agent-skillboard 0.2.18 → 0.3.0

package/src/doctor.mjs

@@ -40,6 +40,7 @@ export async function doctorProject(options = {}) {
     },
     bridges,
     workspace: emptyWorkspaceSummary(),
+    inventory: { required: false, ok: true, path: null, errors: [] },
     policy: { ok: false, errors: [], warnings: [] },
     sources: { checked: false, verified: options.verifySources === true, ok: false, errors: [], warnings: [], blockingWarnings: [], units: [] },
     uninstall,
@@ -76,6 +77,7 @@ export async function doctorProject(options = {}) {
     : auditSources(workspace);
   const blockingWarnings = blockingSourceWarnings(sourceAudit.warnings);
   const workspaceSummary = summarizeWorkspace(workspace);
+  const inventory = inventoryHealth(workspace);
   const result = {
     ...base,
     initialized: true,
@@ -86,6 +88,7 @@ export async function doctorProject(options = {}) {
       error: null
     },
     workspace: workspaceSummary,
+    inventory,
     policy,
     sources: {
       checked: true,
@@ -102,10 +105,14 @@ export async function doctorProject(options = {}) {
 }
 
 function finalizeDoctor(result, recommendations) {
-  const bridgeOk = result.bridges.every((bridge) => bridge.status === "installed" || bridge.status === "absent")
-    && result.bridges.some((bridge) => bridge.status === "installed");
-  const ok = result.config.valid && bridgeOk && result.policy.ok && result.sources.ok;
-  const reviewRequired = ok && reviewRequiredFor(result);
+  const sourceAuditIsInformational = result.config.version === 2;
+  const bridgeOk = sourceAuditIsInformational || (
+    result.bridges.every((bridge) => bridge.status === "installed" || bridge.status === "absent")
+      && result.bridges.some((bridge) => bridge.status === "installed")
+  );
+  const ok = result.config.valid && bridgeOk && result.policy.ok && result.inventory.ok
+    && (sourceAuditIsInformational || result.sources.ok);
+  const reviewRequired = sourceAuditIsInformational ? false : ok && reviewRequiredFor(result);
   const strictOk = ok && !reviewRequired;
   return {
     ...result,
@@ -120,6 +127,15 @@ function finalizeDoctor(result, recommendations) {
 
 function doctorRecommendations(result) {
   const recommendations = [];
+  if (!result.inventory.ok) {
+    recommendations.push("run skillboard inventory refresh and fix generated inventory integrity errors");
+    for (const error of result.inventory.errors) {
+      const match = /^skill (?<skill>[^ ]+) is missing from generated inventory$/u.exec(error);
+      if (match?.groups?.skill !== undefined) {
+        recommendations.push(`reinstall ${match.groups.skill} or run skillboard skill forget ${match.groups.skill}`);
+      }
+    }
+  }
   if (!result.bridges.some((bridge) => bridge.status === "installed")) {
     recommendations.push("legacy project bridge blocks are absent; run skillboard init only if maintaining deprecated project-local policy");
   }
@@ -132,6 +148,9 @@ function doctorRecommendations(result) {
   if (!result.policy.ok) {
     recommendations.push("run skillboard check and fix policy errors");
   }
+  if (result.config.version === 2) {
+    return recommendations;
+  }
   if (!result.sources.ok) {
     recommendations.push("run skillboard audit sources --verify and fix source verification errors");
   } else if (result.sources.blockingWarnings.length > 0) {
@@ -148,6 +167,25 @@ function doctorRecommendations(result) {
   return recommendations;
 }
 
+function inventoryHealth(workspace) {
+  if (workspace.version !== 2) {
+    return { required: false, ok: true, path: null, errors: [] };
+  }
+  const errors = [...(workspace.inventory?.integrityErrors ?? ["generated inventory is unavailable"])];
+  const observed = new Set(workspace.inventory?.skillIds ?? []);
+  for (const skill of workspace.skills) {
+    if (!observed.has(skill.id)) {
+      errors.push(`skill ${skill.id} is missing from generated inventory`);
+    }
+  }
+  return {
+    required: true,
+    ok: errors.length === 0,
+    path: workspace.inventory?.path ?? null,
+    errors
+  };
+}
+
 function reviewRequiredFor(result) {
   return result.sources.blockingWarnings.length > 0
     || result.sources.warnings.length > 0
@@ -156,6 +194,13 @@ function reviewRequiredFor(result) {
 }
 
 function reviewSummaryFor(result) {
+  if (result.config.version === 2) {
+    return {
+      ...emptyReviewSummary(),
+      runtimeReady: result.workspace.skills.declared === 0 || result.workspace.skills.installed > 0,
+      auditInformational: true
+    };
+  }
   const highRiskReviewUnits = result.sources.units
     .filter((unit) => {
       return unit.permissionRisk === "high" && !["trusted", "reviewed"].includes(unit.trustLevel);
@@ -185,6 +230,20 @@ function blockingSourceWarnings(warnings) {
 }
 
 function summarizeWorkspace(workspace) {
+  if (workspace.version === 2) {
+    const enabled = workspace.skills.filter((skill) => skill.enabled).length;
+    return {
+      skills: {
+        declared: workspace.skills.length, installed: workspace.installedSkills.length,
+        enabled, disabled: workspace.skills.length - enabled,
+        shared: workspace.skills.filter((skill) => skill.shared).length,
+        local: workspace.skills.filter((skill) => !skill.shared).length,
+        modelSelectable: enabled, byStatus: {}, byInvocation: {}
+      },
+      workflows: workspace.workflows.length, harnesses: 0,
+      installUnits: { total: 0, bySourceClass: {}, highRisk: [], runtimeExtensions: [] }
+    };
+  }
   const skillsByStatus = countBy(workspace.skills, (skill) => skill.status);
   const skillsByInvocation = countBy(workspace.skills, (skill) => skill.invocation);
   const installUnitsByClass = countBy(workspace.installUnits, (unit) => installUnitSourceClass(unit));

package/src/domain/v2-policy.mjs

@@ -0,0 +1,111 @@
+import YAML from "yaml";
+import { requireRecord } from "../config-helpers.mjs";
+
+const POLICY_KEYS = new Set(["enabled", "shared", "preference"]);
+const V1_POLICY_KEYS = new Set([
+  "path", "status", "invocation", "exposure", "category", "canonical_for",
+  "conflicts_with", "replaced_by", "owner_install_unit", "variant", "scope"
+]);
+const PREFERENCE_KEYS = new Set(["intents", "priority"]);
+const SKILL_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]*$/u;
+const MIGRATION_GUIDANCE = "Run `skillboard migrate v2` to convert version 1 policy.";
+
+export function parseV2Policy(config) {
+  const unknownRootKeys = Object.keys(config).filter((key) => !["version", "skills"].includes(key));
+  if (unknownRootKeys.length > 0) {
+    throw new Error(`Version 2 config contains unsupported policy section: ${unknownRootKeys.join(", ")}. ${MIGRATION_GUIDANCE}`);
+  }
+  const rawSkills = requireRecord(config.skills ?? {}, "skills");
+  const skills = Object.entries(rawSkills)
+    .sort(([left], [right]) => left.localeCompare(right))
+    .map(([id, entry]) => parseSkillPolicy(id, entry));
+  return { workflows: [], skills };
+}
+
+export function serializeV2Policy(workspace) {
+  if (workspace.version !== 2) {
+    throw new Error("serializeV2Policy requires a version 2 workspace");
+  }
+  const config = {
+    version: 2,
+    skills: Object.fromEntries(workspace.skills.map((skill) => [skill.id, serializeSkill(skill)]))
+  };
+  return YAML.stringify(config, { lineWidth: 0 });
+}
+
+function parseSkillPolicy(id, entry) {
+  if (!SKILL_ID_PATTERN.test(id)) {
+    throw new Error(`Version 2 config contains invalid skill id: ${id}`);
+  }
+  const label = `skills.${id}`;
+  const raw = requireRecord(entry, label);
+  const keys = Object.keys(raw);
+  const v1Keys = keys.filter((key) => V1_POLICY_KEYS.has(key));
+  if (v1Keys.length > 0) {
+    throw new Error(`${label} mixes version 1 key ${v1Keys.join(", ")} with version 2 policy. ${MIGRATION_GUIDANCE}`);
+  }
+  const unknownKeys = keys.filter((key) => !POLICY_KEYS.has(key));
+  if (unknownKeys.length > 0) {
+    throw new Error(`${label} contains unsupported version 2 policy key: ${unknownKeys.join(", ")}. ${MIGRATION_GUIDANCE}`);
+  }
+  if (typeof raw.enabled !== "boolean") {
+    throw new Error(`${label}.enabled is required and must be a boolean`);
+  }
+  if (typeof raw.shared !== "boolean") {
+    throw new Error(`${label}.shared is required and must be a boolean`);
+  }
+  return {
+    id,
+    enabled: raw.enabled,
+    shared: raw.shared,
+    preference: parsePreference(raw.preference, label)
+  };
+}
+
+function parsePreference(value, label) {
+  if (value === undefined) {
+    return null;
+  }
+  const raw = requireRecord(value, `${label}.preference`);
+  const unknownKeys = Object.keys(raw).filter((key) => !PREFERENCE_KEYS.has(key));
+  if (unknownKeys.length > 0) {
+    throw new Error(`${label}.preference contains unsupported key: ${unknownKeys.join(", ")}`);
+  }
+  const intents = raw.intents;
+  if (!Array.isArray(intents) || intents.length === 0 || intents.some((intent) => typeof intent !== "string" || intent.trim() === "")) {
+    throw new Error(`${label}.preference.intents must be a non-empty list of intent terms`);
+  }
+  assertUnique(intents, `${label}.preference.intents`);
+  assertSorted(intents, `${label}.preference.intents`);
+  if (!Number.isInteger(raw.priority)) {
+    throw new Error(`${label}.preference.priority is required and must be an integer`);
+  }
+  return { intents: [...intents], priority: raw.priority };
+}
+
+function serializeSkill(skill) {
+  return {
+    enabled: skill.enabled,
+    shared: skill.shared,
+    ...(skill.preference === null ? {} : {
+      preference: { intents: [...skill.preference.intents], priority: skill.preference.priority }
+    })
+  };
+}
+
+function assertUnique(values, label) {
+  const seen = new Set();
+  for (const value of values) {
+    if (seen.has(value)) {
+      throw new Error(`${label} must not contain duplicates: ${value}`);
+    }
+    seen.add(value);
+  }
+}
+
+function assertSorted(values, label) {
+  const sorted = [...values].sort((left, right) => left.localeCompare(right));
+  if (values.some((value, index) => value !== sorted[index])) {
+    throw new Error(`${label} must be sorted`);
+  }
+}

package/src/hook-plan.mjs

@@ -1,6 +1,7 @@
-import { lstat } from "node:fs/promises";
-import { dirname, join } from "node:path";
+import { lstat, realpath } from "node:fs/promises";
+import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { loadWorkspace } from "./workspace.mjs";
+import { V1_MUTATION_ERROR } from "./compatibility.mjs";
 
 export const GUARD_HOOK_MODE = 0o755;
 
@@ -13,6 +14,7 @@ export async function buildGuardHookInstallPlan(options) {
   const workspace = await loadWorkspace({ configPath: options.configPath, skillsRoot: options.skillsRoot });
   requireWorkflow(workspace, options.workflow);
   const out = options.out ?? join(dirname(options.configPath), ".skillboard", "hooks", `skillboard-guard-${safeHookFilePart(options.workflow)}.sh`);
+  if (workspace.version === 2) await assertHookTargetContained(options.configPath, out);
   const command = options.command ?? "skillboard";
   const skillsRoot = options.skillsRoot ?? "skills";
   const script = renderGuardHookScript({
@@ -24,6 +26,7 @@ export async function buildGuardHookInstallPlan(options) {
   const target = await inspectHookTarget(out);
   const plannedMode = modeToOctal(GUARD_HOOK_MODE);
   const plan = {
+    policy_projection_version: workspace.version,
     path: out,
     workflow: options.workflow,
     command,
@@ -41,7 +44,25 @@ export async function buildGuardHookInstallPlan(options) {
   return { plan, script };
 }
 
+export async function assertHookTargetContained(configPath, targetPath) {
+  const root = await realpath(dirname(resolve(configPath)));
+  const target = resolve(targetPath);
+  const targetRelative = relative(root, target);
+  if (targetRelative === "" || targetRelative.startsWith("..") || isAbsolute(targetRelative)) {
+    throw new Error("Guard hook target must remain inside the config directory.");
+  }
+  let current = root;
+  for (const part of targetRelative.split(/[\\/]/u).slice(0, -1)) {
+    current = join(current, part);
+    const stats = await lstat(current).catch(missingOnly);
+    if (stats === undefined) continue;
+    if (stats.isSymbolicLink()) throw new Error("Guard hook parent must not be a symbolic link.");
+    if (!stats.isDirectory()) throw new Error("Guard hook parent must be a directory.");
+  }
+}
+
 export function assertGuardHookPlanIsInstallable(plan) {
+  if (plan.policy_projection_version !== 2) throw new Error(V1_MUTATION_ERROR);
   if (plan.target_exists) {
     throw new Error(`Refusing to overwrite existing hook path: ${plan.path}`);
   }
@@ -58,10 +79,14 @@ function renderGuardHookScript(options) {
   return `#!/usr/bin/env sh
 set -eu
 
+# SkillBoard policy projection version: 2
+
 SKILLBOARD_BIN=${shellQuote(options.command)}
 SKILLBOARD_CONFIG=${shellQuote(options.configPath)}
 SKILLBOARD_SKILLS=${shellQuote(options.skillsRoot)}
 SKILLBOARD_WORKFLOW=${shellQuote(options.workflow)}
+SKILLBOARD_POLICY_PROJECTION_VERSION=2
+export SKILLBOARD_POLICY_PROJECTION_VERSION
 
 if [ "\${SKILLBOARD_SKILL_ID:-}" != "" ]; then
   skill_id="$SKILLBOARD_SKILL_ID"
@@ -76,7 +101,7 @@ fi
 #   --skillboard-bin "node bin/skillboard.mjs"
 # Paths containing spaces should be provided through an environment wrapper.
 set -- $SKILLBOARD_BIN
-exec "$@" guard use "$skill_id" --workflow "$SKILLBOARD_WORKFLOW" --config "$SKILLBOARD_CONFIG" --skills "$SKILLBOARD_SKILLS"
+exec "$@" guard use "$skill_id" --hook-projection-version 2 --workflow "$SKILLBOARD_WORKFLOW" --config "$SKILLBOARD_CONFIG" --skills "$SKILLBOARD_SKILLS"
 `;
 }
 
@@ -127,6 +152,11 @@ async function inspectHookTarget(path) {
   return { exists: true, type: "other" };
 }
 
+function missingOnly(error) {
+  if (error?.code === "ENOENT") return undefined;
+  throw error;
+}
+
 function modeToOctal(mode) {
   return mode.toString(8).padStart(4, "0");
 }

package/src/impact.mjs

@@ -4,12 +4,15 @@ import {
 } from "./conflicts.mjs";
 
 export function impactDisable(workspace, skillId) {
-  const affectedWorkflowEntries = workspace.workflows
-    .filter((workflow) => workflow.activeSkills.includes(skillId) || workflow.requiredCapabilities.some((capability) => {
-      return capability.preferred === skillId || capability.fallback.includes(skillId);
-    }));
-  const affectedWorkflows = affectedWorkflowEntries.map((workflow) => workflow.name);
-  const affectedOutputs = [...new Set(affectedWorkflowEntries.flatMap((workflow) => workflow.requiredOutputs))];
+  if (workspace.version === 2) {
+    return impactDisableV2(workspace, skillId);
+  }
+  const affectedWorkflowEntries = workspace.workflows
+    .filter((workflow) => workflow.activeSkills.includes(skillId) || workflow.requiredCapabilities.some((capability) => {
+      return capability.preferred === skillId || capability.fallback.includes(skillId);
+    }));
+  const affectedWorkflows = affectedWorkflowEntries.map((workflow) => workflow.name);
+  const affectedOutputs = [...new Set(affectedWorkflowEntries.flatMap((workflow) => workflow.requiredOutputs))];
   const skill = workspace.skills.find((candidate) => candidate.id === skillId);
   const alternatives = alternativesForSkill(workspace, skillId, skill);
   const conflictingSkills = conflictingSkillIds(workspace, skillId);
@@ -25,26 +28,46 @@ export function impactDisable(workspace, skillId) {
     risk: riskFor(skill, affectedWorkflows, alternatives)
   };
 }
-
-function alternativesForSkill(workspace, skillId, skill) {
-  if (skill?.replacedBy !== undefined) {
-    return [skill.replacedBy];
-  }
-  const capability = workspace.capabilities.find((candidate) => {
-    return candidate.canonical === skillId || candidate.alternatives.includes(skillId);
-  });
-  if (capability === undefined) {
-    return [];
-  }
-  return [capability.canonical, ...capability.alternatives].filter((candidate) => candidate !== skillId);
-}
-
-function riskFor(skill, affectedWorkflows, alternatives) {
-  if (skill === undefined) {
-    return "unknown";
-  }
-  if (affectedWorkflows.length === 0) {
-    return "low";
-  }
-  return alternatives.length === 0 ? "high" : "medium";
-}
+
+function impactDisableV2(workspace, skillId) {
+  const skill = workspace.skills.find((candidate) => candidate.id === skillId);
+  const affectedAgents = skill?.enabled === true
+    ? workspace.inventory?.skills?.find((entry) => entry.id === skillId)?.installed_on ?? []
+    : [];
+  return {
+    skillId,
+    exists: skill !== undefined,
+    affectedWorkflows: [],
+    affectedAgents,
+    affectedOutputs: [],
+    alternatives: [],
+    conflictingSkills: [],
+    activeConflicts: [],
+    policyBefore: skill === undefined ? null : { enabled: skill.enabled, shared: skill.shared },
+    policyAfter: skill === undefined ? null : { enabled: false, shared: skill.shared },
+    risk: skill === undefined ? "unknown" : affectedAgents.length <= 1 ? "low" : "medium"
+  };
+}
+
+function alternativesForSkill(workspace, skillId, skill) {
+  if (skill?.replacedBy !== undefined) {
+    return [skill.replacedBy];
+  }
+  const capability = workspace.capabilities.find((candidate) => {
+    return candidate.canonical === skillId || candidate.alternatives.includes(skillId);
+  });
+  if (capability === undefined) {
+    return [];
+  }
+  return [capability.canonical, ...capability.alternatives].filter((candidate) => candidate !== skillId);
+}
+
+function riskFor(skill, affectedWorkflows, alternatives) {
+  if (skill === undefined) {
+    return "unknown";
+  }
+  if (affectedWorkflows.length === 0) {
+    return "low";
+  }
+  return alternatives.length === 0 ? "high" : "medium";
+}

package/src/index.mjs

@@ -2,7 +2,7 @@ import { loadWorkspace } from "./workspace.mjs";
 import { checkPolicy } from "./policy.mjs";
 import { doctorProject } from "./doctor.mjs";
 import { impactDisable } from "./impact.mjs";
-import { renderDashboard, renderReconcilePlan } from "./report.mjs";
+import { renderDashboard, renderReconcilePlan } from "./report.mjs";
 import { reconcileWorkspace } from "./reconcile.mjs";
 import { initProject } from "./init.mjs";
 import { agentInventoryDetectors, discoverAgentSkillInventory, mergeAgentSkillInventory } from "./agent-inventory.mjs";
@@ -12,6 +12,15 @@ import { importSource, loadSourceProfile, mergeImportFragment, renderImportFragm
 import { verifySources, writeLockfile } from "./source-verification.mjs";
 import { refreshSourcePins } from "./source-cache.mjs";
 import { detectInstallOutput } from "./install-output-detector.mjs";
+import { migrateV2 } from "./migration/v2-transaction.mjs";
+import {
+  assertCurrentProjectionVersion,
+  STALE_V1_PROJECTION_ERROR,
+  V1_COMPATIBILITY_NOTICE,
+  V1_COMPATIBILITY_REMOVAL_VERSION,
+  V1_MIGRATION_COMMAND,
+  V1_MUTATION_ERROR
+} from "./compatibility.mjs";
 import { rolloutApply, rolloutAudit, rolloutPlan, rolloutReport, rolloutRollback } from "./rollout.mjs";
 import { reviewInstallUnit } from "./review.mjs";
 import { buildSkillBrief } from "./advisor.mjs";
@@ -28,6 +37,7 @@ import {
   canUseSkill,
   explainSkill,
   forkSkillVariant,
+  forgetV2Skill,
   installGuardHook,
   listHarnesses,
   listInstallUnits,
@@ -37,6 +47,9 @@ import {
   quarantineSkill,
   removeSkill,
   resetSkillVariant,
+  setV2SkillEnabled,
+  setV2SkillPreference,
+  setV2SkillShared,
   variantLifecycleStatus
 } from "./control.mjs";
 
@@ -58,6 +71,7 @@ export {
   doctorProject,
   explainSkill,
   forkSkillVariant,
+  forgetV2Skill,
   impactDisable,
   importSource,
   initProject,
@@ -70,10 +84,20 @@ export {
   loadWorkspace,
   mergeAgentSkillInventory,
   mergeImportFragment,
+  migrateV2,
+  assertCurrentProjectionVersion,
+  STALE_V1_PROJECTION_ERROR,
+  V1_COMPATIBILITY_NOTICE,
+  V1_COMPATIBILITY_REMOVAL_VERSION,
+  V1_MIGRATION_COMMAND,
+  V1_MUTATION_ERROR,
   preferSkill,
   quarantineSkill,
   removeSkill,
   resetSkillVariant,
+  setV2SkillEnabled,
+  setV2SkillPreference,
+  setV2SkillShared,
   reconcileWorkspace,
   refreshAgentInventory,
   refreshSourcePins,

package/src/init.mjs

@@ -5,10 +5,10 @@ import { NON_CALLABLE_WORKFLOW_INVOCATIONS, NON_CALLABLE_WORKFLOW_STATUSES } fro
 import { isValidSkillState } from "./domain/skill-state-matrix.mjs";
 import { refreshAgentInventory } from "./inventory-refresh.mjs";
 import { BRIDGE_START, bridgeBlock, defaultConfig, hookReadme, profileReadme } from "./lifecycle-content.mjs";
-
-export async function initProject(options) {
-  const root = options.root;
-  const configPath = join(root, "skillboard.config.yaml");
+
+export async function initProject(options) {
+  const root = options.root;
+  const configPath = join(root, "skillboard.config.yaml");
   const skillsRoot = join(root, "skills");
   const reportRoot = join(root, ".skillboard", "reports");
   const profileRoot = join(root, ".skillboard", "profiles");
@@ -24,7 +24,15 @@ export async function initProject(options) {
     await writeFile(configPath, defaultConfig(), "utf8");
     created.push("skillboard.config.yaml");
   }
-  const profileReadmePath = join(profileRoot, "README.md");
+  if (configCreated && options.scanInstalled === false) {
+    await refreshAgentInventory({
+      root,
+      configPath,
+      inventory: { skills: [], installUnits: [], scannedSkills: 0, warnings: [] }
+    });
+    created.push(".skillboard/inventory.json");
+  }
+  const profileReadmePath = join(profileRoot, "README.md");
   if (!(await exists(profileReadmePath))) {
     await writeFile(profileReadmePath, profileReadme(), "utf8");
     created.push(".skillboard/profiles/README.md");
@@ -34,14 +42,14 @@ export async function initProject(options) {
     await writeFile(hookReadmePath, hookReadme(), "utf8");
     created.push(".skillboard/hooks/README.md");
   }
-  for (const filename of ["AGENTS.md", "CLAUDE.md"]) {
-    const result = await ensureBridge(join(root, filename));
-    if (result === "created") {
-      created.push(filename);
-    } else if (result === "updated") {
-      updated.push(filename);
-    }
-  }
+  for (const filename of ["AGENTS.md", "CLAUDE.md"]) {
+    const result = await ensureBridge(join(root, filename));
+    if (result === "created") {
+      created.push(filename);
+    } else if (result === "updated") {
+      updated.push(filename);
+    }
+  }
   const scan = options.scanInstalled === false
     ? { scannedSkills: 0, scannedInstallUnits: 0, changed: false, addedSkills: [], addedInstallUnits: [], updatedInstallUnits: [], addedWorkflows: [], addedHarnesses: [], skippedSkills: [], reviewNotes: [], warnings: [] }
     : await mergeInstalledAgentSkills(configPath, {
@@ -61,26 +69,26 @@ export async function initProject(options) {
     alreadyInitialized: created.length === 0 && updated.length === 0 && !scan.changed
   };
 }
-
-async function exists(path) {
-  return access(path).then(() => true, () => false);
-}
-
-async function ensureBridge(path) {
-  const block = bridgeBlock();
-  if (!(await exists(path))) {
-    await writeFile(path, `${block}\n`, "utf8");
-    return "created";
-  }
-  const current = await readFile(path, "utf8");
-  if (current.includes(BRIDGE_START)) {
-    return "unchanged";
-  }
-  const separator = current.endsWith("\n") ? "\n" : "\n\n";
-  await writeFile(path, `${current}${separator}${block}\n`, "utf8");
-  return "updated";
-}
-
+
+async function exists(path) {
+  return access(path).then(() => true, () => false);
+}
+
+async function ensureBridge(path) {
+  const block = bridgeBlock();
+  if (!(await exists(path))) {
+    await writeFile(path, `${block}\n`, "utf8");
+    return "created";
+  }
+  const current = await readFile(path, "utf8");
+  if (current.includes(BRIDGE_START)) {
+    return "unchanged";
+  }
+  const separator = current.endsWith("\n") ? "\n" : "\n\n";
+  await writeFile(path, `${current}${separator}${block}\n`, "utf8");
+  return "updated";
+}
+
 async function mergeInstalledAgentSkills(configPath, options) {
   const result = await refreshAgentInventory({
     root: dirname(configPath),
@@ -107,6 +115,14 @@ async function mergeInstalledAgentSkills(configPath, options) {
 async function summarizeSafety(configPath) {
   const config = YAML.parse(await readFile(configPath, "utf8")) ?? {};
   const skills = config.skills && typeof config.skills === "object" ? Object.values(config.skills) : [];
+  if (config.version === 2) {
+    return {
+      enabled: skills.filter((skill) => skill?.enabled === true).length,
+      disabled: skills.filter((skill) => skill?.enabled === false).length,
+      shared: skills.filter((skill) => skill?.enabled === true && skill.shared === true).length,
+      local: skills.filter((skill) => skill?.enabled === true && skill.shared !== true).length
+    };
+  }
   let automatic = 0;
   let manualOnly = 0;
   let routerOnly = 0;
@@ -132,5 +148,5 @@ async function summarizeSafety(configPath) {
       routerOnly += 1;
     }
   }
-  return { automatic, manualOnly, routerOnly, blocked };
+  return { enabled: automatic + manualOnly + routerOnly, disabled: blocked, global: 0, scoped: automatic + manualOnly + routerOnly };
 }

package/src/inventory-install-units.mjs

@@ -0,0 +1,63 @@
+const TRUST_RANK = new Map([["blocked", 0], ["unreviewed", 1], ["reviewed", 2], ["trusted", 3]]);
+const RISK_RANK = new Map([["high", 0], ["medium", 1], ["unknown", 2], ["low", 3]]);
+
+export function coalesceInventoryInstallUnits(records) {
+  const groups = new Map();
+  for (const record of records) {
+    const group = groups.get(record.id) ?? [];
+    group.push(record);
+    groups.set(record.id, group);
+  }
+  return [...groups.values()].map(coalesceGroup).sort(byId);
+}
+
+function coalesceGroup(records) {
+  const sorted = [...records].sort((left, right) => stableKey(left).localeCompare(stableKey(right)));
+  const first = sorted[0];
+  const runtime = sorted.map((record) => record.runtime_components ?? {});
+  return compact({
+    ...first,
+    trust_observation: rankedValue(sorted.map((record) => record.trust_observation), TRUST_RANK),
+    permission_risk: rankedValue(sorted.map((record) => record.permission_risk), RISK_RANK),
+    signature_observed: sorted.some((record) => record.signature_observed === true),
+    runtime_components: {
+      commands: combined(runtime.map((value) => value.commands)),
+      hooks: combined(runtime.map((value) => value.hooks)),
+      mcp_servers: combined(runtime.map((value) => value.mcp_servers))
+    },
+    skills: combined(sorted.map((record) => record.skills)),
+    alias_skills: combined(sorted.map((record) => record.alias_skills)),
+    source_observations: observed(sorted, "source"),
+    manifest_path_observations: observed(sorted, "manifest_path"),
+    cache_path_observations: observed(sorted, "cache_path"),
+    source_digest_observations: observed(sorted, "source_digest")
+  });
+}
+
+function rankedValue(values, ranks) {
+  return values
+    .filter((value) => typeof value === "string" && value.length > 0)
+    .sort((left, right) => (ranks.get(left) ?? Number.MAX_SAFE_INTEGER) - (ranks.get(right) ?? Number.MAX_SAFE_INTEGER)
+      || left.localeCompare(right))[0];
+}
+
+function observed(records, key) {
+  const values = combined(records.map((record) => [record[key]]));
+  return values.length > 1 ? values : undefined;
+}
+
+function combined(groups) {
+  return [...new Set(groups.flat().filter((value) => typeof value === "string" && value.length > 0))].sort();
+}
+
+function compact(value) {
+  return Object.fromEntries(Object.entries(value).filter(([, entry]) => entry !== undefined));
+}
+
+function stableKey(value) {
+  return JSON.stringify(value, Object.keys(value).sort());
+}
+
+function byId(left, right) {
+  return left.id.localeCompare(right.id);
+}