@xopcai/xopc 0.0.180 → 0.0.188

package/dist/src/cli/commands/project.js

@@ -2,11 +2,11 @@ import { closeXopcDatabase, isXopcDatabaseOpen, openXopcDatabase } from "../../s
 import { getSessionMetadata } from "../../storage/sqlite/session-repository.js";
 import "../../storage/sqlite/index.js";
 import { init_loader, loadConfig } from "../../config/loader.js";
-import { GoalService } from "../../goals/goal-service.js";
-import "../../goals/index.js";
+import { TaskRepository } from "../../tasks/task-repository.js";
 import { ProjectService } from "../../projects/project-service.js";
 import { isValidProjectAgentId, normalizeProjectAgentId } from "../../projects/project-agent.js";
 import "../../projects/index.js";
+import "../../tasks/index.js";
 import { formatExamples, register } from "../registry.js";
 import { Command } from "commander";
 //#region src/cli/commands/project.ts
@@ -29,8 +29,8 @@ function resolveProject(projects, ref) {
 function formatProject(project) {
 	const counts = [
 		project.sessionCount != null ? `sessions ${project.sessionCount}` : void 0,
-		project.goalCount != null ? `goals ${project.goalCount}` : void 0,
-		project.activeGoalCount != null ? `active goals ${project.activeGoalCount}` : void 0
+		project.taskCount != null ? `tasks ${project.taskCount}` : void 0,
+		project.activeTaskCount != null ? `active tasks ${project.activeTaskCount}` : void 0
 	].filter(Boolean).join(" | ");
 	return [
 		`${project.id} [${project.status}] ${project.name}`,
@@ -47,8 +47,7 @@ function createProjectCommand(ctx) {
 		"xopc project list",
 		"xopc project new xopc --workspace ~/develop/github/xopc",
 		"xopc project show xopc",
-		"xopc project attach-session <session-key> xopc",
-		"xopc project attach-goal <goal-id> xopc"
+		"xopc project attach-session <session-key> xopc"
 	]));
 	cmd.addCommand(new Command("list").description("List projects").option("--status <status>", "active, paused, or archived").option("--search <query>", "Search by name, slug, or description").option("--limit <n>", "Maximum rows", "20").option("--json", "Output JSON").action(async (options) => {
 		await withProjects(ctx, (projects) => {
@@ -69,7 +68,7 @@ function createProjectCommand(ctx) {
 			for (const project of result.items) console.log(`${formatProject(project)}\n`);
 		});
 	}));
-	cmd.addCommand(new Command("new").description("Create a project").argument("<name>", "Project name").option("--description <text>", "Project description").option("--default-agent <id>", "Default agent id for new project sessions and goals").option("--workspace <path>", "Project workspace root").option("--brief <text>", "Project brief").option("--instructions <text>", "Project instructions").option("--json", "Output JSON").action(async (name, options) => {
+	cmd.addCommand(new Command("new").description("Create a project").argument("<name>", "Project name").option("--description <text>", "Project description").option("--default-agent <id>", "Default agent id for new project sessions and tasks").option("--workspace <path>", "Project workspace root").option("--brief <text>", "Project brief").option("--instructions <text>", "Project instructions").option("--json", "Output JSON").action(async (name, options) => {
 		const cfg = loadConfig(ctx.configPath);
 		const defaultAgentId = normalizeProjectAgentId(options.defaultAgent);
 		if (!isValidProjectAgentId(cfg, defaultAgentId)) {
@@ -110,7 +109,7 @@ function createProjectCommand(ctx) {
 			if (detailed.instructions) console.log(`\nInstructions:\n${detailed.instructions}`);
 		});
 	}));
-	cmd.addCommand(new Command("update").description("Update a project").argument("<project>", "Project id or slug").option("--name <name>", "New name").option("--description <text>", "Project description").option("--default-agent <id>", "Default agent id for new project sessions and goals").option("--clear-default-agent", "Clear project default agent").option("--status <status>", "active, paused, or archived").option("--workspace <path>", "Project workspace root").option("--brief <text>", "Project brief").option("--instructions <text>", "Project instructions").action(async (projectRef, options) => {
+	cmd.addCommand(new Command("update").description("Update a project").argument("<project>", "Project id or slug").option("--name <name>", "New name").option("--description <text>", "Project description").option("--default-agent <id>", "Default agent id for new project sessions and tasks").option("--clear-default-agent", "Clear project default agent").option("--status <status>", "active, paused, or archived").option("--workspace <path>", "Project workspace root").option("--brief <text>", "Project brief").option("--instructions <text>", "Project instructions").action(async (projectRef, options) => {
 		const cfg = loadConfig(ctx.configPath);
 		const defaultAgentId = options.clearDefaultAgent ? null : normalizeProjectAgentId(options.defaultAgent);
 		if (defaultAgentId && !isValidProjectAgentId(cfg, defaultAgentId)) {
@@ -163,23 +162,6 @@ function createProjectCommand(ctx) {
 			console.log("Detached session from project.");
 		});
 	}));
-	cmd.addCommand(new Command("attach-goal").description("Attach a goal to a project").argument("<goal-id>", "Goal id").argument("<project>", "Project id or slug").action(async (goalId, projectRef) => {
-		await withProjects(ctx, (projects) => {
-			const project = resolveProject(projects, projectRef);
-			if (!project) {
-				console.error(`Project not found: ${projectRef}`);
-				process.exit(1);
-			}
-			projects.attachGoal(goalId, project.id);
-			console.log(`Attached goal to ${project.name}`);
-		});
-	}));
-	cmd.addCommand(new Command("detach-goal").description("Detach a goal from its project").argument("<goal-id>", "Goal id").action(async (goalId) => {
-		await withProjects(ctx, (projects) => {
-			projects.detachGoal(goalId);
-			console.log("Detached goal from project.");
-		});
-	}));
 	cmd.addCommand(new Command("sessions").description("List sessions in a project").argument("<project>", "Project id or slug").option("--limit <n>", "Maximum rows", "20").action(async (projectRef, options) => {
 		await withProjects(ctx, (projects) => {
 			const project = resolveProject(projects, projectRef);
@@ -199,22 +181,19 @@ function createProjectCommand(ctx) {
 			}
 		});
 	}));
-	cmd.addCommand(new Command("goals").description("List goals in a project").argument("<project>", "Project id or slug").option("--limit <n>", "Maximum rows", "20").action(async (projectRef, options) => {
+	cmd.addCommand(new Command("tasks").description("List tasks in a project").argument("<project>", "Project id or slug").option("--limit <n>", "Maximum rows", "20").action(async (projectRef, options) => {
 		await withProjects(ctx, (projects) => {
 			const project = resolveProject(projects, projectRef);
 			if (!project) {
 				console.error(`Project not found: ${projectRef}`);
 				process.exit(1);
 			}
-			const goals = new GoalService().list({
-				projectId: project.id,
-				limit: Number(options.limit) || 20
-			});
-			if (!goals.length) {
-				console.log("No goals.");
+			const tasks = new TaskRepository().listByProject(project.id, Number(options.limit) || 20);
+			if (!tasks.length) {
+				console.log("No tasks.");
 				return;
 			}
-			for (const goal of goals) console.log(`${goal.id} [${goal.status}] ${goal.title}`);
+			for (const task of tasks) console.log(`${task.id} [${task.phase}] ${task.title}`);
 		});
 	}));
 	return cmd;

package/dist/src/cli/commands/providers.d.ts

@@ -3,7 +3,7 @@
  *
  * This command sits on top of the existing auth-profile store (`xopc auth …`),
  * but presents a setup-style surface — `list / set-key / unset-key / schema` —
- * with the same `SetupOutcome` JSON contract used by other M1 setup commands.
+ * with the same `SetupTask` JSON contract used by other M1 setup commands.
  * Agents (M2 skills) and the WebUI (M3) can consume both shapes uniformly.
  *
  * Capability-provider (image / voice) settings live under `cfg.providers.<id>`
@@ -11,7 +11,7 @@
  */
 import { type AuthProfileCredential, listAllProfiles } from '../../auth/profiles/index.js';
 import { type ProviderMeta } from '../../providers/index.js';
-import { type SetupOutcome } from './setup-shared/index.js';
+import { type SetupTask } from './setup-shared/index.js';
 type KeyStatus = 'configured' | 'env-only' | 'oauth' | 'not-configured';
 interface ProviderListEntry {
     id: string;
@@ -43,11 +43,11 @@ declare function runSetKey(args: {
     profileId: string;
     key: string;
     options: MutationOptions;
-}): Promise<SetupOutcome>;
+}): Promise<SetupTask>;
 declare function runUnsetKey(args: {
     provider: string;
     profileId: string;
     options: MutationOptions;
-}): Promise<SetupOutcome>;
+}): Promise<SetupTask>;
 export { listProviders, planSetKey, maskKey, runSetKey, runUnsetKey };
 export { listAllProfiles };

package/dist/src/cli/commands/providers.js

@@ -4,7 +4,7 @@ import { formatExamples, register } from "../registry.js";
 import { getProfile, listAllProfiles, listProfilesForProvider, removeAuthProfile, upsertAuthProfile } from "../../auth/profiles/profiles.js";
 import { colors } from "../utils/colors.js";
 import { SETUP_EXIT } from "./setup-shared/types.js";
-import { emitOutcome } from "./setup-shared/output.js";
+import { emitTask } from "./setup-shared/output.js";
 import { isPromptCancelled, promptSecret } from "./setup-shared/prompts.js";
 import "./setup-shared/index.js";
 import { Command } from "commander";
@@ -14,7 +14,7 @@ import { Command } from "commander";
 *
 * This command sits on top of the existing auth-profile store (`xopc auth …`),
 * but presents a setup-style surface — `list / set-key / unset-key / schema` —
-* with the same `SetupOutcome` JSON contract used by other M1 setup commands.
+* with the same `SetupTask` JSON contract used by other M1 setup commands.
 * Agents (M2 skills) and the WebUI (M3) can consume both shapes uniformly.
 *
 * Capability-provider (image / voice) settings live under `cfg.providers.<id>`
@@ -99,10 +99,10 @@ function printListJson(entries) {
 		providers: entries
 	}) + "\n");
 }
-function finalizeProviderOutcome(outcome, options) {
-	emitOutcome(outcome, options.json);
-	process.exitCode = outcome.ok ? SETUP_EXIT.OK : SETUP_EXIT.ERROR;
-	return outcome;
+function finalizeProviderTask(task, options) {
+	emitTask(task, options.json);
+	process.exitCode = task.ok ? SETUP_EXIT.OK : SETUP_EXIT.ERROR;
+	return task;
 }
 function planSetKey(args) {
 	const existing = getProfile(args.profileId);
@@ -118,7 +118,7 @@ function planSetKey(args) {
 }
 async function runSetKey(args) {
 	const meta = PROVIDER_META[args.provider];
-	if (meta && meta.supportsApiKey === false) return finalizeProviderOutcome({
+	if (meta && meta.supportsApiKey === false) return finalizeProviderTask({
 		ok: false,
 		action: "add",
 		domain: "providers",
@@ -130,7 +130,7 @@ async function runSetKey(args) {
 	const { existing, willChange } = planSetKey(args);
 	const changedPaths = willChange ? [`profiles.${args.profileId}.key`] : [];
 	const action = existing ? "set" : "add";
-	if (!willChange) return finalizeProviderOutcome({
+	if (!willChange) return finalizeProviderTask({
 		ok: true,
 		action: "noop",
 		domain: "providers",
@@ -153,7 +153,7 @@ async function runSetKey(args) {
 			}
 		});
 	} catch (error) {
-		return finalizeProviderOutcome({
+		return finalizeProviderTask({
 			ok: false,
 			action,
 			domain: "providers",
@@ -163,7 +163,7 @@ async function runSetKey(args) {
 			errors: [{ message: error.message }]
 		}, args.options);
 	}
-	return finalizeProviderOutcome({
+	return finalizeProviderTask({
 		ok: true,
 		action,
 		domain: "providers",
@@ -177,7 +177,7 @@ async function runSetKey(args) {
 	}, args.options);
 }
 async function runUnsetKey(args) {
-	if (!getProfile(args.profileId)) return finalizeProviderOutcome({
+	if (!getProfile(args.profileId)) return finalizeProviderTask({
 		ok: true,
 		action: "noop",
 		domain: "providers",
@@ -188,7 +188,7 @@ async function runUnsetKey(args) {
 	}, args.options);
 	const changedPaths = [`profiles.${args.profileId}`];
 	if (!args.options.dryRun) removeAuthProfile(args.profileId);
-	return finalizeProviderOutcome({
+	return finalizeProviderTask({
 		ok: true,
 		action: "remove",
 		domain: "providers",
@@ -232,7 +232,7 @@ function emitSchema(opts) {
 					description: "Optional profile id when managing multiple keys per provider."
 				}
 			},
-			outcome: {
+			task: {
 				ok: "boolean",
 				action: "add | set | remove | noop",
 				domain: "providers",
@@ -263,14 +263,14 @@ function createProvidersCommand(_ctx) {
 		if (opts.json) printListJson(entries);
 		else printListText(entries);
 	});
-	cmd.command("set-key <provider>").description("Set or update the API key for a provider (writes an auth profile)").option("--key <value>", `API key value. ${KEY_OPTION_HINT}`).option("--profile <id>", "Profile id (default: <provider>:default)").option("--dry-run", "Show the change without writing", false).option("--json", "Emit a single JSON outcome line", false).action(async (provider, opts) => {
+	cmd.command("set-key <provider>").description("Set or update the API key for a provider (writes an auth profile)").option("--key <value>", `API key value. ${KEY_OPTION_HINT}`).option("--profile <id>", "Profile id (default: <provider>:default)").option("--dry-run", "Show the change without writing", false).option("--json", "Emit a single JSON task line", false).action(async (provider, opts) => {
 		const profileId = opts.profile?.trim() || defaultProfileId(provider);
 		let key = opts.key?.trim();
 		if (!key) try {
 			key = await promptSecret(`API key for ${provider}:`);
 		} catch (error) {
 			if (isPromptCancelled(error)) {
-				emitOutcome({
+				emitTask({
 					ok: false,
 					action: "set",
 					domain: "providers",
@@ -294,7 +294,7 @@ function createProvidersCommand(_ctx) {
 			}
 		});
 	});
-	cmd.command("unset-key <provider>").description("Remove a provider auth profile").option("--profile <id>", "Profile id (default: <provider>:default)").option("--dry-run", "Show the change without writing", false).option("--json", "Emit a single JSON outcome line", false).action(async (provider, opts) => {
+	cmd.command("unset-key <provider>").description("Remove a provider auth profile").option("--profile <id>", "Profile id (default: <provider>:default)").option("--dry-run", "Show the change without writing", false).option("--json", "Emit a single JSON task line", false).action(async (provider, opts) => {
 		await runUnsetKey({
 			provider,
 			profileId: opts.profile?.trim() || defaultProfileId(provider),

package/dist/src/cli/commands/search.js

@@ -3,7 +3,7 @@ import { init_loader, loadConfig } from "../../config/loader.js";
 import { formatExamples, register } from "../registry.js";
 import { colors } from "../utils/colors.js";
 import { SETUP_EXIT } from "./setup-shared/types.js";
-import { emitOutcome } from "./setup-shared/output.js";
+import { emitTask } from "./setup-shared/output.js";
 import { isPromptCancelled, promptSecret } from "./setup-shared/prompts.js";
 import { SetupValidationError, runSetup } from "./setup-shared/runner.js";
 import "./setup-shared/index.js";
@@ -115,12 +115,12 @@ function createSearchCommand(_ctx) {
 		console.log("");
 		console.log(colors.gray(`Supported: ${SEARCH_TYPES.join(", ")}`));
 	});
-	cmd.command("add <type>").description("Add or replace a search provider entry (idempotent by type)").option("--key <value>", "API key (brave / tavily / bing). Prompts securely if omitted.").option("--url <value>", "SearXNG instance URL (required for type=searxng)").option("--dry-run", "Show the change without writing", false).option("--json", "Emit a single JSON outcome line", false).action(async (type, opts, command) => {
+	cmd.command("add <type>").description("Add or replace a search provider entry (idempotent by type)").option("--key <value>", "API key (brave / tavily / bing). Prompts securely if omitted.").option("--url <value>", "SearXNG instance URL (required for type=searxng)").option("--dry-run", "Show the change without writing", false).option("--json", "Emit a single JSON task line", false).action(async (type, opts, command) => {
 		const dryRun = Boolean(opts.dryRun);
 		const json = Boolean(opts.json);
 		const t = type.trim().toLowerCase();
 		if (!isSearchType(t)) {
-			emitOutcome({
+			emitTask({
 				ok: false,
 				action: "add",
 				domain: "search",
@@ -135,7 +135,7 @@ function createSearchCommand(_ctx) {
 		const entry = { type: t };
 		if (t === "searxng") {
 			if (!opts.url) {
-				emitOutcome({
+				emitTask({
 					ok: false,
 					action: "add",
 					domain: "search",
@@ -157,7 +157,7 @@ function createSearchCommand(_ctx) {
 				key = await promptSecret(`API key for ${t}:`);
 			} catch (error) {
 				if (isPromptCancelled(error)) {
-					emitOutcome({
+					emitTask({
 						ok: false,
 						action: "add",
 						domain: "search",
@@ -190,10 +190,10 @@ function createSearchCommand(_ctx) {
 			}
 		});
 	});
-	cmd.command("remove <type>").description("Remove a search provider entry").option("--dry-run", "Show the change without writing", false).option("--json", "Emit a single JSON outcome line", false).action(async (type, opts, command) => {
+	cmd.command("remove <type>").description("Remove a search provider entry").option("--dry-run", "Show the change without writing", false).option("--json", "Emit a single JSON task line", false).action(async (type, opts, command) => {
 		const t = type.trim().toLowerCase();
 		if (!isSearchType(t)) {
-			emitOutcome({
+			emitTask({
 				ok: false,
 				action: "remove",
 				domain: "search",

package/dist/src/cli/commands/setup-shared/index.d.ts

@@ -1,4 +1,4 @@
-export { SETUP_EXIT, type SetupAction, type SetupError, type SetupOutcome, type SetupRunOptions, } from './types.js';
+export { SETUP_EXIT, type SetupAction, type SetupError, type SetupTask, type SetupRunOptions, } from './types.js';
 export { runSetup, runSetupHeadless, SetupValidationError, type SetupMutator, type RunSetupArgs, } from './runner.js';
-export { emitOutcome, printJsonOutcome, printTextOutcome } from './output.js';
+export { emitTask, printJsonTask, printTextTask } from './output.js';
 export { promptSecret, isInteractive, isPromptCancelled } from './prompts.js';

package/dist/src/cli/commands/setup-shared/index.js

@@ -1,5 +1,5 @@
 import { SETUP_EXIT } from "./types.js";
-import { emitOutcome, printJsonOutcome, printTextOutcome } from "./output.js";
+import { emitTask, printJsonTask, printTextTask } from "./output.js";
 import { isInteractive, isPromptCancelled, promptSecret } from "./prompts.js";
 import { SetupValidationError, runSetup, runSetupHeadless } from "./runner.js";
-export { SETUP_EXIT, SetupValidationError, emitOutcome, isInteractive, isPromptCancelled, printJsonOutcome, printTextOutcome, promptSecret, runSetup, runSetupHeadless };
+export { SETUP_EXIT, SetupValidationError, emitTask, isInteractive, isPromptCancelled, printJsonTask, printTextTask, promptSecret, runSetup, runSetupHeadless };

package/dist/src/cli/commands/setup-shared/output.d.ts

@@ -1,9 +1,9 @@
-import type { SetupOutcome } from './types.js';
+import type { SetupTask } from './types.js';
 /**
  * Single-line JSON for `--json` mode. Agents (M2) parse stdout, so we keep
  * this stable: `{ ok, action, domain, target?, changedPaths, dryRun, errors?,
  * value?, notes? }`.
  */
-export declare function printJsonOutcome(outcome: SetupOutcome): void;
-export declare function printTextOutcome(outcome: SetupOutcome): void;
-export declare function emitOutcome(outcome: SetupOutcome, json: boolean): void;
+export declare function printJsonTask(task: SetupTask): void;
+export declare function printTextTask(task: SetupTask): void;
+export declare function emitTask(task: SetupTask, json: boolean): void;

package/dist/src/cli/commands/setup-shared/output.js

@@ -5,18 +5,18 @@ import { colors } from "../../utils/colors.js";
 * this stable: `{ ok, action, domain, target?, changedPaths, dryRun, errors?,
 * value?, notes? }`.
 */
-function printJsonOutcome(outcome) {
+function printJsonTask(task) {
 	const payload = {
-		ok: outcome.ok,
-		action: outcome.action,
-		domain: outcome.domain,
-		changedPaths: outcome.changedPaths,
-		dryRun: outcome.dryRun
+		ok: task.ok,
+		action: task.action,
+		domain: task.domain,
+		changedPaths: task.changedPaths,
+		dryRun: task.dryRun
 	};
-	if (outcome.target !== void 0) payload.target = outcome.target;
-	if (outcome.errors?.length) payload.errors = outcome.errors;
-	if (outcome.value !== void 0) payload.value = outcome.value;
-	if (outcome.notes?.length) payload.notes = outcome.notes;
+	if (task.target !== void 0) payload.target = task.target;
+	if (task.errors?.length) payload.errors = task.errors;
+	if (task.value !== void 0) payload.value = task.value;
+	if (task.notes?.length) payload.notes = task.notes;
 	process.stdout.write(JSON.stringify(payload) + "\n");
 }
 const ACTION_VERB = {
@@ -25,28 +25,28 @@ const ACTION_VERB = {
 	remove: "Removed",
 	noop: "No change"
 };
-function printTextOutcome(outcome) {
-	if (!outcome.ok) {
-		console.error(colors.red("✗") + " " + colors.bold(`${outcome.domain} ${outcome.action}`) + " failed");
-		for (const err of outcome.errors ?? []) {
+function printTextTask(task) {
+	if (!task.ok) {
+		console.error(colors.red("✗") + " " + colors.bold(`${task.domain} ${task.action}`) + " failed");
+		for (const err of task.errors ?? []) {
 			const where = err.path ? colors.gray(`[${err.path}] `) : "";
 			console.error(`  ${where}${err.message}`);
 		}
 		return;
 	}
-	const target = outcome.target ? ` ${colors.bold(outcome.target)}` : "";
-	const verb = ACTION_VERB[outcome.action];
-	const dryRun = outcome.dryRun ? colors.yellow(" [dry-run]") : "";
-	console.log(colors.green("✓") + ` ${verb} ${outcome.domain}${target}${dryRun}`);
-	if (outcome.changedPaths.length > 0) {
+	const target = task.target ? ` ${colors.bold(task.target)}` : "";
+	const verb = ACTION_VERB[task.action];
+	const dryRun = task.dryRun ? colors.yellow(" [dry-run]") : "";
+	console.log(colors.green("✓") + ` ${verb} ${task.domain}${target}${dryRun}`);
+	if (task.changedPaths.length > 0) {
 		console.log(colors.gray("  Changed paths:"));
-		for (const path of outcome.changedPaths) console.log(`    ${colors.cyan(path)}`);
-	} else if (outcome.action === "noop") console.log(colors.gray("  Nothing to change."));
-	for (const note of outcome.notes ?? []) console.log(`  ${colors.gray("→")} ${note}`);
+		for (const path of task.changedPaths) console.log(`    ${colors.cyan(path)}`);
+	} else if (task.action === "noop") console.log(colors.gray("  Nothing to change."));
+	for (const note of task.notes ?? []) console.log(`  ${colors.gray("→")} ${note}`);
 }
-function emitOutcome(outcome, json) {
-	if (json) printJsonOutcome(outcome);
-	else printTextOutcome(outcome);
+function emitTask(task, json) {
+	if (json) printJsonTask(task);
+	else printTextTask(task);
 }
 //#endregion
-export { emitOutcome, printJsonOutcome, printTextOutcome };
+export { emitTask, printJsonTask, printTextTask };

package/dist/src/cli/commands/setup-shared/runner.d.ts

@@ -1,5 +1,5 @@
 import { type Config } from '../../../config/schema.js';
-import { type SetupAction, type SetupError, type SetupOutcome, type SetupRunOptions } from './types.js';
+import { type SetupAction, type SetupError, type SetupTask, type SetupRunOptions } from './types.js';
 /** Thrown by a {@link SetupMutator.mutate} to fail the run with a clean message. */
 export declare class SetupValidationError extends Error {
     readonly errors: SetupError[];
@@ -14,9 +14,9 @@ export interface SetupMutator {
     action: SetupAction;
     /** Mutates `config` in place (or returns a replacement) and returns it. */
     mutate(config: Config): Config | Promise<Config>;
-    /** Optional masked value to surface in the outcome (for agents / UI). */
+    /** Optional masked value to surface in the task (for agents / UI). */
     resultValue?(config: Config): unknown;
-    /** Optional human-readable notes appended to the outcome. */
+    /** Optional human-readable notes appended to the task. */
     notes?(config: Config): string[];
 }
 export interface RunSetupArgs {
@@ -26,24 +26,24 @@ export interface RunSetupArgs {
 }
 /**
  * Headless setup pipeline — load → clone → mutate → validate(zod) → diff →
- * (write | dry-run) → outcome. Returns the {@link SetupOutcome} without any
+ * (write | dry-run) → task. Returns the {@link SetupTask} without any
  * I/O side effects (no stdout, no `process.exitCode`).
  *
  * Used by CLI setup commands via {@link runSetup}. Keep this side-effect-free
  * so it stays safe to call from tests and other programmatic callers.
  *
- * Custom errors thrown by the mutator surface as `errors[]` on the outcome:
+ * Custom errors thrown by the mutator surface as `errors[]` on the task:
  *   - `SetupValidationError` — explicit `{path?, message}[]` entries
  *   - `ExitPromptError` (from `@inquirer/prompts`) — surfaced as "Cancelled by user"
  *   - any other `Error` — the message is used verbatim
  */
-export declare function runSetupHeadless(args: RunSetupArgs): Promise<SetupOutcome>;
+export declare function runSetupHeadless(args: RunSetupArgs): Promise<SetupTask>;
 /**
- * CLI wrapper around {@link runSetupHeadless}: emits the outcome to stdout
+ * CLI wrapper around {@link runSetupHeadless}: emits the task to stdout
  * (text or single-line JSON) and sets `process.exitCode` to the standard
  * setup exit codes (0 ok / 1 error / 2 cancelled).
  *
  * Use this from CLI command actions; use {@link runSetupHeadless} from any
  * non-CLI caller (HTTP routes, library code, tests).
  */
-export declare function runSetup(args: RunSetupArgs): Promise<SetupOutcome>;
+export declare function runSetup(args: RunSetupArgs): Promise<SetupTask>;

package/dist/src/cli/commands/setup-shared/runner.js

@@ -3,7 +3,7 @@ import { loadConfig, saveConfig } from "../../../config/loader.js";
 import { diffConfigPaths } from "../../../config/diff.js";
 import "../../../config/index.js";
 import { SETUP_EXIT } from "./types.js";
-import { emitOutcome } from "./output.js";
+import { emitTask } from "./output.js";
 import { isPromptCancelled } from "./prompts.js";
 //#region src/cli/commands/setup-shared/runner.ts
 init_schema();
@@ -25,13 +25,13 @@ function zodErrorToSetupErrors(err) {
 }
 /**
 * Headless setup pipeline — load → clone → mutate → validate(zod) → diff →
-* (write | dry-run) → outcome. Returns the {@link SetupOutcome} without any
+* (write | dry-run) → task. Returns the {@link SetupTask} without any
 * I/O side effects (no stdout, no `process.exitCode`).
 *
 * Used by CLI setup commands via {@link runSetup}. Keep this side-effect-free
 * so it stays safe to call from tests and other programmatic callers.
 *
-* Custom errors thrown by the mutator surface as `errors[]` on the outcome:
+* Custom errors thrown by the mutator surface as `errors[]` on the task:
 *   - `SetupValidationError` — explicit `{path?, message}[]` entries
 *   - `ExitPromptError` (from `@inquirer/prompts`) — surfaced as "Cancelled by user"
 *   - any other `Error` — the message is used verbatim
@@ -117,7 +117,7 @@ async function runSetupHeadless(args) {
 	};
 }
 /**
-* CLI wrapper around {@link runSetupHeadless}: emits the outcome to stdout
+* CLI wrapper around {@link runSetupHeadless}: emits the task to stdout
 * (text or single-line JSON) and sets `process.exitCode` to the standard
 * setup exit codes (0 ok / 1 error / 2 cancelled).
 *
@@ -125,12 +125,12 @@ async function runSetupHeadless(args) {
 * non-CLI caller (HTTP routes, library code, tests).
 */
 async function runSetup(args) {
-	const outcome = await runSetupHeadless(args);
-	emitOutcome(outcome, args.options.json);
-	if (outcome.ok) process.exitCode = SETUP_EXIT.OK;
-	else if (outcome.errors?.some((e) => /cancelled/i.test(e.message))) process.exitCode = SETUP_EXIT.CANCELLED;
+	const task = await runSetupHeadless(args);
+	emitTask(task, args.options.json);
+	if (task.ok) process.exitCode = SETUP_EXIT.OK;
+	else if (task.errors?.some((e) => /cancelled/i.test(e.message))) process.exitCode = SETUP_EXIT.CANCELLED;
 	else process.exitCode = SETUP_EXIT.ERROR;
-	return outcome;
+	return task;
 }
 //#endregion
 export { SetupValidationError, runSetup, runSetupHeadless };

package/dist/src/cli/commands/setup-shared/types.d.ts

@@ -2,7 +2,7 @@
  * Shared types for `xopc <domain>` setup-style commands (providers / channels / ...).
  *
  * Every setup command runs the same load → mutate → validate → diff → write
- * pipeline, and emits the same structured outcome so agents (M2 skills) and the
+ * pipeline, and emits the same structured task so agents (M2 skills) and the
  * WebUI (M3) can consume results uniformly.
  */
 export type SetupAction = 'add' | 'set' | 'remove' | 'noop';
@@ -11,7 +11,7 @@ export interface SetupError {
     path?: string;
     message: string;
 }
-export interface SetupOutcome {
+export interface SetupTask {
     ok: boolean;
     action: SetupAction;
     /** Logical domain — `providers`, `channels.<id>`, etc. */

package/dist/src/cli/commands/skills.d.ts

@@ -4,6 +4,13 @@
  * Manage skills: list, install, enable/disable, configure, test
  */
 import { Command } from 'commander';
+import { type LoadSkillsResult } from '../../agent/skills/index.js';
+import { ProjectTrustStore } from '../../project-trust/trust-store.js';
 import { type CLIContext } from '../registry.js';
+export interface WorkspaceSkillCatalogOptions {
+    trustStore?: Pick<ProjectTrustStore, 'get'>;
+    bundledSkillsDir?: string | null;
+}
+export declare function loadWorkspaceSkillCatalog(workspaceDir: string, options?: WorkspaceSkillCatalogOptions): LoadSkillsResult;
 declare function createSkillsCommand(ctx: CLIContext): Command;
 export { createSkillsCommand };

package/dist/src/cli/commands/skills.js

@@ -6,6 +6,7 @@ import { formatScanSummary, scanSkillDirectory } from "../../agent/skills/scanne
 import { createSkillLoader } from "../../agent/skills/index.js";
 import { loadSkillsLock } from "../../agent/skills/hub-lock.js";
 import { pullSkillFromSource, updateSkillFromLock } from "../../agent/skills/hub-pull.js";
+import { ProjectTrustStore } from "../../project-trust/trust-store.js";
 import { register } from "../registry.js";
 import { createSkillsTestCommand } from "./skills-test.js";
 import { Command } from "commander";
@@ -16,10 +17,15 @@ import { Command } from "commander";
 * Manage skills: list, install, enable/disable, configure, test
 */
 init_paths();
+function loadWorkspaceSkillCatalog(workspaceDir, options = {}) {
+	const trustStore = options.trustStore ?? new ProjectTrustStore();
+	const loader = createSkillLoader({ isWorkspaceTrusted: (resolvedPath) => trustStore.get(resolvedPath) === true });
+	const bundledSkillsDir = options.bundledSkillsDir === void 0 ? resolveBundledSkillsDir() : options.bundledSkillsDir;
+	loader.init(workspaceDir, bundledSkillsDir);
+	return loader.load();
+}
 function loadWorkspaceSkillEntries(workspaceDir) {
-	const loader = createSkillLoader();
-	loader.init(workspaceDir, resolveBundledSkillsDir());
-	return loader.load().skills.map((skill) => ({
+	return loadWorkspaceSkillCatalog(workspaceDir).skills.map((skill) => ({
 		skill,
 		metadata: skill.metadata,
 		enabled: true
@@ -29,10 +35,8 @@ function createSkillsCommand(ctx) {
 	const command = new Command("skills");
 	command.description("Manage skills");
 	command.command("list").description("List available skills").option("-v, --verbose", "Show detailed information").option("--json", "Output as JSON").action(async (options) => {
-		const loader = createSkillLoader();
 		const workspaceDir = ctx.workspacePath;
-		loader.init(workspaceDir, resolveBundledSkillsDir());
-		const result = loader.load();
+		const result = loadWorkspaceSkillCatalog(workspaceDir);
 		if (options.json) {
 			console.log(JSON.stringify({
 				skills: result.skills.map((s) => ({
@@ -78,12 +82,12 @@ function createSkillsCommand(ctx) {
 	});
 	command.command("install <skill-name>").description("Install a skill dependency").option("-i, --id <install-id>", "Install spec ID to use").option("--timeout <ms>", "Installation timeout in ms", "300000").option("--dry-run", "Show what would be installed without executing").action(async (skillName, options) => {
 		const workspaceDir = ctx.workspacePath;
-		const entry = loadWorkspaceSkillEntries(workspaceDir).find((e) => e.skill.name === skillName);
+		const entries = loadWorkspaceSkillEntries(workspaceDir);
+		const entry = entries.find((e) => e.skill.name === skillName);
 		if (!entry) {
 			console.error(`Error: Skill "${skillName}" not found in workspace`);
 			console.log("\nAvailable skills:");
-			const result = createSkillLoader().load();
-			for (const skill of result.skills) console.log(`  - ${skill.name}`);
+			for (const { skill } of entries) console.log(`  - ${skill.name}`);
 			process.exit(1);
 		}
 		const installSpecs = entry.metadata.xopc?.install || entry.metadata.install || [];
@@ -143,10 +147,8 @@ function createSkillsCommand(ctx) {
 		console.log(`✓ Skill "${skillName}" disabled`);
 	});
 	command.command("status [skill-name]").description("Show skill status").option("--json", "Output as JSON").action(async (skillName, options) => {
-		const loader = createSkillLoader();
 		const workspaceDir = ctx.workspacePath;
-		loader.init(workspaceDir, resolveBundledSkillsDir());
-		const result = loader.load();
+		const result = loadWorkspaceSkillCatalog(workspaceDir);
 		const config = createSkillConfigManager(resolveStateDir()).load();
 		if (skillName) {
 			const skill = result.skills.find((s) => s.name === skillName);
@@ -213,10 +215,8 @@ function createSkillsCommand(ctx) {
 		}
 	});
 	command.command("audit [skill-name]").description("Security audit for skills").option("--deep", "Show detailed findings").action(async (skillName, options) => {
-		const loader = createSkillLoader();
 		const workspaceDir = ctx.workspacePath;
-		loader.init(workspaceDir, resolveBundledSkillsDir());
-		const result = loader.load();
+		const result = loadWorkspaceSkillCatalog(workspaceDir);
 		async function auditSkill(skill) {
 			const summary = await scanSkillDirectory(skill.baseDir);
 			console.log(`\n${formatScanSummary(summary, skill.name)}\n`);
@@ -359,4 +359,4 @@ register({
 	}
 });
 //#endregion
-export { createSkillsCommand };
+export { createSkillsCommand, loadWorkspaceSkillCatalog };