agent-skillboard 0.1.0

package/src/index.mjs

@@ -0,0 +1,82 @@
+import { loadWorkspace } from "./workspace.mjs";
+import { checkPolicy } from "./policy.mjs";
+import { doctorProject } from "./doctor.mjs";
+import { impactDisable } from "./impact.mjs";
+import { renderDashboard, renderReconcilePlan } from "./report.mjs";
+import { reconcileWorkspace } from "./reconcile.mjs";
+import { initProject } from "./init.mjs";
+import { agentInventoryDetectors, discoverAgentSkillInventory, mergeAgentSkillInventory } from "./agent-inventory.mjs";
+import { refreshAgentInventory } from "./inventory-refresh.mjs";
+import { uninstallProject } from "./uninstall.mjs";
+import { importSource, loadSourceProfile, mergeImportFragment, renderImportFragment } from "./source-profiles.mjs";
+import { verifySources, writeLockfile } from "./source-verification.mjs";
+import { refreshSourcePins } from "./source-cache.mjs";
+import { detectInstallOutput } from "./install-output-detector.mjs";
+import { rolloutApply, rolloutAudit, rolloutPlan, rolloutReport, rolloutRollback } from "./rollout.mjs";
+import { reviewInstallUnit } from "./review.mjs";
+import { buildSkillBrief } from "./advisor.mjs";
+import {
+  activateSkill,
+  addHarness,
+  addSkill,
+  addWorkflow,
+  auditSources,
+  blockSkill,
+  canUseSkill,
+  explainSkill,
+  installGuardHook,
+  listHarnesses,
+  listInstallUnits,
+  listSkills,
+  listWorkflows,
+  preferSkill,
+  quarantineSkill,
+  removeSkill
+} from "./control.mjs";
+
+export {
+  activateSkill,
+  addHarness,
+  addSkill,
+  addWorkflow,
+  agentInventoryDetectors,
+  auditSources,
+  blockSkill,
+  buildSkillBrief,
+  canUseSkill,
+  checkPolicy,
+  discoverAgentSkillInventory,
+  detectInstallOutput,
+  doctorProject,
+  explainSkill,
+  impactDisable,
+  importSource,
+  initProject,
+  installGuardHook,
+  listHarnesses,
+  listInstallUnits,
+  listSkills,
+  listWorkflows,
+  loadSourceProfile,
+  loadWorkspace,
+  mergeAgentSkillInventory,
+  mergeImportFragment,
+  preferSkill,
+  quarantineSkill,
+  removeSkill,
+  reconcileWorkspace,
+  refreshAgentInventory,
+  refreshSourcePins,
+  renderDashboard,
+  reviewInstallUnit,
+  rolloutApply,
+  rolloutAudit,
+  rolloutPlan,
+  rolloutReport,
+  rolloutRollback,
+  renderImportFragment,
+  renderReconcilePlan,
+  uninstallProject,
+  verifySources,
+  writeLockfile
+};

package/src/init.mjs

@@ -0,0 +1,136 @@
+import { access, mkdir, readFile, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import YAML from "yaml";
+import { NON_CALLABLE_WORKFLOW_INVOCATIONS, NON_CALLABLE_WORKFLOW_STATUSES } from "./domain/constants.mjs";
+import { isValidSkillState } from "./domain/skill-state-matrix.mjs";
+import { refreshAgentInventory } from "./inventory-refresh.mjs";
+import { BRIDGE_START, bridgeBlock, defaultConfig, hookReadme, profileReadme } from "./lifecycle-content.mjs";
+
+export async function initProject(options) {
+  const root = options.root;
+  const configPath = join(root, "skillboard.config.yaml");
+  const skillsRoot = join(root, "skills");
+  const reportRoot = join(root, ".skillboard", "reports");
+  const profileRoot = join(root, ".skillboard", "profiles");
+  const hookRoot = join(root, ".skillboard", "hooks");
+  const created = [];
+  const updated = [];
+  await mkdir(skillsRoot, { recursive: true });
+  await mkdir(reportRoot, { recursive: true });
+  await mkdir(profileRoot, { recursive: true });
+  await mkdir(hookRoot, { recursive: true });
+  const configCreated = !(await exists(configPath));
+  if (configCreated) {
+    await writeFile(configPath, defaultConfig(), "utf8");
+    created.push("skillboard.config.yaml");
+  }
+  const profileReadmePath = join(profileRoot, "README.md");
+  if (!(await exists(profileReadmePath))) {
+    await writeFile(profileReadmePath, profileReadme(), "utf8");
+    created.push(".skillboard/profiles/README.md");
+  }
+  const hookReadmePath = join(hookRoot, "README.md");
+  if (!(await exists(hookReadmePath))) {
+    await writeFile(hookReadmePath, hookReadme(), "utf8");
+    created.push(".skillboard/hooks/README.md");
+  }
+  for (const filename of ["AGENTS.md", "CLAUDE.md"]) {
+    const result = await ensureBridge(join(root, filename));
+    if (result === "created") {
+      created.push(filename);
+    } else if (result === "updated") {
+      updated.push(filename);
+    }
+  }
+  const scan = options.scanInstalled === false
+    ? { scannedSkills: 0, scannedInstallUnits: 0, changed: false, addedSkills: [], addedInstallUnits: [], updatedInstallUnits: [], addedWorkflows: [], addedHarnesses: [], skippedSkills: [], reviewNotes: [], warnings: [] }
+    : await mergeInstalledAgentSkills(configPath, {
+      roots: options.scanRoots,
+      home: options.home,
+      env: options.env
+    });
+  if (scan.changed && !configCreated) {
+    updated.push("skillboard.config.yaml");
+  }
+  const safety = await summarizeSafety(configPath);
+  return {
+    created,
+    updated,
+    scan,
+    safety,
+    alreadyInitialized: created.length === 0 && updated.length === 0 && !scan.changed
+  };
+}
+
+async function exists(path) {
+  return access(path).then(() => true, () => false);
+}
+
+async function ensureBridge(path) {
+  const block = bridgeBlock();
+  if (!(await exists(path))) {
+    await writeFile(path, `${block}\n`, "utf8");
+    return "created";
+  }
+  const current = await readFile(path, "utf8");
+  if (current.includes(BRIDGE_START)) {
+    return "unchanged";
+  }
+  const separator = current.endsWith("\n") ? "\n" : "\n\n";
+  await writeFile(path, `${current}${separator}${block}\n`, "utf8");
+  return "updated";
+}
+
+async function mergeInstalledAgentSkills(configPath, options) {
+  const result = await refreshAgentInventory({
+    root: dirname(configPath),
+    configPath,
+    roots: options.roots,
+    home: options.home,
+    env: options.env
+  });
+  return {
+    scannedSkills: result.scan.scannedSkills,
+    scannedInstallUnits: result.scan.scannedInstallUnits,
+    changed: result.changed,
+    addedSkills: result.scan.addedSkills,
+    addedInstallUnits: result.scan.addedInstallUnits,
+    updatedInstallUnits: result.scan.updatedInstallUnits,
+    addedWorkflows: result.scan.addedWorkflows,
+    addedHarnesses: result.scan.addedHarnesses,
+    skippedSkills: result.scan.skippedSkills,
+    reviewNotes: result.scan.reviewNotes,
+    warnings: result.scan.warnings
+  };
+}
+
+async function summarizeSafety(configPath) {
+  const config = YAML.parse(await readFile(configPath, "utf8")) ?? {};
+  const skills = config.skills && typeof config.skills === "object" ? Object.values(config.skills) : [];
+  let automatic = 0;
+  let manualOnly = 0;
+  let routerOnly = 0;
+  let blocked = 0;
+  for (const rawSkill of skills) {
+    const skill = rawSkill && typeof rawSkill === "object" ? rawSkill : {};
+    const status = typeof skill.status === "string" ? skill.status : "vendor";
+    const invocation = typeof skill.invocation === "string" ? skill.invocation : "manual-only";
+    if (NON_CALLABLE_WORKFLOW_STATUSES.has(status) || NON_CALLABLE_WORKFLOW_INVOCATIONS.has(invocation)) {
+      blocked += 1;
+      continue;
+    }
+    if (!isValidSkillState(status, invocation)) {
+      continue;
+    }
+    if (["workflow-auto", "global-auto"].includes(invocation)) {
+      automatic += 1;
+    }
+    if (invocation === "manual-only") {
+      manualOnly += 1;
+    }
+    if (invocation === "router-only") {
+      routerOnly += 1;
+    }
+  }
+  return { automatic, manualOnly, routerOnly, blocked };
+}

package/src/install-output-detector.mjs

@@ -0,0 +1,337 @@
+import { readFile, writeFile } from "node:fs/promises";
+import { isAbsolute, relative, resolve } from "node:path";
+import YAML from "yaml";
+import { textChangePlan } from "./change-plan.mjs";
+
+export async function detectInstallOutput(options = {}) {
+  const root = resolve(options.root ?? ".");
+  const configPath = resolveUnderRoot(root, options.configPath ?? "skillboard.config.yaml");
+  const unitId = requireOption(options.unitId, "unit");
+  const dryRun = options.dryRun === true;
+  const originalText = await readFile(configPath, "utf8");
+  const document = YAML.parseDocument(originalText);
+  if (document.errors.length > 0) {
+    throw new Error(`Invalid YAML config: ${document.errors.map((error) => error.message).join("; ")}`);
+  }
+  const installOutput = options.installOutputPath === undefined ? "" : await readFile(options.installOutputPath, "utf8");
+  const configFiles = options.configFiles ?? [];
+  const configTexts = await Promise.all(configFiles.map(async (path) => {
+    return { path, text: await readFile(path, "utf8").catch(() => "") };
+  }));
+  const detected = detectRuntimeMetadata(installOutput, configTexts, root);
+  const unit = ensureInstallUnit(document, unitId, {
+    kind: options.kind ?? "plugin",
+    source: options.source ?? "",
+    scope: options.scope ?? "user-global"
+  });
+  const changedFields = mergeDetectedMetadata(unit, detected, document);
+  const nextText = preserveLineEndings(String(document), originalText);
+  const plan = textChangePlan(originalText, nextText);
+  if (plan.changed && !dryRun) {
+    await writeFile(configPath, nextText, "utf8");
+  }
+  return {
+    dryRun,
+    configPath,
+    unitId,
+    changed: plan.changed,
+    plan,
+    detected,
+    changedFields
+  };
+}
+
+export function detectRuntimeMetadata(installOutput, configTexts = [], root = process.cwd()) {
+  const commands = new Set();
+  const hooks = new Set();
+  const mcpServers = new Set();
+  const modifiedConfigFiles = new Set();
+
+  collectFromText(installOutput, { commands, hooks, mcpServers, modifiedConfigFiles }, root);
+  for (const entry of configTexts) {
+    if (entry.path !== undefined) {
+      modifiedConfigFiles.add(displayPath(entry.path, root));
+    }
+    collectFromConfigText(entry.text, { commands, hooks, mcpServers });
+  }
+
+  return {
+    commands: [...commands].sort((left, right) => left.localeCompare(right)),
+    hooks: [...hooks].sort((left, right) => left.localeCompare(right)),
+    mcpServers: [...mcpServers].sort((left, right) => left.localeCompare(right)),
+    modifiedConfigFiles: [...modifiedConfigFiles].sort((left, right) => left.localeCompare(right))
+  };
+}
+
+function collectFromText(text, output, root) {
+  for (const match of text.matchAll(/\$[A-Za-z][A-Za-z0-9_:-]*/gu)) {
+    output.commands.add(match[0]);
+  }
+  collectLabeledValues(text, /\bcommands?\b\s*[:=]\s*(?<values>[^\n]+)/giu, output.commands, normalizeCommand);
+  collectLabeledValues(text, /\bhooks?\b\s*[:=]\s*(?<values>[^\n]+)/giu, output.hooks, normalizeHook);
+  collectLabeledValues(text, /\bmcp[-_ ]?servers?\b\s*[:=]\s*(?<values>[^\n]+)/giu, output.mcpServers, normalizeIdentifier);
+  collectLabeledValues(text, /\b(?:updated|modified|patched|wrote|writing)\s+(?<values>[^\n]+(?:config|settings)[^\n]*)/giu, output.modifiedConfigFiles, (value) => normalizePath(value, root));
+}
+
+function collectFromConfigText(text, output) {
+  const parsed = parseJsonObject(text);
+  if (parsed !== null) {
+    collectFromObject(parsed, output);
+  }
+  collectLabeledValues(text, /\bcommands?\b\s*[:=]\s*\[?(?<values>[^\]\n]+)\]?/giu, output.commands, normalizeCommand);
+  collectLabeledValues(text, /\bhooks?\b\s*[:=]\s*\[?(?<values>[^\]\n]+)\]?/giu, output.hooks, normalizeHook);
+  for (const match of text.matchAll(/\[(?:mcp_servers|mcpServers)\.(?<name>[A-Za-z0-9_.:-]+)\]/gu)) {
+    output.mcpServers.add(match.groups.name);
+  }
+  for (const match of text.matchAll(/"(?<name>[A-Za-z0-9_.:-]+)"\s*:\s*\{[^{}]*"command"\s*:/gu)) {
+    output.mcpServers.add(match.groups.name);
+  }
+}
+
+function collectFromObject(value, output) {
+  if (value === null || typeof value !== "object") {
+    return;
+  }
+  if (Array.isArray(value)) {
+    for (const entry of value) {
+      collectFromObject(entry, output);
+    }
+    return;
+  }
+  for (const [key, entry] of Object.entries(value)) {
+    if (key === "commands") {
+      collectStringValues(entry, output.commands, normalizeCommand);
+    } else if (key === "hooks") {
+      collectStringValues(entry, output.hooks, normalizeHook);
+    } else if (key === "mcpServers" || key === "mcp_servers") {
+      collectObjectKeys(entry, output.mcpServers);
+    }
+    collectFromObject(entry, output);
+  }
+}
+
+function collectStringValues(value, target, normalize) {
+  if (typeof value === "string") {
+    addNormalized(target, normalize(value));
+  } else if (Array.isArray(value)) {
+    for (const entry of value) {
+      collectStringValues(entry, target, normalize);
+    }
+  } else if (value !== null && typeof value === "object") {
+    collectObjectKeys(value, target);
+  }
+}
+
+function collectObjectKeys(value, target) {
+  if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+    for (const key of Object.keys(value)) {
+      addNormalized(target, normalizeIdentifier(key));
+    }
+  }
+}
+
+function collectLabeledValues(text, pattern, target, normalize) {
+  for (const match of text.matchAll(pattern)) {
+    for (const value of splitValues(match.groups.values)) {
+      addNormalized(target, normalize(value));
+    }
+  }
+}
+
+function splitValues(value) {
+  return value
+    .split(/[,\s]+/u)
+    .map((entry) => entry.trim().replace(/^['"`\[]+|['"`\].:;]+$/gu, ""))
+    .filter((entry) => entry.length > 0);
+}
+
+function mergeDetectedMetadata(unit, detected, document) {
+  const changedFields = [];
+  const components = ensureNestedMap(unit, "components", document);
+  if (appendValues(components, "commands", detected.commands, document)) {
+    changedFields.push("components.commands");
+  }
+  if (appendValues(components, "hooks", detected.hooks, document)) {
+    changedFields.push("components.hooks");
+  }
+  if (appendValues(components, "mcp_servers", detected.mcpServers, document)) {
+    changedFields.push("components.mcp_servers");
+  }
+  const provided = componentNames(detected);
+  if (appendValues(unit, "provided_components", provided, document)) {
+    changedFields.push("provided_components");
+  }
+  if (appendValues(unit, "modified_config_files", detected.modifiedConfigFiles, document)) {
+    changedFields.push("modified_config_files");
+  }
+  const risk = detected.hooks.length > 0 || detected.mcpServers.length > 0
+    ? "high"
+    : detected.commands.length > 0 ? "medium" : "";
+  if (setIfHigherRisk(unit, risk)) {
+    changedFields.push("permission_risk");
+  }
+  return changedFields;
+}
+
+function ensureInstallUnit(document, id, defaults) {
+  const units = ensureMap(document, "install_units");
+  const existing = units.get(id, true);
+  if (existing !== undefined) {
+    return requireYamlMap(existing, `install_units.${id}`);
+  }
+  const unit = document.createNode({
+    kind: defaults.kind,
+    trust_level: "unreviewed",
+    source: defaults.source,
+    scope: defaults.scope,
+    provided_components: [],
+    components: {},
+    modified_config_files: [],
+    auto_update: false,
+    enabled: true,
+    permission_risk: "unknown",
+    rollback: "manual"
+  });
+  units.set(id, unit);
+  return requireYamlMap(unit, `install_units.${id}`);
+}
+
+function ensureMap(document, key) {
+  const existing = document.get(key, true);
+  if (existing === undefined) {
+    const next = document.createNode({});
+    next.flow = false;
+    document.set(key, next);
+    return next;
+  }
+  return requireYamlMap(existing, key);
+}
+
+function ensureNestedMap(parent, key, document) {
+  const existing = parent.get(key, true);
+  if (existing === undefined) {
+    const next = document.createNode({});
+    next.flow = false;
+    parent.set(key, next);
+    return next;
+  }
+  return requireYamlMap(existing, key);
+}
+
+function appendValues(parent, key, values, document) {
+  if (values.length === 0) {
+    return false;
+  }
+  const seq = ensureSeq(parent, key, document);
+  const before = seq.items.length;
+  for (const value of values) {
+    if (!seq.items.some((item) => item?.value === value)) {
+      seq.add(document.createNode(value));
+    }
+  }
+  return seq.items.length !== before;
+}
+
+function ensureSeq(parent, key, document) {
+  const existing = parent.get(key, true);
+  if (existing === undefined) {
+    const next = document.createNode([]);
+    next.flow = false;
+    parent.set(key, next);
+    return next;
+  }
+  if (!YAML.isSeq(existing)) {
+    throw new Error(`${key} must be a sequence`);
+  }
+  return existing;
+}
+
+function requireYamlMap(value, label) {
+  if (!YAML.isMap(value)) {
+    throw new Error(`${label} must be a mapping`);
+  }
+  value.flow = false;
+  return value;
+}
+
+function setIfHigherRisk(unit, risk) {
+  if (risk.length === 0) {
+    return false;
+  }
+  const rank = { unknown: 0, low: 1, medium: 2, high: 3 };
+  const current = unit.get("permission_risk");
+  if ((rank[risk] ?? 0) <= (rank[current] ?? 0)) {
+    return false;
+  }
+  unit.set("permission_risk", risk);
+  return true;
+}
+
+function componentNames(detected) {
+  const names = [];
+  if (detected.commands.length > 0) {
+    names.push("commands");
+  }
+  if (detected.hooks.length > 0) {
+    names.push("hook");
+  }
+  if (detected.mcpServers.length > 0) {
+    names.push("mcp-server");
+  }
+  return names;
+}
+
+function parseJsonObject(text) {
+  try {
+    const parsed = JSON.parse(text);
+    return parsed !== null && typeof parsed === "object" ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+function addNormalized(target, value) {
+  if (value.length > 0) {
+    target.add(value);
+  }
+}
+
+function normalizeCommand(value) {
+  const trimmed = normalizeIdentifier(value);
+  return trimmed.startsWith("$") ? trimmed : `$${trimmed}`;
+}
+
+function normalizeHook(value) {
+  return normalizeIdentifier(value).replace(/\.json$/u, "");
+}
+
+function normalizeIdentifier(value) {
+  return value.trim().replace(/^['"`\[]+|['"`\].:;]+$/gu, "");
+}
+
+function normalizePath(value, root) {
+  return displayPath(normalizeIdentifier(value), root);
+}
+
+function displayPath(path, root) {
+  if (!isAbsolute(path)) {
+    return path.replaceAll("\\", "/");
+  }
+  const rel = relative(root, path).replaceAll("\\", "/");
+  return rel.startsWith("..") ? path : rel;
+}
+
+function resolveUnderRoot(root, path) {
+  return isAbsolute(path) ? path : resolve(root, path);
+}
+
+function preserveLineEndings(text, reference) {
+  return reference.includes("\r\n") ? text.replace(/\n/g, "\r\n") : text;
+}
+
+function requireOption(value, name) {
+  if (value === undefined || value.trim() === "") {
+    throw new Error(`Missing required option: --${name}`);
+  }
+  return value;
+}

package/src/install-units.mjs

@@ -0,0 +1,62 @@
+import { readBoolean, readOptionalNumber, readOptionalString, readString, readStringList, requireRecord } from "./config-helpers.mjs";
+import { INSTALL_UNIT_KIND_VALUES, PERMISSION_RISK_VALUES, TRUST_LEVEL_VALUES } from "./domain/constants.mjs";
+
+export function parseInstallUnits(value) {
+  const raw = requireRecord(value ?? {}, "install_units");
+  return Object.entries(raw).map(([id, entry]) => {
+    const unit = requireRecord(entry, `install_units.${id}`);
+    const kind = readString(unit, "kind", "skill");
+    const permissionRisk = readString(unit, "permission_risk", "unknown");
+    const trustLevel = readString(unit, "trust_level", "unreviewed");
+    const sourceDigest = readOptionalString(unit, "source_digest");
+    const signature = readOptionalString(unit, "signature");
+    const publicKey = readOptionalString(unit, "public_key");
+    const verifiedAt = readOptionalString(unit, "verified_at");
+    if (!INSTALL_UNIT_KIND_VALUES.has(kind)) {
+      throw new Error(`Unsupported install unit kind for ${id}: ${kind}`);
+    }
+    if (!PERMISSION_RISK_VALUES.has(permissionRisk)) {
+      throw new Error(`Unsupported permission risk for ${id}: ${permissionRisk}`);
+    }
+    if (!TRUST_LEVEL_VALUES.has(trustLevel)) {
+      throw new Error(`Unsupported trust level for ${id}: ${trustLevel}`);
+    }
+    return {
+      id,
+      kind,
+      sourceClass: readOptionalString(unit, "source_class"),
+      priority: readOptionalNumber(unit, "priority"),
+      trustLevel,
+      sourceDigest: nonEmpty(sourceDigest),
+      signature: nonEmpty(signature),
+      publicKey: nonEmpty(publicKey),
+      verifiedAt: nonEmpty(verifiedAt),
+      source: readString(unit, "source", ""),
+      scope: readString(unit, "scope", "local"),
+      manifestPath: readString(unit, "manifest_path", ""),
+      cachePath: readString(unit, "cache_path", ""),
+      providedComponents: readStringList(unit, "provided_components"),
+      components: parseComponents(unit.components, `install_units.${id}.components`),
+      modifiedConfigFiles: readStringList(unit, "modified_config_files"),
+      autoUpdate: readBoolean(unit, "auto_update", false),
+      enabled: readBoolean(unit, "enabled", false),
+      workflowDependencies: readStringList(unit, "workflow_dependencies"),
+      permissionRisk,
+      rollback: readString(unit, "rollback", "unknown")
+    };
+  });
+}
+
+function nonEmpty(value) {
+  return value === undefined || value.trim() === "" ? undefined : value;
+}
+
+function parseComponents(value, label) {
+  const raw = requireRecord(value ?? {}, label);
+  return {
+    skills: readStringList(raw, "skills"),
+    commands: readStringList(raw, "commands"),
+    hooks: readStringList(raw, "hooks"),
+    mcpServers: readStringList(raw, "mcp_servers")
+  };
+}

package/src/inventory-refresh.mjs

@@ -0,0 +1,45 @@
+import { readFile, writeFile } from "node:fs/promises";
+import { isAbsolute, resolve } from "node:path";
+import { discoverAgentSkillInventory, mergeAgentSkillInventory } from "./agent-inventory.mjs";
+import { textChangePlan } from "./change-plan.mjs";
+
+export async function refreshAgentInventory(options = {}) {
+  const root = resolve(options.root ?? ".");
+  const configPath = resolveUnderRoot(root, options.configPath ?? "skillboard.config.yaml");
+  const inventory = await discoverAgentSkillInventory({
+    roots: options.roots,
+    home: options.home,
+    env: options.env
+  });
+  const current = await readFile(configPath, "utf8");
+  const merged = mergeAgentSkillInventory(current, inventory);
+  const plan = textChangePlan(current, merged.text);
+  const dryRun = options.dryRun === true;
+
+  if (plan.changed && !dryRun) {
+    await writeFile(configPath, merged.text, "utf8");
+  }
+
+  return {
+    dryRun,
+    configPath,
+    changed: plan.changed,
+    plan,
+    scan: {
+      scannedSkills: inventory.skills.length,
+      scannedInstallUnits: inventory.installUnits.length,
+      addedSkills: merged.addedSkills,
+      addedInstallUnits: merged.addedInstallUnits,
+      updatedInstallUnits: merged.updatedInstallUnits,
+      addedWorkflows: merged.addedWorkflows,
+      addedHarnesses: merged.addedHarnesses,
+      skippedSkills: merged.skippedSkills,
+      reviewNotes: merged.reviewNotes,
+      warnings: inventory.warnings ?? []
+    }
+  };
+}
+
+function resolveUnderRoot(root, path) {
+  return isAbsolute(path) ? path : resolve(root, path);
+}