loadout-ai 0.1.2 → 0.2.0

package/dist/src/core/update.js

@@ -1,5 +1,5 @@
 import { mkdir, writeFile } from "node:fs/promises";
-import { join } from "node:path";
+import { basename, join } from "node:path";
 import { fetchRepositorySnapshot } from "./source.js";
 import { repositoryCachePath } from "./source.js";
 import { diffRepositorySnapshots } from "./diff.js";
@@ -7,7 +7,83 @@ import { hashDirectory, readInstallState } from "./state.js";
 import { analyzeUpdateSafety } from "./safety.js";
 import { detectAgents, loadoutHome } from "./paths.js";
 import { applySkillInstall, buildSkillPlan, installedAgents, } from "./install.js";
-import { validateSkillDirectory } from "./skills.js";
+import { discoverSkillDirectories, validateSkillDirectory, } from "./skills.js";
+function managedUnitIds(state, packageId) {
+    return [
+        ...new Set((state.activations ?? [])
+            .filter((activation) => activation.packageId === packageId &&
+            activation.installationState === "installed")
+            .map((activation) => activation.unitId ??
+            basename(activation.targets[0]?.activePath ?? packageId))
+            .filter(Boolean)),
+    ].sort();
+}
+async function locateManagedSkills(root, unitIds) {
+    const normalized = new Map(unitIds.map((unitId) => [unitId.toLowerCase(), unitId]));
+    const located = new Map();
+    await discoverSkillDirectories(root, {
+        validate: false,
+        include: (skill) => {
+            const unitId = (skill.name ? normalized.get(skill.name.toLowerCase()) : undefined) ??
+                normalized.get(skill.targetName.toLowerCase());
+            if (!unitId)
+                return false;
+            located.set(unitId, skill.path);
+            return true;
+        },
+    });
+    return located;
+}
+async function analyzeManagedUpdate(oldRoot, newRoot, unitIds) {
+    if (!unitIds.length) {
+        const [diff, safety] = await Promise.all([
+            diffRepositorySnapshots(oldRoot, newRoot),
+            analyzeUpdateSafety(oldRoot, newRoot),
+        ]);
+        return {
+            diff,
+            safetyFindings: safety.findings,
+            approvalRequired: safety.approvalRequired,
+        };
+    }
+    const [oldSkills, newSkills] = await Promise.all([
+        locateManagedSkills(oldRoot, unitIds),
+        locateManagedSkills(newRoot, unitIds),
+    ]);
+    const diff = [];
+    const findings = [];
+    for (const unitId of unitIds) {
+        const oldPath = oldSkills.get(unitId);
+        const newPath = newSkills.get(unitId);
+        if (!oldPath || !newPath) {
+            findings.push({
+                severity: "blocking",
+                category: "instruction",
+                message: `Managed skill '${unitId}' is missing from one update revision.`,
+                paths: [unitId],
+            });
+            continue;
+        }
+        diff.push(...(await diffRepositorySnapshots(oldPath, newPath)).map((item) => ({
+            ...item,
+            path: `${unitId}/${item.path}`,
+        })));
+        const safety = await analyzeUpdateSafety(oldPath, newPath);
+        findings.push(...safety.findings.map((finding) => ({
+            ...finding,
+            paths: finding.paths.map((path) => `${unitId}/${path}`),
+        })));
+    }
+    const unique = new Map();
+    for (const finding of findings)
+        unique.set(`${finding.severity}:${finding.category}:${finding.message}:${finding.paths.join(",")}:${finding.names?.join(",") ?? ""}`, finding);
+    const safetyFindings = [...unique.values()];
+    return {
+        diff,
+        safetyFindings,
+        approvalRequired: safetyFindings.some((finding) => finding.severity === "blocking"),
+    };
+}
 /** Builds a read-only update plan from persisted installs and live GitHub snapshots. */
 export async function buildUpdatePlan(resolver = async (repository) => fetchRepositorySnapshot(repository)) {
     const state = await readInstallState();
@@ -39,10 +115,10 @@ export async function buildUpdatePlan(resolver = async (repository) => fetchRepo
             let approvalRequired = false;
             if (!same && current.path) {
                 const oldPath = repositoryCachePath(record.repository, record.resolvedCommit);
-                diff = await diffRepositorySnapshots(oldPath, current.path);
-                const safety = await analyzeUpdateSafety(oldPath, current.path);
-                safetyFindings = safety.findings;
-                approvalRequired = safety.approvalRequired;
+                const analysis = await analyzeManagedUpdate(oldPath, current.path, managedUnitIds(state, record.packageId));
+                diff = analysis.diff;
+                safetyFindings = analysis.safetyFindings;
+                approvalRequired = analysis.approvalRequired;
             }
             return {
                 ...base,
@@ -148,18 +224,32 @@ export async function applyPackageUpdate(packageId, options = {}, runtime = {})
     if (current.commit.toLowerCase() === record.resolvedCommit.toLowerCase())
         throw new Error(`Package '${packageId}' is already up to date`);
     const oldPath = repositoryCachePath(record.repository, record.resolvedCommit);
-    const safety = await analyzeUpdateSafety(oldPath, current.path);
+    const units = managedUnitIds(state, packageId);
+    const safety = await analyzeManagedUpdate(oldPath, current.path, units);
     if (safety.approvalRequired && !options.approveRisk) {
         const quarantinePath = options.quarantineOnBlock === false
             ? undefined
-            : await quarantineUpdate(packageId, current.repository, current.commit, safety.findings);
-        throw new Error(`Update is blocked pending explicit risk approval${quarantinePath ? `; quarantined at ${quarantinePath}` : ""}: ${safety.findings
+            : await quarantineUpdate(packageId, current.repository, current.commit, safety.safetyFindings);
+        throw new Error(`Update is blocked pending explicit risk approval${quarantinePath ? `; quarantined at ${quarantinePath}` : ""}: ${safety.safetyFindings
             .filter((finding) => finding.severity === "blocking")
             .map((finding) => finding.message)
             .join(" ")}`);
     }
     const agents = installedAgents(await (runtime.detectAgents ?? detectAgents)(), record.targetAgents);
-    const plan = await (runtime.buildPlan ?? buildSkillPlan)(current.path, record.packageId, agents);
+    const plan = await (runtime.buildPlan ?? buildSkillPlan)(current.path, record.packageId, agents, units.length
+        ? {
+            include: (skill) => units.some((unitId) => unitId.toLowerCase() === skill.name?.toLowerCase() ||
+                unitId.toLowerCase() === skill.targetName.toLowerCase()),
+        }
+        : {});
+    if (units.length) {
+        const plannedUnits = [
+            ...new Set(plan.files.map((file) => basename(file.target))),
+        ].sort();
+        if (plannedUnits.length !== units.length ||
+            plannedUnits.some((unitId, index) => unitId.toLowerCase() !== units[index].toLowerCase()))
+            throw new Error(`Update plan changed the managed skill set for '${packageId}'; expected ${units.join(", ")}, received ${plannedUnits.join(", ") || "none"}.`);
+    }
     const verifier = runtime.verify ?? verifyInstalledSkills;
     let verificationFailure;
     let verificationSnapshotId;
@@ -167,6 +257,17 @@ export async function applyPackageUpdate(packageId, options = {}, runtime = {})
         const snapshotId = await applySkillInstall(plan, {
             repository: current.repository,
             resolvedCommit: current.commit,
+            reviewed: true,
+            staticAssessment: {
+                status: safety.approvalRequired
+                    ? "blocking"
+                    : safety.safetyFindings.length
+                        ? "warning"
+                        : "clear",
+                findingCount: safety.safetyFindings.length,
+                assessedAt: new Date().toISOString(),
+                policy: "install-safety-v1",
+            },
         }, {
             allowManagedReplacement: true,
             replaceManagedTargets: true,

package/dist/src/core/upgrade.js

@@ -33,6 +33,7 @@ export async function planUpgrade(selection, options = {}) {
                 ? { fetchSnapshot: options.fetchSnapshot }
                 : {}),
             ...(options.onProgress ? { onProgress: options.onProgress } : {}),
+            ...(options.access ? { access: options.access } : {}),
         }),
         outcomes(),
     ]);

package/dist/src/shared/schemas.js

@@ -257,6 +257,14 @@ export const installRecordSchema = z
     files: z.array(fileHashSchema),
     snapshotId: text,
     installedAt: text,
+    staticAssessment: z
+        .object({
+        status: z.enum(["clear", "warning", "blocking"]),
+        findingCount: z.number().int().nonnegative(),
+        assessedAt: z.iso.datetime(),
+        policy: text,
+    })
+        .optional(),
 })
     .passthrough();
 export const mcpInstallRecordSchema = z