loadout-ai 0.1.2 → 0.2.1

package/dist/src/core/skills.js

@@ -25,6 +25,7 @@ export async function discoverSkillDirectories(root, options = {}) {
         }
         if (entries.includes("SKILL.md")) {
             const skillPath = join(directory, "SKILL.md");
+            const targetName = directory.split(sep).at(-1) ?? "skill";
             let name;
             try {
                 const skillStat = await lstat(skillPath);
@@ -36,14 +37,26 @@ export async function discoverSkillDirectories(root, options = {}) {
             catch {
                 // Selected invalid skills are rejected by validateSkillDirectory below.
             }
-            if (options.include &&
-                !options.include({
-                    path: directory,
-                    ...(name ? { name } : {}),
-                    targetName: directory.split(sep).at(-1) ?? "skill",
-                }))
+            const discovered = {
+                path: directory,
+                ...(name ? { name } : {}),
+                targetName,
+            };
+            if (options.include && !options.include(discovered))
                 return;
-            await validateSkillDirectory(directory);
+            try {
+                if (options.validate !== false)
+                    await validateSkillDirectory(directory);
+            }
+            catch (error) {
+                if (!options.continueOnRejected)
+                    throw error;
+                options.onRejected?.({
+                    ...discovered,
+                    reason: error instanceof Error ? error.message : String(error),
+                });
+                return;
+            }
             result.push(directory);
             // A SKILL.md directory is one atomic skill package. Resources beneath it
             // are validated as content, not recursively treated as additional skills.

package/dist/src/core/state.js

@@ -138,7 +138,13 @@ async function createInstallRecord(plan, snapshotId, metadata = {}) {
     const files = (await Promise.all([...new Set(plan.files.map((file) => file.target))].map(hashDirectory))).flat();
     return {
         packageId: plan.packageId,
-        ...metadata,
+        ...(metadata.repository ? { repository: metadata.repository } : {}),
+        ...(metadata.resolvedCommit
+            ? { resolvedCommit: metadata.resolvedCommit }
+            : {}),
+        ...(metadata.staticAssessment
+            ? { staticAssessment: metadata.staticAssessment }
+            : {}),
         targetAgents: [...plan.targetAgents],
         files,
         snapshotId,
@@ -164,6 +170,11 @@ export async function recordInstallBatch(entries, snapshotId) {
  */
 export async function recordLibraryInstallBatch(entries, snapshotId) {
     const now = new Date().toISOString();
+    const state = await readInstallState();
+    const existingActivations = new Map((state.activations ?? []).map((record) => [
+        `${record.packageId}\0${record.agent}\0${record.unitId ?? ""}`,
+        record,
+    ]));
     const activationRecords = [];
     const records = [];
     for (const entry of entries) {
@@ -202,6 +213,9 @@ export async function recordLibraryInstallBatch(entries, snapshotId) {
                         sha256: file.sha256,
                     });
                 }
+                const existing = existingActivations.get(`${entry.plan.packageId}\0${agent}\0${unitId}`);
+                const preserveActive = existing?.installationState === "installed" &&
+                    existing.activationState === "active";
                 activationRecords.push({
                     packageId: entry.plan.packageId,
                     unitId,
@@ -209,9 +223,9 @@ export async function recordLibraryInstallBatch(entries, snapshotId) {
                     cacheState: "downloaded",
                     reviewState: entry.metadata?.reviewed ? "reviewed" : "unreviewed",
                     installationState: "installed",
-                    activationState: "disabled",
+                    activationState: preserveActive ? "active" : "disabled",
                     libraryPath,
-                    targets: [target],
+                    targets: preserveActive ? existing.targets : [target],
                     libraryFiles: libraryFiles.sort((left, right) => left.path.localeCompare(right.path)),
                     updatedAt: now,
                     snapshotId,
@@ -230,9 +244,11 @@ export async function recordLibraryInstallBatch(entries, snapshotId) {
             files: installFiles.sort((left, right) => left.path.localeCompare(right.path)),
             snapshotId,
             installedAt: now,
+            ...(entry.metadata?.staticAssessment
+                ? { staticAssessment: entry.metadata.staticAssessment }
+                : {}),
         });
     }
-    const state = await readInstallState();
     const ids = new Set(records.map((record) => record.packageId));
     state.installs = [
         ...state.installs.filter((record) => !ids.has(record.packageId)),

package/dist/src/core/update.js

@@ -1,5 +1,5 @@
 import { mkdir, writeFile } from "node:fs/promises";
-import { join } from "node:path";
+import { basename, join } from "node:path";
 import { fetchRepositorySnapshot } from "./source.js";
 import { repositoryCachePath } from "./source.js";
 import { diffRepositorySnapshots } from "./diff.js";
@@ -7,7 +7,83 @@ import { hashDirectory, readInstallState } from "./state.js";
 import { analyzeUpdateSafety } from "./safety.js";
 import { detectAgents, loadoutHome } from "./paths.js";
 import { applySkillInstall, buildSkillPlan, installedAgents, } from "./install.js";
-import { validateSkillDirectory } from "./skills.js";
+import { discoverSkillDirectories, validateSkillDirectory, } from "./skills.js";
+function managedUnitIds(state, packageId) {
+    return [
+        ...new Set((state.activations ?? [])
+            .filter((activation) => activation.packageId === packageId &&
+            activation.installationState === "installed")
+            .map((activation) => activation.unitId ??
+            basename(activation.targets[0]?.activePath ?? packageId))
+            .filter(Boolean)),
+    ].sort();
+}
+async function locateManagedSkills(root, unitIds) {
+    const normalized = new Map(unitIds.map((unitId) => [unitId.toLowerCase(), unitId]));
+    const located = new Map();
+    await discoverSkillDirectories(root, {
+        validate: false,
+        include: (skill) => {
+            const unitId = (skill.name ? normalized.get(skill.name.toLowerCase()) : undefined) ??
+                normalized.get(skill.targetName.toLowerCase());
+            if (!unitId)
+                return false;
+            located.set(unitId, skill.path);
+            return true;
+        },
+    });
+    return located;
+}
+async function analyzeManagedUpdate(oldRoot, newRoot, unitIds) {
+    if (!unitIds.length) {
+        const [diff, safety] = await Promise.all([
+            diffRepositorySnapshots(oldRoot, newRoot),
+            analyzeUpdateSafety(oldRoot, newRoot),
+        ]);
+        return {
+            diff,
+            safetyFindings: safety.findings,
+            approvalRequired: safety.approvalRequired,
+        };
+    }
+    const [oldSkills, newSkills] = await Promise.all([
+        locateManagedSkills(oldRoot, unitIds),
+        locateManagedSkills(newRoot, unitIds),
+    ]);
+    const diff = [];
+    const findings = [];
+    for (const unitId of unitIds) {
+        const oldPath = oldSkills.get(unitId);
+        const newPath = newSkills.get(unitId);
+        if (!oldPath || !newPath) {
+            findings.push({
+                severity: "blocking",
+                category: "instruction",
+                message: `Managed skill '${unitId}' is missing from one update revision.`,
+                paths: [unitId],
+            });
+            continue;
+        }
+        diff.push(...(await diffRepositorySnapshots(oldPath, newPath)).map((item) => ({
+            ...item,
+            path: `${unitId}/${item.path}`,
+        })));
+        const safety = await analyzeUpdateSafety(oldPath, newPath);
+        findings.push(...safety.findings.map((finding) => ({
+            ...finding,
+            paths: finding.paths.map((path) => `${unitId}/${path}`),
+        })));
+    }
+    const unique = new Map();
+    for (const finding of findings)
+        unique.set(`${finding.severity}:${finding.category}:${finding.message}:${finding.paths.join(",")}:${finding.names?.join(",") ?? ""}`, finding);
+    const safetyFindings = [...unique.values()];
+    return {
+        diff,
+        safetyFindings,
+        approvalRequired: safetyFindings.some((finding) => finding.severity === "blocking"),
+    };
+}
 /** Builds a read-only update plan from persisted installs and live GitHub snapshots. */
 export async function buildUpdatePlan(resolver = async (repository) => fetchRepositorySnapshot(repository)) {
     const state = await readInstallState();
@@ -39,10 +115,10 @@ export async function buildUpdatePlan(resolver = async (repository) => fetchRepo
             let approvalRequired = false;
             if (!same && current.path) {
                 const oldPath = repositoryCachePath(record.repository, record.resolvedCommit);
-                diff = await diffRepositorySnapshots(oldPath, current.path);
-                const safety = await analyzeUpdateSafety(oldPath, current.path);
-                safetyFindings = safety.findings;
-                approvalRequired = safety.approvalRequired;
+                const analysis = await analyzeManagedUpdate(oldPath, current.path, managedUnitIds(state, record.packageId));
+                diff = analysis.diff;
+                safetyFindings = analysis.safetyFindings;
+                approvalRequired = analysis.approvalRequired;
             }
             return {
                 ...base,
@@ -148,18 +224,32 @@ export async function applyPackageUpdate(packageId, options = {}, runtime = {})
     if (current.commit.toLowerCase() === record.resolvedCommit.toLowerCase())
         throw new Error(`Package '${packageId}' is already up to date`);
     const oldPath = repositoryCachePath(record.repository, record.resolvedCommit);
-    const safety = await analyzeUpdateSafety(oldPath, current.path);
+    const units = managedUnitIds(state, packageId);
+    const safety = await analyzeManagedUpdate(oldPath, current.path, units);
     if (safety.approvalRequired && !options.approveRisk) {
         const quarantinePath = options.quarantineOnBlock === false
             ? undefined
-            : await quarantineUpdate(packageId, current.repository, current.commit, safety.findings);
-        throw new Error(`Update is blocked pending explicit risk approval${quarantinePath ? `; quarantined at ${quarantinePath}` : ""}: ${safety.findings
+            : await quarantineUpdate(packageId, current.repository, current.commit, safety.safetyFindings);
+        throw new Error(`Update is blocked pending explicit risk approval${quarantinePath ? `; quarantined at ${quarantinePath}` : ""}: ${safety.safetyFindings
             .filter((finding) => finding.severity === "blocking")
             .map((finding) => finding.message)
             .join(" ")}`);
     }
     const agents = installedAgents(await (runtime.detectAgents ?? detectAgents)(), record.targetAgents);
-    const plan = await (runtime.buildPlan ?? buildSkillPlan)(current.path, record.packageId, agents);
+    const plan = await (runtime.buildPlan ?? buildSkillPlan)(current.path, record.packageId, agents, units.length
+        ? {
+            include: (skill) => units.some((unitId) => unitId.toLowerCase() === skill.name?.toLowerCase() ||
+                unitId.toLowerCase() === skill.targetName.toLowerCase()),
+        }
+        : {});
+    if (units.length) {
+        const plannedUnits = [
+            ...new Set(plan.files.map((file) => basename(file.target))),
+        ].sort();
+        if (plannedUnits.length !== units.length ||
+            plannedUnits.some((unitId, index) => unitId.toLowerCase() !== units[index].toLowerCase()))
+            throw new Error(`Update plan changed the managed skill set for '${packageId}'; expected ${units.join(", ")}, received ${plannedUnits.join(", ") || "none"}.`);
+    }
     const verifier = runtime.verify ?? verifyInstalledSkills;
     let verificationFailure;
     let verificationSnapshotId;
@@ -167,6 +257,17 @@ export async function applyPackageUpdate(packageId, options = {}, runtime = {})
         const snapshotId = await applySkillInstall(plan, {
             repository: current.repository,
             resolvedCommit: current.commit,
+            reviewed: true,
+            staticAssessment: {
+                status: safety.approvalRequired
+                    ? "blocking"
+                    : safety.safetyFindings.length
+                        ? "warning"
+                        : "clear",
+                findingCount: safety.safetyFindings.length,
+                assessedAt: new Date().toISOString(),
+                policy: "install-safety-v1",
+            },
         }, {
             allowManagedReplacement: true,
             replaceManagedTargets: true,

package/dist/src/core/upgrade.js

@@ -33,6 +33,7 @@ export async function planUpgrade(selection, options = {}) {
                 ? { fetchSnapshot: options.fetchSnapshot }
                 : {}),
             ...(options.onProgress ? { onProgress: options.onProgress } : {}),
+            ...(options.access ? { access: options.access } : {}),
         }),
         outcomes(),
     ]);

package/dist/src/shared/schemas.js

@@ -257,6 +257,14 @@ export const installRecordSchema = z
     files: z.array(fileHashSchema),
     snapshotId: text,
     installedAt: text,
+    staticAssessment: z
+        .object({
+        status: z.enum(["clear", "warning", "blocking"]),
+        findingCount: z.number().int().nonnegative(),
+        assessedAt: z.iso.datetime(),
+        policy: text,
+    })
+        .optional(),
 })
     .passthrough();
 export const mcpInstallRecordSchema = z