strings as free-form text. Centralised
+* here so the four near-identical copies in `agent.ts`, `skills/catalog.ts`,
+* `tools/skills-use.ts`, and `tools/tool-search.ts` don't drift.
+*/
+const RE_AMP = /&/g;
+const RE_LT = /</g;
+const RE_GT = />/g;
+const RE_QUOT = /"/g;
+function escapeXml(str) {
+	return str.replace(RE_AMP, "&amp;").replace(RE_LT, "&lt;").replace(RE_GT, "&gt;").replace(RE_QUOT, "&quot;");
+}
+//#endregion
+//#region src/install/source.ts
+/**
+* Shared install-source layer — the source-agnostic half of "install a
+* thing from github/npm". Extracted from the extensions installer so
+* SKILL installs (and any future installable artifact) reuse the exact
+* same spec grammar, fetch pipeline, and hardening instead of forking
+* them:
+*
+*   - Spec grammar: `owner/repo[#ref][:subdir]`, `github:owner/repo`,
+*     pasted GitHub URLs (including `/tree/<ref>/<path>`),
+*     `pkg[@version]`, `@scope/pkg[@version]`.
+*   - Fetch: `git clone --depth 1` (records the exact commit) with a
+*     codeload-tarball fallback, npm registry resolve (exact versions +
+*     dist-tags) + tarball download. Downloads are double-capped at
+*     {@link MAX_DOWNLOAD_BYTES} (content-length header AND post-hoc for
+*     chunked responses). Extraction requires `tar` on PATH.
+*   - All side effects go through the injectable {@link InstallIo} seams
+*     so tests stay offline and hosts can instrument.
+*
+* Flavor-specific concerns stay OUT of this module: candidate
+* enumeration, validation, target roots, provenance files, dependency
+* installs. Flavors subclass {@link InstallSourceError} to widen the
+* error-code union while keeping `.code`-based handling uniform.
+*/
+/**
+* Base error for install pipelines. `code` is a plain string here so
+* flavors (extensions, skills) can widen it with their own codes while
+* callers keep a single `err.code` switch. The base layer itself only
+* throws `'invalid-source'` and `'fetch-failed'`.
+*/
+var InstallSourceError = class extends Error {
+	code;
+	/** Set for candidate-selection errors — the names the caller can pick from. */
+	candidates;
+	constructor(code, message, candidates) {
+		super(message);
+		this.name = "InstallSourceError";
+		this.code = code;
+		if (candidates) this.candidates = candidates;
+	}
+};
+const GITHUB_TREE_URL_RE = /^(?:https?:\/\/)?(?:www\.)?github\.com\/([^/\s]+)\/([^/\s#@:]+?)(?:\.git)?\/tree\/([^/\s:]+)(?:\/([^\s:]+?))?\/?$/;
+const GITHUB_URL_RE = /^(?:https?:\/\/)?(?:www\.)?github\.com\/([^/\s]+)\/([^/\s#@:]+?)(?:\.git)?\/?$/;
+const OWNER_REPO_RE = /^([\w.-]+)\/([\w.-]+)$/;
+const GITHUB_REF_RE = /^[\w./-]+$/;
+const NPM_NAME_RE = /^(@[\w.-]+\/[\w.-]+|[\w.-]+)(?:@([\w.^~><=*-]+))?$/;
+/** Structural validation for a `:subdir` suffix — repo-relative, no escapes. */
+function parseSubdir(rawSubdir, raw) {
+	const subdir = rawSubdir.replace(/^\.\//, "").replace(/\/+$/, "");
+	const segments = subdir.split("/");
+	if (subdir.length === 0 || subdir.startsWith("/") || subdir.includes("\\") || segments.some((s) => s.length === 0 || s === "." || s === "..")) throw new InstallSourceError("invalid-source", `"${raw}" has an invalid subdirectory — expected a repo-relative path (no leading /, no ..).`);
+	return subdir;
+}
+/**
+* Classify a raw source string:
+*
+*   - `github:owner/repo`, `owner/repo`, GitHub URLs (including
+*     `/tree/<ref>/<path>` links) → GitHub. Optional `#ref` (or the
+*     legacy `@ref`) pins a branch/tag; optional `:path/to/dir` roots the
+*     candidate search in a subdirectory: `owner/repo#branch:packages/x`.
+*   - `@scope/pkg[@version]`, `pkg[@version]` → npm (no subdir support —
+*     flavors expose their own selector for multi-candidate packages).
+*
+* The one ambiguity — `a/b` — is resolved as GitHub: npm's slash names
+* are always scoped (`@scope/…`), so a bare `owner/repo` can only be a
+* repo. Throws `invalid-source` on anything else.
+*/
+function parseInstallSource(raw) {
+	const spec = raw.trim();
+	if (spec.length === 0) throw new InstallSourceError("invalid-source", "Empty source. Expected `owner/repo`, `github:owner/repo`, a GitHub URL, or an npm package name.");
+	const explicitGithub = spec.startsWith("github:");
+	const body = explicitGithub ? spec.slice(7) : spec;
+	const tree = GITHUB_TREE_URL_RE.exec(body);
+	if (tree) return {
+		kind: "github",
+		owner: tree[1],
+		repo: tree[2],
+		ref: tree[3],
+		...tree[4] ? { subdir: parseSubdir(tree[4], raw) } : {}
+	};
+	const url = GITHUB_URL_RE.exec(body);
+	if (url) return {
+		kind: "github",
+		owner: url[1],
+		repo: url[2]
+	};
+	if (body.startsWith("@")) {
+		if (explicitGithub) throw new InstallSourceError("invalid-source", `"${raw}" mixes the github: prefix with an npm scoped name.`);
+		if (body.includes(":")) throw new InstallSourceError("invalid-source", `"${raw}": subdirectories (\`:path\`) are only supported for GitHub sources.`);
+		const m = NPM_NAME_RE.exec(body);
+		if (!m) throw new InstallSourceError("invalid-source", `"${raw}" is not a valid npm package spec.`);
+		return {
+			kind: "npm",
+			pkg: m[1],
+			...m[2] ? { version: m[2] } : {}
+		};
+	}
+	if (body.includes("/")) {
+		const colonIdx = body.indexOf(":");
+		const specPart = colonIdx === -1 ? body : body.slice(0, colonIdx);
+		const subdir = colonIdx === -1 ? void 0 : parseSubdir(body.slice(colonIdx + 1), raw);
+		const hashIdx = specPart.indexOf("#");
+		const refIdx = hashIdx >= 0 ? hashIdx : specPart.indexOf("@");
+		const repoPart = refIdx === -1 ? specPart : specPart.slice(0, refIdx);
+		const ref = refIdx === -1 ? void 0 : specPart.slice(refIdx + 1);
+		const m = OWNER_REPO_RE.exec(repoPart);
+		if (!m || ref !== void 0 && !GITHUB_REF_RE.test(ref)) throw new InstallSourceError("invalid-source", `"${raw}" is not a valid GitHub repo spec (expected owner/repo, optionally #ref and :subdir).`);
+		return {
+			kind: "github",
+			owner: m[1],
+			repo: m[2],
+			...ref ? { ref } : {},
+			...subdir ? { subdir } : {}
+		};
+	}
+	if (explicitGithub) throw new InstallSourceError("invalid-source", `"${raw}" is missing the repo part (expected github:owner/repo).`);
+	if (body.includes(":")) throw new InstallSourceError("invalid-source", `"${raw}": subdirectories (\`:path\`) are only supported for GitHub sources.`);
+	const m = NPM_NAME_RE.exec(body);
+	if (!m) throw new InstallSourceError("invalid-source", `"${raw}" is not a valid npm package spec.`);
+	return {
+		kind: "npm",
+		pkg: m[1],
+		...m[2] ? { version: m[2] } : {}
+	};
+}
+/**
+* Materialize the source into `destDir` (created by the caller, assumed
+* empty). Returns the provenance string plus, for git clones, the exact
+* commit SHA (the tarball fallback can't know it — codeload doesn't
+* expose the resolved commit).
+*/
+async function fetchInstallSource(source, destDir, io = {}, onProgress) {
+	const exec = io.exec ?? defaultExec;
+	const which = io.which ?? defaultWhich;
+	const fetchImpl = io.fetch ?? fetch;
+	if (source.kind === "github") {
+		const label = `${source.owner}/${source.repo}${source.ref ? `@${source.ref}` : ""}${source.subdir ? `:${source.subdir}` : ""}`;
+		if (which("git")) {
+			onProgress?.(`cloning github.com/${label}…`);
+			const args = [
+				"clone",
+				"--depth",
+				"1",
+				"--single-branch"
+			];
+			if (source.ref) args.push("--branch", source.ref);
+			args.push(`https://github.com/${source.owner}/${source.repo}.git`, destDir);
+			const res = await exec("git", args, {});
+			if (!res.ok) throw new InstallSourceError("fetch-failed", `git clone failed for ${label}: ${lastLine(res.stderr)}`);
+			const head = await exec("git", ["rev-parse", "HEAD"], { cwd: destDir });
+			const commit = head.ok && /^[0-9a-f]{40}$/.test(head.stdout.trim()) ? head.stdout.trim() : void 0;
+			rmSync(join(destDir, ".git"), {
+				recursive: true,
+				force: true
+			});
+			return {
+				provenance: `github:${label}`,
+				...commit ? { commit } : {}
+			};
+		}
+		onProgress?.(`downloading github.com/${label} tarball…`);
+		const ref = source.ref ?? "HEAD";
+		await downloadAndExtract(`https://codeload.github.com/${source.owner}/${source.repo}/tar.gz/${ref}`, destDir, {
+			exec,
+			fetchImpl,
+			which,
+			what: label
+		});
+		return { provenance: `github:${label}` };
+	}
+	onProgress?.(`resolving npm:${source.pkg}…`);
+	const { version, tarball } = await resolveNpmVersion(source, fetchImpl);
+	onProgress?.(`downloading npm:${source.pkg}@${version}…`);
+	await downloadAndExtract(tarball, destDir, {
+		exec,
+		fetchImpl,
+		which,
+		what: `${source.pkg}@${version}`
+	});
+	return { provenance: `npm:${source.pkg}@${version}` };
+}
+/**
+* Registry lookup shared by the fetch path and update no-op checks.
+* Exact versions and dist-tags only — range resolution is out of scope.
+*/
+async function resolveNpmVersion(source, fetchImpl) {
+	const registryUrl = `https://registry.npmjs.org/${source.pkg.replace("/", "%2F")}`;
+	let meta;
+	try {
+		const res = await fetchImpl(registryUrl);
+		if (!res.ok) throw new Error(`registry returned ${res.status}`);
+		meta = await res.json();
+	} catch (err) {
+		throw new InstallSourceError("fetch-failed", `Could not resolve npm package "${source.pkg}": ${errorText(err)}`);
+	}
+	const version = source.version && meta.versions?.[source.version] ? source.version : meta["dist-tags"]?.[source.version ?? "latest"];
+	const tarball = version ? meta.versions?.[version]?.dist?.tarball : void 0;
+	if (!version || !tarball) throw new InstallSourceError("fetch-failed", `npm package "${source.pkg}" has no ${source.version ? `version/tag "${source.version}"` : "latest version"} (exact versions and dist-tags only — ranges are not resolved).`);
+	return {
+		version,
+		tarball
+	};
+}
+/**
+* OOM guard: tarballs are buffered in memory before extraction, so an
+* unexpectedly huge (or hostile) URL must fail fast instead of ballooning
+* RSS. Install sources are source trees — 64MB is already generous.
+*/
+const MAX_DOWNLOAD_BYTES = 64 * 1024 * 1024;
+async function downloadAndExtract(url, destDir, opts) {
+	let bytes;
+	try {
+		const res = await opts.fetchImpl(url);
+		if (!res.ok) throw new Error(`download returned ${res.status}`);
+		const declared = Number(res.headers.get("content-length") ?? "0");
+		if (declared > 67108864) throw new Error(`archive is ${Math.round(declared / 1024 / 1024)}MB — larger than the ${MAX_DOWNLOAD_BYTES / 1024 / 1024}MB limit`);
+		bytes = await res.arrayBuffer();
+		if (bytes.byteLength > 67108864) throw new Error(`archive is ${Math.round(bytes.byteLength / 1024 / 1024)}MB — larger than the ${MAX_DOWNLOAD_BYTES / 1024 / 1024}MB limit`);
+	} catch (err) {
+		throw new InstallSourceError("fetch-failed", `Download failed for ${opts.what}: ${errorText(err)}`);
+	}
+	if (!opts.which("tar")) throw new InstallSourceError("fetch-failed", `Extracting ${opts.what} requires \`tar\` on PATH (or install git for the clone path).`);
+	const tarPath = join(destDir, ".zidane-install.tgz");
+	mkdirSync(destDir, { recursive: true });
+	writeFileSync(tarPath, new Uint8Array(bytes));
+	const res = await opts.exec("tar", [
+		"-xzf",
+		tarPath,
+		"-C",
+		destDir,
+		"--strip-components=1"
+	], {});
+	rmSync(tarPath, { force: true });
+	if (!res.ok) throw new InstallSourceError("fetch-failed", `Extracting ${opts.what} failed: ${lastLine(res.stderr)}`);
+}
+/**
+* Resolve a `:subdir` inside a fetched tree with PHYSICAL containment:
+* string-level prefix check first, then realpath both sides and re-check
+* so a malicious repo shipping a symlink (`evil -> /`) can't walk the
+* candidate search (and any follow-up validation) onto the local
+* filesystem. Returns the physical directory, or a typed refusal the
+* flavor maps onto its own error vocabulary.
+*/
+function resolveSubdirRoot(fetchedInto, subdir) {
+	const resolved = resolve(fetchedInto, subdir);
+	if (!resolved.startsWith(fetchedInto + sep)) return {
+		ok: false,
+		reason: "escape"
+	};
+	let physical = null;
+	try {
+		physical = realpathSync(resolved);
+	} catch {}
+	if (physical === null || !isDirectory(physical)) return {
+		ok: false,
+		reason: "missing"
+	};
+	const physicalRoot = realpathSync(fetchedInto);
+	if (physical !== physicalRoot && !physical.startsWith(physicalRoot + sep)) return {
+		ok: false,
+		reason: "escape-symlink"
+	};
+	return {
+		ok: true,
+		dir: physical
+	};
+}
+function isDirectory(path) {
+	try {
+		return lstatSync(path).isDirectory();
+	} catch {
+		return false;
+	}
+}
+function defaultExec(cmd, args, opts) {
+	return new Promise((resolvePromise) => {
+		execFile(cmd, [...args], {
+			cwd: opts.cwd,
+			maxBuffer: 16 * 1024 * 1024
+		}, (err, stdout, stderr) => {
+			resolvePromise({
+				ok: !err,
+				stdout: String(stdout),
+				stderr: String(stderr)
+			});
+		});
+	});
+}
+function defaultWhich(cmd) {
+	const exts = process.platform === "win32" ? [
+		".exe",
+		".cmd",
+		".bat",
+		""
+	] : [""];
+	for (const dir of (process.env.PATH ?? "").split(delimiter)) {
+		if (!dir) continue;
+		for (const ext of exts) {
+			const full = resolve(dir, cmd + ext);
+			try {
+				if (lstatSync(full).isFile()) return full;
+			} catch {
+				continue;
+			}
+		}
+	}
+	return null;
+}
+/** Last non-empty line of a command's output — the useful bit of tool noise. */
+function lastLine(text) {
+	const lines = text.trim().split("\n").filter((l) => l.trim().length > 0);
+	return lines[lines.length - 1]?.trim() ?? "";
+}
+function errorText(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+//#endregion
+//#region src/skills/activation.ts
+function createSkillActivationState(options = {}) {
+	const byName = /* @__PURE__ */ new Map();
+	const maxActive = typeof options.maxActive === "number" && options.maxActive > 0 ? options.maxActive : void 0;
+	return {
+		active() {
+			return [...byName.values()];
+		},
+		isActive(name) {
+			return byName.has(name);
+		},
+		get(name) {
+			return byName.get(name);
+		},
+		activate(skill, via) {
+			if (byName.has(skill.name)) return "already-active";
+			if (maxActive !== void 0 && byName.size >= maxActive) return "cap-reached";
+			byName.set(skill.name, {
+				skill,
+				activatedAt: Date.now(),
+				activatedVia: via
+			});
+			return "ok";
+		},
+		deactivate(name) {
+			const existing = byName.get(name);
+			if (!existing) return void 0;
+			byName.delete(name);
+			return existing;
+		},
+		clear() {
+			const snapshot = [...byName.values()];
+			byName.clear();
+			return snapshot;
+		}
+	};
+}
+//#endregion
 //#region src/skills/allowed-tools.ts
 /** Tools that are always allowed regardless of the active skills' allow-list. */
 const IMPLICITLY_ALLOWED_SKILL_TOOLS = [
@@ -1031,92 +1543,6 @@ async function resolveSkills(config) {
 	};
 }
 //#endregion
-//#region src/skills/interpolate.ts
-/** Regex to match !`command` patterns in skill instructions */
-const SHELL_INTERPOLATION_RE = /!`([^`]+)`/g;
-/**
-* Replace every !\`command\` pattern with a static placeholder, without
-* executing anything. Used when shell interpolation is disabled
-* (`SkillsConfig.allowShellInterpolation: false`): skill content can be
-* third-party input, and running its embedded commands on activation
-* bypasses the allowed-tools gate.
-*/
-function stripShellInterpolations(instructions) {
-	return instructions.replace(SHELL_INTERPOLATION_RE, "[shell interpolation disabled]");
-}
-/**
-* Interpolate shell commands in skill instructions.
-*
-* Runs each !\`command\` through the execution context and replaces
-* the placeholder with the command's stdout. If a command fails,
-* the placeholder is replaced with an error message (and
-* `options.onFailure` is notified when provided).
-*
-* @param instructions - Raw skill instructions with potential !\`command\` patterns
-* @param execution - The execution context to run commands in
-* @param handle - The active execution handle
-* @returns Instructions with all !\`command\` patterns replaced by output
-*/
-async function interpolateShellCommands(instructions, execution, handle, options = {}) {
-	const matches = [...instructions.matchAll(SHELL_INTERPOLATION_RE)];
-	if (matches.length === 0) return instructions;
-	const replacements = [];
-	for (const match of matches) {
-		const command = match[1];
-		const index = match.index;
-		const length = match[0].length;
-		if (options.approve) {
-			let approved = false;
-			try {
-				approved = await options.approve(command);
-			} catch {
-				approved = false;
-			}
-			if (!approved) {
-				const placeholder = "[shell interpolation not approved]";
-				options.onFailure?.(command, placeholder);
-				replacements.push({
-					index,
-					length,
-					output: placeholder
-				});
-				continue;
-			}
-		}
-		try {
-			const result = await execution.exec(handle, command, { timeout: 30 });
-			if (result.exitCode === 0) replacements.push({
-				index,
-				length,
-				output: result.stdout.trim()
-			});
-			else {
-				const placeholder = `[command failed (exit ${result.exitCode}): ${result.stderr.trim() || result.stdout.trim()}]`;
-				options.onFailure?.(command, placeholder);
-				replacements.push({
-					index,
-					length,
-					output: placeholder
-				});
-			}
-		} catch (err) {
-			const placeholder = `[command error: ${errorMessage(err)}]`;
-			options.onFailure?.(command, placeholder);
-			replacements.push({
-				index,
-				length,
-				output: placeholder
-			});
-		}
-	}
-	let result = instructions;
-	for (let i = replacements.length - 1; i >= 0; i--) {
-		const { index, length, output } = replacements[i];
-		result = result.slice(0, index) + output + result.slice(index + length);
-	}
-	return result;
-}
-//#endregion
-export { escapeXml as S, validateResourcePath as _, writeSkillsToDisk as a, validateSkillName as b, inferSource as c, buildCatalog as d, IMPLICITLY_ALLOWED_SKILL_TOOLS as f, parseAllowedToolPattern as g, matchesAllowedTool as h, writeSkillToDisk as i, parseFrontmatter as l, isToolAllowedByUnion as m, stripShellInterpolations as n, discoverSkills as o, installAllowedToolsGate as p, resolveSkills as r, getDefaultScanPaths as s, interpolateShellCommands as t, parseSkillFile as u, validateResourcePathReal as v, createSkillActivationState as x, validateSkillForWrite as y };
+export { validateSkillName as A, stripShellInterpolations as C, validateResourcePath as D, parseAllowedToolPattern as E, findGitRoot as M, validateResourcePathReal as O, interpolateShellCommands as S, matchesAllowedTool as T, lastLine as _, getDefaultScanPaths as a, resolveSubdirRoot as b, parseSkillFile as c, installAllowedToolsGate as d, createSkillActivationState as f, fetchInstallSource as g, defaultWhich as h, discoverSkills as i, projectUserPaths as j, validateSkillForWrite as k, buildCatalog as l, defaultExec as m, writeSkillToDisk as n, inferSource as o, InstallSourceError as p, writeSkillsToDisk as r, parseFrontmatter as s, resolveSkills as t, IMPLICITLY_ALLOWED_SKILL_TOOLS as u, parseInstallSource as v, isToolAllowedByUnion as w, escapeXml as x, resolveNpmVersion as y };
 
-//# sourceMappingURL=interpolate-BtIgcCuz.js.map
+//# sourceMappingURL=resolve-Cr8JSL_O.js.map