@delorenj/skillex 0.4.1 → 0.4.2

package/dist/cli.js

@@ -18236,7 +18236,7 @@ import { isDeepStrictEqual as isDeepStrictEqual10 } from "node:util";
 // src/core/profile-policy.ts
 import { constants as constants12 } from "node:fs";
 import { open as open16, readdir as readdir29, readFile as readFile18, stat as stat8 } from "node:fs/promises";
-import { join as join43 } from "node:path";
+import { basename as basename13, join as join43 } from "node:path";
 import { parseDocument as parseDocument4 } from "yaml";
 var metadataFiles = /* @__PURE__ */ new Set([
   ".usage.json",
@@ -18324,11 +18324,38 @@ async function profileInheritsGlobal(profile) {
     refuse5(path, "Profile skills.inherit_global must be boolean.");
   return inherit !== false;
 }
-async function assertStrictProfile(profile, options, local) {
+var learnedScanLimit = 2e4;
+async function learnedSkills(item2) {
+  if (item2.kind !== "directory" || item2.name.startsWith(".")) return null;
+  const skills = [];
+  const pending = [item2.path];
+  let seen = 0;
+  while (pending.length) {
+    const directory2 = pending.pop();
+    const entries = await children(directory2);
+    if (!entries) return null;
+    for (const child of entries) {
+      if (++seen > learnedScanLimit) return null;
+      if (child.isDirectory()) pending.push(join43(directory2, child.name));
+      else if (!child.isFile()) return null;
+      else if (child.name === "SKILL.md") skills.push(basename13(directory2));
+    }
+  }
+  return skills;
+}
+async function assertStrictProfile(profile, options, local, desired = /* @__PURE__ */ new Set()) {
   if (!await strictProfile(profile, options)) return false;
-  for (const item2 of local)
-    if (!await hermesMetadata(item2))
-      refuse5(item2.path, `Skillex-only profile contains unowned entry ${item2.name}.`);
+  for (const item2 of local) {
+    if (await hermesMetadata(item2)) continue;
+    const learned = await learnedSkills(item2);
+    if (!learned) refuse5(item2.path, `Skillex-only profile contains unowned entry ${item2.name}.`);
+    const clash = [item2.name, ...learned].find((name) => desired.has(name));
+    if (clash !== void 0)
+      refuse5(
+        item2.path,
+        `Agent-written skill ${clash} in ${item2.name} shares its name with a selected skill.`
+      );
+  }
   const path = join43(profile.root, "config.yaml");
   const config = await entry2(path);
   if (config) {
@@ -18573,7 +18600,12 @@ async function buildWork(profile, state, options) {
       );
   state = await readProfileState(profile, receiptOptions(profile, options, projection.scopes));
   const observed = await observations(profile, state);
-  await assertStrictProfile(profile, options, observed.local);
+  await assertStrictProfile(
+    profile,
+    options,
+    observed.local,
+    new Set(projection.desired.map((desired) => desired.name))
+  );
   const links = { ...state.data.links };
   const changes = [];
   if (!observed.root) changes.push({ action: "mkdir", path: profile.skillsRoot });
@@ -19049,7 +19081,12 @@ async function runProfileSync(name, options) {
           });
         }
         await assertProfileIdentity(selected);
-        if (await assertStrictProfile(selected, options, (await observations(selected, state)).local))
+        if (await assertStrictProfile(
+          selected,
+          options,
+          (await observations(selected, state)).local,
+          new Set(work.projection.desired.map((desired) => desired.name))
+        ))
           await publishStrictPolicy(selected);
         const currentProfile = await discoverProfile(name, options);
         if (currentProfile.root !== selected.root || currentProfile.skillsRoot !== selected.skillsRoot)
@@ -19691,7 +19728,7 @@ import { randomUUID as randomUUID13 } from "node:crypto";
 import { constants as constants14 } from "node:fs";
 import { mkdir as mkdir13, open as open19, realpath as realpath34, rename as rename13, symlink as symlink8 } from "node:fs/promises";
 import { homedir as homedir16 } from "node:os";
-import { basename as basename13, dirname as dirname29, join as join46, parse as parse6, resolve as resolve27 } from "node:path";
+import { basename as basename14, dirname as dirname29, join as join46, parse as parse6, resolve as resolve27 } from "node:path";
 import { isDeepStrictEqual as isDeepStrictEqual12 } from "node:util";
 import { valid as valid3 } from "semver";
 var binding5 = { namespace: "migrations", targetParts: [".agents", "root-adoption"] };
@@ -19891,7 +19928,7 @@ async function guard2(context2, journal) {
 function paths2(snapshot3, id) {
   const prefix2 = join46(
     dirname29(snapshot3.path),
-    `${basename13(snapshot3.path, ".json")}.root-cutover-${id}`
+    `${basename14(snapshot3.path, ".json")}.root-cutover-${id}`
   );
   return { archive: `${prefix2}-old`, stage: `${prefix2}-new` };
 }
@@ -20003,8 +20040,8 @@ function journalData(snapshot3, context2) {
   )))
     refuse7(snapshot3.path, "The staged root does not match its canonical inventory.");
   for (const stage2 of raw.preservedStages) {
-    const prefix2 = `${basename13(snapshot3.path, ".json")}.root-cutover-`;
-    if (typeof stage2 !== "string" || dirname29(stage2) !== dirname29(snapshot3.path) || !basename13(stage2).startsWith(prefix2) || !uuid.test(basename13(stage2).slice(prefix2.length, -4)) || !stage2.endsWith("-new"))
+    const prefix2 = `${basename14(snapshot3.path, ".json")}.root-cutover-`;
+    if (typeof stage2 !== "string" || dirname29(stage2) !== dirname29(snapshot3.path) || !basename14(stage2).startsWith(prefix2) || !uuid.test(basename14(stage2).slice(prefix2.length, -4)) || !stage2.endsWith("-new"))
       refuse7(snapshot3.path, "A preserved stage has an invalid quarantine path.");
   }
   const data2 = raw;
@@ -20045,7 +20082,7 @@ async function ownerFor2(context2, allowed) {
   ]) {
     if (allowed && (path === context2.root || dirname29(path) === context2.root)) {
       const candidates = allowed.map(
-        (node) => path === context2.root ? node : node.children[basename13(path)]
+        (node) => path === context2.root ? node : node.children[basename14(path)]
       );
       if (!candidates.some(
         (node) => node && ["link", "directory"].includes(node.identity.kind) && isDeepStrictEqual12(nodeIdentity(node), expected)

package/dist/core/profile-policy.d.ts

@@ -2,5 +2,11 @@ import type { ProfileLocalEntry, ProfileLocation, ProfileOptions } from "./profi
 export declare function strictProfile(profile: ProfileLocation, options: ProfileOptions): Promise<boolean>;
 /** Persist a profile's selection boundary independently of the caller's HOME. */
 export declare function profileInheritsGlobal(profile: ProfileLocation): Promise<boolean>;
-export declare function assertStrictProfile(profile: ProfileLocation, options: ProfileOptions, local: readonly ProfileLocalEntry[]): Promise<boolean>;
+/**
+ * Strict (Skillex-only) policy: Skillex owns every link it projects. Hermes bookkeeping and the
+ * skills a desk's own agent wrote may sit beside those links (operator decision 2026-11-06,
+ * SKRILL-35); a learned skill named like a selected one, a foreign link, a stray file, an
+ * archive or a hub install is still refused. `desired` names the skills Skillex will project.
+ */
+export declare function assertStrictProfile(profile: ProfileLocation, options: ProfileOptions, local: readonly ProfileLocalEntry[], desired?: ReadonlySet<string>): Promise<boolean>;
 export declare function publishStrictPolicy(profile: ProfileLocation): Promise<void>;

package/dist/index.js

@@ -18234,7 +18234,7 @@ import { isDeepStrictEqual as isDeepStrictEqual10 } from "node:util";
 // src/core/profile-policy.ts
 import { constants as constants12 } from "node:fs";
 import { open as open16, readdir as readdir29, readFile as readFile18, stat as stat8 } from "node:fs/promises";
-import { join as join43 } from "node:path";
+import { basename as basename13, join as join43 } from "node:path";
 import { parseDocument as parseDocument4 } from "yaml";
 var metadataFiles = /* @__PURE__ */ new Set([
   ".usage.json",
@@ -18322,11 +18322,38 @@ async function profileInheritsGlobal(profile) {
     refuse5(path, "Profile skills.inherit_global must be boolean.");
   return inherit !== false;
 }
-async function assertStrictProfile(profile, options, local) {
+var learnedScanLimit = 2e4;
+async function learnedSkills(item2) {
+  if (item2.kind !== "directory" || item2.name.startsWith(".")) return null;
+  const skills = [];
+  const pending = [item2.path];
+  let seen = 0;
+  while (pending.length) {
+    const directory2 = pending.pop();
+    const entries = await children(directory2);
+    if (!entries) return null;
+    for (const child of entries) {
+      if (++seen > learnedScanLimit) return null;
+      if (child.isDirectory()) pending.push(join43(directory2, child.name));
+      else if (!child.isFile()) return null;
+      else if (child.name === "SKILL.md") skills.push(basename13(directory2));
+    }
+  }
+  return skills;
+}
+async function assertStrictProfile(profile, options, local, desired = /* @__PURE__ */ new Set()) {
   if (!await strictProfile(profile, options)) return false;
-  for (const item2 of local)
-    if (!await hermesMetadata(item2))
-      refuse5(item2.path, `Skillex-only profile contains unowned entry ${item2.name}.`);
+  for (const item2 of local) {
+    if (await hermesMetadata(item2)) continue;
+    const learned = await learnedSkills(item2);
+    if (!learned) refuse5(item2.path, `Skillex-only profile contains unowned entry ${item2.name}.`);
+    const clash = [item2.name, ...learned].find((name) => desired.has(name));
+    if (clash !== void 0)
+      refuse5(
+        item2.path,
+        `Agent-written skill ${clash} in ${item2.name} shares its name with a selected skill.`
+      );
+  }
   const path = join43(profile.root, "config.yaml");
   const config = await entry2(path);
   if (config) {
@@ -18571,7 +18598,12 @@ async function buildWork(profile, state, options) {
       );
   state = await readProfileState(profile, receiptOptions(profile, options, projection.scopes));
   const observed = await observations(profile, state);
-  await assertStrictProfile(profile, options, observed.local);
+  await assertStrictProfile(
+    profile,
+    options,
+    observed.local,
+    new Set(projection.desired.map((desired) => desired.name))
+  );
   const links = { ...state.data.links };
   const changes = [];
   if (!observed.root) changes.push({ action: "mkdir", path: profile.skillsRoot });
@@ -19047,7 +19079,12 @@ async function runProfileSync(name, options) {
           });
         }
         await assertProfileIdentity(selected);
-        if (await assertStrictProfile(selected, options, (await observations(selected, state)).local))
+        if (await assertStrictProfile(
+          selected,
+          options,
+          (await observations(selected, state)).local,
+          new Set(work.projection.desired.map((desired) => desired.name))
+        ))
           await publishStrictPolicy(selected);
         const currentProfile = await discoverProfile(name, options);
         if (currentProfile.root !== selected.root || currentProfile.skillsRoot !== selected.skillsRoot)
@@ -19689,7 +19726,7 @@ import { randomUUID as randomUUID13 } from "node:crypto";
 import { constants as constants14 } from "node:fs";
 import { mkdir as mkdir13, open as open19, realpath as realpath34, rename as rename13, symlink as symlink8 } from "node:fs/promises";
 import { homedir as homedir16 } from "node:os";
-import { basename as basename13, dirname as dirname29, join as join46, parse as parse6, resolve as resolve27 } from "node:path";
+import { basename as basename14, dirname as dirname29, join as join46, parse as parse6, resolve as resolve27 } from "node:path";
 import { isDeepStrictEqual as isDeepStrictEqual12 } from "node:util";
 import { valid as valid3 } from "semver";
 var binding5 = { namespace: "migrations", targetParts: [".agents", "root-adoption"] };
@@ -19889,7 +19926,7 @@ async function guard2(context2, journal) {
 function paths2(snapshot3, id) {
   const prefix2 = join46(
     dirname29(snapshot3.path),
-    `${basename13(snapshot3.path, ".json")}.root-cutover-${id}`
+    `${basename14(snapshot3.path, ".json")}.root-cutover-${id}`
   );
   return { archive: `${prefix2}-old`, stage: `${prefix2}-new` };
 }
@@ -20001,8 +20038,8 @@ function journalData(snapshot3, context2) {
   )))
     refuse7(snapshot3.path, "The staged root does not match its canonical inventory.");
   for (const stage2 of raw.preservedStages) {
-    const prefix2 = `${basename13(snapshot3.path, ".json")}.root-cutover-`;
-    if (typeof stage2 !== "string" || dirname29(stage2) !== dirname29(snapshot3.path) || !basename13(stage2).startsWith(prefix2) || !uuid.test(basename13(stage2).slice(prefix2.length, -4)) || !stage2.endsWith("-new"))
+    const prefix2 = `${basename14(snapshot3.path, ".json")}.root-cutover-`;
+    if (typeof stage2 !== "string" || dirname29(stage2) !== dirname29(snapshot3.path) || !basename14(stage2).startsWith(prefix2) || !uuid.test(basename14(stage2).slice(prefix2.length, -4)) || !stage2.endsWith("-new"))
       refuse7(snapshot3.path, "A preserved stage has an invalid quarantine path.");
   }
   const data2 = raw;
@@ -20043,7 +20080,7 @@ async function ownerFor2(context2, allowed) {
   ]) {
     if (allowed && (path === context2.root || dirname29(path) === context2.root)) {
       const candidates = allowed.map(
-        (node) => path === context2.root ? node : node.children[basename13(path)]
+        (node) => path === context2.root ? node : node.children[basename14(path)]
       );
       if (!candidates.some(
         (node) => node && ["link", "directory"].includes(node.identity.kind) && isDeepStrictEqual12(nodeIdentity(node), expected)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@delorenj/skillex",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Canonical skill catalog and activation management for agentic CLIs.",
   "type": "module",
   "license": "MIT",