loadout-ai 0.4.1 → 0.5.0

package/catalog/packages.json

@@ -1146,5 +1146,31 @@
       "evidencePaths": ["server.js", "package.json"],
       "verifiedAt": "2026-07-16T08:45:18Z"
     }
+  },
+  {
+    "id": "obsidian-skills",
+    "displayName": "Obsidian Skills",
+    "repository": "kepano/obsidian-skills",
+    "description": "Agent skills for working with Obsidian Markdown, Bases, JSON Canvas, Defuddle, and the Obsidian CLI.",
+    "category": "knowledge-management",
+    "tier": "community",
+    "license": "MIT",
+    "components": ["skill", "plugin"],
+    "operatingSystems": ["windows", "macos", "linux"],
+    "stars": 42827,
+    "pushedAt": "2026-06-08T16:12:01Z",
+    "source": {
+      "type": "github",
+      "url": "https://github.com/kepano/obsidian-skills",
+      "defaultBranch": "main",
+      "commit": "a1dc48e68138490d522c04cbf5822214c6eb1202",
+      "evidencePaths": [
+        "skills/obsidian-markdown/SKILL.md",
+        "skills/obsidian-bases/SKILL.md",
+        "skills/json-canvas/SKILL.md",
+        ".claude-plugin/plugin.json"
+      ],
+      "verifiedAt": "2026-07-21T08:45:00Z"
+    }
   }
 ]

package/dist/src/cli.js

@@ -3,21 +3,21 @@ import { Command, CommanderError } from "commander";
 import { existsSync } from "node:fs";
 import { createInterface } from "node:readline/promises";
 import { explainCatalogScore, loadEffectiveCatalog, loadCatalog, rankCatalog, refreshCatalog, } from "./core/catalog.js";
-import { detectAgents, parseAgentSelection } from "./core/paths.js";
+import { detectAgents, parseAgentSelection, userHome } from "./core/paths.js";
 import { readFile } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
 import { buildSkillPlan, applySkillInstall, installedAgents, } from "./core/install.js";
-import { listSnapshotIds, readSnapshot, restoreSnapshot, } from "./core/snapshot.js";
+import { listSnapshotIds, readSnapshot, restoreSnapshot, summarizeSnapshot, } from "./core/snapshot.js";
 import { fetchRepositorySnapshot } from "./core/source.js";
 import { discoverMcpManifests, summarizeMcpManifest, planMcpConfig, summarizeMcpConfigPlan, applyMcpConfigPlan, } from "./core/mcp.js";
-import { REVIEWED_MCP_RECIPES, findMcpRecipe, formatMcpRecipePlan, planMcpRecipe, verifyMcpRecipe, verifyMcpRecipeConnection, } from "./core/mcp-recipes.js";
+import { REVIEWED_MCP_RECIPES, buildMcpRecipeServer, findMcpRecipe, formatMcpRecipePlan, planMcpRecipe, verifyMcpRecipe, verifyMcpRecipeConnection, } from "./core/mcp-recipes.js";
 import { runDoctor, formatDoctorReport } from "./core/doctor.js";
 import { applyPackageUpdate, buildUpdatePlan, formatUpdatePlan, selectSafeAutomaticUpdates, } from "./core/update.js";
 import { startApiServer } from "./core/api.js";
 import { inspectPackage, formatPackageInspection } from "./core/package.js";
 import { addManifestPackage, applyProfileToManifest, initManifest, readManifest, removeManifestPackage, writeLockfile, } from "./core/manifest.js";
 import { buildHealthReport, formatHealthReport } from "./core/health.js";
-import { readInstallState, recordInstallTransaction } from "./core/state.js";
+import { installStatePath, readInstallState, recordInstallTransaction, recordMcpInstall, } from "./core/state.js";
 import { applyRemove, planRemove } from "./core/remove.js";
 import { applyUninstall, buildUninstallPlan, formatUninstallPlan, uninstallGlobalCli, } from "./core/uninstall.js";
 import { evaluateInstalledProfile, formatInstalledProfileStatus, } from "./core/profile-state.js";
@@ -31,8 +31,7 @@ import { ADAPTER_CAPABILITIES, buildAdapterCapabilityGaps, formatAdapterCapabili
 import { formatAgentInventory, inspectAgents, } from "./core/agent-inspection.js";
 import { generateSigningKeys, signJsonFile, verifyJsonFile, } from "./core/signing.js";
 import { applyPortableImport, exportPortableLoadout, planPortableImport, } from "./core/portable.js";
-import { applyCodexMcpConfigPlan, defaultCodexMcpConfigPath, planCodexMcpConfig, } from "./core/codex-mcp.js";
-import { formatDemoResult, runIsolatedDemo } from "./core/demo.js";
+import { applyCodexMcpConfigPlan, codexMcpServerFingerprint, defaultCodexMcpConfigPath, planCodexMcpConfig, } from "./core/codex-mcp.js";
 import { catalogTrustStage, formatCatalogTrustStage, resolveCatalogProfile, } from "./core/profiles.js";
 import { discoverHackerNewsRepositories } from "./core/community.js";
 import { discoverPrivateRepositories } from "./core/private-discovery.js";
@@ -44,7 +43,6 @@ import { runDisposableSandbox } from "./core/sandbox.js";
 import { compileConversion, } from "./core/conversion.js";
 import { writeFileAtomically } from "./core/atomic-file.js";
 import { formatCanaryResult, runCanary } from "./core/canary.js";
-import { startDashboardServer } from "./dashboard.js";
 import { applyPreparedCatalogInstall, formatCatalogApplyGuidance, formatPreparedCatalogInstall, prepareCatalogInstall, } from "./core/catalog-install.js";
 import { formatInstalledSkillInventory, scanInstalledSkills, } from "./core/skill-inventory.js";
 import { enrichInventoryWithProvenance, formatProvenanceSummary, resolveCatalogSkillIndex, } from "./core/provenance.js";
@@ -222,7 +220,7 @@ async function runSetup(options) {
             onProgress: printSetupProgress,
             access,
         });
-        console.log(`\n${formatPreparedCatalogInstall(prepared)}\n`);
+        console.log(`\n${formatPreparedCatalogInstall(prepared, { details: options.details })}\n`);
         const risky = riskyPackageSummary(prepared);
         let approved = Boolean(options.yes);
         let riskApproved = Boolean(options.approveRisk);
@@ -265,7 +263,7 @@ async function runSetup(options) {
         reader?.close();
     }
 }
-const LOADOUT_VERSION = "0.4.1";
+const LOADOUT_VERSION = "0.5.0";
 function durableSchedulerLauncher() {
     return [
         join(dirname(process.execPath), process.platform === "win32" ? "npx.cmd" : "npx"),
@@ -308,6 +306,7 @@ program
     .option("--api-access <providers>", "separately billed model API access: none, openai, anthropic, openrouter, or other (comma-separated; never a key)")
     .option("-y, --yes", "install after preparing the screened plan")
     .option("--approve-risk", "approve reviewed safety findings in non-interactive mode")
+    .option("--details", "show every quarantined and deferred unit")
     .action((options) => runSetup(options));
 program
     .command("upgrade")
@@ -1077,6 +1076,12 @@ program
             : Object.entries(TESTED_PROFILES)
                 .map(([id, profile]) => `${id} — ${profile.description}`)
                 .join("\n"));
+    if (name === "custom" && !options.applyTo) {
+        const profile = TESTED_PROFILES.custom;
+        return console.log(options.json
+            ? JSON.stringify({ name, ...profile, packages: [] }, null, 2)
+            : `custom: ${profile.description}\n  Use: loadout setup --mode custom --package <id>`);
+    }
     const packages = profileManifestPackages(name, await loadEffectiveCatalog());
     if (options.applyTo) {
         const manifest = await applyProfileToManifest(options.applyTo, name, packages);
@@ -1465,26 +1470,6 @@ benchmark
     if (!summary.withinBudget)
         process.exitCode = 2;
 });
-program
-    .command("demo")
-    .alias("test-drive")
-    .description("Test-drive a reviewed install + rollback in a disposable profile; never touches local agent config")
-    .option("--repository <owner/repo>", "public GitHub skill repository", "obra/superpowers")
-    .option("--package <id>", "package identifier", "obra-superpowers")
-    .option("--agents <ids>", "comma-separated virtual demo targets", "codex")
-    .option("--keep", "retain the isolated profile after install for inspection")
-    .option("--json", "emit the demo result as JSON")
-    .action(async (options) => {
-    const result = await runIsolatedDemo({
-        repository: options.repository,
-        packageId: options.package,
-        agents: parseAgentSelection(options.agents),
-        keep: options.keep,
-    });
-    console.log(options.json
-        ? JSON.stringify(result, null, 2)
-        : formatDemoResult(result));
-});
 program
     .command("capabilities")
     .description("Show honest native, adapted, and unsupported adapter capabilities")
@@ -2150,6 +2135,7 @@ program
     .command("mcp-recipe")
     .description("Preview/configure a reviewed MCP recipe, or explicitly verify its real connection")
     .argument("[id]", "recipe id; omit to list reviewed recipes")
+    .option("--agent <id>", "target host: codex or claude-code; selects its default config format and path")
     .option("--config <path>", "target JSON MCP config path")
     .option("--yes", "write the reviewed server entry after preview")
     .option("--verify", "verify the configured entry without starting a server")
@@ -2176,11 +2162,14 @@ program
             environment: recipe.environment,
             modelApiProviders: recipe.modelApiProviders,
         }));
-        console.log(options.json
+        const output = options.json
             ? JSON.stringify(listed, null, 2)
             : listed
                 .map((recipe) => `${recipe.id} — ${recipe.displayName} — ${recipe.modelApiProviders.length ? `AI API required: ${recipe.modelApiProviders.join(", ")}` : "No AI API key required"} · ${recipe.environment.length ? `${recipe.environment.includes("GITHUB_PERSONAL_ACCESS_TOKEN") ? "GitHub token required" : `service credential required: ${recipe.environment.join(", ")}`}` : "no other credential"}`)
-                .join("\n"));
+                .join("\n");
+        console.log(output);
+        if (!options.json)
+            console.log("\nInstall for one host (preview first):\n  loadout mcp-recipe playwright --agent codex\n  loadout mcp-recipe playwright --agent claude-code");
         return;
     }
     if (options.connect) {
@@ -2210,12 +2199,41 @@ program
         }
         return;
     }
-    if (!options.config)
-        throw new Error("--config is required for recipe planning or --verify");
+    if (options.agent &&
+        options.agent !== "codex" &&
+        options.agent !== "claude-code")
+        throw new Error("--agent must be codex or claude-code");
+    if (options.agent && options.config)
+        throw new Error("Choose --agent for a managed default path or --config for an explicit JSON path, not both");
+    const configPath = options.config ??
+        (options.agent === "codex"
+            ? defaultCodexMcpConfigPath()
+            : options.agent === "claude-code"
+                ? join(userHome(), ".claude.json")
+                : undefined);
+    if (!configPath)
+        throw new Error("Choose --agent codex, --agent claude-code, or an explicit --config path");
     if (options.verify) {
         if (options.yes)
             throw new Error("--verify cannot be combined with --yes");
-        const verification = await verifyMcpRecipe(id, options.config);
+        if (options.agent === "codex") {
+            const recipe = findMcpRecipe(id);
+            let content = "";
+            try {
+                content = await readFile(configPath, "utf8");
+            }
+            catch {
+                // Missing config is rendered as a normal not-configured result.
+            }
+            const configured = Boolean(codexMcpServerFingerprint(content, recipe.serverName));
+            console.log(options.json
+                ? JSON.stringify({ recipeId: id, configPath, configured }, null, 2)
+                : `${configured ? "Configured" : "Not configured"}: ${id}\nCodex config: ${configPath}\nConfiguration presence does not launch the MCP server; add --connect --approve-risk for a bounded handshake.`);
+            if (!configured)
+                process.exitCode = 1;
+            return;
+        }
+        const verification = await verifyMcpRecipe(id, configPath);
         console.log(options.json
             ? JSON.stringify(verification, null, 2)
             : `${verification.configured ? "Configured" : "Not configured"}: ${verification.recipeId}\n${[...verification.checks, ...verification.warnings].join("\n")}`);
@@ -2225,21 +2243,82 @@ program
     }
     const recipe = findMcpRecipe(id);
     const credentialReferences = parseMcpCredentialMappings(recipe, options.credential, options.credentialAccount);
-    const plan = await planMcpRecipe(id, options.config, {
+    if (options.agent === "codex") {
+        const server = buildMcpRecipeServer(id, configPath, {
+            credentialReferences,
+            requireResolvedCredentials: Boolean(options.yes),
+        });
+        const plan = await planCodexMcpConfig(configPath, server, server.name);
+        const recipe = findMcpRecipe(id);
+        const preview = [
+            `MCP recipe: ${recipe.displayName}`,
+            `Target: Codex`,
+            `Config: ${plan.path}`,
+            `Change: ${plan.summary}`,
+            `Artifact: ${recipe.artifact}`,
+            `Permissions: ${recipe.permissions.join(", ")}`,
+            recipe.environment.length
+                ? `Credential references required: ${recipe.environment.join(", ")}`
+                : "Credentials: none",
+        ].join("\n");
+        if (!options.yes) {
+            console.log(options.json
+                ? JSON.stringify({
+                    recipe,
+                    agent: "codex",
+                    path: plan.path,
+                    summary: plan.summary,
+                }, null, 2)
+                : `${preview}\nDry run only. Re-run with --yes to add this reviewed Codex MCP server.`);
+            return;
+        }
+        const fingerprint = codexMcpServerFingerprint(plan.proposed, recipe.serverName);
+        if (!fingerprint)
+            throw new Error("Could not fingerprint the applied Codex MCP entry");
+        const snapshot = await applyCodexMcpConfigPlan(plan, {
+            extraTargets: [installStatePath()],
+            afterApply: async (_result, transactionSnapshot) => recordMcpInstall({
+                packageId: `mcp-recipe:${id}:codex`,
+                configPath: plan.path,
+                serverName: recipe.serverName,
+                fingerprint,
+                snapshotId: transactionSnapshot.id,
+                installedAt: new Date().toISOString(),
+                configFormat: "codex-toml",
+            }),
+        });
+        console.log(options.json
+            ? JSON.stringify({
+                recipe,
+                agent: "codex",
+                snapshotId: snapshot.rollbackSnapshotId,
+            }, null, 2)
+            : `${preview}\nConfigured for Codex. Managed package: mcp-recipe:${id}:codex\nRollback: loadout rollback --snapshot ${snapshot.rollbackSnapshotId}\nNext: loadout mcp-recipe ${id} --agent codex --verify`);
+        return;
+    }
+    const plan = await planMcpRecipe(id, configPath, {
         credentialReferences,
         requireResolvedCredentials: Boolean(options.yes),
     });
     if (!options.yes) {
+        const target = options.agent === "claude-code" ? "Target: Claude Code\n" : "";
         console.log(options.json
-            ? JSON.stringify(plan, null, 2)
-            : `${formatMcpRecipePlan(plan)}\nDry run only. Re-run with --yes to write this server entry.`);
+            ? JSON.stringify(options.agent ? { agent: options.agent, ...plan } : plan, null, 2)
+            : `${target}${formatMcpRecipePlan(plan)}\nDry run only. Re-run with --yes to write this server entry.`);
         return;
     }
-    const snapshot = await applyMcpConfigPlan(plan.config);
-    await recordInstallTransaction([], [{ packageId: `mcp-recipe:${id}`, plan: plan.config }], snapshot.id);
+    const managedId = options.agent
+        ? `mcp-recipe:${id}:${options.agent}`
+        : `mcp-recipe:${id}`;
+    const snapshot = await applyMcpConfigPlan(plan.config, {
+        extraTargets: [installStatePath()],
+        afterApply: async (_result, transactionSnapshot) => {
+            await recordInstallTransaction([], [{ packageId: managedId, plan: plan.config }], transactionSnapshot.id);
+        },
+    });
     console.log(options.json
         ? JSON.stringify({ plan, snapshot }, null, 2)
-        : `${formatMcpRecipePlan(plan)}\nConfigured. Snapshot: ${snapshot.id}\nAuthorize the service separately, then run: loadout mcp-recipe ${id} --config ${plan.config.path} --verify`);
+        : `${options.agent === "claude-code" ? "Target: Claude Code\n" : ""}${formatMcpRecipePlan(plan)}\nConfigured${options.agent ? " for Claude Code" : ""}. Managed package: ${managedId}\nRollback: loadout rollback --snapshot ${snapshot.rollbackSnapshotId}\nAuthorize the service separately, then run: loadout mcp-recipe ${id} ${options.agent ? `--agent ${options.agent}` : `--config ${plan.config.path}`} --verify`);
 });
 program
     .command("mcp")
@@ -2439,7 +2518,7 @@ program
         return;
     }
     const snapshot = await applyMcpConfigPlan(plan);
-    console.log(`Applied successfully. Snapshot: ${snapshot.id}`);
+    console.log(`Applied successfully. Snapshot: ${snapshot.rollbackSnapshotId}`);
 });
 program
     .command("codex-mcp-config")
@@ -2478,7 +2557,7 @@ program
     if (!options.yes)
         return console.log("Dry run only. Re-run with --yes to add this Codex MCP server.");
     const snapshot = await applyCodexMcpConfigPlan(plan);
-    console.log(`Applied successfully. Snapshot: ${snapshot.id}`);
+    console.log(`Applied successfully. Snapshot: ${snapshot.rollbackSnapshotId}`);
 });
 program
     .command("plan")
@@ -2575,6 +2654,7 @@ program
     .option("--agents <ids>", "comma-separated agent ids; defaults to all detected agents")
     .option("--yes", "apply without interactive confirmation")
     .option("--approve-risk", "approve reviewed safety findings for catalog mode")
+    .option("--details", "show every quarantined and deferred unit")
     .action(async (options) => {
     const packageIds = options.package ?? [];
     const hasSource = Boolean(options.source || options.repository);
@@ -2589,7 +2669,9 @@ program
             requestedAgents: parseAgentSelection(options.agents),
             onProgress: printSetupProgress,
         });
-        console.log(formatPreparedCatalogInstall(prepared));
+        console.log(formatPreparedCatalogInstall(prepared, {
+            details: options.details,
+        }));
         if (!options.yes) {
             console.log(formatCatalogApplyGuidance(prepared.entries.some((entry) => entry.safety.approvalRequired)));
             return;
@@ -2662,8 +2744,15 @@ program
         const snapshotIds = await listSnapshotIds();
         if (!snapshotIds.length)
             return console.log("No Loadout snapshots found.");
-        for (const id of snapshotIds)
-            console.log(id);
+        console.log("Loadout rollback history (oldest to newest):");
+        for (const [index, id] of snapshotIds.entries()) {
+            const summary = summarizeSnapshot(await readSnapshot(id));
+            const impact = summary.changedEntries === undefined
+                ? "legacy impact unknown"
+                : `${summary.changedEntries} changed filesystem entr${summary.changedEntries === 1 ? "y" : "ies"}`;
+            console.log(`${index === snapshotIds.length - 1 ? "latest" : "      "}  ${summary.createdAt}  ${summary.label}  ${impact}  ${summary.roots} root(s)  ${id}`);
+        }
+        console.log("Restore an exact entry with: loadout rollback --snapshot <id>");
         return;
     }
     const selected = await withMutationLock(async () => {
@@ -2671,12 +2760,15 @@ program
         const chosen = options.snapshot ?? snapshotIds.at(-1);
         if (!chosen)
             throw new Error("No Loadout snapshots found");
-        await restoreSnapshot(await readSnapshot(chosen), {
+        const snapshot = await readSnapshot(chosen);
+        await restoreSnapshot(snapshot, {
             requireUnchangedPostMutationState: true,
         });
-        return chosen;
+        return summarizeSnapshot(snapshot);
     });
-    console.log(`Restored snapshot ${selected}`);
+    console.log(`Restored ${selected.label} snapshot ${selected.id} (${selected.changedEntries ?? "unknown"} recorded changed filesystem entries across ${selected.roots} root(s)).`);
+    if (selected.changedEntries === 0)
+        console.log("This snapshot recorded no effective filesystem change. Choose an older explicit snapshot if you meant to undo an earlier installation.");
 });
 program
     .command("update")
@@ -2844,26 +2936,6 @@ program
     if (result.status === "blocked")
         process.exitCode = 1;
 });
-program
-    .command("dashboard")
-    .description("Start the local Loadout dashboard on a loopback-only port")
-    .option("--port <port>", "TCP port (0 selects an available port)", "0")
-    .action(async (options) => {
-    const port = Number(options.port);
-    if (!Number.isInteger(port) || port < 0 || port > 65_535)
-        throw new Error("--port must be an integer between 0 and 65535");
-    const handle = await startDashboardServer({}, port);
-    console.log(`Loadout dashboard: http://${handle.host}:${handle.port}`);
-    await new Promise((resolve) => {
-        const stop = () => {
-            process.off("SIGINT", stop);
-            process.off("SIGTERM", stop);
-            void handle.close().then(resolve);
-        };
-        process.on("SIGINT", stop);
-        process.on("SIGTERM", stop);
-    });
-});
 program
     .command("serve")
     .description("Start a loopback-only read-only API for status, health, catalog, and updates")

package/dist/src/core/active-policy.js

@@ -19,13 +19,46 @@ const FOUNDATION = new Set([
     "code-review-excellence",
     "api-design-principles",
     "architecture-patterns",
-    "accessibility-compliance",
     "deployment-pipeline-design",
     "documentation-writer",
     "openai-docs",
-    "web-design-guidelines",
 ]);
-const SPECIALIZED_WITHOUT_SIGNAL = /(?:appstore|backtesting|bats-|oracle|salesforce|power-bi|dataverse|qdrant|azure-|aws-|mcp-server-generator|sandbox-npm|migration)/;
+const SPECIALIZED_WITHOUT_SIGNAL = /(?:appstore|msstore|backtesting|bats-|oracle|salesforce|power-bi|dataverse|qdrant|azure-|aws-|mcp-server-generator|sandbox-npm|migration|social-(?:publish|media)|marketing|copywriting)/;
+/**
+ * A matching word such as `mcp`, `cli`, or `publish` is not enough to make a
+ * skill compatible with the detected project. These gates run before scoring
+ * so a strong generic signal cannot pull in tooling for another ecosystem.
+ * Explicit pins remain an intentional user override.
+ */
+function hasProjectCompatibility(name, project) {
+    const hasLanguage = (language) => project.languages.includes(language);
+    const languageRequirements = [
+        [/(?:dotnet|csharp|aspnet|nuget|maui)/, ".net"],
+        [
+            /(?:python|pytest|fastapi|django|flask|pydantic|poetry|uv-package)/,
+            "python",
+        ],
+        [/(?:^|-)go(?:-|$)|golang/, "go"],
+        [/(?:rust|cargo)/, "rust"],
+        [/(?:^|-)java(?:-|$)|spring-boot/, "java"],
+        [/(?:ruby|rails|bundler)/, "ruby"],
+        [/(?:elixir|phoenix)/, "elixir"],
+    ];
+    for (const [pattern, language] of languageRequirements)
+        if (pattern.test(name) && !hasLanguage(language))
+            return false;
+    if (/(?:nodejs-)?backend|api-server/.test(name) &&
+        !project.roles.includes("backend"))
+        return false;
+    if (/(?:^|-)vercel(?:-|$)/.test(name) &&
+        !project.frameworks.includes("next.js") &&
+        !project.files.includes("vercel.json"))
+        return false;
+    if (/(?:publish-to-pages|github-pages|cloudflare-pages)/.test(name) &&
+        !project.frameworks.some((framework) => ["react", "next.js", "vue", "svelte"].includes(framework)))
+        return false;
+    return true;
+}
 const SOURCE_PRIORITY = {
     superpowers: 80,
     context7: 75,
@@ -49,7 +82,7 @@ const GENERAL = [
 const SIGNAL_RULES = [
     {
         signal: (project) => project.languages.includes("javascript/typescript"),
-        pattern: /(?:javascript|typescript|nodejs|npm|webapp)/,
+        pattern: /(?:javascript|typescript|nodejs|webapp)|(?:^|-)npm(?:-|$)/,
         label: "JavaScript/TypeScript project",
     },
     {
@@ -89,12 +122,12 @@ const SIGNAL_RULES = [
     },
     {
         signal: (project) => project.roles.includes("node-cli"),
-        pattern: /(?:^|-)cli(?:-|$)|command-line/,
+        pattern: /^(?:cli|cli-design|cli-mastery|node-cli|command-line|command-line-tools?|building-cli(?:-apps?)?)$/,
         label: "Node CLI",
     },
     {
         signal: (project) => project.roles.includes("npm-package"),
-        pattern: /npm|package|publish/,
+        pattern: /(?:^|-)npm(?:-|$)|package|publish/,
         label: "npm package",
     },
     {
@@ -112,6 +145,11 @@ const SIGNAL_RULES = [
         pattern: /security|threat|secrets|owasp/,
         label: "security policy",
     },
+    {
+        signal: (project) => project.roles.includes("obsidian-vault"),
+        pattern: /obsidian|json-canvas|defuddle/,
+        label: "Obsidian vault",
+    },
     {
         signal: (project) => project.tools.includes("vitest"),
         pattern: /vitest/,
@@ -119,12 +157,12 @@ const SIGNAL_RULES = [
     },
     {
         signal: (project) => project.tools.includes("commander"),
-        pattern: /(?:^|-)cli(?:-|$)|commander|command-line/,
+        pattern: /^(?:cli|cli-design|cli-mastery|node-cli|commander|command-line|command-line-tools?|building-cli(?:-apps?)?)$/,
         label: "Commander CLI",
     },
     {
         signal: (project) => project.tools.includes("zod"),
-        pattern: /zod|schema|validation/,
+        pattern: /zod|schema-validation|(?:^|-)validation(?:-|$)/,
         label: "Zod schemas",
     },
 ];
@@ -179,6 +217,8 @@ function scoreCandidate(record, project, pinned, outcomes, taskFamilies) {
         reasons.push("explicitly pinned");
     }
     const explicitlyPinned = score >= 1000;
+    if (!explicitlyPinned && !hasProjectCompatibility(name, project))
+        return undefined;
     if (!explicitlyPinned && SPECIALIZED_WITHOUT_SIGNAL.test(name))
         return undefined;
     if (FOUNDATION.has(name)) {

package/dist/src/core/active-set.js

@@ -367,7 +367,7 @@ export async function applyActivationChange(plan, options = {}) {
         }
         state.activations = records.map((record) => replacements.get(activationKey(record)) ?? record);
         await writeInstallState(state);
-    });
+    }, { label: `${plan.action} project skill set` });
     return applied.snapshotId;
 }
 function formatLibraryHeadline(report) {

package/dist/src/core/adopt.js

@@ -208,7 +208,7 @@ export async function applySkillAdoption(plan, options = {}) {
                     throw new Error("The skill changed after preview; scan again before adopting it.");
             },
         });
-    });
+    }, { label: `adopt ${plan.packageId}` });
     return applied.snapshotId;
 }
 export function formatAdoptionPlan(plan) {

package/dist/src/core/catalog-coverage.js

@@ -77,7 +77,8 @@ export function formatCatalogCoverage(report) {
         .join(", ");
     return [
         `Screened catalog: ${report.technicallyScreenedRecords}/${report.records} technically complete records (target ${report.targetRecords})`,
-        `Policy selection: ${report.recommendedRecords} Stable sources · ${report.trustStages["human-reviewed"]} human-reviewed · ${report.trustStages.benchmarked} benchmarked`,
+        `Catalog maturity: ${report.records} sourced · ${report.technicallyScreenedRecords} technically inspected · ${report.recommendedRecords} selected for Stable`,
+        `Higher-confidence evidence: ${report.trustStages["human-reviewed"]} stored human-review attestations · ${report.trustStages.benchmarked} signed benchmark results`,
         `Evidence: ${report.immutablePins} immutable pins · ${report.assertedLicenses} asserted licenses · ${report.noAssertionLicenses} NOASSERTION`,
         `Coverage: ${Object.values(report.categories).length} categories · ${report.evaluationReady} evaluation-ready · ${report.activityObserved} with refreshed activity`,
         `Install shape: ${report.installShapes.skills} skill · ${report.installShapes.mcpOnly} MCP-only · ${report.installShapes.mixed} mixed`,

package/dist/src/core/catalog-install.js

@@ -123,14 +123,17 @@ export async function prepareCatalogInstall(selection, options = {}) {
         catch (error) {
             completed += 1;
             const reason = error instanceof Error ? error.message : String(error);
+            const fullyQuarantined = rejected.size > 0 && /No SKILL\.md found/.test(reason);
             options.onProgress?.({
                 packageId: pkg.id,
                 completed,
                 total: installable.length,
                 status: "skipped",
-                message: `${pkg.displayName} could not be prepared: ${reason}`,
+                message: fullyQuarantined
+                    ? `${pkg.displayName}: all ${rejected.size} discovered skill unit(s) were quarantined`
+                    : `${pkg.displayName} could not be prepared: ${reason}`,
             });
-            if (rejected.size > 0 && /No SKILL\.md found/.test(reason))
+            if (fullyQuarantined)
                 return { quarantined: [...rejected.values()] };
             return {
                 result: {
@@ -195,7 +198,7 @@ export async function prepareCatalogInstall(selection, options = {}) {
         reconciliation,
     };
 }
-export function formatPreparedCatalogInstall(prepared) {
+export function formatPreparedCatalogInstall(prepared, options = {}) {
     const targetDirectories = prepared.entries.reduce((total, entry) => total + entry.plan.files.length, 0);
     const directoriesPerAgent = prepared.agents.length
         ? Math.ceil(targetDirectories / prepared.agents.length)
@@ -215,11 +218,13 @@ export function formatPreparedCatalogInstall(prepared) {
         "Automatic skill setup does not require an OpenAI, Anthropic, or OpenRouter API key; credentialed MCP/runtime integrations remain explicit and deferred.",
     ];
     if (directoriesPerAgent > RECOMMENDED_ACTIVE_SKILL_LIMIT)
-        lines.push(`Capacity warning: about ${directoriesPerAgent} skill directories per agent exceeds the recommended active-set limit of ${RECOMMENDED_ACTIVE_SKILL_LIMIT}.${prepared.selection.mode === "maximum" ? " Maximum stores these in the disabled library; use project activation to choose the working set." : " Prefer Stable or project-aware activation for smaller context."}`);
+        lines.push(`Capacity notice: about ${directoriesPerAgent} skill directories per agent exceeds Stable's ${RECOMMENDED_ACTIVE_SKILL_LIMIT}-skill bound.${prepared.selection.mode === "maximum" ? " Maximum stores them in the disabled library; optimize or activate a project-relevant working set." : prepared.selection.mode === "power" ? " Power is the explicit larger active mode; choose Stable or project optimization when lower context use matters." : " Use project-aware activation for a smaller working set."}`);
     if (failures.length)
         lines.push(`Preparation failures (installation will remain blocked): ${failures.map((item) => item.packageId).join(", ")}`);
     if (quarantined.length)
         lines.push(`Quarantined invalid skill units: ${quarantined.length} (safe siblings remain available)`);
+    if (explicit.length)
+        lines.push(`Deferred integration setup: ${explicit.length} record(s) remain opt-in through MCP/runtime commands.`);
     if (prepared.collisions.length)
         lines.push(`Overlapping skill targets resolved: ${prepared.collisions.length} lower-ranked duplicate directories deferred`);
     if (retired.length) {
@@ -228,11 +233,19 @@ export function formatPreparedCatalogInstall(prepared) {
             lines.push(`Retire ${item.packageId}${item.unitId ? `/${item.unitId}` : ""} from ${item.agent}`);
     }
     if (risky.length)
-        lines.push(`Additional risk approval required: ${risky.map((entry) => entry.package.id).join(", ")}`);
+        lines.push(options.details
+            ? `Additional risk approval required: ${risky.map((entry) => entry.package.id).join(", ")}`
+            : `Additional risk approval required for ${risky.length} repositor${risky.length === 1 ? "y" : "ies"}. Run the preview with --details before approval.`);
     for (const warning of prepared.resolution.warnings)
         lines.push(`Warning: ${warning}`);
-    for (const item of prepared.skipped)
-        lines.push(`${item.kind === "preparation-failed" ? "Failed" : item.kind === "quarantined" ? "Quarantined" : "Deferred"} ${item.packageId}${item.unitId ? `/${item.unitId}` : ""}: ${item.reason}`);
+    if (failures.length)
+        for (const item of failures)
+            lines.push(`Failed ${item.packageId}${item.unitId ? `/${item.unitId}` : ""}: ${item.reason}`);
+    if (options.details)
+        for (const item of prepared.skipped.filter((item) => item.kind !== "preparation-failed"))
+            lines.push(`${item.kind === "quarantined" ? "Quarantined" : "Deferred"} ${item.packageId}${item.unitId ? `/${item.unitId}` : ""}: ${item.reason}`);
+    else if (quarantined.length || explicit.length)
+        lines.push("Use --details to show every quarantined or deferred unit.");
     return lines.join("\n");
 }
 export async function applyPreparedCatalogInstall(prepared, options = {}) {
@@ -258,5 +271,7 @@ export async function applyPreparedCatalogInstall(prepared, options = {}) {
         });
 }
 export function formatCatalogApplyGuidance(riskApprovalRequired) {
-    return `Preview complete; nothing was changed. Re-run with --yes${riskApprovalRequired ? " --approve-risk" : ""} to install this exact screened plan.`;
+    return riskApprovalRequired
+        ? "Preview complete; nothing was changed. Inspect the plan with --details, then re-run with --yes --approve-risk only if you accept every reported finding."
+        : "Preview complete; nothing was changed. Re-run with --yes to install this exact screened plan.";
 }

package/dist/src/core/cli-guide.js

@@ -7,6 +7,7 @@ START HERE
 
 2. Preview the recommended everyday setup
    loadout setup --mode stable
+   loadout profiles
 
 3. Find additions that fit the project in this folder
    loadout recommend --project .
@@ -17,8 +18,10 @@ START HERE
    loadout alerts
    loadout candidate list --limit 10
 
-5. If you want a visual view, start the private local dashboard
-   loadout dashboard
+5. See reviewed MCP integrations and their credential needs
+   loadout mcp-recipe
+   loadout mcp-recipe --credential-free
+   loadout mcp-recipe playwright --agent codex
 
 If you decide to install something, Loadout shows a preview first and creates a
 snapshot before changing managed files. Recover with: loadout rollback