@cleocode/caamp 2026.4.7 → 2026.4.10

package/dist/index.js

@@ -1,6 +1,9 @@
 import {
+  DEFAULT_EXCLUSIVITY_MODE,
+  EXCLUSIVITY_MODE_ENV_VAR,
   MarketplaceClient,
   PiHarness,
+  PiRequiredError,
   RECOMMENDATION_ERROR_CODES,
   buildLibraryFromFiles,
   catalog_exports,
@@ -17,6 +20,7 @@ import {
   ensureDir,
   formatSkillRecommendations,
   getAllHarnesses,
+  getExclusivityMode,
   getHarnessFor,
   getInstalledProviders,
   getNestedValue,
@@ -25,6 +29,7 @@ import {
   installBatchWithRollback,
   installMcpServer,
   installSkill,
+  isExclusivityMode,
   isMarketplaceScoped,
   isQuiet,
   isVerbose,
@@ -48,6 +53,7 @@ import {
   removeSkill,
   removeSkillFromLock,
   resetDetectionCache,
+  resetExclusivityModeOverride,
   resolveDefaultTargetProviders,
   resolveMcpConfigPath,
   scanDirectory,
@@ -55,6 +61,7 @@ import {
   scoreSkillRecommendation,
   searchSkills,
   selectProvidersByMinimumPriority,
+  setExclusivityMode,
   setQuiet,
   setVerbose,
   toSarif,
@@ -63,7 +70,7 @@ import {
   validateRecommendationCriteria,
   validateSkill,
   writeConfig
-} from "./chunk-HEAGCHKU.js";
+} from "./chunk-XVZT7K6F.js";
 import {
   buildInjectionContent,
   buildSkillsMap,
@@ -288,9 +295,12 @@ async function validateInstructionIntegrity(providers, projectDir, scope, expect
 }
 export {
   CANONICAL_HOOK_EVENTS,
+  DEFAULT_EXCLUSIVITY_MODE,
+  EXCLUSIVITY_MODE_ENV_VAR,
   HOOK_CATEGORIES,
   MarketplaceClient,
   PiHarness,
+  PiRequiredError,
   RECOMMENDATION_ERROR_CODES,
   _resetPlatformPathsCache,
   buildHookMatrix,
@@ -335,6 +345,7 @@ export {
   getCommonEvents,
   getCommonHookEvents,
   getEffectiveSkillsPaths,
+  getExclusivityMode,
   getHarnessFor,
   getHookConfigPath,
   getHookMappingsVersion,
@@ -376,6 +387,7 @@ export {
   installMcpServer,
   installSkill,
   isCaampOwnedSkill,
+  isExclusivityMode,
   isMarketplaceScoped,
   isQuiet,
   isVerbose,
@@ -402,6 +414,7 @@ export {
   removeSkill,
   removeSkillFromLock,
   resetDetectionCache,
+  resetExclusivityModeOverride,
   resolveAlias,
   resolveDefaultTargetProviders,
   resolveMcpConfigPath,
@@ -413,6 +426,7 @@ export {
   scoreSkillRecommendation,
   searchSkills,
   selectProvidersByMinimumPriority,
+  setExclusivityMode,
   setQuiet,
   setVerbose,
   shouldOverrideSkill,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/core/skills/integrity.ts"],"sourcesContent":["/**\n * Skill integrity checking\n *\n * Validates that installed skills have intact symlinks, correct canonical paths,\n * and enforces ct-* prefix priority for CAAMP-shipped skills.\n */\n\nimport { existsSync, lstatSync, readlinkSync } from 'node:fs';\nimport { join, resolve } from 'node:path';\nimport type { LockEntry, Provider } from '../../types.js';\nimport { readLockFile } from '../lock-utils.js';\nimport { getCanonicalSkillsDir, resolveProviderSkillsDirs } from '../paths/standard.js';\n\n/** CAAMP-reserved skill prefix. Skills with this prefix are owned by CAAMP. */\nconst CAAMP_SKILL_PREFIX = 'ct-';\n\n/**\n * Status of a single skill's integrity check.\n *\n * @public\n */\nexport type SkillIntegrityStatus =\n  | 'intact'\n  | 'broken-symlink'\n  | 'missing-canonical'\n  | 'missing-link'\n  | 'not-tracked'\n  | 'tampered';\n\n/**\n * Result of checking a single skill's integrity.\n *\n * @public\n */\nexport interface SkillIntegrityResult {\n  /** Skill name. */\n  name: string;\n  /** Overall integrity status. */\n  status: SkillIntegrityStatus;\n  /** Whether the canonical directory exists. */\n  canonicalExists: boolean;\n  /** Expected canonical path from lock file. */\n  canonicalPath: string | null;\n  /** Provider link statuses — which agents have valid symlinks. */\n  linkStatuses: Array<{\n    providerId: string;\n    linkPath: string;\n    exists: boolean;\n    isSymlink: boolean;\n    pointsToCanonical: boolean;\n  }>;\n  /** Whether this is a CAAMP-reserved (ct-*) skill. */\n  isCaampOwned: boolean;\n  /** Human-readable issue description, if any. */\n  issue?: string;\n}\n\n/**\n * Check whether a skill name is reserved by CAAMP (ct-* prefix).\n *\n * @remarks\n * Skills with the `ct-` prefix are considered CAAMP-owned and receive\n * special treatment during installation conflict resolution.\n *\n * @param skillName - Skill name to check\n * @returns `true` if the skill name starts with `ct-`\n *\n * @example\n * ```typescript\n * isCaampOwnedSkill(\"ct-research-agent\"); // true\n * isCaampOwnedSkill(\"my-custom-skill\");   // false\n * ```\n *\n * @public\n */\nexport function isCaampOwnedSkill(skillName: string): boolean {\n  return skillName.startsWith(CAAMP_SKILL_PREFIX);\n}\n\n/**\n * Check the integrity of a single installed skill.\n *\n * @remarks\n * Validates that the canonical directory exists on disk, the lock file entry\n * matches the actual state, and symlinks from provider skill directories\n * point to the canonical path.\n *\n * @param skillName - Name of the skill to check\n * @param providers - Providers to check symlinks for\n * @param scope - Whether to check global or project links\n * @param projectDir - Project directory (for project scope)\n * @returns Integrity check result\n *\n * @example\n * ```typescript\n * const result = await checkSkillIntegrity(\"ct-research-agent\", providers, \"global\");\n * if (result.status !== \"intact\") {\n *   console.log(`Issue: ${result.issue}`);\n * }\n * ```\n *\n * @public\n */\nexport async function checkSkillIntegrity(\n  skillName: string,\n  providers: Provider[],\n  scope: 'global' | 'project' = 'global',\n  projectDir?: string,\n): Promise<SkillIntegrityResult> {\n  const lock = await readLockFile();\n  const entry = lock.skills[skillName];\n  const isCaampOwned = isCaampOwnedSkill(skillName);\n\n  // Not tracked in lock file\n  if (!entry) {\n    const canonicalPath = join(getCanonicalSkillsDir(), skillName);\n    return {\n      name: skillName,\n      status: 'not-tracked',\n      canonicalExists: existsSync(canonicalPath),\n      canonicalPath: null,\n      linkStatuses: [],\n      isCaampOwned,\n      issue: 'Skill is not tracked in the CAAMP lock file',\n    };\n  }\n\n  const canonicalPath = entry.canonicalPath;\n  const canonicalExists = existsSync(canonicalPath);\n\n  // Check symlinks for each provider\n  const linkStatuses: SkillIntegrityResult['linkStatuses'] = [];\n\n  for (const provider of providers) {\n    const targetDirs = resolveProviderSkillsDirs(provider, scope, projectDir);\n    for (const skillsDir of targetDirs) {\n      if (!skillsDir) continue;\n\n      const linkPath = join(skillsDir, skillName);\n      const exists = existsSync(linkPath);\n      let isSymlink = false;\n      let pointsToCanonical = false;\n\n      if (exists) {\n        try {\n          const stat = lstatSync(linkPath);\n          isSymlink = stat.isSymbolicLink();\n          if (isSymlink) {\n            const target = resolve(readlinkSync(linkPath));\n            pointsToCanonical = target === resolve(canonicalPath);\n          }\n        } catch {\n          // Can't stat — treat as broken\n        }\n      }\n\n      linkStatuses.push({\n        providerId: provider.id,\n        linkPath,\n        exists,\n        isSymlink,\n        pointsToCanonical,\n      });\n    }\n  }\n\n  // Determine overall status\n  if (!canonicalExists) {\n    return {\n      name: skillName,\n      status: 'missing-canonical',\n      canonicalExists,\n      canonicalPath,\n      linkStatuses,\n      isCaampOwned,\n      issue: `Canonical directory missing: ${canonicalPath}`,\n    };\n  }\n\n  const brokenLinks = linkStatuses.filter((l) => !l.exists);\n  const tamperedLinks = linkStatuses.filter((l) => l.exists && !l.pointsToCanonical);\n\n  if (tamperedLinks.length > 0) {\n    return {\n      name: skillName,\n      status: 'tampered',\n      canonicalExists,\n      canonicalPath,\n      linkStatuses,\n      isCaampOwned,\n      issue: `${tamperedLinks.length} link(s) do not point to canonical path`,\n    };\n  }\n\n  if (brokenLinks.length > 0) {\n    return {\n      name: skillName,\n      status: 'broken-symlink',\n      canonicalExists,\n      canonicalPath,\n      linkStatuses,\n      isCaampOwned,\n      issue: `${brokenLinks.length} symlink(s) missing`,\n    };\n  }\n\n  return {\n    name: skillName,\n    status: 'intact',\n    canonicalExists,\n    canonicalPath,\n    linkStatuses,\n    isCaampOwned,\n  };\n}\n\n/**\n * Check integrity of all tracked skills.\n *\n * @remarks\n * Iterates over every skill in the lock file and runs\n * {@link checkSkillIntegrity} on each.\n *\n * @param providers - Providers to check symlinks for\n * @param scope - Whether to check global or project links\n * @param projectDir - Project directory (for project scope)\n * @returns Map of skill name to integrity result\n *\n * @example\n * ```typescript\n * const results = await checkAllSkillIntegrity(providers);\n * for (const [name, result] of results) {\n *   console.log(`${name}: ${result.status}`);\n * }\n * ```\n *\n * @public\n */\nexport async function checkAllSkillIntegrity(\n  providers: Provider[],\n  scope: 'global' | 'project' = 'global',\n  projectDir?: string,\n): Promise<Map<string, SkillIntegrityResult>> {\n  const lock = await readLockFile();\n  const results = new Map<string, SkillIntegrityResult>();\n\n  for (const skillName of Object.keys(lock.skills)) {\n    const result = await checkSkillIntegrity(skillName, providers, scope, projectDir);\n    results.set(skillName, result);\n  }\n\n  return results;\n}\n\n/**\n * Resolve a skill name conflict where a user-installed skill collides\n * with a CAAMP-owned (ct-*) skill.\n *\n * @remarks\n * CAAMP-owned skills always win. Returns `true` if the incoming skill\n * should take precedence over the existing installation.\n *\n * @param skillName - Skill name to check\n * @param incomingSource - Source of the incoming skill installation\n * @param existingEntry - Existing lock entry, if any\n * @returns `true` if the incoming installation should proceed\n *\n * @example\n * ```typescript\n * const proceed = shouldOverrideSkill(\"ct-research-agent\", \"library\", existingEntry);\n * if (proceed) {\n *   // Safe to install/override\n * }\n * ```\n *\n * @public\n */\nexport function shouldOverrideSkill(\n  skillName: string,\n  incomingSource: string,\n  existingEntry: LockEntry | undefined,\n): boolean {\n  // No existing entry — always allow\n  if (!existingEntry) return true;\n\n  // For ct-* skills, CAAMP package source always wins\n  if (isCaampOwnedSkill(skillName)) {\n    // If incoming is from CAAMP package (library source), it always wins\n    if (existingEntry.sourceType === 'library') return true;\n    // If existing is from CAAMP but incoming is user, CAAMP wins (block user)\n    return true;\n  }\n\n  // Non-ct-* skills: user always wins\n  return true;\n}\n\n/**\n * Validate instruction file injection status across all providers.\n *\n * @remarks\n * Checks that CAAMP blocks exist and are current in all relevant\n * instruction files (CLAUDE.md, AGENTS.md, GEMINI.md).\n *\n * @param providers - Providers to check\n * @param projectDir - Project directory\n * @param scope - Whether to check global or project files\n * @param expectedContent - Expected CAAMP block content\n * @returns Array of file paths with issues\n *\n * @example\n * ```typescript\n * const issues = await validateInstructionIntegrity(providers, process.cwd(), \"project\");\n * for (const issue of issues) {\n *   console.log(`${issue.providerId}: ${issue.issue} (${issue.file})`);\n * }\n * ```\n *\n * @public\n */\nexport async function validateInstructionIntegrity(\n  providers: Provider[],\n  projectDir: string,\n  scope: 'project' | 'global',\n  expectedContent?: string,\n): Promise<Array<{ file: string; providerId: string; issue: string }>> {\n  const { checkAllInjections } = await import('../instructions/injector.js');\n  const results = await checkAllInjections(providers, projectDir, scope, expectedContent);\n  const issues: Array<{ file: string; providerId: string; issue: string }> = [];\n\n  for (const result of results) {\n    if (result.status === 'missing') {\n      issues.push({\n        file: result.file,\n        providerId: result.provider,\n        issue: 'Instruction file does not exist',\n      });\n    } else if (result.status === 'none') {\n      issues.push({\n        file: result.file,\n        providerId: result.provider,\n        issue: 'No CAAMP injection block found',\n      });\n    } else if (result.status === 'outdated') {\n      issues.push({\n        file: result.file,\n        providerId: result.provider,\n        issue: 'CAAMP injection block is outdated',\n      });\n    }\n  }\n\n  return issues;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAOA,SAAS,YAAY,WAAW,oBAAoB;AACpD,SAAS,MAAM,eAAe;AAM9B,IAAM,qBAAqB;AA6DpB,SAAS,kBAAkB,WAA4B;AAC5D,SAAO,UAAU,WAAW,kBAAkB;AAChD;AA0BA,eAAsB,oBACpB,WACA,WACA,QAA8B,UAC9B,YAC+B;AAC/B,QAAM,OAAO,MAAM,aAAa;AAChC,QAAM,QAAQ,KAAK,OAAO,SAAS;AACnC,QAAM,eAAe,kBAAkB,SAAS;AAGhD,MAAI,CAAC,OAAO;AACV,UAAMA,iBAAgB,KAAK,sBAAsB,GAAG,SAAS;AAC7D,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,iBAAiB,WAAWA,cAAa;AAAA,MACzC,eAAe;AAAA,MACf,cAAc,CAAC;AAAA,MACf;AAAA,MACA,OAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,gBAAgB,MAAM;AAC5B,QAAM,kBAAkB,WAAW,aAAa;AAGhD,QAAM,eAAqD,CAAC;AAE5D,aAAW,YAAY,WAAW;AAChC,UAAM,aAAa,0BAA0B,UAAU,OAAO,UAAU;AACxE,eAAW,aAAa,YAAY;AAClC,UAAI,CAAC,UAAW;AAEhB,YAAM,WAAW,KAAK,WAAW,SAAS;AAC1C,YAAM,SAAS,WAAW,QAAQ;AAClC,UAAI,YAAY;AAChB,UAAI,oBAAoB;AAExB,UAAI,QAAQ;AACV,YAAI;AACF,gBAAM,OAAO,UAAU,QAAQ;AAC/B,sBAAY,KAAK,eAAe;AAChC,cAAI,WAAW;AACb,kBAAM,SAAS,QAAQ,aAAa,QAAQ,CAAC;AAC7C,gCAAoB,WAAW,QAAQ,aAAa;AAAA,UACtD;AAAA,QACF,QAAQ;AAAA,QAER;AAAA,MACF;AAEA,mBAAa,KAAK;AAAA,QAChB,YAAY,SAAS;AAAA,QACrB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAGA,MAAI,CAAC,iBAAiB;AACpB,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,gCAAgC,aAAa;AAAA,IACtD;AAAA,EACF;AAEA,QAAM,cAAc,aAAa,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM;AACxD,QAAM,gBAAgB,aAAa,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,iBAAiB;AAEjF,MAAI,cAAc,SAAS,GAAG;AAC5B,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,GAAG,cAAc,MAAM;AAAA,IAChC;AAAA,EACF;AAEA,MAAI,YAAY,SAAS,GAAG;AAC1B,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,GAAG,YAAY,MAAM;AAAA,IAC9B;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAwBA,eAAsB,uBACpB,WACA,QAA8B,UAC9B,YAC4C;AAC5C,QAAM,OAAO,MAAM,aAAa;AAChC,QAAM,UAAU,oBAAI,IAAkC;AAEtD,aAAW,aAAa,OAAO,KAAK,KAAK,MAAM,GAAG;AAChD,UAAM,SAAS,MAAM,oBAAoB,WAAW,WAAW,OAAO,UAAU;AAChF,YAAQ,IAAI,WAAW,MAAM;AAAA,EAC/B;AAEA,SAAO;AACT;AAyBO,SAAS,oBACd,WACA,gBACA,eACS;AAET,MAAI,CAAC,cAAe,QAAO;AAG3B,MAAI,kBAAkB,SAAS,GAAG;AAEhC,QAAI,cAAc,eAAe,UAAW,QAAO;AAEnD,WAAO;AAAA,EACT;AAGA,SAAO;AACT;AAyBA,eAAsB,6BACpB,WACA,YACA,OACA,iBACqE;AACrE,QAAM,EAAE,oBAAAC,oBAAmB,IAAI,MAAM,OAAO,wBAA6B;AACzE,QAAM,UAAU,MAAMA,oBAAmB,WAAW,YAAY,OAAO,eAAe;AACtF,QAAM,SAAqE,CAAC;AAE5E,aAAW,UAAU,SAAS;AAC5B,QAAI,OAAO,WAAW,WAAW;AAC/B,aAAO,KAAK;AAAA,QACV,MAAM,OAAO;AAAA,QACb,YAAY,OAAO;AAAA,QACnB,OAAO;AAAA,MACT,CAAC;AAAA,IACH,WAAW,OAAO,WAAW,QAAQ;AACnC,aAAO,KAAK;AAAA,QACV,MAAM,OAAO;AAAA,QACb,YAAY,OAAO;AAAA,QACnB,OAAO;AAAA,MACT,CAAC;AAAA,IACH,WAAW,OAAO,WAAW,YAAY;AACvC,aAAO,KAAK;AAAA,QACV,MAAM,OAAO;AAAA,QACb,YAAY,OAAO;AAAA,QACnB,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;","names":["canonicalPath","checkAllInjections"]}
+{"version":3,"sources":["../src/core/skills/integrity.ts"],"sourcesContent":["/**\n * Skill integrity checking\n *\n * Validates that installed skills have intact symlinks, correct canonical paths,\n * and enforces ct-* prefix priority for CAAMP-shipped skills.\n */\n\nimport { existsSync, lstatSync, readlinkSync } from 'node:fs';\nimport { join, resolve } from 'node:path';\nimport type { LockEntry, Provider } from '../../types.js';\nimport { readLockFile } from '../lock-utils.js';\nimport { getCanonicalSkillsDir, resolveProviderSkillsDirs } from '../paths/standard.js';\n\n/** CAAMP-reserved skill prefix. Skills with this prefix are owned by CAAMP. */\nconst CAAMP_SKILL_PREFIX = 'ct-';\n\n/**\n * Status of a single skill's integrity check.\n *\n * @public\n */\nexport type SkillIntegrityStatus =\n  | 'intact'\n  | 'broken-symlink'\n  | 'missing-canonical'\n  | 'missing-link'\n  | 'not-tracked'\n  | 'tampered';\n\n/**\n * Result of checking a single skill's integrity.\n *\n * @public\n */\nexport interface SkillIntegrityResult {\n  /** Skill name. */\n  name: string;\n  /** Overall integrity status. */\n  status: SkillIntegrityStatus;\n  /** Whether the canonical directory exists. */\n  canonicalExists: boolean;\n  /** Expected canonical path from lock file. */\n  canonicalPath: string | null;\n  /** Provider link statuses — which agents have valid symlinks. */\n  linkStatuses: Array<{\n    providerId: string;\n    linkPath: string;\n    exists: boolean;\n    isSymlink: boolean;\n    pointsToCanonical: boolean;\n  }>;\n  /** Whether this is a CAAMP-reserved (ct-*) skill. */\n  isCaampOwned: boolean;\n  /** Human-readable issue description, if any. */\n  issue?: string;\n}\n\n/**\n * Check whether a skill name is reserved by CAAMP (ct-* prefix).\n *\n * @remarks\n * Skills with the `ct-` prefix are considered CAAMP-owned and receive\n * special treatment during installation conflict resolution.\n *\n * @param skillName - Skill name to check\n * @returns `true` if the skill name starts with `ct-`\n *\n * @example\n * ```typescript\n * isCaampOwnedSkill(\"ct-research-agent\"); // true\n * isCaampOwnedSkill(\"my-custom-skill\");   // false\n * ```\n *\n * @public\n */\nexport function isCaampOwnedSkill(skillName: string): boolean {\n  return skillName.startsWith(CAAMP_SKILL_PREFIX);\n}\n\n/**\n * Check the integrity of a single installed skill.\n *\n * @remarks\n * Validates that the canonical directory exists on disk, the lock file entry\n * matches the actual state, and symlinks from provider skill directories\n * point to the canonical path.\n *\n * @param skillName - Name of the skill to check\n * @param providers - Providers to check symlinks for\n * @param scope - Whether to check global or project links\n * @param projectDir - Project directory (for project scope)\n * @returns Integrity check result\n *\n * @example\n * ```typescript\n * const result = await checkSkillIntegrity(\"ct-research-agent\", providers, \"global\");\n * if (result.status !== \"intact\") {\n *   console.log(`Issue: ${result.issue}`);\n * }\n * ```\n *\n * @public\n */\nexport async function checkSkillIntegrity(\n  skillName: string,\n  providers: Provider[],\n  scope: 'global' | 'project' = 'global',\n  projectDir?: string,\n): Promise<SkillIntegrityResult> {\n  const lock = await readLockFile();\n  const entry = lock.skills[skillName];\n  const isCaampOwned = isCaampOwnedSkill(skillName);\n\n  // Not tracked in lock file\n  if (!entry) {\n    const canonicalPath = join(getCanonicalSkillsDir(), skillName);\n    return {\n      name: skillName,\n      status: 'not-tracked',\n      canonicalExists: existsSync(canonicalPath),\n      canonicalPath: null,\n      linkStatuses: [],\n      isCaampOwned,\n      issue: 'Skill is not tracked in the CAAMP lock file',\n    };\n  }\n\n  const canonicalPath = entry.canonicalPath;\n  const canonicalExists = existsSync(canonicalPath);\n\n  // Check symlinks for each provider\n  const linkStatuses: SkillIntegrityResult['linkStatuses'] = [];\n\n  for (const provider of providers) {\n    const targetDirs = resolveProviderSkillsDirs(provider, scope, projectDir);\n    for (const skillsDir of targetDirs) {\n      if (!skillsDir) continue;\n\n      const linkPath = join(skillsDir, skillName);\n      const exists = existsSync(linkPath);\n      let isSymlink = false;\n      let pointsToCanonical = false;\n\n      if (exists) {\n        try {\n          const stat = lstatSync(linkPath);\n          isSymlink = stat.isSymbolicLink();\n          if (isSymlink) {\n            const target = resolve(readlinkSync(linkPath));\n            pointsToCanonical = target === resolve(canonicalPath);\n          }\n        } catch {\n          // Can't stat — treat as broken\n        }\n      }\n\n      linkStatuses.push({\n        providerId: provider.id,\n        linkPath,\n        exists,\n        isSymlink,\n        pointsToCanonical,\n      });\n    }\n  }\n\n  // Determine overall status\n  if (!canonicalExists) {\n    return {\n      name: skillName,\n      status: 'missing-canonical',\n      canonicalExists,\n      canonicalPath,\n      linkStatuses,\n      isCaampOwned,\n      issue: `Canonical directory missing: ${canonicalPath}`,\n    };\n  }\n\n  const brokenLinks = linkStatuses.filter((l) => !l.exists);\n  const tamperedLinks = linkStatuses.filter((l) => l.exists && !l.pointsToCanonical);\n\n  if (tamperedLinks.length > 0) {\n    return {\n      name: skillName,\n      status: 'tampered',\n      canonicalExists,\n      canonicalPath,\n      linkStatuses,\n      isCaampOwned,\n      issue: `${tamperedLinks.length} link(s) do not point to canonical path`,\n    };\n  }\n\n  if (brokenLinks.length > 0) {\n    return {\n      name: skillName,\n      status: 'broken-symlink',\n      canonicalExists,\n      canonicalPath,\n      linkStatuses,\n      isCaampOwned,\n      issue: `${brokenLinks.length} symlink(s) missing`,\n    };\n  }\n\n  return {\n    name: skillName,\n    status: 'intact',\n    canonicalExists,\n    canonicalPath,\n    linkStatuses,\n    isCaampOwned,\n  };\n}\n\n/**\n * Check integrity of all tracked skills.\n *\n * @remarks\n * Iterates over every skill in the lock file and runs\n * {@link checkSkillIntegrity} on each.\n *\n * @param providers - Providers to check symlinks for\n * @param scope - Whether to check global or project links\n * @param projectDir - Project directory (for project scope)\n * @returns Map of skill name to integrity result\n *\n * @example\n * ```typescript\n * const results = await checkAllSkillIntegrity(providers);\n * for (const [name, result] of results) {\n *   console.log(`${name}: ${result.status}`);\n * }\n * ```\n *\n * @public\n */\nexport async function checkAllSkillIntegrity(\n  providers: Provider[],\n  scope: 'global' | 'project' = 'global',\n  projectDir?: string,\n): Promise<Map<string, SkillIntegrityResult>> {\n  const lock = await readLockFile();\n  const results = new Map<string, SkillIntegrityResult>();\n\n  for (const skillName of Object.keys(lock.skills)) {\n    const result = await checkSkillIntegrity(skillName, providers, scope, projectDir);\n    results.set(skillName, result);\n  }\n\n  return results;\n}\n\n/**\n * Resolve a skill name conflict where a user-installed skill collides\n * with a CAAMP-owned (ct-*) skill.\n *\n * @remarks\n * CAAMP-owned skills always win. Returns `true` if the incoming skill\n * should take precedence over the existing installation.\n *\n * @param skillName - Skill name to check\n * @param incomingSource - Source of the incoming skill installation\n * @param existingEntry - Existing lock entry, if any\n * @returns `true` if the incoming installation should proceed\n *\n * @example\n * ```typescript\n * const proceed = shouldOverrideSkill(\"ct-research-agent\", \"library\", existingEntry);\n * if (proceed) {\n *   // Safe to install/override\n * }\n * ```\n *\n * @public\n */\nexport function shouldOverrideSkill(\n  skillName: string,\n  incomingSource: string,\n  existingEntry: LockEntry | undefined,\n): boolean {\n  // No existing entry — always allow\n  if (!existingEntry) return true;\n\n  // For ct-* skills, CAAMP package source always wins\n  if (isCaampOwnedSkill(skillName)) {\n    // If incoming is from CAAMP package (library source), it always wins\n    if (existingEntry.sourceType === 'library') return true;\n    // If existing is from CAAMP but incoming is user, CAAMP wins (block user)\n    return true;\n  }\n\n  // Non-ct-* skills: user always wins\n  return true;\n}\n\n/**\n * Validate instruction file injection status across all providers.\n *\n * @remarks\n * Checks that CAAMP blocks exist and are current in all relevant\n * instruction files (CLAUDE.md, AGENTS.md, GEMINI.md).\n *\n * @param providers - Providers to check\n * @param projectDir - Project directory\n * @param scope - Whether to check global or project files\n * @param expectedContent - Expected CAAMP block content\n * @returns Array of file paths with issues\n *\n * @example\n * ```typescript\n * const issues = await validateInstructionIntegrity(providers, process.cwd(), \"project\");\n * for (const issue of issues) {\n *   console.log(`${issue.providerId}: ${issue.issue} (${issue.file})`);\n * }\n * ```\n *\n * @public\n */\nexport async function validateInstructionIntegrity(\n  providers: Provider[],\n  projectDir: string,\n  scope: 'project' | 'global',\n  expectedContent?: string,\n): Promise<Array<{ file: string; providerId: string; issue: string }>> {\n  const { checkAllInjections } = await import('../instructions/injector.js');\n  const results = await checkAllInjections(providers, projectDir, scope, expectedContent);\n  const issues: Array<{ file: string; providerId: string; issue: string }> = [];\n\n  for (const result of results) {\n    if (result.status === 'missing') {\n      issues.push({\n        file: result.file,\n        providerId: result.provider,\n        issue: 'Instruction file does not exist',\n      });\n    } else if (result.status === 'none') {\n      issues.push({\n        file: result.file,\n        providerId: result.provider,\n        issue: 'No CAAMP injection block found',\n      });\n    } else if (result.status === 'outdated') {\n      issues.push({\n        file: result.file,\n        providerId: result.provider,\n        issue: 'CAAMP injection block is outdated',\n      });\n    }\n  }\n\n  return issues;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAOA,SAAS,YAAY,WAAW,oBAAoB;AACpD,SAAS,MAAM,eAAe;AAM9B,IAAM,qBAAqB;AA6DpB,SAAS,kBAAkB,WAA4B;AAC5D,SAAO,UAAU,WAAW,kBAAkB;AAChD;AA0BA,eAAsB,oBACpB,WACA,WACA,QAA8B,UAC9B,YAC+B;AAC/B,QAAM,OAAO,MAAM,aAAa;AAChC,QAAM,QAAQ,KAAK,OAAO,SAAS;AACnC,QAAM,eAAe,kBAAkB,SAAS;AAGhD,MAAI,CAAC,OAAO;AACV,UAAMA,iBAAgB,KAAK,sBAAsB,GAAG,SAAS;AAC7D,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,iBAAiB,WAAWA,cAAa;AAAA,MACzC,eAAe;AAAA,MACf,cAAc,CAAC;AAAA,MACf;AAAA,MACA,OAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,gBAAgB,MAAM;AAC5B,QAAM,kBAAkB,WAAW,aAAa;AAGhD,QAAM,eAAqD,CAAC;AAE5D,aAAW,YAAY,WAAW;AAChC,UAAM,aAAa,0BAA0B,UAAU,OAAO,UAAU;AACxE,eAAW,aAAa,YAAY;AAClC,UAAI,CAAC,UAAW;AAEhB,YAAM,WAAW,KAAK,WAAW,SAAS;AAC1C,YAAM,SAAS,WAAW,QAAQ;AAClC,UAAI,YAAY;AAChB,UAAI,oBAAoB;AAExB,UAAI,QAAQ;AACV,YAAI;AACF,gBAAM,OAAO,UAAU,QAAQ;AAC/B,sBAAY,KAAK,eAAe;AAChC,cAAI,WAAW;AACb,kBAAM,SAAS,QAAQ,aAAa,QAAQ,CAAC;AAC7C,gCAAoB,WAAW,QAAQ,aAAa;AAAA,UACtD;AAAA,QACF,QAAQ;AAAA,QAER;AAAA,MACF;AAEA,mBAAa,KAAK;AAAA,QAChB,YAAY,SAAS;AAAA,QACrB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAGA,MAAI,CAAC,iBAAiB;AACpB,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,gCAAgC,aAAa;AAAA,IACtD;AAAA,EACF;AAEA,QAAM,cAAc,aAAa,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM;AACxD,QAAM,gBAAgB,aAAa,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,iBAAiB;AAEjF,MAAI,cAAc,SAAS,GAAG;AAC5B,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,GAAG,cAAc,MAAM;AAAA,IAChC;AAAA,EACF;AAEA,MAAI,YAAY,SAAS,GAAG;AAC1B,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,GAAG,YAAY,MAAM;AAAA,IAC9B;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAwBA,eAAsB,uBACpB,WACA,QAA8B,UAC9B,YAC4C;AAC5C,QAAM,OAAO,MAAM,aAAa;AAChC,QAAM,UAAU,oBAAI,IAAkC;AAEtD,aAAW,aAAa,OAAO,KAAK,KAAK,MAAM,GAAG;AAChD,UAAM,SAAS,MAAM,oBAAoB,WAAW,WAAW,OAAO,UAAU;AAChF,YAAQ,IAAI,WAAW,MAAM;AAAA,EAC/B;AAEA,SAAO;AACT;AAyBO,SAAS,oBACd,WACA,gBACA,eACS;AAET,MAAI,CAAC,cAAe,QAAO;AAG3B,MAAI,kBAAkB,SAAS,GAAG;AAEhC,QAAI,cAAc,eAAe,UAAW,QAAO;AAEnD,WAAO;AAAA,EACT;AAGA,SAAO;AACT;AAyBA,eAAsB,6BACpB,WACA,YACA,OACA,iBACqE;AACrE,QAAM,EAAE,oBAAAC,oBAAmB,IAAI,MAAM,OAAO,wBAA6B;AACzE,QAAM,UAAU,MAAMA,oBAAmB,WAAW,YAAY,OAAO,eAAe;AACtF,QAAM,SAAqE,CAAC;AAE5E,aAAW,UAAU,SAAS;AAC5B,QAAI,OAAO,WAAW,WAAW;AAC/B,aAAO,KAAK;AAAA,QACV,MAAM,OAAO;AAAA,QACb,YAAY,OAAO;AAAA,QACnB,OAAO;AAAA,MACT,CAAC;AAAA,IACH,WAAW,OAAO,WAAW,QAAQ;AACnC,aAAO,KAAK;AAAA,QACV,MAAM,OAAO;AAAA,QACb,YAAY,OAAO;AAAA,QACnB,OAAO;AAAA,MACT,CAAC;AAAA,IACH,WAAW,OAAO,WAAW,YAAY;AACvC,aAAO,KAAK;AAAA,QACV,MAAM,OAAO;AAAA,QACb,YAAY,OAAO;AAAA,QACnB,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;","names":["canonicalPath","checkAllInjections"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cleocode/caamp",
-  "version": "2026.4.7",
+  "version": "2026.4.10",
   "description": "Central AI Agent Managed Packages - unified provider registry and package manager for AI coding agents",
   "type": "module",
   "bin": {
@@ -51,10 +51,12 @@
     "jsonc-parser": "^3.3.1",
     "picocolors": "^1.1.1",
     "simple-git": "3.33.0",
-    "@cleocode/lafs": "2026.4.7"
+    "@cleocode/cant": "2026.4.10",
+    "@cleocode/lafs": "2026.4.10"
   },
   "devDependencies": {
     "@biomejs/biome": "2.4.8",
+    "@forge-ts/cli": "0.23.0",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "25.5.0",
     "@vitest/coverage-v8": "^4.1.0",
@@ -82,6 +84,8 @@
     "typecheck": "tsc --noEmit",
     "lint": "biome lint src tests",
     "lint:fix": "biome lint --write src tests",
+    "docs": "forge-ts check && forge-ts build --skip-api",
+    "docs:check": "forge-ts check",
     "docs:api": "typedoc",
     "docs:api:check": "typedoc --emit none",
     "research": "tsx scripts/provider-research.ts"