@namewta/speculo 1.0.24 → 2.0.1

package/dist/src/agent-skills.js

@@ -1,530 +1,168 @@
 import { createHash } from "node:crypto";
-import { lstat, readdir, readFile, readlink } from "node:fs/promises";
-import { join } from "node:path";
-import { containedPath } from "./paths.js";
-import { pathToFileURL } from "node:url";
+import { lstat, readFile, readdir, writeFile } from "node:fs/promises";
+import { join, posix } from "node:path";
+import { readAssetCatalog, parseFrontmatter } from "./assets.js";
+import { containedPath, INSTALL_ROOT, safeRelativePath } from "./paths.js";
 import { RefreshBlockedError } from "./refresh.js";
-import { pathExists } from "./utils.js";
-import { discoverWorkflowCatalog } from "./workflows.js";
-export const MANAGED_MANIFEST = ".speculo-managed.json";
-const WORK_DIR = /^[A-Z]-[a-z0-9][a-z0-9-]*$/;
-const SKILL_ID = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-const REQUIRED_TAIL = "选中后必须先读工作入口；选择本技能不构成执行授权。";
-let validateSkill;
-async function skillValidator(packageRoot) {
-    if (!validateSkill) {
-        const href = pathToFileURL(join(packageRoot, "scripts/validate-skills.mjs")).href;
-        validateSkill = (await import(href)).validateSkill;
-    }
-    return validateSkill;
-}
-function record(value) {
-    return !!value && typeof value === "object" && !Array.isArray(value);
-}
-export function sha256Buffer(content) {
-    return createHash("sha256").update(content).digest("hex");
-}
-function frontmatter(content) {
-    const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
-    const fields = {};
-    if (!match)
-        return fields;
-    for (const line of match[1].split(/\r?\n/)) {
-        const field = line.match(/^([A-Za-z0-9_-]+):\s*(.*)$/);
-        if (field)
-            fields[field[1]] = field[2].trim();
-    }
-    return fields;
-}
-function oneLine(value) {
-    return value.replace(/[\r\n|]+/g, " ").replace(/\s+/g, " ").trim();
-}
-function keywordsOf(raw) {
-    if (!raw)
-        return [];
-    return raw.replace(/^\[/, "").replace(/\]$/, "").split(",").map((item) => item.trim()).filter(Boolean);
-}
-export function buildWorkDescription(workflowName, workName, workDescription, keywords) {
-    const keyText = keywords.length ? `关键词：${keywords.join("、")}。` : "";
-    const tail = `${keyText}使用时机：用户要执行该 Work，或任务与其描述或关键词匹配。${REQUIRED_TAIL}`;
-    const head = `${oneLine(workflowName)} Work「${oneLine(workName)}」：${oneLine(workDescription)}。`;
-    const combined = `${head}${tail}`.replace(/\s+/g, " ").trim();
-    if (combined.length <= 1024)
-        return combined;
-    const budget = Math.max(0, 1024 - tail.length);
-    return `${head.slice(0, budget).trim()}${tail}`.slice(0, 1024);
-}
-export function renderWorkSkill(input) {
-    const id = `${input.workflowId}-${input.work.toLowerCase()}`;
-    const entry = `speculo/workflows/${input.workflowId}/${input.work}/${input.work}.md`;
-    const relative = `../../../${entry}`;
-    const description = buildWorkDescription(input.workflowName, input.title, input.workDescription, input.keywords);
-    const metadata = JSON.stringify({
-        "speculo-kind": "work-pointer",
-        "speculo-workflow": input.workflowId,
-        "speculo-work": input.work,
-        "speculo-entry": input.entryId,
-    });
-    const body = [
-        "---",
-        `name: ${id}`,
-        `description: ${description}`,
-        `metadata: ${metadata}`,
-        "---",
-        "",
-        `# ${oneLine(input.title)}`,
-        "",
-        "做任何步骤、扩读或改动之前，先读工作入口，并只以该文件为事实源。",
-        "",
-        `- 项目根路径：\`${entry}\``,
-        `- 相对本文件：[${input.work}.md](${relative})`,
-        "",
-        "接着只执行该入口的第一条读取指令。不要把 `<Path>` 当宿主标签。先读 `speculo/.speculo/workspace.json`，按 `path_base: project-root` 解析：`{roots.workflows}`=`speculo/workflows`，`{roots.state}`=`speculo/.speculo`，`{roots.skills}`=`speculo/skills`。入口内的相对链接相对于入口文件所在目录，不相对于本 SKILL.md。",
-        "",
-        "不复制入口、references、scripts 或正文。选中本技能不是执行授权。缺入口、roots 或该 Work 要求的确认时停止。",
-        "",
-    ].join("\n");
-    return { id, workflow: input.workflowId, work: input.work, entry, sha256: sha256Buffer(body), body, title: oneLine(input.title) };
-}
-export async function discoverWorks(workflowRoot, workflowId, workflowName) {
-    const skills = [];
-    let entries;
-    try {
-        entries = await readdir(workflowRoot, { withFileTypes: true });
-    }
-    catch (error) {
-        if (error.code === "ENOENT")
-            return skills;
-        throw error;
-    }
-    for (const entry of entries) {
-        if (!entry.isDirectory() || !WORK_DIR.test(entry.name))
-            continue;
-        const file = join(workflowRoot, entry.name, `${entry.name}.md`);
-        if (!(await pathExists(file)))
-            continue;
-        const fields = frontmatter(await readFile(file, "utf8"));
-        if (fields.type !== "workflow-entry" || fields.workflow !== workflowId)
-            continue;
-        skills.push(renderWorkSkill({
-            workflowId,
-            workflowName,
-            work: entry.name,
-            entryId: fields.id || `${workflowId}/${entry.name}`,
-            title: fields.name || entry.name,
-            workDescription: fields.description || fields.name || entry.name,
-            keywords: keywordsOf(fields.keywords),
-        }));
-    }
-    return skills.sort((left, right) => left.id.localeCompare(right.id));
-}
-export async function listTemplateSkillNames(skillsRoot) {
-    const names = [];
-    for (const entry of await readdir(skillsRoot, { withFileTypes: true })) {
-        if (!entry.isDirectory() || entry.isSymbolicLink())
-            continue;
-        if (await pathExists(join(skillsRoot, entry.name, "SKILL.md")))
-            names.push(entry.name);
-    }
-    return names.sort();
-}
-export function templateLink(name) {
-    return `../../speculo/skills/${name}`;
-}
-export function parseAgentSkillSpec(spec, workflowIds) {
-    if (spec === "none")
-        return { mode: "none" };
-    if (spec === "keep")
-        return { mode: "keep" };
-    if (!/^[a-z0-9:+,-]+$/.test(spec))
-        throw new Error("--agent-skills contains an invalid token");
-    const parts = spec.split(",").filter((part) => part.length > 0);
-    if (parts.length === 0 || parts.includes("none") || parts.includes("keep"))
-        throw new Error("--agent-skills none and keep must be used alone");
-    const workflowSelection = [];
-    const templateNames = [];
-    let templateAll = false;
-    for (let index = 0; index < parts.length; index++) {
-        const part = parts[index];
-        if (part === "template") {
-            templateAll = true;
-            continue;
-        }
-        if (part.startsWith("template:")) {
-            const inline = part.slice("template:".length).split("+").filter((id) => id.length > 0);
-            if (inline.length === 0 || inline.some((id) => !SKILL_ID.test(id)))
-                throw new Error("--agent-skills template id is invalid: " + part);
-            templateNames.push(...inline);
-            while (index + 1 < parts.length && !workflowIds.has(parts[index + 1]) && parts[index + 1] !== "template" && !parts[index + 1].startsWith("template:") && SKILL_ID.test(parts[index + 1])) {
-                templateNames.push(parts[++index]);
-            }
-            continue;
-        }
-        if (!workflowIds.has(part))
-            throw new Error("--agent-skills unknown workflow: " + part);
-        workflowSelection.push(part);
-    }
-    return {
-        mode: "set",
-        workflowIds: [...new Set(workflowSelection)].sort(),
-        templateNames: templateAll ? "all" : [...new Set(templateNames)].sort(),
-    };
-}
-function absent() { return { kind: "absent" }; }
-function fileNode(content) {
-    return { kind: "file", content: Buffer.from(content, "utf8").toString("base64"), mode: 0o644 };
-}
-function directoryNode(content) {
-    return { kind: "directory", file: "SKILL.md", content: Buffer.from(content, "utf8").toString("base64"), mode: 0o644 };
-}
-function symlinkNode(target) {
-    return { kind: "symlink", target };
-}
-export function decodeSkillText(node) {
-    if (node.kind !== "file" && node.kind !== "directory")
-        return "";
-    return Buffer.from(node.content, "base64").toString("utf8");
-}
-async function readManifest(target) {
-    const path = join(target, ".agents", "skills", MANAGED_MANIFEST);
-    let stat;
-    try {
-        stat = await lstat(path);
-    }
-    catch (error) {
-        if (error.code === "ENOENT")
-            return { manifest: null, raw: null, blocker: null };
-        throw error;
-    }
-    if (stat.isSymbolicLink() || !stat.isFile()) {
-        return { manifest: null, raw: null, blocker: { code: "agent-skill-drift", path: `.agents/skills/${MANAGED_MANIFEST}`, message: "managed manifest must be a regular file" } };
-    }
-    const raw = await readFile(path, "utf8");
-    let parsed;
-    try {
-        parsed = JSON.parse(raw);
-    }
-    catch {
-        return { manifest: null, raw, blocker: { code: "agent-skill-drift", path: `.agents/skills/${MANAGED_MANIFEST}`, message: "managed manifest is not valid JSON" } };
-    }
-    if (!record(parsed) || parsed.schema_version !== 1 || typeof parsed.package_version !== "string" || !Array.isArray(parsed.works) || !Array.isArray(parsed.template_skills)) {
-        return { manifest: null, raw, blocker: { code: "agent-skill-drift", path: `.agents/skills/${MANAGED_MANIFEST}`, message: "managed manifest schema is invalid" } };
-    }
-    const works = [];
-    const templateSkills = [];
-    for (const work of parsed.works) {
-        if (!record(work) || typeof work.id !== "string" || typeof work.workflow !== "string" || typeof work.work !== "string" || typeof work.entry !== "string" || typeof work.sha256 !== "string") {
-            return { manifest: null, raw, blocker: { code: "agent-skill-drift", path: `.agents/skills/${MANAGED_MANIFEST}`, message: "managed work record is invalid" } };
-        }
-        works.push({ id: work.id, workflow: work.workflow, work: work.work, entry: work.entry, sha256: work.sha256 });
-    }
-    for (const skill of parsed.template_skills) {
-        if (!record(skill) || typeof skill.name !== "string" || typeof skill.link !== "string" || typeof skill.sha256 !== "string") {
-            return { manifest: null, raw, blocker: { code: "agent-skill-drift", path: `.agents/skills/${MANAGED_MANIFEST}`, message: "managed template record is invalid" } };
-        }
-        templateSkills.push({ name: skill.name, link: skill.link, sha256: skill.sha256 });
-    }
-    return { manifest: { schema_version: 1, package_version: parsed.package_version, works, template_skills: templateSkills }, raw, blocker: null };
-}
-async function parentBlocker(target) {
-    for (const relative of [".agents", ".agents/skills"]) {
-        try {
-            const stat = await lstat(join(target, relative));
-            if (stat.isSymbolicLink() || !stat.isDirectory()) {
-                return { code: "agent-skill-parent", path: relative, message: "expected a real directory so managed skills can be projected beside unmanaged entries" };
-            }
-        }
-        catch (error) {
-            if (error.code !== "ENOENT")
-                throw error;
-        }
-    }
-    return null;
-}
-async function workNodeMatches(target, work) {
-    const dir = join(target, ".agents", "skills", work.id);
-    let stat;
+import { readImage } from "./external-files.js";
+export const MANAGED_MANIFEST = "projections.json";
+export function sha256Buffer(value) { return createHash('sha256').update(value).digest('hex'); }
+export function parseAgentSkillSpec(spec) {
+    if (['none', 'keep', 'domains', 'all'].includes(spec))
+        return { mode: spec };
+    const ids = spec.split(',');
+    if (!ids.length || ids.some(id => !/^[a-z0-9]+(?:-[a-z0-9]+)*\/[a-z0-9]+(?:-[a-z0-9]+)*$/.test(id)))
+        throw new Error('projection selection must be none|keep|domains|all or comma-separated business ids');
+    return { mode: 'set', assetIds: [...new Set(ids)].sort() };
+}
+export async function readProjectionManifest(target) {
+    let content;
     try {
-        stat = await lstat(dir);
-    }
-    catch (error) {
-        return error.code === "ENOENT" ? false : Promise.reject(error);
-    }
-    if (stat.isSymbolicLink() || !stat.isDirectory())
-        return false;
-    const entries = await readdir(dir);
-    if (entries.length !== 1 || entries[0] !== "SKILL.md")
-        return false;
-    const file = join(dir, "SKILL.md");
-    const fileStat = await lstat(file);
-    if (fileStat.isSymbolicLink() || !fileStat.isFile())
-        return false;
-    return sha256Buffer(await readFile(file)) === work.sha256;
-}
-async function templateNodeMatches(target, skill) {
-    const path = join(target, ".agents", "skills", skill.name);
-    let stat;
+        content = await readFile(await containedPath(target, `${INSTALL_ROOT}/.speculo/${MANAGED_MANIFEST}`), 'utf8');
+    }
+    catch (e) {
+        if (e.code === 'ENOENT')
+            return null;
+        throw e;
+    }
+    const m = JSON.parse(content);
+    if (m.schema_version !== 2 || typeof m.package_version !== 'string' || !m.selections || !['agents', 'claude'].every(h => Array.isArray(m.selections[h]) && m.selections[h].every(id => typeof id === 'string')) || !Array.isArray(m.files) || new Set(m.files.map(f => f.path)).size !== m.files.length)
+        throw new Error('invalid-projection-manifest');
+    for (const file of m.files)
+        if (!safeRelativePath(file.path) || !/^\.(agents|claude)\/skills\/[a-z0-9-]+\/(SKILL\.md|agents\/openai\.yaml)$/.test(file.path) || typeof file.asset_id !== 'string' || !/^[a-f0-9]{64}$/.test(file.sha256))
+            throw new Error('invalid-projection-record');
+    return m;
+}
+function fileNode(content) { return { kind: 'file', content: Buffer.from(content).toString('base64'), mode: 0o644 }; }
+async function assertProjectionCasing(target, path) {
+    let parent = target;
+    for (const part of path.split('/')) {
+        const names = await readdir(parent).catch((error) => { if (error.code === 'ENOENT')
+            return []; throw error; });
+        if (names.some(name => name.toLowerCase() === part.toLowerCase() && name !== part))
+            throw new Error(`ambiguous-projection-casing: ${path}`);
+        parent = join(parent, part);
+    }
+}
+async function snapshot(target, p) {
+    const full = await containedPath(target, p);
     try {
-        stat = await lstat(path);
-    }
-    catch (error) {
-        return error.code === "ENOENT" ? false : Promise.reject(error);
-    }
-    if (!stat.isSymbolicLink())
-        return false;
-    return await readlink(path) === skill.link && sha256Buffer(skill.link) === skill.sha256;
-}
-export async function cleanProjectionSelection(target, manifest) {
-    const workflows = new Set();
-    const byWorkflow = new Map();
-    for (const work of manifest.works) {
-        const group = byWorkflow.get(work.workflow) ?? [];
-        group.push(work);
-        byWorkflow.set(work.workflow, group);
-    }
-    for (const [workflow, works] of byWorkflow) {
-        let clean = works.length > 0;
-        for (const work of works)
-            if (!(await workNodeMatches(target, work)))
-                clean = false;
-        if (clean)
-            workflows.add(workflow);
-    }
-    const template = new Set();
-    for (const skill of manifest.template_skills)
-        if (await templateNodeMatches(target, skill))
-            template.add(skill.name);
-    return { workflows, template };
-}
-async function promptAgentSkills(input) {
-    const { checkbox } = await import("@inquirer/prompts");
-    const workflowIds = input.workflows.length === 0 ? [] : await checkbox({
-        message: "选择要写入 .agents/skills/ 的 Work 组（供 Agents /skills；默认不写入，空格切换，回车确认）：",
-        choices: input.workflows.map((workflow) => ({ name: workflow.label, value: workflow.id, checked: workflow.checked })),
-        pageSize: 12,
-    });
-    const templateNames = input.template.length === 0 ? [] : await checkbox({
-        message: "选择要链接到 .agents/skills/ 的模板 Skill（默认不链接，不影响 speculo/skills）：",
-        choices: input.template.map((skill) => ({ name: skill.name, value: skill.name, checked: skill.checked })),
-        pageSize: 12,
-    });
-    return { workflowIds, templateNames };
+        const value = await readImage(full);
+        if (!value)
+            return { kind: 'absent' };
+        if (!(value.mode & 0o200))
+            throw new Error(`managed-asset-conflict: readonly ${p}`);
+        return { kind: 'file', ...value };
+    }
+    catch (e) {
+        if (e.code === 'ENOENT')
+            return { kind: 'absent' };
+        throw e;
+    }
+}
+export function renderSkillPointer(asset, source, host) {
+    const destination = `.${host}/skills/${asset.name}`, sourcePath = `${INSTALL_ROOT}/${asset.entry}`;
+    const link = posix.relative(destination, sourcePath), { raw } = parseFrontmatter(source);
+    const eol = raw.includes('\r\n') ? '\r\n' : '\n';
+    const header = asset.kind === 'command' ? `---\nname: ${asset.name}\ndescription: ${JSON.stringify(asset.description)}${host === 'claude' ? '\ndisable-model-invocation: true' : ''}\n---` : raw;
+    const body = [header, '', `# ${asset.name}`, '', `执行任何步骤或扩读之前，必须先读取[权威入口](${link})。该入口是本能力的唯一事实源。`, '', '随后仅按入口读取当前分支所需的参考。相对链接以权威入口所在目录为基准。读取或选择本投影不构成执行、提交、发布或其他副作用授权。入口不可读时停止，不根据描述猜测流程。', ''].join(eol);
+    const files = { [`${destination}/SKILL.md`]: body };
+    if (asset.kind === 'command' && host === 'agents')
+        files[`${destination}/agents/openai.yaml`] = 'policy:\n  allow_implicit_invocation: false\n';
+    return files;
 }
 export async function resolveAgentSkillRequest(options) {
     if (options.request)
         return options.request;
-    const existing = await readManifest(options.target);
-    if (existing.blocker)
-        throw new RefreshBlockedError([existing.blocker]);
+    const existing = await readProjectionManifest(options.target);
     if (!options.prompt)
-        return existing.manifest ? { mode: "keep" } : { mode: "skip" };
-    const prechecked = existing.manifest ? await cleanProjectionSelection(options.target, existing.manifest) : { workflows: new Set(), template: new Set() };
-    const workflows = [];
-    for (const id of options.installedWorkflowIds) {
-        const workflow = options.catalog.get(id);
-        if (!workflow)
-            continue;
-        const works = await discoverWorks(join(options.packageRoot, "template", "workflows", id), id, workflow.displayName);
-        workflows.push({ id, label: `${workflow.displayName} 的 ${works.length} 个 Work`, checked: prechecked.workflows.has(id) });
-    }
-    const template = (await listTemplateSkillNames(join(options.packageRoot, "template", "skills"))).map((name) => ({ name, checked: prechecked.template.has(name) }));
-    const picked = await promptAgentSkills({ workflows, template });
-    return { mode: "set", workflowIds: picked.workflowIds, templateNames: picked.templateNames };
-}
-function manifestText(manifest) {
-    return JSON.stringify(manifest, null, 2) + "\n";
-}
-function pushChange(records, name, before, after) {
-    if (JSON.stringify(before) === JSON.stringify(after))
-        return;
-    records.push({ name, before, after });
+        return { mode: existing ? 'keep' : 'none' };
+    const { select } = await import('@inquirer/prompts');
+    return { mode: await select({ message: '选择 .agents/skills 能力曝光范围：', choices: [{ name: '保留现有选择', value: 'keep' }, { name: '不曝光', value: 'none' }, { name: '已安装领域入口', value: 'domains' }, { name: '全部已安装公开入口', value: 'all' }], default: existing ? 'keep' : 'none' }) };
 }
 export async function planSkillProjection(options) {
-    if (options.request.mode === "skip")
-        return { records: null, blockers: [] };
-    const loaded = await readManifest(options.target);
-    if (loaded.blocker)
-        return { records: null, blockers: [loaded.blocker] };
-    const manifest = loaded.manifest;
-    if ((options.request.mode === "none" || options.request.mode === "keep") && !manifest)
-        return { records: null, blockers: [] };
-    const installed = new Set(options.installedWorkflowIds);
-    let workflowIds = [];
-    let templateNames = [];
-    if (options.request.mode === "none") {
-        workflowIds = [];
-        templateNames = [];
-    }
-    else if (options.request.mode === "keep") {
-        workflowIds = [...new Set(manifest.works.map((work) => work.workflow))].sort();
-        templateNames = manifest.template_skills.map((skill) => skill.name).sort();
-    }
-    else {
-        workflowIds = [...options.request.workflowIds].sort();
-        templateNames = options.request.templateNames === "all"
-            ? await listTemplateSkillNames(join(options.stagedRoot, "skills"))
-            : [...options.request.templateNames].sort();
-    }
-    const blockers = [];
-    for (const work of manifest?.works ?? []) {
-        if (!SKILL_ID.test(work.id) || !SKILL_ID.test(work.workflow) || !WORK_DIR.test(work.work) || work.entry !== `speculo/workflows/${work.workflow}/${work.work}/${work.work}.md`) {
-            blockers.push({ code: "agent-skill-drift", path: `.agents/skills/${MANAGED_MANIFEST}`, message: "managed work record is not a contained skill id" });
-        }
-    }
-    for (const skill of manifest?.template_skills ?? []) {
-        if (!SKILL_ID.test(skill.name) || skill.link !== templateLink(skill.name)) {
-            blockers.push({ code: "agent-skill-drift", path: `.agents/skills/${MANAGED_MANIFEST}`, message: "managed template record is not a contained skill id" });
-        }
-    }
-    if (blockers.length)
-        return { records: null, blockers };
-    for (const workflowId of workflowIds) {
-        if (!installed.has(workflowId))
-            blockers.push({ code: "agent-skill-workflow", path: workflowId, message: "workflow is not installed; select it for installation before projecting its works" });
-    }
-    const availableTemplate = new Set(await listTemplateSkillNames(join(options.stagedRoot, "skills")));
-    for (const name of templateNames) {
-        if (!availableTemplate.has(name))
-            blockers.push({ code: "agent-skill-template", path: name, message: "unknown template skill" });
-    }
-    if (blockers.length)
-        return { records: null, blockers };
-    const catalog = await discoverWorkflowCatalog(options.packageRoot);
-    const desiredWorks = [];
-    for (const workflowId of workflowIds) {
-        const workflow = catalog.get(workflowId);
-        desiredWorks.push(...await discoverWorks(join(options.stagedRoot, "workflows", workflowId), workflowId, workflow?.displayName ?? workflowId));
-    }
-    const validator = await skillValidator(options.packageRoot);
-    for (const work of desiredWorks) {
-        const errors = validator(work.body, work.id);
-        if (errors.length)
-            blockers.push({ code: "agent-skill-render", path: work.id, message: errors.join("; ") });
-    }
-    if (blockers.length)
-        return { records: null, blockers };
-    const desiredTemplates = templateNames.map((name) => {
-        const link = templateLink(name);
-        return { name, link, sha256: sha256Buffer(link) };
-    });
-    const nextManifest = {
-        schema_version: 1,
-        package_version: options.packageVersion,
-        works: desiredWorks.map(({ id, workflow, work, entry, sha256 }) => ({ id, workflow, work, entry, sha256 })),
-        template_skills: desiredTemplates,
-    };
-    const desiredNames = new Set([...desiredWorks.map((work) => work.id), ...desiredTemplates.map((skill) => skill.name)]);
-    if (manifest) {
-        for (const work of manifest.works) {
-            if (!(await workNodeMatches(options.target, work))) {
-                blockers.push({ code: "agent-skill-drift", path: `.agents/skills/${work.id}`, message: "managed work skill differs from the recorded projection; preserve the edited file and reconcile it explicitly" });
+    const old = await readProjectionManifest(options.target), catalog = await readAssetCatalog(options.stagedRoot);
+    const next = { schema_version: 2, package_version: options.packageVersion, selections: { agents: [], claude: [] }, files: [] };
+    const records = [], warnings = [];
+    for (const host of ['agents', 'claude']) {
+        const request = host === 'agents' ? options.request : options.claudeRequest ?? { mode: 'keep' };
+        const ids = request.mode === 'none' ? [] : request.mode === 'keep' ? old?.selections[host] ?? [] : request.mode === 'all' ? catalog.assets.map(a => a.id) : request.mode === 'domains' ? catalog.assets.filter(a => a.kind === 'domain-skill').map(a => a.id) : request.assetIds;
+        for (const id of ids)
+            if (!catalog.assets.some(a => a.id === id))
+                throw new RefreshBlockedError([{ code: 'unknown-projection-asset', path: id, message: 'select an installed public asset business id' }]);
+        next.selections[host] = [...ids].sort();
+        const previous = (old?.files ?? []).filter(f => f.path.startsWith(`.${host}/skills/`));
+        const allIds = [...new Set([...ids, ...previous.map(f => f.asset_id)])];
+        for (const id of allIds) {
+            const owned = previous.filter(f => f.asset_id === id), asset = catalog.assets.find(a => a.id === id), desired = ids.includes(id) && asset ? renderSkillPointer(asset, await readFile(join(options.stagedRoot, asset.entry)), host) : {};
+            const pending = [], registered = [];
+            try {
+                if (asset)
+                    await assertProjectionCasing(options.target, `.${host}/skills/${asset.name}`);
+                if (asset && ids.includes(id) && !owned.some(file => file.path.startsWith(`.${host}/skills/${asset.name}/`))) {
+                    const folder = await containedPath(options.target, `.${host}/skills/${asset.name}`);
+                    try {
+                        await lstat(folder);
+                        throw new Error('unmanaged Skill directory already exists');
+                    }
+                    catch (e) {
+                        if (e.code !== 'ENOENT')
+                            throw e;
+                    }
+                }
+                for (const p of new Set([...owned.map(f => f.path), ...Object.keys(desired)])) {
+                    const before = await snapshot(options.target, p), prior = owned.find(f => f.path === p);
+                    if (prior ? before.kind !== 'file' || sha256Buffer(Buffer.from(before.content, 'base64')) !== prior.sha256 : before.kind !== 'absent')
+                        throw new Error(`file differs from ownership record: ${p}`);
+                    const after = desired[p] === undefined ? { kind: 'absent' } : fileNode(desired[p]);
+                    if (JSON.stringify(before) !== JSON.stringify(after))
+                        pending.push({ name: p, before, after });
+                    if (desired[p] !== undefined)
+                        registered.push({ path: p, asset_id: id, sha256: sha256Buffer(desired[p]) });
+                }
+                records.push(...pending);
+                next.files.push(...registered);
             }
-        }
-        for (const skill of manifest.template_skills) {
-            if (!(await templateNodeMatches(options.target, skill))) {
-                blockers.push({ code: "agent-skill-drift", path: `.agents/skills/${skill.name}`, message: "managed template link differs from the recorded projection" });
+            catch (e) {
+                warnings.push({ code: 'managed-asset-conflict', path: `${host}:${id}`, message: String(e) });
+                next.files.push(...owned);
             }
         }
     }
-    for (const name of desiredNames) {
-        if (manifest?.works.some((work) => work.id === name) || manifest?.template_skills.some((skill) => skill.name === name))
-            continue;
-        if (await pathExists(join(options.target, ".agents", "skills", name))) {
-            blockers.push({ code: "agent-skill-unmanaged", path: `.agents/skills/${name}`, message: "path exists and is not a Speculo-managed skill" });
-        }
-    }
-    if (nextManifest.works.length || nextManifest.template_skills.length || manifest) {
-        const parent = await parentBlocker(options.target);
-        if (parent)
-            blockers.push(parent);
-    }
-    if (blockers.length)
-        return { records: null, blockers };
-    const records = [];
-    const previousWorks = new Map((manifest?.works ?? []).map((work) => [work.id, work]));
-    for (const work of desiredWorks) {
-        const before = previousWorks.has(work.id) ? directoryNode(await readFile(join(options.target, ".agents", "skills", work.id, "SKILL.md"), "utf8")) : absent();
-        pushChange(records, work.id, before, directoryNode(work.body));
-    }
-    for (const work of manifest?.works ?? []) {
-        if (!desiredNames.has(work.id))
-            pushChange(records, work.id, directoryNode(await readFile(join(options.target, ".agents", "skills", work.id, "SKILL.md"), "utf8")), absent());
-    }
-    const previousTemplates = new Map((manifest?.template_skills ?? []).map((skill) => [skill.name, skill]));
-    for (const skill of desiredTemplates) {
-        const before = previousTemplates.has(skill.name) ? symlinkNode(skill.link) : absent();
-        pushChange(records, skill.name, before, symlinkNode(skill.link));
-    }
-    for (const skill of manifest?.template_skills ?? []) {
-        if (!desiredNames.has(skill.name))
-            pushChange(records, skill.name, symlinkNode(skill.link), absent());
-    }
-    const nextText = nextManifest.works.length || nextManifest.template_skills.length ? manifestText(nextManifest) : null;
-    const beforeManifest = manifest && loaded.raw !== null ? fileNode(loaded.raw) : absent();
-    const afterManifest = nextText === null ? absent() : fileNode(nextText);
-    pushChange(records, MANAGED_MANIFEST, beforeManifest, afterManifest);
-    return { records: records.length ? records : null, blockers: [] };
+    next.files.sort((a, b) => a.path.localeCompare(b.path));
+    if (old || next.files.length || next.selections.agents.length || next.selections.claude.length)
+        await writeFile(join(options.stagedRoot, '.speculo', MANAGED_MANIFEST), JSON.stringify(next, null, 2) + '\n');
+    return { records: records.length ? records : null, blockers: [], warnings, count: next.files.filter(f => f.path.endsWith('/SKILL.md')).length };
 }
-export async function inspectProjectedSkills(target, installedWorkflows) {
-    const loaded = await readManifest(target);
-    if (!loaded.manifest && !loaded.blocker && !loaded.raw)
-        return [];
-    const checks = [];
-    if (loaded.blocker || !loaded.manifest) {
-        checks.push({ id: "agent-skills", ok: false, message: loaded.blocker?.message ?? "invalid managed skill manifest" });
-        return checks;
-    }
-    const manifest = loaded.manifest;
-    const skillsDir = join(target, ".agents", "skills");
-    let names = [];
+export async function inspectProjectedSkills(target, _installed) {
     try {
-        names = await readdir(skillsDir);
-    }
-    catch (error) {
-        checks.push({ id: "agent-skills", ok: false, message: String(error) });
+        const manifest = await readProjectionManifest(target);
+        if (!manifest)
+            return [];
+        const catalog = await readAssetCatalog(join(target, INSTALL_ROOT)), checks = [];
+        for (const record of manifest.files) {
+            const node = await snapshot(target, record.path);
+            if (node.kind !== 'file' || sha256Buffer(Buffer.from(node.content, 'base64')) !== record.sha256)
+                checks.push({ id: `projection-file:${record.path}`, ok: false, message: 'owned projection drifted; preserve and reconcile explicitly' });
+        }
+        for (const host of ['agents', 'claude'])
+            for (const id of manifest.selections[host]) {
+                const asset = catalog.assets.find(a => a.id === id);
+                let ok = !!asset;
+                if (asset) {
+                    const expected = renderSkillPointer(asset, await readFile(join(target, INSTALL_ROOT, asset.entry)), host);
+                    for (const [p, text] of Object.entries(expected)) {
+                        const record = manifest.files.find(f => f.path === p);
+                        const node = await snapshot(target, p);
+                        ok = ok && !!record && record.sha256 === sha256Buffer(text) && node.kind === 'file' && node.content === Buffer.from(text).toString('base64');
+                    }
+                }
+                checks.push({ id: `projection:${host}:${id}`, ok, message: ok ? 'source and owned projection match; host invocation not probed' : 'projection missing, conflicted or drifted' });
+            }
         return checks;
     }
-    for (const name of names) {
-        if (name.startsWith(".speculo-skill-"))
-            checks.push({ id: "agent-skill-residue:" + name, ok: false, message: "preserve projection residue until recovery finishes" });
-    }
-    const installed = new Set(installedWorkflows);
-    for (const work of manifest.works) {
-        const id = "agent-skill:" + work.id;
-        if (!SKILL_ID.test(work.id) || work.entry !== `speculo/workflows/${work.workflow}/${work.work}/${work.work}.md`) {
-            checks.push({ id, ok: false, message: "work projection record is not a contained entry path" });
-            continue;
-        }
-        if (!installed.has(work.workflow)) {
-            checks.push({ id, ok: false, message: "projected workflow is not installed" });
-            continue;
-        }
-        const matches = await workNodeMatches(target, work);
-        let entryExists = false;
-        try {
-            await readFile(await containedPath(target, work.entry));
-            entryExists = true;
-        }
-        catch {
-            entryExists = false;
-        }
-        checks.push({ id, ok: matches && entryExists, message: matches && entryExists ? "work pointer matches the recorded entry" : "work pointer drifted or its entry is missing" });
-    }
-    for (const skill of manifest.template_skills) {
-        const id = "agent-skill-template:" + skill.name;
-        const expected = templateLink(skill.name);
-        const matches = SKILL_ID.test(skill.name) && skill.link === expected && await templateNodeMatches(target, skill);
-        let targetExists = false;
-        try {
-            await readFile(join(target, "speculo", "skills", skill.name, "SKILL.md"));
-            targetExists = true;
-        }
-        catch {
-            targetExists = false;
-        }
-        checks.push({ id, ok: matches && targetExists, message: matches && targetExists ? "template link matches the installed skill" : "template link drifted or its target is missing" });
+    catch (e) {
+        return [{ id: 'projections', ok: false, message: String(e) }];
     }
-    checks.push({ id: "agent-skills", ok: checks.every((check) => check.ok), message: checks.every((check) => check.ok) ? `verified ${manifest.works.length} work pointers and ${manifest.template_skills.length} template links; host invocation was not probed` : "projected skills drifted" });
-    return checks;
 }
 //# sourceMappingURL=agent-skills.js.map