@klhapp/skillmux 1.11.2 → 1.13.0

package/src/install.ts

@@ -1,232 +0,0 @@
-import { cpSync, existsSync, lstatSync, mkdtempSync, readdirSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { basename, dirname, join, relative } from "node:path";
-import { type ScanFinding, readTextFileOrNull, scanContent } from "./scan";
-import { decodeUtf8Strict, listSupportingFiles, parseSkillMd } from "./vault";
-
-export interface RepoSource {
-  url: string;
-  skillPath?: string;
-}
-
-const GIT_URL_PREFIXES = ["http://", "https://", "git://", "ssh://", "file://"];
-const SCP_LIKE_URL_PATTERN = /^[^/\s]+@[^/\s]+:/;
-
-export function isGitUrl(repo: string): boolean {
-  if (GIT_URL_PREFIXES.some((prefix) => repo.startsWith(prefix))) return true;
-  // scp-like syntax (user@host:path) has no URL scheme, so whatever accepts it here
-  // hands the raw string to `git clone`/`git ls-remote` as a bare positional argument.
-  // If that string starts with `-`, git's own option parser reads it as a flag, not a
-  // repository — verified against git 2.55: `--upload-pack=<cmd>@host:path` makes git
-  // run `<cmd>` as a real local shell command instead of contacting a remote. Reject
-  // it outright rather than let a crafted string reach that argv slot.
-  return SCP_LIKE_URL_PATTERN.test(repo) && !repo.startsWith("-");
-}
-
-/** A `file://` source_url reaches the local filesystem directly, not just a network
- *  remote. That's fine when the user typed it themselves at `skillmux install` time,
- *  but a `.skillmux-origin` sidecar is vault content — readable and writable by
- *  whatever populated the vault (a shared git-backed vault pulled in, or a hand-edit),
- *  same threat model as every other vault-content read this codebase guards. `skillmux
- *  outdated`/`update` must not blindly git-clone/ls-remote whatever local path a
- *  forged sidecar names. */
-export function isLocalFileUrl(url: string): boolean {
-  return url.startsWith("file://");
-}
-
-export function resolveRepoSource(repo: string): RepoSource {
-  if (isGitUrl(repo)) return { url: repo };
-
-  const [owner, name, ...rest] = repo.split("/");
-  if (!owner || !name) {
-    throw new Error(`invalid repo "${repo}": expected owner/repo, owner/repo/path, or a git URL`);
-  }
-  const url = `https://github.com/${owner}/${name}.git`;
-  return rest.length > 0 ? { url, skillPath: rest.join("/") } : { url };
-}
-
-function extractHost(url: string): string {
-  const scpMatch = url.match(/^[^/\s]+@([^/\s]+):/);
-  if (scpMatch) return scpMatch[1]!;
-  return new URL(url).hostname;
-}
-
-export function assertHostAllowed(url: string, allowedHosts: string[] | undefined): void {
-  if (!allowedHosts || allowedHosts.length === 0) return;
-  if (isLocalFileUrl(url)) return;
-  const host = extractHost(url);
-  if (!allowedHosts.map((h) => h.toLowerCase()).includes(host.toLowerCase())) {
-    throw new Error(`refusing to fetch from host "${host}" — not in [egress] allowed_hosts`);
-  }
-}
-
-export function deriveRepoName(url: string): string {
-  const cleaned = url.replace(/\.git$/, "");
-  const segment = cleaned.split(/[/:]/).filter(Boolean).pop();
-  if (!segment) throw new Error(`could not derive a repo name from "${url}"`);
-  return segment;
-}
-
-export async function cloneToTemp(url: string): Promise<string> {
-  const dir = mkdtempSync(join(tmpdir(), "skillmux-install-"));
-  const proc = Bun.spawn(["git", "clone", "--quiet", "--depth", "1", url, dir], {
-    stdout: "pipe",
-    stderr: "pipe",
-  });
-  const exitCode = await proc.exited;
-  if (exitCode !== 0) {
-    const stderr = await new Response(proc.stderr).text();
-    rmSync(dir, { recursive: true, force: true });
-    throw new Error(`git clone failed for ${url}: ${stderr.trim()}`);
-  }
-  return dir;
-}
-
-export function resolveCloneCommit(cloneDir: string): string {
-  const proc = Bun.spawnSync(["git", "-C", cloneDir, "rev-parse", "HEAD"], { stdout: "pipe", stderr: "pipe" });
-  if (proc.exitCode !== 0) {
-    throw new Error(`git rev-parse HEAD failed in ${cloneDir}: ${proc.stderr.toString().trim()}`);
-  }
-  return proc.stdout.toString().trim();
-}
-
-export async function remoteHeadCommit(url: string, ref = "HEAD"): Promise<string> {
-  const proc = Bun.spawn(["git", "ls-remote", url, ref], { stdout: "pipe", stderr: "pipe" });
-  const exitCode = await proc.exited;
-  const stdout = await new Response(proc.stdout).text();
-  if (exitCode !== 0) {
-    const stderr = await new Response(proc.stderr).text();
-    throw new Error(`git ls-remote failed for ${url}: ${stderr.trim()}`);
-  }
-  const line = stdout.split("\n").find((l) => l.trim().length > 0);
-  if (!line) throw new Error(`git ls-remote returned no ref "${ref}" for ${url}`);
-  const sha = line.split("\t")[0]?.trim();
-  if (!sha || !/^[0-9a-f]{40}$/.test(sha)) {
-    throw new Error(`git ls-remote returned an unparseable SHA for ${url}: ${line}`);
-  }
-  return sha;
-}
-
-/** Recursively finds symlinks under `dir` (skipping `.git`), without following them.
- *  A skill's content must be regular files only — a symlink here is how a malicious
- *  skill smuggles an escape out of the vault once `skillmux sync` exposes it inside
- *  an agent's native skill directory. `dir` itself is checked too: a `skill_path`
- *  can point straight at a directory that git committed *as a symlink* (git supports
- *  storing symlink blobs) — walking its descendants alone would silently resolve
- *  through it and report the target's real files as clean. */
-export function findSymlinks(dir: string): string[] {
-  const found: string[] = [];
-  if (lstatSync(dir).isSymbolicLink()) {
-    return ["(the skill directory itself is a symlink)"];
-  }
-  const walk = (current: string) => {
-    for (const entry of readdirSync(current, { withFileTypes: true })) {
-      if (entry.name === ".git") continue;
-      const abs = join(current, entry.name);
-      if (entry.isSymbolicLink()) {
-        found.push(relative(dir, abs));
-      } else if (entry.isDirectory()) {
-        walk(abs);
-      }
-    }
-  };
-  walk(dir);
-  return found.sort();
-}
-
-export interface ValidationResult {
-  findings: ScanFinding[];
-}
-
-export async function validateSkillCandidate(skillId: string, dir: string): Promise<ValidationResult> {
-  const symlinks = findSymlinks(dir);
-  if (symlinks.length > 0) {
-    throw new Error(
-      `"${skillId}" contains symlink(s), which are not allowed in skill content: ${symlinks.join(", ")}`,
-    );
-  }
-
-  const bytes = await Bun.file(join(dir, "SKILL.md")).bytes();
-  const body = decodeUtf8Strict(bytes);
-  parseSkillMd(skillId, body);
-
-  const findings: ScanFinding[] = scanContent(body).map((match) => ({
-    ...match,
-    skill_id: skillId,
-    file: "SKILL.md",
-  }));
-
-  const vaultPath = dirname(dir);
-  const dirName = basename(dir);
-  for (const rel of listSupportingFiles(vaultPath, dirName)) {
-    const content = await readTextFileOrNull(join(dir, rel));
-    if (content === null) continue;
-    for (const match of scanContent(content)) {
-      findings.push({ ...match, skill_id: skillId, file: rel });
-    }
-  }
-
-  return { findings };
-}
-
-export function installIntoVault(vaultPath: string, skillId: string, sourceDir: string, force = false): string {
-  const symlinks = findSymlinks(sourceDir);
-  if (symlinks.length > 0) {
-    throw new Error(
-      `refusing to install "${skillId}": source contains symlink(s), which are not allowed in skill content: ${symlinks.join(", ")}`,
-    );
-  }
-  const targetDir = join(vaultPath, skillId);
-  if (existsSync(targetDir)) {
-    if (!force) {
-      throw new Error(`skill "${skillId}" already exists in the vault at ${targetDir} — pass --force to overwrite`);
-    }
-    rmSync(targetDir, { recursive: true, force: true });
-  }
-  cpSync(sourceDir, targetDir, { recursive: true, filter: (src) => basename(src) !== ".git" });
-  return targetDir;
-}
-
-export interface ResolvedSkillDir {
-  skillId: string;
-  dir: string;
-}
-
-/** The returned skillId is joined straight into vaultPath by installIntoVault's callers
- *  and fed to a real rmSync(recursive)+cpSync overwrite. Both branches below can produce
- *  "." or ".." for a crafted-but-plausible input: `skill_path` of "." (e.g. `skillmux
- *  install owner/repo/.`) survives the ".." segment check since "." isn't "..", and its
- *  basename is "." too; `fallbackName` comes from deriveRepoName(url), which can return
- *  ".." for a url whose last "/"- or ":"-delimited segment is literally "..". Verified
- *  end-to-end against the real CLI binary: the former makes `install --force` wipe the
- *  entire vault, the latter makes it wipe the vault's parent directory. Neither can ever
- *  legitimately be a skill id, so reject both outright rather than let them reach a join. */
-function rejectTraversalSkillId(skillId: string): void {
-  if (skillId === "." || skillId === "..") {
-    throw new Error(`invalid skill id "${skillId}"`);
-  }
-}
-
-export function resolveSkillDir(cloneDir: string, fallbackName: string, skillPath?: string): ResolvedSkillDir {
-  if (skillPath) {
-    if (skillPath.startsWith("/") || skillPath.split("/").includes("..")) {
-      throw new Error(`invalid skill_path "${skillPath}": must be a relative path within the repo`);
-    }
-    const skillId = basename(skillPath);
-    rejectTraversalSkillId(skillId);
-    return { skillId, dir: join(cloneDir, skillPath) };
-  }
-  if (existsSync(join(cloneDir, "SKILL.md"))) {
-    rejectTraversalSkillId(fallbackName);
-    return { skillId: fallbackName, dir: cloneDir };
-  }
-  const discovered = readdirSync(cloneDir, { withFileTypes: true })
-    .filter((entry) => entry.isDirectory() && existsSync(join(cloneDir, entry.name, "SKILL.md")))
-    .map((entry) => entry.name)
-    .sort();
-  throw new Error(
-    discovered.length > 0
-      ? `no SKILL.md at repo root; found skill dirs: ${discovered.join(", ")} — pass a path to select one, e.g. owner/repo/${discovered[0]}`
-      : "no SKILL.md at repo root and no skill dirs found under it",
-  );
-}

package/src/lifecycle.ts

@@ -1,51 +0,0 @@
-import { expandHome } from "./config";
-import type { ReadinessState } from "./readiness";
-import { backfillEmbeddings, getRuntime, rebuildIndex } from "./router-core";
-import { getVaultMaxMtime } from "./vault";
-
-export async function initializeRuntime(state: ReadinessState): Promise<void> {
-  try {
-    const { config, db, clients } = await getRuntime();
-    const vaultPath = expandHome(config.vault_path);
-    const report = await rebuildIndex();
-    let embedding: "ready" | "unavailable" = "ready";
-    try {
-      await backfillEmbeddings();
-      await clients.embed(["skill router readiness probe"]);
-    } catch {
-      embedding = "unavailable";
-    }
-
-    let reranker: "not_configured" | "ready" | "unavailable" = "not_configured";
-    if (clients.rerank) {
-      try {
-        await clients.rerank("skill router readiness probe", [
-          { skill_id: "readiness", text: "Routes tasks to relevant skills." },
-        ]);
-        reranker = "ready";
-      } catch {
-        reranker = "unavailable";
-      }
-    }
-
-    state.set({
-      status: "ready",
-      retrieval: reranker === "ready" ? "reranked" : embedding === "ready" ? "hybrid" : "lexical",
-      skills: report.indexed,
-      index_current: getVaultMaxMtime(vaultPath) >= 0 && db.query("SELECT COUNT(*) AS count FROM skills").get() !== null,
-      embedding,
-      reranker,
-    });
-  } catch (error) {
-    state.set({
-      status: "not_ready",
-      retrieval: null,
-      skills: 0,
-      index_current: false,
-      embedding: "unavailable",
-      reranker: "not_configured",
-      error: error instanceof Error ? error.message : String(error),
-    });
-    throw error;
-  }
-}

package/src/logger.ts

@@ -1,26 +0,0 @@
-/**
- * Centralized logging helpers, all writing to stderr via console.error.
- * `log` emits structured JSON ({ level, stage, ...payload }) for machine-
- * readable signals like router-core's retrieval-degradation warnings.
- * `redactedErrorLog` builds a plain-text [prefix, message] pair for
- * operator-facing runtime errors that need secret redaction.
- */
-
-export const log = {
-  warn(stage: string, payload: Record<string, unknown>): void {
-    console.error(JSON.stringify({ level: "warn", stage, ...payload }));
-  },
-  error(stage: string, payload: Record<string, unknown>): void {
-    console.error(JSON.stringify({ level: "error", stage, ...payload }));
-  },
-};
-
-/** Pairs a fixed log prefix with a redacted error message, for console.error. */
-export function redactedErrorLog(
-  prefix: string,
-  err: unknown,
-  redact: (text: string) => string,
-): [string, string] {
-  const msg = err instanceof Error ? err.message : String(err);
-  return [prefix, redact(msg)];
-}

package/src/manifest.ts

@@ -1,352 +0,0 @@
-import { existsSync, renameSync, rmSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-import { z } from "zod";
-import { expandHome } from "./config";
-import { BUILT_IN_TARGET_NAMES, resolveBuiltInTarget } from "./init-agents";
-import { resolveSkillRoot, SKILL_ID_PATTERN } from "./vault";
-
-export const MANIFEST_FILENAME = "skillmux.toml";
-export const LEGACY_MANIFEST_FILENAME = "skr.toml";
-
-export function resolveManifestPath(vaultPath: string): string | null {
-  const newPath = join(vaultPath, MANIFEST_FILENAME);
-  if (existsSync(newPath)) return newPath;
-  const legacyPath = join(vaultPath, LEGACY_MANIFEST_FILENAME);
-  if (existsSync(legacyPath)) return legacyPath;
-  return null;
-}
-
-const groupNameSchema = z.string().regex(/^[a-z][a-z0-9_-]*$/).max(64);
-const skillIdSchema = z.string().regex(SKILL_ID_PATTERN);
-
-const projectGroupSchema = z.object({
-  paths: z.array(z.string().min(1)),
-  skills: z.array(skillIdSchema),
-}).strict();
-
-const targetSchema = z.object({
-  dir: z.string().min(1).optional(),
-  host: z.string().min(1).optional(),
-  project_groups: z.array(groupNameSchema).default([]),
-}).strict();
-
-const manifestSchema = z.object({
-  core: z.object({ skills: z.array(skillIdSchema) }).strict(),
-  project: z.record(groupNameSchema, projectGroupSchema).optional(),
-  targets: z.record(groupNameSchema, targetSchema).default({}),
-}).strict();
-
-export type ProjectGroup = z.infer<typeof projectGroupSchema>;
-export type Target = z.infer<typeof targetSchema>;
-export type Manifest = z.infer<typeof manifestSchema>;
-
-export function resolveTargetDir(
-  name: string,
-  target: Target,
-  options: { home?: string; codexHome?: string } = {},
-): string {
-  if (BUILT_IN_TARGET_NAMES.has(name)) {
-    return resolveBuiltInTarget(name, {
-      ...options,
-      codexHome: options.codexHome ?? (process.env.CODEX_HOME ? expandHome(process.env.CODEX_HOME) : undefined),
-    }).path;
-  }
-  if (!target.dir) throw new Error(`[targets.${name}] requires dir for a custom target`);
-  return expandHome(target.dir);
-}
-
-export function parseManifest(toml: string): Manifest {
-  const parsed = Bun.TOML.parse(toml) as Record<string, unknown>;
-  try {
-    const manifest = manifestSchema.parse(parsed);
-    for (const [name, target] of Object.entries(manifest.targets)) {
-      if (!BUILT_IN_TARGET_NAMES.has(name) && !target.dir) {
-        throw new Error(`[targets.${name}] requires dir for a custom target`);
-      }
-    }
-    return manifest;
-  } catch (error) {
-    if (error instanceof z.ZodError) {
-      for (const issue of error.issues) {
-        if (
-          issue.code === "unrecognized_keys" &&
-          issue.path[0] === "targets" &&
-          issue.keys.includes("project")
-        ) {
-          throw new Error(
-            `[targets.${String(issue.path[1])}] uses the removed field "project" (boolean) — replace it with "project_groups" (an array of [project.<group>] names).`,
-          );
-        }
-        if (
-          issue.code === "unrecognized_keys" &&
-          issue.path[0] === "project" &&
-          issue.keys.includes("repos")
-        ) {
-          throw new Error(
-            `[project.${String(issue.path[1])}] uses the removed field "repos" — replace it with "paths".`,
-          );
-        }
-      }
-    }
-    throw error;
-  }
-}
-
-function tomlStringArray(values: string[]): string {
-  return `[${values.map((v) => JSON.stringify(v)).join(", ")}]`;
-}
-
-/** Purpose-built serializer for this manifest's fixed shape — not a general TOML writer. */
-export function serializeManifest(manifest: Manifest): string {
-  const sections: string[] = [`[core]\nskills = ${tomlStringArray(manifest.core.skills)}`];
-
-  for (const [name, group] of Object.entries(manifest.project ?? {})) {
-    sections.push(
-      `[project.${name}]\npaths = ${tomlStringArray(group.paths)}\nskills = ${tomlStringArray(group.skills)}`,
-    );
-  }
-
-  for (const [name, target] of Object.entries(manifest.targets)) {
-    const dir = BUILT_IN_TARGET_NAMES.has(name) ? "" : `\ndir = ${JSON.stringify(target.dir)}`;
-    const host = target.host ? `\nhost = ${JSON.stringify(target.host)}` : "";
-    sections.push(
-      `[targets.${name}]${dir}${host}\nproject_groups = ${tomlStringArray(target.project_groups)}`,
-    );
-  }
-
-  return `${sections.join("\n\n")}\n`;
-}
-
-export function writeManifestAtomic(path: string, manifest: Manifest): void {
-  const temporaryPath = `${path}.${process.pid}.${crypto.randomUUID()}.tmp`;
-  try {
-    writeFileSync(temporaryPath, serializeManifest(manifest), "utf8");
-    renameSync(temporaryPath, path);
-  } finally {
-    rmSync(temporaryPath, { force: true });
-  }
-}
-
-function findExistingPin(manifest: Manifest, skillId: string): string | null {
-  if (manifest.core.skills.includes(skillId)) return "[core]";
-  for (const [groupName, group] of Object.entries(manifest.project ?? {})) {
-    if (group.skills.includes(skillId)) return `[project.${groupName}]`;
-  }
-  return null;
-}
-
-export function pinCore(manifest: Manifest, skillId: string): Manifest {
-  const existing = findExistingPin(manifest, skillId);
-  if (existing) {
-    throw new Error(`skill "${skillId}" already pinned in ${existing}`);
-  }
-  return { ...manifest, core: { skills: [...manifest.core.skills, skillId] } };
-}
-
-export function unpinCore(manifest: Manifest, skillId: string): Manifest {
-  if (!manifest.core.skills.includes(skillId)) {
-    throw new Error(`skill "${skillId}" is not pinned in [core]`);
-  }
-  return { ...manifest, core: { skills: manifest.core.skills.filter((id) => id !== skillId) } };
-}
-
-export function pinProject(manifest: Manifest, skillId: string, group: string, paths?: string[]): Manifest {
-  if (!groupNameSchema.safeParse(group).success) {
-    throw new Error(`invalid group name "${group}" — must match /^[a-z][a-z0-9_-]*$/ (max 64 chars)`);
-  }
-  const existingGroup = manifest.project?.[group];
-
-  if (!existingGroup) {
-    if (!paths || paths.length === 0) {
-      throw new Error(`group "${group}" does not exist — pass --path <path> at least once to create it`);
-    }
-    const existing = findExistingPin(manifest, skillId);
-    if (existing) {
-      throw new Error(`skill "${skillId}" already pinned in ${existing}`);
-    }
-    return {
-      ...manifest,
-      project: { ...manifest.project, [group]: { paths, skills: [skillId] } },
-    };
-  }
-
-  if (paths && paths.length > 0) {
-    throw new Error(`group "${group}" already exists — --path is only used when creating a new group`);
-  }
-  const existing = findExistingPin(manifest, skillId);
-  if (existing) {
-    throw new Error(`skill "${skillId}" already pinned in ${existing}`);
-  }
-  return {
-    ...manifest,
-    project: { ...manifest.project, [group]: { ...existingGroup, skills: [...existingGroup.skills, skillId] } },
-  };
-}
-
-export function unpinProject(manifest: Manifest, skillId: string, group: string): Manifest {
-  const existingGroup = manifest.project?.[group];
-  if (!existingGroup) {
-    throw new Error(`[project.${group}] does not exist`);
-  }
-  if (!existingGroup.skills.includes(skillId)) {
-    throw new Error(`skill "${skillId}" is not pinned in [project.${group}]`);
-  }
-  return {
-    ...manifest,
-    project: {
-      ...manifest.project,
-      [group]: { ...existingGroup, skills: existingGroup.skills.filter((id) => id !== skillId) },
-    },
-  };
-}
-
-export interface UpsertProjectOptions {
-  name: string;
-  paths: string[];
-  skills: string[];
-  targets: string[];
-}
-
-export function upsertProject(manifest: Manifest, options: UpsertProjectOptions): Manifest {
-  if (!groupNameSchema.safeParse(options.name).success) {
-    throw new Error(
-      `invalid group name "${options.name}" — must match /^[a-z][a-z0-9_-]*$/ (max 64 chars)`,
-    );
-  }
-
-  const existingGroup = manifest.project?.[options.name] ?? { paths: [], skills: [] };
-  for (const skillId of options.skills) {
-    if (!skillIdSchema.safeParse(skillId).success) {
-      throw new Error(`invalid skill ID "${skillId}"`);
-    }
-    if (existingGroup.skills.includes(skillId)) continue;
-    const existing = findExistingPin(manifest, skillId);
-    if (existing) throw new Error(`skill "${skillId}" already pinned in ${existing}`);
-  }
-
-  const targets = { ...manifest.targets };
-  for (const targetName of options.targets) {
-    const target = targets[targetName];
-    if (!target) throw new Error(`target "${targetName}" does not exist`);
-    targets[targetName] = {
-      ...target,
-      project_groups: [...new Set([...target.project_groups, options.name])],
-    };
-  }
-
-  return {
-    ...manifest,
-    project: {
-      ...manifest.project,
-      [options.name]: {
-        paths: [...new Set([...existingGroup.paths, ...options.paths])],
-        skills: [...new Set([...existingGroup.skills, ...options.skills])],
-      },
-    },
-    targets,
-  };
-}
-
-export function updateProjectPaths(
-  manifest: Manifest,
-  group: string,
-  changes: { add?: string[]; remove?: string[] },
-): Manifest {
-  const existingGroup = manifest.project?.[group];
-  if (!existingGroup) throw new Error(`[project.${group}] does not exist`);
-  const removed = new Set(changes.remove ?? []);
-  const paths = [...new Set([...existingGroup.paths, ...(changes.add ?? [])])]
-    .filter((path) => !removed.has(path));
-  return {
-    ...manifest,
-    project: {
-      ...manifest.project,
-      [group]: { ...existingGroup, paths },
-    },
-  };
-}
-
-export function updateProjectTargets(
-  manifest: Manifest,
-  group: string,
-  changes: { attach?: string[]; detach?: string[] },
-): Manifest {
-  if (!manifest.project?.[group]) throw new Error(`[project.${group}] does not exist`);
-  const attach = new Set(changes.attach ?? []);
-  const detach = new Set(changes.detach ?? []);
-  const requested = new Set([...attach, ...detach]);
-  for (const target of requested) {
-    if (!manifest.targets[target]) throw new Error(`target "${target}" does not exist`);
-  }
-  return {
-    ...manifest,
-    targets: Object.fromEntries(Object.entries(manifest.targets).map(([name, target]) => {
-      let groups = target.project_groups;
-      if (attach.has(name)) groups = [...new Set([...groups, group])];
-      if (detach.has(name)) groups = groups.filter((item) => item !== group);
-      return [name, { ...target, project_groups: groups }];
-    })),
-  };
-}
-
-export interface ManifestValidationResult {
-  notes: string[];
-}
-
-export const CORE_SKILL_LIMIT = 25;
-
-function requireCoreVaultRoot(skillId: string, vaultPath: string, localVaultPaths: string[], location: string): void {
-  const root = resolveSkillRoot(skillId, vaultPath, localVaultPaths);
-  if (root === null) {
-    throw new Error(`${location} skill "${skillId}" does not exist in the vault`);
-  }
-  if (root !== vaultPath) {
-    throw new Error(
-      `${location} skill "${skillId}" only exists in a local vault path (${root}) — pins in the shared ` +
-        `manifest must be backed by the canonical vault_path (${vaultPath}) to stay portable across machines`,
-    );
-  }
-}
-
-export function validateManifest(
-  manifest: Manifest,
-  vaultPath: string,
-  localVaultPaths: string[] = [],
-): ManifestValidationResult {
-  if (manifest.core.skills.length > CORE_SKILL_LIMIT) {
-    throw new Error(
-      `[core] has ${manifest.core.skills.length} skills, exceeding the limit of ${CORE_SKILL_LIMIT}`,
-    );
-  }
-
-  const coreSet = new Set(manifest.core.skills);
-  for (const skillId of manifest.core.skills) {
-    requireCoreVaultRoot(skillId, vaultPath, localVaultPaths, "[core]");
-  }
-
-  const groupNames = new Set(Object.keys(manifest.project ?? {}));
-  for (const [targetName, target] of Object.entries(manifest.targets)) {
-    for (const groupName of target.project_groups) {
-      if (!groupNames.has(groupName)) {
-        throw new Error(`[targets.${targetName}] project_groups references undefined group "${groupName}"`);
-      }
-    }
-  }
-
-  const notes: string[] = [];
-  for (const [groupName, group] of Object.entries(manifest.project ?? {})) {
-    for (const skillId of group.skills) {
-      requireCoreVaultRoot(skillId, vaultPath, localVaultPaths, `[project.${groupName}]`);
-      if (coreSet.has(skillId)) {
-        throw new Error(`skill "${skillId}" appears in both [core] and [project.${groupName}]`);
-      }
-    }
-    for (const path of group.paths) {
-      if (!existsSync(expandHome(path))) {
-        notes.push(`[project.${groupName}] paths entry not found locally, skipped: ${path}`);
-      }
-    }
-  }
-
-  return { notes };
-}