loadout-ai 0.5.4 → 0.5.6

package/CHANGELOG.md

@@ -2,6 +2,45 @@
 
 ## Unreleased
 
+## 0.5.6 - 2026-07-21
+
+### Changed
+
+- Resolve each repository's default-branch commit with a lightweight Git metadata
+  request before downloading files, deduplicate shared sources, and reuse exact
+  cached changed revisions for safety review.
+- Give changed repositories a bounded 120-second review window while keeping remote
+  commit checks at 30 seconds, so large reviewed sources do not produce permanent
+  false connectivity warnings under four-way concurrency.
+
+### Fixed
+
+- Complete update checks for large sources such as Scientific Agent Skills and
+  Awesome Copilot without weakening static diff analysis, activating disabled skills,
+  or treating a timed-out clone as a GitHub outage.
+
+## 0.5.5 - 2026-07-21
+
+### Changed
+
+- Summarize update checks as active, disabled-library, current, and unavailable
+  records; hide repetitive current-package lines by default while retaining complete
+  JSON output and focused per-package review.
+- Keep disabled Maximum-library copies pinned and explicitly state that newer
+  upstream commits neither change nor reactivate agent-visible skills.
+- Treat catalog sources represented by adopted units as present in saved-profile
+  evaluation, and describe fully quarantined or unavailable profile sources without
+  calling them missing upgrades.
+
+### Fixed
+
+- Deduplicate per-agent disabled update state and fetch a shared repository only once
+  when several adopted skill units track the same upstream source.
+- Distinguish active updates from disabled-library updates in health output, including
+  separately reported network-check failures.
+- Label partial catalog indexing accurately as sources containing quarantined units
+  instead of repository failures.
+
 ## 0.5.4 - 2026-07-21
 
 ### Added

package/MASTER_PLAN.md

@@ -318,6 +318,24 @@ merged `codex/relatable-readme-hero` remote branch remains safe to delete after
       Humanizer and Turnstile update findings before any replacement, then finish
       read-only update/discovery, Graphify removal, complete uninstall, and clean
       reinstall acceptance.
+- [x] `P18-45 [TERRA]` Correct the founder-discovered update-reporting defects after
+      the real `0.5.4` Maximum/reconciliation run. Update planning now deduplicates
+      repeated agent names and shared-repository fetches, separates active updates
+      from newer commits held for disabled library copies, compacts safety output,
+      recognizes adopted sources in profile state, and labels partial quarantine
+      evidence instead of calling it a repository failure. The real profile confirms
+      39 active managed skills, 2,326 disabled copies, one Graphify runtime, zero
+      managed drift, and no active adopted-skill update. Release this correction
+      before the remaining Graphify removal, discovery, uninstall, and reinstall
+      acceptance steps.
+- [x] `P18-46 [TERRA]` Eliminate the repeated large-repository timeout exposed by the
+      published `0.5.5` founder check. Resolve remote HEAD metadata before fetching
+      content, download only changed revisions that require static safety analysis,
+      reuse immutable cached snapshots, and allow those bounded reviews 120 seconds.
+      The real 40-record Maximum state now completes with 19 disabled-library
+      changes, 21 current packages, zero active updates, and zero unavailable checks;
+      both previously failing large repositories complete without changing or
+      activating any agent-visible skill.
 
 ### Release 0.3 lifecycle hardening
 

package/README.md

@@ -26,7 +26,7 @@
 </p>
 
 > [!IMPORTANT]
-> Installation is version-pinned so the code you test matches these docs. The commands below target `loadout-ai@0.5.4`; review the preview before every apply.
+> Installation is version-pinned so the code you test matches these docs. The commands below target `loadout-ai@0.5.6`; review the preview before every apply.
 
 ## How it works
 
@@ -76,7 +76,7 @@ Skills, plugins, MCP servers, and agent settings tend to accumulate one experime
 You need Node.js 20 or newer and Git.
 
 ```bash
-npm install --global loadout-ai@0.5.4
+npm install --global loadout-ai@0.5.6
 loadout --version
 loadout guide
 ```

package/dist/src/cli.js

@@ -264,7 +264,7 @@ async function runSetup(options) {
         reader?.close();
     }
 }
-const LOADOUT_VERSION = "0.5.4";
+const LOADOUT_VERSION = "0.5.6";
 function durableSchedulerLauncher() {
     return [
         join(dirname(process.execPath), process.platform === "win32" ? "npx.cmd" : "npx"),
@@ -909,7 +909,7 @@ program
     .option("--agents <ids>", "limit explained scores to selected agent ids")
     .action(async (options) => {
     if (options.updates && !options.json)
-        console.error("Checking managed repositories (4 at a time, 30s per network operation)…");
+        console.error("Checking repository commits (4 at a time; changed sources may take up to 120s for safety review)…");
     const report = await buildHealthReport({
         updates: options.updates
             ? () => buildUpdatePlan(undefined, {
@@ -2857,7 +2857,7 @@ program
         profile = await evaluateInstalledProfile(catalog);
     }
     if (!options.json)
-        console.error("Checking managed repositories (4 at a time, 30s per network operation)…");
+        console.error("Checking repository commits (4 at a time; changed sources may take up to 120s for safety review)…");
     let plans = await buildUpdatePlan(undefined, {
         packageId: options.package,
         onProgress: options.json

package/dist/src/core/health.js

@@ -103,15 +103,24 @@ export async function buildHealthReport(options = {}) {
             fix: "Review the target, then remove and reinstall the owning runtime tool.",
         });
     const available = updates.filter((update) => update.status === "update-available");
-    if (available.length)
+    const disabledAvailable = available.filter((update) => Boolean(update.disabledAgents?.length));
+    const activeAvailable = available.filter((update) => !update.disabledAgents?.length);
+    if (activeAvailable.length)
         findings.push({
-            level: available.some((update) => update.approvalRequired)
+            level: activeAvailable.some((update) => update.approvalRequired)
                 ? "warning"
                 : "info",
             code: "updates-available",
-            message: `${available.length} package update(s) are available.`,
+            message: `${activeAvailable.length} active package update(s) are available.`,
             fix: "Run loadout update and review the safety findings.",
         });
+    if (disabledAvailable.length)
+        findings.push({
+            level: "info",
+            code: "disabled-library-updates-available",
+            message: `${disabledAvailable.length} disabled-library package(s) have newer upstream commits.`,
+            fix: "Nothing active changed; disabled skills stay pinned and are never reactivated automatically.",
+        });
     const errors = updates.filter((update) => update.status === "error");
     if (errors.length)
         findings.push({
@@ -150,6 +159,9 @@ export async function buildHealthReport(options = {}) {
         managedRuntimeTools: runtimeTools.length,
         updatesChecked: Boolean(options.updates || options.checkUpdates),
         updatesAvailable: available.length,
+        activeUpdatesAvailable: activeAvailable.length,
+        disabledUpdatesAvailable: disabledAvailable.length,
+        updateChecksFailed: errors.length,
         driftedFiles: drifted.length,
         driftedMcpServers,
         findings,
@@ -165,7 +177,7 @@ export function formatHealthReport(report) {
                 : "✗";
     const lines = [
         `${icon} Loadout health: ${report.status === "not-configured" ? "not configured" : report.status === "library-only" ? "library ready (nothing active)" : report.status}`,
-        `Packages: ${report.installedPackages} managed; skills: ${report.activeSkills ?? 0} active, ${report.disabledSkills ?? 0} disabled; MCP servers: ${report.managedMcpServers ?? 0}; runtime tools: ${report.managedRuntimeTools ?? 0}; ${report.updatesChecked ? `${report.updatesAvailable} update(s)` : "updates not checked (use --updates)"}; ${report.driftedFiles} drifted file(s), ${report.driftedMcpServers} drifted MCP server(s)`,
+        `Packages: ${report.installedPackages} managed; skills: ${report.activeSkills ?? 0} active, ${report.disabledSkills ?? 0} disabled; MCP servers: ${report.managedMcpServers ?? 0}; runtime tools: ${report.managedRuntimeTools ?? 0}; ${report.updatesChecked ? `${report.activeUpdatesAvailable ?? report.updatesAvailable} active update(s), ${report.disabledUpdatesAvailable ?? 0} disabled-library update(s), ${report.updateChecksFailed ?? 0} check(s) unavailable` : "updates not checked (use --updates)"}; ${report.driftedFiles} drifted file(s), ${report.driftedMcpServers} drifted MCP server(s)`,
     ];
     for (const finding of report.findings)
         lines.push(`${finding.level === "ok" ? "✓" : finding.level === "error" ? "✗" : finding.level === "warning" ? "!" : "•"} ${finding.message}${finding.fix ? ` ${finding.fix}` : ""}`);

package/dist/src/core/profile-state.js

@@ -27,6 +27,7 @@ export function evaluateInstalledProfileState(state, catalog) {
             installed: false,
             expectedPackages: [],
             missingPackages: [],
+            newlyReviewedPackages: [],
             reviewedRevisionChanges: [],
             needsRefresh: false,
             evaluatedAt,
@@ -41,8 +42,16 @@ export function evaluateInstalledProfileState(state, catalog) {
     const expected = resolution.packages.filter((pkg) => pkg.components?.includes("skill"));
     const installed = new Map(state.installs.map((record) => [record.packageId, record]));
     const previousCatalog = new Map(state.profile.catalogPackages.map((record) => [record.packageId, record]));
-    const missingPackages = expected
-        .filter((pkg) => !installed.has(pkg.id))
+    const representedRepositories = new Set(state.installs
+        .map((record) => record.repository?.toLowerCase())
+        .filter((repository) => Boolean(repository)));
+    const missingPackages = state.profile.catalogPackages
+        .filter((item) => !installed.has(item.packageId))
+        .map((item) => item.packageId);
+    const newlyReviewedPackages = expected
+        .filter((pkg) => !previousCatalog.has(pkg.id) &&
+        !installed.has(pkg.id) &&
+        !representedRepositories.has(pkg.repository.toLowerCase()))
         .map((pkg) => pkg.id);
     const reviewedRevisionChanges = expected.flatMap((pkg) => {
         const previous = previousCatalog.get(pkg.id);
@@ -58,21 +67,16 @@ export function evaluateInstalledProfileState(state, catalog) {
             },
         ];
     });
-    const oldIds = state.profile.catalogPackages
-        .map((item) => item.packageId)
-        .sort();
     const expectedPackages = expected.map((pkg) => pkg.id).sort();
-    const selectionChanged = oldIds.join("\0") !== expectedPackages.join("\0");
     return {
         installed: true,
         mode: state.profile.mode,
         appliedAt: state.profile.appliedAt,
         expectedPackages,
         missingPackages,
+        newlyReviewedPackages,
         reviewedRevisionChanges,
-        needsRefresh: selectionChanged ||
-            missingPackages.length > 0 ||
-            reviewedRevisionChanges.length > 0,
+        needsRefresh: newlyReviewedPackages.length > 0 || reviewedRevisionChanges.length > 0,
         evaluatedAt,
         boundary,
     };
@@ -87,7 +91,14 @@ export function formatInstalledProfileStatus(status) {
         `PROFILE ${status.mode?.toUpperCase()}: ${status.needsRefresh ? "reviewed changes available" : "current against reviewed catalog"}`,
         `Expected repositories: ${status.expectedPackages.length}`,
         ...(status.missingPackages.length
-            ? [`Missing: ${status.missingPackages.join(", ")}`]
+            ? [
+                `Not installed from the saved profile (removed, quarantined, or unavailable): ${status.missingPackages.join(", ")}`,
+            ]
+            : []),
+        ...(status.newlyReviewedPackages.length
+            ? [
+                `New reviewed catalog sources to inspect: ${status.newlyReviewedPackages.join(", ")}`,
+            ]
             : []),
         ...(status.reviewedRevisionChanges.length
             ? [

package/dist/src/core/provenance.js

@@ -292,8 +292,10 @@ export function enrichInventoryWithProvenance(report, index, source = "none") {
 }
 export function formatProvenanceSummary(report) {
     const value = report.provenance;
+    const quarantinedSources = value.failures.filter((failure) => /^\d+ skill unit\(s\) quarantined:/.test(failure.error)).length;
+    const preparationFailures = value.failures.length - quarantinedSources;
     return [
         `Provenance: ${value.exact} exact catalog match(es), ${value.managed} Loadout-managed, ${value.embedded} embedded-source candidate(s), ${value.nameCandidates} name-only candidate(s), ${value.unknown} unknown`,
-        `Catalog skill index: ${value.indexSource}; ${value.indexedSkills} reviewed skill(s)${value.failures.length ? `; ${value.failures.length} repository failure(s)` : ""}`,
+        `Catalog skill index: ${value.indexSource}; ${value.indexedSkills} reviewed skill(s)${quarantinedSources ? `; ${quarantinedSources} source(s) contain quarantined units` : ""}${preparationFailures ? `; ${preparationFailures} source preparation failure(s)` : ""}`,
     ].join("\n");
 }

package/dist/src/core/source.js

@@ -144,6 +144,36 @@ export function normalizeRepository(input) {
     }
     return value;
 }
+export function parseRepositoryHead(repository, output) {
+    const commit = output
+        .split(/\r?\n/)
+        .map((line) => line.split(/\s+/))
+        .find((parts) => parts[1] === "HEAD" && /^[0-9a-f]{40}$/i.test(parts[0]))?.[0];
+    if (!commit)
+        throw new Error(`Git returned an invalid default-branch HEAD for ${repository}`);
+    return commit;
+}
+/** Resolve the public default-branch commit without downloading repository files. */
+export async function resolveRepositoryHead(input, options = {}) {
+    const repository = normalizeRepository(input);
+    const gitEnvironment = await isolatedGitEnvironment(loadoutHome());
+    const url = `https://github.com/${repository}.git`;
+    try {
+        const { stdout } = await execFileAsync("git", ["ls-remote", "--symref", "--", url, "HEAD"], {
+            maxBuffer: 1024 * 1024,
+            timeout: options.timeoutMs,
+            env: gitEnvironment,
+        });
+        return {
+            repository,
+            commit: parseRepositoryHead(repository, stdout),
+        };
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new Error(`Could not resolve ${repository}: ${message}`);
+    }
+}
 function normalizeRef(ref) {
     if (!/^[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(ref) ||
         ref.includes("..") ||

package/dist/src/core/update.js

@@ -1,6 +1,6 @@
 import { mkdir, writeFile } from "node:fs/promises";
 import { basename, join } from "node:path";
-import { fetchRepositorySnapshot } from "./source.js";
+import { fetchRepositorySnapshot, resolveRepositoryHead } from "./source.js";
 import { repositoryCachePath } from "./source.js";
 import { diffRepositorySnapshots } from "./diff.js";
 import { hashDirectory, readInstallState } from "./state.js";
@@ -85,12 +85,39 @@ async function analyzeManagedUpdate(oldRoot, newRoot, unitIds) {
     };
 }
 /** Builds a read-only update plan from persisted installs and live GitHub snapshots. */
-export async function buildUpdatePlan(resolver = async (repository) => fetchRepositorySnapshot(repository, { timeoutMs: 30_000 }), options = {}) {
+export async function buildUpdatePlan(resolver, options = {}) {
     const state = await readInstallState();
     const records = options.packageId
         ? state.installs.filter((record) => record.packageId === options.packageId)
         : state.installs;
     const results = new Array(records.length);
+    const lightweightResolver = resolver ??
+        options.resolveHead ??
+        ((repository) => resolveRepositoryHead(repository, { timeoutMs: 30_000 }));
+    const resolutions = new Map();
+    const resolveOnce = (repository) => {
+        const existing = resolutions.get(repository);
+        if (existing)
+            return existing;
+        const pending = lightweightResolver(repository);
+        resolutions.set(repository, pending);
+        return pending;
+    };
+    const changedSnapshots = new Map();
+    const fetchChangedOnce = (repository, commit) => {
+        const key = `${repository}\0${commit.toLowerCase()}`;
+        const existing = changedSnapshots.get(key);
+        if (existing)
+            return existing;
+        const pending = options.fetchChangedSnapshot
+            ? options.fetchChangedSnapshot(repository)
+            : fetchRepositorySnapshot(repository, {
+                ref: commit,
+                timeoutMs: 120_000,
+            });
+        changedSnapshots.set(key, pending);
+        return pending;
+    };
     let cursor = 0;
     let completed = 0;
     const workers = Array.from({
@@ -100,17 +127,21 @@ export async function buildUpdatePlan(resolver = async (repository) => fetchRepo
             const index = cursor++;
             const record = records[index];
             results[index] = await (async () => {
-                const disabledAgents = (state.activations ?? [])
-                    .filter((activation) => activation.packageId === record.packageId &&
+                const disabledActivations = (state.activations ?? []).filter((activation) => activation.packageId === record.packageId &&
                     activation.installationState === "installed" &&
-                    activation.activationState === "disabled")
-                    .map((activation) => activation.agent);
+                    activation.activationState === "disabled");
+                const disabledAgents = [
+                    ...new Set(disabledActivations.map((activation) => activation.agent)),
+                ].sort();
                 const base = {
                     packageId: record.packageId,
                     repository: record.repository,
                     installedCommit: record.resolvedCommit,
                     targetAgents: record.targetAgents,
                     ...(disabledAgents.length ? { disabledAgents } : {}),
+                    ...(disabledActivations.length
+                        ? { disabledUnits: disabledActivations.length }
+                        : {}),
                 };
                 if (!record.repository || !record.resolvedCommit) {
                     return {
@@ -120,15 +151,22 @@ export async function buildUpdatePlan(resolver = async (repository) => fetchRepo
                     };
                 }
                 try {
-                    const current = await resolver(record.repository);
+                    const current = await resolveOnce(record.repository);
                     const same = current.commit.toLowerCase() ===
                         record.resolvedCommit.toLowerCase();
                     let diff;
                     let safetyFindings;
                     let approvalRequired = false;
-                    if (!same && current.path) {
+                    let currentPath = current.path;
+                    if (!same && !currentPath && !resolver) {
+                        const fetched = await fetchChangedOnce(record.repository, current.commit);
+                        if (fetched.commit.toLowerCase() !== current.commit.toLowerCase())
+                            throw new Error(`Resolved ${current.commit}, but fetched ${fetched.commit} for safety review`);
+                        currentPath = fetched.path;
+                    }
+                    if (!same && currentPath) {
                         const oldPath = repositoryCachePath(record.repository, record.resolvedCommit);
-                        const analysis = await analyzeManagedUpdate(oldPath, current.path, managedUnitIds(state, record.packageId));
+                        const analysis = await analyzeManagedUpdate(oldPath, currentPath, managedUnitIds(state, record.packageId));
                         diff = analysis.diff;
                         safetyFindings = analysis.safetyFindings;
                         approvalRequired = analysis.approvalRequired;
@@ -140,7 +178,7 @@ export async function buildUpdatePlan(resolver = async (repository) => fetchRepo
                         action: same
                             ? "No action required."
                             : disabledAgents.length
-                                ? `Enable ${record.packageId} for ${disabledAgents.join(", ")} before applying an update; planning remains read-only.`
+                                ? `A newer upstream commit exists, but ${disabledActivations.length} reviewed library ${disabledActivations.length === 1 ? "copy is" : "copies are"} disabled for ${disabledAgents.join(" and ")}. Nothing active changed; Loadout will not update or reactivate disabled skills automatically.`
                                 : approvalRequired
                                     ? `Approval required: review safety warnings before updating ${record.packageId}.`
                                     : `Run loadout update --package ${record.packageId} --yes after review.`,
@@ -172,16 +210,35 @@ export async function buildUpdatePlan(resolver = async (repository) => fetchRepo
 export function formatUpdatePlan(plans) {
     if (plans.length === 0)
         return "No tracked installations found.";
-    return plans
-        .map((plan) => {
+    const available = plans.filter((plan) => plan.status === "update-available");
+    const activeAvailable = available.filter((plan) => !plan.disabledAgents?.length);
+    const disabledAvailable = available.filter((plan) => Boolean(plan.disabledAgents?.length));
+    const current = plans.filter((plan) => plan.status === "up-to-date");
+    const unavailable = plans.filter((plan) => plan.status === "error" || plan.status === "untracked");
+    const lines = [
+        `Update check: ${activeAvailable.length} active update(s), ${disabledAvailable.length} disabled-library update(s), ${current.length} current, ${unavailable.length} unavailable.`,
+    ];
+    const visible = plans.length === 1
+        ? plans
+        : plans.filter((plan) => plan.status !== "up-to-date");
+    lines.push(...visible.map((plan) => {
         const suffix = plan.error ? ` — ${plan.error}` : "";
         const repo = plan.repository ? ` (${plan.repository})` : "";
-        const safety = plan.safetyFindings
-            ?.map((finding) => ` [${finding.severity}] ${finding.message}${finding.names?.length ? ` (${finding.names.join(", ")})` : ""}`)
-            .join("") ?? "";
+        const findingCounts = new Map();
+        for (const finding of plan.safetyFindings ?? []) {
+            const key = `${finding.severity} ${finding.category}`;
+            findingCounts.set(key, (findingCounts.get(key) ?? 0) + 1);
+        }
+        const safety = findingCounts.size
+            ? ` Safety review: ${[...findingCounts.entries()]
+                .map(([key, count]) => `${key}${count > 1 ? ` ×${count}` : ""}`)
+                .join(", ")}. Run loadout update --package ${plan.packageId} for the focused review.`
+            : "";
         return `${plan.status.toUpperCase()} ${plan.packageId}${repo}: ${plan.action}${safety}${suffix}`;
-    })
-        .join("\n");
+    }));
+    if (current.length && plans.length > 1)
+        lines.push(`Current packages hidden for readability (${current.length}); use --json for every record.`);
+    return lines.join("\n");
 }
 /** Updates safe enough for an explicit whole-profile `update --yes` apply. */
 export function selectSafeAutomaticUpdates(plans) {
@@ -236,11 +293,13 @@ export async function applyPackageUpdate(packageId, options = {}, runtime = {})
     const record = state.installs.find((item) => item.packageId === packageId);
     if (!record)
         throw new Error(`Package is not managed by Loadout: ${packageId}`);
-    const disabledAgents = (state.activations ?? [])
-        .filter((activation) => activation.packageId === packageId &&
-        activation.installationState === "installed" &&
-        activation.activationState === "disabled")
-        .map((activation) => activation.agent);
+    const disabledAgents = [
+        ...new Set((state.activations ?? [])
+            .filter((activation) => activation.packageId === packageId &&
+            activation.installationState === "installed" &&
+            activation.activationState === "disabled")
+            .map((activation) => activation.agent)),
+    ].sort();
     const expectedRecord = JSON.stringify(record);
     const expectedActivations = JSON.stringify((state.activations ?? [])
         .filter((activation) => activation.packageId === packageId)

package/docs/USER_TEST_GUIDE.md

@@ -211,7 +211,7 @@ cleanup deliberately deletes Loadout's snapshots, so it is the last lifecycle te
 ## Troubleshooting and recovery
 
 - **`loadout` is not found after installation:** confirm `npm install --global
-loadout-ai@0.5.4` completed, run `hash -r`, and confirm npm's global binary
+loadout-ai@0.5.6` completed, run `hash -r`, and confirm npm's global binary
   directory is on `PATH`. For a source checkout, run `npm run build` and `npm link`.
 - **A preview asks for `--approve-risk`:** read the reported scripts, domains,
   credentials, binaries, or instruction findings. If you accept that specific plan,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "loadout-ai",
-  "version": "0.5.4",
+  "version": "0.5.6",
   "private": false,
   "license": "MIT",
   "description": "Universal upgrade manager for AI coding agents",