loadout-ai 0.7.0 → 0.9.0

package/dist/src/core/discovery/candidate-intelligence.js

@@ -11,15 +11,10 @@ import { inspectPackage } from "../install/package.js";
 import { ensureDirectory, loadoutHome } from "../agents/paths.js";
 import { fetchRepositorySnapshot, normalizeRepository, } from "../install/source.js";
 import { safeTerminalText } from "../reporting/terminal.js";
+import { componentsFor, evidencePathsFor, installabilityFor, overlapFor, } from "./candidate-intelligence-evidence.js";
+import { assertDossierEvidence, finiteNonnegative, isTextArray, validDate, validPersistedEvaluation, validPersistedInspection, } from "./candidate-intelligence-validation.js";
 const dossierDirectory = () => join(loadoutHome(), "candidates");
 const sourceVerifiedDossiers = new WeakMap();
-function installabilityFor(components) {
-    if (components.some((component) => ["skill", "rule", "command", "agent"].includes(component)))
-        return "portable-components";
-    if (components.some((component) => component === "mcp" || component === "plugin"))
-        return "explicit-runtime-setup";
-    return "unsupported-source-shape";
-}
 function dossierIntegrity(dossier) {
     return createHash("sha256").update(JSON.stringify(dossier)).digest("hex");
 }
@@ -28,19 +23,11 @@ function bundledDiscoveryPath() {
     const candidates = [
         join(moduleDirectory, "..", "..", "catalog", "discovered.json"),
         join(moduleDirectory, "..", "..", "..", "catalog", "discovered.json"),
+        join(moduleDirectory, "..", "..", "..", "..", "catalog", "discovered.json"),
         join(process.cwd(), "catalog", "discovered.json"),
     ];
     return candidates.find((candidate) => existsSync(candidate)) ?? candidates[0];
 }
-function isTextArray(value) {
-    return (Array.isArray(value) && value.every((item) => typeof item === "string"));
-}
-function finiteNonnegative(value) {
-    return typeof value === "number" && Number.isFinite(value) && value >= 0;
-}
-function validDate(value) {
-    return typeof value === "string" && !Number.isNaN(Date.parse(value));
-}
 function parseDiscovery(value) {
     if (!value || typeof value !== "object" || Array.isArray(value))
         throw new Error("Discovery artifact must be an object");
@@ -163,106 +150,6 @@ export async function listDiscoveryCandidates(options = {}) {
         left.repository.localeCompare(right.repository))
         .slice(0, options.limit ?? 20);
 }
-function componentsFor(inspection) {
-    const result = [];
-    if (inspection.counts.skills)
-        result.push("skill");
-    if (inspection.counts.rules)
-        result.push("rule");
-    if (inspection.counts.commands)
-        result.push("command");
-    if (inspection.counts.agents)
-        result.push("agent");
-    if (inspection.plugins.some((plugin) => !plugin.warnings.some((warning) => warning.startsWith("invalid plugin manifest"))))
-        result.push("plugin");
-    if (inspection.mcpServers.length)
-        result.push("mcp");
-    return result;
-}
-function evidencePathsFor(inspection) {
-    return [
-        ...inspection.skills.map((item) => join(item.path, "SKILL.md")),
-        ...inspection.resources.map((item) => item.path),
-        ...inspection.plugins
-            .filter((item) => !item.warnings.some((warning) => warning.startsWith("invalid plugin manifest")))
-            .map((item) => item.path),
-        ...inspection.mcpServers.map((item) => item.path),
-    ]
-        .map((path) => path.split(/[\\/]/).join("/"))
-        .filter((path) => path !== "." && !path.startsWith("../"))
-        .filter((path, index, paths) => paths.indexOf(path) === index)
-        .sort();
-}
-const STOP_WORDS = new Set([
-    "the",
-    "and",
-    "for",
-    "with",
-    "from",
-    "that",
-    "this",
-    "your",
-    "into",
-    "agent",
-    "agents",
-    "skill",
-    "skills",
-    "mcp",
-    "server",
-    "servers",
-    "workflow",
-    "workflows",
-    "code",
-    "coding",
-    "developer",
-    "development",
-    "platform",
-    "context",
-    "open",
-    "source",
-    "using",
-    "across",
-    "tool",
-    "tools",
-    "github",
-]);
-function tokens(...values) {
-    return new Set(values
-        .join(" ")
-        .toLowerCase()
-        .split(/[^a-z0-9]+/)
-        .filter((word) => word.length >= 3 && !STOP_WORDS.has(word)));
-}
-function overlapFor(discovery, inspection, catalog) {
-    const candidateTokens = tokens(discovery.repository, discovery.description, discovery.topics.join(" "), ...inspection.skills.flatMap((item) => [item.name, item.description]), ...inspection.resources.map((item) => item.name), ...inspection.plugins.flatMap((item) => [item.name, item.description]), ...inspection.mcpServers.map((item) => item.name));
-    const candidateComponents = new Set(componentsFor(inspection));
-    return catalog
-        .map((pkg) => {
-        const packageTokens = tokens(pkg.id, pkg.displayName, pkg.description, pkg.category, pkg.topics?.join(" "));
-        const common = [...candidateTokens]
-            .filter((word) => packageTokens.has(word))
-            .sort();
-        // Containment is more useful than union similarity here: a large skill
-        // collection can overlap a focused package even when most collection
-        // tokens describe unrelated capabilities.
-        const smallerVocabulary = Math.min(candidateTokens.size, packageTokens.size);
-        const score = smallerVocabulary ? common.length / smallerVocabulary : 0;
-        const componentMatch = pkg.components?.some((component) => candidateComponents.has(component)) ?? false;
-        return {
-            packageId: pkg.id,
-            repository: pkg.repository,
-            score: Math.round(score * 1000) / 1000,
-            relationship: componentMatch && common.length >= 2 && score >= 0.2
-                ? "possible-overlap"
-                : "same-tooling-area",
-            evidence: common.slice(0, 8).map((word) => `shared term: ${word}`),
-        };
-    })
-        .filter((item) => item.evidence.length >= 1 && item.score >= 0.1)
-        .sort((left, right) => right.score - left.score ||
-        left.packageId.localeCompare(right.packageId))
-        .slice(0, 5);
-}
 export async function buildCandidateDossier(repository, options = {}) {
     const normalized = normalizeRepository(repository);
     const artifact = await readDiscoveryArtifact(options.discoveryPath);
@@ -370,104 +257,6 @@ export async function writeCandidateDossier(dossier, output) {
     await writeFileAtomically(target, `${JSON.stringify(dossier, null, 2)}\n`);
     return target;
 }
-function validPersistedEvaluation(value) {
-    if (!value || typeof value !== "object" || Array.isArray(value))
-        return false;
-    const evaluation = value;
-    const categories = evaluation.categories;
-    return (evaluation.evaluatorVersion === 1 &&
-        typeof evaluation.uncertainty === "string" &&
-        Array.isArray(categories) &&
-        categories.length === 2 &&
-        new Set(categories.map((item) => item.category)).size === 2 &&
-        categories.every((item) => (item.category === "skills" || item.category === "mcp") &&
-            ["ready", "needs-review", "blocked", "not-applicable"].includes(item.status) &&
-            isTextArray(item.findings)));
-}
-function safeEvidencePath(value) {
-    return (typeof value === "string" &&
-        Boolean(value) &&
-        !value.startsWith("/") &&
-        !value.split(/[\\/]/).includes(".."));
-}
-function validPersistedInspection(value) {
-    if (!value || typeof value !== "object" || Array.isArray(value))
-        return false;
-    const inspection = value;
-    const validCount = (count) => typeof count === "number" && Number.isSafeInteger(count) && count >= 0;
-    const validNamedPath = (item, type) => Boolean(item &&
-        typeof item === "object" &&
-        !Array.isArray(item) &&
-        item.type === type &&
-        typeof item.name === "string" &&
-        safeEvidencePath(item.path));
-    if (!Array.isArray(inspection.skills) ||
-        !inspection.skills.every((item) => validNamedPath(item, "skill") &&
-            (item.description === undefined ||
-                typeof item.description === "string")) ||
-        !Array.isArray(inspection.resources) ||
-        !inspection.resources.every((item) => ["rule", "command", "agent"].includes(item.type) &&
-            validNamedPath(item, item.type)) ||
-        !Array.isArray(inspection.plugins) ||
-        !inspection.plugins.every((item) => validNamedPath(item, "plugin") &&
-            (item.description === undefined ||
-                typeof item.description === "string") &&
-            (item.version === undefined || typeof item.version === "string") &&
-            (item.author === undefined || typeof item.author === "string") &&
-            Array.isArray(item.components) &&
-            item.components.every((component) => [
-                "skill",
-                "rule",
-                "command",
-                "agent",
-                "mcp",
-                "plugin",
-                "root",
-            ].includes(component)) &&
-            isTextArray(item.hookEvents) &&
-            isTextArray(item.mcpServers) &&
-            isTextArray(item.warnings)) ||
-        !Array.isArray(inspection.mcpServers) ||
-        !inspection.mcpServers.every((item) => validNamedPath(item, "mcp") &&
-            ["command", "url", "unknown"].includes(item.transport) &&
-            (item.command === undefined || typeof item.command === "string") &&
-            (item.url === undefined || typeof item.url === "string") &&
-            validCount(item.argumentCount) &&
-            validCount(item.environmentVariableCount) &&
-            isTextArray(item.warnings)) ||
-        !inspection.counts ||
-        !validCount(inspection.counts.skills) ||
-        !validCount(inspection.counts.rules) ||
-        !validCount(inspection.counts.commands) ||
-        !validCount(inspection.counts.agents) ||
-        !validCount(inspection.counts.plugins) ||
-        !validCount(inspection.counts.mcpServers) ||
-        !validCount(inspection.counts.manifests) ||
-        !isTextArray(inspection.warnings))
-        return false;
-    return (inspection.counts.skills === inspection.skills.length &&
-        inspection.counts.rules ===
-            inspection.resources.filter((item) => item.type === "rule").length &&
-        inspection.counts.commands ===
-            inspection.resources.filter((item) => item.type === "command").length &&
-        inspection.counts.agents ===
-            inspection.resources.filter((item) => item.type === "agent").length &&
-        inspection.counts.plugins === inspection.plugins.length &&
-        inspection.counts.mcpServers === inspection.mcpServers.length);
-}
-function assertDossierEvidence(dossier) {
-    if (!validPersistedInspection(dossier.inspection))
-        throw new Error("Candidate dossier inspection evidence is invalid");
-    const inspection = { root: ".", ...dossier.inspection };
-    const components = componentsFor(inspection);
-    const evidencePaths = evidencePathsFor(inspection);
-    if (JSON.stringify(dossier.components) !== JSON.stringify(components))
-        throw new Error("Candidate dossier components do not match inspection evidence");
-    if (dossier.installability !== installabilityFor(components))
-        throw new Error("Candidate dossier installability does not match inspection evidence");
-    if (JSON.stringify(dossier.evidencePaths) !== JSON.stringify(evidencePaths))
-        throw new Error("Candidate dossier evidencePaths do not match inspection evidence");
-}
 export async function readCandidateDossier(path) {
     const target = resolve(path);
     const info = await stat(target);

package/dist/src/core/discovery/community.js

@@ -1,3 +1,4 @@
+import { boundedJson } from "../runtime/bounded-json.js";
 const API_BASE = "https://hacker-news.firebaseio.com/v0";
 const GITHUB_REPOSITORY = /(?:https?:\/\/)?(?:www\.)?github\.com\/([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)/gi;
 function repositoryFromText(value) {
@@ -50,20 +51,27 @@ export async function discoverHackerNewsRepositories(options = {}) {
     const keywords = (options.keywords ?? [])
         .map((keyword) => keyword.trim().toLowerCase())
         .filter(Boolean);
-    const idsResponse = await fetcher(`${API_BASE}/topstories.json`);
+    const { response: idsResponse, value: ids } = await boundedJson(fetcher, `${API_BASE}/topstories.json`, {}, {
+        timeoutMs: 30_000,
+        maxBytes: 4 * 1024 * 1024,
+        label: "Hacker News",
+    });
     if (!idsResponse.ok)
         throw new Error(`Hacker News top stories request failed (${idsResponse.status})`);
-    const ids = (await idsResponse.json());
     if (!Array.isArray(ids))
         throw new Error("Hacker News top stories response is invalid");
     const selectedIds = ids
         .filter((id) => typeof id === "number" && Number.isInteger(id))
         .slice(0, limit);
     const stories = await Promise.all(selectedIds.map(async (id) => {
-        const response = await fetcher(`${API_BASE}/item/${id}.json`);
+        const { response, value } = await boundedJson(fetcher, `${API_BASE}/item/${id}.json`, {}, {
+            timeoutMs: 30_000,
+            maxBytes: 1024 * 1024,
+            label: "Hacker News",
+        });
         if (!response.ok)
             return undefined;
-        return (await response.json());
+        return value;
     }));
     const deduplicated = new Map();
     for (const story of stories) {

package/dist/src/core/discovery/github-discovery.js

@@ -1,3 +1,4 @@
+import { boundedJson } from "../runtime/bounded-json.js";
 /** A rolling window prevents the default discovery query from aging in place. */
 export function defaultGitHubDiscoveryQuery(now = new Date()) {
     return defaultGitHubDiscoveryQueries(now)[0];
@@ -41,7 +42,11 @@ export async function discoverGitHubRepositories(options) {
             order: "desc",
             per_page: String(limit),
         });
-        const response = await (options.fetcher ?? fetch)(`https://api.github.com/search/repositories?${params}`, { headers });
+        const { response, value } = await boundedJson(options.fetcher ?? fetch, `https://api.github.com/search/repositories?${params}`, { headers }, {
+            timeoutMs: 30_000,
+            maxBytes: 8 * 1024 * 1024,
+            label: "GitHub repository discovery",
+        });
         if (!response.ok) {
             const remaining = response.headers.get("x-ratelimit-remaining");
             const reset = response.headers.get("x-ratelimit-reset");
@@ -51,7 +56,6 @@ export async function discoverGitHubRepositories(options) {
                 : undefined;
             throw new Error(`GitHub repository discovery failed (${response.status})${remaining === "0" ? `; rate limit exhausted${resetAt ? ` until ${resetAt}` : ""}` : retryAfter ? `; retry after ${retryAfter} second(s)` : ""}`);
         }
-        const value = await response.json();
         if (!value || typeof value !== "object")
             throw new Error("GitHub repository discovery response is invalid");
         const items = value.items;

package/dist/src/core/discovery/private-discovery.js

@@ -1,3 +1,4 @@
+import { boundedJson } from "../runtime/bounded-json.js";
 /**
  * Opt-in private discovery using a caller-provided GitHub token. OAuth/App
  * brokering remains a deployment concern; this function proves the safe data
@@ -7,16 +8,19 @@ export async function discoverPrivateRepositories(options = {}) {
     const token = options.token ?? process.env.GITHUB_TOKEN;
     if (!token)
         throw new Error("Private discovery requires an explicit GITHUB_TOKEN or token option; public discovery needs no credentials");
-    const response = await (options.fetcher ?? fetch)("https://api.github.com/user/repos?visibility=private&affiliation=owner,collaborator,organization_member&per_page=100", {
+    const { response, value } = await boundedJson(options.fetcher ?? fetch, "https://api.github.com/user/repos?visibility=private&affiliation=owner,collaborator,organization_member&per_page=100", {
         headers: {
             accept: "application/vnd.github+json",
             authorization: `Bearer ${token}`,
             "user-agent": "loadout-discovery",
         },
+    }, {
+        timeoutMs: 30_000,
+        maxBytes: 8 * 1024 * 1024,
+        label: "Private GitHub discovery",
     });
     if (!response.ok)
         throw new Error(`Private GitHub discovery failed (${response.status})`);
-    const value = await response.json();
     if (!Array.isArray(value))
         throw new Error("Private GitHub discovery response is invalid");
     return value.flatMap((item) => {

package/dist/src/core/install/reconcile.js

@@ -230,7 +230,7 @@ export async function applyReconcilePlan(plan, options = {}) {
         : [];
     const selected = [...exact, ...outdated];
     if (!selected.length)
-        throw new Error("No exact or explicitly selected outdated skills to reconcile");
+        return { snapshotId: null, adopted: 0, updated: 0 };
     const risky = outdated.filter((item) => item.approvalRequired);
     if (risky.length && !options.approveRisk)
         throw new Error(`Replacing ${risky.length} outdated skill group(s) requires --approve-risk after reviewing the reported findings.`);

package/dist/src/core/install/source.js

@@ -6,9 +6,26 @@ import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { loadoutHome, ensureDirectory } from "../agents/paths.js";
 const execFileAsync = promisify(execFile);
+/**
+ * Bounds apply to every fetch, not only to callers who remember to ask. An
+ * unbounded clone of an untrusted repository can hang a Git process forever or
+ * fill the disk, so callers may raise a limit but none may omit one.
+ */
+export const REPOSITORY_FETCH_DEFAULTS = {
+    /** A reviewed skill repository clones well inside this. */
+    timeoutMs: 120_000,
+    maxBytes: 256 * 1024 * 1024,
+    maxFiles: 20_000,
+};
+function withFetchDefaults(options) {
+    return {
+        ...options,
+        timeoutMs: options.timeoutMs ?? REPOSITORY_FETCH_DEFAULTS.timeoutMs,
+        maxBytes: options.maxBytes ?? REPOSITORY_FETCH_DEFAULTS.maxBytes,
+        maxFiles: options.maxFiles ?? REPOSITORY_FETCH_DEFAULTS.maxFiles,
+    };
+}
 async function enforceRepositoryBounds(root, options) {
-    if (options.maxBytes === undefined && options.maxFiles === undefined)
-        return;
     let bytes = 0;
     let files = 0;
     const pending = [root];
@@ -35,8 +52,6 @@ async function enforceRepositoryBounds(root, options) {
     }
 }
 export function validateGitHubTreeBounds(value, options) {
-    if (options.maxBytes === undefined && options.maxFiles === undefined)
-        return;
     if (!value || typeof value !== "object" || Array.isArray(value))
         throw new Error("GitHub tree preflight returned an invalid response");
     const response = value;
@@ -63,8 +78,6 @@ export function validateGitHubTreeBounds(value, options) {
     }
 }
 async function enforceGitHubTreeBounds(repository, commit, options) {
-    if (options.maxBytes === undefined && options.maxFiles === undefined)
-        return;
     const signal = AbortSignal.timeout(options.timeoutMs ?? 120_000);
     const token = process.env.GITHUB_TOKEN?.trim();
     const response = await (options.fetcher ?? fetch)(`https://api.github.com/repos/${repository}/git/trees/${commit}?recursive=1`, {
@@ -181,7 +194,8 @@ function normalizeRef(ref) {
         throw new Error(`Invalid Git ref: ${ref}`);
     return ref;
 }
-export async function fetchRepositorySnapshot(input, options = {}) {
+export async function fetchRepositorySnapshot(input, requested = {}) {
+    const options = withFetchDefaults(requested);
     const repository = normalizeRepository(input);
     const gitEnvironment = await isolatedGitEnvironment(loadoutHome());
     const ref = options.ref ? normalizeRef(options.ref) : undefined;

package/dist/src/core/install/uninstall.js

@@ -1,12 +1,32 @@
 import { execFile } from "node:child_process";
 import { readdir, rm, rmdir } from "node:fs/promises";
-import { dirname, parse, resolve } from "node:path";
+import { dirname, parse, relative, resolve } from "node:path";
 import { promisify } from "node:util";
 import { loadoutHome } from "../agents/paths.js";
 import { applyRemove, planRemove } from "./remove.js";
 import { applyRuntimeToolPlan, listInstalledRuntimeTools, planRuntimeTool, } from "../agents/runtime-tools.js";
 import { applyNativeSchedulerBundle, planNativeScheduler, } from "../runtime/scheduler.js";
-import { readInstallState } from "../workspace/state.js";
+import { hashDirectory, readInstallState } from "../workspace/state.js";
+import { FIRST_PARTY_SKILLS, planFirstPartySkill, } from "../delegation/first-party-skills.js";
+async function directorySignature(root) {
+    return JSON.stringify((await hashDirectory(root))
+        .map((file) => ({ path: relative(root, file.path), sha256: file.sha256 }))
+        .sort((left, right) => left.path.localeCompare(right.path)));
+}
+async function firstPartyUninstallTargets() {
+    const targets = [];
+    for (const skill of FIRST_PARTY_SKILLS) {
+        const plan = await planFirstPartySkill(skill.id);
+        const sourceSignature = await directorySignature(plan.source);
+        for (const target of plan.targets.filter((item) => item.replacing))
+            targets.push({
+                id: skill.id,
+                path: target.destination,
+                modified: (await directorySignature(target.destination)) !== sourceSignature,
+            });
+    }
+    return targets;
+}
 export async function buildUninstallPlan(dependencies = {}) {
     const stateHome = loadoutHome();
     const state = await readInstallState();
@@ -18,19 +38,25 @@ export async function buildUninstallPlan(dependencies = {}) {
     ];
     const packages = await Promise.all(packageIds.map(planRemove));
     const runtimeTools = await (dependencies.runtimeTools ?? listInstalledRuntimeTools)(stateHome);
+    const firstPartySkills = await firstPartyUninstallTargets();
     const schedulers = dependencies.schedulerPlans?.() ??
         ["updates", "discovery"].map((job) => planNativeScheduler("unschedule", { job }));
     const warnings = packages.flatMap((entry) => entry.warnings);
     if (runtimeTools.length)
         warnings.push(`${runtimeTools.length} Loadout-managed runtime tool(s) will be restored to their pre-install snapshots.`);
+    const modifiedFirstPartySkills = firstPartySkills.filter((target) => target.modified);
+    if (modifiedFirstPartySkills.length)
+        warnings.push(`${modifiedFirstPartySkills.length} first-party skill install(s) differ from this Loadout release. Review them, or use --force to remove them.`);
     warnings.push("Loadout's cache, disabled library, history, and rollback snapshots will be deleted. This final state cleanup cannot itself be rolled back.");
     return {
         stateHome,
         packages,
         runtimeTools,
+        firstPartySkills,
         schedulers,
         disabledLibraryRecords: (state.activations ?? []).filter((entry) => entry.activationState === "disabled").length,
-        blocked: packages.some((entry) => entry.blocked),
+        blocked: packages.some((entry) => entry.blocked) ||
+            modifiedFirstPartySkills.length > 0,
         warnings,
     };
 }
@@ -96,6 +122,10 @@ export async function applyUninstall(plan, dependencies = {}, options = {}) {
         options.onProgress?.(`${packagePlan.preserveFiles ? "Forgetting adopted ownership" : "Removing managed package"} [${index + 1}/${fresh.packages.length}]: ${packagePlan.packageId}`);
         await applyRemove(packagePlan, { force: options.force });
     }
+    for (const target of fresh.firstPartySkills) {
+        options.onProgress?.(`Removing first-party skill: ${target.id}`);
+        await rm(target.path, { recursive: true, force: true });
+    }
     await removeEmptyManagedDirectories(fresh.packages);
     if (fresh.schedulers.length) {
         options.onProgress?.("Removing daily read-only schedules");
@@ -108,6 +138,7 @@ export async function applyUninstall(plan, dependencies = {}, options = {}) {
     return {
         removedPackages: fresh.packages.length,
         removedRuntimeTools: fresh.runtimeTools.length,
+        removedFirstPartySkills: fresh.firstPartySkills.length,
     };
 }
 const execFileAsync = promisify(execFile);
@@ -127,6 +158,7 @@ export function formatUninstallPlan(plan, options = {}) {
         "",
         `Managed packages: ${plan.packages.length}`,
         `Managed runtime tools: ${plan.runtimeTools.length ? plan.runtimeTools.join(", ") : "none"}`,
+        `First-party skills: ${plan.firstPartySkills.length}`,
         `Disabled library records: ${plan.disabledLibraryRecords}`,
         `Daily jobs to remove: ${plan.schedulers.map((item) => item.job).join(", ") || "none"}`,
         `State and cache: ${plan.stateHome}`,
@@ -135,6 +167,10 @@ export function formatUninstallPlan(plan, options = {}) {
                 "",
                 "BLOCKED: managed files were changed outside Loadout.",
                 ...modifiedPaths.slice(0, 10).map((path) => `  Modified: ${path}`),
+                ...plan.firstPartySkills
+                    .filter((target) => target.modified)
+                    .slice(0, 10)
+                    .map((target) => `  Modified: ${target.path}`),
                 ...(modifiedPaths.length > 10
                     ? [`  …and ${modifiedPaths.length - 10} more`]
                     : []),

package/dist/src/core/reporting/cli-guide.js

@@ -16,16 +16,15 @@ IN A PROJECT
 
 WHILE YOU WORK
 
-  loadout route <describe a task>   which model tier fits, and what it costs
-  loadout route --conserve <task>   cheaper tiers when you are low on quota
-  loadout handoff send codex "..."  give a task to your other agent
+  loadout handoff codex "..."       give a task to your other agent
+  loadout handoff                   what is waiting, both directions
 
 USE IT INSIDE YOUR AGENT
 
-  loadout skills install loadout-router --yes
+  loadout skills install loadout-handoff --yes
 
-  Then just ask your agent "which model should I use for this?" instead of
-  coming back here.
+  Then your agents check their own inboxes and can hand work to each other
+  without you relaying it.
 
 KEEPING CURRENT
 
@@ -45,6 +44,7 @@ export const ADVANCED_GUIDE = [
     "Discovery:    candidate, discover, review-queue, evaluate, skill-audit",
     "Sharing:      init, lock, export, import, share, card",
     "Integrations: mcp-recipe, mcp-config, credentials, models, handoff, skills, convert",
+    "Coordination: coordinate (coord), daemon, serve",
     "Lifecycle:    plan, adopt, uninstall, profiles, autopilot, tool, watch",
     "",
     "`loadout <command> --help` for options. Mutations preview first or require --yes.",
@@ -100,4 +100,8 @@ export const HIDDEN_FROM_FIRST_SCREEN = new Set([
     "alert-pin",
     "alert-unpin",
     "alert-pins",
+    // coordination
+    "coordinate",
+    "daemon",
+    "serve",
 ]);