@pieai/pro-gov 0.7.2 → 0.7.3

package/dist/cli.js

@@ -577,10 +577,10 @@ function createAssetInstallPlan(options) {
   const placement = options.placement ?? "registry";
   const assetsById = new Map(options.registry.assets.map((asset) => [asset.id, asset]));
   const bundlesById = new Map(options.bundles.map((bundle) => [bundle.id, bundle]));
-  const assetIds = resolveBundleAssetIds(options.bundleIds, bundlesById);
+  const assetIds = resolveAssetIds(options.bundleIds, options.assetIds ?? [], bundlesById);
   const assets = assetIds.map((assetId) => {
     const asset = assetsById.get(assetId);
-    if (!asset) throw new Error(`Unknown asset id in bundle: ${assetId}`);
+    if (!asset) throw new Error(`Unknown asset id in install plan: ${assetId}`);
     if (asset.kind === "skill" && !asset.hosts.includes(options.host)) {
       throw new Error(`Asset ${assetId} does not support host ${options.host}`);
     }
@@ -661,8 +661,8 @@ function createAssetInstallPlan(options) {
     ]
   };
 }
-function resolveBundleAssetIds(bundleIds, bundlesById) {
-  const ids = /* @__PURE__ */ new Set();
+function resolveAssetIds(bundleIds, explicitAssetIds, bundlesById) {
+  const ids = new Set(explicitAssetIds);
   for (const bundleId of bundleIds) {
     const bundle = bundlesById.get(bundleId);
     if (!bundle) throw new Error(`Unknown bundle id: ${bundleId}`);
@@ -1437,6 +1437,7 @@ function runAssetsPlan(args) {
       registry: loaded.registry,
       bundles: loadAgentAssetBundles(loaded.agentAssetsDir),
       bundleIds: options.value.bundleIds,
+      assetIds: options.value.assetIds,
       host: options.value.host,
       placement: options.value.placement
     });
@@ -1519,6 +1520,7 @@ function parsePlanOptions(args) {
     targetDir: process.cwd(),
     json: false,
     bundleIds: [],
+    assetIds: [],
     host: "codex"
   };
   for (let index = 0; index < args.length; index += 1) {
@@ -1533,6 +1535,11 @@ function parsePlanOptions(args) {
       if (!bundleId) return { ok: false, error: "Expected --bundle <bundle-id>" };
       options.bundleIds.push(bundleId);
       index += 1;
+    } else if (arg === "--asset") {
+      const assetId = args[index + 1];
+      if (!assetId) return { ok: false, error: "Expected --asset <asset-id>" };
+      options.assetIds.push(assetId);
+      index += 1;
     } else if (arg === "--host") {
       const host = args[index + 1];
       if (!isHost(host)) {
@@ -1564,8 +1571,8 @@ function parsePlanOptions(args) {
       return { ok: false, error: `Unknown assets plan option: ${arg}` };
     }
   }
-  if (options.bundleIds.length === 0) {
-    return { ok: false, error: "Expected at least one --bundle <bundle-id>" };
+  if (options.bundleIds.length === 0 && options.assetIds.length === 0) {
+    return { ok: false, error: "Expected at least one --bundle <bundle-id> or --asset <asset-id>" };
   }
   return { ok: true, value: options };
 }
@@ -1711,7 +1718,7 @@ function printUsage() {
   console.error("  pro-gov assets list [--registry] [--json] [--visibility public|private|third-party|all]");
   console.error("  pro-gov assets discover [--target <path>] [--json]");
   console.error("  pro-gov assets recommend [--target <path>] [--json]");
-  console.error("  pro-gov assets plan --bundle <bundle-id> [--bundle <bundle-id>] [--target <path>] [--host codex|claude-code|gemini-cli|antigravity] [--placement auto|manual] [--out <path>] [--json]");
+  console.error("  pro-gov assets plan [--bundle <bundle-id>] [--asset <asset-id>] [--target <path>] [--host codex|claude-code|gemini-cli|antigravity] [--placement auto|manual] [--out <path>] [--json]");
   console.error("  pro-gov assets apply --plan <path>");
   console.error("  pro-gov assets check [--target <path>] [--json]");
   console.error("  pro-gov assets public-check [--public-root <path>] [--private-root <path>] [--json]");
@@ -2817,13 +2824,30 @@ import { homedir } from "node:os";
 import { join as join18 } from "node:path";
 var DEFAULT_CACHE_THRESHOLD_BYTES = 1e9;
 var MAX_CACHE_ENTRIES = 2e4;
-function inspectProjectRedundancy(root, options = {}) {
-  const legacyDirectories = inspectLegacyDirectories(root);
+function inspectHostRedundancy(options = {}) {
   const homeDir = options.homeDir ?? homedir();
-  const cachePaths = getPlaywrightCachePaths(homeDir, options.playwrightBrowsersPath ?? process.env.PLAYWRIGHT_BROWSERS_PATH);
-  const playwrightCaches = cachePaths.map((path) => inspectPlaywrightCache(path));
+  const cachePaths = getPlaywrightCachePaths(
+    homeDir,
+    options.playwrightBrowsersPath ?? process.env.PLAYWRIGHT_BROWSERS_PATH
+  );
+  const playwrightCaches = cachePaths.map((path) => inspectPlaywrightCache(path, options.cache));
   const cacheThresholdBytes = options.cacheThresholdBytes ?? DEFAULT_CACHE_THRESHOLD_BYTES;
-  const status = legacyDirectories.length > 0 || playwrightCaches.some((cache) => cache.exists && (cache.bytes >= cacheThresholdBytes || cache.truncated)) ? "attention" : "clean";
+  const status = playwrightCaches.some(
+    (cache) => cache.exists && (cache.bytes >= cacheThresholdBytes || cache.truncated)
+  ) ? "attention" : "clean";
+  return {
+    status,
+    playwrightCaches,
+    recommendations: status === "attention" ? [
+      "\u53D1\u73B0\u5927\u578B\u6216\u672A\u5B8C\u6574\u8BA1\u6570\u7684 Playwright \u6D4F\u89C8\u5668\u7F13\u5B58\uFF1B\u786E\u8BA4\u6CA1\u6709\u6D4B\u8BD5\u4EFB\u52A1\u5360\u7528\u540E\uFF0C\u6309\u5BBF\u4E3B\u7EA7\u7F13\u5B58\u7EDF\u4E00\u6E05\u7406\u3002"
+    ] : []
+  };
+}
+function inspectProjectRedundancy(root, options = {}) {
+  const legacyDirectories = inspectLegacyDirectories(root);
+  const hostRedundancy = options.includePlaywrightCaches === false ? void 0 : inspectHostRedundancy(options);
+  const playwrightCaches = hostRedundancy?.playwrightCaches ?? [];
+  const status = legacyDirectories.length > 0 || hostRedundancy?.status === "attention" ? "attention" : "clean";
   return { status, legacyDirectories, playwrightCaches };
 }
 function inspectLegacyDirectories(root) {
@@ -2831,13 +2855,15 @@ function inspectLegacyDirectories(root) {
   const path = join18(root, relativePath);
   if (!existsSync16(path)) return [];
   const stats = collectDirectoryStats(path);
-  return [{
-    path: relativePath,
-    kind: "legacy-ai-directory",
-    fileCount: stats.fileCount,
-    bytes: stats.bytes,
-    reason: "\u9879\u76EE\u7EA7\u65E7 AI \u5BBF\u4E3B\u76EE\u5F55\uFF1B\u5E94\u4E0E .agents/skills \u7684 SSOT \u9010\u9879\u6BD4\u5BF9\u540E\u518D\u51B3\u5B9A\u662F\u5426\u8FC1\u79FB\uFF0C\u626B\u63CF\u5668\u4E0D\u81EA\u52A8\u5220\u9664\u3002"
-  }];
+  return [
+    {
+      path: relativePath,
+      kind: "legacy-ai-directory",
+      fileCount: stats.fileCount,
+      bytes: stats.bytes,
+      reason: "\u9879\u76EE\u7EA7\u65E7 AI \u5BBF\u4E3B\u76EE\u5F55\uFF1B\u5E94\u4E0E .agents/skills \u7684 SSOT \u9010\u9879\u6BD4\u5BF9\u540E\u518D\u51B3\u5B9A\u662F\u5426\u8FC1\u79FB\uFF0C\u626B\u63CF\u5668\u4E0D\u81EA\u52A8\u5220\u9664\u3002"
+    }
+  ];
 }
 function getPlaywrightCachePaths(homeDir, configuredPath) {
   const candidates = [
@@ -2848,18 +2874,40 @@ function getPlaywrightCachePaths(homeDir, configuredPath) {
   ].filter((path) => Boolean(path));
   return [...new Set(candidates)];
 }
-function inspectPlaywrightCache(path) {
+function inspectPlaywrightCache(path, cache) {
+  const cached = cache?.get(path);
+  if (cached) return cached;
   if (!existsSync16(path)) {
-    return { path, exists: false, fileCount: 0, bytes: 0, revisionCount: 0, truncated: false };
+    const missing = {
+      path,
+      exists: false,
+      fileCount: 0,
+      bytes: 0,
+      revisionCount: 0,
+      truncated: false
+    };
+    cache?.set(path, missing);
+    return missing;
   }
   const stats = collectDirectoryStats(path);
   let revisionCount = 0;
   try {
-    revisionCount = readdirSync7(path, { withFileTypes: true }).filter((entry) => entry.isDirectory()).length;
+    revisionCount = readdirSync7(path, { withFileTypes: true }).filter(
+      (entry) => entry.isDirectory()
+    ).length;
   } catch {
     revisionCount = 0;
   }
-  return { path, exists: true, fileCount: stats.fileCount, bytes: stats.bytes, revisionCount, truncated: stats.truncated };
+  const evidence = {
+    path,
+    exists: true,
+    fileCount: stats.fileCount,
+    bytes: stats.bytes,
+    revisionCount,
+    truncated: stats.truncated
+  };
+  cache?.set(path, evidence);
+  return evidence;
 }
 function collectDirectoryStats(root) {
   let fileCount = 0;
@@ -3397,7 +3445,7 @@ function validateTechnologyGovernance(value, issues) {
     issues.push({ type: "invalid-field", field: "technologyGovernance", message: "Portfolio technologyGovernance must be an object." });
     return { technologies, projectTypes };
   }
-  validateAllowedFields(value, "technologyGovernance", ["strategySource", "versionPolicy", "technologies", "projectTypes"], issues);
+  validateAllowedFields(value, "technologyGovernance", ["strategySource", "versionPolicy", "exclusiveOwnership", "technologies", "projectTypes"], issues);
   if (value.strategySource !== void 0 && (typeof value.strategySource !== "string" || value.strategySource.length === 0)) {
     issues.push({ type: "invalid-field", field: "technologyGovernance.strategySource", message: "Technology strategySource must be a non-empty string." });
   }
@@ -3460,9 +3508,65 @@ function validateTechnologyGovernance(value, issues) {
       if (!technologies.has(technology)) issues.push({ type: "invalid-field", field: "technologyGovernance.projectTypes", message: `Project type ${projectType.id} references unknown technology: ${technology}` });
     }
   }
+  validateExclusiveOwnership(value.exclusiveOwnership, projectTypes, issues);
   validateVersionPolicy(value.versionPolicy, projectTypes, issues);
   return { technologies, projectTypes };
 }
+function validateExclusiveOwnership(value, projectTypes, issues) {
+  if (value === void 0) return;
+  const field = "technologyGovernance.exclusiveOwnership";
+  if (!Array.isArray(value)) {
+    issues.push({ type: "invalid-field", field, message: "Technology exclusiveOwnership must be an array." });
+    return;
+  }
+  const seenIds = /* @__PURE__ */ new Set();
+  for (const rule of value) {
+    if (!isRecord(rule)) {
+      issues.push({ type: "invalid-field", field, message: "Exclusive ownership rule must be an object." });
+      continue;
+    }
+    validateAllowedFields(rule, "exclusiveOwnership", ["id", "label", "allowedProjectTypes", "paths"], issues);
+    const id = typeof rule.id === "string" ? rule.id : "";
+    if (!id || seenIds.has(id)) {
+      issues.push({ type: "invalid-field", field: `${field}.id`, message: `Exclusive ownership rule id must be non-empty and unique: ${String(rule.id)}` });
+    } else {
+      seenIds.add(id);
+    }
+    if (typeof rule.label !== "string" || rule.label.trim().length === 0) {
+      issues.push({ type: "invalid-field", field: `${field}.label`, message: "Exclusive ownership rule label must be a non-empty string." });
+    }
+    validateOptionalStringArray(rule.allowedProjectTypes, id, `${field}.allowedProjectTypes`, issues);
+    if (!Array.isArray(rule.allowedProjectTypes) || rule.allowedProjectTypes.length === 0) {
+      issues.push({ type: "invalid-field", field: `${field}.allowedProjectTypes`, message: "Exclusive ownership rule must allow at least one project type." });
+    } else {
+      for (const projectType of rule.allowedProjectTypes) {
+        if (typeof projectType === "string" && !projectTypes.has(projectType)) {
+          issues.push({ type: "invalid-field", field: `${field}.allowedProjectTypes`, message: `Exclusive ownership rule references unknown project type: ${projectType}` });
+        }
+      }
+    }
+    validateOptionalStringArray(rule.paths, id, `${field}.paths`, issues);
+    if (!Array.isArray(rule.paths) || rule.paths.length === 0) {
+      issues.push({ type: "invalid-field", field: `${field}.paths`, message: "Exclusive ownership rule must declare at least one repository-relative path." });
+    } else {
+      const seenPaths = /* @__PURE__ */ new Set();
+      for (const path of rule.paths) {
+        if (typeof path !== "string") continue;
+        if (!isExactRepositoryRelativePath(path)) {
+          issues.push({
+            type: "invalid-field",
+            field: `${field}.paths`,
+            message: `Exclusive ownership path must be an exact repository-relative path: ${path}`
+          });
+        } else if (seenPaths.has(path)) {
+          issues.push({ type: "invalid-field", field: `${field}.paths`, message: `Duplicate exclusive ownership path: ${path}` });
+        } else {
+          seenPaths.add(path);
+        }
+      }
+    }
+  }
+}
 function validateVersionPolicy(value, projectTypes, issues) {
   if (value === void 0) return;
   if (!isRecord(value)) {
@@ -4039,9 +4143,12 @@ function collectPackageManifests(root) {
     "build",
     "coverage",
     "dist",
+    "examples",
+    "fixtures",
     "node_modules",
     "out",
     "target",
+    "templates",
     "tmp",
     ".cache",
     ".pnpm-store",
@@ -4289,6 +4396,18 @@ import { homedir as homedir4 } from "node:os";
 import { dirname as dirname14, join as join24, relative as relative8, resolve as resolve5, sep } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 var CURRENT_ROUTER_VERSION = "1.1";
+var MCP_DISCOVERY_PATHS = {
+  project: {
+    codex: ".codex/config.toml",
+    claudeCodeShared: ".mcp.json",
+    grok: ".grok/config.toml"
+  },
+  user: {
+    codex: ".codex/config.toml",
+    claudeCode: ".claude.json",
+    grok: ".grok/config.toml"
+  }
+};
 function inspectPortfolioAiHealth(options) {
   const allEndpoints = collectEndpoints(options.manifest);
   const endpoints = options.targetId && options.targetId !== "all" ? allEndpoints.filter(({ endpoint }) => endpoint.id === options.targetId) : allEndpoints;
@@ -4305,6 +4424,7 @@ function inspectPortfolioAiHealth(options) {
   const grokVersion = commandVersion("grok");
   const executionEngineRoot = options.manifest.executionEngine?.path;
   const skillRegistry = inspectSkillRegistry(executionEngineRoot);
+  const userSkills = inspectUserSkillEvidence(join24(homeDir, ".agents/skills"));
   const expectedPackageVersion = packageVersion(
     join24(executionEngineRoot ?? "", "packages/pro-gov/package.json")
   );
@@ -4316,13 +4436,15 @@ function inspectPortfolioAiHealth(options) {
       homeDir,
       expectedPackageVersion,
       options.manifest.technologyGovernance,
-      grokVersion
+      grokVersion,
+      skillRegistry.skills,
+      userSkills
     )
   );
   const summary = { healthy: 0, attention: 0, unhealthy: 0 };
   for (const repository of repositories) summary[repository.status] += 1;
   return {
-    schemaVersion: 5,
+    schemaVersion: 6,
     portfolioId: options.manifest.portfolioId,
     generatedAt: options.generatedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
     coverage: {
@@ -4339,7 +4461,7 @@ function inspectPortfolioAiHealth(options) {
       allEndpoints.map(({ endpoint }) => endpoint.path),
       options.manifest.specialistChecks?.devspace
     ),
-    skillRegistry,
+    skillRegistry: skillRegistry.health,
     technologyGovernance: {
       strategySource: options.manifest.technologyGovernance?.strategySource,
       versionPolicy: options.manifest.technologyGovernance?.versionPolicy,
@@ -4424,20 +4546,23 @@ function collectEndpoints(manifest) {
     return true;
   });
 }
-function inspectRepository(endpoint, role, secretsRoot, homeDir, expectedPackageVersion, technologyGovernance, grokVersion) {
+function inspectRepository(endpoint, role, secretsRoot, homeDir, expectedPackageVersion, technologyGovernance, grokVersion, registeredSkills, userSkills) {
   const root = endpoint.path;
   const git = inspectGit2(root);
   const entries = inspectEntries(root);
   const grokInspection = inspectGrokProject(root, homeDir, grokVersion);
-  const skills = inspectSkills(root, grokInspection);
+  const skills = inspectSkills(root, grokInspection, registeredSkills, userSkills);
   const hostSsot = inspectProjectHostSsot(root);
   const hooks = inspectHooks(root);
   const docs = inspectDocs(root, role === "execution-engine" ? void 0 : expectedPackageVersion);
   const mcp = {
-    codexProject: tomlMcpNames(join24(root, ".codex/config.toml")),
-    claudeCodeProjectShared: jsonObjectKeys(join24(root, ".mcp.json"), "mcpServers"),
+    codexProject: tomlMcpNames(join24(root, MCP_DISCOVERY_PATHS.project.codex)),
+    claudeCodeProjectShared: jsonObjectKeys(
+      join24(root, MCP_DISCOVERY_PATHS.project.claudeCodeShared),
+      "mcpServers"
+    ),
     claudeCodeProjectLocal: claudeProjectLocalMcpNames(homeDir, root),
-    grokProject: tomlMcpNames(join24(root, ".grok/config.toml")),
+    grokProject: tomlMcpNames(join24(root, MCP_DISCOVERY_PATHS.project.grok)),
     grokEffective: grokInspection.effectiveMcp,
     grokInspection: grokInspection.inspection
   };
@@ -4449,13 +4574,21 @@ function inspectRepository(endpoint, role, secretsRoot, homeDir, expectedPackage
     endpoint.environmentPolicy
   );
   const projectModel = inspectProjectModel(root, endpoint, technologyGovernance);
+  const exclusiveOwnershipViolations = inspectExclusiveOwnership(
+    root,
+    endpoint,
+    technologyGovernance
+  );
   const versions = inspectVersionPolicy(
     root,
     technologyGovernance?.versionPolicy,
     endpoint.projectType
   );
   const verification = inspectProjectVerification(root);
-  const redundancy = inspectProjectRedundancy(root, { homeDir });
+  const redundancy = inspectProjectRedundancy(root, {
+    homeDir,
+    includePlaywrightCaches: false
+  });
   const recommendations = [];
   if (!git.isRepository) recommendations.push("\u8BE5\u8DEF\u5F84\u4E0D\u662F Git \u4ED3\u5E93\uFF1B\u786E\u8BA4\u6E05\u5355\u8DEF\u5F84\u662F\u5426\u6B63\u786E\u3002");
   if (git.unmergedBranches.length > 0)
@@ -4495,8 +4628,32 @@ function inspectRepository(endpoint, role, secretsRoot, homeDir, expectedPackage
     recommendations.push("GEMINI.md \u662F\u72EC\u7ACB\u5165\u53E3\uFF1B\u82E5\u6CA1\u6709 Gemini \u4E13\u5C5E\u5DEE\u5F02\uFF0C\u5EFA\u8BAE\u94FE\u63A5\u5230 AGENTS.md\u3002");
   if (entries.gemini === "dangling-symlink")
     recommendations.push("GEMINI.md \u662F\u65AD\u5F00\u7684\u94FE\u63A5\uFF1B\u9700\u8981\u91CD\u65B0\u6307\u5411 AGENTS.md\u3002");
-  if (skills.canonical.some((skill) => skill.kind === "dangling-symlink"))
-    recommendations.push("`.agents/skills` \u4E2D\u5B58\u5728\u65AD\u5F00\u7684\u6280\u80FD\u94FE\u63A5\u3002");
+  if ([...skills.automatic, ...skills.manual].some((skill) => skill.kind === "dangling-symlink"))
+    recommendations.push("`.agents/skills` \u6216 `.agents/manual-skills` \u4E2D\u5B58\u5728\u65AD\u5F00\u7684\u6280\u80FD\u94FE\u63A5\u3002");
+  if (skills.invalidEntries.length > 0)
+    recommendations.push(
+      `\u6280\u80FD\u76EE\u5F55\u4E2D\u6709 ${skills.invalidEntries.length} \u4E2A\u5783\u573E\u6216\u975E\u6280\u80FD\u6587\u4EF6\uFF1A${skills.invalidEntries.map((entry) => entry.path).join("\u3001")}\u3002`
+    );
+  if (skills.userDuplicates.length > 0)
+    recommendations.push(
+      `\u9879\u76EE\u6280\u80FD\u4E0E\u7528\u6237\u7EA7\u6280\u80FD\u91CD\u590D\uFF1A${skills.userDuplicates.join("\u3001")}\uFF1B\u4F18\u5148\u4FDD\u7559\u7528\u6237\u7EA7\u5355\u4E00\u5165\u53E3\u3002`
+    );
+  if (skills.crossPlacementDuplicates.length > 0)
+    recommendations.push(
+      `\u540C\u540D\u6280\u80FD\u540C\u65F6\u51FA\u73B0\u5728 auto \u4E0E manual\uFF1A${skills.crossPlacementDuplicates.join("\u3001")}\uFF1B\u53EA\u80FD\u4FDD\u7559\u4E00\u4E2A\u671F\u671B\u4F4D\u7F6E\u3002`
+    );
+  if (skills.placementDrift.length > 0)
+    recommendations.push(
+      `\u6709 ${skills.placementDrift.length} \u4E2A\u6280\u80FD\u672A\u653E\u5728\u6CE8\u518C\u8868\u89C4\u5B9A\u7684\u4F4D\u7F6E\uFF1A${skills.placementDrift.map((item) => `${item.name} \u5E94\u4E3A ${item.reason === "scope" ? "\u7528\u6237\u7EA7" : `\u9879\u76EE ${item.expectedPlacement}`}`).join("\u3001")}\u3002`
+    );
+  if (skills.automatic.length > skills.automaticReviewThreshold)
+    recommendations.push(
+      `\u81EA\u52A8\u53D1\u73B0\u6280\u80FD\u6709 ${skills.automatic.length} \u4E2A\uFF0C\u8D85\u8FC7 ${skills.automaticReviewThreshold} \u4E2A\u590D\u6838\u7EBF\uFF1B\u9010\u9879\u786E\u8BA4\u662F\u5426\u9AD8\u9891\u4E14\u5141\u8BB8\u4E3B\u52A8\u89E6\u53D1\u3002`
+    );
+  if (skills.unregistered.length > 0)
+    recommendations.push(
+      `\u6709 ${skills.unregistered.length} \u4E2A\u6280\u80FD\u65E0\u6CD5\u6620\u5C04\u5230 PGS \u6CE8\u518C\u6E90\uFF1B\u786E\u8BA4\u5B83\u4EEC\u662F\u5408\u7406\u7684\u9879\u76EE\u672C\u5730\u6280\u80FD\u8FD8\u662F\u5F85\u767B\u8BB0\u8D44\u4EA7\u3002`
+    );
   if (skills.claudeCompatibility === "duplicate-directory")
     recommendations.push(
       "`.claude/skills` \u662F\u72EC\u7ACB\u526F\u672C\uFF1B\u5EFA\u8BAE\u94FE\u63A5\u5230 `.agents/skills`\uFF0C\u907F\u514D\u53CC\u4EFD\u6280\u80FD\u6F02\u79FB\u3002"
@@ -4545,6 +4702,11 @@ function inspectRepository(endpoint, role, secretsRoot, homeDir, expectedPackage
     recommendations.push("\u7F3A\u5C11 docs/governance/MANIFEST.yml\uFF1B\u6587\u6863\u6E05\u5355\u65E0\u6CD5\u8BC1\u660E\u5DF2\u540C\u6B65\u3002");
   if (technologyGovernance && !projectModel.projectType)
     recommendations.push("\u672A\u58F0\u660E\u9879\u76EE\u7C7B\u578B\uFF1B\u65E0\u6CD5\u628A\u5B9E\u9645\u6280\u672F\u4E0E\u4EA7\u54C1\u7EBF\u57FA\u7EBF\u8FDB\u884C\u6BD4\u8F83\u3002");
+  for (const violation of exclusiveOwnershipViolations) {
+    recommendations.push(
+      `\u4ED3\u5E93\u8D8A\u754C\u62E5\u6709\u201C${violation.rule.label}\u201D\uFF1A${violation.paths.join("\u3001")}\uFF1B\u4EC5\u5141\u8BB8\u9879\u76EE\u7C7B\u578B ${violation.rule.allowedProjectTypes.join("\u3001")} \u6301\u6709\u3002`
+    );
+  }
   const missingBaseline = projectModel.baseline.filter(
     (technology) => !technology.detected && !hasBaselineException(projectModel, technology.id)
   );
@@ -4569,7 +4731,7 @@ function inspectRepository(endpoint, role, secretsRoot, homeDir, expectedPackage
     );
   if (redundancy.status === "attention")
     recommendations.push(
-      "\u53D1\u73B0\u65E7 AI \u76EE\u5F55\u6216\u5927\u578B Playwright \u7F13\u5B58\uFF1B\u4EC5\u63D0\u4F9B\u8BC1\u636E\uFF0C\u786E\u8BA4\u5F52\u5C5E\u540E\u518D\u7531\u4EBA\u5DE5\u6E05\u7406\u3002"
+      "\u53D1\u73B0\u9879\u76EE\u7EA7\u65E7 AI \u76EE\u5F55\uFF1B\u4EC5\u63D0\u4F9B\u8BC1\u636E\uFF0C\u4E0E .agents/skills \u7684 SSOT \u6BD4\u5BF9\u540E\u518D\u7531\u4EBA\u5DE5\u8FC1\u79FB\u6216\u6E05\u7406\u3002"
     );
   return {
     id: endpoint.id,
@@ -4586,6 +4748,7 @@ function inspectRepository(endpoint, role, secretsRoot, homeDir, expectedPackage
       secrets,
       docs,
       projectModel,
+      exclusiveOwnershipViolations,
       Boolean(technologyGovernance),
       versions,
       verification,
@@ -4733,8 +4896,8 @@ function hasUsableTechnologyFile(path) {
     return false;
   }
 }
-function deriveStatus(role, entries, git, hooks, skills, hostSsot, secrets, docs, projectModel, technologyGovernanceConfigured, versions, verification, redundancy) {
-  if (!git.isRepository || entries.agents === "missing" || entries.claude === "dangling-symlink" || entries.gemini === "dangling-symlink" || skills.canonical.some((item) => item.kind === "dangling-symlink") || secrets.repositoryEnvFiles.some((file) => file.tracked && !file.template && !file.fixture) || hasUnsafeCentralSecretPermissions(secrets))
+function deriveStatus(role, entries, git, hooks, skills, hostSsot, secrets, docs, projectModel, exclusiveOwnershipViolations, technologyGovernanceConfigured, versions, verification, redundancy) {
+  if (!git.isRepository || entries.agents === "missing" || entries.claude === "dangling-symlink" || entries.gemini === "dangling-symlink" || [...skills.automatic, ...skills.manual].some((item) => item.kind === "dangling-symlink") || exclusiveOwnershipViolations.length > 0 || secrets.repositoryEnvFiles.some((file) => file.tracked && !file.template && !file.fixture) || hasUnsafeCentralSecretPermissions(secrets))
     return "unhealthy";
   const missingBaseline = projectModel.baseline.some(
     (technology) => !technology.detected && !hasBaselineException(projectModel, technology.id)
@@ -4749,10 +4912,18 @@ function deriveStatus(role, entries, git, hooks, skills, hostSsot, secrets, docs
   const packageVersionNeedsReview = docs.packages.expected !== void 0 && !docs.packages.aligned;
   const routerVersionNeedsReview = !docs.routerAligned;
   const targetManifestMissing = role === "target" && !docs.manifest;
-  if (entries.agents !== "pgs-router" || entries.claude !== "agents-symlink" || hasWorkflowReminderHooks(hooks) || skills.claudeCompatibility === "duplicate-directory" || skills.claudeCompatibility === "dangling-symlink" || !hostSsot.compliant || git.branches.length > 1 || git.worktrees.length > 1 || git.dirtyPaths.length > 0 || (git.ahead ?? 0) > 0 || secretMaterializationNeedsReview || technologyGovernanceConfigured && !projectModel.projectType || missingBaseline || missingSelected || packageVersionNeedsReview || routerVersionNeedsReview || targetManifestMissing || versions.status === "attention" || verification.status === "attention" || redundancy.legacyDirectories.length > 0)
+  if (entries.agents !== "pgs-router" || entries.claude !== "agents-symlink" || hasWorkflowReminderHooks(hooks) || skills.claudeCompatibility === "duplicate-directory" || skills.claudeCompatibility === "dangling-symlink" || skills.invalidEntries.length > 0 || skills.userDuplicates.length > 0 || skills.crossPlacementDuplicates.length > 0 || skills.placementDrift.length > 0 || skills.automatic.length > skills.automaticReviewThreshold || !hostSsot.compliant || git.branches.length > 1 || git.worktrees.length > 1 || git.dirtyPaths.length > 0 || (git.ahead ?? 0) > 0 || secretMaterializationNeedsReview || technologyGovernanceConfigured && !projectModel.projectType || missingBaseline || missingSelected || packageVersionNeedsReview || routerVersionNeedsReview || targetManifestMissing || versions.status === "attention" || verification.status === "attention" || redundancy.legacyDirectories.length > 0)
     return "attention";
   return "healthy";
 }
+function inspectExclusiveOwnership(root, endpoint, governance) {
+  const projectType = endpoint.projectType;
+  return (governance?.exclusiveOwnership ?? []).flatMap((rule) => {
+    if (projectType && rule.allowedProjectTypes.includes(projectType)) return [];
+    const paths = rule.paths.filter((path) => existsSync23(join24(root, path)));
+    return paths.length > 0 ? [{ rule, paths }] : [];
+  });
+}
 function inspectProjectModel(root, endpoint, governance) {
   const projectType = governance?.projectTypes.find(
     (candidate) => candidate.id === endpoint.projectType
@@ -4880,51 +5051,142 @@ function inspectOptionalEntry(root, filename, agentsPath) {
   const content = safeRead(path);
   return /AGENTS\.md/.test(content) && content.length < 2e3 ? "thin-adapter" : "custom";
 }
-function inspectSkills(root, grokInspection) {
+function inspectSkills(root, grokInspection, registeredSkills, userSkills) {
   const lock = readJson4(join24(root, ".pro-gov/assets.lock.json"));
+  const assetManifest = readJson4(join24(root, ".pro-gov/assets.json"));
   const managed = /* @__PURE__ */ new Set();
   const bundleIds = stringArray(isRecord3(lock) ? lock.bundleIds : void 0);
   if (isRecord3(lock) && Array.isArray(lock.assets)) {
     for (const asset of lock.assets) {
       if (!isRecord3(asset) || typeof asset.targetPath !== "string") continue;
-      const match = asset.targetPath.match(/^\.agents\/skills\/([^/]+)$/);
-      if (match) managed.add(match[1]);
+      const match = asset.targetPath.match(/^\.agents\/(skills|manual-skills)\/([^/]+)$/);
+      if (match) managed.add(`${match[1]}:${match[2]}`);
     }
   }
-  const skillRoot = join24(root, ".agents/skills");
-  const canonical = pathLexists(skillRoot) && safeIsDirectory(skillRoot) ? safeReadDir(skillRoot).filter((name) => !name.startsWith(".")).map((name) => {
-    const path = join24(skillRoot, name);
-    const stat = lstatSync8(path);
-    let kind = stat.isSymbolicLink() ? "symlink" : stat.isDirectory() ? "directory" : "file";
-    if (stat.isSymbolicLink()) {
-      try {
-        realpathSync4(path);
-      } catch {
-        kind = "dangling-symlink";
-      }
-    }
-    return { name, kind, managed: managed.has(name) };
-  }) : [];
-  const locked = isRecord3(lock) && Array.isArray(lock.assets) ? lock.assets.length : 0;
+  const inspectPlacement = (placement) => {
+    const directory = placement === "auto" ? "skills" : "manual-skills";
+    const skillRoot = join24(root, ".agents", directory);
+    if (!pathLexists(skillRoot) || !safeIsDirectory(skillRoot)) return [];
+    return safeReadDir(skillRoot).filter((name) => !name.startsWith(".")).map((name) => inspectSkillItem(skillRoot, directory, name, managed, registeredSkills));
+  };
+  const automatic = inspectPlacement("auto");
+  const manual = inspectPlacement("manual");
+  const invalidEntries = [
+    ...inspectInvalidSkillEntries(root, "skills"),
+    ...inspectInvalidSkillEntries(root, "manual-skills")
+  ];
+  const userDuplicates = [...automatic, ...manual].filter((item) => skillDuplicatesUser(item, root, userSkills)).map((item) => item.name).filter((name, index, names) => names.indexOf(name) === index).sort();
+  const automaticNames = new Set(automatic.map((item) => item.name));
+  const crossPlacementDuplicates = manual.map((item) => item.name).filter((name) => automaticNames.has(name)).sort();
+  const placementDrift = [
+    ...automatic.flatMap((item) => skillPlacementDrift(item, "auto")),
+    ...manual.flatMap((item) => skillPlacementDrift(item, "manual"))
+  ];
+  const unregistered = [
+    ...automatic.flatMap(
+      (item) => item.registryId || item.classification ? [] : [{ name: item.name, placement: "auto" }]
+    ),
+    ...manual.flatMap(
+      (item) => item.registryId || item.classification ? [] : [{ name: item.name, placement: "manual" }]
+    )
+  ];
+  const lockedSkills = isRecord3(lock) && Array.isArray(lock.assets) ? lock.assets.filter(
+    (asset) => isRecord3(asset) && typeof asset.targetPath === "string" && /^\.agents\/(skills|manual-skills)\/[^/]+$/.test(asset.targetPath)
+  ) : [];
+  const desiredAssetIds = new Set(
+    isRecord3(assetManifest) ? stringArray(assetManifest.assetIds) : []
+  );
+  const desired = registeredSkills.filter(
+    (skill) => desiredAssetIds.has(skill.id) && skill.defaultScope === "project"
+  ).length;
+  const allInstalled = [...automatic, ...manual];
   return {
-    canonical,
+    automatic,
+    manual,
+    invalidEntries,
+    userDuplicates,
+    crossPlacementDuplicates,
+    placementDrift,
+    unregistered,
+    automaticReviewThreshold: 10,
     claudeCompatibility: inspectClaudeSkillRoot(root),
     bundleIds,
     lifecycle: {
-      desired: bundleIds.length,
-      locked,
-      installed: canonical.filter((item) => item.managed && item.kind !== "dangling-symlink").length,
-      discoverable: canonical.filter((item) => item.kind !== "dangling-symlink").length,
+      desired,
+      locked: lockedSkills.length,
+      installed: allInstalled.filter((item) => item.managed && item.kind !== "dangling-symlink").length,
+      discoverable: automatic.filter((item) => item.kind !== "dangling-symlink").length,
       runtime: "unobservable"
     },
     hosts: {
-      codexProject: canonical.filter((item) => item.kind !== "dangling-symlink").length,
+      codexProject: automatic.filter((item) => item.kind !== "dangling-symlink").length,
       claudeCodeProject: inspectSkillRoot(join24(root, ".claude/skills")).names.length,
       grokNativeProject: inspectSkillRoot(join24(root, ".grok/skills")).names.length,
       grokEffective: grokInspection.skills
     }
   };
 }
+function inspectSkillItem(skillRoot, directory, name, managed, registeredSkills) {
+  const path = join24(skillRoot, name);
+  const stat = lstatSync8(path);
+  let kind = stat.isSymbolicLink() ? "symlink" : stat.isDirectory() ? "directory" : "file";
+  let realPath;
+  try {
+    realPath = realpathSync4(path);
+  } catch {
+    if (stat.isSymbolicLink()) kind = "dangling-symlink";
+  }
+  const registered = realPath ? registeredSkills.find((skill) => skill.sourceRealPath === realPath) : void 0;
+  const classification = registered ? void 0 : realPath && isPluginPack(realPath) ? "plugin-pack" : kind === "directory" && existsSync23(join24(path, "SKILL.md")) ? "project-local" : void 0;
+  return {
+    name,
+    kind,
+    managed: managed.has(`${directory}:${name}`),
+    classification,
+    registryId: registered?.id,
+    expectedPlacement: registered?.defaultPlacement,
+    expectedScope: registered?.defaultScope
+  };
+}
+function isPluginPack(path) {
+  const skillsRoot = join24(path, "skills");
+  return existsSync23(join24(path, ".codex-plugin/plugin.json")) && safeIsDirectory(skillsRoot) && safeReadDir(skillsRoot).some((name) => existsSync23(join24(skillsRoot, name, "SKILL.md")));
+}
+function inspectInvalidSkillEntries(root, directory) {
+  const skillRoot = join24(root, ".agents", directory);
+  if (!pathLexists(skillRoot) || !safeIsDirectory(skillRoot)) return [];
+  return safeReadDir(skillRoot).flatMap((name) => {
+    if (name === ".gitkeep") return [];
+    if (name === ".DS_Store")
+      return [{ path: `.agents/${directory}/${name}`, reason: "metadata-junk" }];
+    if (name.startsWith("."))
+      return [{ path: `.agents/${directory}/${name}`, reason: "unexpected-file" }];
+    const path = join24(skillRoot, name);
+    return !lstatSync8(path).isDirectory() && !lstatSync8(path).isSymbolicLink() ? [{ path: `.agents/${directory}/${name}`, reason: "unexpected-file" }] : [];
+  });
+}
+function skillDuplicatesUser(item, root, userSkills) {
+  if (userSkills.names.has(item.name)) return true;
+  const automatic = join24(root, ".agents/skills", item.name);
+  const manual = join24(root, ".agents/manual-skills", item.name);
+  const realPath = safeRealpath(pathLexists(automatic) ? automatic : manual);
+  return realPath ? userSkills.realPaths.has(realPath) : false;
+}
+function skillPlacementDrift(item, actualPlacement) {
+  if (!item.registryId || !item.expectedPlacement) return [];
+  if (item.expectedScope === "user" || item.expectedPlacement !== actualPlacement)
+    return [
+      {
+        name: item.name,
+        registryId: item.registryId,
+        actualPlacement,
+        expectedPlacement: item.expectedPlacement,
+        expectedScope: item.expectedScope ?? "project",
+        reason: item.expectedScope === "user" ? "scope" : "placement"
+      }
+    ];
+  return [];
+}
 function inspectClaudeSkillRoot(root) {
   const path = join24(root, ".claude/skills");
   if (!pathLexists(path)) return "missing";
@@ -5048,9 +5310,9 @@ function inspectSecretsRoot(path) {
   return existsSync23(path) ? { path, exists: true, mode: modeString(statSync5(path).mode) } : { path, exists: false };
 }
 function inspectHostEnvironment(homeDir, grokVersion, repositoryPaths, devspaceSettings) {
-  const codexConfig = join24(homeDir, ".codex/config.toml");
-  const claudeConfig = join24(homeDir, ".claude.json");
-  const grokConfig = join24(homeDir, ".grok/config.toml");
+  const codexConfig = join24(homeDir, MCP_DISCOVERY_PATHS.user.codex);
+  const claudeConfig = join24(homeDir, MCP_DISCOVERY_PATHS.user.claudeCode);
+  const grokConfig = join24(homeDir, MCP_DISCOVERY_PATHS.user.grok);
   const hostEnvironment = {
     mcp: {
       codexUser: { path: codexConfig, names: tomlMcpNames(codexConfig) },
@@ -5069,7 +5331,8 @@ function inspectHostEnvironment(homeDir, grokVersion, repositoryPaths, devspaceS
       available: grokVersion !== void 0,
       ...grokVersion ? { version: grokVersion } : {},
       inspectionCommand: "grok inspect --json"
-    }
+    },
+    redundancy: inspectHostRedundancy({ homeDir })
   };
   if (devspaceSettings) {
     hostEnvironment.devspace = inspectDevSpaceHealth({
@@ -5197,7 +5460,7 @@ function inspectSkillRoot(path) {
 }
 function claudeProjectLocalMcpNames(homeDir, root) {
   if (!homeDir) return [];
-  const value = readJson4(join24(homeDir, ".claude.json"));
+  const value = readJson4(join24(homeDir, MCP_DISCOVERY_PATHS.user.claudeCode));
   if (!isRecord3(value) || !isRecord3(value.projects)) return [];
   const candidates = new Set(
     [resolve5(root), safeRealpath(root)].filter((path) => Boolean(path))
@@ -5246,7 +5509,9 @@ function inspectGrokProject(root, homeDir, grokVersion) {
       })
     );
     if (!isRecord3(value)) return empty("failed");
-    const userClaudeNames = new Set(jsonObjectKeys(join24(homeDir, ".claude.json"), "mcpServers"));
+    const userClaudeNames = new Set(
+      jsonObjectKeys(join24(homeDir, MCP_DISCOVERY_PATHS.user.claudeCode), "mcpServers")
+    );
     const localClaudeNames = new Set(claudeProjectLocalMcpNames(homeDir, root));
     const effectiveMcp = Array.isArray(value.mcpServers) ? value.mcpServers.flatMap((item) => {
       if (!isRecord3(item) || typeof item.name !== "string") return [];
@@ -5315,9 +5580,10 @@ function inferGrokMcpScope(name, sourceType, sourcePath, root, homeDir, userClau
   }
   const resolvedSource = safeRealpath(sourcePath) ?? resolve5(sourcePath);
   const resolvedRoot = safeRealpath(root) ?? resolve5(root);
-  if (resolvedSource === join24(resolvedRoot, ".mcp.json")) return "project-shared";
+  if (resolvedSource === join24(resolvedRoot, MCP_DISCOVERY_PATHS.project.claudeCodeShared))
+    return "project-shared";
   if (resolvedSource.startsWith(resolvedRoot + sep)) return "project";
-  if (homeDir && resolvedSource === join24(resolve5(homeDir), ".claude.json")) {
+  if (homeDir && resolvedSource === join24(resolve5(homeDir), MCP_DISCOVERY_PATHS.user.claudeCode)) {
     if (localClaudeNames.has(name)) return "project-local";
     if (userClaudeNames.has(name)) return "user";
   }
@@ -5406,7 +5672,11 @@ function recordOrEmpty(value) {
   return isRecord3(value) ? value : {};
 }
 function inspectSkillRegistry(executionEngineRoot) {
-  if (!executionEngineRoot) return { source: 0, registered: 0, bundled: 0, bundles: 0 };
+  if (!executionEngineRoot)
+    return {
+      health: { source: 0, registered: 0, bundled: 0, bundles: 0 },
+      skills: []
+    };
   const agentAssetsRoot = join24(executionEngineRoot, "agent-assets");
   const registry = readJson4(join24(agentAssetsRoot, "registry.json"));
   const assets = isRecord3(registry) && Array.isArray(registry.assets) ? registry.assets : [];
@@ -5428,14 +5698,40 @@ function inspectSkillRegistry(executionEngineRoot) {
     0
   );
   return {
-    source,
-    registered: registeredSkills.length,
-    bundled: registeredSkills.filter(
-      (asset) => isRecord3(asset) && typeof asset.id === "string" && bundledIds.has(asset.id)
-    ).length,
-    bundles: bundleFiles.length
+    health: {
+      source,
+      registered: registeredSkills.length,
+      bundled: registeredSkills.filter(
+        (asset) => isRecord3(asset) && typeof asset.id === "string" && bundledIds.has(asset.id)
+      ).length,
+      bundles: bundleFiles.length
+    },
+    skills: registeredSkills.flatMap((asset) => {
+      if (!isRecord3(asset) || typeof asset.id !== "string" || typeof asset.sourcePath !== "string" || asset.defaultPlacement !== "auto" && asset.defaultPlacement !== "manual")
+        return [];
+      return [
+        {
+          id: asset.id,
+          sourceRealPath: safeRealpath(join24(agentAssetsRoot, asset.sourcePath)),
+          defaultPlacement: asset.defaultPlacement,
+          defaultScope: asset.defaultScope === "user" ? "user" : "project"
+        }
+      ];
+    })
   };
 }
+function inspectUserSkillEvidence(root) {
+  const names = /* @__PURE__ */ new Set();
+  const realPaths = /* @__PURE__ */ new Set();
+  if (!pathLexists(root) || !safeIsDirectory(root)) return { names, realPaths };
+  for (const name of safeReadDir(root)) {
+    if (name.startsWith(".")) continue;
+    names.add(name);
+    const realPath = safeRealpath(join24(root, name));
+    if (realPath) realPaths.add(realPath);
+  }
+  return { names, realPaths };
+}
 function jsonObjectKeys(path, key) {
   const value = readJson4(path);
   if (!isRecord3(value) || !isRecord3(value[key])) return [];
@@ -5561,7 +5857,12 @@ function runPortfolioAiHealth(args) {
     return 1;
   }
   const targetId = options.value.targetId && options.value.targetId !== "all" ? options.value.targetId : void 0;
-  if (targetId && !loaded.manifest.targets.some((target) => target.id === targetId)) {
+  const allRepositoryIds = [
+    loaded.manifest.controlPlane?.id,
+    loaded.manifest.executionEngine?.id,
+    ...loaded.manifest.targets.map((target) => target.id)
+  ].filter((id) => Boolean(id));
+  if (targetId && !allRepositoryIds.includes(targetId)) {
     console.error(`Unknown portfolio target: ${targetId}`);
     return 1;
   }
@@ -5570,11 +5871,6 @@ function runPortfolioAiHealth(args) {
     secretsRoot: options.value.secretsRoot,
     targetId
   });
-  const allRepositoryIds = [
-    loaded.manifest.controlPlane?.id,
-    loaded.manifest.executionEngine?.id,
-    ...loaded.manifest.targets.map((target) => target.id)
-  ].filter((id) => Boolean(id));
   const existing = targetId ? readExistingAiHealthReport(options.value.outDir, loaded.manifest.portfolioId) : void 0;
   const report = targetId ? mergePortfolioAiHealthReport(existing, latest, allRepositoryIds) : latest;
   const written = writePortfolioAiHealthReport(report, options.value.outDir);
@@ -6040,7 +6336,7 @@ var COMMANDS = [
   "assets list [--json] [--visibility public|private|third-party|all]",
   "assets discover [--target <path>] [--json]",
   "assets recommend [--target <path>] [--json]",
-  "assets plan --bundle <bundle-id> [--target <path>] [--json]",
+  "assets plan [--bundle <bundle-id>] [--asset <asset-id>] [--target <path>] [--json]",
   "assets apply --plan <path>",
   "assets check [--target <path>] [--strict-registry] [--json]",
   "assets public-check [--public-root <path>] [--private-root <path>] [--json]",