@iseoane/agent-depot 0.4.1 → 0.5.0

package/dist/src/profile-export.js

@@ -2,8 +2,10 @@ import { writeFile } from "node:fs/promises";
 import path from "node:path";
 import { loadAppOwnedSkillFilter } from "./app-owned-skills.js";
 import { sourceIdForUrl } from "./git-source.js";
+import { bundleRoot, describeCoordinates } from "./package-model.js";
 import { AGENT_DEPOT_PACKAGE_VERSION } from "./project-manifest.js";
 import { parseProfile, PROFILE_FORMAT, serializeProfile } from "./profile.js";
+import { formatVersionPolicy } from "./skill-install.js";
 import { scanUserGlobalSkillInventory } from "./user-global-skill-inventory.js";
 export function selectProfileItems(items, requested, disabled, names, block) {
     if (disabled && requested?.length)
@@ -14,6 +16,24 @@ export function selectProfileItems(items, requested, disabled, names, block) {
     }
     return disabled ? [] : items.filter(item => !requested?.length || names(item).some(name => requested.includes(name)));
 }
+/** The Package identities a `--package` filter accepts, matching `describeCoordinates`. */
+export function packageFilterNames(selection) {
+    const root = bundleRoot(selection);
+    const names = [describeCoordinates(selection)];
+    if (root !== "") {
+        names.push(root);
+        const basename = path.posix.basename(root);
+        if (basename !== root)
+            names.push(basename);
+    }
+    if (selection.host === "claude")
+        names.push(selection.pluginName);
+    return names;
+}
+/** One Package line, shared by the export preview and the import plan label. */
+export function describeProfilePackage(selection) {
+    return `Package ${describeCoordinates(selection)} (${formatVersionPolicy(selection.version)})`;
+}
 function validateOne(block, item) {
     const profile = parseProfile({ format: PROFILE_FORMAT, agentDepotVersion: AGENT_DEPOT_PACKAGE_VERSION,
         sources: [], skills: [], apps: [], [block]: [item] });
@@ -34,6 +54,11 @@ export async function buildProfileExport(operations, apps, options = {}) {
     const allInstallations = await operations.listUserGlobalInstallations();
     const installations = selectProfileItems(allInstallations, options.skills, options.noSkills, skill => [skill.path, path.posix.basename(skill.path)], "skills");
     const entries = selectProfileItems(await apps.load(), options.apps, options.noApps, entry => [entry.recipe?.name ?? path.basename(entry.file)], "apps");
+    const packageRecords = options.packageOperations === undefined ? [] : await options.packageOperations.list();
+    if (options.packageOperations === undefined && options.packages?.length) {
+        throw new Error("Profile export requires Package operations to select Packages");
+    }
+    const selectedPackages = selectProfileItems(packageRecords, options.packages, options.noPackages, record => packageFilterNames(record.selection), "packages");
     const owned = await loadAppOwnedSkillFilter({ appEnvironment: { recipesDirectory: apps.directory },
         reportWarning: warn });
     const portableSources = [];
@@ -79,6 +104,15 @@ export async function buildProfileExport(operations, apps, options = {}) {
             exclude("apps", `App recipe ${path.basename(entry.file)}`, error instanceof Error ? error.message : String(error));
         }
     }
+    const packages = [];
+    for (const record of selectedPackages) {
+        try {
+            packages.push(validateOne("packages", record.selection));
+        }
+        catch (error) {
+            exclude("packages", describeProfilePackage(record.selection), `not portable (${error instanceof Error ? error.message : String(error)})`);
+        }
+    }
     if (!options.noSkills) {
         const inventory = await scanUserGlobalSkillInventory({
             homeDirectory: options.homeDirectory, managedInstallations: allInstallations,
@@ -89,7 +123,7 @@ export async function buildProfileExport(operations, apps, options = {}) {
         }
     }
     const profile = parseProfile({ format: PROFILE_FORMAT, agentDepotVersion: AGENT_DEPOT_PACKAGE_VERSION,
-        sources: portableSources, skills, apps: recipes });
+        sources: portableSources, skills, apps: recipes, packages });
     return {
         profile,
         exclusions: diagnostics.filter((item) => "block" in item),
@@ -98,13 +132,13 @@ export async function buildProfileExport(operations, apps, options = {}) {
     };
 }
 function sourceWarnings(profile) {
-    return profile.skills.flatMap(skill => {
-        const identity = skill.source;
-        if (identity.kind === "external" && "url" in identity && !profile.sources.some(source => source.url === identity.url)) {
-            return [{ kind: "source", message: `WARNING: Skill ${skill.path} references Source ${identity.url} not included in profile` }];
-        }
-        return [];
-    });
+    const missing = (source, label) => source.kind === "external" && "url" in source && !profile.sources.some(candidate => candidate.url === source.url)
+        ? [{ kind: "source", message: `WARNING: ${label} references Source ${source.url} not included in profile` }]
+        : [];
+    return [
+        ...profile.skills.flatMap(skill => missing(skill.source, `Skill ${skill.path}`)),
+        ...profile.packages.flatMap(selection => missing(selection.source, describeProfilePackage(selection))),
+    ];
 }
 /** Shared preview for a frontend-selected subset; Source warnings are recomputed. */
 export function profileExportPreview(profile, diagnostics = []) {
@@ -112,12 +146,13 @@ export function profileExportPreview(profile, diagnostics = []) {
         ...profile.sources.map(source => `Source ${sourceIdForUrl(source.url)} ${source.url} (included: ${source.included})`),
         ...profile.skills.map(skill => `Skill ${skill.path} [${skill.hosts.join(", ")}] (${skill.version.policy})`),
         ...profile.apps.map(recipe => `App recipe ${recipe.name} (${recipe.platform ?? "all platforms"}; no approval)`),
+        ...profile.packages.map(selection => `${describeProfilePackage(selection)}; no receipt, no installed state`),
         ...diagnostics.flatMap(item => "block" in item ? [`Excluded ${item.label}: ${item.reason}`] : item.kind === "load" ? [item.message] : []),
         ...sourceWarnings(profile).map(warning => warning.message)];
 }
 /** Empty profiles are valid to parse, but are not useful export artifacts. */
 export function requireProfileExportSelection(profile) {
-    if (!profile.sources.length && !profile.skills.length && !profile.apps.length) {
+    if (!profile.sources.length && !profile.skills.length && !profile.apps.length && !profile.packages.length) {
         throw new Error("Nothing selected; nothing written.");
     }
 }

package/dist/src/profile-import.js

@@ -4,7 +4,8 @@ import { homedir } from "node:os";
 import path from "node:path";
 import { compareAppVersions } from "./app-version.js";
 import { canonicalizeGitSourceUrl, sourceIdForUrl } from "./git-source.js";
-import { selectProfileItems } from "./profile-export.js";
+import { selectionKey } from "./package-model.js";
+import { describeProfilePackage, packageFilterNames, selectProfileItems } from "./profile-export.js";
 import { parseProfile, PROFILE_FORMAT } from "./profile.js";
 import { AGENT_DEPOT_PACKAGE_VERSION } from "./project-manifest.js";
 import { defaultProjectSkillTreeAccess, executeSingleInstall, formatVersionPolicy, outputSingleInstallPreview, planSingleInstall } from "./skill-install.js";
@@ -75,6 +76,12 @@ function classifySkill(value, skills) {
     const existing = skills.find(skill => skillIdentity(skill) === skillIdentity(value));
     return { block: "skills", value, label: `Skill ${value.path}`, ...comparison(existing && skillChoices(existing), skillChoices(value)) };
 }
+/** Identity is the Source and coordinates; only the version policy is a portable choice. */
+function classifyPackage(value, recorded) {
+    const existing = recorded.find(record => selectionKey(record.selection) === selectionKey(value));
+    return { block: "packages", value, label: describeProfilePackage(value),
+        ...comparison(existing === undefined ? undefined : { version: existing.selection.version }, { version: value.version }) };
+}
 function classifyRecipe(value, recipes) {
     const existing = recipes.filter(entry => entry.name === value.name &&
         (entry.platform === undefined || value.platform === undefined || entry.platform === value.platform));
@@ -87,8 +94,18 @@ function classifyRecipe(value, recipes) {
         status: existing.length ? "conflict" : "add",
         ...(existing.length ? { difference: existing.map(entry => `${entry.file}: name ${JSON.stringify(value.name)} already present with overlapping platforms; ${fieldDifferences(entry.content ?? {}, value).join("; ") || "content identical"}`).join("; ") } : {}) };
 }
+/** An external Source that no plan item registers is fetched but never added to Sources. */
+function fetchedSourceNote(source, sources, entries) {
+    if (source.kind !== "external" || !("url" in source))
+        return undefined;
+    const url = canonicalizeGitSourceUrl(source.url);
+    const registered = sources.some(registered => registered.kind === "git" && canonicalizeGitSourceUrl(registered.url) === url);
+    const planned = entries.some(candidate => candidate.block === "sources" && candidate.status === "add"
+        && canonicalizeGitSourceUrl(candidate.value.url) === url);
+    return registered || planned ? undefined : `  Source ${source.url} will be fetched but not registered`;
+}
 /** Load only this block; retained across skips and invalidated after every attempted write. */
-async function loadImportClassifier(block, operations, apps) {
+async function loadImportClassifier(block, operations, apps, packages) {
     if (block === "sources") {
         const sources = await operations.listSources();
         return (item) => item.block === "sources" ? classifySource(item.value, sources) : item;
@@ -99,17 +116,28 @@ async function loadImportClassifier(block, operations, apps) {
         const skills = await operations.listUserGlobalInstallations();
         return (item) => item.block === "skills" ? classifySkill(item.value, skills) : item;
     }
+    if (block === "packages") {
+        if (packages === undefined)
+            throw new Error("Profile import requires Package operations to replay Package selections");
+        const recorded = await packages.list();
+        return (item) => item.block === "packages" ? classifyPackage(item.value, recorded) : item;
+    }
     const recipes = await loadImportRecipes(apps);
     return (item) => item.block === "apps" ? classifyRecipe(item.value, recipes) : item;
 }
 /** Read-only classification. Inclusion is a transient frontend choice, not persisted Source state. */
-export async function buildProfileImport(input, operations, apps, filters = {}) {
+export async function buildProfileImport(input, operations, apps, filters = {}, packageOperations) {
     const profile = parseProfile(input);
     if (!operations.listUserGlobalInstallations)
         throw new Error("Profile import requires user-global installation listing");
     const sources = await operations.listSources();
     const skills = await operations.listUserGlobalInstallations();
     const recipes = await loadImportRecipes(apps);
+    const packageValues = selectProfileItems(profile.packages, filters.packages, filters.noPackages, selection => packageFilterNames(selection), "packages");
+    if (packageValues.length > 0 && packageOperations === undefined) {
+        throw new Error("Profile import requires Package operations to replay Package selections");
+    }
+    const recordedPackages = packageOperations === undefined ? [] : await packageOperations.list();
     const items = [];
     for (const value of selectProfileItems(profile.sources, filters.sources, filters.noSources, source => [source.url, sourceIdForUrl(source.url)], "sources"))
         items.push(classifySource(value, sources));
@@ -118,7 +146,9 @@ export async function buildProfileImport(input, operations, apps, filters = {})
     for (const value of selectProfileItems(profile.apps, filters.apps, filters.noApps, recipe => [recipe.name], "apps")) {
         items.push(classifyRecipe(value, recipes));
     }
-    const preview = ["Preview: import portable user-global profile", ...items.flatMap(item => {
+    const packages = packageValues.map(value => classifyPackage(value, recordedPackages));
+    const entries = [...items, ...packages];
+    const preview = ["Preview: import portable user-global profile", ...entries.flatMap(item => {
             const status = item.block === "sources" && item.status === "same" && !item.value.included
                 ? "same (discovery inclusion is not imported)" : item.status;
             const lines = [`${status}: ${item.label}${item.difference ? `; ${item.difference}` : ""}`];
@@ -128,12 +158,16 @@ export async function buildProfileImport(input, operations, apps, filters = {})
                 for (const [action, method] of Object.entries(skill.methods ?? {})) {
                     lines.push(`  ${action}: argv=${JSON.stringify(method.argv)} (user-provided method from the profile, runs only after --yes)`);
                 }
-                const source = skill.source;
-                if (source.kind === "external" && "url" in source &&
-                    !sources.some(registered => registered.kind === "git" && canonicalizeGitSourceUrl(registered.url) === canonicalizeGitSourceUrl(source.url)) &&
-                    !items.some(candidate => candidate.block === "sources" && canonicalizeGitSourceUrl(candidate.value.url) === canonicalizeGitSourceUrl(source.url) && candidate.status === "add")) {
-                    lines.push(`  Source ${source.url} will be fetched but not registered`);
-                }
+                const note = fetchedSourceNote(skill.source, sources, entries);
+                if (note !== undefined)
+                    lines.push(note);
+            }
+            if (item.block === "packages" && item.status === "add") {
+                const selection = item.value;
+                lines.push(`  Source ${canonical(selection.source)}`, `  host ${selection.host}: select records the choice; it runs no host command and installs nothing`);
+                const note = fetchedSourceNote(selection.source, sources, entries);
+                if (note !== undefined)
+                    lines.push(note);
             }
             return lines;
         })];
@@ -142,7 +176,7 @@ export async function buildProfileImport(input, operations, apps, filters = {})
         preview.push(`WARNING: profile Agent Depot ${profile.agentDepotVersion} is newer than running ${AGENT_DEPOT_PACKAGE_VERSION}`);
     }
     preview.push("Existing choices are never replaced. Source inclusion is a transient discovery choice.", "Same-name App recipes conflict only when platforms overlap; disjoint platform recipes can both be added.");
-    return { items, preview };
+    return { items, packages, preview };
 }
 /** Publish complete JSON exclusively: rename would silently overwrite an existing recipe. */
 async function writeRecipe(directory, recipe) {
@@ -163,17 +197,24 @@ async function writeRecipe(directory, recipe) {
 /** Apply only confirmed additions, rechecking destination choices per item. Failures remain independent. */
 export async function applyProfileImport(plan, operations, apps, confirmed, output, environment = {}) {
     const results = [];
-    for (const block of ["sources", "skills", "apps"]) {
+    const packageOperations = environment.packageOperations;
+    const groups = [
+        { block: "sources", entries: plan.items.filter(item => item.block === "sources") },
+        { block: "skills", entries: plan.items.filter(item => item.block === "skills") },
+        { block: "apps", entries: plan.items.filter(item => item.block === "apps") },
+        { block: "packages", entries: plan.packages },
+    ];
+    for (const group of groups) {
         let classify;
-        for (const item of plan.items.filter(item => item.block === block)) {
+        for (const item of group.entries) {
             if (!confirmed || item.status !== "add") {
                 results.push({ item, status: "skipped" });
                 continue;
             }
             try {
                 parseProfile({ format: PROFILE_FORMAT, agentDepotVersion: AGENT_DEPOT_PACKAGE_VERSION,
-                    sources: [], skills: [], apps: [], [block]: [item.value] });
-                classify ??= await loadImportClassifier(block, operations, apps);
+                    sources: [], skills: [], apps: [], [group.block]: [item.value] });
+                classify ??= await loadImportClassifier(group.block, operations, apps, packageOperations);
                 const recheck = classify(item);
                 if (recheck.status !== "add") {
                     results.push({ item, status: "skipped", detail: `${recheck.status}: ${recheck.label}${recheck.difference ? `; ${recheck.difference}` : ""}` });
@@ -185,9 +226,10 @@ export async function applyProfileImport(plan, operations, apps, confirmed, outp
                     await operations.addGitSource(item.value.url);
                 else if (item.block === "apps")
                     await writeRecipe(apps.directory, item.value);
-                else {
+                else if (item.block === "packages")
+                    await selectImportedPackage(item.value, packageOperations, output);
+                else
                     await installImportedSkill(item.value, operations, apps, output, environment);
-                }
                 results.push({ item, status: "added" });
             }
             catch (error) {
@@ -197,6 +239,27 @@ export async function applyProfileImport(plan, operations, apps, confirmed, outp
     }
     return results;
 }
+/**
+ * Replays one selection through the flow's select action. Approval is written for
+ * that action alone, whose declaration carries no argv, so no install or update
+ * authorization is created and no host command can run.
+ */
+async function selectImportedPackage(selection, packages, output) {
+    if (packages === undefined)
+        throw new Error("Package operations are required to replay a Package selection");
+    const plan = await packages.planLifecycle(selection, "select");
+    if (plan.commands.length > 0) {
+        throw new Error(`${describeProfilePackage(selection)} plan carries ${plan.commands.length} host steps; import runs no host command`);
+    }
+    await packages.approve(selection, "select");
+    const result = await packages.executeLifecycle(plan, true);
+    if (result.status !== "selected") {
+        const reason = result.status === "failed" || result.status === "stale plan" || result.status === "manual required"
+            ? `: ${result.reason}` : "";
+        throw new Error(`${describeProfilePackage(selection)} was not selected (${result.status}${reason})`);
+    }
+    output(`  selected ${describeProfilePackage(selection)}: no host command ran`);
+}
 async function installImportedSkill(selection, operations, apps, output, environment) {
     if (!operations.addUserGlobalInstallation || !operations.listUserGlobalInstallations)
         throw new Error("Cannot persist user-global Skills");

package/dist/src/profile.js

@@ -1,6 +1,7 @@
 import path from "node:path";
 import { parseAppRecipe } from "./app-recipes.js";
 import { canonicalizeGitSourceUrl } from "./git-source.js";
+import { selectionKey } from "./package-model.js";
 import { containsCredentialArgument, parseProjectManifest, ProjectManifestError } from "./project-manifest.js";
 export const PROFILE_FORMAT = "agent-depot-profile/v1";
 function object(value, keys, field) {
@@ -64,9 +65,69 @@ function rejectDuplicates(items, identity, field) {
         seen.add(key);
     });
 }
+/** A Source-relative bundle root in the one canonical form discovery produces. */
+function bundleDirectory(value, field) {
+    if (typeof value !== "string")
+        throw new Error(`${field}: expected a string`);
+    if (value === "")
+        return value;
+    const noncanonical = value.startsWith("/") || value === "." || value.startsWith("./") || value.endsWith("/") ||
+        value.includes("//") || value.includes("\\") || value === ".." || value.startsWith("../") ||
+        path.posix.normalize(value) !== value;
+    if (noncanonical)
+        throw new Error(`${field}: expected a canonical Source-relative directory`);
+    return value;
+}
+/** The single segment a Claude selection names, matching the host's own plugin key. */
+function pluginName(value, field) {
+    if (typeof value !== "string" || value.length === 0)
+        throw new Error(`${field}: expected a plugin name`);
+    const unsafe = [...value].some(character => (character.codePointAt(0) ?? 0) <= 0x1f || character.codePointAt(0) === 0x7f);
+    if (value === "." || value === ".." || value.includes("/") || value.includes("\\") || /\s/u.test(value) || unsafe) {
+        throw new Error(`${field}: expected one plugin name segment`);
+    }
+    return value;
+}
+/**
+ * A Package declaration carries its Source identity, host coordinates and version
+ * policy. The host's own install identity, verified version and receipt stay out,
+ * so they cannot travel to another machine.
+ */
+function parseProfilePackage(value, field) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error(`${field}: expected an object`);
+    const host = value.host;
+    if (host !== "pi" && host !== "claude")
+        throw new Error(`${field}.host: expected "pi" or "claude"`);
+    const record = object(value, host === "pi"
+        ? ["source", "version", "host", "root"]
+        : ["source", "version", "host", "marketplaceRoot", "pluginName"], field);
+    const coordinates = host === "pi"
+        ? { host, root: bundleDirectory(record.root, `${field}.root`) }
+        : { host, marketplaceRoot: bundleDirectory(record.marketplaceRoot, `${field}.marketplaceRoot`),
+            pluginName: pluginName(record.pluginName, `${field}.pluginName`) };
+    const at = (root, name) => root === "" ? name : `${root}/${name}`;
+    const manifestPath = coordinates.host === "pi"
+        ? at(coordinates.root, "package.json")
+        : at(coordinates.marketplaceRoot, ".claude-plugin/marketplace.json");
+    try {
+        const [parsed] = parseProjectManifest({ version: 1, skills: [
+                { source: record.source, path: manifestPath, version: record.version, hosts: [host] },
+            ] }, "profile").skills;
+        return Object.freeze({ source: parsed.source, version: parsed.version, ...coordinates });
+    }
+    catch (error) {
+        if (!(error instanceof ProjectManifestError))
+            throw error;
+        const rootField = coordinates.host === "pi" ? "root" : "marketplaceRoot";
+        const reason = error.reason.replace(/^skills\[0\]\.path/u, `${field}.${rootField}`).replace(/^skills\[0\]\./u, `${field}.`);
+        const [path0, ...rest] = reason.split(" ");
+        throw new Error(`${path0}: ${rest.join(" ")}`);
+    }
+}
 /** Portable profile parsing shares the manifest and recipe safety contracts. */
 export function parseProfile(value) {
-    const root = object(value, ["format", "agentDepotVersion", "sources", "skills", "apps"], "profile");
+    const root = object(value, ["format", "agentDepotVersion", "sources", "skills", "apps", "packages"], "profile");
     if (root.format !== PROFILE_FORMAT)
         throw new Error("profile.format: unsupported profile version");
     if (typeof root.agentDepotVersion !== "string" || !/^\d+\.\d+\.\d+(?:[-+][\w.+-]+)?$/u.test(root.agentDepotVersion)) {
@@ -112,7 +173,14 @@ export function parseProfile(value) {
             throw new Error(reason.startsWith(`apps[${index}]`) ? reason : `apps[${index}].${reason}`);
         }
     });
+    const packages = (root.packages === undefined ? [] : list(root.packages, "packages")).map((value, index) => {
+        const field = `packages[${index}]`;
+        const selection = parseProfilePackage(value, field);
+        assertPortableText(selection, field);
+        return selection;
+    });
     rejectDuplicates(sources, source => source.url, "sources");
+    rejectDuplicates(packages, selectionKey, "packages");
     apps.forEach((app, index) => {
         if (apps.slice(0, index).some(previous => previous.name === app.name &&
             (previous.platform === undefined || app.platform === undefined || previous.platform === app.platform))) {
@@ -123,8 +191,15 @@ export function parseProfile(value) {
     sources.sort((a, b) => compare(a.url, b.url));
     const sortedSkills = [...parsedSkills].sort((a, b) => compare(JSON.stringify([a.source, a.path]), JSON.stringify([b.source, b.path])));
     apps.sort((a, b) => compare(a.name, b.name) || compare(a.platform ?? "", b.platform ?? ""));
-    return { format: PROFILE_FORMAT, agentDepotVersion: root.agentDepotVersion, sources, skills: sortedSkills, apps };
+    packages.sort((a, b) => compare(selectionKey(a), selectionKey(b)));
+    return { format: PROFILE_FORMAT, agentDepotVersion: root.agentDepotVersion, sources, skills: sortedSkills, apps, packages };
 }
+/**
+ * An empty Package block is omitted, so an export with no Packages stays readable
+ * by an Agent Depot version that predates the block.
+ */
 export function serializeProfile(profile) {
-    return `${JSON.stringify(parseProfile(profile), null, 2)}\n`;
+    const parsed = parseProfile(profile);
+    const { packages, ...rest } = parsed;
+    return `${JSON.stringify(packages.length === 0 ? rest : parsed, null, 2)}\n`;
 }

package/dist/src/skill-discovery.js

@@ -4,7 +4,7 @@ import { lstat, readdir, readFile } from "node:fs/promises";
 import { assertNoSymlinkPath } from "./path-safety.js";
 import { fileURLToPath } from "node:url";
 import path from "node:path";
-import { defaultGitSourceCachePath, GitSourceSnapshotAccess, SKILL_TREE_LIMITS, validateSkillDirectoryPath, } from "./git-source.js";
+import { defaultGitSourceCachePath, GitSourceSnapshotAccess, isSourceSnapshotFile, SKILL_TREE_LIMITS, validateSkillDirectoryPath, } from "./git-source.js";
 import { AGENT_DEPOT_PACKAGE_VERSION, } from "./project-manifest.js";
 export const EXCLUDED_LIFECYCLE_SEGMENTS = Object.freeze([
     "in-progress",
@@ -325,7 +325,7 @@ async function walkDirectory(root, relativeDirectory, files, readTextFile) {
             await walkDirectory(root, relativePath, files, readTextFile);
             continue;
         }
-        if (!entry.isFile() || entry.name !== "SKILL.md" || (await safePathKind(absolutePath)) !== "file") {
+        if (!entry.isFile() || !isSourceSnapshotFile(relativePath) || (await safePathKind(absolutePath)) !== "file") {
             continue;
         }
         files.push({

package/dist/src/skill-install.js

@@ -1,5 +1,6 @@
 import path from "node:path";
 import { assertSkillNotAppOwned } from "./app-owned-skills.js";
+import { assertSkillNotPackageOwned, loadPackageOwnedSkillFilter, } from "./package-owned-skills.js";
 import { pathsOverlap } from "./path-safety.js";
 import { inspectProjectSkillInstallation, installProjectSkillTransaction, validateProjectSkillInstallationPreview, } from "./project-installation.js";
 import { AGENT_DEPOT_PACKAGE_VERSION, parseProjectManifest, } from "./project-manifest.js";
@@ -313,6 +314,7 @@ export async function planSingleInstall(request, context) {
     }
     const { resolvedSource, resolved, installationInspection } = await resolveInstallInspection(selection, source, projectSource, context.root, request, context.operations, context.environment, context.sourceAccess);
     await assertInstallNotAppOwned(request, context, installationInspection);
+    await assertInstallNotPackageOwned(selection, resolvedSource, context);
     return { request, context, selection, source, resolvedSource, resolved, inspection: installationInspection };
 }
 /** Prints the preview the user confirms before {@link executeSingleInstall}. */
@@ -327,6 +329,7 @@ export function outputSingleInstallPreview(plan, output) {
 export async function executeSingleInstall(plan, persist, output) {
     const { request, context, selection, resolvedSource, resolved, inspection } = plan;
     await assertInstallNotAppOwned(request, context, inspection);
+    await assertInstallNotPackageOwned(selection, resolvedSource, context);
     const protectedPaths = assertNoManagedInstallationOverlap(context.existing, selection, inspection, context.root, request.overwrite);
     rejectInstallationCollision(inspection, request.overwrite);
     const transaction = await installOne(selection, resolvedSource, context.sourceAccess, context.root, context.environment, resolved.method, request.portableV1, resolved.files, resolved.resolvedVersion, request.confirmAdditionalHostExposure, request.overwrite, inspection, protectedPaths);
@@ -372,3 +375,16 @@ async function assertInstallNotAppOwned(request, context, inspection) {
         await assertSkillNotAppOwned(path.basename(location.path), { ...context.environment, homeDirectory: context.root });
     }
 }
+/** Reloads bundle ownership from the selected Source and refuses its own Skill paths. */
+async function assertInstallNotPackageOwned(selection, source, context) {
+    const owned = await loadPackageOwnedSkillFilter({
+        sources: [source],
+        homeDirectory: context.root,
+        ...(context.environment.sourceContentAccess === undefined ? {} : { sourceContentAccess: context.environment.sourceContentAccess }),
+        ...(context.environment.selections === undefined ? {} : { selections: context.environment.selections }),
+        ...(context.environment.hostView === undefined ? {} : { hostView: context.environment.hostView }),
+        ...(context.environment.stateDirectory === undefined ? {} : { stateDirectory: context.environment.stateDirectory }),
+        ...(context.environment.reportWarning === undefined ? {} : { reportWarning: context.environment.reportWarning }),
+    });
+    assertSkillNotPackageOwned(selection.path, owned);
+}

package/dist/src/sources.js

@@ -286,6 +286,17 @@ export function createSourceOperations(options = {}) {
         },
     };
 }
+/** Converts a registered Source back into the self-contained identity a selection carries. */
+export function projectSourceOf(source) {
+    if (source.kind === "builtin") {
+        return Object.freeze({ kind: "builtin", id: source.id });
+    }
+    return Object.freeze({
+        kind: "external",
+        url: source.url,
+        ...(source.ref === undefined ? {} : { ref: source.ref }),
+    });
+}
 /** Converts persisted project identity into a read-only Source identity. */
 export function resolveProjectSource(projectSource) {
     if (projectSource.kind === "builtin") {

package/dist/src/tui/app-actions.js

@@ -13,7 +13,7 @@ export function isAppMode(mode) {
 export const appName = (entry) => entry.recipe?.name ?? entry.file;
 export function appStepLines(step) {
     return [
-        ...(step.argv ? [`argv: ${JSON.stringify(step.argv)}`, `Executable: ${step.executable ?? "unavailable"}`] : []),
+        ...(step.argv ? [`argv: ${JSON.stringify(step.argv)}`, `Executable: ${step.executable ?? `${JSON.stringify(step.argv[0])} not found in PATH`}`] : []),
         ...(step.manual ? [`Manual: ${step.manual}`] : []),
         `Working directory: ${step.cwd}`,
         ...(step.warning ? [step.warning] : []),

package/dist/src/tui/app.js

@@ -6,7 +6,7 @@ import { CatalogView } from "./catalog-view.js";
 import { InstallationsView } from "./installations-view.js";
 import { useKeys } from "./keys.js";
 import { ProfileView } from "./profile-view.js";
-import { SourcesView } from "./sources-view.js";
+import { SourcesView, sourceRowHints } from "./sources-view.js";
 import { separatorLine, theme } from "./theme.js";
 import { UpdatesView } from "./updates-view.js";
 const TABS = [
@@ -16,11 +16,9 @@ const TABS = [
     ["updates", "4 Updates"],
     ["profile", "5 Import/Export"],
 ];
-/** Compact keys of the current view; the tab bar already shows how to switch views. */
+/** Sources derives its own hints from the selected row, so it is excluded here. */
 function hintsOf(view, catalogFocusedOnSource) {
     switch (view) {
-        case "sources":
-            return "Tab section · j/k move · space mark · a all · Enter catalog · n add · r refresh · d remove · q quit";
         case "catalog":
             return `j/k move · Enter expand · space mark · a all · i install · / filter${catalogFocusedOnSource ? " · s all sources" : ""} · q quit`;
         case "installations":
@@ -43,6 +41,7 @@ export function App({ operations, environment, onExit }) {
     }, []);
     const [view, setView] = useState("sources");
     const [catalogSourceId, setCatalogSourceId] = useState();
+    const [sourcesHints, setSourcesHints] = useState(sourceRowHints(undefined));
     const showView = (next) => setView(next);
     useKeys((input) => {
         if (capturingRef.current)
@@ -62,8 +61,8 @@ export function App({ operations, environment, onExit }) {
         else if (input === "5")
             showView("profile");
     });
-    return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Text, { bold: true, color: theme.accent, children: ["Agent Depot", AGENT_DEPOT_PACKAGE_VERSION === undefined ? "" : ` v${AGENT_DEPOT_PACKAGE_VERSION}`] }), _jsx(Text, { children: TABS.map(([name, label], position) => (_jsxs(Text, { color: view === name ? theme.accent : theme.inactive, bold: view === name, children: [position > 0 ? " " : "", view === name ? `[${label}]` : ` ${label} `] }, name))) }), _jsx(Text, { color: theme.muted, children: separatorLine(stdout.columns) }), view === "sources" ? (_jsx(SourcesView, { operations: operations, environment: environment, onCapturingChange: onCapturingChange, onOpenCatalog: (source) => {
+    return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Text, { bold: true, color: theme.accent, children: ["Agent Depot", AGENT_DEPOT_PACKAGE_VERSION === undefined ? "" : ` v${AGENT_DEPOT_PACKAGE_VERSION}`] }), _jsx(Text, { children: TABS.map(([name, label], position) => (_jsxs(Text, { color: view === name ? theme.accent : theme.inactive, bold: view === name, children: [position > 0 ? " " : "", view === name ? `[${label}]` : ` ${label} `] }, name))) }), _jsx(Text, { color: theme.muted, children: separatorLine(stdout.columns) }), view === "sources" ? (_jsx(SourcesView, { operations: operations, environment: environment, onCapturingChange: onCapturingChange, onHintsChange: setSourcesHints, onOpenCatalog: (source) => {
                     setCatalogSourceId(source.id);
                     setView("catalog");
-                } })) : view === "installations" ? (_jsx(InstallationsView, { operations: operations, environment: environment, onCapturingChange: onCapturingChange })) : view === "profile" ? (_jsx(ProfileView, { operations: operations, environment: environment, onCapturingChange: onCapturingChange })) : view === "updates" ? (_jsx(UpdatesView, { operations: operations, environment: environment, onCapturingChange: onCapturingChange })) : (_jsx(CatalogView, { operations: operations, sourceId: catalogSourceId, environment: environment, onCapturingChange: onCapturingChange })), _jsx(Text, { color: theme.muted, children: capturing ? "Enter submit · Esc cancel · y/n confirm · space toggle" : hintsOf(view, catalogSourceId !== undefined) })] }));
+                } })) : view === "installations" ? (_jsx(InstallationsView, { operations: operations, environment: environment, onCapturingChange: onCapturingChange })) : view === "profile" ? (_jsx(ProfileView, { operations: operations, environment: environment, onCapturingChange: onCapturingChange })) : view === "updates" ? (_jsx(UpdatesView, { operations: operations, environment: environment, onCapturingChange: onCapturingChange })) : (_jsx(CatalogView, { operations: operations, sourceId: catalogSourceId, environment: environment, onCapturingChange: onCapturingChange })), _jsx(Text, { color: theme.muted, children: capturing ? "Enter submit · Esc cancel · y/n confirm · space toggle" : view === "sources" ? sourcesHints : hintsOf(view, catalogSourceId !== undefined) })] }));
 }

package/dist/src/tui/catalog-browse.js

@@ -22,15 +22,22 @@ function markAllListed(context) {
     context.setMessage(undefined);
     setMarked(leaves.every((skill) => markedRef.current.has(skillKey(skill))) ? new Set() : new Set(leaves.map(skillKey)));
 }
-/** `i`: installs the marked Skills that are listed, or the highlighted one. */
+/** `i`: installs the highlighted bundle, or the marked Skills that are listed, or the highlighted one. */
 function chooseHosts(context, row) {
+    const data = row.node.data;
+    // A bundle row is not markable, so it acts on itself and never picks up a Skill mark.
+    if (data.kind === "bundle") {
+        context.setMessage(undefined);
+        context.startPackage({ selection: data.entry.selection, name: data.entry.descriptor.name });
+        return;
+    }
     // Only what is listed installs: marks on Skills hidden by the filter are ignored.
     const marked = leavesOf(context.navigation.latestRoots())
         .filter((skill) => context.marks.markedRef.current.has(skillKey(skill)));
-    const highlighted = row.node.data.kind === "skill" ? [row.node.data.skill] : [];
+    const highlighted = data.kind === "skill" ? [data.skill] : [];
     const chosen = marked.length > 0 ? marked : highlighted;
     if (chosen.length === 0) {
-        context.setMessage({ kind: "error", text: "Install is not available for source rows; highlight a skill or mark some with space" });
+        context.setMessage({ kind: "error", text: "Install is not available for source rows; highlight a skill or a Package bundle, or mark some skills with space" });
         return;
     }
     context.setMessage(undefined);

package/dist/src/tui/catalog-panel.js

@@ -4,6 +4,7 @@ import { describeSkills, HOST_CHOICES, SCOPE_CHOICES } from "./catalog-actions.j
 import { skillKey } from "./catalog-tree.js";
 import { hasUnmanagedCopy } from "./catalog-installs.js";
 import { describeRow, UNMANAGED_MARKER } from "./catalog-tree.js";
+import { isPackageMode, PackagePanel } from "./package-actions.js";
 import { HostChecklist, PreviewLines } from "./panel-parts.js";
 import { rowStyle } from "./theme.js";
 import { theme } from "./theme.js";
@@ -11,16 +12,19 @@ import { theme } from "./theme.js";
 export function CatalogHeader({ scope, listed, installable, total, filter }) {
     return (_jsxs(_Fragment, { children: [_jsxs(Text, { color: theme.muted, children: ["Scope: ", scope, "  ", listed, " of ", installable] }), filter.editing || filter.query !== "" ? (_jsxs(Text, { children: ["Filter: ", filter.query, filter.editing ? "_" : ""] })) : null, total === 0 ? _jsx(Text, { children: "No skills" }) : null, total > 0 && installable === 0 ? _jsx(Text, { children: "All skills are installed" }) : null, installable > 0 && listed === 0 ? _jsx(Text, { children: "No matching skills" }) : null] }));
 }
-/** One line of the Catalog tree: cursor, indent, mark box, label and the unmanaged-copy marker. */
+/** One line of the Catalog tree: cursor, indent, mark box, label and the ownership markers. */
 export function CatalogRowLine({ row, selected, marked, installed }) {
     const { data } = row.node;
-    const isSource = data.kind === "source";
-    return (_jsxs(Text, { ...rowStyle(selected), color: isSource ? theme.group : undefined, children: [selected ? "> " : "  ", "  ".repeat(row.depth), isSource ? "" : marked ? "[x] " : "[ ] ", describeRow(row), data.kind === "skill" && hasUnmanagedCopy(data.skill, installed)
+    const isGroup = data.kind === "source" || data.kind === "group";
+    const ownedBy = data.kind === "skill" ? data.ownedBy : undefined;
+    return (_jsxs(Text, { ...rowStyle(selected), color: isGroup ? theme.group : ownedBy === undefined ? undefined : theme.inactive, children: [selected ? "> " : "  ", "  ".repeat(row.depth), data.kind === "skill" ? marked ? "[x] " : "[ ] " : "", describeRow(row), ownedBy === undefined ? null : _jsxs(Text, { color: theme.inactive, children: ["  ", "provided by the ", ownedBy.host, " Package ", ownedBy.name] }), data.kind === "skill" && hasUnmanagedCopy(data.skill, installed)
                 ? _jsxs(Text, { color: theme.marker, children: ["  ", UNMANAGED_MARKER] })
                 : null] }));
 }
 /** The prompt of the install flow; browsing shows nothing. */
 export function ActionPanel({ mode }) {
+    if (isPackageMode(mode))
+        return _jsx(PackagePanel, { mode: mode });
     switch (mode.kind) {
         case "browse":
             return null;