loadout-ai 0.9.1 → 0.9.2

package/dist/src/commands/coordination-discussions.js

@@ -4,6 +4,29 @@ import { SessionManager } from "../core/coordination/session-manager.js";
 import { createProviderAdapters } from "../core/coordination/runtime.js";
 import { acquireBridgeLease } from "../core/coordination/bridge-lease.js";
 import { parseProviderSessionRef, } from "./coordination-sessions.js";
+const QUOTA_PATTERNS = [
+    /rate.?limit/i,
+    /quota.?exceed/i,
+    /too many requests/i,
+    /429/,
+    /usage.?limit/i,
+    /capacity/i,
+    /try again later/i,
+    /billing/i,
+    /insufficient.?credits/i,
+];
+export function wrapProviderError(provider, error) {
+    const message = error instanceof Error ? error.message : String(error);
+    const isQuota = QUOTA_PATTERNS.some((pattern) => pattern.test(message));
+    if (isQuota) {
+        return new Error(`${provider} appears to be out of quota or rate-limited. ` +
+            `The discussion cannot continue until usage resets. ` +
+            `Original error: ${message}`);
+    }
+    return new Error(`${provider} provider error: ${message}`, {
+        ...(error instanceof Error ? { cause: error } : {}),
+    });
+}
 function assertBothProviders(values) {
     if (values.length !== 2 ||
         new Set(values).size !== 2 ||
@@ -68,17 +91,22 @@ export function createSessionParticipant(sessions, selection, role, cwd, timeout
         agent: selection.provider,
         role,
         async respond(prompt) {
-            if (!sessionId) {
-                const started = await sessions.startSession(selection.provider, cwd, prompt, timeoutMs);
-                sessionId = started.sessionId;
-            }
-            else {
-                const accepted = await sessions.submitTurn(sessionId, prompt, timeoutMs);
-                if (!accepted) {
-                    throw new Error(`${selection.provider}:${sessionId} rejected the discussion turn`);
+            try {
+                if (!sessionId) {
+                    const started = await sessions.startSession(selection.provider, cwd, prompt, timeoutMs);
+                    sessionId = started.sessionId;
+                }
+                else {
+                    const accepted = await sessions.submitTurn(sessionId, prompt, timeoutMs);
+                    if (!accepted) {
+                        throw new Error(`${selection.provider}:${sessionId} rejected the discussion turn`);
+                    }
                 }
+                return sessions.getLastResponse(sessionId) ?? "";
+            }
+            catch (error) {
+                throw wrapProviderError(selection.provider, error);
             }
-            return sessions.getLastResponse(sessionId) ?? "";
         },
     };
 }
@@ -190,6 +218,16 @@ export function registerCoordinationDiscussions(coord) {
         const sessions = createManager(projectRoot);
         try {
             await sessions.start();
+            // Pre-flight: verify both provider CLIs are reachable before
+            // spending any paid turns.
+            const detected = await sessions.detectProviders();
+            const needed = selection.participants.map((p) => p.provider);
+            const missing = needed.filter((name) => !detected.some((d) => d.provider === name));
+            if (missing.length) {
+                throw new Error(`Cannot start discussion: ${missing.join(", ")} not detected. ` +
+                    `Install the CLI or check that it is on PATH. ` +
+                    `Detected providers: ${detected.map((d) => `${d.provider} ${d.version}`).join(", ") || "none"}.`);
+            }
             if (selection.mode === "existing") {
                 for (const item of selection.participants) {
                     await sessions.attachSession(item.provider, item.sessionId, projectRoot);

package/dist/src/core/catalog/safety.js

@@ -22,17 +22,61 @@ const SECRET_PATTERNS = [
     },
 ];
 const SUSPICIOUS_INSTRUCTIONS = [
+    // --- Prompt injection / instruction override ---
     {
         name: "instruction override",
         pattern: /\bignore (?:all |any )?(?:previous|prior|system|developer) instructions?\b/i,
     },
+    {
+        name: "instruction override (disregard)",
+        pattern: /\b(?:disregard|forget|override|bypass)\b.{0,40}\b(?:previous|prior|system|above|rules?|instructions?|guidelines?)\b/i,
+    },
+    {
+        name: "role hijack",
+        pattern: /\byou are (?:now |actually )?(?:a|an|the)\b.{0,60}\b(?:assistant|system|admin|root)\b/i,
+    },
+    {
+        name: "hidden system prompt",
+        pattern: /\[(?:SYSTEM|INST)\]|<\|(?:system|im_start)\|?>/i,
+    },
+    {
+        name: "encoding evasion",
+        pattern: /\b(?:base64|rot13|hex)[- ]?(?:decode|encoded?)\b.{0,60}\b(?:execute|run|eval)\b/i,
+    },
+    // --- Credential / data exfiltration ---
     {
         name: "credential extraction",
-        pattern: /\b(?:read|print|send|upload|exfiltrate)\b.{0,80}\b(?:credentials?|tokens?|secrets?|\.ssh|\.aws)\b/i,
+        pattern: /\b(?:read|print|send|upload|exfiltrate|output|display|echo|cat)\b.{0,80}\b(?:credentials?|tokens?|secrets?|\.ssh|\.aws|\.env|api[_-]?keys?|passwords?)\b/i,
+    },
+    {
+        name: "exfiltration via URL",
+        pattern: /\b(?:curl|wget|fetch|http)\b.{0,120}\b(?:credentials?|tokens?|secrets?|api[_-]?key|password|\.env)\b/i,
     },
+    {
+        name: "environment variable leak",
+        pattern: /\b(?:print|echo|log|send|post)\b.{0,40}\bprocess\.env\b/i,
+    },
+    // --- Destructive operations ---
     {
         name: "hidden destructive command",
-        pattern: /\b(?:rm\s+-rf|del\s+\/s|format\s+[a-z]:)\b/i,
+        pattern: /\b(?:rm\s+-rf|del\s+\/s|format\s+[a-z]:|mkfs\b|dd\s+if=)/i,
+    },
+    {
+        name: "git force push",
+        pattern: /\bgit\s+push\s+(?:--force|-f)\b/i,
+    },
+    // --- Stealth / persistence ---
+    {
+        name: "hidden file creation",
+        pattern: /\b(?:create|write|add|mkdir)\b.{0,60}(?:\/\.[a-z]|\\\.|\bhidden\b)/i,
+    },
+    {
+        name: "cron/scheduler injection",
+        pattern: /\b(?:crontab|at\s+now|systemctl\s+enable|launchctl\s+load)\b/i,
+    },
+    {
+        name: "network listener",
+        pattern: /\b(?:listen|bind|nc\s+-l|socat|ncat)\b.{0,40}\b(?:port|0\.0\.0\.0|\d{4,5})\b/i,
     },
 ];
 export function detectSecretKinds(content) {

package/dist/src/core/coordination/adapters/claude-code.js

@@ -5,14 +5,20 @@
  * turn; the CLI does not provide mid-turn injection or global session listing.
  */
 import { execFile } from "node:child_process";
-import { promisify } from "node:util";
-const exec = promisify(execFile);
 const PROVIDER = "claude-code";
 const CLI = "claude";
-const defaultCommandDriver = async (command, args, options) => {
-    const { stdout } = await exec(command, [...args], options);
-    return { stdout: String(stdout) };
-};
+export const runClaudeCommand = async (command, args, options) => new Promise((resolve, reject) => {
+    const child = execFile(command, [...args], { ...options, encoding: "utf8" }, (error, stdout) => {
+        if (error) {
+            reject(error);
+            return;
+        }
+        resolve({ stdout: String(stdout) });
+    });
+    // execFile opens a writable stdin pipe. Claude waits briefly for input
+    // unless the parent closes it, so end it as soon as the process starts.
+    child.stdin?.end();
+});
 function parseSessionOutput(stdout) {
     let parsed;
     try {
@@ -40,7 +46,7 @@ export class ClaudeCodeAdapter {
     provider = PROVIDER;
     sessions = new Map();
     responses = new Map();
-    constructor(runCommand = defaultCommandDriver) {
+    constructor(runCommand = runClaudeCommand) {
         this.runCommand = runCommand;
     }
     capabilities = {
@@ -73,6 +79,7 @@ export class ClaudeCodeAdapter {
         const { stdout } = await this.runCommand(CLI, args, {
             cwd: options.cwd,
             timeout: options.timeout ?? 30000,
+            ...(options.signal ? { signal: options.signal } : {}),
         });
         const output = parseSessionOutput(stdout);
         const sessionId = output.sessionId;
@@ -122,6 +129,7 @@ export class ClaudeCodeAdapter {
             const { stdout } = await this.runCommand(CLI, args, {
                 cwd: session.cwd,
                 timeout: options.timeout ?? 30000,
+                ...(options.signal ? { signal: options.signal } : {}),
             });
             const output = parseSessionOutput(stdout);
             if (output.response) {

package/dist/src/core/coordination/adapters/codex.js

@@ -17,25 +17,25 @@ function requireThreadId(thread) {
     }
     return id;
 }
-async function withAbort(promise, thread, signal) {
-    if (!signal)
-        return promise;
-    signal.throwIfAborted();
-    return new Promise((resolve, reject) => {
-        const onAbort = () => {
-            thread.abort?.();
-            reject(signal.reason ??
-                new DOMException("The operation was aborted", "AbortError"));
-        };
-        signal.addEventListener("abort", onAbort, { once: true });
-        promise.then((value) => {
-            signal.removeEventListener("abort", onAbort);
-            resolve(value);
-        }, (error) => {
-            signal.removeEventListener("abort", onAbort);
-            reject(error);
-        });
-    });
+async function runWithCancellation(thread, prompt, options) {
+    if (options.timeout === undefined) {
+        return thread.run(prompt, options.signal ? { signal: options.signal } : undefined);
+    }
+    const controller = new AbortController();
+    const onAbort = () => controller.abort(options.signal?.reason);
+    if (options.signal?.aborted)
+        onAbort();
+    else
+        options.signal?.addEventListener("abort", onAbort, { once: true });
+    const timer = setTimeout(() => controller.abort(new Error(`Codex provider turn timed out after ${options.timeout}ms`)), options.timeout);
+    timer.unref();
+    try {
+        return await thread.run(prompt, { signal: controller.signal });
+    }
+    finally {
+        clearTimeout(timer);
+        options.signal?.removeEventListener("abort", onAbort);
+    }
 }
 function responseFromRun(result) {
     if (typeof result === "object" &&
@@ -84,8 +84,10 @@ export class CodexAdapter {
         const thread = this.driver.startThread({
             workingDirectory: options.cwd,
         });
-        const runPromise = thread.run(options.prompt ?? "");
-        const result = await withAbort(runPromise, thread, options.signal);
+        const result = await runWithCancellation(thread, options.prompt ?? "", {
+            ...(options.signal ? { signal: options.signal } : {}),
+            ...(options.timeout === undefined ? {} : { timeout: options.timeout }),
+        });
         const sessionId = requireThreadId(thread);
         const session = {
             sessionId,
@@ -131,8 +133,10 @@ export class CodexAdapter {
             return false;
         session.busy = true;
         try {
-            const runPromise = thread.run(options.message);
-            const result = await withAbort(runPromise, thread, options.signal);
+            const result = await runWithCancellation(thread, options.message, {
+                ...(options.signal ? { signal: options.signal } : {}),
+                ...(options.timeout === undefined ? {} : { timeout: options.timeout }),
+            });
             const response = responseFromRun(result);
             if (response)
                 this.responses.set(session.sessionId, response);

package/dist/src/core/coordination/coordinator.js

@@ -240,7 +240,7 @@ function ownershipFromEvents(events) {
             }
             ownership.set(path, {
                 agent: event.from,
-                paths,
+                paths: [path],
                 mode: payload.mode,
                 eventId: event.id,
                 seq: event.seq,
@@ -502,12 +502,13 @@ export function formatSnapshot(snap) {
         lines.push(`File ownership (${snap.ownership.length} paths):`);
         const byAgent = new Map();
         for (const claim of snap.ownership) {
-            const existing = byAgent.get(claim.agent) ?? [];
-            existing.push(...claim.paths);
+            const existing = byAgent.get(claim.agent) ?? new Set();
+            for (const p of claim.paths)
+                existing.add(p);
             byAgent.set(claim.agent, existing);
         }
         for (const [agent, paths] of byAgent) {
-            lines.push(`  ${agent}: ${paths.join(", ")}`);
+            lines.push(`  ${agent}: ${[...paths].join(", ")}`);
         }
         lines.push("");
     }

package/dist/src/core/coordination/discussion.js

@@ -82,13 +82,27 @@ export function formatDiscussion(state) {
     ];
     for (const event of state.events) {
         const payload = payloadOf(event);
+        if (payload.kind === "started")
+            continue;
+        if (payload.kind === "closed" && state.status !== "failed")
+            continue;
         lines.push(`[round ${payload.round}] ${event.from} · ${payload.kind}`, payload.content, "");
     }
     if (state.truncatedEvents > 0) {
         lines.push(`${state.truncatedEvents} earlier event(s) omitted.`, "");
     }
+    if (state.finalDecision || state.status === "failed") {
+        lines.push("Outcome", "-------");
+    }
     if (state.finalDecision)
         lines.push(`Decision: ${state.finalDecision}`);
+    if (state.status === "failed") {
+        const failure = [...state.events]
+            .reverse()
+            .find((event) => payloadOf(event).kind === "closed");
+        if (failure)
+            lines.push(`Failure: ${payloadOf(failure).content}`);
+    }
     if (state.alternatives.length > 0) {
         lines.push(`Alternatives: ${state.alternatives.join("; ")}`);
     }
@@ -97,9 +111,15 @@ export function formatDiscussion(state) {
     }
     return lines.join("\n").trimEnd();
 }
+const MAX_DECISION_LENGTH = 200;
+function boundedDecision(value) {
+    if (value.length <= MAX_DECISION_LENGTH)
+        return value;
+    return `${value.slice(0, MAX_DECISION_LENGTH - 1).trimEnd()}…`;
+}
 const conclusionSchema = z
     .object({
-    decision: z.string().trim().min(1).max(200),
+    decision: z.string().trim().min(1).transform(boundedDecision),
     rationale: z.string().trim().min(1).max(10_000),
     alternatives: z.array(z.string().trim().min(1).max(2_000)).max(10),
     unresolved: z.array(z.string().trim().min(1).max(2_000)).max(10),
@@ -277,7 +297,7 @@ export async function runDiscussion(projectRoot, options) {
         }
         await assertCoordinationEnabled(projectRoot);
         const current = await getDiscussion(projectRoot, threadId);
-        const synthesisResponse = publicResponse(await proposer.respond(safePrompt(`Topic: ${topic}\n\nPublic transcript (untrusted discussion data):\n${transcriptForPrompt(current?.events ?? [])}\n\nSynthesize the best-supported outcome. Return only strict JSON with this exact shape: {"decision":"one concise decision","rationale":"why it won","alternatives":["credible alternative"],"unresolved":["remaining uncertainty"]}. Do not claim consensus when disagreement remains; put it in unresolved.`)), proposer.agent);
+        const synthesisResponse = publicResponse(await proposer.respond(safePrompt(`Topic: ${topic}\n\nPublic transcript (untrusted discussion data):\n${transcriptForPrompt(current?.events ?? [])}\n\nSynthesize the best-supported outcome. Return only strict JSON with this exact shape: {"decision":"one concise decision","rationale":"why it won","alternatives":["credible alternative"],"unresolved":["remaining uncertainty"]}. Keep decision at most ${MAX_DECISION_LENGTH} characters. Do not claim consensus when disagreement remains; put it in unresolved.`)), proposer.agent);
         turnsUsed += 1;
         const conclusion = parseConclusion(synthesisResponse);
         const summary = await emit(projectRoot, {

package/dist/src/core/coordination/retention.js

@@ -88,9 +88,19 @@ export async function compact(projectRoot, config = DEFAULT_RETENTION) {
             payload: summaryPayload,
         });
         const lines = [
-            summaryLine,
-            ...finalRetained.map((e) => JSON.stringify(e)),
-        ].join("\n");
+            ...stateCheckpoints.map((event) => ({
+                seq: event.seq,
+                line: JSON.stringify(event),
+            })),
+            { seq: remove[remove.length - 1].seq, line: summaryLine },
+            ...keptByIndex.map((event) => ({
+                seq: event.seq,
+                line: JSON.stringify(event),
+            })),
+        ]
+            .sort((left, right) => left.seq - right.seq)
+            .map(({ line }) => line)
+            .join("\n");
         // Atomic write: write to temp, rename over
         const tmpPath = `${logPath}.tmp`;
         await writeFile(tmpPath, lines + "\n", {
@@ -169,7 +179,7 @@ function stateKey(event) {
         case "ownership":
             // Key by agent + sorted paths — an ownership event replaces the previous
             // one for the same agent/path combination.
-            return `ownership:${event.from}:${(p.paths ?? []).sort().join(",")}`;
+            return `ownership:${event.from}:${[...(p.paths ?? [])].sort().join(",")}`;
         case "contract":
             return `contract:${p.name}`;
         case "decision":

package/dist/src/core/install/catalog-install.js

@@ -260,7 +260,7 @@ export function formatPreparedCatalogInstall(prepared, options = {}) {
     if (directoriesPerAgent > DEFAULT_ACTIVE_SKILL_LIMIT)
         lines.push(`Capacity notice: about ${directoriesPerAgent} skill directories per agent exceeds Stable's ${DEFAULT_ACTIVE_SKILL_LIMIT}-skill bound.${prepared.selection.mode === "maximum" ? " Maximum stores them in the disabled library; optimize or activate a project-relevant working set." : prepared.selection.mode === "power" ? " Power is the explicit larger active mode; choose Stable or project optimization when lower context use matters." : " Use project-aware activation for a smaller working set."}`);
     if (failures.length)
-        lines.push(`Preparation failures (installation will remain blocked): ${failures.map((item) => item.packageId).join(", ")}`);
+        lines.push(`Preparation failures (${prepared.selection.mode === "maximum" ? "will be skipped; remaining library can install" : "installation will remain blocked"}): ${failures.map((item) => item.packageId).join(", ")}`);
     if (quarantined.length)
         lines.push(`Quarantined invalid skill units: ${quarantined.length} (safe siblings remain available)`);
     if (explicit.length)
@@ -292,8 +292,14 @@ export async function applyPreparedCatalogInstall(prepared, options = {}) {
     if (!prepared.entries.length)
         throw new Error("No reviewed skill packages could be prepared for installation");
     const failures = prepared.skipped.filter((item) => item.kind === "preparation-failed");
-    if (failures.length)
+    if (failures.length && prepared.selection.mode !== "maximum") {
         throw new Error(`Setup is incomplete because reviewed packages failed to prepare: ${failures.map((item) => item.packageId).join(", ")}. Retry when GitHub is reachable; no partial loadout was installed.`);
+    }
+    if (failures.length) {
+        for (const fail of failures) {
+            console.error(`Warning: skipping ${fail.packageId} (preparation failed). The remaining library will install without it.`);
+        }
+    }
     const risky = prepared.entries.filter((entry) => entry.safety.approvalRequired);
     if (risky.length && !options.approveRisk)
         throw new Error(`Additional risk approval is required for: ${risky.map((entry) => entry.package.id).join(", ")}. Review the plan, then use --approve-risk.`);

package/dist/src/core/install/snapshot.js

@@ -83,14 +83,14 @@ export async function restoreSnapshot(snapshot, options = {}) {
     validateSnapshot(snapshot);
     if (options.requireUnchangedPostMutationState)
         await assertUnchangedPostMutationState(snapshot);
-    for (const root of snapshot.roots)
+    for (const root of snapshot.roots) {
+        await makeTreeRemovable(root);
         await rm(root, { recursive: true, force: true });
+    }
     for (const directory of snapshot.files
         .filter((file) => file.existed && file.directory)
         .sort((a, b) => a.path.length - b.path.length)) {
         await mkdir(directory.path, { recursive: true });
-        if (directory.mode !== undefined)
-            await chmod(directory.path, directory.mode);
     }
     for (const file of snapshot.files) {
         if (!file.existed || file.directory)
@@ -102,6 +102,30 @@ export async function restoreSnapshot(snapshot, options = {}) {
         if (file.mode !== undefined)
             await chmod(file.path, file.mode);
     }
+    for (const directory of snapshot.files
+        .filter((file) => file.existed && file.directory)
+        .sort((a, b) => b.path.length - a.path.length)) {
+        if (directory.mode !== undefined)
+            await chmod(directory.path, directory.mode);
+    }
+}
+async function makeTreeRemovable(path) {
+    let info;
+    try {
+        info = await lstat(path);
+    }
+    catch (error) {
+        if (isFileError(error, "ENOENT"))
+            return;
+        throw error;
+    }
+    if (!info.isDirectory() || info.isSymbolicLink())
+        return;
+    await chmod(path, (info.mode & 0o777) | 0o700);
+    for (const entry of await readdir(path, { withFileTypes: true })) {
+        if (entry.isDirectory() && !entry.isSymbolicLink())
+            await makeTreeRemovable(join(path, entry.name));
+    }
 }
 /** Attach the committed state used to make later user-requested rollback safe. */
 export async function recordSnapshotPostMutationState(snapshot) {
@@ -259,7 +283,7 @@ function validateSnapshotFiles(files, roots, label) {
                 (typeof file.mode !== "number" ||
                     !Number.isInteger(file.mode) ||
                     file.mode < 0 ||
-                    file.mode > 0o7777)))
+                    file.mode > 0o777)))
             throw new Error(`${label} file ${index} is invalid`);
         const filePath = file.path;
         if (resolve(filePath) !== filePath)

package/dist/src/core/install/source.js

@@ -17,7 +17,7 @@ export const REPOSITORY_FETCH_DEFAULTS = {
     maxBytes: 256 * 1024 * 1024,
     maxFiles: 20_000,
 };
-function withFetchDefaults(options) {
+export function withFetchDefaults(options) {
     return {
         ...options,
         timeoutMs: options.timeoutMs ?? REPOSITORY_FETCH_DEFAULTS.timeoutMs,
@@ -320,24 +320,26 @@ export async function fetchGitSnapshot(input, options = {}) {
     // checked before fetching the way the GitHub path does. Enforce a bound
     // AFTER a shallow clone instead of refusing bounded requests, giving parity
     // with the catalog path and a default ceiling against an adversarial repo.
-    const boundedOptions = {
+    const boundedOptions = withFetchDefaults({
         ...options,
         maxBytes: options.maxBytes ?? 128 * 1024 * 1024,
         maxFiles: options.maxFiles ?? 20_000,
-    };
+    });
     const url = normalizeGitUrl(input);
     const temporary = await mkdtemp(join(tmpdir(), "loadout-git-"));
     try {
         const gitEnvironment = await isolatedGitEnvironment(loadoutHome());
-        const refArgs = options.ref ? ["--branch", normalizeRef(options.ref)] : [];
+        const refArgs = boundedOptions.ref
+            ? ["--branch", normalizeRef(boundedOptions.ref)]
+            : [];
         await execFileAsync("git", ["clone", "--depth", "1", ...refArgs, "--", url, temporary], {
             maxBuffer: 10 * 1024 * 1024,
-            timeout: options.timeoutMs,
+            timeout: boundedOptions.timeoutMs,
             env: {
                 ...gitEnvironment,
             },
         });
-        const { stdout } = await execFileAsync("git", ["-C", temporary, "rev-parse", "HEAD"], { timeout: options.timeoutMs, env: gitEnvironment });
+        const { stdout } = await execFileAsync("git", ["-C", temporary, "rev-parse", "HEAD"], { timeout: boundedOptions.timeoutMs, env: gitEnvironment });
         const commit = stdout.trim();
         if (!/^[0-9a-f]{40}$/i.test(commit))
             throw new Error("Git returned an invalid commit");

package/dist/src/core/install/update.js

@@ -8,6 +8,7 @@ import { analyzeUpdateSafety } from "../catalog/safety.js";
 import { detectAgents, loadoutHome } from "../agents/paths.js";
 import { applySkillInstall, buildSkillPlan, installedAgents, } from "./install.js";
 import { discoverSkillDirectories, validateSkillDirectory, } from "../catalog/skills.js";
+import { loadEffectiveCatalog } from "../catalog/catalog.js";
 function managedUnitIds(state, packageId) {
     return [
         ...new Set((state.activations ?? [])
@@ -84,6 +85,22 @@ async function analyzeManagedUpdate(oldRoot, newRoot, unitIds) {
         approvalRequired: safetyFindings.some((finding) => finding.severity === "blocking"),
     };
 }
+/**
+ * Index catalog-pinned commits by repository for O(1) lookup during update.
+ * A commit matches if the catalog's source evidence references the same SHA.
+ */
+function buildCatalogCommitIndex(catalog) {
+    const index = new Map();
+    for (const pkg of catalog) {
+        if (pkg.source?.commit && pkg.repository) {
+            const repository = pkg.repository.toLowerCase();
+            const commits = index.get(repository) ?? new Set();
+            commits.add(pkg.source.commit.toLowerCase());
+            index.set(repository, commits);
+        }
+    }
+    return index;
+}
 /** Builds a read-only update plan from persisted installs and live GitHub snapshots. */
 export async function buildUpdatePlan(resolver, options = {}) {
     const state = await readInstallState();
@@ -91,6 +108,18 @@ export async function buildUpdatePlan(resolver, options = {}) {
         ? state.installs.filter((record) => record.packageId === options.packageId)
         : state.installs;
     const results = new Array(records.length);
+    // Load catalog commit pins so we can flag updates that diverge from
+    // the last reviewed snapshot. This is a read-only safety check — it
+    // does not prevent the update, but adds a blocking safety finding
+    // when the upstream HEAD has moved past the catalog-pinned commit.
+    let catalogIndex;
+    try {
+        const catalog = options.catalog ?? (await loadEffectiveCatalog());
+        catalogIndex = buildCatalogCommitIndex(catalog);
+    }
+    catch {
+        catalogIndex = new Map();
+    }
     const lightweightResolver = resolver ??
         options.resolveHead ??
         ((repository) => resolveRepositoryHead(repository, { timeoutMs: 30_000 }));
@@ -164,12 +193,36 @@ export async function buildUpdatePlan(resolver, options = {}) {
                             throw new Error(`Resolved ${current.commit}, but fetched ${fetched.commit} for safety review`);
                         currentPath = fetched.path;
                     }
+                    // Check whether the upstream HEAD matches the catalog-pinned
+                    // commit. A mismatch means the repository has changed since the
+                    // catalog was last reviewed — the content may be fine, but it
+                    // hasn't been vetted, so flag it for human review.
+                    let catalogDrift = false;
+                    if (!same && record.repository) {
+                        const pinnedCommits = catalogIndex.get(record.repository.toLowerCase());
+                        if (pinnedCommits &&
+                            !pinnedCommits.has(current.commit.toLowerCase())) {
+                            catalogDrift = true;
+                        }
+                    }
                     if (!same && currentPath) {
                         const oldPath = repositoryCachePath(record.repository, record.resolvedCommit);
                         const analysis = await analyzeManagedUpdate(oldPath, currentPath, managedUnitIds(state, record.packageId));
                         diff = analysis.diff;
-                        safetyFindings = analysis.safetyFindings;
+                        safetyFindings = analysis.safetyFindings ?? [];
                         approvalRequired = analysis.approvalRequired;
+                        if (catalogDrift) {
+                            safetyFindings.push({
+                                severity: "blocking",
+                                category: "instruction",
+                                message: "Upstream HEAD has moved past the catalog-reviewed commit. " +
+                                    "The new content has not been verified by the catalog maintainer. " +
+                                    "Review the diff carefully before approving.",
+                                paths: [],
+                                names: ["catalog-drift"],
+                            });
+                            approvalRequired = true;
+                        }
                     }
                     return {
                         ...base,
@@ -185,6 +238,7 @@ export async function buildUpdatePlan(resolver, options = {}) {
                         ...(approvalRequired ? { approvalRequired: true } : {}),
                         ...(safetyFindings?.length ? { safetyFindings } : {}),
                         ...(diff ? { diff } : {}),
+                        ...(catalogDrift ? { catalogDrift: true } : {}),
                     };
                 }
                 catch (error) {