loadout-ai 0.5.1 → 0.5.3

package/CHANGELOG.md

@@ -2,6 +2,30 @@
 
 ## Unreleased
 
+## 0.5.3 - 2026-07-21
+
+### Fixed
+
+- Include reviewed runtime-tool skills installed at official host-specific paths in
+  inventory, provenance, capacity, and health reporting. Graphify is now recognized
+  as Loadout-managed in both `~/.claude/skills` and Codex's `~/.codex/skills` target.
+- Report managed MCP server and runtime-tool counts in health, and warn when an
+  installed runtime tool's expected skill target disappears.
+- Give runtime-tool install snapshots meaningful labels instead of `managed change`.
+- Allow 30 seconds by default for a cold reviewed MCP connection handshake and make
+  MCP-only removal preview language accurately describe a removal plan.
+
+## 0.5.2 - 2026-07-21
+
+### Fixed
+
+- Revalidate and apply the exact skill-and-agent activation delta shown in a project
+  preview instead of broadening package selections across every requested agent.
+- Reject browser-testing skills and Playwright MCP recommendations for CLI-only
+  TypeScript projects without a browser or frontend signal.
+- Replace unexplained ranking numbers and a duplicated full activation delta with a
+  concise exact-transaction summary in the default project optimization output.
+
 ## 0.5.1 - 2026-07-21
 
 ### Fixed

package/MASTER_PLAN.md

@@ -277,6 +277,23 @@ merged `codex/relatable-readme-hero` remote branch remains safe to delete after
       previews an unblocked removal of 29 packages/2,316 disabled records, and health
       reports `library ready (nothing active)` with explicit counts. Release as
       `0.5.1` before continuing the complete-uninstall acceptance step.
+- [x] `P18-38 [TERRA]` Fix the founder-discovered asymmetric project-activation
+      scope bug. The `0.5.1` preview correctly budgeted 22 Codex and 18 Claude
+      additions, but apply-time revalidation broadened four Codex-only selectors
+      onto Claude. Revalidation now preserves the exact package, skill, and agent
+      tuple from the preview; a two-agent regression proves exact 30/18 applied
+      counts. CLI-only TypeScript projects also reject browser-testing and
+      Playwright false positives, and the default preview removes unexplained scores
+      and duplicated delta output. Release as `0.5.2` before resuming activation.
+- [x] `P18-39 [TERRA]` Integrate reviewed runtime tools into the same inventory and
+      health truth as skill repositories. Founder testing proved Graphify installed
+      correctly for Claude Code and Codex, but the scanner counted Claude's target as
+      unmanaged and omitted Codex's official `~/.codex/skills` target because its
+      standard collection root is `~/.agents/skills`. Scan every registered runtime
+      target, attribute it to `runtime-tool:<id>`, count both host targets in health,
+      surface runtime/MCP totals and missing targets, label runtime snapshots, and
+      raise the default cold MCP handshake window to the tested 30 seconds. Release
+      as `0.5.3` before continuing Graphify removal and discovery/update acceptance.
 
 ### Release 0.3 lifecycle hardening
 

package/README.md

@@ -26,7 +26,7 @@
 </p>
 
 > [!IMPORTANT]
-> Installation is version-pinned so the code you test matches these docs. The commands below target `loadout-ai@0.5.1`; review the preview before every apply.
+> Installation is version-pinned so the code you test matches these docs. The commands below target `loadout-ai@0.5.3`; review the preview before every apply.
 
 ## How it works
 
@@ -76,7 +76,7 @@ Skills, plugins, MCP servers, and agent settings tend to accumulate one experime
 You need Node.js 20 or newer and Git.
 
 ```bash
-npm install --global loadout-ai@0.5.1
+npm install --global loadout-ai@0.5.3
 loadout --version
 loadout guide
 ```

package/dist/src/cli.js

@@ -263,7 +263,7 @@ async function runSetup(options) {
         reader?.close();
     }
 }
-const LOADOUT_VERSION = "0.5.1";
+const LOADOUT_VERSION = "0.5.3";
 function durableSchedulerLauncher() {
     return [
         join(dirname(process.execPath), process.platform === "win32" ? "npx.cmd" : "npx"),
@@ -1007,7 +1007,7 @@ program
     const plan = await planRemove(packageId);
     console.log(JSON.stringify(plan, null, 2));
     if (!options.yes)
-        return console.log("Dry run only. Re-run with --yes to remove these files.");
+        return console.log("Dry run only. Re-run with --yes to apply this removal plan.");
     const snapshot = await applyRemove(plan, { force: options.force });
     console.log(`Removed ${packageId}. Snapshot: ${snapshot}`);
 });
@@ -2142,7 +2142,7 @@ program
     .option("--connect", "launch the exact pinned artifact and perform an MCP initialize handshake")
     .option("--credential <mapping>", "credential mapping NAME=env:VARIABLE or NAME=keychain:SERVICE (repeatable)", collectOption, [])
     .option("--credential-account <account>", "account for keychain mappings")
-    .option("--timeout <milliseconds>", "real connection timeout", "8000")
+    .option("--timeout <milliseconds>", "real connection timeout", "30000")
     .option("--approve-risk", "approve launching the reviewed pinned MCP artifact for --connect")
     .option("--json", "emit machine-readable JSON")
     .option("--no-key", "list recipes needing no separately billed AI/model API key")

package/dist/src/core/active-policy.js

@@ -57,6 +57,10 @@ function hasProjectCompatibility(name, project) {
     if (/(?:publish-to-pages|github-pages|cloudflare-pages)/.test(name) &&
         !project.frameworks.some((framework) => ["react", "next.js", "vue", "svelte"].includes(framework)))
         return false;
+    if (/playwright|e2e|webapp-testing|browser-testing/.test(name) &&
+        !project.frameworks.includes("playwright") &&
+        !project.frameworks.some((framework) => ["react", "next.js", "vue", "svelte"].includes(framework)))
+        return false;
     return true;
 }
 const SOURCE_PRIORITY = {
@@ -396,11 +400,20 @@ export function formatProjectActivation(plan) {
         ...plan.agentPlans.flatMap((agentPlan) => [
             `${agentPlan.displayName}: ${agentPlan.activeBefore} active (${agentPlan.managedBefore} managed, ${agentPlan.unmanagedBefore} unmanaged); ${agentPlan.capacity}/${plan.limit} slots available`,
             `Proposed additions for ${agentPlan.displayName}: ${agentPlan.selected.length}`,
-            ...agentPlan.selected.map((item) => `  + ${item.selector} [${item.score}] — ${item.reasons.join(", ")}`),
+            ...agentPlan.selected.map((item) => `  + ${item.selector} — ${item.reasons.join(", ")}`),
             ...agentPlan.alternatives.map((item) => `  = ${item.unitId}: selected ${item.selected}; deferred equivalent source(s): ${item.deferred.join(", ")}`),
         ]),
         ...(plan.activation
-            ? ["", "Exact activation delta:", formatActivationPlan(plan.activation)]
+            ? plan.activation.blocked
+                ? [
+                    "",
+                    "Blocked activation details:",
+                    formatActivationPlan(plan.activation),
+                ]
+                : [
+                    "",
+                    `Activation transaction: ${plan.activation.changes.length} exact skill change(s), applied together with one rollback snapshot.`,
+                ]
             : []),
         ...plan.warnings.map((warning) => `Warning: ${warning}`),
     ].join("\n");

package/dist/src/core/active-set.js

@@ -287,12 +287,39 @@ export async function planActivationChange(action, packageIds, options = {}) {
 function activationKey(record) {
     return `${record.packageId}\0${record.agent}\0${record.unitId ?? ""}`;
 }
+async function revalidateExactActivationPlan(plan) {
+    const selectorsByAgent = new Map();
+    for (const change of plan.changes) {
+        const selectors = selectorsByAgent.get(change.agent) ?? [];
+        selectors.push(change.unitId ? `${change.packageId}/${change.unitId}` : change.packageId);
+        selectorsByAgent.set(change.agent, selectors);
+    }
+    const fragments = await Promise.all([...selectorsByAgent].map(([agent, selectors]) => planActivationChange(plan.action, selectors, { agents: [agent] })));
+    const changes = fragments.flatMap((fragment) => fragment.changes);
+    const plannedKeys = plan.changes.map(activationKey);
+    const freshKeys = changes.map(activationKey);
+    if (new Set(plannedKeys).size !== plannedKeys.length ||
+        new Set(freshKeys).size !== freshKeys.length ||
+        plannedKeys.length !== freshKeys.length ||
+        plannedKeys.some((key) => !freshKeys.includes(key)))
+        throw new Error("Activation selection changed after preview; generate a new plan before applying.");
+    const order = new Map(plannedKeys.map((key, index) => [key, index]));
+    changes.sort((left, right) => order.get(activationKey(left)) - order.get(activationKey(right)));
+    const warnings = fragments.flatMap((fragment) => fragment.warnings);
+    return {
+        action: plan.action,
+        packages: plan.packages,
+        ...(plan.requestedAgents ? { requestedAgents: plan.requestedAgents } : {}),
+        changes,
+        skipped: fragments.flatMap((fragment) => fragment.skipped),
+        blocked: warnings.length > 0,
+        warnings,
+    };
+}
 export async function applyActivationChange(plan, options = {}) {
     const applied = await runMutationTransaction(async () => {
         await options.preflight?.();
-        const fresh = await planActivationChange(plan.action, plan.packages, {
-            ...(plan.requestedAgents ? { agents: plan.requestedAgents } : {}),
-        });
+        const fresh = await revalidateExactActivationPlan(plan);
         if (fresh.blocked)
             throw new Error(fresh.warnings.join("; "));
         if (!fresh.changes.length)

package/dist/src/core/health.js

@@ -1,10 +1,12 @@
 import { createHash } from "node:crypto";
 import { readFile } from "node:fs/promises";
+import { join } from "node:path";
 import { managedFileReadPath } from "./active-set.js";
 import { detectAgents } from "./paths.js";
 import { readInstallState } from "./state.js";
 import { buildUpdatePlan } from "./update.js";
 import { codexMcpServerFingerprint } from "./codex-mcp.js";
+import { listInstalledRuntimeToolSkillTargets, listInstalledRuntimeTools, } from "./runtime-tools.js";
 async function drift(record, activations) {
     const changed = [];
     for (const file of record.files) {
@@ -35,18 +37,30 @@ async function mcpDrift(configPath, serverName, expected, configFormat = "json")
     }
 }
 export async function buildHealthReport(options = {}) {
-    const [agents, state, updates] = await Promise.all([
-        detectAgents(),
+    const [agents, state, updates, runtimeTools, runtimeTargets] = await Promise.all([
+        options.agents ? options.agents() : detectAgents(),
         readInstallState(),
         options.updates
             ? options.updates()
             : options.checkUpdates
                 ? buildUpdatePlan()
                 : Promise.resolve([]),
+        listInstalledRuntimeTools(),
+        listInstalledRuntimeToolSkillTargets(),
     ]);
     const drifted = (await Promise.all(state.installs.map((record) => drift(record, state.activations ?? [])))).flat();
     const driftedMcpServers = (await Promise.all((state.mcpInstalls ?? []).map((entry) => mcpDrift(entry.configPath, entry.serverName, entry.fingerprint, entry.configFormat)))).filter(Boolean).length;
     const findings = [];
+    const runtimeTargetPresence = await Promise.all(runtimeTargets.map(async (target) => {
+        try {
+            await readFile(join(target.path, "SKILL.md"));
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }));
+    const missingRuntimeTargets = runtimeTargetPresence.filter((present) => !present).length;
     if (!agents.some((agent) => agent.installed))
         findings.push({
             level: "error",
@@ -81,6 +95,13 @@ export async function buildHealthReport(options = {}) {
             message: `${driftedMcpServers} managed MCP server entry or entries changed or disappeared outside Loadout.`,
             fix: "Review the MCP config, then synchronize or remove the owning package.",
         });
+    if (missingRuntimeTargets)
+        findings.push({
+            level: "warning",
+            code: "managed-runtime-target-drift",
+            message: `${missingRuntimeTargets} managed runtime-tool skill target(s) changed or disappeared.`,
+            fix: "Review the target, then remove and reinstall the owning runtime tool.",
+        });
     const available = updates.filter((update) => update.status === "update-available");
     if (available.length)
         findings.push({
@@ -99,9 +120,11 @@ export async function buildHealthReport(options = {}) {
             message: `${errors.length} update check(s) could not be completed.`,
             fix: "Check connectivity and retry.",
         });
-    const configured = state.installs.length > 0 || (state.mcpInstalls ?? []).length > 0;
+    const configured = state.installs.length > 0 ||
+        (state.mcpInstalls ?? []).length > 0 ||
+        runtimeTools.length > 0;
     const activeSkills = (state.activations ?? []).filter((entry) => entry.installationState === "installed" &&
-        entry.activationState === "active").length;
+        entry.activationState === "active").length + runtimeTargetPresence.filter(Boolean).length;
     const disabledSkills = (state.activations ?? []).filter((entry) => entry.installationState === "installed" &&
         entry.activationState === "disabled").length;
     const status = findings.some((finding) => finding.level === "error")
@@ -110,7 +133,10 @@ export async function buildHealthReport(options = {}) {
             ? "not-configured"
             : findings.some((finding) => finding.level === "warning")
                 ? "attention"
-                : activeSkills === 0 && disabledSkills > 0
+                : activeSkills === 0 &&
+                    disabledSkills > 0 &&
+                    (state.mcpInstalls ?? []).length === 0 &&
+                    runtimeTools.length === 0
                     ? "library-only"
                     : "healthy";
     return {
@@ -120,6 +146,8 @@ export async function buildHealthReport(options = {}) {
         installedPackages: state.installs.length,
         activeSkills,
         disabledSkills,
+        managedMcpServers: (state.mcpInstalls ?? []).length,
+        managedRuntimeTools: runtimeTools.length,
         updatesChecked: Boolean(options.updates || options.checkUpdates),
         updatesAvailable: available.length,
         driftedFiles: drifted.length,
@@ -137,7 +165,7 @@ export function formatHealthReport(report) {
                 : "✗";
     const lines = [
         `${icon} Loadout health: ${report.status === "not-configured" ? "not configured" : report.status === "library-only" ? "library ready (nothing active)" : report.status}`,
-        `Packages: ${report.installedPackages} managed; skills: ${report.activeSkills ?? 0} active, ${report.disabledSkills ?? 0} disabled; ${report.updatesChecked ? `${report.updatesAvailable} update(s)` : "updates not checked (use --updates)"}; ${report.driftedFiles} drifted file(s), ${report.driftedMcpServers} drifted MCP server(s)`,
+        `Packages: ${report.installedPackages} managed; skills: ${report.activeSkills ?? 0} active, ${report.disabledSkills ?? 0} disabled; MCP servers: ${report.managedMcpServers ?? 0}; runtime tools: ${report.managedRuntimeTools ?? 0}; ${report.updatesChecked ? `${report.updatesAvailable} update(s)` : "updates not checked (use --updates)"}; ${report.driftedFiles} drifted file(s), ${report.driftedMcpServers} drifted MCP server(s)`,
     ];
     for (const finding of report.findings)
         lines.push(`${finding.level === "ok" ? "✓" : finding.level === "error" ? "✗" : finding.level === "warning" ? "!" : "•"} ${finding.message}${finding.fix ? ` ${finding.fix}` : ""}`);

package/dist/src/core/mcp-recipes.js

@@ -148,7 +148,7 @@ export async function planMcpRecipe(recipeId, configPath, options = {}) {
     };
 }
 const MCP_PROTOCOL_VERSION = "2025-06-18";
-const DEFAULT_CONNECTION_TIMEOUT_MS = 8_000;
+const DEFAULT_CONNECTION_TIMEOUT_MS = 30_000;
 const DEFAULT_CONNECTION_OUTPUT_BYTES = 256 * 1024;
 const INITIALIZE_ID = "loadout-initialize";
 function validateConnectionBounds(timeoutMs, maxOutputBytes) {

package/dist/src/core/recommend.js

@@ -179,8 +179,10 @@ export function recommendPackages(signals, catalog) {
     if (signals.frameworks.some((item) => ["react", "next.js", "vue", "svelte"].includes(item)))
         add("ui-ux-pro-max", `Frontend framework detected: ${signals.frameworks.join(", ")}.`, "high");
     if (signals.frameworks.includes("playwright") ||
-        signals.languages.includes("javascript/typescript"))
-        add("playwright-mcp", "Browser verification is useful for this web-capable project.", signals.frameworks.includes("playwright") ? "high" : "medium");
+        signals.frameworks.some((item) => ["react", "next.js", "vue", "svelte"].includes(item)))
+        add("playwright-mcp", signals.frameworks.includes("playwright")
+            ? "Playwright is already configured in this project."
+            : "Browser verification may help test the detected frontend framework.", signals.frameworks.includes("playwright") ? "high" : "medium");
     if (signals.files.includes(".git"))
         add("github-mcp-server", "A Git repository was detected; GitHub tools may help with issues and pull requests.", "medium");
     if (signals.roles.includes("obsidian-vault"))

package/dist/src/core/runtime-tools.js

@@ -222,6 +222,28 @@ export async function listInstalledRuntimeTools(stateHome = loadoutHome()) {
     const state = await readState(stateHome);
     return Object.keys(state.tools).sort();
 }
+/** Return agent skill targets owned by installed reviewed runtime tools. */
+export async function listInstalledRuntimeToolSkillTargets(options = {}) {
+    const state = await readState(options.stateHome ?? loadoutHome());
+    const home = options.home ?? userHome();
+    const platform = currentRecipePlatform(options.platform);
+    return Object.entries(state.tools).flatMap(([toolId, installed]) => {
+        const recipe = findRuntimeToolRecipe(toolId);
+        return installed.agents.flatMap((agent) => {
+            const target = recipe.targets[agent];
+            return target
+                ? [
+                    {
+                        toolId,
+                        packageId: `runtime-tool:${toolId}`,
+                        agent,
+                        path: resolveRuntimeRecipePath(home, target.path, platform),
+                    },
+                ]
+                : [];
+        });
+    });
+}
 async function writeState(state, stateHome) {
     await writeFileAtomically(statePath(stateHome), `${JSON.stringify(state, null, 2)}\n`);
 }
@@ -231,12 +253,10 @@ export function findRuntimeToolRecipe(id) {
         throw new Error(`Unknown runtime tool '${id}'. Available: ${REVIEWED_RUNTIME_TOOLS.map((item) => item.id).join(", ")}`);
     return recipe;
 }
-function currentRecipePlatform() {
-    if (process.platform === "darwin" ||
-        process.platform === "linux" ||
-        process.platform === "win32")
-        return process.platform;
-    throw new Error(`Runtime tool recipes do not support ${process.platform}`);
+function currentRecipePlatform(platform = process.platform) {
+    if (platform === "darwin" || platform === "linux" || platform === "win32")
+        return platform;
+    throw new Error(`Runtime tool recipes do not support ${platform}`);
 }
 function buildRuntimeToolCommands(recipe, runtimeRoot, agents, platform, action) {
     if (action === "remove")
@@ -425,7 +445,9 @@ export async function applyRuntimeToolPlan(plan, options) {
         const snapshotRoots = plan.recipe.snapshotRoots.flatMap((root) => root === "{runtimeRoot}"
             ? [plan.runtimeRoot]
             : plan.agents.map((agent) => agent.target));
-        snapshot = await createSnapshot(snapshotRoots);
+        snapshot = await createSnapshot(snapshotRoots, {
+            label: `install runtime tool ${plan.recipe.displayName}`,
+        });
         const runner = options.runner ?? defaultRunner;
         const env = runtimeEnvironment(plan);
         const healthCheckStart = plan.commands.length - plan.recipe.healthChecks.length;

package/dist/src/core/skill-inventory.js

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { lstat, readFile, readdir } from "node:fs/promises";
 import { join, relative, resolve, sep } from "node:path";
 import { readInstallState } from "./state.js";
+import { listInstalledRuntimeToolSkillTargets, } from "./runtime-tools.js";
 const MAX_SCAN_DEPTH = 6;
 export const RECOMMENDED_ACTIVE_SKILLS = 30;
 function cleanFrontmatterValue(value) {
@@ -17,7 +18,10 @@ function isInside(root, candidate) {
     const path = relative(resolve(root), resolve(candidate));
     return path === "" || (!path.startsWith("..") && !path.startsWith(sep));
 }
-function owningPackage(skillRoot, agent, records, activations) {
+function owningPackage(skillRoot, agent, records, activations, runtimeTargets) {
+    const runtime = runtimeTargets.find((target) => target.agent === agent && isInside(target.path, skillRoot));
+    if (runtime)
+        return runtime.packageId;
     const active = activations.find((record) => record.agent === agent &&
         record.activationState === "active" &&
         record.installationState === "installed" &&
@@ -29,8 +33,15 @@ function owningPackage(skillRoot, agent, records, activations) {
             activation.agent === agent) &&
         record.files.some((file) => isInside(skillRoot, file.path)))?.packageId;
 }
-async function scanAgentSkills(agent, records, activations) {
-    const root = resolve(agent.skillsDirectory);
+async function scanAgentSkills(agent, records, activations, runtimeTargets) {
+    const primaryRoot = resolve(agent.skillsDirectory);
+    const roots = [
+        primaryRoot,
+        ...runtimeTargets
+            .filter((target) => target.agent === agent.id)
+            .map((target) => resolve(target.path))
+            .filter((target) => !isInside(primaryRoot, target)),
+    ];
     const skills = [];
     const warnings = [];
     async function visit(directory, depth) {
@@ -60,7 +71,7 @@ async function scanAgentSkills(agent, records, activations) {
             try {
                 const path = join(directory, "SKILL.md");
                 const content = await readFile(path, "utf8");
-                const packageId = owningPackage(directory, agent.id, records, activations);
+                const packageId = owningPackage(directory, agent.id, records, activations, runtimeTargets);
                 const sourceHints = [
                     ...new Set([
                         ...content.matchAll(/https?:\/\/github\.com\/([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]*[A-Za-z0-9_-])/g),
@@ -102,7 +113,8 @@ async function scanAgentSkills(agent, records, activations) {
                 await visit(join(directory, child.name), depth + 1);
         }
     }
-    await visit(root, 0);
+    for (const root of [...new Set(roots)])
+        await visit(root, 0);
     return {
         skills: skills.sort((left, right) => left.path.localeCompare(right.path)),
         warnings,
@@ -141,8 +153,11 @@ function duplicateGroups(skills) {
  * safety verdict and no files are changed by this scan.
  */
 export async function scanInstalledSkills(agents) {
-    const state = await readInstallState();
-    const scans = await Promise.all(agents.map((agent) => scanAgentSkills(agent, state.installs, state.activations ?? [])));
+    const [state, runtimeTargets] = await Promise.all([
+        readInstallState(),
+        listInstalledRuntimeToolSkillTargets(),
+    ]);
+    const scans = await Promise.all(agents.map((agent) => scanAgentSkills(agent, state.installs, state.activations ?? [], runtimeTargets)));
     const skills = scans.flatMap((scan) => scan.skills);
     const warnings = scans.flatMap((scan) => scan.warnings);
     const summaries = agents.map((agent, index) => {
@@ -157,6 +172,7 @@ export async function scanInstalledSkills(agents) {
             managed,
             unmanaged: entries.length - managed,
             overRecommendedLimit: entries.length > RECOMMENDED_ACTIVE_SKILLS,
+            runtimeToolTargets: runtimeTargets.filter((target) => target.agent === agent.id).length,
         };
     });
     for (const summary of summaries.filter((item) => item.overRecommendedLimit))
@@ -185,7 +201,7 @@ export function formatInstalledSkillInventory(report) {
         "",
     ];
     for (const agent of report.agents)
-        lines.push(`${agent.detected ? "✓" : "○"} ${agent.displayName}: ${agent.total} skill(s) (${agent.managed} managed, ${agent.unmanaged} unmanaged) — ${agent.directory}`);
+        lines.push(`${agent.detected ? "✓" : "○"} ${agent.displayName}: ${agent.total} skill(s) (${agent.managed} managed, ${agent.unmanaged} unmanaged)${agent.runtimeToolTargets ? `, including ${agent.runtimeToolTargets} runtime-tool skill(s)` : ""} — ${agent.directory}`);
     for (const warning of report.warnings)
         lines.push(`! ${warning}`);
     lines.push("", "Read-only scan complete. Unmanaged content was not changed or judged automatically.");

package/docs/USER_TEST_GUIDE.md

@@ -183,7 +183,7 @@ cleanup deliberately deletes Loadout's snapshots, so it is the last lifecycle te
 ## Troubleshooting and recovery
 
 - **`loadout` is not found after installation:** confirm `npm install --global
-loadout-ai@0.5.1` completed, run `hash -r`, and confirm npm's global binary
+loadout-ai@0.5.3` completed, run `hash -r`, and confirm npm's global binary
   directory is on `PATH`. For a source checkout, run `npm run build` and `npm link`.
 - **A preview asks for `--approve-risk`:** read the reported scripts, domains,
   credentials, binaries, or instruction findings. If you accept that specific plan,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "loadout-ai",
-  "version": "0.5.1",
+  "version": "0.5.3",
   "private": false,
   "license": "MIT",
   "description": "Universal upgrade manager for AI coding agents",