@1aboveio/skills 0.20.2 → 0.20.4

package/runtime/skills/distribution/scripts/bundles.mjs

@@ -305,19 +305,14 @@ function localFirstPartyCommand(command, localRoot, groupId) {
   return command.replace(NATIVE_ADD_SOURCE, (_match, prefix) => `${prefix}${shellArgument(localRoot)}`);
 }
 
-// The coordinator executes one native add PER SKILL (#1129) rather than coalescing a whole source
-// into one invocation. A coalesced add can only attribute a failure to the entire source; per-skill
-// adds let the run record exactly which skill failed, continue with the remaining skills, and keep
-// only the succeeded skills in selection memory. Recipe step/member order is preserved
-// (dependency-first), and a member shared by several selected groups (harness-runtime) is still
-// planned exactly once, at its first occurrence. The pinned native CLI has no `--symlink` selector,
-// so the coordinator adds `--yes` to choose its default symlink deployment without one installation-
-// method prompt per skill. Attribution, ordering and deduplication remain coordinator-owned.
-const SKILL_TAIL = /^(.*? --skill )(.+?)( && .*)?$/;
-
-// The generated step binds its runtime suffix (` && npm ci ...`) to the whole coalesced command.
-// Per skill it belongs to the runtime member's own add, so the dependency install runs only after
-// engineering-runtime itself was actually added — never after a sibling, never when it was skipped.
+// The coordinator preserves generated dependency/member order, then coalesces each contiguous run
+// from one source into a native add. A member shared by groups is included once and retains every
+// owning selection for memory. Per-member attribution comes from post-install digest verification,
+// not process count.
+const SKILL_TAIL = /^(.*? --skill )(.+?)( --yes)?( && .*)?$/;
+
+// The generated step binds its runtime suffix (` && npm ci ...`) to engineering-runtime. Keep it on
+// the source batch only when that member remains selected after digest and consent filtering.
 const RUNTIME_MEMBER = 'engineering-runtime';
 
 function skillsFromCommand(command) {
@@ -329,14 +324,14 @@ function skillsFromCommand(command) {
 function withSkills(command, skills) {
   const match = SKILL_TAIL.exec(command);
   if (!match) throw new Error(`Native add has no --skill list to rewrite: ${command}`);
-  return `${match[1]}${skills.join(' ')}${match[3] || ''}`;
+  return `${match[1]}${skills.join(' ')}${match[3] || ''}${match[4] || ''}`;
 }
 
 function withYesFlag(command) {
   // --yes must bind to `skills`, not to a trailing `&& npm ci ...`.
   const match = SKILL_TAIL.exec(command);
   if (!match) return `${command} --yes`;
-  return `${match[1]}${match[2]} --yes${match[3] || ''}`;
+  return `${match[1]}${match[2]} --yes${match[4] || ''}`;
 }
 
 export function planBundleCommands(action, groupIds, {
@@ -354,18 +349,19 @@ export function planBundleCommands(action, groupIds, {
   const recipes = readRecipes(recipesPath);
   assertLocalRoot(localRoot);
   const groups = new Map(recipes.groups.map((group) => [group.id, group]));
+  const memberMetadata = new Map((recipes.sources ?? [])
+    .flatMap((source) => source.members ?? [])
+    .map((member) => [member.installName, member]));
   const requested = [];
   for (const groupId of groupIds) {
     if (!groups.has(groupId) || SUPPORT_GROUPS.has(groupId)) throw new Error(`Unknown bundle: ${groupId}`);
     if (!requested.includes(groupId)) requested.push(groupId);
   }
 
-  // Plan from the selected groups (not recipes.all). A public package may expose only a subset of
-  // groups while still shipping a full recipes.all from the private catalog; using that all-plan
-  // would install skills that are not in the selection / not in the package.
+  // Plan individual member records first. The execution boundary coalesces adjacent records from
+  // the same source without weakening per-member dependency, policy, or selection metadata.
   const planned = [];
   const plannedByMember = new Map();
-
   for (const groupId of requested) {
     const group = groups.get(groupId);
     for (const step of group[action].steps) {
@@ -376,14 +372,10 @@ export function planBundleCommands(action, groupIds, {
       const command = step.sourceId === 'first-party'
         ? localFirstPartyCommand(generated.command, localRoot, groupId)
         : generated.command;
-      // An explicit member subset (the digest skip) removes members from the native add but never
-      // reorders the rest: the remaining skills keep recipe order, support dependency first.
-      // Declined new members (#1128) are also filtered out, but consent never applies to support
-      // dependencies (harness-runtime): they are silent install dependencies, not capabilities.
       const skills = skillsFromCommand(command)
         .filter((skill) => !skipMembers?.has(skill))
         .filter((skill) => SUPPORT_GROUPS.has(skill) || !omit.has(skill));
-      const suffix = SKILL_TAIL.exec(command)?.[3] || '';
+      const suffix = SKILL_TAIL.exec(command)?.[4] || '';
       const bare = suffix ? command.slice(0, command.length - suffix.length) : command;
       for (const skill of skills) {
         const existing = plannedByMember.get(skill);
@@ -393,8 +385,6 @@ export function planBundleCommands(action, groupIds, {
         }
         let skillCommand = withSkills(bare, [skill]);
         if (suffix && skill === RUNTIME_MEMBER) skillCommand = `${skillCommand}${suffix}`;
-        // The pinned CLI has no --symlink flag. --yes is its only supported way to select the
-        // default symlink deployment without presenting the install-method chooser.
         skillCommand = withYesFlag(skillCommand);
         const invocationPolicy = skill === 'tdd' && enableTdd
           ? undefined
@@ -409,55 +399,158 @@ export function planBundleCommands(action, groupIds, {
           command: skillCommand,
           cwd: localRoot,
           failureMessage: step.onFailure.message,
+          ...(memberMetadata.get(skill)?.requires?.length > 0
+            ? { requires: memberMetadata.get(skill).requires }
+            : {}),
+          metadata: memberMetadata.get(skill) ?? { installName: skill },
         };
         plannedByMember.set(skill, entry);
         planned.push(entry);
       }
     }
   }
-
   return planned;
 }
 
-// Continue-on-failure (#1129): every planned per-skill add is attempted in dependency order; a
-// failed skill is recorded (its recipe failure message goes to stderr) and the run proceeds to the
-// remaining skills. Nothing here stops early — the caller summarizes the buckets and decides the
-// exit status, and selection persistence sees exactly which members succeeded.
-export function runBundleCommands(commands, {
+export function coalesceBundleCommands(commands) {
+  const batches = [];
+  for (const planned of commands) {
+    const previous = batches.at(-1);
+    if (!previous || previous.sourceId !== planned.sourceId || previous.cwd !== planned.cwd) {
+      batches.push({
+        sourceId: planned.sourceId,
+        members: [planned],
+        command: planned.command,
+        cwd: planned.cwd,
+        failureMessage: planned.failureMessage,
+      });
+      continue;
+    }
+    previous.members.push(planned);
+    const suffix = previous.members.map(({ command }) => SKILL_TAIL.exec(command)?.[4] || '').find(Boolean) || '';
+    const bare = suffix && previous.command.endsWith(suffix)
+      ? previous.command.slice(0, previous.command.length - suffix.length)
+      : previous.command;
+    previous.command = withSkills(bare, previous.members.map(({ member }) => member));
+    if (suffix) previous.command = `${previous.command}${suffix}`;
+  }
+  for (const batch of batches) {
+    batch.groupIds = [...new Set(batch.members.flatMap((member) => member.groupIds))];
+    batch.groupName = [...new Set(batch.members.map((member) => member.groupName))].join(', ');
+  }
+  return batches;
+}
+
+// Source batches continue independently. Within each batch, command status is only process evidence;
+// installed-content verification is the per-member authority used for attribution and memory.
+export function runBundleCommands(batches, {
   execute = (command, cwd) => spawnSync('/bin/bash', ['-lc', command], { cwd, stdio: 'inherit' }),
   applyPolicy = applyInvocationPolicy,
+  verifyMember,
   skillsRoot,
   stdout = process.stdout,
   stderr = process.stderr,
+  satisfiedMembers = [],
 } = {}) {
   const succeeded = [];
   const failed = [];
-  for (const planned of commands) {
-    stdout.write(`\nInstalling ${planned.member} (${planned.sourceId})...\n`);
-    const result = execute(planned.command, planned.cwd);
-    if (result.status === 0) {
-      try {
-        if (planned.invocationPolicy) {
+  const available = new Set(satisfiedMembers);
+  for (const candidate of batches) {
+    const legacySingle = !Array.isArray(candidate.members);
+    const batch = legacySingle ? { ...candidate, members: [candidate] } : candidate;
+    let runnable = [...batch.members];
+    let changed = true;
+    while (changed) {
+      changed = false;
+      const runnableNames = new Set(runnable.map(({ member }) => member));
+      for (const planned of [...runnable]) {
+        const blockedBy = (planned.requires ?? [])
+          .filter((dependency) => !available.has(dependency) && !runnableNames.has(dependency));
+        if (blockedBy.length === 0) continue;
+        stderr.write(`Dependency failed for ${planned.member}: ${blockedBy.join(', ')} is not available\n`);
+        failed.push({ planned, status: 1, blockedBy });
+        runnable = runnable.filter((candidate) => candidate !== planned);
+        changed = true;
+      }
+    }
+    if (runnable.length === 0) continue;
+    let command = batch.command;
+    let batchSuffix = '';
+    if (!legacySingle) {
+      batchSuffix = SKILL_TAIL.exec(batch.command)?.[4] || '';
+      command = withSkills(batch.command, runnable.map(({ member }) => member));
+      if (batchSuffix && !runnable.some(({ member }) => member === RUNTIME_MEMBER)) {
+        command = command.slice(0, command.length - batchSuffix.length);
+      }
+    }
+    stdout.write(`\nInstalling ${runnable.map(({ member }) => member).join(', ')} (${batch.sourceId})...\n`);
+    const result = execute(command, batch.cwd);
+    const status = Number.isInteger(result.status) ? result.status : 1;
+    const policyFailures = new Set();
+    if (status === 0) {
+      for (const planned of runnable) {
+        if (!planned.invocationPolicy) continue;
+        try {
           applyPolicy({
             installName: planned.member,
             policy: planned.invocationPolicy,
             ...(skillsRoot ? { skillsRoot } : {}),
           });
+        } catch (error) {
+          stderr.write(`Invocation policy failed for ${planned.member}: ${error.message}\n`);
+          policyFailures.add(planned.member);
         }
-        succeeded.push(planned);
+      }
+    } else {
+      stderr.write(`${batch.failureMessage}\n`);
+    }
+    for (const planned of runnable) {
+      if (policyFailures.has(planned.member)) {
+        failed.push({ planned, status: 1 });
+        continue;
+      }
+      if (status !== 0 && batchSuffix && planned.member === RUNTIME_MEMBER) {
+        stderr.write(`Post-install command failed for ${planned.member}\n`);
+        failed.push({ planned, status });
         continue;
+      }
+      try {
+        const verified = verifyMember ? verifyMember(planned) : status === 0;
+        if (verified) {
+          succeeded.push(planned);
+          available.add(planned.member);
+        } else {
+          stderr.write(`Post-install verification failed for ${planned.member}\n`);
+          failed.push({ planned, status: status || 1 });
+        }
       } catch (error) {
-        stderr.write(`Invocation policy failed for ${planned.member}: ${error.message}\n`);
+        stderr.write(`Post-install verification failed for ${planned.member}: ${error.message}\n`);
         failed.push({ planned, status: 1 });
-        continue;
       }
     }
-    stderr.write(`${planned.failureMessage}\n`);
-    failed.push({ planned, status: Number.isInteger(result.status) ? result.status : 1 });
   }
   return { succeeded, failed };
 }
 
+export function enforceReadyDependencies(readyMembers, records, stderr = process.stderr) {
+  const metadata = new Map(records.map((record) => [record.member, record]));
+  const blocked = [];
+  let changed = true;
+  while (changed) {
+    changed = false;
+    for (const member of [...readyMembers]) {
+      const record = metadata.get(member);
+      const blockedBy = (record?.requires ?? []).filter((dependency) => !readyMembers.has(dependency));
+      if (blockedBy.length === 0) continue;
+      readyMembers.delete(member);
+      blocked.push({ planned: record, status: 1, blockedBy });
+      stderr.write(`Dependency unavailable for ${member}: ${blockedBy.join(', ')} is not ready\n`);
+      changed = true;
+    }
+  }
+  return blocked;
+}
+
 // The four run buckets, printed after every non-dry run. `unchanged` (digest-identical skip, #1127)
 // and `declined` (new-member consent, #1128) render from empty lists until those units land — the
 // summary contract is stable from here on, so both buckets are always shown.
@@ -508,7 +601,12 @@ export function expectedMemberDigest(source, member, { localRoot }) {
 // installed store (`~/.agents/skills`); the member lives under it by installName.
 export function classifyInstalledMember(source, member, { enableTdd = true, localRoot, skillsRoot }) {
   const directory = join(skillsRoot, member.installName);
-  const entry = { member: member.installName, sourceId: source?.id ?? null, directory };
+  const entry = {
+    member: member.installName,
+    sourceId: source?.id ?? null,
+    directory,
+    ...(member.requires?.length > 0 ? { requires: member.requires } : {}),
+  };
   if (!statSync(directory, { throwIfNoEntry: false })?.isDirectory()) {
     return { ...entry, status: 'missing' };
   }
@@ -835,6 +933,7 @@ function selectionIncludesTdd(groupIds, catalog) {
 export async function runCli(args, {
   execute,
   applyPolicy,
+  verifyMember,
   stdin = process.stdin,
   stdout = process.stdout,
   stderr = process.stderr,
@@ -930,10 +1029,11 @@ export async function runCli(args, {
       skipMembers,
       omitMembers: declined,
     });
+    const batches = coalesceBundleCommands(commands);
     if (parsed.dryRun) {
       if (buckets) printUpdateBuckets(stdout, buckets);
-      for (const planned of commands) {
-        stdout.write(`\n${planned.groupName} / ${planned.sourceId} / ${planned.member}\n${planned.command}\n`);
+      for (const batch of batches) {
+        stdout.write(`\n${batch.groupName} / ${batch.sourceId} / ${batch.members.map(({ member }) => member).join(', ')}\n${batch.command}\n`);
       }
       if (buckets && commands.length === 0 && archiveCandidates.length === 0) {
         stdout.write('Nothing to do: every accepted skill is already up to date.\n');
@@ -946,24 +1046,43 @@ export async function runCli(args, {
       const skipping = buckets.unchanged.map((entry) => entry.member).filter((member) => !SUPPORT_GROUPS.has(member));
       if (skipping.length > 0) stdout.write(`Up to date, skipping: ${skipping.join(', ')}\n`);
     }
-    const { succeeded, failed } = runBundleCommands(commands, {
+    const verificationTransport = resolveBundleTransport(transport);
+    const verificationSources = new Map(readRecipes(verificationTransport.recipesPath).sources
+      .map((source) => [source.id, source]));
+    const verifyInstalledMember = verifyMember ?? (execute ? undefined : (planned) => {
+      const source = verificationSources.get(planned.sourceId);
+      return classifyInstalledMember(source, planned.metadata, {
+        enableTdd,
+        localRoot: verificationTransport.localRoot,
+        skillsRoot,
+      }).status === 'unchanged';
+    });
+    const { succeeded, failed } = runBundleCommands(batches, {
       execute,
       applyPolicy,
+      verifyMember: verifyInstalledMember,
       skillsRoot,
       stdout,
       stderr,
+      satisfiedMembers: buckets?.unchanged.map((entry) => entry.member),
     });
     const readyMembers = new Set([
       ...succeeded.map((planned) => planned.member),
       ...(buckets?.unchanged.map((entry) => entry.member) ?? []),
     ]);
+    failed.push(...enforceReadyDependencies(
+      readyMembers,
+      [...commands, ...(buckets?.unchanged ?? [])],
+      stderr,
+    ));
+    const coherentSucceeded = succeeded.filter((planned) => readyMembers.has(planned.member));
     const archives = runArchiveCommands(
       archiveCandidates.filter((candidate) => !declinedArchives.has(candidate.installName)),
       readyMembers,
       { execute, skillsRoot, stdout, stderr },
     );
     printRunSummary(stdout, {
-      succeeded,
+      succeeded: coherentSucceeded,
       failed,
       unchanged: buckets?.unchanged.map((entry) => entry.member),
       declined: [...declined],

package/runtime/skills/engineering/engineering-runtime/scripts/workflow-coherence.mjs

@@ -154,6 +154,10 @@ const TEST_FIXTURE = /\.fixtures?\.[^.]+$/;
 export function publishedContentExcluded(name) {
   return name.startsWith('.')
     || name === 'node_modules'
+    || name === '__pycache__'
+    || name === 'evals'
+    || name === 'samples'
+    || name === 'tests'
     || name.endsWith('-workspace')
     || name.endsWith('.test.mjs')
     || TEST_FIXTURE.test(name);

package/runtime/skills/engineering/engineering-runtime/scripts/workflow-policy.mjs

@@ -86,7 +86,7 @@ export const WORKFLOW_TRUSTED_SOURCES = deepFreeze({
     id: 'first-party',
     type: 'first-party',
     package: '@1aboveio/skills',
-    version: '0.20.2',
+    version: '0.20.4',
   },
   matt: {
     id: 'matt-pocock',

package/skills/compliance/compliance-audit/LICENSE

@@ -0,0 +1,3 @@
+MIT License
+
+Copyright (c) 2026 1AboveIO