loadout-ai 0.8.0 → 0.9.0

package/dist/src/core/discovery/candidate-intelligence-evidence.js

@@ -0,0 +1,108 @@
+import { join } from "node:path";
+export function installabilityFor(components) {
+    if (components.some((component) => ["skill", "rule", "command", "agent"].includes(component)))
+        return "portable-components";
+    if (components.some((component) => component === "mcp" || component === "plugin"))
+        return "explicit-runtime-setup";
+    return "unsupported-source-shape";
+}
+export function componentsFor(inspection) {
+    const result = [];
+    if (inspection.counts.skills)
+        result.push("skill");
+    if (inspection.counts.rules)
+        result.push("rule");
+    if (inspection.counts.commands)
+        result.push("command");
+    if (inspection.counts.agents)
+        result.push("agent");
+    if (inspection.plugins.some((plugin) => !plugin.warnings.some((warning) => warning.startsWith("invalid plugin manifest"))))
+        result.push("plugin");
+    if (inspection.mcpServers.length)
+        result.push("mcp");
+    return result;
+}
+export function evidencePathsFor(inspection) {
+    return [
+        ...inspection.skills.map((item) => join(item.path, "SKILL.md")),
+        ...inspection.resources.map((item) => item.path),
+        ...inspection.plugins
+            .filter((item) => !item.warnings.some((warning) => warning.startsWith("invalid plugin manifest")))
+            .map((item) => item.path),
+        ...inspection.mcpServers.map((item) => item.path),
+    ]
+        .map((path) => path.split(/[\\/]/).join("/"))
+        .filter((path) => path !== "." && !path.startsWith("../"))
+        .filter((path, index, paths) => paths.indexOf(path) === index)
+        .sort();
+}
+const STOP_WORDS = new Set([
+    "the",
+    "and",
+    "for",
+    "with",
+    "from",
+    "that",
+    "this",
+    "your",
+    "into",
+    "agent",
+    "agents",
+    "skill",
+    "skills",
+    "mcp",
+    "server",
+    "servers",
+    "workflow",
+    "workflows",
+    "code",
+    "coding",
+    "developer",
+    "development",
+    "platform",
+    "context",
+    "open",
+    "source",
+    "using",
+    "across",
+    "tool",
+    "tools",
+    "github",
+]);
+function tokens(...values) {
+    return new Set(values
+        .join(" ")
+        .toLowerCase()
+        .split(/[^a-z0-9]+/)
+        .filter((word) => word.length >= 3 && !STOP_WORDS.has(word)));
+}
+export function overlapFor(discovery, inspection, catalog) {
+    const candidateTokens = tokens(discovery.repository, discovery.description, discovery.topics.join(" "), ...inspection.skills.flatMap((item) => [item.name, item.description]), ...inspection.resources.map((item) => item.name), ...inspection.plugins.flatMap((item) => [item.name, item.description]), ...inspection.mcpServers.map((item) => item.name));
+    const candidateComponents = new Set(componentsFor(inspection));
+    return catalog
+        .map((pkg) => {
+        const packageTokens = tokens(pkg.id, pkg.displayName, pkg.description, pkg.category, pkg.topics?.join(" "));
+        const common = [...candidateTokens]
+            .filter((word) => packageTokens.has(word))
+            .sort();
+        // Containment is more useful than union similarity here: a large skill
+        // collection can overlap a focused package even when most collection
+        // tokens describe unrelated capabilities.
+        const smallerVocabulary = Math.min(candidateTokens.size, packageTokens.size);
+        const score = smallerVocabulary ? common.length / smallerVocabulary : 0;
+        const componentMatch = pkg.components?.some((component) => candidateComponents.has(component)) ?? false;
+        return {
+            packageId: pkg.id,
+            repository: pkg.repository,
+            score: Math.round(score * 1000) / 1000,
+            relationship: componentMatch && common.length >= 2 && score >= 0.2
+                ? "possible-overlap"
+                : "same-tooling-area",
+            evidence: common.slice(0, 8).map((word) => `shared term: ${word}`),
+        };
+    })
+        .filter((item) => item.evidence.length >= 1 && item.score >= 0.1)
+        .sort((left, right) => right.score - left.score ||
+        left.packageId.localeCompare(right.packageId))
+        .slice(0, 5);
+}

package/dist/src/core/discovery/candidate-intelligence-types.js

@@ -0,0 +1 @@
+export {};

package/dist/src/core/discovery/candidate-intelligence-validation.js

@@ -0,0 +1,108 @@
+import { componentsFor, evidencePathsFor, installabilityFor, } from "./candidate-intelligence-evidence.js";
+export function isTextArray(value) {
+    return (Array.isArray(value) && value.every((item) => typeof item === "string"));
+}
+export function finiteNonnegative(value) {
+    return typeof value === "number" && Number.isFinite(value) && value >= 0;
+}
+export function validDate(value) {
+    return typeof value === "string" && !Number.isNaN(Date.parse(value));
+}
+export function validPersistedEvaluation(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const evaluation = value;
+    const categories = evaluation.categories;
+    return (evaluation.evaluatorVersion === 1 &&
+        typeof evaluation.uncertainty === "string" &&
+        Array.isArray(categories) &&
+        categories.length === 2 &&
+        new Set(categories.map((item) => item.category)).size === 2 &&
+        categories.every((item) => (item.category === "skills" || item.category === "mcp") &&
+            ["ready", "needs-review", "blocked", "not-applicable"].includes(item.status) &&
+            isTextArray(item.findings)));
+}
+function safeEvidencePath(value) {
+    return (typeof value === "string" &&
+        Boolean(value) &&
+        !value.startsWith("/") &&
+        !value.split(/[\\/]/).includes(".."));
+}
+export function validPersistedInspection(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const inspection = value;
+    const validCount = (count) => typeof count === "number" && Number.isSafeInteger(count) && count >= 0;
+    const validNamedPath = (item, type) => Boolean(item &&
+        typeof item === "object" &&
+        !Array.isArray(item) &&
+        item.type === type &&
+        typeof item.name === "string" &&
+        safeEvidencePath(item.path));
+    if (!Array.isArray(inspection.skills) ||
+        !inspection.skills.every((item) => validNamedPath(item, "skill") &&
+            (item.description === undefined ||
+                typeof item.description === "string")) ||
+        !Array.isArray(inspection.resources) ||
+        !inspection.resources.every((item) => ["rule", "command", "agent"].includes(item.type) &&
+            validNamedPath(item, item.type)) ||
+        !Array.isArray(inspection.plugins) ||
+        !inspection.plugins.every((item) => validNamedPath(item, "plugin") &&
+            (item.description === undefined ||
+                typeof item.description === "string") &&
+            (item.version === undefined || typeof item.version === "string") &&
+            (item.author === undefined || typeof item.author === "string") &&
+            Array.isArray(item.components) &&
+            item.components.every((component) => [
+                "skill",
+                "rule",
+                "command",
+                "agent",
+                "mcp",
+                "plugin",
+                "root",
+            ].includes(component)) &&
+            isTextArray(item.hookEvents) &&
+            isTextArray(item.mcpServers) &&
+            isTextArray(item.warnings)) ||
+        !Array.isArray(inspection.mcpServers) ||
+        !inspection.mcpServers.every((item) => validNamedPath(item, "mcp") &&
+            ["command", "url", "unknown"].includes(item.transport) &&
+            (item.command === undefined || typeof item.command === "string") &&
+            (item.url === undefined || typeof item.url === "string") &&
+            validCount(item.argumentCount) &&
+            validCount(item.environmentVariableCount) &&
+            isTextArray(item.warnings)) ||
+        !inspection.counts ||
+        !validCount(inspection.counts.skills) ||
+        !validCount(inspection.counts.rules) ||
+        !validCount(inspection.counts.commands) ||
+        !validCount(inspection.counts.agents) ||
+        !validCount(inspection.counts.plugins) ||
+        !validCount(inspection.counts.mcpServers) ||
+        !validCount(inspection.counts.manifests) ||
+        !isTextArray(inspection.warnings))
+        return false;
+    return (inspection.counts.skills === inspection.skills.length &&
+        inspection.counts.rules ===
+            inspection.resources.filter((item) => item.type === "rule").length &&
+        inspection.counts.commands ===
+            inspection.resources.filter((item) => item.type === "command").length &&
+        inspection.counts.agents ===
+            inspection.resources.filter((item) => item.type === "agent").length &&
+        inspection.counts.plugins === inspection.plugins.length &&
+        inspection.counts.mcpServers === inspection.mcpServers.length);
+}
+export function assertDossierEvidence(dossier) {
+    if (!validPersistedInspection(dossier.inspection))
+        throw new Error("Candidate dossier inspection evidence is invalid");
+    const inspection = { root: ".", ...dossier.inspection };
+    const components = componentsFor(inspection);
+    const evidencePaths = evidencePathsFor(inspection);
+    if (JSON.stringify(dossier.components) !== JSON.stringify(components))
+        throw new Error("Candidate dossier components do not match inspection evidence");
+    if (dossier.installability !== installabilityFor(components))
+        throw new Error("Candidate dossier installability does not match inspection evidence");
+    if (JSON.stringify(dossier.evidencePaths) !== JSON.stringify(evidencePaths))
+        throw new Error("Candidate dossier evidencePaths do not match inspection evidence");
+}

package/dist/src/core/discovery/candidate-intelligence.js

@@ -11,15 +11,10 @@ import { inspectPackage } from "../install/package.js";
 import { ensureDirectory, loadoutHome } from "../agents/paths.js";
 import { fetchRepositorySnapshot, normalizeRepository, } from "../install/source.js";
 import { safeTerminalText } from "../reporting/terminal.js";
+import { componentsFor, evidencePathsFor, installabilityFor, overlapFor, } from "./candidate-intelligence-evidence.js";
+import { assertDossierEvidence, finiteNonnegative, isTextArray, validDate, validPersistedEvaluation, validPersistedInspection, } from "./candidate-intelligence-validation.js";
 const dossierDirectory = () => join(loadoutHome(), "candidates");
 const sourceVerifiedDossiers = new WeakMap();
-function installabilityFor(components) {
-    if (components.some((component) => ["skill", "rule", "command", "agent"].includes(component)))
-        return "portable-components";
-    if (components.some((component) => component === "mcp" || component === "plugin"))
-        return "explicit-runtime-setup";
-    return "unsupported-source-shape";
-}
 function dossierIntegrity(dossier) {
     return createHash("sha256").update(JSON.stringify(dossier)).digest("hex");
 }
@@ -28,19 +23,11 @@ function bundledDiscoveryPath() {
     const candidates = [
         join(moduleDirectory, "..", "..", "catalog", "discovered.json"),
         join(moduleDirectory, "..", "..", "..", "catalog", "discovered.json"),
+        join(moduleDirectory, "..", "..", "..", "..", "catalog", "discovered.json"),
         join(process.cwd(), "catalog", "discovered.json"),
     ];
     return candidates.find((candidate) => existsSync(candidate)) ?? candidates[0];
 }
-function isTextArray(value) {
-    return (Array.isArray(value) && value.every((item) => typeof item === "string"));
-}
-function finiteNonnegative(value) {
-    return typeof value === "number" && Number.isFinite(value) && value >= 0;
-}
-function validDate(value) {
-    return typeof value === "string" && !Number.isNaN(Date.parse(value));
-}
 function parseDiscovery(value) {
     if (!value || typeof value !== "object" || Array.isArray(value))
         throw new Error("Discovery artifact must be an object");
@@ -163,106 +150,6 @@ export async function listDiscoveryCandidates(options = {}) {
         left.repository.localeCompare(right.repository))
         .slice(0, options.limit ?? 20);
 }
-function componentsFor(inspection) {
-    const result = [];
-    if (inspection.counts.skills)
-        result.push("skill");
-    if (inspection.counts.rules)
-        result.push("rule");
-    if (inspection.counts.commands)
-        result.push("command");
-    if (inspection.counts.agents)
-        result.push("agent");
-    if (inspection.plugins.some((plugin) => !plugin.warnings.some((warning) => warning.startsWith("invalid plugin manifest"))))
-        result.push("plugin");
-    if (inspection.mcpServers.length)
-        result.push("mcp");
-    return result;
-}
-function evidencePathsFor(inspection) {
-    return [
-        ...inspection.skills.map((item) => join(item.path, "SKILL.md")),
-        ...inspection.resources.map((item) => item.path),
-        ...inspection.plugins
-            .filter((item) => !item.warnings.some((warning) => warning.startsWith("invalid plugin manifest")))
-            .map((item) => item.path),
-        ...inspection.mcpServers.map((item) => item.path),
-    ]
-        .map((path) => path.split(/[\\/]/).join("/"))
-        .filter((path) => path !== "." && !path.startsWith("../"))
-        .filter((path, index, paths) => paths.indexOf(path) === index)
-        .sort();
-}
-const STOP_WORDS = new Set([
-    "the",
-    "and",
-    "for",
-    "with",
-    "from",
-    "that",
-    "this",
-    "your",
-    "into",
-    "agent",
-    "agents",
-    "skill",
-    "skills",
-    "mcp",
-    "server",
-    "servers",
-    "workflow",
-    "workflows",
-    "code",
-    "coding",
-    "developer",
-    "development",
-    "platform",
-    "context",
-    "open",
-    "source",
-    "using",
-    "across",
-    "tool",
-    "tools",
-    "github",
-]);
-function tokens(...values) {
-    return new Set(values
-        .join(" ")
-        .toLowerCase()
-        .split(/[^a-z0-9]+/)
-        .filter((word) => word.length >= 3 && !STOP_WORDS.has(word)));
-}
-function overlapFor(discovery, inspection, catalog) {
-    const candidateTokens = tokens(discovery.repository, discovery.description, discovery.topics.join(" "), ...inspection.skills.flatMap((item) => [item.name, item.description]), ...inspection.resources.map((item) => item.name), ...inspection.plugins.flatMap((item) => [item.name, item.description]), ...inspection.mcpServers.map((item) => item.name));
-    const candidateComponents = new Set(componentsFor(inspection));
-    return catalog
-        .map((pkg) => {
-        const packageTokens = tokens(pkg.id, pkg.displayName, pkg.description, pkg.category, pkg.topics?.join(" "));
-        const common = [...candidateTokens]
-            .filter((word) => packageTokens.has(word))
-            .sort();
-        // Containment is more useful than union similarity here: a large skill
-        // collection can overlap a focused package even when most collection
-        // tokens describe unrelated capabilities.
-        const smallerVocabulary = Math.min(candidateTokens.size, packageTokens.size);
-        const score = smallerVocabulary ? common.length / smallerVocabulary : 0;
-        const componentMatch = pkg.components?.some((component) => candidateComponents.has(component)) ?? false;
-        return {
-            packageId: pkg.id,
-            repository: pkg.repository,
-            score: Math.round(score * 1000) / 1000,
-            relationship: componentMatch && common.length >= 2 && score >= 0.2
-                ? "possible-overlap"
-                : "same-tooling-area",
-            evidence: common.slice(0, 8).map((word) => `shared term: ${word}`),
-        };
-    })
-        .filter((item) => item.evidence.length >= 1 && item.score >= 0.1)
-        .sort((left, right) => right.score - left.score ||
-        left.packageId.localeCompare(right.packageId))
-        .slice(0, 5);
-}
 export async function buildCandidateDossier(repository, options = {}) {
     const normalized = normalizeRepository(repository);
     const artifact = await readDiscoveryArtifact(options.discoveryPath);
@@ -370,104 +257,6 @@ export async function writeCandidateDossier(dossier, output) {
     await writeFileAtomically(target, `${JSON.stringify(dossier, null, 2)}\n`);
     return target;
 }
-function validPersistedEvaluation(value) {
-    if (!value || typeof value !== "object" || Array.isArray(value))
-        return false;
-    const evaluation = value;
-    const categories = evaluation.categories;
-    return (evaluation.evaluatorVersion === 1 &&
-        typeof evaluation.uncertainty === "string" &&
-        Array.isArray(categories) &&
-        categories.length === 2 &&
-        new Set(categories.map((item) => item.category)).size === 2 &&
-        categories.every((item) => (item.category === "skills" || item.category === "mcp") &&
-            ["ready", "needs-review", "blocked", "not-applicable"].includes(item.status) &&
-            isTextArray(item.findings)));
-}
-function safeEvidencePath(value) {
-    return (typeof value === "string" &&
-        Boolean(value) &&
-        !value.startsWith("/") &&
-        !value.split(/[\\/]/).includes(".."));
-}
-function validPersistedInspection(value) {
-    if (!value || typeof value !== "object" || Array.isArray(value))
-        return false;
-    const inspection = value;
-    const validCount = (count) => typeof count === "number" && Number.isSafeInteger(count) && count >= 0;
-    const validNamedPath = (item, type) => Boolean(item &&
-        typeof item === "object" &&
-        !Array.isArray(item) &&
-        item.type === type &&
-        typeof item.name === "string" &&
-        safeEvidencePath(item.path));
-    if (!Array.isArray(inspection.skills) ||
-        !inspection.skills.every((item) => validNamedPath(item, "skill") &&
-            (item.description === undefined ||
-                typeof item.description === "string")) ||
-        !Array.isArray(inspection.resources) ||
-        !inspection.resources.every((item) => ["rule", "command", "agent"].includes(item.type) &&
-            validNamedPath(item, item.type)) ||
-        !Array.isArray(inspection.plugins) ||
-        !inspection.plugins.every((item) => validNamedPath(item, "plugin") &&
-            (item.description === undefined ||
-                typeof item.description === "string") &&
-            (item.version === undefined || typeof item.version === "string") &&
-            (item.author === undefined || typeof item.author === "string") &&
-            Array.isArray(item.components) &&
-            item.components.every((component) => [
-                "skill",
-                "rule",
-                "command",
-                "agent",
-                "mcp",
-                "plugin",
-                "root",
-            ].includes(component)) &&
-            isTextArray(item.hookEvents) &&
-            isTextArray(item.mcpServers) &&
-            isTextArray(item.warnings)) ||
-        !Array.isArray(inspection.mcpServers) ||
-        !inspection.mcpServers.every((item) => validNamedPath(item, "mcp") &&
-            ["command", "url", "unknown"].includes(item.transport) &&
-            (item.command === undefined || typeof item.command === "string") &&
-            (item.url === undefined || typeof item.url === "string") &&
-            validCount(item.argumentCount) &&
-            validCount(item.environmentVariableCount) &&
-            isTextArray(item.warnings)) ||
-        !inspection.counts ||
-        !validCount(inspection.counts.skills) ||
-        !validCount(inspection.counts.rules) ||
-        !validCount(inspection.counts.commands) ||
-        !validCount(inspection.counts.agents) ||
-        !validCount(inspection.counts.plugins) ||
-        !validCount(inspection.counts.mcpServers) ||
-        !validCount(inspection.counts.manifests) ||
-        !isTextArray(inspection.warnings))
-        return false;
-    return (inspection.counts.skills === inspection.skills.length &&
-        inspection.counts.rules ===
-            inspection.resources.filter((item) => item.type === "rule").length &&
-        inspection.counts.commands ===
-            inspection.resources.filter((item) => item.type === "command").length &&
-        inspection.counts.agents ===
-            inspection.resources.filter((item) => item.type === "agent").length &&
-        inspection.counts.plugins === inspection.plugins.length &&
-        inspection.counts.mcpServers === inspection.mcpServers.length);
-}
-function assertDossierEvidence(dossier) {
-    if (!validPersistedInspection(dossier.inspection))
-        throw new Error("Candidate dossier inspection evidence is invalid");
-    const inspection = { root: ".", ...dossier.inspection };
-    const components = componentsFor(inspection);
-    const evidencePaths = evidencePathsFor(inspection);
-    if (JSON.stringify(dossier.components) !== JSON.stringify(components))
-        throw new Error("Candidate dossier components do not match inspection evidence");
-    if (dossier.installability !== installabilityFor(components))
-        throw new Error("Candidate dossier installability does not match inspection evidence");
-    if (JSON.stringify(dossier.evidencePaths) !== JSON.stringify(evidencePaths))
-        throw new Error("Candidate dossier evidencePaths do not match inspection evidence");
-}
 export async function readCandidateDossier(path) {
     const target = resolve(path);
     const info = await stat(target);

package/dist/src/core/discovery/community.js

@@ -1,3 +1,4 @@
+import { boundedJson } from "../runtime/bounded-json.js";
 const API_BASE = "https://hacker-news.firebaseio.com/v0";
 const GITHUB_REPOSITORY = /(?:https?:\/\/)?(?:www\.)?github\.com\/([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)/gi;
 function repositoryFromText(value) {
@@ -50,20 +51,27 @@ export async function discoverHackerNewsRepositories(options = {}) {
     const keywords = (options.keywords ?? [])
         .map((keyword) => keyword.trim().toLowerCase())
         .filter(Boolean);
-    const idsResponse = await fetcher(`${API_BASE}/topstories.json`);
+    const { response: idsResponse, value: ids } = await boundedJson(fetcher, `${API_BASE}/topstories.json`, {}, {
+        timeoutMs: 30_000,
+        maxBytes: 4 * 1024 * 1024,
+        label: "Hacker News",
+    });
     if (!idsResponse.ok)
         throw new Error(`Hacker News top stories request failed (${idsResponse.status})`);
-    const ids = (await idsResponse.json());
     if (!Array.isArray(ids))
         throw new Error("Hacker News top stories response is invalid");
     const selectedIds = ids
         .filter((id) => typeof id === "number" && Number.isInteger(id))
         .slice(0, limit);
     const stories = await Promise.all(selectedIds.map(async (id) => {
-        const response = await fetcher(`${API_BASE}/item/${id}.json`);
+        const { response, value } = await boundedJson(fetcher, `${API_BASE}/item/${id}.json`, {}, {
+            timeoutMs: 30_000,
+            maxBytes: 1024 * 1024,
+            label: "Hacker News",
+        });
         if (!response.ok)
             return undefined;
-        return (await response.json());
+        return value;
     }));
     const deduplicated = new Map();
     for (const story of stories) {

package/dist/src/core/discovery/github-discovery.js

@@ -1,3 +1,4 @@
+import { boundedJson } from "../runtime/bounded-json.js";
 /** A rolling window prevents the default discovery query from aging in place. */
 export function defaultGitHubDiscoveryQuery(now = new Date()) {
     return defaultGitHubDiscoveryQueries(now)[0];
@@ -41,7 +42,11 @@ export async function discoverGitHubRepositories(options) {
             order: "desc",
             per_page: String(limit),
         });
-        const response = await (options.fetcher ?? fetch)(`https://api.github.com/search/repositories?${params}`, { headers });
+        const { response, value } = await boundedJson(options.fetcher ?? fetch, `https://api.github.com/search/repositories?${params}`, { headers }, {
+            timeoutMs: 30_000,
+            maxBytes: 8 * 1024 * 1024,
+            label: "GitHub repository discovery",
+        });
         if (!response.ok) {
             const remaining = response.headers.get("x-ratelimit-remaining");
             const reset = response.headers.get("x-ratelimit-reset");
@@ -51,7 +56,6 @@ export async function discoverGitHubRepositories(options) {
                 : undefined;
             throw new Error(`GitHub repository discovery failed (${response.status})${remaining === "0" ? `; rate limit exhausted${resetAt ? ` until ${resetAt}` : ""}` : retryAfter ? `; retry after ${retryAfter} second(s)` : ""}`);
         }
-        const value = await response.json();
         if (!value || typeof value !== "object")
             throw new Error("GitHub repository discovery response is invalid");
         const items = value.items;

package/dist/src/core/discovery/private-discovery.js

@@ -1,3 +1,4 @@
+import { boundedJson } from "../runtime/bounded-json.js";
 /**
  * Opt-in private discovery using a caller-provided GitHub token. OAuth/App
  * brokering remains a deployment concern; this function proves the safe data
@@ -7,16 +8,19 @@ export async function discoverPrivateRepositories(options = {}) {
     const token = options.token ?? process.env.GITHUB_TOKEN;
     if (!token)
         throw new Error("Private discovery requires an explicit GITHUB_TOKEN or token option; public discovery needs no credentials");
-    const response = await (options.fetcher ?? fetch)("https://api.github.com/user/repos?visibility=private&affiliation=owner,collaborator,organization_member&per_page=100", {
+    const { response, value } = await boundedJson(options.fetcher ?? fetch, "https://api.github.com/user/repos?visibility=private&affiliation=owner,collaborator,organization_member&per_page=100", {
         headers: {
             accept: "application/vnd.github+json",
             authorization: `Bearer ${token}`,
             "user-agent": "loadout-discovery",
         },
+    }, {
+        timeoutMs: 30_000,
+        maxBytes: 8 * 1024 * 1024,
+        label: "Private GitHub discovery",
     });
     if (!response.ok)
         throw new Error(`Private GitHub discovery failed (${response.status})`);
-    const value = await response.json();
     if (!Array.isArray(value))
         throw new Error("Private GitHub discovery response is invalid");
     return value.flatMap((item) => {

package/dist/src/core/install/reconcile.js

@@ -230,7 +230,7 @@ export async function applyReconcilePlan(plan, options = {}) {
         : [];
     const selected = [...exact, ...outdated];
     if (!selected.length)
-        throw new Error("No exact or explicitly selected outdated skills to reconcile");
+        return { snapshotId: null, adopted: 0, updated: 0 };
     const risky = outdated.filter((item) => item.approvalRequired);
     if (risky.length && !options.approveRisk)
         throw new Error(`Replacing ${risky.length} outdated skill group(s) requires --approve-risk after reviewing the reported findings.`);