loadout-ai 0.6.0 → 0.8.0

package/dist/src/core/{registry.js → catalog/registry.js}

@@ -1,9 +1,11 @@
-import { createHash } from "node:crypto";
-import { cp, lstat, mkdir, readFile, readdir, rm, writeFile, } from "node:fs/promises";
+import { createHash, randomUUID } from "node:crypto";
+import { cp, lstat, mkdir, readFile, readdir, rename, rm, writeFile, } from "node:fs/promises";
 import { join, relative, resolve, sep } from "node:path";
-import { loadoutHome } from "./paths.js";
+import { loadoutHome } from "../agents/paths.js";
 import { analyzeUpdateSafety } from "./safety.js";
 const NAME = /^[a-z0-9][a-z0-9._-]*$/;
+/** A SHA-256 digest, and nothing that could traverse a path. */
+const DIGEST = /^[a-f0-9]{64}$/;
 const VERSION = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?$/;
 export function parsePackageDescriptor(value) {
     if (!value || typeof value !== "object")
@@ -266,18 +268,54 @@ function registryEndpoint(base, path) {
     endpoint.hash = "";
     return endpoint;
 }
+/** Registry responses are untrusted input: bound the wait and the body. */
+const REGISTRY_TIMEOUT_MS = 30_000;
+const REGISTRY_MAX_BYTES = 32 * 1024 * 1024;
+async function registryJson(input, init = {}) {
+    const response = await fetch(input, {
+        ...init,
+        signal: AbortSignal.timeout(REGISTRY_TIMEOUT_MS),
+    });
+    // Trust the declared length when present, but still cap what is read: a
+    // server may understate or omit it.
+    const declared = Number(response.headers.get("content-length"));
+    if (Number.isFinite(declared) && declared > REGISTRY_MAX_BYTES)
+        throw new Error("Remote registry response exceeds the size limit");
+    const body = await response.arrayBuffer();
+    if (body.byteLength > REGISTRY_MAX_BYTES)
+        throw new Error("Remote registry response exceeds the size limit");
+    const text = new TextDecoder().decode(body);
+    let value;
+    try {
+        value = JSON.parse(text);
+    }
+    catch {
+        throw new Error("Remote registry returned a malformed JSON response");
+    }
+    return { ok: response.ok, status: response.status, value };
+}
 export async function fetchRemoteRegistryPackage(registry, name, version) {
     if (!NAME.test(name) || !VERSION.test(version))
         throw new Error("Invalid remote registry package name or version");
     const base = registryUrl(registry);
-    const response = await fetch(registryEndpoint(base, `/v1/packages/${encodeURIComponent(name)}/${encodeURIComponent(version)}`));
+    const response = await registryJson(registryEndpoint(base, `/v1/packages/${encodeURIComponent(name)}/${encodeURIComponent(version)}`));
     if (!response.ok)
         throw new Error(`Remote registry returned ${response.status}`);
-    const bundle = (await response.json());
+    const bundle = response.value;
+    // `digest` arrives from a remote server and is used to build a path that is
+    // later deleted recursively. Validate its shape before it can become one:
+    // a value such as "../../.." would otherwise escape the cache root.
+    if (typeof bundle?.digest !== "string" || !DIGEST.test(bundle.digest))
+        throw new Error("Remote registry returned a bundle whose digest is not a SHA-256 hex string");
     const key = createHash("sha256")
         .update(base.origin + base.pathname)
         .digest("hex");
-    const target = join(loadoutHome(), "cache", "registry", key, name, version, bundle.digest);
+    const root = join(loadoutHome(), "cache", "registry", key, name, version);
+    const target = resolve(root, bundle.digest);
+    // Belt and braces: even with a validated digest, never operate on a path
+    // that resolved outside the directory it was meant to live in.
+    if (target !== root && !target.startsWith(root + sep))
+        throw new Error("Remote registry bundle resolved outside the cache root");
     try {
         const packed = await packPackage(target);
         if (packed.digest === bundle.digest)
@@ -286,9 +324,19 @@ export async function fetchRemoteRegistryPackage(registry, name, version) {
     catch {
         /* import below */
     }
-    await mkdir(resolve(target, ".."), { recursive: true });
-    await rm(target, { recursive: true, force: true });
-    await importRegistryBundle(bundle, target);
+    // Import into a scratch directory and swap it in, so a failed or malicious
+    // import cannot leave the cache holding a half-written package.
+    await mkdir(root, { recursive: true });
+    const staging = `${target}.incoming-${randomUUID().slice(0, 8)}`;
+    try {
+        await importRegistryBundle(bundle, staging);
+        await rm(target, { recursive: true, force: true });
+        await rename(staging, target);
+    }
+    catch (error) {
+        await rm(staging, { recursive: true, force: true });
+        throw error;
+    }
     return { path: target, digest: bundle.digest };
 }
 export async function publishRemotePackage(root, registry, token, options = {}) {
@@ -296,7 +344,7 @@ export async function publishRemotePackage(root, registry, token, options = {})
         throw new Error("Remote registry token is required");
     const bundle = await createRegistryBundle(root);
     const base = registryUrl(registry);
-    const response = await fetch(registryEndpoint(base, "/v1/packages"), {
+    const response = await registryJson(registryEndpoint(base, "/v1/packages"), {
         method: "POST",
         headers: {
             authorization: `Bearer ${token}`,
@@ -305,7 +353,7 @@ export async function publishRemotePackage(root, registry, token, options = {})
         },
         body: JSON.stringify(bundle),
     });
-    const result = (await response.json());
+    const result = response.value;
     if (!response.ok)
         throw new Error(result.error ?? `Remote registry returned ${response.status}`);
     return {

package/dist/src/core/{safety.js → catalog/safety.js}

@@ -38,27 +38,37 @@ const SUSPICIOUS_INSTRUCTIONS = [
 export function detectSecretKinds(content) {
     return SECRET_PATTERNS.filter((check) => check.pattern.test(content)).map((check) => check.name);
 }
-async function files(root) {
+const MAX_INSPECTABLE_BYTES = 2_000_000;
+const MAX_DEPTH = 10;
+async function files(root, gaps = []) {
     const result = new Map();
     const base = resolve(root);
     try {
         const rootInfo = await stat(base);
-        if (rootInfo.isFile() && rootInfo.size <= 2_000_000) {
+        if (rootInfo.isFile()) {
+            if (rootInfo.size > MAX_INSPECTABLE_BYTES) {
+                gaps.push({ path: basename(base), reason: "too-large" });
+                return result;
+            }
             result.set(basename(base), await readFile(base));
             return result;
         }
     }
     catch {
+        gaps.push({ path: basename(base), reason: "unreadable" });
         return result;
     }
     async function visit(directory, depth) {
-        if (depth > 10)
+        if (depth > MAX_DEPTH) {
+            gaps.push({ path: relative(base, directory), reason: "too-deep" });
             return;
+        }
         let entries;
         try {
             entries = await readdir(directory, { withFileTypes: true });
         }
         catch {
+            gaps.push({ path: relative(base, directory), reason: "unreadable" });
             return;
         }
         for (const entry of entries) {
@@ -73,14 +83,19 @@ async function files(root) {
             }
             if (!entry.isFile())
                 continue;
+            const shown = relative(base, absolute).split("\\").join("/");
             try {
                 const info = await stat(absolute);
-                if (info.size > 2_000_000)
+                if (info.size > MAX_INSPECTABLE_BYTES) {
+                    gaps.push({ path: shown, reason: "too-large" });
                     continue;
-                result.set(relative(base, absolute).split("\\").join("/"), await readFile(absolute));
+                }
+                result.set(shown, await readFile(absolute));
             }
             catch {
-                /* repository may change while being inspected */
+                // The repository may change while being inspected; either way this
+                // file was not reviewed, so record it rather than passing it silently.
+                gaps.push({ path: shown, reason: "unreadable" });
             }
         }
     }
@@ -131,8 +146,9 @@ function collectEnvironmentNames(content) {
 }
 /** Analyze changed repository files without running package code or revealing secret values. */
 export async function analyzeUpdateSafety(oldPath, newPath) {
+    const gaps = [];
     const oldFiles = oldPath ? await files(oldPath) : new Map();
-    const newFiles = await files(newPath);
+    const newFiles = await files(newPath, gaps);
     const changed = changedPaths(oldFiles, newFiles);
     const findings = [];
     const domains = new Set();
@@ -227,6 +243,19 @@ export async function analyzeUpdateSafety(oldPath, newPath) {
             paths: [...new Set(instructionPaths)].sort(),
             names: [...instructionKinds].sort(),
         });
+    // Fail closed. Anything the scan could not open is exactly what a reviewer
+    // needs told about, so an uninspectable file requires approval rather than
+    // producing a clean report.
+    if (gaps.length) {
+        const reasons = [...new Set(gaps.map((gap) => gap.reason))].sort();
+        findings.push({
+            severity: "blocking",
+            category: "uninspectable",
+            message: `Safety scan could not inspect ${gaps.length} path(s) (${reasons.join(", ")}); they were not reviewed.`,
+            paths: [...new Set(gaps.map((gap) => gap.path))].sort(),
+            names: reasons,
+        });
+    }
     return {
         approvalRequired: findings.some((finding) => finding.severity === "blocking"),
         findings,

package/dist/src/core/{skill-compare.js → catalog/skill-compare.js}

@@ -1,5 +1,5 @@
 import { basename } from "node:path";
-import { explainCatalogScore } from "./ranking.js";
+import { explainCatalogScore } from "../discovery/ranking.js";
 const STOP_WORDS = new Set([
     "a",
     "an",

package/dist/src/core/{skill-inventory.js → catalog/skill-inventory.js}

@@ -1,9 +1,9 @@
 import { createHash } from "node:crypto";
 import { lstat, readFile, readdir } from "node:fs/promises";
 import { join, relative, resolve, sep } from "node:path";
-import { DEFAULT_ACTIVE_SKILL_LIMIT } from "./active-limit.js";
-import { readInstallState } from "./state.js";
-import { listInstalledRuntimeToolSkillTargets, } from "./runtime-tools.js";
+import { DEFAULT_ACTIVE_SKILL_LIMIT } from "../workspace/active-limit.js";
+import { readInstallState } from "../workspace/state.js";
+import { listInstalledRuntimeToolSkillTargets, } from "../agents/runtime-tools.js";
 const MAX_SCAN_DEPTH = 6;
 function cleanFrontmatterValue(value) {
     if (!value)

package/dist/src/core/{skills.js → catalog/skills.js}

@@ -1,6 +1,6 @@
 import { cp, lstat, readdir, readFile, rm } from "node:fs/promises";
 import { dirname, join, relative, resolve, sep } from "node:path";
-import { ensureDirectory } from "./paths.js";
+import { ensureDirectory } from "../agents/paths.js";
 import { assertSkillSecurity, scanSkillSecurity } from "./skill-security.js";
 export async function discoverSkillDirectories(root, options = {}) {
     const result = [];

package/dist/src/core/{candidate-intelligence.js → discovery/candidate-intelligence.js}

@@ -4,13 +4,13 @@ import { readFile, stat } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { isDeepStrictEqual } from "node:util";
-import { writeFileAtomically } from "./atomic-file.js";
-import { loadEffectiveCatalog, validateCatalog } from "./catalog.js";
+import { writeFileAtomically } from "../install/atomic-file.js";
+import { loadEffectiveCatalog, validateCatalog } from "../catalog/catalog.js";
 import { evaluatePackage } from "./evaluate.js";
-import { inspectPackage } from "./package.js";
-import { ensureDirectory, loadoutHome } from "./paths.js";
-import { fetchRepositorySnapshot, normalizeRepository, } from "./source.js";
-import { safeTerminalText } from "./terminal.js";
+import { inspectPackage } from "../install/package.js";
+import { ensureDirectory, loadoutHome } from "../agents/paths.js";
+import { fetchRepositorySnapshot, normalizeRepository, } from "../install/source.js";
+import { safeTerminalText } from "../reporting/terminal.js";
 const dossierDirectory = () => join(loadoutHome(), "candidates");
 const sourceVerifiedDossiers = new WeakMap();
 function installabilityFor(components) {

package/dist/src/core/{discovery-connector.js → discovery/discovery-connector.js}

@@ -1,7 +1,7 @@
 import { readFile, stat } from "node:fs/promises";
 import { dirname } from "node:path";
-import { writeFileAtomically } from "./atomic-file.js";
-import { ensureDirectory } from "./paths.js";
+import { writeFileAtomically } from "../install/atomic-file.js";
+import { ensureDirectory } from "../agents/paths.js";
 export class ConnectorRequestError extends Error {
     status;
     retryAfterSeconds;

package/dist/src/core/{evaluate.js → discovery/evaluate.js}

@@ -1,5 +1,5 @@
-import { inspectPackage } from "./package.js";
-import { analyzeUpdateSafety } from "./safety.js";
+import { inspectPackage } from "../install/package.js";
+import { analyzeUpdateSafety } from "../catalog/safety.js";
 function statusFor(findings) {
     if (findings.some((finding) => finding.category === "secret" || finding.category === "instruction"))
         return "blocked";

package/dist/src/core/{mcp-registry-discovery.js → discovery/mcp-registry-discovery.js}

@@ -1,6 +1,6 @@
 import { join } from "node:path";
 import { ConnectorRequestError, fetchBoundedJson, rateLimitFromHeaders, readDiscoveryConnectorCache, writeDiscoveryConnectorCache, } from "./discovery-connector.js";
-import { loadoutHome } from "./paths.js";
+import { loadoutHome } from "../agents/paths.js";
 const SOURCE = "official-mcp-registry";
 const API = "https://registry.modelcontextprotocol.io/v0.1/servers";
 const ATTRIBUTION = "https://registry.modelcontextprotocol.io/docs";

package/dist/src/core/{observations.js → discovery/observations.js}

@@ -1,8 +1,8 @@
 import { readFile } from "node:fs/promises";
 import { join } from "node:path";
-import { fetchGitHubReleaseMetadata, } from "./github.js";
-import { writeFileAtomically } from "./atomic-file.js";
-import { loadoutHome } from "./paths.js";
+import { fetchGitHubReleaseMetadata, } from "../runtime/github.js";
+import { writeFileAtomically } from "../install/atomic-file.js";
+import { loadoutHome } from "../agents/paths.js";
 const MAX_OBSERVATIONS_PER_REPOSITORY = 90;
 function observationPath(repository) {
     return join(loadoutHome(), "observations", `${repository.replace("/", "__")}.json`);

package/dist/src/core/{review-queue.js → discovery/review-queue.js}

@@ -1,7 +1,7 @@
 import { readFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
-import { writeFileAtomically } from "./atomic-file.js";
-import { ensureDirectory, loadoutHome } from "./paths.js";
+import { writeFileAtomically } from "../install/atomic-file.js";
+import { ensureDirectory, loadoutHome } from "../agents/paths.js";
 const queuePath = () => join(loadoutHome(), "review-queue.json");
 function isQueue(value) {
     if (!value || typeof value !== "object" || Array.isArray(value))

package/dist/src/core/{skills-sh-discovery.js → discovery/skills-sh-discovery.js}

@@ -1,6 +1,6 @@
 import { join } from "node:path";
 import { ConnectorRequestError, fetchBoundedJson, rateLimitFromHeaders, readDiscoveryConnectorCache, writeDiscoveryConnectorCache, } from "./discovery-connector.js";
-import { loadoutHome } from "./paths.js";
+import { loadoutHome } from "../agents/paths.js";
 const SOURCE = "skills-sh";
 const API = "https://skills.sh/api/v1/skills";
 const ATTRIBUTION = "https://skills.sh/docs/api";

package/dist/src/core/{adopt.js → install/adopt.js}

@@ -1,9 +1,9 @@
 import { createHash } from "node:crypto";
 import { lstat, readFile, readdir } from "node:fs/promises";
 import { basename, isAbsolute, join, posix, relative, sep } from "node:path";
-import { enrichInventoryWithProvenance } from "./provenance.js";
-import { scanInstalledSkills } from "./skill-inventory.js";
-import { installStatePath, recordInstall } from "./state.js";
+import { enrichInventoryWithProvenance } from "../catalog/provenance.js";
+import { scanInstalledSkills } from "../catalog/skill-inventory.js";
+import { installStatePath, recordInstall } from "../workspace/state.js";
 import { runMutationTransaction } from "./transaction.js";
 const issuedAdoptionPlans = new WeakMap();
 function safeRelativePath(root, path) {

package/dist/src/core/{catalog-install.js → install/catalog-install.js}

@@ -1,13 +1,13 @@
-import { DEFAULT_ACTIVE_SKILL_LIMIT } from "./active-limit.js";
-import { loadEffectiveCatalog } from "./catalog.js";
-import { detectAgents } from "./paths.js";
-import { isStableSkillSelected, isPowerSkillSelected, resolveCatalogProfile, } from "./profiles.js";
+import { DEFAULT_ACTIVE_SKILL_LIMIT } from "../workspace/active-limit.js";
+import { loadEffectiveCatalog, } from "../catalog/catalog.js";
+import { detectAgents } from "../agents/paths.js";
+import { isStableSkillSelected, isPowerSkillSelected, resolveCatalogProfile, } from "../catalog/profiles.js";
 import { applySkillLibraryBatch, applySkillInstallBatch, buildSkillPlan, installedAgents, planManagedProfileReconciliation, } from "./install.js";
 import { fetchRepositorySnapshot, } from "./source.js";
-import { analyzeInstallPlanSafety, } from "./safety.js";
-import { formatModelApiAccess } from "./access.js";
-import { recordInstalledProfile } from "./profile-state.js";
-import { readInstallState } from "./state.js";
+import { analyzeInstallPlanSafety, } from "../catalog/safety.js";
+import { formatModelApiAccess, } from "../routing/access.js";
+import { recordInstalledProfile } from "../workspace/profile-state.js";
+import { readInstallState } from "../workspace/state.js";
 async function parallelMap(values, concurrency, worker) {
     const results = new Array(values.length);
     let cursor = 0;
@@ -240,11 +240,11 @@ export function formatPreparedCatalogInstall(prepared, options = {}) {
     const quarantined = prepared.skipped.filter((item) => item.kind === "quarantined");
     const retired = prepared.reconciliation?.obsoleteUnits ?? [];
     const modeLabel = prepared.selection.mode === "maximum"
-        ? "Maximum Library"
+        ? "Maximum"
         : prepared.selection.mode === "power"
-            ? "Power Boost"
+            ? "Power"
             : prepared.selection.mode === "stable"
-                ? "Stable Boost"
+                ? "Stable"
                 : "Custom";
     const lines = [
         `Loadout: ${modeLabel}`,

package/dist/src/core/{file-lock.js → install/file-lock.js}

@@ -1,7 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { mkdir, open, readFile, rename, rm, stat, utimes, } from "node:fs/promises";
 import { dirname } from "node:path";
-import { ensureDirectory } from "./paths.js";
+import { ensureDirectory } from "../agents/paths.js";
 const wait = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds));
 function parseOwner(content) {
     try {

package/dist/src/core/{install.js → install/install.js}

@@ -1,12 +1,12 @@
 import { existsSync } from "node:fs";
 import { cp, lstat, rm } from "node:fs/promises";
 import { basename, dirname, isAbsolute, join, posix, relative, win32, } from "node:path";
-import { ensureDirectory, loadoutHome } from "./paths.js";
-import { planAdapterSkillInstall } from "./adapters.js";
-import { applySkillPlan, detectInstallConflicts } from "./skills.js";
-import { activationLibraryPath, installStatePath, recordInstall, recordInstallBatch, recordLibraryInstallBatch, readInstallState, hashDirectory, writeInstallState, } from "./state.js";
+import { ensureDirectory, loadoutHome } from "../agents/paths.js";
+import { planAdapterSkillInstall } from "../agents/adapters.js";
+import { applySkillPlan, detectInstallConflicts } from "../catalog/skills.js";
+import { activationLibraryPath, installStatePath, recordInstall, recordInstallBatch, recordLibraryInstallBatch, readInstallState, hashDirectory, writeInstallState, } from "../workspace/state.js";
 import { runMutationTransaction } from "./transaction.js";
-import { inspectTargetOccupancy } from "./target-occupancy.js";
+import { inspectTargetOccupancy } from "../workspace/target-occupancy.js";
 export function installedAgents(agents, requested) {
     const available = agents.filter((agent) => agent.installed);
     if (!requested || requested.length === 0)

package/dist/src/core/{package.js → install/package.js}

@@ -1,8 +1,8 @@
 import { readFile, readdir } from "node:fs/promises";
 import { dirname, join, relative, resolve } from "node:path";
-import { discoverSkillDirectories } from "./skills.js";
-import { discoverMcpManifests } from "./mcp.js";
-import { discoverResources } from "./components.js";
+import { discoverSkillDirectories } from "../catalog/skills.js";
+import { discoverMcpManifests } from "../runtime/mcp.js";
+import { discoverResources } from "../catalog/components.js";
 const portableRelative = (root, path) => relative(root, path).split(/[\\/]/).join("/") || ".";
 function frontmatter(path) {
     return readFile(join(path, "SKILL.md"), "utf8").then((content) => {

package/dist/src/core/{reconcile.js → install/reconcile.js}

@@ -1,13 +1,13 @@
 import { createHash } from "node:crypto";
 import { cp, lstat, readFile, readdir, rm } from "node:fs/promises";
 import { join, relative, sep } from "node:path";
-import { analyzeUpdateSafety } from "./safety.js";
-import { enrichInventoryWithProvenance, } from "./provenance.js";
-import { scanInstalledSkills } from "./skill-inventory.js";
-import { installStatePath, recordInstallBatch } from "./state.js";
+import { analyzeUpdateSafety } from "../catalog/safety.js";
+import { enrichInventoryWithProvenance, } from "../catalog/provenance.js";
+import { scanInstalledSkills } from "../catalog/skill-inventory.js";
+import { installStatePath, recordInstallBatch } from "../workspace/state.js";
 import { runMutationTransaction } from "./transaction.js";
 import { repositoryCachePath } from "./source.js";
-import { validateSkillDirectory } from "./skills.js";
+import { validateSkillDirectory } from "../catalog/skills.js";
 const issuedPlans = new WeakMap();
 const IGNORED_TREE_NAMES = new Set([".git", ".cache", "node_modules"]);
 function slug(value) {

package/dist/src/core/{remove.js → install/remove.js}

@@ -1,10 +1,10 @@
 import { createHash } from "node:crypto";
 import { readFile, rm } from "node:fs/promises";
-import { forgetInstall, installStatePath, readInstallState } from "./state.js";
-import { writeMcpConfigPlan } from "./mcp.js";
+import { forgetInstall, installStatePath, readInstallState, } from "../workspace/state.js";
+import { writeMcpConfigPlan } from "../runtime/mcp.js";
 import { runMutationTransaction } from "./transaction.js";
-import { managedFileReadPath } from "./active-set.js";
-import { codexMcpServerFingerprint, removeCodexMcpServerBlock, writeCodexMcpConfigContent, } from "./codex-mcp.js";
+import { managedFileReadPath } from "../workspace/active-set.js";
+import { codexMcpServerFingerprint, removeCodexMcpServerBlock, writeCodexMcpConfigContent, } from "../agents/codex-mcp.js";
 export async function planRemove(packageId) {
     const state = await readInstallState();
     const record = state.installs.find((entry) => entry.packageId === packageId);

package/dist/src/core/{snapshot.js → install/snapshot.js}

@@ -1,7 +1,7 @@
 import { createHash, randomUUID } from "node:crypto";
 import { readFile, writeFile, mkdir, readdir, rename, rm, lstat, } from "node:fs/promises";
 import { dirname, join, resolve, sep } from "node:path";
-import { loadoutHome, ensureDirectory, userHome } from "./paths.js";
+import { loadoutHome, ensureDirectory, userHome } from "../agents/paths.js";
 export async function createSnapshot(paths, options = {}) {
     const normalizedRoots = [...new Set(paths.map((path) => resolve(path)))];
     const snapshot = {

package/dist/src/core/{source.js → install/source.js}

@@ -4,11 +4,28 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
-import { loadoutHome, ensureDirectory } from "./paths.js";
+import { loadoutHome, ensureDirectory } from "../agents/paths.js";
 const execFileAsync = promisify(execFile);
+/**
+ * Bounds apply to every fetch, not only to callers who remember to ask. An
+ * unbounded clone of an untrusted repository can hang a Git process forever or
+ * fill the disk, so callers may raise a limit but none may omit one.
+ */
+export const REPOSITORY_FETCH_DEFAULTS = {
+    /** A reviewed skill repository clones well inside this. */
+    timeoutMs: 120_000,
+    maxBytes: 256 * 1024 * 1024,
+    maxFiles: 20_000,
+};
+function withFetchDefaults(options) {
+    return {
+        ...options,
+        timeoutMs: options.timeoutMs ?? REPOSITORY_FETCH_DEFAULTS.timeoutMs,
+        maxBytes: options.maxBytes ?? REPOSITORY_FETCH_DEFAULTS.maxBytes,
+        maxFiles: options.maxFiles ?? REPOSITORY_FETCH_DEFAULTS.maxFiles,
+    };
+}
 async function enforceRepositoryBounds(root, options) {
-    if (options.maxBytes === undefined && options.maxFiles === undefined)
-        return;
     let bytes = 0;
     let files = 0;
     const pending = [root];
@@ -35,8 +52,6 @@ async function enforceRepositoryBounds(root, options) {
     }
 }
 export function validateGitHubTreeBounds(value, options) {
-    if (options.maxBytes === undefined && options.maxFiles === undefined)
-        return;
     if (!value || typeof value !== "object" || Array.isArray(value))
         throw new Error("GitHub tree preflight returned an invalid response");
     const response = value;
@@ -63,8 +78,6 @@ export function validateGitHubTreeBounds(value, options) {
     }
 }
 async function enforceGitHubTreeBounds(repository, commit, options) {
-    if (options.maxBytes === undefined && options.maxFiles === undefined)
-        return;
     const signal = AbortSignal.timeout(options.timeoutMs ?? 120_000);
     const token = process.env.GITHUB_TOKEN?.trim();
     const response = await (options.fetcher ?? fetch)(`https://api.github.com/repos/${repository}/git/trees/${commit}?recursive=1`, {
@@ -181,7 +194,8 @@ function normalizeRef(ref) {
         throw new Error(`Invalid Git ref: ${ref}`);
     return ref;
 }
-export async function fetchRepositorySnapshot(input, options = {}) {
+export async function fetchRepositorySnapshot(input, requested = {}) {
+    const options = withFetchDefaults(requested);
     const repository = normalizeRepository(input);
     const gitEnvironment = await isolatedGitEnvironment(loadoutHome());
     const ref = options.ref ? normalizeRef(options.ref) : undefined;

package/dist/src/core/{sync.js → install/sync.js}

@@ -1,17 +1,17 @@
 import { createHash } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import { dirname, resolve, sep } from "node:path";
-import { loadEffectiveCatalog } from "./catalog.js";
+import { loadEffectiveCatalog } from "../catalog/catalog.js";
 import { installedAgents } from "./install.js";
-import { orderManifestPackages, readManifest, writeLockfile, } from "./manifest.js";
-import { detectAgents, userHome } from "./paths.js";
+import { orderManifestPackages, readManifest, writeLockfile, } from "../workspace/manifest.js";
+import { detectAgents, userHome } from "../agents/paths.js";
 import { fetchGitSnapshot, fetchRepositorySnapshot } from "./source.js";
-import { addRootFileExports, buildUniversalPackagePlan } from "./components.js";
-import { analyzeInstallPlanSafety, } from "./safety.js";
-import { fetchRemoteRegistryPackage, packPackage, resolveRegistryPackage, } from "./registry.js";
-import { discoverMcpManifests, planMcpConfigBatch, writeMcpConfigPlan, } from "./mcp.js";
-import { applySkillPlan, detectInstallConflicts } from "./skills.js";
-import { installStatePath, readInstallState, recordInstallTransaction, } from "./state.js";
+import { addRootFileExports, buildUniversalPackagePlan, } from "../catalog/components.js";
+import { analyzeInstallPlanSafety, } from "../catalog/safety.js";
+import { fetchRemoteRegistryPackage, packPackage, resolveRegistryPackage, } from "../catalog/registry.js";
+import { discoverMcpManifests, planMcpConfigBatch, writeMcpConfigPlan, } from "../runtime/mcp.js";
+import { applySkillPlan, detectInstallConflicts } from "../catalog/skills.js";
+import { installStatePath, readInstallState, recordInstallTransaction, } from "../workspace/state.js";
 import { runMutationTransaction } from "./transaction.js";
 function registrySourceKey(source) {
     if (source.type === "registry")

package/dist/src/core/{transaction.js → install/transaction.js}

@@ -1,7 +1,7 @@
 import { lstat, mkdir, readdir, readFile, rename, rm, writeFile, } from "node:fs/promises";
 import { randomUUID } from "node:crypto";
 import { join } from "node:path";
-import { ensureDirectory, loadoutHome } from "./paths.js";
+import { ensureDirectory, loadoutHome } from "../agents/paths.js";
 import { createSnapshot, readSnapshot, recordSnapshotPostMutationState, restoreSnapshot, } from "./snapshot.js";
 import { acquireFileLock, withFileLock, } from "./file-lock.js";
 export const transactionRoot = () => join(loadoutHome(), "staging");

package/dist/src/core/{uninstall.js → install/uninstall.js}

@@ -2,11 +2,11 @@ import { execFile } from "node:child_process";
 import { readdir, rm, rmdir } from "node:fs/promises";
 import { dirname, parse, resolve } from "node:path";
 import { promisify } from "node:util";
-import { loadoutHome } from "./paths.js";
+import { loadoutHome } from "../agents/paths.js";
 import { applyRemove, planRemove } from "./remove.js";
-import { applyRuntimeToolPlan, listInstalledRuntimeTools, planRuntimeTool, } from "./runtime-tools.js";
-import { applyNativeSchedulerBundle, planNativeScheduler, } from "./scheduler.js";
-import { readInstallState } from "./state.js";
+import { applyRuntimeToolPlan, listInstalledRuntimeTools, planRuntimeTool, } from "../agents/runtime-tools.js";
+import { applyNativeSchedulerBundle, planNativeScheduler, } from "../runtime/scheduler.js";
+import { readInstallState } from "../workspace/state.js";
 export async function buildUninstallPlan(dependencies = {}) {
     const stateHome = loadoutHome();
     const state = await readInstallState();

package/dist/src/core/{update.js → install/update.js}

@@ -3,11 +3,11 @@ import { basename, join } from "node:path";
 import { fetchRepositorySnapshot, resolveRepositoryHead } from "./source.js";
 import { repositoryCachePath } from "./source.js";
 import { diffRepositorySnapshots } from "./diff.js";
-import { hashDirectory, readInstallState } from "./state.js";
-import { analyzeUpdateSafety } from "./safety.js";
-import { detectAgents, loadoutHome } from "./paths.js";
+import { hashDirectory, readInstallState } from "../workspace/state.js";
+import { analyzeUpdateSafety } from "../catalog/safety.js";
+import { detectAgents, loadoutHome } from "../agents/paths.js";
 import { applySkillInstall, buildSkillPlan, installedAgents, } from "./install.js";
-import { discoverSkillDirectories, validateSkillDirectory, } from "./skills.js";
+import { discoverSkillDirectories, validateSkillDirectory, } from "../catalog/skills.js";
 function managedUnitIds(state, packageId) {
     return [
         ...new Set((state.activations ?? [])