loadout-ai 0.9.3 → 0.9.5

package/dist/src/core/catalog/skills.js

@@ -1,5 +1,6 @@
-import { cp, lstat, readdir, readFile, rm } from "node:fs/promises";
-import { dirname, join, relative, resolve, sep } from "node:path";
+import { cp, lstat, mkdtemp, readdir, readFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { basename, dirname, join, relative, resolve, sep } from "node:path";
 import { ensureDirectory } from "../agents/paths.js";
 import { assertSkillSecurity, scanSkillSecurity } from "./skill-security.js";
 export async function discoverSkillDirectories(root, options = {}) {
@@ -82,6 +83,60 @@ export async function discoverSkillDirectories(root, options = {}) {
     await visit(root, 0);
     return result;
 }
+// A link such as `references/security-checklist.md`, not a deeper path like
+// `docs/references/x.md`, which the lookbehind leaves to its own directory.
+const SHARED_REFERENCE = /(?<![\w./-])references\/([A-Za-z0-9][\w.-]*\.md)\b/g;
+async function isRegularFile(path) {
+    try {
+        const info = await lstat(path);
+        return info.isFile() && !info.isSymbolicLink();
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Some repositories keep shared checklists in a root `references/` folder that
+ * their skills link to relatively. A skill copied on its own would point at
+ * nothing, so plan from a staged copy that carries those files beside it.
+ */
+async function withSharedReferences(skill, packageRoot) {
+    if (skill === packageRoot)
+        return skill;
+    const text = await readFile(join(skill, "SKILL.md"), "utf8");
+    const names = new Set([...text.matchAll(SHARED_REFERENCE)].map((m) => m[1]));
+    const sharedRoot = join(packageRoot, "references");
+    // lstat checks only the last path segment, so a symlinked folder would let a
+    // package copy files from anywhere on disk into the skill.
+    const rootInfo = await lstat(sharedRoot).catch(() => undefined);
+    if (!rootInfo?.isDirectory() || rootInfo.isSymbolicLink())
+        return skill;
+    const shared = [];
+    for (const name of names) {
+        if (!name || (await isRegularFile(join(skill, "references", name))))
+            continue;
+        const candidate = join(sharedRoot, name);
+        if (await isRegularFile(candidate))
+            shared.push(candidate);
+    }
+    if (!shared.length)
+        return skill;
+    // ponytail: staged copies stay in the OS temp dir until it is cleaned; track and remove them if installs become frequent
+    const staged = join(await mkdtemp(join(tmpdir(), "loadout-skill-")), basename(skill));
+    await cp(skill, staged, {
+        recursive: true,
+        errorOnExist: true,
+        force: false,
+    });
+    await ensureDirectory(join(staged, "references"));
+    for (const file of shared)
+        await cp(file, join(staged, "references", basename(file)), {
+            errorOnExist: true,
+            force: false,
+        });
+    await validateSkillDirectory(staged);
+    return staged;
+}
 function safeTarget(root, target) {
     const resolvedRoot = resolve(root);
     const resolvedTarget = resolve(target);
@@ -95,6 +150,9 @@ export async function planSkillInstall(sourceRoot, targetDirectories, packageId,
     const skills = await discoverSkillDirectories(sourceRoot, options);
     if (skills.length === 0)
         throw new Error(`No SKILL.md found under ${sourceRoot}`);
+    const sources = new Map();
+    for (const skill of skills)
+        sources.set(skill, await withSharedReferences(skill, sourceRoot));
     const files = [];
     for (const targetRoot of targetDirectories) {
         try {
@@ -116,7 +174,7 @@ export async function planSkillInstall(sourceRoot, targetDirectories, packageId,
             const target = safeTarget(targetRoot, join(targetRoot, name));
             const frontmatter = await readFile(join(skill, "SKILL.md"), "utf8");
             const skillName = frontmatter.match(/^name:\s*(\S+)/m)?.[1];
-            files.push({ source: skill, target, skillName });
+            files.push({ source: sources.get(skill) ?? skill, target, skillName });
         }
     }
     const conflicts = detectInstallConflicts([

package/dist/src/core/coordination/lock.js

@@ -4,6 +4,7 @@ import { join } from "node:path";
 const LOCK_FILE = "coordination.lock";
 const DEFAULT_TIMEOUT_MS = 10_000;
 const MALFORMED_LOCK_STALE_MS = 30_000;
+const localLockTails = new Map();
 export class CoordinationLockTimeoutError extends Error {
     constructor(timeoutMs) {
         super(`Timed out waiting ${timeoutMs}ms for the coordination lock`);
@@ -64,9 +65,25 @@ async function releaseOwnedLock(path, token) {
 function wait(delayMs) {
     return new Promise((resolve) => setTimeout(resolve, delayMs));
 }
-/** Serialize coordination mutations across Node processes sharing a project. */
-export async function withCoordinationLock(coordinationDir, operation, timeoutMs = DEFAULT_TIMEOUT_MS) {
-    const path = join(coordinationDir, LOCK_FILE);
+async function withLocalLock(path, operation) {
+    const previous = localLockTails.get(path) ?? Promise.resolve();
+    let release = () => undefined;
+    const current = new Promise((resolve) => {
+        release = resolve;
+    });
+    const tail = previous.then(() => current);
+    localLockTails.set(path, tail);
+    await previous;
+    try {
+        return await operation();
+    }
+    finally {
+        release();
+        if (localLockTails.get(path) === tail)
+            localLockTails.delete(path);
+    }
+}
+async function withFileLock(path, operation, timeoutMs) {
     const deadline = Date.now() + timeoutMs;
     const token = randomUUID();
     const owner = {
@@ -138,3 +155,8 @@ export async function withCoordinationLock(coordinationDir, operation, timeoutMs
         await releaseOwnedLock(path, token);
     }
 }
+/** Serialize coordination mutations within this process and across processes. */
+export async function withCoordinationLock(coordinationDir, operation, timeoutMs = DEFAULT_TIMEOUT_MS) {
+    const path = join(coordinationDir, LOCK_FILE);
+    return withLocalLock(path, () => withFileLock(path, operation, timeoutMs));
+}

package/dist/src/core/reporting/cli-guide.js

@@ -5,8 +5,10 @@ Loadout — manage the skills, tools, and MCP servers your AI agents use.
 FIRST TIME
 
   loadout doctor                    which agents you have, and whether they are healthy
-  loadout setup --mode stable       preview 30 reviewed skills (nothing changes)
-  loadout setup --mode stable --yes install them
+  loadout setup --mode stable --details
+                                      preview 30 reviewed skills and findings
+  loadout setup --mode stable --yes --approve-risk
+                                      install only after reviewing those findings
 
 IN A PROJECT
 

package/dist/src/core/workspace/active-policy.js

@@ -34,7 +34,7 @@ const SPECIALIZED_WITHOUT_SIGNAL = /(?:appstore|msstore|backtesting|bats-|oracle
 function hasProjectCompatibility(name, project) {
     const hasLanguage = (language) => project.languages.includes(language);
     const languageRequirements = [
-        [/(?:dotnet|csharp|aspnet|nuget|maui)/, ".net"],
+        [/(?:dotnet|csharp|aspnet|nuget|maui|blazor)/, ".net"],
         [
             /(?:python|pytest|fastapi|django|flask|pydantic|poetry|uv-package)/,
             "python",