@senpi/runtime 3.0.6-dev.runtime-phase-2.20260630134536 → 3.0.6-dev.runtime-phase-2.20260630182800

package/dist/skills-manager/version-manager.js

@@ -40,112 +40,29 @@ export function parseSkillMdVersion(content) {
     return versionMatch ? versionMatch[1].trim() : null;
 }
 /**
- * Extract the `description` value from a SKILL.md YAML frontmatter block.
- *
- * Skill descriptions can be authored a few different ways. This helper
- * handles the real-world shapes that appear in the senpi-skills repo today:
- *
- *   1. Single-line, double-quoted:
- *        description: "Configure, deploy, ..."
- *   2. Single-line, single-quoted or unquoted:
- *        description: Manage runtimes ...
- *   3. YAML block scalar (folded or literal, optional chomping indicator):
- *        description: >
- *          A short summary
- *          continues on this line.
- *        description: >-       # strip trailing newlines (this PR's senpi-skills repo)
- *          A short summary
- *        description: |        # literal — preserves newlines (collapsed to spaces here)
- *          A short summary
- *        description: |+       # keep trailing newlines (same handling)
- *
- *      The block scalar header is `[>|][-+]?` per the YAML 1.2 spec:
- *      `>` = folded, `|` = literal; `-` strips trailing newlines,
- *      `+` keeps them, no indicator clips. For notification rendering we
- *      always collapse to a single line joined by spaces, so the chomping
- *      indicator only affects whether we match the block-scalar branch.
- *
- * Returns null when the field is absent or the frontmatter block is missing.
- *
- * Note: kept as a regex extractor rather than introducing a full YAML
- * parse here — `parseSkillMdVersion` uses the same approach, and skill
- * frontmatters are constrained enough that the regex covers the shapes we
- * actually encounter. If we ever adopt a full YAML parser for this file,
- * both helpers should switch together.
- */
-export function parseSkillMdDescription(content) {
-    const match = /^---\r?\n([\s\S]*?)\r?\n---/.exec(content.trim());
-    if (!match)
-        return null;
-    const frontmatter = match[1];
-    // Shape 3: block scalar — `description:` followed by a `>` or `|` header
-    // (optionally with a `-` / `+` chomping indicator) on its own line, then
-    // indented continuation lines. Stop at the first un-indented line or the
-    // end of frontmatter. We collapse the indent and join lines into a single
-    // string so the notification renderer doesn't emit raw YAML continuations.
-    //
-    // Pre-fix this regex was `[>|]` (no indicator). A SKILL.md authored with
-    // `description: >-` (the YAML strip-trailing-newlines variant — what the
-    // senpi-skills repo actually uses) didn't match, fell through to the
-    // inline branch, and ended up capturing the literal "`>-`" as the value.
-    // That's the bug report this fixes: the Telegram notification showed
-    // `>-` instead of the real description.
-    const foldedMatch = /(?:^|\n)description:[ \t]*[>|][-+]?[ \t]*\r?\n([\s\S]*?)(?=\n[^\s]|\n?$)/i.exec(frontmatter);
-    if (foldedMatch) {
-        const lines = foldedMatch[1]
-            .split(/\r?\n/)
-            .map((l) => l.replace(/^[ \t]+/, "").trim())
-            .filter((l) => l.length > 0);
-        if (lines.length > 0)
-            return lines.join(" ");
-    }
-    // Shapes 1 + 2: single-line value. Allow optional surrounding quotes.
-    // The value runs to the end of the line; trailing whitespace + matching
-    // closing quote stripped.
-    const inlineMatch = /(?:^|\n)description:[ \t]*(?:"((?:[^"\\]|\\.)*)"|'((?:[^'\\]|\\.)*)'|([^\r\n]+?))[ \t]*(?:\r?\n|$)/i
-        .exec(frontmatter);
-    if (inlineMatch) {
-        // Unescape `\"` and `\\` for double-quoted form; single-quoted is taken
-        // literally per YAML (no escapes). Unquoted form passes through.
-        const raw = inlineMatch[1] ?? inlineMatch[2] ?? inlineMatch[3] ?? "";
-        const value = inlineMatch[1]
-            ? raw.replace(/\\(["\\])/g, "$1")
-            : raw;
-        const trimmed = value.trim();
-        return trimmed.length > 0 ? trimmed : null;
-    }
-    return null;
-}
-// `summarizeDescription` (sentence-cut + char-cap truncator) was removed
-// alongside the notification reformat in PR #78. The new nested-bullet
-// notification format renders the full description verbatim so users get
-// the complete context for the skill they're being notified about.
-// Telegram's own 4096-char message limit is the only remaining ceiling,
-// and skill descriptions in the senpi-skills repo are nowhere near that.
-/**
- * Read both the installed version and description for a skill from its local
- * SKILL.md. Shared core for `readLocalVersion` and `readLocalDescription` so a
- * tick that needs both pays a single file read per dir rather than two.
+ * Read the installed version for a skill from its local SKILL.md.
  *
- * Multi-dir search path: tries each entry in order and returns the first
- * readable SKILL.md's parsed fields. Either field may be null if absent in
- * the frontmatter — that's distinct from "no SKILL.md found at all" (which
- * returns nulls only after every dir has been tried).
+ * Accepts either a single dir (legacy callers) or an array of dirs (the
+ * multi-dir search path). When given an array, tries each entry in order and
+ * returns the first readable SKILL.md's parsed version — this mirrors the
+ * documented behaviour that `skillsDir[0]` is the *primary* (writes go here)
+ * and the remaining entries are read-only fallbacks scanned during version
+ * checks.
+ *
+ * The first readable SKILL.md wins even if its version field is absent — a
+ * present-but-versionless file is meaningful state (skill predates versioning),
+ * not a "not found" signal that should let the next dir override it. Returns
+ * null when no readable SKILL.md is found across any candidate dir, or when the
+ * version field is absent. Logs a warning per dir for unexpected errors
+ * (anything other than ENOENT).
  */
-export async function readLocalSkillMetadata(skillsDir, skillName, logger) {
+export async function readLocalVersion(skillsDir, skillName, logger) {
     const dirs = typeof skillsDir === "string" ? [skillsDir] : skillsDir;
     for (const dir of dirs) {
         const filePath = join(dir, skillName, "SKILL.md");
         try {
             const content = await readFile(filePath, "utf8");
-            // First readable SKILL.md wins, even if its fields are missing —
-            // a present-but-versionless file is meaningful state (skill predates
-            // versioning), not a "not found" signal that should let the next dir
-            // override it.
-            return {
-                version: parseSkillMdVersion(content),
-                description: parseSkillMdDescription(content),
-            };
+            return parseSkillMdVersion(content);
         }
         catch (err) {
             if (err.code === "ENOENT") {
@@ -154,60 +71,35 @@ export async function readLocalSkillMetadata(skillsDir, skillName, logger) {
             logger?.warn(`[senpi-skills-manager] failed to read SKILL.md for "${skillName}" | path=${filePath} err=${formatErr(err)}`);
             // Non-ENOENT (permissions, I/O error) — log and keep trying the
             // remaining dirs rather than short-circuit; if one mirror is broken,
-            // a healthy mirror further down the path should still serve metadata.
+            // a healthy mirror further down the path should still serve the version.
         }
     }
-    return { version: null, description: null };
-}
-/**
- * Read the installed version for a skill from its local SKILL.md.
- *
- * Accepts either a single dir (legacy callers) or an array of dirs (new
- * multi-dir search path). When given an array, tries each entry in order and
- * returns the first non-null match — this mirrors the documented behaviour
- * that `skillsDir[0]` is the *primary* (writes go here) and the remaining
- * entries are read-only fallbacks scanned during version checks.
- *
- * Returns null when no readable SKILL.md is found across any of the
- * candidate dirs, or when the version field is absent. Logs a warning per
- * dir for unexpected errors (anything other than ENOENT).
- */
-export async function readLocalVersion(skillsDir, skillName, logger) {
-    return (await readLocalSkillMetadata(skillsDir, skillName, logger)).version;
-}
-/**
- * Read the installed description for a skill from its local SKILL.md.
- * Multi-dir search path semantics identical to `readLocalVersion`.
- *
- * Returns null when no readable SKILL.md is found across any of the
- * candidate dirs, or when the description field is absent.
- */
-export async function readLocalDescription(skillsDir, skillName, logger) {
-    return (await readLocalSkillMetadata(skillsDir, skillName, logger)).description;
+    return null;
 }
 /**
- * Fetch the remote SKILL.md for a skill and return both the version and the
- * description in one network round-trip.
- *
- * Notification text uses the description from the **remote** SKILL.md (not
- * the local one) so the "About:" line reflects the version the user is being
- * asked about — a description on disk for v1.x may be stale relative to the
- * v2.0.0 the major-update notification is announcing.
+ * Fetch the remote SKILL.md for a skill and return its version.
  *
- * Returns null fields when the skill does not exist in the remote repo
- * (HTTP 404) — that's a legitimate state ("skill removed or not yet
- * published"), not an error, so it should not pollute failure counters.
- * Both fields may also be null when the remote SKILL.md is present but
- * its frontmatter omits the corresponding field.
+ * Returns null when the skill does not exist in the remote repo (HTTP 404) —
+ * that's a legitimate state ("skill removed or not yet published"), not an
+ * error, so it should not pollute failure counters. Also null when the remote
+ * SKILL.md is present but its frontmatter omits the version field.
  *
  * Throws on transient/operational failures (network errors, timeouts, 5xx
  * responses, body-parse failures) so the caller's failure-recording path can
  * fire.
  *
+ * @param remotePath Subdirectory inside the repo holding the skill (manifest
+ *   `path`); defaults to the skill name (monorepo convention).
  * @param fetchImpl Injectable for unit testing — defaults to global `fetch`.
  */
-export async function fetchRemoteSkillMetadata(skillName, rawBaseUrl = SKILLS_RAW_BASE_URL, fetchImpl = fetch) {
-    const url = `${rawBaseUrl}/${encodeURIComponent(skillName)}/SKILL.md`;
+export async function fetchRemoteVersion(skillName, rawBaseUrl = SKILLS_RAW_BASE_URL, fetchImpl = fetch, remotePath = skillName) {
+    // Each path segment is encoded so a nested `path` like "skills/foo" stays a
+    // valid URL.
+    const encodedPath = remotePath
+        .split("/")
+        .map((seg) => encodeURIComponent(seg))
+        .join("/");
+    const url = `${rawBaseUrl}/${encodedPath}/SKILL.md`;
     let res;
     try {
         res = await fetchImpl(url, { signal: AbortSignal.timeout(15_000) });
@@ -215,36 +107,21 @@ export async function fetchRemoteSkillMetadata(skillName, rawBaseUrl = SKILLS_RA
     catch (err) {
         throw new Error(`Network error fetching remote SKILL.md for "${skillName}": ${formatErr(err)}`);
     }
-    // 404 = skill is not in the remote repo. Treated as "no remote metadata"
+    // 404 = skill is not in the remote repo. Treated as "no remote version"
     // rather than a failure so the caller can skip cleanly without escalating.
     if (res.status === 404) {
-        return { version: null, description: null };
+        return null;
     }
     if (!res.ok) {
         throw new Error(`Failed to fetch remote SKILL.md for "${skillName}": HTTP ${res.status} ${res.statusText}`);
     }
     try {
-        const text = await res.text();
-        return {
-            version: parseSkillMdVersion(text),
-            description: parseSkillMdDescription(text),
-        };
+        return parseSkillMdVersion(await res.text());
     }
     catch (err) {
         throw new Error(`Failed to read response body for "${skillName}": ${formatErr(err)}`);
     }
 }
-/**
- * Fetch the remote SKILL.md for a skill and return its version.
- *
- * Thin wrapper over {@link fetchRemoteSkillMetadata} kept for backward
- * compatibility with callers (and tests) that only need the version field.
- * New code that wants both version + description in a single round-trip
- * should call `fetchRemoteSkillMetadata` directly.
- */
-export async function fetchRemoteVersion(skillName, rawBaseUrl = SKILLS_RAW_BASE_URL, fetchImpl = fetch) {
-    return (await fetchRemoteSkillMetadata(skillName, rawBaseUrl, fetchImpl)).version;
-}
 /**
  * Compare the local and remote versions for a skill and return a classified diff.
  *
@@ -256,44 +133,37 @@ export async function fetchRemoteVersion(skillName, rawBaseUrl = SKILLS_RAW_BASE
  * - Remote version is absent or unparseable → "unknown", caller should log and
  *   skip.
  */
-export async function checkSkillVersion(skillsDir, skillName, rawBaseUrl = SKILLS_RAW_BASE_URL, fetchImpl = fetch, logger) {
-    // Fetch the remote SKILL.md once and extract both version + description.
-    // Description is reported back to the coordinator so notifications can
-    // surface the *remote* (i.e. upcoming-version) description rather than the
-    // local one, which may be stale relative to the version the notification
-    // is announcing.
-    //
-    // Log the specific fetch failure for traceability, then re-throw so the
-    // coordinator records it as a check failure (consecutiveFailures,
-    // lastFailureReason). 404 is intentionally returned as null inside
-    // fetchRemoteSkillMetadata and never reaches this catch.
-    const remoteMetadataPromise = fetchRemoteSkillMetadata(skillName, rawBaseUrl, fetchImpl).catch((err) => {
+export async function checkSkillVersion(skillsDir, skillName, rawBaseUrl = SKILLS_RAW_BASE_URL, fetchImpl = fetch, logger, remotePath = skillName) {
+    // Fetch the remote SKILL.md version. Log the specific fetch failure for
+    // traceability, then re-throw so the coordinator records it as a check
+    // failure (consecutiveFailures, lastFailureReason). 404 is intentionally
+    // returned as null inside fetchRemoteVersion and never reaches this catch.
+    const remoteVersionPromise = fetchRemoteVersion(skillName, rawBaseUrl, fetchImpl, remotePath).catch((err) => {
         logger?.warn(`[senpi-skills-manager] failed to fetch remote SKILL.md for "${skillName}" | err=${formatErr(err)}`);
         throw err;
     });
-    const [localVersion, remoteMetadata] = await Promise.all([
+    const [localVersion, remoteVersion] = await Promise.all([
         readLocalVersion(skillsDir, skillName, logger),
-        remoteMetadataPromise,
+        remoteVersionPromise,
     ]);
-    const { version: remoteVersion, description: remoteDescription } = remoteMetadata;
     const normalizedRemote = normalizeVersion(remoteVersion ?? "");
     if (!remoteVersion || !parseSemver(normalizedRemote)) {
-        return { localVersion, remoteVersion, updateKind: "unknown", remoteDescription };
+        return { localVersion, remoteVersion, updateKind: "unknown" };
     }
     // Skill has never had a version in SKILL.md (null) — predates the versioning
     // system or was installed before the field was added. Treat as a minor update
     // so it is auto-applied without requiring a manual major-version approval.
     if (localVersion === null) {
-        return { localVersion, remoteVersion, updateKind: "minor", remoteDescription };
+        return { localVersion, remoteVersion, updateKind: "minor" };
     }
     const normalizedLocal = normalizeVersion(localVersion);
     // Local version string exists but is not valid semver even after normalisation
     // (e.g. "latest", "nightly"). We cannot safely compare, so skip.
     if (!parseSemver(normalizedLocal)) {
-        return { localVersion, remoteVersion, updateKind: "unknown", remoteDescription };
+        return { localVersion, remoteVersion, updateKind: "unknown" };
     }
     // classifyUpdate returns AutoUpdateKind which is a strict subset of SkillUpdateKind
     const updateKind = classifyUpdate(normalizedLocal, normalizedRemote);
-    return { localVersion, remoteVersion, updateKind, remoteDescription };
+    return { localVersion, remoteVersion, updateKind };
 }
 //# sourceMappingURL=version-manager.js.map

package/dist/skills-manager/version-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"version-manager.js","sourceRoot":"","sources":["../../src/skills-manager/version-manager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAAS;IACxC,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,MAAM,KAAK,GAAG,6BAA6B,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACjE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7B,MAAM,YAAY,GAAG,uDAAuD,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/F,OAAO,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,MAAM,KAAK,GAAG,6BAA6B,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACjE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAE7B,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,0EAA0E;IAC1E,2EAA2E;IAC3E,EAAE;IACF,yEAAyE;IACzE,yEAAyE;IACzE,qEAAqE;IACrE,yEAAyE;IACzE,qEAAqE;IACrE,wCAAwC;IACxC,MAAM,WAAW,GAAG,2EAA2E,CAAC,IAAI,CAClG,WAAW,CACZ,CAAC;IACF,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC;aACzB,KAAK,CAAC,OAAO,CAAC;aACd,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;aAC3C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;IAED,sEAAsE;IACtE,wEAAwE;IACxE,0BAA0B;IAC1B,MAAM,WAAW,GAAG,qGAAqG;SACtH,IAAI,CAAC,WAAW,CAAC,CAAC;IACrB,IAAI,WAAW,EAAE,CAAC;QAChB,wEAAwE;QACxE,iEAAiE;QACjE,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrE,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC;YAC1B,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC;YACjC,CAAC,CAAC,GAAG,CAAC;QACR,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yEAAyE;AACzE,uEAAuE;AACvE,yEAAyE;AACzE,mEAAmE;AACnE,wEAAwE;AACxE,yEAAyE;AAEzE;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,SAAqC,EACrC,SAAiB,EACjB,MAAmB;IAEnB,MAAM,IAAI,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACjD,iEAAiE;YACjE,qEAAqE;YACrE,qEAAqE;YACrE,eAAe;YACf,OAAO;gBACL,OAAO,EAAE,mBAAmB,CAAC,OAAO,CAAC;gBACrC,WAAW,EAAE,uBAAuB,CAAC,OAAO,CAAC;aAC9C,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrD,SAAS,CAAC,eAAe;YAC3B,CAAC;YACD,MAAM,EAAE,IAAI,CACV,uDAAuD,SAAS,YAAY,QAAQ,QAAQ,SAAS,CAAC,GAAG,CAAC,EAAE,CAC7G,CAAC;YACF,gEAAgE;YAChE,qEAAqE;YACrE,sEAAsE;QACxE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,SAAqC,EACrC,SAAiB,EACjB,MAAmB;IAEnB,OAAO,CAAC,MAAM,sBAAsB,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;AAC9E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,SAAqC,EACrC,SAAiB,EACjB,MAAmB;IAEnB,OAAO,CAAC,MAAM,sBAAsB,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC;AAClF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,SAAiB,EACjB,aAAqB,mBAAmB,EACxC,YAA0B,KAAK;IAE/B,MAAM,GAAG,GAAG,GAAG,UAAU,IAAI,kBAAkB,CAAC,SAAS,CAAC,WAAW,CAAC;IAEtE,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,+CAA+C,SAAS,MAAM,SAAS,CAAC,GAAG,CAAC,EAAE,CAC/E,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,2EAA2E;IAC3E,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC9C,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,wCAAwC,SAAS,WAAW,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAC3F,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,OAAO;YACL,OAAO,EAAE,mBAAmB,CAAC,IAAI,CAAC;YAClC,WAAW,EAAE,uBAAuB,CAAC,IAAI,CAAC;SAC3C,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,qCAAqC,SAAS,MAAM,SAAS,CAAC,GAAG,CAAC,EAAE,CACrE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAAiB,EACjB,aAAqB,mBAAmB,EACxC,YAA0B,KAAK;IAE/B,OAAO,CAAC,MAAM,wBAAwB,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;AACpF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,SAAqC,EACrC,SAAiB,EACjB,aAAqB,mBAAmB,EACxC,YAA0B,KAAK,EAC/B,MAAmB;IAEnB,yEAAyE;IACzE,uEAAuE;IACvE,2EAA2E;IAC3E,yEAAyE;IACzE,iBAAiB;IACjB,EAAE;IACF,wEAAwE;IACxE,kEAAkE;IAClE,mEAAmE;IACnE,yDAAyD;IACzD,MAAM,qBAAqB,GAAG,wBAAwB,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,KAAK,CAC5F,CAAC,GAAG,EAAE,EAAE;QACN,MAAM,EAAE,IAAI,CACV,+DAA+D,SAAS,WAAW,SAAS,CAAC,GAAG,CAAC,EAAE,CACpG,CAAC;QACF,MAAM,GAAG,CAAC;IACZ,CAAC,CACF,CAAC;IACF,MAAM,CAAC,YAAY,EAAE,cAAc,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACvD,gBAAgB,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC;QAC9C,qBAAqB;KACtB,CAAC,CAAC;IACH,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,EAAE,GAAG,cAAc,CAAC;IAElF,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IAC/D,IAAI,CAAC,aAAa,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACrD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;IACnF,CAAC;IAED,6EAA6E;IAC7E,8EAA8E;IAC9E,2EAA2E;IAC3E,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC1B,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;IACjF,CAAC;IAED,MAAM,eAAe,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;IAEvD,+EAA+E;IAC/E,iEAAiE;IACjE,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE,CAAC;QAClC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC;IACnF,CAAC;IAED,oFAAoF;IACpF,MAAM,UAAU,GAAG,cAAc,CAAC,eAAe,EAAE,gBAAgB,CAAoB,CAAC;IACxF,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC;AACxE,CAAC"}
+{"version":3,"file":"version-manager.js","sourceRoot":"","sources":["../../src/skills-manager/version-manager.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAAS;IACxC,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,MAAM,KAAK,GAAG,6BAA6B,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACjE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7B,MAAM,YAAY,GAAG,uDAAuD,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/F,OAAO,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,SAAqC,EACrC,SAAiB,EACjB,MAAmB;IAEnB,MAAM,IAAI,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACjD,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrD,SAAS,CAAC,eAAe;YAC3B,CAAC;YACD,MAAM,EAAE,IAAI,CACV,uDAAuD,SAAS,YAAY,QAAQ,QAAQ,SAAS,CAAC,GAAG,CAAC,EAAE,CAC7G,CAAC;YACF,gEAAgE;YAChE,qEAAqE;YACrE,yEAAyE;QAC3E,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAAiB,EACjB,aAAqB,mBAAmB,EACxC,YAA0B,KAAK,EAC/B,aAAqB,SAAS;IAE9B,4EAA4E;IAC5E,aAAa;IACb,MAAM,WAAW,GAAG,UAAU;SAC3B,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;SACrC,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,MAAM,GAAG,GAAG,GAAG,UAAU,IAAI,WAAW,WAAW,CAAC;IAEpD,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,+CAA+C,SAAS,MAAM,SAAS,CAAC,GAAG,CAAC,EAAE,CAC/E,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,2EAA2E;IAC3E,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,wCAAwC,SAAS,WAAW,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAC3F,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,OAAO,mBAAmB,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,qCAAqC,SAAS,MAAM,SAAS,CAAC,GAAG,CAAC,EAAE,CACrE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,SAAqC,EACrC,SAAiB,EACjB,aAAqB,mBAAmB,EACxC,YAA0B,KAAK,EAC/B,MAAmB,EACnB,aAAqB,SAAS;IAE9B,wEAAwE;IACxE,uEAAuE;IACvE,yEAAyE;IACzE,2EAA2E;IAC3E,MAAM,oBAAoB,GAAG,kBAAkB,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,KAAK,CACjG,CAAC,GAAG,EAAE,EAAE;QACN,MAAM,EAAE,IAAI,CACV,+DAA+D,SAAS,WAAW,SAAS,CAAC,GAAG,CAAC,EAAE,CACpG,CAAC;QACF,MAAM,GAAG,CAAC;IACZ,CAAC,CACF,CAAC;IACF,MAAM,CAAC,YAAY,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACtD,gBAAgB,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC;QAC9C,oBAAoB;KACrB,CAAC,CAAC;IAEH,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IAC/D,IAAI,CAAC,aAAa,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACrD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IAChE,CAAC;IAED,6EAA6E;IAC7E,8EAA8E;IAC9E,2EAA2E;IAC3E,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC1B,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IAC9D,CAAC;IAED,MAAM,eAAe,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;IAEvD,+EAA+E;IAC/E,iEAAiE;IACjE,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE,CAAC;QAClC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IAChE,CAAC;IAED,oFAAoF;IACpF,MAAM,UAAU,GAAG,cAAc,CAAC,eAAe,EAAE,gBAAgB,CAAoB,CAAC;IACxF,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC;AACrD,CAAC"}

package/dist/skills-manager/writer.d.ts

@@ -24,5 +24,16 @@ import type { LoggerLike } from "./types.js";
  * @throws When the skill subdirectory is absent in the clone.
  * @throws When the staging copy fails.
  */
-export declare function installSkill(cloneDir: string, skillName: string, skillsDir: string, logger?: LoggerLike): Promise<void>;
+export declare function installSkill(cloneDir: string, skillName: string, skillsDir: string, logger?: LoggerLike, options?: {
+    sourcePath?: string;
+    allowedSkills?: readonly string[];
+    /**
+     * The version we intend to install (the version the check read from the
+     * remote SKILL.md). When provided, the installed SKILL.md is re-read after
+     * the swap and the install is **rolled back** if it doesn't match — closing
+     * the gap between the CDN version check and the git clone (TOCTOU). Omit
+     * (e.g. bootstrap) to skip verification.
+     */
+    expectedVersion?: string | null;
+}): Promise<void>;
 //# sourceMappingURL=writer.d.ts.map

package/dist/skills-manager/writer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"writer.d.ts","sourceRoot":"","sources":["../../src/skills-manager/writer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,UAAU,GAClB,OAAO,CAAC,IAAI,CAAC,CA6Ff"}
+{"version":3,"file":"writer.d.ts","sourceRoot":"","sources":["../../src/skills-manager/writer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAQH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAc7C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,UAAU,EACnB,OAAO,GAAE;IACP,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,GACL,OAAO,CAAC,IAAI,CAAC,CAsIf"}

package/dist/skills-manager/writer.js

@@ -6,7 +6,20 @@ import * as fs from "node:fs/promises";
 import { randomUUID } from "node:crypto";
 import { join } from "node:path";
 import { ALLOWED_SKILLS } from "./constants.js";
+import { normalizeVersion, parseSkillMdVersion } from "./version-manager.js";
 import { formatErr } from "./utils.js";
+/**
+ * Compare an installed SKILL.md version against the version we intended to
+ * install. Tolerant of two-part vs three-part forms (via `normalizeVersion`)
+ * and a leading `v`. A `null` installed version never matches a non-null
+ * expectation.
+ */
+function versionsMatch(installed, expected) {
+    if (installed === null)
+        return false;
+    const norm = (v) => normalizeVersion(v.trim().replace(/^v/i, "")).toLowerCase();
+    return norm(installed) === norm(expected);
+}
 /**
  * Copy a skill's subdirectory from `cloneDir` into `skillsDir/<skillName>/`,
  * replacing the existing copy via a crash-safe swap.
@@ -28,11 +41,17 @@ import { formatErr } from "./utils.js";
  * @throws When the skill subdirectory is absent in the clone.
  * @throws When the staging copy fails.
  */
-export async function installSkill(cloneDir, skillName, skillsDir, logger) {
-    if (!ALLOWED_SKILLS.includes(skillName)) {
-        throw new Error(`Skill "${skillName}" is not in the allowed skills list: ${ALLOWED_SKILLS.join(", ")}`);
+export async function installSkill(cloneDir, skillName, skillsDir, logger, options = {}) {
+    // Allowlist defaults to ALLOWED_SKILLS (manifest-derived) but can be
+    // overridden by the coordinator with the exact set it's managing this run.
+    const allowedSkills = options.allowedSkills ?? ALLOWED_SKILLS;
+    if (!allowedSkills.includes(skillName)) {
+        throw new Error(`Skill "${skillName}" is not in the allowed skills list: ${allowedSkills.join(", ")}`);
     }
-    const sourcePath = join(cloneDir, skillName);
+    // `sourcePath` is the subdir inside the clone to copy from (manifest `path`);
+    // it defaults to the skill name (monorepo convention). The install *target*
+    // is always `skillsDir/<skillName>` regardless of source layout.
+    const sourcePath = join(cloneDir, options.sourcePath ?? skillName);
     const targetPath = join(skillsDir, skillName);
     const stagingPath = join(skillsDir, `.tmp-${skillName}`);
     const backupPath = join(skillsDir, `.bak-${skillName}-${randomUUID()}`);
@@ -90,6 +109,33 @@ export async function installSkill(cloneDir, skillName, skillsDir, logger) {
         // On successful rename this path no longer exists; rm is still safe with force=true.
         await fs.rm(stagingPath, { recursive: true, force: true });
     }
+    // ── Post-install verification ─────────────────────────────────────────────
+    // The version we *decided* to install came from the raw-CDN SKILL.md, which
+    // can be cached/stale relative to the git clone we just swapped in. Re-read
+    // the installed SKILL.md and confirm it matches; on mismatch, roll back to the
+    // backup (or remove the bad install if there was none) and throw so the caller
+    // records a failure and retries next tick — never silently record a version we
+    // didn't actually install.
+    if (options.expectedVersion != null) {
+        let installedVersion = null;
+        try {
+            installedVersion = parseSkillMdVersion(await fs.readFile(join(targetPath, "SKILL.md"), "utf8"));
+        }
+        catch {
+            installedVersion = null; // missing/unreadable SKILL.md → treated as mismatch
+        }
+        if (!versionsMatch(installedVersion, options.expectedVersion)) {
+            logger?.warn(`[senpi-skills-manager] post-install verification failed, rolling back | skill=${skillName} expected=${options.expectedVersion} installed=${installedVersion ?? "none"}`);
+            await fs.rm(targetPath, { recursive: true, force: true });
+            if (movedTargetToBackup) {
+                await fs.rename(backupPath, targetPath).catch((restoreErr) => {
+                    logger?.warn(`[senpi-skills-manager] failed to restore backup after verification failure | skill=${skillName} backup=${backupPath} err=${formatErr(restoreErr)}`);
+                });
+            }
+            throw new Error(`post-install verification failed for "${skillName}": expected version ${options.expectedVersion}, installed ${installedVersion ?? "none"}`);
+        }
+        logger?.info(`[senpi-skills-manager] post-install verification ok | skill=${skillName} version=${installedVersion}`);
+    }
     // Backup cleanup is best-effort once the new target is in place.
     if (movedTargetToBackup) {
         await fs.rm(backupPath, { recursive: true, force: true }).catch((err) => {

package/dist/skills-manager/writer.js.map

@@ -1 +1 @@
-{"version":3,"file":"writer.js","sourceRoot":"","sources":["../../src/skills-manager/writer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAGvC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,SAAiB,EACjB,SAAiB,EACjB,MAAmB;IAEnB,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,UAAU,SAAS,wCAAwC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACvF,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,SAAS,EAAE,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,SAAS,IAAI,UAAU,EAAE,EAAE,CAAC,CAAC;IAExE,MAAM,EAAE,IAAI,CACV,mDAAmD,SAAS,SAAS,UAAU,OAAO,UAAU,EAAE,CACnG,CAAC;IAEF,4CAA4C;IAC5C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,4BAA4B,UAAU,gBAAgB,SAAS,oBAAoB,CACpF,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CACb,UAAU,SAAS,kCAAkC,UAAU,GAAG,CACnE,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,0BAA0B;IAC1B,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE/C,iEAAiE;IACjE,MAAM,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,MAAM,EAAE,IAAI,CAAC,8DAA8D,WAAW,EAAE,CAAC,CAAC;IAE1F,wBAAwB;IACxB,MAAM,EAAE,IAAI,CAAC,0DAA0D,UAAU,OAAO,WAAW,EAAE,CAAC,CAAC;IACvG,MAAM,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE1D,kFAAkF;IAClF,IAAI,mBAAmB,GAAG,KAAK,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACxC,mBAAmB,GAAG,IAAI,CAAC;QAC3B,MAAM,EAAE,IAAI,CACV,4DAA4D,UAAU,OAAO,UAAU,EAAE,CAC1F,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,EAAE,IAAI,CAAC,iEAAiE,SAAS,EAAE,CAAC,CAAC;IAC7F,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,CACV,4DAA4D,WAAW,OAAO,UAAU,EAAE,CAC3F,CAAC;QACF,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,EAAE,IAAI,CACV,4DAA4D,SAAS,QAAQ,SAAS,CAAC,GAAG,CAAC,EAAE,CAC9F,CAAC;QACF,2DAA2D;QAC3D,MAAM,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,IAAI,mBAAmB,EAAE,CAAC;YACxB,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE;gBAC3D,MAAM,EAAE,IAAI,CACV,8EAA8E,SAAS,WAAW,UAAU,QAAQ,SAAS,CAAC,UAAU,CAAC,EAAE,CAC5I,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,qFAAqF;QACrF,MAAM,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,iEAAiE;IACjE,IAAI,mBAAmB,EAAE,CAAC;QACxB,MAAM,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACtE,MAAM,EAAE,IAAI,CACV,6DAA6D,UAAU,QAAQ,SAAS,CAAC,GAAG,CAAC,EAAE,CAChG,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,EAAE,IAAI,CAAC,+DAA+D,SAAS,SAAS,UAAU,EAAE,CAAC,CAAC;AAC9G,CAAC"}
+{"version":3,"file":"writer.js","sourceRoot":"","sources":["../../src/skills-manager/writer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAGvC;;;;;GAKG;AACH,SAAS,aAAa,CAAC,SAAwB,EAAE,QAAgB;IAC/D,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACxF,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,SAAiB,EACjB,SAAiB,EACjB,MAAmB,EACnB,UAWI,EAAE;IAEN,qEAAqE;IACrE,2EAA2E;IAC3E,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,cAAc,CAAC;IAC9D,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,UAAU,SAAS,wCAAwC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtF,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,4EAA4E;IAC5E,iEAAiE;IACjE,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,IAAI,SAAS,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,SAAS,EAAE,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,SAAS,IAAI,UAAU,EAAE,EAAE,CAAC,CAAC;IAExE,MAAM,EAAE,IAAI,CACV,mDAAmD,SAAS,SAAS,UAAU,OAAO,UAAU,EAAE,CACnG,CAAC;IAEF,4CAA4C;IAC5C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,4BAA4B,UAAU,gBAAgB,SAAS,oBAAoB,CACpF,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CACb,UAAU,SAAS,kCAAkC,UAAU,GAAG,CACnE,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,0BAA0B;IAC1B,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE/C,iEAAiE;IACjE,MAAM,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,MAAM,EAAE,IAAI,CAAC,8DAA8D,WAAW,EAAE,CAAC,CAAC;IAE1F,wBAAwB;IACxB,MAAM,EAAE,IAAI,CAAC,0DAA0D,UAAU,OAAO,WAAW,EAAE,CAAC,CAAC;IACvG,MAAM,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE1D,kFAAkF;IAClF,IAAI,mBAAmB,GAAG,KAAK,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACxC,mBAAmB,GAAG,IAAI,CAAC;QAC3B,MAAM,EAAE,IAAI,CACV,4DAA4D,UAAU,OAAO,UAAU,EAAE,CAC1F,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,EAAE,IAAI,CAAC,iEAAiE,SAAS,EAAE,CAAC,CAAC;IAC7F,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,CACV,4DAA4D,WAAW,OAAO,UAAU,EAAE,CAC3F,CAAC;QACF,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,EAAE,IAAI,CACV,4DAA4D,SAAS,QAAQ,SAAS,CAAC,GAAG,CAAC,EAAE,CAC9F,CAAC;QACF,2DAA2D;QAC3D,MAAM,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,IAAI,mBAAmB,EAAE,CAAC;YACxB,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE;gBAC3D,MAAM,EAAE,IAAI,CACV,8EAA8E,SAAS,WAAW,UAAU,QAAQ,SAAS,CAAC,UAAU,CAAC,EAAE,CAC5I,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,qFAAqF;QACrF,MAAM,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,+EAA+E;IAC/E,+EAA+E;IAC/E,+EAA+E;IAC/E,2BAA2B;IAC3B,IAAI,OAAO,CAAC,eAAe,IAAI,IAAI,EAAE,CAAC;QACpC,IAAI,gBAAgB,GAAkB,IAAI,CAAC;QAC3C,IAAI,CAAC;YACH,gBAAgB,GAAG,mBAAmB,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAClG,CAAC;QAAC,MAAM,CAAC;YACP,gBAAgB,GAAG,IAAI,CAAC,CAAC,oDAAoD;QAC/E,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,gBAAgB,EAAE,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YAC9D,MAAM,EAAE,IAAI,CACV,iFAAiF,SAAS,aAAa,OAAO,CAAC,eAAe,cAAc,gBAAgB,IAAI,MAAM,EAAE,CACzK,CAAC;YACF,MAAM,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1D,IAAI,mBAAmB,EAAE,CAAC;gBACxB,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE;oBAC3D,MAAM,EAAE,IAAI,CACV,sFAAsF,SAAS,WAAW,UAAU,QAAQ,SAAS,CAAC,UAAU,CAAC,EAAE,CACpJ,CAAC;gBACJ,CAAC,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,KAAK,CACb,yCAAyC,SAAS,uBAAuB,OAAO,CAAC,eAAe,eAAe,gBAAgB,IAAI,MAAM,EAAE,CAC5I,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,IAAI,CACV,+DAA+D,SAAS,YAAY,gBAAgB,EAAE,CACvG,CAAC;IACJ,CAAC;IAED,iEAAiE;IACjE,IAAI,mBAAmB,EAAE,CAAC;QACxB,MAAM,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACtE,MAAM,EAAE,IAAI,CACV,6DAA6D,UAAU,QAAQ,SAAS,CAAC,GAAG,CAAC,EAAE,CAChG,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,EAAE,IAAI,CAAC,+DAA+D,SAAS,SAAS,UAAU,EAAE,CAAC,CAAC;AAC9G,CAAC"}

package/openclaw.plugin.json

@@ -85,12 +85,9 @@
       "skillsManager": {
         "type": "object",
         "additionalProperties": false,
-        "description": "Skills manager configuration. Checks the senpi-skills repo for updates to declared skills after each plugin auto-update tick and applies patch/minor updates automatically (major updates are notify-only). Cadence is inherited from `autoUpdate.pollIntervalMinutes`; this block has no independent poll interval. Omit this block to use defaults.",
+        "description": "Skills manager configuration. The managed skill set and each skill's source (repo/branch/path) come from the checked-in manifest src/skills-manager/skills-manifest.json — the single source of truth, shipped with the runtime. Checks the source repo for updates after each plugin auto-update tick and applies patch/minor updates automatically; major updates are gated by default (detected, surfaced via `senpi skills status`, applied via a manual `senpi skills update <name>` — no notification). To authorize automatic major upgrades, set a per-skill `maxMajor` ceiling in the manifest (or `overrides`): the tick then auto-applies majors up to and including that number; bumping it in a reviewed change is the fleet-wide lever for adopting a new skill major. Cadence is inherited from `autoUpdate.pollIntervalMinutes`; this block has no independent poll interval. Omit this block to manage the full manifest set with defaults.",
         "default": {
-          "enabled": true,
-          "skills": [
-            "senpi-trading-runtime"
-          ]
+          "enabled": true
         },
         "properties": {
           "enabled": {
@@ -118,7 +115,22 @@
             "items": {
               "type": "string"
             },
-            "description": "Explicit skill names to manage. Omitting the field falls back to the canonical default [\"senpi-trading-runtime\"]; passing an explicit empty array [] switches to discovery mode (scan subdirs under skillsDir)."
+            "description": "Deprecated and ignored. The managed skill set is defined solely by the manifest (src/skills-manager/skills-manifest.json). This field is tolerated for backward compatibility with existing configs but no longer affects which skills are managed. Use `overrides` to retarget a skill's repo/branch/path, or `enabled: false` to disable the manager."
+          },
+          "overrides": {
+            "type": "object",
+            "additionalProperties": {
+              "type": "object",
+              "additionalProperties": false,
+              "properties": {
+                "repo": { "type": "string" },
+                "branch": { "type": "string" },
+                "commit": { "type": "string", "description": "Pin to a commit SHA, or 'latest' to track the branch tip." },
+                "path": { "type": "string" },
+                "maxMajor": { "type": "integer", "minimum": 0, "description": "Auto-update major-version ceiling: the tick auto-applies updates up to and including this major and gates anything above. Unset gates all majors (manual update required)." }
+              }
+            },
+            "description": "Optional per-skill source overrides keyed by skill name, e.g. { \"senpi-strategy-ops\": { \"branch\": \"strategy-v2\" } }. Each entry may override repo, branch, and/or path. Branch precedence (highest first): per-skill env SENPI_SKILLS_BRANCH_<NAME> > this per-skill override > global env SENPI_SKILLS_BRANCH > manifest entry branch > manifest defaults.branch. So a per-skill override pins a skill even while the global env retargets the rest."
           }
         }
       },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@senpi/runtime",
-  "version": "3.0.6-dev.runtime-phase-2.20260630134536",
+  "version": "3.0.6-dev.runtime-phase-2.20260630182800",
   "description": "Senpi runtime plugin for OpenClaw",
   "type": "module",
   "main": "dist/index.js",
@@ -13,8 +13,9 @@
   "scripts": {
     "setup:hooks": "sh -c 'git rev-parse --git-dir >/dev/null 2>&1 && git config core.hooksPath .githooks || true'",
     "prepare": "npm run setup:hooks",
-    "build": "npm i && tsc && npm run copy:external-scanners",
+    "build": "npm i && tsc && npm run copy:external-scanners && npm run copy:skills-manifest",
     "copy:external-scanners": "node -e \"require('fs').rmSync('dist/scanners/external', { recursive: true, force: true }); require('fs').cpSync('src/scanners/external', 'dist/scanners/external', { recursive: true })\"",
+    "copy:skills-manifest": "node -e \"require('fs').cpSync('src/skills-manager/skills-manifest.json', 'dist/skills-manager/skills-manifest.json')\"",
     "typecheck:tests": "tsc -p tsconfig.tests.json --noEmit",
     "start": "node dist/index.js",
     "debug": "npm run build && node dist/debug.js",