mustflow 2.112.14 → 2.114.0

package/README.md

@@ -290,6 +290,8 @@ mf run mustflow_update_apply
 | `mf handoff validate <path>` | Validate a restricted work-item or handoff JSON record without writing files. |
 | `mf context --json` | Print read order, command rules, context trust metadata, available capabilities, prompt-cache bundles, and recent run summary as JSON. |
 | `mf skill route` | Resolve compact skill route candidates from task text, paths, and reasons before reading selected skill documents. |
+| `mf skill outdated` | Check installed external skills against their saved upstream provenance, report file hash drift, and refresh the local update-check timestamp without writing skill files. |
+| `mf skill update <skill-name>\|--all` | Refresh installed external skills from their saved provenance source, refusing to overwrite local drift. Use `--dry-run` to preview and refresh the update-check timestamp. |
 | `mf map --stdout` | Print the current mustflow root map to stdout. |
 | `mf map --write` | Create or update `REPO_MAP.md`. |
 | `mf flow --stdout` | Print the current mustflow root design-flow map to stdout. |

package/dist/cli/commands/skill.js

@@ -5,7 +5,7 @@ import { resolveMustflowRoot } from '../lib/project-root.js';
 import { listScriptPackScripts } from '../lib/script-pack-registry.js';
 import { createScriptPackSuggestionReport, } from '../../core/script-pack-suggestions.js';
 import { resolveSkillRoutes } from '../../core/skill-route-resolution.js';
-import { createExternalSkillImportReport, } from '../lib/external-skill-import.js';
+import { createExternalSkillImportReport, createExternalSkillUpdateReminder, createExternalSkillUpdateReport, } from '../lib/external-skill-import.js';
 const SKILL_OPTIONS = [
     { name: '--json', kind: 'boolean' },
     { name: '--task', kind: 'string' },
@@ -14,8 +14,10 @@ const SKILL_OPTIONS = [
     { name: '--max-candidates', kind: 'string' },
     { name: '--install', kind: 'boolean' },
     { name: '--dry-run', kind: 'boolean' },
+    { name: '--all', kind: 'boolean' },
     { name: '--name', kind: 'string' },
     { name: '--ref', kind: 'string' },
+    { name: '--trust-scripts', kind: 'boolean' },
 ];
 export function getSkillHelp(lang = 'en') {
     return renderHelp({
@@ -24,14 +26,18 @@ export function getSkillHelp(lang = 'en') {
         options: [
             { label: 'route', description: 'Resolve installed skill route candidates' },
             { label: 'import <github-url>', description: 'Preview or install an external SKILL.md under .mustflow/external-skills/' },
+            { label: 'outdated [skill-name...]', description: 'Check installed external skills for upstream file changes' },
+            { label: 'update <skill-name>|--all', description: 'Refresh installed external skills from their saved provenance source' },
             { label: '--task <text>', description: 'Task text used for route scoring' },
             { label: '--path <path>', description: 'Changed or expected path; may be repeated' },
             { label: '--reason <reason>', description: 'Classification or verification reason; may be repeated' },
             { label: '--max-candidates <count>', description: 'Maximum candidates to return, from 1 to 10' },
             { label: '--dry-run', description: 'Preview an external skill import without writing files; default for import' },
             { label: '--install', description: 'Install an external skill after previewing the same source' },
+            { label: '--all', description: 'Select every installed external skill for outdated or update checks' },
             { label: '--name <slug>', description: 'Override the installed external skill directory name' },
             { label: '--ref <ref>', description: 'Override the GitHub ref used for import' },
+            { label: '--trust-scripts', description: 'Create command-contract intents for imported scripts; requires --install to write them' },
             { label: '--json', description: t(lang, 'cli.option.json') },
             { label: '-h, --help', description: t(lang, 'cli.option.help') },
         ],
@@ -40,6 +46,9 @@ export function getSkillHelp(lang = 'en') {
             'mf skill route --reason docs_change --path docs-site/src/content/docs/en/commands/context.md',
             'mf skill import https://github.com/example/agent-skills/tree/main/review/security --dry-run --json',
             'mf skill import https://github.com/example/agent-skills/blob/main/review/security/SKILL.md --install',
+            'mf skill outdated --json',
+            'mf skill update concurrency-review --dry-run --json',
+            'mf skill update --all --trust-scripts',
         ],
         exitCodes: [
             { label: '0', description: 'Skill route candidates were resolved' },
@@ -65,14 +74,17 @@ function parseSkillArgs(args) {
         json: hasParsedCliOption(parsed, '--json'),
         action: parsed.positionals[0] ?? null,
         sourceUrl: parsed.positionals[1] ?? null,
+        skillNames: parsed.positionals.slice(1),
         taskText: getParsedCliStringOption(parsed, '--task'),
         paths: getParsedCliStringOptions(parsed, '--path'),
         reasons: getParsedCliStringOptions(parsed, '--reason'),
         maxCandidates: parseMaxCandidates(getParsedCliStringOption(parsed, '--max-candidates')),
         install: hasParsedCliOption(parsed, '--install'),
         dryRun: hasParsedCliOption(parsed, '--dry-run'),
+        all: hasParsedCliOption(parsed, '--all'),
         name: getParsedCliStringOption(parsed, '--name'),
         ref: getParsedCliStringOption(parsed, '--ref'),
+        trustScripts: hasParsedCliOption(parsed, '--trust-scripts'),
         error: parsed.error,
     };
 }
@@ -99,7 +111,7 @@ function createSkillRouteScriptPackSuggestions(mustflowRoot, report, paths) {
         issues: suggestionReport.issues,
     };
 }
-function renderSkillRouteReport(report, lang) {
+function renderSkillRouteReport(report, lang, warnings = []) {
     const lines = [
         'mustflow skill route',
         `${t(lang, 'label.mustflowRoot')}: ${resolveMustflowRoot()}`,
@@ -117,6 +129,42 @@ function renderSkillRouteReport(report, lang) {
         }
     }
     lines.push('', 'Read plan', ...report.read_plan.selected_skill_paths.map((skillPath) => `- read selected skill: ${skillPath}`), `- avoid by default: ${report.read_plan.avoid_by_default.join(', ') || t(lang, 'value.none')}`, `- fallback route metadata: ${report.read_plan.fallback_route_metadata.path}`, '', 'Source files', ...report.source_files.map((sourceFile) => `- ${sourceFile}`));
+    if (warnings.length > 0) {
+        lines.push('', 'Warnings', ...warnings.map((warning) => `- ${warning}`));
+    }
+    return lines.join('\n');
+}
+function renderSkillUpdateReport(report) {
+    const lines = [
+        `mustflow skill ${report.action}`,
+        `status: ${report.status}`,
+        `mode: ${report.mode}`,
+        `wrote_files: ${String(report.wrote_files)}`,
+        '',
+        'Skills',
+    ];
+    if (report.skills.length === 0) {
+        lines.push('- none');
+    }
+    else {
+        for (const skill of report.skills) {
+            lines.push(`- ${skill.skill_name}: ${skill.status}`, `  source: ${skill.source?.source_url ?? 'none'}`, `  target: ${skill.target.skill_dir}`, `  changed_files: ${String(skill.changed_files.length)}`);
+            for (const changedFile of skill.changed_files) {
+                lines.push(`  - ${changedFile.relative_path}: ${changedFile.status}`, `    current: ${changedFile.current_sha256 ?? 'none'}`, `    remote: ${changedFile.remote_sha256 ?? 'none'}`);
+            }
+            if (skill.issues.length > 0) {
+                for (const issue of skill.issues) {
+                    lines.push(`  issue: ${issue}`);
+                }
+            }
+        }
+    }
+    if (report.warnings.length > 0) {
+        lines.push('', 'Warnings', ...report.warnings.map((warning) => `- ${warning}`));
+    }
+    if (report.issues.length > 0) {
+        lines.push('', 'Issues', ...report.issues.map((issue) => `- ${issue}`));
+    }
     return lines.join('\n');
 }
 function renderSkillImportReport(report) {
@@ -138,6 +186,15 @@ function renderSkillImportReport(report) {
             lines.push(`- ${file.relative_path} (${file.kind}, ${file.bytes} bytes, ${file.sha256})`);
         }
     }
+    if (report.script_trust) {
+        lines.push('', 'Script trust', `- requested: ${String(report.script_trust.requested)}`, `- status: ${report.script_trust.status}`, `- command authority: ${String(report.script_trust.grants_command_authority)}`);
+        if (report.script_trust.fragment_path) {
+            lines.push(`- command fragment: ${report.script_trust.fragment_path}`);
+        }
+        for (const intent of report.script_trust.intents) {
+            lines.push(`- intent: ${intent.intent}`);
+        }
+    }
     if (report.warnings.length > 0) {
         lines.push('', 'Warnings', ...report.warnings.map((warning) => `- ${warning}`));
     }
@@ -162,7 +219,10 @@ export async function runSkill(args, reporter, lang = 'en') {
         printUsageError(reporter, formatCliOptionParseError(parsed.error, lang), 'mf skill --help', getSkillHelp(lang), lang);
         return 1;
     }
-    if (parsed.action !== 'route' && parsed.action !== 'import') {
+    if (parsed.action !== 'route' &&
+        parsed.action !== 'import' &&
+        parsed.action !== 'outdated' &&
+        parsed.action !== 'update') {
         printUsageError(reporter, t(lang, parsed.action ? 'cli.error.unexpectedArgument' : 'cli.error.missingValue', {
             argument: parsed.action ?? '',
             option: 'route',
@@ -183,6 +243,7 @@ export async function runSkill(args, reporter, lang = 'en') {
             mode,
             name: parsed.name,
             ref: parsed.ref,
+            trustScripts: parsed.trustScripts,
         });
         if (parsed.json) {
             reporter.stdout(JSON.stringify(report, null, 2));
@@ -192,6 +253,30 @@ export async function runSkill(args, reporter, lang = 'en') {
         }
         return report.ok ? 0 : 1;
     }
+    if (parsed.action === 'outdated' || parsed.action === 'update') {
+        if (parsed.action === 'outdated' && (parsed.install || parsed.dryRun)) {
+            printUsageError(reporter, t(lang, 'cli.error.unexpectedValue', { option: '--install/--dry-run' }), 'mf skill --help', getSkillHelp(lang), lang);
+            return 1;
+        }
+        if (parsed.action === 'update' && parsed.install) {
+            printUsageError(reporter, t(lang, 'cli.error.unexpectedValue', { option: '--install' }), 'mf skill --help', getSkillHelp(lang), lang);
+            return 1;
+        }
+        const report = await createExternalSkillUpdateReport(resolveMustflowRoot(), {
+            action: parsed.action,
+            mode: parsed.action === 'outdated' ? 'check' : parsed.dryRun ? 'dry_run' : 'install',
+            skillNames: parsed.skillNames,
+            all: parsed.all,
+            trustScripts: parsed.trustScripts,
+        });
+        if (parsed.json) {
+            reporter.stdout(JSON.stringify(report, null, 2));
+        }
+        else {
+            reporter.stdout(renderSkillUpdateReport(report));
+        }
+        return report.ok ? 0 : 1;
+    }
     if (Number.isNaN(parsed.maxCandidates)) {
         printUsageError(reporter, t(lang, 'cli.error.unexpectedValue', { option: '--max-candidates' }), 'mf skill --help', getSkillHelp(lang), lang);
         return 1;
@@ -212,6 +297,7 @@ export async function runSkill(args, reporter, lang = 'en') {
         }, null, 2));
         return 0;
     }
-    reporter.stdout(renderSkillRouteReport(report, lang));
+    const updateReminder = createExternalSkillUpdateReminder(mustflowRoot);
+    reporter.stdout(renderSkillRouteReport(report, lang, updateReminder ? [updateReminder] : []));
     return 0;
 }

package/dist/cli/lib/command-registry.js

@@ -242,7 +242,7 @@ export const COMMAND_DEFINITIONS = [
         id: 'skill',
         usage: 'mf skill',
         summaryKey: 'command.skill.summary',
-        contract: commandContract(TEXT_JSON_OUTPUT, ['skill-route-report', 'skill-import-report']),
+        contract: commandContract(TEXT_JSON_OUTPUT, ['skill-route-report', 'skill-import-report', 'skill-update-report']),
         loadRunner: async () => (await import('../commands/skill.js')).runSkill,
     },
     {