loadout-ai 0.5.5 → 0.5.6

package/CHANGELOG.md

@@ -2,6 +2,23 @@
 
 ## Unreleased
 
+## 0.5.6 - 2026-07-21
+
+### Changed
+
+- Resolve each repository's default-branch commit with a lightweight Git metadata
+  request before downloading files, deduplicate shared sources, and reuse exact
+  cached changed revisions for safety review.
+- Give changed repositories a bounded 120-second review window while keeping remote
+  commit checks at 30 seconds, so large reviewed sources do not produce permanent
+  false connectivity warnings under four-way concurrency.
+
+### Fixed
+
+- Complete update checks for large sources such as Scientific Agent Skills and
+  Awesome Copilot without weakening static diff analysis, activating disabled skills,
+  or treating a timed-out clone as a GitHub outage.
+
 ## 0.5.5 - 2026-07-21
 
 ### Changed

package/MASTER_PLAN.md

@@ -328,6 +328,14 @@ merged `codex/relatable-readme-hero` remote branch remains safe to delete after
       managed drift, and no active adopted-skill update. Release this correction
       before the remaining Graphify removal, discovery, uninstall, and reinstall
       acceptance steps.
+- [x] `P18-46 [TERRA]` Eliminate the repeated large-repository timeout exposed by the
+      published `0.5.5` founder check. Resolve remote HEAD metadata before fetching
+      content, download only changed revisions that require static safety analysis,
+      reuse immutable cached snapshots, and allow those bounded reviews 120 seconds.
+      The real 40-record Maximum state now completes with 19 disabled-library
+      changes, 21 current packages, zero active updates, and zero unavailable checks;
+      both previously failing large repositories complete without changing or
+      activating any agent-visible skill.
 
 ### Release 0.3 lifecycle hardening
 

package/README.md

@@ -26,7 +26,7 @@
 </p>
 
 > [!IMPORTANT]
-> Installation is version-pinned so the code you test matches these docs. The commands below target `loadout-ai@0.5.5`; review the preview before every apply.
+> Installation is version-pinned so the code you test matches these docs. The commands below target `loadout-ai@0.5.6`; review the preview before every apply.
 
 ## How it works
 
@@ -76,7 +76,7 @@ Skills, plugins, MCP servers, and agent settings tend to accumulate one experime
 You need Node.js 20 or newer and Git.
 
 ```bash
-npm install --global loadout-ai@0.5.5
+npm install --global loadout-ai@0.5.6
 loadout --version
 loadout guide
 ```

package/dist/src/cli.js

@@ -264,7 +264,7 @@ async function runSetup(options) {
         reader?.close();
     }
 }
-const LOADOUT_VERSION = "0.5.5";
+const LOADOUT_VERSION = "0.5.6";
 function durableSchedulerLauncher() {
     return [
         join(dirname(process.execPath), process.platform === "win32" ? "npx.cmd" : "npx"),
@@ -909,7 +909,7 @@ program
     .option("--agents <ids>", "limit explained scores to selected agent ids")
     .action(async (options) => {
     if (options.updates && !options.json)
-        console.error("Checking managed repositories (4 at a time, 30s per network operation)…");
+        console.error("Checking repository commits (4 at a time; changed sources may take up to 120s for safety review)…");
     const report = await buildHealthReport({
         updates: options.updates
             ? () => buildUpdatePlan(undefined, {
@@ -2857,7 +2857,7 @@ program
         profile = await evaluateInstalledProfile(catalog);
     }
     if (!options.json)
-        console.error("Checking managed repositories (4 at a time, 30s per network operation)…");
+        console.error("Checking repository commits (4 at a time; changed sources may take up to 120s for safety review)…");
     let plans = await buildUpdatePlan(undefined, {
         packageId: options.package,
         onProgress: options.json

package/dist/src/core/source.js

@@ -144,6 +144,36 @@ export function normalizeRepository(input) {
     }
     return value;
 }
+export function parseRepositoryHead(repository, output) {
+    const commit = output
+        .split(/\r?\n/)
+        .map((line) => line.split(/\s+/))
+        .find((parts) => parts[1] === "HEAD" && /^[0-9a-f]{40}$/i.test(parts[0]))?.[0];
+    if (!commit)
+        throw new Error(`Git returned an invalid default-branch HEAD for ${repository}`);
+    return commit;
+}
+/** Resolve the public default-branch commit without downloading repository files. */
+export async function resolveRepositoryHead(input, options = {}) {
+    const repository = normalizeRepository(input);
+    const gitEnvironment = await isolatedGitEnvironment(loadoutHome());
+    const url = `https://github.com/${repository}.git`;
+    try {
+        const { stdout } = await execFileAsync("git", ["ls-remote", "--symref", "--", url, "HEAD"], {
+            maxBuffer: 1024 * 1024,
+            timeout: options.timeoutMs,
+            env: gitEnvironment,
+        });
+        return {
+            repository,
+            commit: parseRepositoryHead(repository, stdout),
+        };
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new Error(`Could not resolve ${repository}: ${message}`);
+    }
+}
 function normalizeRef(ref) {
     if (!/^[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(ref) ||
         ref.includes("..") ||

package/dist/src/core/update.js

@@ -1,6 +1,6 @@
 import { mkdir, writeFile } from "node:fs/promises";
 import { basename, join } from "node:path";
-import { fetchRepositorySnapshot } from "./source.js";
+import { fetchRepositorySnapshot, resolveRepositoryHead } from "./source.js";
 import { repositoryCachePath } from "./source.js";
 import { diffRepositorySnapshots } from "./diff.js";
 import { hashDirectory, readInstallState } from "./state.js";
@@ -85,21 +85,39 @@ async function analyzeManagedUpdate(oldRoot, newRoot, unitIds) {
     };
 }
 /** Builds a read-only update plan from persisted installs and live GitHub snapshots. */
-export async function buildUpdatePlan(resolver = async (repository) => fetchRepositorySnapshot(repository, { timeoutMs: 30_000 }), options = {}) {
+export async function buildUpdatePlan(resolver, options = {}) {
     const state = await readInstallState();
     const records = options.packageId
         ? state.installs.filter((record) => record.packageId === options.packageId)
         : state.installs;
     const results = new Array(records.length);
+    const lightweightResolver = resolver ??
+        options.resolveHead ??
+        ((repository) => resolveRepositoryHead(repository, { timeoutMs: 30_000 }));
     const resolutions = new Map();
     const resolveOnce = (repository) => {
         const existing = resolutions.get(repository);
         if (existing)
             return existing;
-        const pending = resolver(repository);
+        const pending = lightweightResolver(repository);
         resolutions.set(repository, pending);
         return pending;
     };
+    const changedSnapshots = new Map();
+    const fetchChangedOnce = (repository, commit) => {
+        const key = `${repository}\0${commit.toLowerCase()}`;
+        const existing = changedSnapshots.get(key);
+        if (existing)
+            return existing;
+        const pending = options.fetchChangedSnapshot
+            ? options.fetchChangedSnapshot(repository)
+            : fetchRepositorySnapshot(repository, {
+                ref: commit,
+                timeoutMs: 120_000,
+            });
+        changedSnapshots.set(key, pending);
+        return pending;
+    };
     let cursor = 0;
     let completed = 0;
     const workers = Array.from({
@@ -139,9 +157,16 @@ export async function buildUpdatePlan(resolver = async (repository) => fetchRepo
                     let diff;
                     let safetyFindings;
                     let approvalRequired = false;
-                    if (!same && current.path) {
+                    let currentPath = current.path;
+                    if (!same && !currentPath && !resolver) {
+                        const fetched = await fetchChangedOnce(record.repository, current.commit);
+                        if (fetched.commit.toLowerCase() !== current.commit.toLowerCase())
+                            throw new Error(`Resolved ${current.commit}, but fetched ${fetched.commit} for safety review`);
+                        currentPath = fetched.path;
+                    }
+                    if (!same && currentPath) {
                         const oldPath = repositoryCachePath(record.repository, record.resolvedCommit);
-                        const analysis = await analyzeManagedUpdate(oldPath, current.path, managedUnitIds(state, record.packageId));
+                        const analysis = await analyzeManagedUpdate(oldPath, currentPath, managedUnitIds(state, record.packageId));
                         diff = analysis.diff;
                         safetyFindings = analysis.safetyFindings;
                         approvalRequired = analysis.approvalRequired;

package/docs/USER_TEST_GUIDE.md

@@ -211,7 +211,7 @@ cleanup deliberately deletes Loadout's snapshots, so it is the last lifecycle te
 ## Troubleshooting and recovery
 
 - **`loadout` is not found after installation:** confirm `npm install --global
-loadout-ai@0.5.5` completed, run `hash -r`, and confirm npm's global binary
+loadout-ai@0.5.6` completed, run `hash -r`, and confirm npm's global binary
   directory is on `PATH`. For a source checkout, run `npm run build` and `npm link`.
 - **A preview asks for `--approve-risk`:** read the reported scripts, domains,
   credentials, binaries, or instruction findings. If you accept that specific plan,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "loadout-ai",
-  "version": "0.5.5",
+  "version": "0.5.6",
   "private": false,
   "license": "MIT",
   "description": "Universal upgrade manager for AI coding agents",