@delorenj/skillex 0.4.0 → 0.4.2

package/dist/cli.js

@@ -8620,7 +8620,7 @@ async function buildScope(scope, options, forbiddenRoots, verifySet = verifySele
     if (!owned4)
       refuse3(root, "Whole-root switching requires explicit ownership of the existing root.");
     if (owned4.kind === "link") return { identity: owned4 };
-    const children = {};
+    const children2 = {};
     for (const name of awaitableNames) {
       const child = links[join25(root, name)];
       if (!child)
@@ -8628,9 +8628,9 @@ async function buildScope(scope, options, forbiddenRoots, verifySet = verifySele
           join25(root, name),
           "Foreign content prevents a whole-root switch; it will not be removed."
         );
-      children[name] = child;
+      children2[name] = child;
     }
-    return { identity: owned4, children };
+    return { identity: owned4, children: children2 };
   };
   const awaitableNames = rootEntry?.info.isDirectory() ? await readdir16(physicalPath(root, recovery)) : [];
   if (!rootEntry) {
@@ -8969,7 +8969,7 @@ async function publishPrepared(work, staged, destination, node, directories) {
 async function stageNode(work, operation2, path) {
   if (operation2.children !== void 0) {
     await mkdir7(path, { mode: 493 });
-    const children = {};
+    const children2 = {};
     for (const [name, target2] of operation2.children) {
       const destination = join25(operation2.path, name);
       if (!await canonicalTarget(work, name, target2))
@@ -8978,11 +8978,11 @@ async function stageNode(work, operation2, path) {
       await symlink4(relative9(dirname13(destination), target2), child);
       const found2 = await entry2(child);
       if (!found2) refuse3(child, "Prepared activation link disappeared.");
-      children[name] = identity(found2);
+      children2[name] = identity(found2);
     }
     const found = await entry2(path);
     if (!found) refuse3(path, "Prepared activation directory disappeared.");
-    return { identity: identity(found), children };
+    return { identity: identity(found), children: children2 };
   }
   if (operation2.target !== void 0) {
     if (dirname13(operation2.path) === work.plan.activationRoot && !await canonicalTarget(work, basename5(operation2.path), operation2.target))
@@ -11417,7 +11417,7 @@ async function captureMigrationNode(path) {
     mode: Number(before.mode & 0o7777n),
     ...before.isSymbolicLink() ? { raw: await readlink6(path) } : {}
   };
-  const children = {};
+  const children2 = {};
   let hash5 = null;
   if (before.isDirectory()) {
     const names2 = await readdir22(path, { encoding: "buffer" });
@@ -11434,7 +11434,7 @@ async function captureMigrationNode(path) {
       const child = await captureMigrationNode(join31(path, name));
       if (!child)
         migrationRefusal(join31(path, name), "Content disappeared during migration inventory.");
-      Object.defineProperty(children, name, { value: child, enumerable: true });
+      Object.defineProperty(children2, name, { value: child, enumerable: true });
     }
   } else if (before.isFile()) {
     const handle = await open10(
@@ -11473,7 +11473,7 @@ async function captureMigrationNode(path) {
   const after = await lstat20(path, { bigint: true });
   if (after.dev !== before.dev || after.ino !== before.ino || after.mode !== before.mode || after.size !== before.size || after.mtimeNs !== before.mtimeNs || after.ctimeNs !== before.ctimeNs)
     migrationRefusal(path, "Content changed while its migration inventory was being captured.");
-  return { identity: identity5, hash: hash5, children };
+  return { identity: identity5, hash: hash5, children: children2 };
 }
 function migrationDigest(node) {
   const project = (item2) => ({
@@ -12574,16 +12574,16 @@ async function prepare2(target2) {
             shared,
             "The old alias points at one skill definition rather than a collection root."
           );
-        const children = {};
+        const children2 = {};
         const claimNames = [];
         const proofs = [{ path: shared, node: contents }];
         for (const name of Object.keys(contents.children)) {
           const path = join34(target2.root, name);
           const mapped2 = await canonicalMapping(target2, path);
           const output2 = mapped2?.name ?? name;
-          if (Object.hasOwn(children, output2))
+          if (Object.hasOwn(children2, output2))
             migrationRefusal(path, "Two original children map to the same resulting name.");
-          Object.defineProperty(children, output2, {
+          Object.defineProperty(children2, output2, {
             value: mapped2?.target ?? join34(shared, name),
             enumerable: true
           });
@@ -12598,7 +12598,7 @@ async function prepare2(target2) {
               [
                 mapped2 ? "The mapped canonical content is verified." : "The original child remains reachable through a foreign forwarding link; its shared target is untouched."
               ],
-              children[output2]
+              children2[output2]
             )
           );
         }
@@ -12607,7 +12607,7 @@ async function prepare2(target2) {
             "Replace only the old root symlink with a real directory; preserve every inventoried child and leave the shared target untouched."
           ]),
           previous: root,
-          children,
+          children: children2,
           claimRoot: true,
           claimNames,
           proofs
@@ -18229,14 +18229,14 @@ async function normalizeScope(options = {}) {
 // src/core/profile-sync.ts
 import { randomUUID as randomUUID11 } from "node:crypto";
 import { constants as constants13 } from "node:fs";
-import { mkdir as mkdir12, open as open17, readdir as readdir29, realpath as realpath32, rename as rename11, symlink as symlink7, unlink as unlink12 } from "node:fs/promises";
+import { mkdir as mkdir12, open as open17, readdir as readdir30, realpath as realpath32, rename as rename11, symlink as symlink7, unlink as unlink12 } from "node:fs/promises";
 import { dirname as dirname27, join as join44, resolve as resolve25 } from "node:path";
 import { isDeepStrictEqual as isDeepStrictEqual10 } from "node:util";
 
 // src/core/profile-policy.ts
 import { constants as constants12 } from "node:fs";
-import { open as open16, readFile as readFile18, stat as stat8 } from "node:fs/promises";
-import { join as join43 } from "node:path";
+import { open as open16, readdir as readdir29, readFile as readFile18, stat as stat8 } from "node:fs/promises";
+import { basename as basename13, join as join43 } from "node:path";
 import { parseDocument as parseDocument4 } from "yaml";
 var metadataFiles = /* @__PURE__ */ new Set([
   ".usage.json",
@@ -18248,9 +18248,48 @@ var metadataFiles = /* @__PURE__ */ new Set([
   ".curator_ledger.jsonl"
 ]);
 var metadataDirectories = /* @__PURE__ */ new Set([".curator_backups", ".locks"]);
-function hermesMetadata(item2) {
+var hubFiles = /* @__PURE__ */ new Set(["audit.log", "taps.json", "lock.json"]);
+async function children(path) {
+  try {
+    return await readdir29(path, { withFileTypes: true });
+  } catch {
+    return null;
+  }
+}
+async function categoryStub(item2) {
+  if (item2.kind !== "directory" || item2.shadows) return false;
+  const entries = await children(item2.path);
+  return entries?.length === 1 && entries[0]?.name === "DESCRIPTION.md" && entries[0].isFile();
+}
+async function idleHub(item2) {
+  if (item2.kind !== "directory" || item2.name !== ".hub") return false;
+  const entries = await children(item2.path);
+  if (!entries) return false;
+  for (const child of entries) {
+    const path = join43(item2.path, child.name);
+    if (child.isFile() && hubFiles.has(child.name)) {
+      if (child.name !== "lock.json") continue;
+      try {
+        const lock = JSON.parse(await readFile18(path, "utf8"));
+        const installed = lock?.installed;
+        if (!installed || typeof installed !== "object" || Object.keys(installed).length)
+          return false;
+      } catch {
+        return false;
+      }
+    } else if (child.isDirectory() && child.name === "quarantine") {
+      if ((await children(path))?.length !== 0) return false;
+    } else if (child.isDirectory() && child.name === "index-cache") {
+      const cached2 = await children(path);
+      if (!cached2 || cached2.some((entry3) => !entry3.isFile())) return false;
+    } else return false;
+  }
+  return true;
+}
+async function hermesMetadata(item2) {
   if (item2.kind === "file") return metadataFiles.has(item2.name);
-  if (item2.kind === "directory") return metadataDirectories.has(item2.name);
+  if (item2.kind === "directory")
+    return metadataDirectories.has(item2.name) || await idleHub(item2) || await categoryStub(item2);
   return false;
 }
 function refuse5(path, message) {
@@ -18285,11 +18324,38 @@ async function profileInheritsGlobal(profile) {
     refuse5(path, "Profile skills.inherit_global must be boolean.");
   return inherit !== false;
 }
-async function assertStrictProfile(profile, options, local) {
+var learnedScanLimit = 2e4;
+async function learnedSkills(item2) {
+  if (item2.kind !== "directory" || item2.name.startsWith(".")) return null;
+  const skills = [];
+  const pending = [item2.path];
+  let seen = 0;
+  while (pending.length) {
+    const directory2 = pending.pop();
+    const entries = await children(directory2);
+    if (!entries) return null;
+    for (const child of entries) {
+      if (++seen > learnedScanLimit) return null;
+      if (child.isDirectory()) pending.push(join43(directory2, child.name));
+      else if (!child.isFile()) return null;
+      else if (child.name === "SKILL.md") skills.push(basename13(directory2));
+    }
+  }
+  return skills;
+}
+async function assertStrictProfile(profile, options, local, desired = /* @__PURE__ */ new Set()) {
   if (!await strictProfile(profile, options)) return false;
-  for (const item2 of local)
-    if (!hermesMetadata(item2))
-      refuse5(item2.path, `Skillex-only profile contains unowned entry ${item2.name}.`);
+  for (const item2 of local) {
+    if (await hermesMetadata(item2)) continue;
+    const learned = await learnedSkills(item2);
+    if (!learned) refuse5(item2.path, `Skillex-only profile contains unowned entry ${item2.name}.`);
+    const clash = [item2.name, ...learned].find((name) => desired.has(name));
+    if (clash !== void 0)
+      refuse5(
+        item2.path,
+        `Agent-written skill ${clash} in ${item2.name} shares its name with a selected skill.`
+      );
+  }
   const path = join43(profile.root, "config.yaml");
   const config = await entry2(path);
   if (config) {
@@ -18461,7 +18527,7 @@ async function observations(profile, state) {
       "Use the explicit migrate workflow to replace this whole-root alias or conflicting file while preserving profile content."
     );
   if (root)
-    for (const name of (await readdir29(profile.skillsRoot)).sort()) {
+    for (const name of (await readdir30(profile.skillsRoot)).sort()) {
       const path = join44(profile.skillsRoot, name);
       const actual = await entry2(path);
       if (!actual) continue;
@@ -18534,7 +18600,12 @@ async function buildWork(profile, state, options) {
       );
   state = await readProfileState(profile, receiptOptions(profile, options, projection.scopes));
   const observed = await observations(profile, state);
-  await assertStrictProfile(profile, options, observed.local);
+  await assertStrictProfile(
+    profile,
+    options,
+    observed.local,
+    new Set(projection.desired.map((desired) => desired.name))
+  );
   const links = { ...state.data.links };
   const changes = [];
   if (!observed.root) changes.push({ action: "mkdir", path: profile.skillsRoot });
@@ -19010,7 +19081,12 @@ async function runProfileSync(name, options) {
           });
         }
         await assertProfileIdentity(selected);
-        if (await assertStrictProfile(selected, options, (await observations(selected, state)).local))
+        if (await assertStrictProfile(
+          selected,
+          options,
+          (await observations(selected, state)).local,
+          new Set(work.projection.desired.map((desired) => desired.name))
+        ))
           await publishStrictPolicy(selected);
         const currentProfile = await discoverProfile(name, options);
         if (currentProfile.root !== selected.root || currentProfile.skillsRoot !== selected.skillsRoot)
@@ -19652,7 +19728,7 @@ import { randomUUID as randomUUID13 } from "node:crypto";
 import { constants as constants14 } from "node:fs";
 import { mkdir as mkdir13, open as open19, realpath as realpath34, rename as rename13, symlink as symlink8 } from "node:fs/promises";
 import { homedir as homedir16 } from "node:os";
-import { basename as basename13, dirname as dirname29, join as join46, parse as parse6, resolve as resolve27 } from "node:path";
+import { basename as basename14, dirname as dirname29, join as join46, parse as parse6, resolve as resolve27 } from "node:path";
 import { isDeepStrictEqual as isDeepStrictEqual12 } from "node:util";
 import { valid as valid3 } from "semver";
 var binding5 = { namespace: "migrations", targetParts: [".agents", "root-adoption"] };
@@ -19852,7 +19928,7 @@ async function guard2(context2, journal) {
 function paths2(snapshot3, id) {
   const prefix2 = join46(
     dirname29(snapshot3.path),
-    `${basename13(snapshot3.path, ".json")}.root-cutover-${id}`
+    `${basename14(snapshot3.path, ".json")}.root-cutover-${id}`
   );
   return { archive: `${prefix2}-old`, stage: `${prefix2}-new` };
 }
@@ -19964,8 +20040,8 @@ function journalData(snapshot3, context2) {
   )))
     refuse7(snapshot3.path, "The staged root does not match its canonical inventory.");
   for (const stage2 of raw.preservedStages) {
-    const prefix2 = `${basename13(snapshot3.path, ".json")}.root-cutover-`;
-    if (typeof stage2 !== "string" || dirname29(stage2) !== dirname29(snapshot3.path) || !basename13(stage2).startsWith(prefix2) || !uuid.test(basename13(stage2).slice(prefix2.length, -4)) || !stage2.endsWith("-new"))
+    const prefix2 = `${basename14(snapshot3.path, ".json")}.root-cutover-`;
+    if (typeof stage2 !== "string" || dirname29(stage2) !== dirname29(snapshot3.path) || !basename14(stage2).startsWith(prefix2) || !uuid.test(basename14(stage2).slice(prefix2.length, -4)) || !stage2.endsWith("-new"))
       refuse7(snapshot3.path, "A preserved stage has an invalid quarantine path.");
   }
   const data2 = raw;
@@ -20006,7 +20082,7 @@ async function ownerFor2(context2, allowed) {
   ]) {
     if (allowed && (path === context2.root || dirname29(path) === context2.root)) {
       const candidates = allowed.map(
-        (node) => path === context2.root ? node : node.children[basename13(path)]
+        (node) => path === context2.root ? node : node.children[basename14(path)]
       );
       if (!candidates.some(
         (node) => node && ["link", "directory"].includes(node.identity.kind) && isDeepStrictEqual12(nodeIdentity(node), expected)
@@ -20669,7 +20745,7 @@ async function adoptRoot(options = {}) {
 }
 
 // src/core/sets.ts
-import { readdir as readdir30 } from "node:fs/promises";
+import { readdir as readdir31 } from "node:fs/promises";
 import { join as join47 } from "node:path";
 function validateName(name) {
   parseManifest({ sets: [{ name }] }, "set name");
@@ -20692,7 +20768,7 @@ async function listSets(options = {}) {
     const failures = [];
     if (await inspectPath(path)) {
       await requireDirectory(path, "E_SET_MISSING");
-      for (const entry3 of (await readdir30(path, { withFileTypes: true })).sort(
+      for (const entry3 of (await readdir31(path, { withFileTypes: true })).sort(
         (a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0
       )) {
         if (entry3.name.startsWith(".") || entry3.name.startsWith("_") || !entry3.isDirectory() && !entry3.isSymbolicLink())
@@ -20834,7 +20910,7 @@ async function removeSetSkills(name, names2, options = {}) {
 }
 
 // src/core/vendor-inspect.ts
-import { readdir as readdir31 } from "node:fs/promises";
+import { readdir as readdir32 } from "node:fs/promises";
 import { join as join48 } from "node:path";
 
 // src/core/vendor-git.ts
@@ -21126,8 +21202,8 @@ async function readVendorGitSource(source, checkoutRoot, options = {}) {
     checkout
   ).trim();
   const base = await treeAt(checkout, rootTree, source.subdir, options);
-  const children = await treeEntries(checkout, base, options);
-  const declarations = source.membership === "explicit" ? source.skills : children.filter(
+  const children2 = await treeEntries(checkout, base, options);
+  const declarations = source.membership === "explicit" ? source.skills : children2.filter(
     (entry3) => !entry3.name.startsWith(".") && !entry3.name.startsWith("_") && (entry3.type === "tree" || entry3.mode === "120000" || entry3.mode === "160000")
   ).map((entry3) => ({ name: entry3.name, dir: entry3.name }));
   const selected = declarations.filter(
@@ -21199,7 +21275,7 @@ async function recordedInventory(manifest, observation, options) {
   const recorded = /* @__PURE__ */ new Map();
   const failed2 = /* @__PURE__ */ new Set();
   const catalog = join48(manifest.registry.root, "all-skills");
-  for (const entry3 of (await readdir31(catalog, { withFileTypes: true })).sort(
+  for (const entry3 of (await readdir32(catalog, { withFileTypes: true })).sort(
     (a, b) => a.name.localeCompare(b.name)
   )) {
     checkVendorSignal(options);
@@ -21672,7 +21748,7 @@ async function inspectVendorStatus(options = {}) {
 
 // src/core/vendor-sync.ts
 import { randomUUID as randomUUID14 } from "node:crypto";
-import { chmod as chmod4, lstat as lstat27, mkdir as mkdir14, open as open20, readdir as readdir32, rename as rename14 } from "node:fs/promises";
+import { chmod as chmod4, lstat as lstat27, mkdir as mkdir14, open as open20, readdir as readdir33, rename as rename14 } from "node:fs/promises";
 import { dirname as dirname30, join as join49 } from "node:path";
 function refuse8(code, message, path, fix) {
   fail(code, message, { path, fix }, ExitCode.REFUSED);
@@ -21899,7 +21975,7 @@ async function prepare6(options, extractedAt) {
     }
   }
   if (options.prune) {
-    for (const name of (await readdir32(catalog)).filter(isSkillName).sort()) {
+    for (const name of (await readdir33(catalog)).filter(isSkillName).sort()) {
       if (names2.has(name)) continue;
       const path = join49(catalog, name);
       if (!(await vendorLstat(path))?.isDirectory()) continue;

package/dist/core/profile-policy.d.ts

@@ -2,5 +2,11 @@ import type { ProfileLocalEntry, ProfileLocation, ProfileOptions } from "./profi
 export declare function strictProfile(profile: ProfileLocation, options: ProfileOptions): Promise<boolean>;
 /** Persist a profile's selection boundary independently of the caller's HOME. */
 export declare function profileInheritsGlobal(profile: ProfileLocation): Promise<boolean>;
-export declare function assertStrictProfile(profile: ProfileLocation, options: ProfileOptions, local: readonly ProfileLocalEntry[]): Promise<boolean>;
+/**
+ * Strict (Skillex-only) policy: Skillex owns every link it projects. Hermes bookkeeping and the
+ * skills a desk's own agent wrote may sit beside those links (operator decision 2026-11-06,
+ * SKRILL-35); a learned skill named like a selected one, a foreign link, a stray file, an
+ * archive or a hub install is still refused. `desired` names the skills Skillex will project.
+ */
+export declare function assertStrictProfile(profile: ProfileLocation, options: ProfileOptions, local: readonly ProfileLocalEntry[], desired?: ReadonlySet<string>): Promise<boolean>;
 export declare function publishStrictPolicy(profile: ProfileLocation): Promise<void>;

package/dist/index.js

@@ -8618,7 +8618,7 @@ async function buildScope(scope, options, forbiddenRoots, verifySet = verifySele
     if (!owned4)
       refuse3(root, "Whole-root switching requires explicit ownership of the existing root.");
     if (owned4.kind === "link") return { identity: owned4 };
-    const children = {};
+    const children2 = {};
     for (const name of awaitableNames) {
       const child = links[join25(root, name)];
       if (!child)
@@ -8626,9 +8626,9 @@ async function buildScope(scope, options, forbiddenRoots, verifySet = verifySele
           join25(root, name),
           "Foreign content prevents a whole-root switch; it will not be removed."
         );
-      children[name] = child;
+      children2[name] = child;
     }
-    return { identity: owned4, children };
+    return { identity: owned4, children: children2 };
   };
   const awaitableNames = rootEntry?.info.isDirectory() ? await readdir16(physicalPath(root, recovery)) : [];
   if (!rootEntry) {
@@ -8967,7 +8967,7 @@ async function publishPrepared(work, staged, destination, node, directories) {
 async function stageNode(work, operation2, path) {
   if (operation2.children !== void 0) {
     await mkdir7(path, { mode: 493 });
-    const children = {};
+    const children2 = {};
     for (const [name, target2] of operation2.children) {
       const destination = join25(operation2.path, name);
       if (!await canonicalTarget(work, name, target2))
@@ -8976,11 +8976,11 @@ async function stageNode(work, operation2, path) {
       await symlink4(relative9(dirname13(destination), target2), child);
       const found2 = await entry2(child);
       if (!found2) refuse3(child, "Prepared activation link disappeared.");
-      children[name] = identity(found2);
+      children2[name] = identity(found2);
     }
     const found = await entry2(path);
     if (!found) refuse3(path, "Prepared activation directory disappeared.");
-    return { identity: identity(found), children };
+    return { identity: identity(found), children: children2 };
   }
   if (operation2.target !== void 0) {
     if (dirname13(operation2.path) === work.plan.activationRoot && !await canonicalTarget(work, basename5(operation2.path), operation2.target))
@@ -11415,7 +11415,7 @@ async function captureMigrationNode(path) {
     mode: Number(before.mode & 0o7777n),
     ...before.isSymbolicLink() ? { raw: await readlink6(path) } : {}
   };
-  const children = {};
+  const children2 = {};
   let hash5 = null;
   if (before.isDirectory()) {
     const names2 = await readdir22(path, { encoding: "buffer" });
@@ -11432,7 +11432,7 @@ async function captureMigrationNode(path) {
       const child = await captureMigrationNode(join31(path, name));
       if (!child)
         migrationRefusal(join31(path, name), "Content disappeared during migration inventory.");
-      Object.defineProperty(children, name, { value: child, enumerable: true });
+      Object.defineProperty(children2, name, { value: child, enumerable: true });
     }
   } else if (before.isFile()) {
     const handle = await open10(
@@ -11471,7 +11471,7 @@ async function captureMigrationNode(path) {
   const after = await lstat20(path, { bigint: true });
   if (after.dev !== before.dev || after.ino !== before.ino || after.mode !== before.mode || after.size !== before.size || after.mtimeNs !== before.mtimeNs || after.ctimeNs !== before.ctimeNs)
     migrationRefusal(path, "Content changed while its migration inventory was being captured.");
-  return { identity: identity4, hash: hash5, children };
+  return { identity: identity4, hash: hash5, children: children2 };
 }
 function migrationDigest(node) {
   const project = (item2) => ({
@@ -12572,16 +12572,16 @@ async function prepare2(target2) {
             shared,
             "The old alias points at one skill definition rather than a collection root."
           );
-        const children = {};
+        const children2 = {};
         const claimNames = [];
         const proofs = [{ path: shared, node: contents }];
         for (const name of Object.keys(contents.children)) {
           const path = join34(target2.root, name);
           const mapped2 = await canonicalMapping(target2, path);
           const output = mapped2?.name ?? name;
-          if (Object.hasOwn(children, output))
+          if (Object.hasOwn(children2, output))
             migrationRefusal(path, "Two original children map to the same resulting name.");
-          Object.defineProperty(children, output, {
+          Object.defineProperty(children2, output, {
             value: mapped2?.target ?? join34(shared, name),
             enumerable: true
           });
@@ -12596,7 +12596,7 @@ async function prepare2(target2) {
               [
                 mapped2 ? "The mapped canonical content is verified." : "The original child remains reachable through a foreign forwarding link; its shared target is untouched."
               ],
-              children[output]
+              children2[output]
             )
           );
         }
@@ -12605,7 +12605,7 @@ async function prepare2(target2) {
             "Replace only the old root symlink with a real directory; preserve every inventoried child and leave the shared target untouched."
           ]),
           previous: root,
-          children,
+          children: children2,
           claimRoot: true,
           claimNames,
           proofs
@@ -18227,14 +18227,14 @@ async function normalizeScope(options = {}) {
 // src/core/profile-sync.ts
 import { randomUUID as randomUUID11 } from "node:crypto";
 import { constants as constants13 } from "node:fs";
-import { mkdir as mkdir12, open as open17, readdir as readdir29, realpath as realpath32, rename as rename11, symlink as symlink7, unlink as unlink12 } from "node:fs/promises";
+import { mkdir as mkdir12, open as open17, readdir as readdir30, realpath as realpath32, rename as rename11, symlink as symlink7, unlink as unlink12 } from "node:fs/promises";
 import { dirname as dirname27, join as join44, resolve as resolve25 } from "node:path";
 import { isDeepStrictEqual as isDeepStrictEqual10 } from "node:util";
 
 // src/core/profile-policy.ts
 import { constants as constants12 } from "node:fs";
-import { open as open16, readFile as readFile18, stat as stat8 } from "node:fs/promises";
-import { join as join43 } from "node:path";
+import { open as open16, readdir as readdir29, readFile as readFile18, stat as stat8 } from "node:fs/promises";
+import { basename as basename13, join as join43 } from "node:path";
 import { parseDocument as parseDocument4 } from "yaml";
 var metadataFiles = /* @__PURE__ */ new Set([
   ".usage.json",
@@ -18246,9 +18246,48 @@ var metadataFiles = /* @__PURE__ */ new Set([
   ".curator_ledger.jsonl"
 ]);
 var metadataDirectories = /* @__PURE__ */ new Set([".curator_backups", ".locks"]);
-function hermesMetadata(item2) {
+var hubFiles = /* @__PURE__ */ new Set(["audit.log", "taps.json", "lock.json"]);
+async function children(path) {
+  try {
+    return await readdir29(path, { withFileTypes: true });
+  } catch {
+    return null;
+  }
+}
+async function categoryStub(item2) {
+  if (item2.kind !== "directory" || item2.shadows) return false;
+  const entries = await children(item2.path);
+  return entries?.length === 1 && entries[0]?.name === "DESCRIPTION.md" && entries[0].isFile();
+}
+async function idleHub(item2) {
+  if (item2.kind !== "directory" || item2.name !== ".hub") return false;
+  const entries = await children(item2.path);
+  if (!entries) return false;
+  for (const child of entries) {
+    const path = join43(item2.path, child.name);
+    if (child.isFile() && hubFiles.has(child.name)) {
+      if (child.name !== "lock.json") continue;
+      try {
+        const lock = JSON.parse(await readFile18(path, "utf8"));
+        const installed = lock?.installed;
+        if (!installed || typeof installed !== "object" || Object.keys(installed).length)
+          return false;
+      } catch {
+        return false;
+      }
+    } else if (child.isDirectory() && child.name === "quarantine") {
+      if ((await children(path))?.length !== 0) return false;
+    } else if (child.isDirectory() && child.name === "index-cache") {
+      const cached2 = await children(path);
+      if (!cached2 || cached2.some((entry3) => !entry3.isFile())) return false;
+    } else return false;
+  }
+  return true;
+}
+async function hermesMetadata(item2) {
   if (item2.kind === "file") return metadataFiles.has(item2.name);
-  if (item2.kind === "directory") return metadataDirectories.has(item2.name);
+  if (item2.kind === "directory")
+    return metadataDirectories.has(item2.name) || await idleHub(item2) || await categoryStub(item2);
   return false;
 }
 function refuse5(path, message) {
@@ -18283,11 +18322,38 @@ async function profileInheritsGlobal(profile) {
     refuse5(path, "Profile skills.inherit_global must be boolean.");
   return inherit !== false;
 }
-async function assertStrictProfile(profile, options, local) {
+var learnedScanLimit = 2e4;
+async function learnedSkills(item2) {
+  if (item2.kind !== "directory" || item2.name.startsWith(".")) return null;
+  const skills = [];
+  const pending = [item2.path];
+  let seen = 0;
+  while (pending.length) {
+    const directory2 = pending.pop();
+    const entries = await children(directory2);
+    if (!entries) return null;
+    for (const child of entries) {
+      if (++seen > learnedScanLimit) return null;
+      if (child.isDirectory()) pending.push(join43(directory2, child.name));
+      else if (!child.isFile()) return null;
+      else if (child.name === "SKILL.md") skills.push(basename13(directory2));
+    }
+  }
+  return skills;
+}
+async function assertStrictProfile(profile, options, local, desired = /* @__PURE__ */ new Set()) {
   if (!await strictProfile(profile, options)) return false;
-  for (const item2 of local)
-    if (!hermesMetadata(item2))
-      refuse5(item2.path, `Skillex-only profile contains unowned entry ${item2.name}.`);
+  for (const item2 of local) {
+    if (await hermesMetadata(item2)) continue;
+    const learned = await learnedSkills(item2);
+    if (!learned) refuse5(item2.path, `Skillex-only profile contains unowned entry ${item2.name}.`);
+    const clash = [item2.name, ...learned].find((name) => desired.has(name));
+    if (clash !== void 0)
+      refuse5(
+        item2.path,
+        `Agent-written skill ${clash} in ${item2.name} shares its name with a selected skill.`
+      );
+  }
   const path = join43(profile.root, "config.yaml");
   const config = await entry2(path);
   if (config) {
@@ -18459,7 +18525,7 @@ async function observations(profile, state) {
       "Use the explicit migrate workflow to replace this whole-root alias or conflicting file while preserving profile content."
     );
   if (root)
-    for (const name of (await readdir29(profile.skillsRoot)).sort()) {
+    for (const name of (await readdir30(profile.skillsRoot)).sort()) {
       const path = join44(profile.skillsRoot, name);
       const actual = await entry2(path);
       if (!actual) continue;
@@ -18532,7 +18598,12 @@ async function buildWork(profile, state, options) {
       );
   state = await readProfileState(profile, receiptOptions(profile, options, projection.scopes));
   const observed = await observations(profile, state);
-  await assertStrictProfile(profile, options, observed.local);
+  await assertStrictProfile(
+    profile,
+    options,
+    observed.local,
+    new Set(projection.desired.map((desired) => desired.name))
+  );
   const links = { ...state.data.links };
   const changes = [];
   if (!observed.root) changes.push({ action: "mkdir", path: profile.skillsRoot });
@@ -19008,7 +19079,12 @@ async function runProfileSync(name, options) {
           });
         }
         await assertProfileIdentity(selected);
-        if (await assertStrictProfile(selected, options, (await observations(selected, state)).local))
+        if (await assertStrictProfile(
+          selected,
+          options,
+          (await observations(selected, state)).local,
+          new Set(work.projection.desired.map((desired) => desired.name))
+        ))
           await publishStrictPolicy(selected);
         const currentProfile = await discoverProfile(name, options);
         if (currentProfile.root !== selected.root || currentProfile.skillsRoot !== selected.skillsRoot)
@@ -19650,7 +19726,7 @@ import { randomUUID as randomUUID13 } from "node:crypto";
 import { constants as constants14 } from "node:fs";
 import { mkdir as mkdir13, open as open19, realpath as realpath34, rename as rename13, symlink as symlink8 } from "node:fs/promises";
 import { homedir as homedir16 } from "node:os";
-import { basename as basename13, dirname as dirname29, join as join46, parse as parse6, resolve as resolve27 } from "node:path";
+import { basename as basename14, dirname as dirname29, join as join46, parse as parse6, resolve as resolve27 } from "node:path";
 import { isDeepStrictEqual as isDeepStrictEqual12 } from "node:util";
 import { valid as valid3 } from "semver";
 var binding5 = { namespace: "migrations", targetParts: [".agents", "root-adoption"] };
@@ -19850,7 +19926,7 @@ async function guard2(context2, journal) {
 function paths2(snapshot3, id) {
   const prefix2 = join46(
     dirname29(snapshot3.path),
-    `${basename13(snapshot3.path, ".json")}.root-cutover-${id}`
+    `${basename14(snapshot3.path, ".json")}.root-cutover-${id}`
   );
   return { archive: `${prefix2}-old`, stage: `${prefix2}-new` };
 }
@@ -19962,8 +20038,8 @@ function journalData(snapshot3, context2) {
   )))
     refuse7(snapshot3.path, "The staged root does not match its canonical inventory.");
   for (const stage2 of raw.preservedStages) {
-    const prefix2 = `${basename13(snapshot3.path, ".json")}.root-cutover-`;
-    if (typeof stage2 !== "string" || dirname29(stage2) !== dirname29(snapshot3.path) || !basename13(stage2).startsWith(prefix2) || !uuid.test(basename13(stage2).slice(prefix2.length, -4)) || !stage2.endsWith("-new"))
+    const prefix2 = `${basename14(snapshot3.path, ".json")}.root-cutover-`;
+    if (typeof stage2 !== "string" || dirname29(stage2) !== dirname29(snapshot3.path) || !basename14(stage2).startsWith(prefix2) || !uuid.test(basename14(stage2).slice(prefix2.length, -4)) || !stage2.endsWith("-new"))
       refuse7(snapshot3.path, "A preserved stage has an invalid quarantine path.");
   }
   const data2 = raw;
@@ -20004,7 +20080,7 @@ async function ownerFor2(context2, allowed) {
   ]) {
     if (allowed && (path === context2.root || dirname29(path) === context2.root)) {
       const candidates = allowed.map(
-        (node) => path === context2.root ? node : node.children[basename13(path)]
+        (node) => path === context2.root ? node : node.children[basename14(path)]
       );
       if (!candidates.some(
         (node) => node && ["link", "directory"].includes(node.identity.kind) && isDeepStrictEqual12(nodeIdentity(node), expected)
@@ -20667,7 +20743,7 @@ async function adoptRoot(options = {}) {
 }
 
 // src/core/sets.ts
-import { readdir as readdir30 } from "node:fs/promises";
+import { readdir as readdir31 } from "node:fs/promises";
 import { join as join47 } from "node:path";
 function validateName(name) {
   parseManifest({ sets: [{ name }] }, "set name");
@@ -20690,7 +20766,7 @@ async function listSets(options = {}) {
     const failures = [];
     if (await inspectPath(path)) {
       await requireDirectory(path, "E_SET_MISSING");
-      for (const entry3 of (await readdir30(path, { withFileTypes: true })).sort(
+      for (const entry3 of (await readdir31(path, { withFileTypes: true })).sort(
         (a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0
       )) {
         if (entry3.name.startsWith(".") || entry3.name.startsWith("_") || !entry3.isDirectory() && !entry3.isSymbolicLink())
@@ -20832,7 +20908,7 @@ async function removeSetSkills(name, names2, options = {}) {
 }
 
 // src/core/vendor-inspect.ts
-import { readdir as readdir31 } from "node:fs/promises";
+import { readdir as readdir32 } from "node:fs/promises";
 import { join as join48 } from "node:path";
 
 // src/core/vendor-git.ts
@@ -21124,8 +21200,8 @@ async function readVendorGitSource(source, checkoutRoot, options = {}) {
     checkout
   ).trim();
   const base = await treeAt(checkout, rootTree, source.subdir, options);
-  const children = await treeEntries(checkout, base, options);
-  const declarations = source.membership === "explicit" ? source.skills : children.filter(
+  const children2 = await treeEntries(checkout, base, options);
+  const declarations = source.membership === "explicit" ? source.skills : children2.filter(
     (entry3) => !entry3.name.startsWith(".") && !entry3.name.startsWith("_") && (entry3.type === "tree" || entry3.mode === "120000" || entry3.mode === "160000")
   ).map((entry3) => ({ name: entry3.name, dir: entry3.name }));
   const selected = declarations.filter(
@@ -21197,7 +21273,7 @@ async function recordedInventory(manifest, observation, options) {
   const recorded = /* @__PURE__ */ new Map();
   const failed2 = /* @__PURE__ */ new Set();
   const catalog = join48(manifest.registry.root, "all-skills");
-  for (const entry3 of (await readdir31(catalog, { withFileTypes: true })).sort(
+  for (const entry3 of (await readdir32(catalog, { withFileTypes: true })).sort(
     (a, b) => a.name.localeCompare(b.name)
   )) {
     checkVendorSignal(options);
@@ -21670,7 +21746,7 @@ async function inspectVendorStatus(options = {}) {
 
 // src/core/vendor-sync.ts
 import { randomUUID as randomUUID14 } from "node:crypto";
-import { chmod as chmod4, lstat as lstat27, mkdir as mkdir14, open as open20, readdir as readdir32, rename as rename14 } from "node:fs/promises";
+import { chmod as chmod4, lstat as lstat27, mkdir as mkdir14, open as open20, readdir as readdir33, rename as rename14 } from "node:fs/promises";
 import { dirname as dirname30, join as join49 } from "node:path";
 function refuse8(code, message, path, fix) {
   fail(code, message, { path, fix }, ExitCode.REFUSED);
@@ -21897,7 +21973,7 @@ async function prepare6(options, extractedAt) {
     }
   }
   if (options.prune) {
-    for (const name of (await readdir32(catalog)).filter(isSkillName).sort()) {
+    for (const name of (await readdir33(catalog)).filter(isSkillName).sort()) {
       if (names2.has(name)) continue;
       const path = join49(catalog, name);
       if (!(await vendorLstat(path))?.isDirectory()) continue;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@delorenj/skillex",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "Canonical skill catalog and activation management for agentic CLIs.",
   "type": "module",
   "license": "MIT",