loadout-ai 0.4.0 → 0.5.0

package/dist/src/core/active-policy.js

@@ -1,5 +1,7 @@
 import { applyActivationChange, formatActivationPlan, planActivationChange, } from "./active-set.js";
-import { scanProject } from "./recommend.js";
+import { detectAgents } from "./paths.js";
+import { formatDetectedSignals, scanProject } from "./recommend.js";
+import { scanInstalledSkills } from "./skill-inventory.js";
 import { readInstallState } from "./state.js";
 import { outcomeAdjustment, projectTaskFamilies, readLocalOutcomes, } from "./outcomes.js";
 const FOUNDATION = new Set([
@@ -17,13 +19,46 @@ const FOUNDATION = new Set([
     "code-review-excellence",
     "api-design-principles",
     "architecture-patterns",
-    "accessibility-compliance",
     "deployment-pipeline-design",
     "documentation-writer",
     "openai-docs",
-    "web-design-guidelines",
 ]);
-const SPECIALIZED_WITHOUT_SIGNAL = /(?:appstore|backtesting|bats-|oracle|salesforce|power-bi|dataverse|qdrant|azure-|aws-|mcp-server-generator|sandbox-npm|migration)/;
+const SPECIALIZED_WITHOUT_SIGNAL = /(?:appstore|msstore|backtesting|bats-|oracle|salesforce|power-bi|dataverse|qdrant|azure-|aws-|mcp-server-generator|sandbox-npm|migration|social-(?:publish|media)|marketing|copywriting)/;
+/**
+ * A matching word such as `mcp`, `cli`, or `publish` is not enough to make a
+ * skill compatible with the detected project. These gates run before scoring
+ * so a strong generic signal cannot pull in tooling for another ecosystem.
+ * Explicit pins remain an intentional user override.
+ */
+function hasProjectCompatibility(name, project) {
+    const hasLanguage = (language) => project.languages.includes(language);
+    const languageRequirements = [
+        [/(?:dotnet|csharp|aspnet|nuget|maui)/, ".net"],
+        [
+            /(?:python|pytest|fastapi|django|flask|pydantic|poetry|uv-package)/,
+            "python",
+        ],
+        [/(?:^|-)go(?:-|$)|golang/, "go"],
+        [/(?:rust|cargo)/, "rust"],
+        [/(?:^|-)java(?:-|$)|spring-boot/, "java"],
+        [/(?:ruby|rails|bundler)/, "ruby"],
+        [/(?:elixir|phoenix)/, "elixir"],
+    ];
+    for (const [pattern, language] of languageRequirements)
+        if (pattern.test(name) && !hasLanguage(language))
+            return false;
+    if (/(?:nodejs-)?backend|api-server/.test(name) &&
+        !project.roles.includes("backend"))
+        return false;
+    if (/(?:^|-)vercel(?:-|$)/.test(name) &&
+        !project.frameworks.includes("next.js") &&
+        !project.files.includes("vercel.json"))
+        return false;
+    if (/(?:publish-to-pages|github-pages|cloudflare-pages)/.test(name) &&
+        !project.frameworks.some((framework) => ["react", "next.js", "vue", "svelte"].includes(framework)))
+        return false;
+    return true;
+}
 const SOURCE_PRIORITY = {
     superpowers: 80,
     context7: 75,
@@ -47,7 +82,7 @@ const GENERAL = [
 const SIGNAL_RULES = [
     {
         signal: (project) => project.languages.includes("javascript/typescript"),
-        pattern: /(?:javascript|typescript|nodejs|npm|webapp)/,
+        pattern: /(?:javascript|typescript|nodejs|webapp)|(?:^|-)npm(?:-|$)/,
         label: "JavaScript/TypeScript project",
     },
     {
@@ -85,7 +120,82 @@ const SIGNAL_RULES = [
         pattern: /playwright|e2e|webapp-testing/,
         label: "Playwright project",
     },
+    {
+        signal: (project) => project.roles.includes("node-cli"),
+        pattern: /^(?:cli|cli-design|cli-mastery|node-cli|command-line|command-line-tools?|building-cli(?:-apps?)?)$/,
+        label: "Node CLI",
+    },
+    {
+        signal: (project) => project.roles.includes("npm-package"),
+        pattern: /(?:^|-)npm(?:-|$)|package|publish/,
+        label: "npm package",
+    },
+    {
+        signal: (project) => project.roles.includes("release"),
+        pattern: /release|publish|package/,
+        label: "release automation",
+    },
+    {
+        signal: (project) => project.roles.includes("mcp"),
+        pattern: /mcp|model-context-protocol/,
+        label: "MCP tooling",
+    },
+    {
+        signal: (project) => project.roles.includes("security"),
+        pattern: /security|threat|secrets|owasp/,
+        label: "security policy",
+    },
+    {
+        signal: (project) => project.roles.includes("obsidian-vault"),
+        pattern: /obsidian|json-canvas|defuddle/,
+        label: "Obsidian vault",
+    },
+    {
+        signal: (project) => project.tools.includes("vitest"),
+        pattern: /vitest/,
+        label: "Vitest",
+    },
+    {
+        signal: (project) => project.tools.includes("commander"),
+        pattern: /^(?:cli|cli-design|cli-mastery|node-cli|commander|command-line|command-line-tools?|building-cli(?:-apps?)?)$/,
+        label: "Commander CLI",
+    },
+    {
+        signal: (project) => project.tools.includes("zod"),
+        pattern: /zod|schema-validation|(?:^|-)validation(?:-|$)/,
+        label: "Zod schemas",
+    },
 ];
+const FAMILY_CAPS = {
+    "browser-testing": 3,
+    documentation: 2,
+    "code-review": 2,
+    architecture: 2,
+    planning: 3,
+    security: 3,
+    "language-tooling": 5,
+    testing: 3,
+    uncategorized: 3,
+};
+function candidateFamily(unitId) {
+    if (/playwright|e2e|webapp-testing|browser-testing/.test(unitId))
+        return "browser-testing";
+    if (/docs|documentation|readme/.test(unitId))
+        return "documentation";
+    if (/review|refactor/.test(unitId))
+        return "code-review";
+    if (/architect|api-design|openapi/.test(unitId))
+        return "architecture";
+    if (/brainstorm|planning|writing-plans/.test(unitId))
+        return "planning";
+    if (/security|threat|secrets|owasp/.test(unitId))
+        return "security";
+    if (/test|coverage|vitest|jest/.test(unitId))
+        return "testing";
+    if (/javascript|typescript|nodejs|npm|package|cli|zod|schema/.test(unitId))
+        return "language-tooling";
+    return "uncategorized";
+}
 function selector(record) {
     if (!record.unitId)
         return undefined;
@@ -96,6 +206,10 @@ function scoreCandidate(record, project, pinned, outcomes, taskFamilies) {
     if (!id || !record.unitId)
         return undefined;
     const name = record.unitId.toLowerCase();
+    if (/(?:^|-)jest(?:-|$)/.test(name) &&
+        project.tools.includes("vitest") &&
+        !project.tools.includes("jest"))
+        return undefined;
     let score = 0;
     const reasons = [];
     if (pinned.has(id) || pinned.has(record.unitId)) {
@@ -103,6 +217,8 @@ function scoreCandidate(record, project, pinned, outcomes, taskFamilies) {
         reasons.push("explicitly pinned");
     }
     const explicitlyPinned = score >= 1000;
+    if (!explicitlyPinned && !hasProjectCompatibility(name, project))
+        return undefined;
     if (!explicitlyPinned && SPECIALIZED_WITHOUT_SIGNAL.test(name))
         return undefined;
     if (FOUNDATION.has(name)) {
@@ -136,25 +252,8 @@ function scoreCandidate(record, project, pinned, outcomes, taskFamilies) {
         reasons: [...new Set(reasons)],
     };
 }
-/** Deterministic, local-only active-set selection over the reviewed library. */
-export async function planProjectActivation(projectPath, options = {}) {
-    const limit = options.limit ?? 40;
-    if (!Number.isInteger(limit) || limit < 1 || limit > 200)
-        throw new Error("--limit must be an integer from 1 to 200");
-    const project = await scanProject(projectPath);
-    const state = await readInstallState();
-    const outcomes = await readLocalOutcomes();
-    const taskFamilies = projectTaskFamilies(project);
-    const relevant = (state.activations ?? []).filter((record) => record.installationState === "installed" &&
-        (!options.agents || options.agents.includes(record.agent)));
-    const byAgent = new Map();
-    for (const record of relevant)
-        if (record.activationState === "active")
-            byAgent.set(record.agent, (byAgent.get(record.agent) ?? 0) + 1);
-    const activeBefore = Math.max(0, ...byAgent.values());
-    const capacity = Math.max(0, limit - activeBefore);
-    const pins = new Set(options.pins ?? []);
-    const scored = relevant
+function rankedCandidates(records, project, pins, outcomes, taskFamilies) {
+    const scored = records
         .filter((record) => record.activationState === "disabled" &&
         record.cacheState === "downloaded" &&
         record.reviewState === "reviewed")
@@ -165,19 +264,24 @@ export async function planProjectActivation(projectPath, options = {}) {
             (SOURCE_PRIORITY[left.packageId] ?? 0) ||
         left.unitId.localeCompare(right.unitId) ||
         left.packageId.localeCompare(right.packageId));
-    // One capability name wins by evidence order; overlapping collections remain
-    // in the library and can still be explicitly pinned by full selector.
     const unique = [];
     const claimedUnits = new Set();
+    const familyCounts = new Map();
     for (const item of scored) {
         const fullPin = pins.has(item.selector);
         if (!fullPin && claimedUnits.has(item.unitId))
             continue;
+        const family = candidateFamily(item.unitId);
+        if (!fullPin && (familyCounts.get(family) ?? 0) >= FAMILY_CAPS[family])
+            continue;
         claimedUnits.add(item.unitId);
+        familyCounts.set(family, (familyCounts.get(family) ?? 0) + 1);
         unique.push(item);
     }
-    const selected = unique.slice(0, capacity);
-    const alternatives = selected.flatMap((chosen) => {
+    return unique;
+}
+function alternativesFor(selected, scored) {
+    return selected.flatMap((chosen) => {
         const deferred = scored
             .filter((candidate) => candidate.unitId === chosen.unitId &&
             candidate.selector !== chosen.selector)
@@ -186,7 +290,67 @@ export async function planProjectActivation(projectPath, options = {}) {
             ? [{ unitId: chosen.unitId, selected: chosen.selector, deferred }]
             : [];
     });
+}
+/** Deterministic, local-only active-set selection over the reviewed library. */
+export async function planProjectActivation(projectPath, options = {}) {
+    const limit = options.limit ?? 40;
+    if (!Number.isInteger(limit) || limit < 1 || limit > 200)
+        throw new Error("--limit must be an integer from 1 to 200");
+    const project = await scanProject(projectPath);
+    const state = await readInstallState();
+    const outcomes = await readLocalOutcomes();
+    const taskFamilies = projectTaskFamilies(project);
+    const relevant = (state.activations ?? []).filter((record) => record.installationState === "installed" &&
+        (!options.agents || options.agents.includes(record.agent)));
+    const requestedAgents = options.agents ?? [
+        ...new Set(relevant.map((record) => record.agent)),
+    ];
+    const detected = (await detectAgents()).filter((agent) => requestedAgents.includes(agent.id));
+    const inventory = await scanInstalledSkills(detected);
+    const pins = new Set(options.pins ?? []);
     const warnings = [];
+    const agentPlans = requestedAgents.map((agent) => {
+        const summary = inventory.agents.find((item) => item.agent === agent);
+        if (!summary)
+            throw new Error(`Could not scan active skills for requested agent '${agent}'`);
+        const capacity = Math.max(0, limit - summary.total);
+        const ranked = rankedCandidates(relevant.filter((record) => record.agent === agent), project, pins, outcomes, taskFamilies);
+        const selected = ranked.slice(0, capacity);
+        if (!capacity)
+            warnings.push(`${summary.displayName} has reached the active-set limit ${limit}; disable skills or raise --limit.`);
+        return {
+            agent,
+            displayName: summary.displayName,
+            activeBefore: summary.total,
+            managedBefore: summary.managed,
+            unmanagedBefore: summary.unmanaged,
+            capacity,
+            selected,
+            alternatives: alternativesFor(selected, ranked),
+        };
+    });
+    const activationPlans = await Promise.all(agentPlans
+        .filter((agentPlan) => agentPlan.selected.length)
+        .map((agentPlan) => planActivationChange("enable", agentPlan.selected.map((item) => item.selector), { agents: [agentPlan.agent] })));
+    const activation = activationPlans.length
+        ? {
+            action: "enable",
+            packages: [
+                ...new Set(activationPlans.flatMap((plan) => plan.packages)),
+            ],
+            requestedAgents,
+            changes: activationPlans.flatMap((plan) => plan.changes),
+            skipped: activationPlans.flatMap((plan) => plan.skipped),
+            blocked: activationPlans.some((plan) => plan.blocked),
+            warnings: activationPlans.flatMap((plan) => plan.warnings),
+        }
+        : undefined;
+    const selected = [
+        ...new Map(agentPlans
+            .flatMap((agentPlan) => agentPlan.selected)
+            .map((item) => [item.selector, item])).values(),
+    ];
+    const alternatives = agentPlans.flatMap((item) => item.alternatives);
     const known = new Set(relevant.flatMap((record) => {
         const id = selector(record);
         return id ? [id, record.unitId] : [];
@@ -194,17 +358,13 @@ export async function planProjectActivation(projectPath, options = {}) {
     const unknownPins = [...pins].filter((pin) => !known.has(pin));
     if (unknownPins.length)
         warnings.push(`Pinned skill(s) are not in the managed library: ${unknownPins.join(", ")}`);
-    if (!capacity)
-        warnings.push(`Active-set limit ${limit} is already reached; disable skills or raise --limit.`);
-    const activation = selected.length
-        ? await planActivationChange("enable", selected.map((item) => item.selector), { ...(options.agents ? { agents: options.agents } : {}) })
-        : undefined;
     return {
         project,
         limit,
         ...(options.agents ? { agents: options.agents } : {}),
-        activeBefore,
-        capacity,
+        agentPlans,
+        activeBefore: Math.max(0, ...agentPlans.map((item) => item.activeBefore)),
+        capacity: Math.min(limit, ...agentPlans.map((item) => item.capacity)),
         selected,
         alternatives,
         ...(activation ? { activation } : {}),
@@ -214,17 +374,31 @@ export async function planProjectActivation(projectPath, options = {}) {
 export async function applyProjectActivation(plan) {
     if (!plan.activation || !plan.selected.length)
         throw new Error("No reviewed library skills were selected for activation");
-    return applyActivationChange(plan.activation);
+    return applyActivationChange(plan.activation, {
+        preflight: async () => {
+            const requested = plan.agentPlans.map((item) => item.agent);
+            const detected = (await detectAgents()).filter((agent) => requested.includes(agent.id));
+            const inventory = await scanInstalledSkills(detected);
+            for (const agentPlan of plan.agentPlans) {
+                const current = inventory.agents.find((item) => item.agent === agentPlan.agent);
+                if (!current)
+                    throw new Error(`Could not re-scan active skills for requested agent '${agentPlan.agent}'`);
+                if (current.total + agentPlan.selected.length > plan.limit)
+                    throw new Error(`${agentPlan.displayName} active skill capacity changed after preview: ${current.total} active plus ${agentPlan.selected.length} proposed exceeds limit ${plan.limit}`);
+            }
+        },
+    });
 }
 export function formatProjectActivation(plan) {
-    const detected = [...plan.project.languages, ...plan.project.frameworks];
     return [
         `Project: ${plan.project.root}`,
-        `Detected: ${detected.join(", ") || "no known project signals"}`,
-        `Active-set budget: ${plan.activeBefore}/${plan.limit} active; ${plan.capacity} slot(s) available`,
-        `Proposed additions: ${plan.selected.length}`,
-        ...plan.selected.map((item) => `  + ${item.selector} [${item.score}] — ${item.reasons.join(", ")}`),
-        ...plan.alternatives.map((item) => `  = ${item.unitId}: selected ${item.selected}; deferred equivalent source(s): ${item.deferred.join(", ")}`),
+        `Detected: ${formatDetectedSignals(plan.project) || "no known project signals"}`,
+        ...plan.agentPlans.flatMap((agentPlan) => [
+            `${agentPlan.displayName}: ${agentPlan.activeBefore} active (${agentPlan.managedBefore} managed, ${agentPlan.unmanagedBefore} unmanaged); ${agentPlan.capacity}/${plan.limit} slots available`,
+            `Proposed additions for ${agentPlan.displayName}: ${agentPlan.selected.length}`,
+            ...agentPlan.selected.map((item) => `  + ${item.selector} [${item.score}] — ${item.reasons.join(", ")}`),
+            ...agentPlan.alternatives.map((item) => `  = ${item.unitId}: selected ${item.selected}; deferred equivalent source(s): ${item.deferred.join(", ")}`),
+        ]),
         ...(plan.activation
             ? ["", "Exact activation delta:", formatActivationPlan(plan.activation)]
             : []),

package/dist/src/core/active-set.js

@@ -3,6 +3,7 @@ import { cp, lstat, mkdir, readFile, readdir, rm } from "node:fs/promises";
 import { basename, dirname, join, relative, resolve, sep } from "node:path";
 import { agentSkillsDirectory, ensureDirectory } from "./paths.js";
 import { activationLibraryPath, installStatePath, readInstallState, writeInstallState, } from "./state.js";
+import { inspectTargetOccupancy } from "./target-occupancy.js";
 import { runMutationTransaction } from "./transaction.js";
 /** Resolve a managed file to its active location or disabled library copy. */
 export function managedFileReadPath(packageId, filePath, activations) {
@@ -262,9 +263,12 @@ export async function planActivationChange(action, packageIds, options = {}) {
                     const libraryActual = await hashTree(record.libraryPath);
                     change.blockers.push(...exactTreeDifferences(record.libraryFiles, libraryActual).map((message) => `library copy: ${message}`));
                 }
-                const occupied = (await Promise.all(change.targets.map((target) => pathExists(target.activePath)))).filter(Boolean).length;
-                if (occupied)
-                    change.blockers.push(`${occupied} active target(s) already exist and would be overwritten`);
+                const occupied = (await Promise.all(change.targets.map(async (target) => ({
+                    target,
+                    result: await inspectTargetOccupancy(target.activePath),
+                })))).filter((item) => item.result.occupied);
+                if (occupied.length)
+                    change.blockers.push(`${occupied.length} active target(s) already contain protected content and would be overwritten; first target: ${occupied[0].target.activePath} (${occupied[0].result.reason})`);
             }
             changes.push(change);
         }
@@ -283,8 +287,9 @@ export async function planActivationChange(action, packageIds, options = {}) {
 function activationKey(record) {
     return `${record.packageId}\0${record.agent}\0${record.unitId ?? ""}`;
 }
-export async function applyActivationChange(plan) {
+export async function applyActivationChange(plan, options = {}) {
     const applied = await runMutationTransaction(async () => {
+        await options.preflight?.();
         const fresh = await planActivationChange(plan.action, plan.packages, {
             ...(plan.requestedAgents ? { agents: plan.requestedAgents } : {}),
         });
@@ -337,6 +342,10 @@ export async function applyActivationChange(plan) {
             else {
                 for (const target of change.targets) {
                     const source = join(change.libraryPath, target.libraryRelativePath);
+                    const occupancy = await inspectTargetOccupancy(target.activePath);
+                    if (occupancy.occupied)
+                        throw new Error(`${change.packageId}/${change.agent}: activation target became occupied: ${target.activePath} (${occupancy.reason})`);
+                    await rm(target.activePath, { recursive: true, force: true });
                     await mkdir(dirname(target.activePath), { recursive: true });
                     await cp(source, target.activePath, {
                         recursive: true,
@@ -358,7 +367,7 @@ export async function applyActivationChange(plan) {
         }
         state.activations = records.map((record) => replacements.get(activationKey(record)) ?? record);
         await writeInstallState(state);
-    });
+    }, { label: `${plan.action} project skill set` });
     return applied.snapshotId;
 }
 function formatLibraryHeadline(report) {

package/dist/src/core/adopt.js

@@ -208,7 +208,7 @@ export async function applySkillAdoption(plan, options = {}) {
                     throw new Error("The skill changed after preview; scan again before adopting it.");
             },
         });
-    });
+    }, { label: `adopt ${plan.packageId}` });
     return applied.snapshotId;
 }
 export function formatAdoptionPlan(plan) {

package/dist/src/core/catalog-coverage.js

@@ -77,7 +77,8 @@ export function formatCatalogCoverage(report) {
         .join(", ");
     return [
         `Screened catalog: ${report.technicallyScreenedRecords}/${report.records} technically complete records (target ${report.targetRecords})`,
-        `Policy selection: ${report.recommendedRecords} Stable sources · ${report.trustStages["human-reviewed"]} human-reviewed · ${report.trustStages.benchmarked} benchmarked`,
+        `Catalog maturity: ${report.records} sourced · ${report.technicallyScreenedRecords} technically inspected · ${report.recommendedRecords} selected for Stable`,
+        `Higher-confidence evidence: ${report.trustStages["human-reviewed"]} stored human-review attestations · ${report.trustStages.benchmarked} signed benchmark results`,
         `Evidence: ${report.immutablePins} immutable pins · ${report.assertedLicenses} asserted licenses · ${report.noAssertionLicenses} NOASSERTION`,
         `Coverage: ${Object.values(report.categories).length} categories · ${report.evaluationReady} evaluation-ready · ${report.activityObserved} with refreshed activity`,
         `Install shape: ${report.installShapes.skills} skill · ${report.installShapes.mcpOnly} MCP-only · ${report.installShapes.mixed} mixed`,

package/dist/src/core/catalog-install.js

@@ -123,14 +123,17 @@ export async function prepareCatalogInstall(selection, options = {}) {
         catch (error) {
             completed += 1;
             const reason = error instanceof Error ? error.message : String(error);
+            const fullyQuarantined = rejected.size > 0 && /No SKILL\.md found/.test(reason);
             options.onProgress?.({
                 packageId: pkg.id,
                 completed,
                 total: installable.length,
                 status: "skipped",
-                message: `${pkg.displayName} could not be prepared: ${reason}`,
+                message: fullyQuarantined
+                    ? `${pkg.displayName}: all ${rejected.size} discovered skill unit(s) were quarantined`
+                    : `${pkg.displayName} could not be prepared: ${reason}`,
             });
-            if (rejected.size > 0 && /No SKILL\.md found/.test(reason))
+            if (fullyQuarantined)
                 return { quarantined: [...rejected.values()] };
             return {
                 result: {
@@ -195,7 +198,7 @@ export async function prepareCatalogInstall(selection, options = {}) {
         reconciliation,
     };
 }
-export function formatPreparedCatalogInstall(prepared) {
+export function formatPreparedCatalogInstall(prepared, options = {}) {
     const targetDirectories = prepared.entries.reduce((total, entry) => total + entry.plan.files.length, 0);
     const directoriesPerAgent = prepared.agents.length
         ? Math.ceil(targetDirectories / prepared.agents.length)
@@ -215,11 +218,13 @@ export function formatPreparedCatalogInstall(prepared) {
         "Automatic skill setup does not require an OpenAI, Anthropic, or OpenRouter API key; credentialed MCP/runtime integrations remain explicit and deferred.",
     ];
     if (directoriesPerAgent > RECOMMENDED_ACTIVE_SKILL_LIMIT)
-        lines.push(`Capacity warning: about ${directoriesPerAgent} skill directories per agent exceeds the recommended active-set limit of ${RECOMMENDED_ACTIVE_SKILL_LIMIT}.${prepared.selection.mode === "maximum" ? " Maximum stores these in the disabled library; use project activation to choose the working set." : " Prefer Stable or project-aware activation for smaller context."}`);
+        lines.push(`Capacity notice: about ${directoriesPerAgent} skill directories per agent exceeds Stable's ${RECOMMENDED_ACTIVE_SKILL_LIMIT}-skill bound.${prepared.selection.mode === "maximum" ? " Maximum stores them in the disabled library; optimize or activate a project-relevant working set." : prepared.selection.mode === "power" ? " Power is the explicit larger active mode; choose Stable or project optimization when lower context use matters." : " Use project-aware activation for a smaller working set."}`);
     if (failures.length)
         lines.push(`Preparation failures (installation will remain blocked): ${failures.map((item) => item.packageId).join(", ")}`);
     if (quarantined.length)
         lines.push(`Quarantined invalid skill units: ${quarantined.length} (safe siblings remain available)`);
+    if (explicit.length)
+        lines.push(`Deferred integration setup: ${explicit.length} record(s) remain opt-in through MCP/runtime commands.`);
     if (prepared.collisions.length)
         lines.push(`Overlapping skill targets resolved: ${prepared.collisions.length} lower-ranked duplicate directories deferred`);
     if (retired.length) {
@@ -228,11 +233,19 @@ export function formatPreparedCatalogInstall(prepared) {
             lines.push(`Retire ${item.packageId}${item.unitId ? `/${item.unitId}` : ""} from ${item.agent}`);
     }
     if (risky.length)
-        lines.push(`Additional risk approval required: ${risky.map((entry) => entry.package.id).join(", ")}`);
+        lines.push(options.details
+            ? `Additional risk approval required: ${risky.map((entry) => entry.package.id).join(", ")}`
+            : `Additional risk approval required for ${risky.length} repositor${risky.length === 1 ? "y" : "ies"}. Run the preview with --details before approval.`);
     for (const warning of prepared.resolution.warnings)
         lines.push(`Warning: ${warning}`);
-    for (const item of prepared.skipped)
-        lines.push(`${item.kind === "preparation-failed" ? "Failed" : item.kind === "quarantined" ? "Quarantined" : "Deferred"} ${item.packageId}${item.unitId ? `/${item.unitId}` : ""}: ${item.reason}`);
+    if (failures.length)
+        for (const item of failures)
+            lines.push(`Failed ${item.packageId}${item.unitId ? `/${item.unitId}` : ""}: ${item.reason}`);
+    if (options.details)
+        for (const item of prepared.skipped.filter((item) => item.kind !== "preparation-failed"))
+            lines.push(`${item.kind === "quarantined" ? "Quarantined" : "Deferred"} ${item.packageId}${item.unitId ? `/${item.unitId}` : ""}: ${item.reason}`);
+    else if (quarantined.length || explicit.length)
+        lines.push("Use --details to show every quarantined or deferred unit.");
     return lines.join("\n");
 }
 export async function applyPreparedCatalogInstall(prepared, options = {}) {
@@ -258,5 +271,7 @@ export async function applyPreparedCatalogInstall(prepared, options = {}) {
         });
 }
 export function formatCatalogApplyGuidance(riskApprovalRequired) {
-    return `Preview complete; nothing was changed. Re-run with --yes${riskApprovalRequired ? " --approve-risk" : ""} to install this exact screened plan.`;
+    return riskApprovalRequired
+        ? "Preview complete; nothing was changed. Inspect the plan with --details, then re-run with --yes --approve-risk only if you accept every reported finding."
+        : "Preview complete; nothing was changed. Re-run with --yes to install this exact screened plan.";
 }

package/dist/src/core/cli-guide.js

@@ -7,6 +7,7 @@ START HERE
 
 2. Preview the recommended everyday setup
    loadout setup --mode stable
+   loadout profiles
 
 3. Find additions that fit the project in this folder
    loadout recommend --project .
@@ -17,8 +18,10 @@ START HERE
    loadout alerts
    loadout candidate list --limit 10
 
-5. If you want a visual view, start the private local dashboard
-   loadout dashboard
+5. See reviewed MCP integrations and their credential needs
+   loadout mcp-recipe
+   loadout mcp-recipe --credential-free
+   loadout mcp-recipe playwright --agent codex
 
 If you decide to install something, Loadout shows a preview first and creates a
 snapshot before changing managed files. Recover with: loadout rollback

package/dist/src/core/codex-mcp.js

@@ -16,6 +16,49 @@ function tomlString(value) {
 function tableHeader(name) {
     return `[mcp_servers.${tomlString(name)}]`;
 }
+function tablePrefix(name) {
+    return `[mcp_servers.${tomlString(name)}`;
+}
+export function codexMcpServerBlock(content, name) {
+    safeName(name);
+    const lines = content.match(/.*(?:\n|$)/g)?.filter(Boolean) ?? [];
+    const header = tableHeader(name);
+    const start = lines.findIndex((line) => line.trim() === header);
+    if (start < 0)
+        return undefined;
+    const prefix = tablePrefix(name);
+    let end = start + 1;
+    while (end < lines.length) {
+        const trimmed = lines[end].trim();
+        if (trimmed.startsWith("[") && !trimmed.startsWith(`${prefix}.`))
+            break;
+        end += 1;
+    }
+    return lines.slice(start, end).join("");
+}
+export function codexMcpServerFingerprint(content, name) {
+    const block = codexMcpServerBlock(content, name);
+    return block ? createHash("sha256").update(block).digest("hex") : undefined;
+}
+export function removeCodexMcpServerBlock(content, name) {
+    const block = codexMcpServerBlock(content, name);
+    if (!block)
+        return content;
+    return content.replace(block, "").replace(/\n{3,}/g, "\n\n");
+}
+export async function writeCodexMcpConfigContent(path, content) {
+    const target = resolve(path);
+    await mkdir(dirname(target), { recursive: true });
+    const temporary = join(dirname(target), `.${basename(target)}.loadout-${randomUUID()}.tmp`);
+    try {
+        await writeFile(temporary, content, { mode: 0o600 });
+        await rename(temporary, target);
+    }
+    catch (error) {
+        await rm(temporary, { force: true });
+        throw error;
+    }
+}
 export function defaultCodexMcpConfigPath() {
     return join(userHome(), ".codex", "config.toml");
 }
@@ -73,7 +116,7 @@ export async function planCodexMcpConfig(path, server, name = server.name) {
 async function snapshotPath(id) {
     return join(loadoutHome(), "mcp-snapshots", `${id}.json`);
 }
-export async function applyCodexMcpConfigPlan(plan) {
+export async function applyCodexMcpConfigPlan(plan, options = {}) {
     const applied = await runMutationTransaction(async () => {
         let content = "";
         let existed = true;
@@ -100,10 +143,10 @@ export async function applyCodexMcpConfigPlan(plan) {
         };
         const stored = await snapshotPath(snapshot.id);
         return {
-            targets: [plan.path, stored],
+            targets: [plan.path, stored, ...(options.extraTargets ?? [])],
             value: { plan, snapshot, stored },
         };
-    }, async ({ plan: freshPlan, snapshot, stored }) => {
+    }, async ({ plan: freshPlan, snapshot, stored }, transactionSnapshot) => {
         await mkdir(dirname(freshPlan.path), { recursive: true });
         const temporary = join(dirname(freshPlan.path), `.${basename(freshPlan.path)}.loadout-${randomUUID()}.tmp`);
         try {
@@ -111,12 +154,13 @@ export async function applyCodexMcpConfigPlan(plan) {
             await rename(temporary, freshPlan.path);
             await mkdir(dirname(stored), { recursive: true });
             await writeFile(stored, JSON.stringify(snapshot), { mode: 0o600 });
+            await options.afterApply?.(snapshot, transactionSnapshot);
         }
         catch (error) {
             await rm(temporary, { force: true });
             throw error;
         }
         return snapshot;
-    });
-    return applied.result;
+    }, { label: `configure Codex MCP ${plan.serverName}` });
+    return { ...applied.result, rollbackSnapshotId: applied.snapshotId };
 }

package/dist/src/core/completion.js

@@ -16,8 +16,6 @@ const commands = [
     "add",
     "unadd",
     "list",
-    "demo",
-    "test-drive",
     "scan",
     "status",
     "versions",
@@ -86,7 +84,6 @@ const commands = [
     "outcomes",
     "remove",
     "uninstall",
-    "dashboard",
     "serve",
     "completion",
 ];