showdar-skills 0.2.1 → 0.2.3

package/bin/showdar.js

@@ -49,6 +49,10 @@ async function main() {
   const version = await packageVersion();
 
   if (command === 'help' || command === '--help' || command === '-h') return printHelp(version);
+  if (command === '--version' || command === '-V') {
+    console.log(version);
+    return;
+  }
   if (args.includes('--help') || args.includes('-h')) return printHelp(version, command);
 
   const scope = ['init', 'status', 'doctor', 'remove'].includes(command) ? scopeAfter(args) : null;
@@ -83,6 +87,10 @@ async function main() {
       ? await initGlobal({ homeRoot: homedir(), packageRoot, profile, ai, skillIds, commandNames, packageVersion: version })
       : await initProject({ projectRoot, packageRoot, profile, ai, skillIds, commandNames, packageVersion: version });
     console.log(`Showdar Skills installed.\nScope: ${scope}\nProfile: ${profile}\nAI: ${ai}\nTargets: ${result.targets.join(', ')}\nSkills: ${result.skills}\nOpenCode commands: ${result.commands}`);
+    if (scope === 'project') {
+      console.log(`Requested: ${result.requestedSkills}\nInstalled in project: ${result.installedSkills}\nSatisfied by global: ${result.satisfiedByGlobal}\nSkipped duplicate copies: ${result.skippedDuplicates}`);
+    }
+    for (const warning of result.warnings ?? []) console.log(`warning: ${warning}`);
     if (scope === 'global') console.log(`Manifest: ${globalManifestPath()}`);
     if (result.targets.includes('codex')) console.log('Codex: invoke skills directly with $showdar-<name> or let native skill discovery route by description.');
     if (result.targets.includes('opencode')) console.log('OpenCode: use native skill discovery or /showdar/<command>.');
@@ -97,7 +105,9 @@ async function main() {
       return;
     }
     console.log(`Showdar Skills\nScope: ${result.scope}\nProfile: ${result.profile}\nAI: ${result.ai}\nTargets: ${result.targets.join(', ')}\nSkills: ${result.skills}\nCommands: ${result.commands}\nHealth: ${result.healthy ? 'OK' : 'BROKEN'}`);
+    if (scope === 'project') console.log(`Requested: ${result.requestedSkills}\nInstalled in project: ${result.installedSkills}\nSatisfied by global: ${result.satisfiedByGlobal}`);
     for (const issue of result.issues) console.log(`- ${issue}`);
+    for (const warning of result.warnings ?? []) console.log(`warning: ${warning}`);
     if (command === 'doctor' && !result.healthy) process.exitCode = 1;
     return;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "showdar-skills",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "Production-grade software engineering lifecycle skills for coding agents.",
   "type": "module",
   "bin": { "showdar": "./bin/showdar.js" },

package/skills/showdar-review/scripts/collect-diff.mjs

@@ -1,5 +1,12 @@
 #!/usr/bin/env node
 import { spawnSync } from 'node:child_process';
 const cwd=process.argv[2]??process.cwd(); const base=process.argv[3]??'HEAD';
-const run=a=>{const r=spawnSync('git',a,{cwd,encoding:'utf8'});return r.status===0?r.stdout.trim():null};
-console.log(JSON.stringify({base,status:run(['status','--short']),files:run(['diff','--name-only',base])?.split('\n').filter(Boolean)??[],stat:run(['diff','--stat',base]),diff:run(['diff','--no-ext-diff','--unified=3',base])},null,2));
+const run=(args)=>{const r=spawnSync('git',args,{cwd,encoding:'utf8',shell:false});if(r.error)throw r.error;if(r.status!==0)throw new Error((r.stderr||r.stdout).trim()||`git ${args.join(' ')} failed`);return r.stdout.trim()};
+try {
+  if (base.startsWith('-')) throw new Error('revision must not begin with "-"');
+  const resolved=run(['rev-parse','--verify',`${base}^{commit}`]);
+  console.log(JSON.stringify({base,status:run(['status','--short']),files:run(['diff','--no-ext-diff','--name-only',resolved])?.split('\n').filter(Boolean)??[],stat:run(['diff','--no-ext-diff','--stat',resolved]),diff:run(['diff','--no-ext-diff','--unified=3',resolved])},null,2));
+} catch (error) {
+  console.error(`collect-diff: ${error.message}`);
+  process.exitCode=1;
+}

package/src/path-safety.js

@@ -0,0 +1,39 @@
+import { lstat } from 'node:fs/promises';
+import path from 'node:path';
+
+export function safeOwnedPath(baseRoot, relative, allowedRoots = []) {
+  if (typeof relative !== 'string' || !relative) return null;
+  const roots = [baseRoot, ...allowedRoots].map((root) => path.resolve(root));
+  const target = path.resolve(relative.startsWith(path.sep) ? relative : path.join(roots[0], relative));
+  return roots.some((root) => target === root || target.startsWith(`${root}${path.sep}`)) ? target : null;
+}
+
+export async function lstatWithoutSymlink(target) {
+  const info = await lstat(target);
+  if (info.isSymbolicLink()) throw new Error(`Refusing managed path through symlink: ${target}`);
+  return info;
+}
+
+export async function assertSafeManagedPath(baseRoot, target, allowedRoots = []) {
+  const root = path.resolve(baseRoot);
+  const resolved = safeOwnedPath(root, target, allowedRoots);
+  if (!resolved) throw new Error(`Invalid managed path: ${target}`);
+
+  try {
+    await lstatWithoutSymlink(root);
+  } catch (error) {
+    if (error?.code === 'ENOENT') return resolved;
+    throw error;
+  }
+  let current = root;
+  for (const component of path.relative(root, resolved).split(path.sep).filter(Boolean)) {
+    current = path.join(current, component);
+    try {
+      await lstatWithoutSymlink(current);
+    } catch (error) {
+      if (error?.code === 'ENOENT') break;
+      throw error;
+    }
+  }
+  return resolved;
+}

package/src/project.js

@@ -1,8 +1,9 @@
-import { access, cp, mkdir, readFile, readdir, rename, rm, stat, writeFile } from 'node:fs/promises';
+import { access, cp, mkdir, readFile, readdir, rename, rm, writeFile } from 'node:fs/promises';
 import { createHash } from 'node:crypto';
 import { homedir } from 'node:os';
 import path from 'node:path';
 import { globalCommandRootFor, globalSkillRootFor, NATIVE_TARGETS, opencodeCommandRoot, resolveTargets, skillRootFor } from './adapters.js';
+import { assertSafeManagedPath, lstatWithoutSymlink, safeOwnedPath } from './path-safety.js';
 
 const PROJECT_MANIFEST = '.showdar.json';
 const START = '<!-- showdar-skills:start -->';
@@ -19,7 +20,7 @@ async function exists(target) {
 async function hashTree(target) {
   const h = createHash('sha256');
   async function walk(current, relative = '') {
-    const info = await stat(current);
+    const info = await lstatWithoutSymlink(current);
     if (info.isDirectory()) {
       const entries = await readdir(current, { withFileTypes: true });
       entries.sort((a, b) => a.name.localeCompare(b.name));
@@ -35,15 +36,20 @@ async function hashTree(target) {
   return h.digest('hex');
 }
 
-async function readManifest(manifestPath) {
+async function readManifest(manifestPath, baseRoot) {
+  await assertSafeManagedPath(baseRoot, manifestPath);
   if (!(await exists(manifestPath))) return null;
   try { return JSON.parse(await readFile(manifestPath, 'utf8')); }
   catch (error) { throw new Error(`Invalid Showdar manifest: ${error.message}`); }
 }
 
 async function writeJsonAtomic(target, value) {
+  await writeTextAtomic(target, `${JSON.stringify(value, null, 2)}\n`);
+}
+
+async function writeTextAtomic(target, value) {
   const tmp = `${target}.tmp-${process.pid}-${Date.now()}`;
-  await writeFile(tmp, `${JSON.stringify(value, null, 2)}\n`);
+  await writeFile(tmp, value, { flag: 'wx' });
   await rename(tmp, target);
 }
 
@@ -81,18 +87,20 @@ function stripManagedBlock(content) {
 
 async function writeAgentsBlock(projectRoot, skillIds) {
   const target = path.join(projectRoot, 'AGENTS.md');
+  await assertSafeManagedPath(projectRoot, target);
   const current = (await exists(target)) ? await readFile(target, 'utf8') : '';
   const clean = stripManagedBlock(current).trimEnd();
   const block = managedBlock(skillIds);
-  await writeFile(target, clean ? `${clean}\n\n${block}\n` : `${block}\n`);
+  await writeTextAtomic(target, clean ? `${clean}\n\n${block}\n` : `${block}\n`);
 }
 
 async function removeAgentsBlock(projectRoot) {
   const target = path.join(projectRoot, 'AGENTS.md');
+  await assertSafeManagedPath(projectRoot, target);
   if (!(await exists(target))) return;
   const current = await readFile(target, 'utf8');
   const clean = stripManagedBlock(current).trim();
-  if (clean) await writeFile(target, `${clean}\n`);
+  if (clean) await writeTextAtomic(target, `${clean}\n`);
   else await rm(target, { force: true });
 }
 
@@ -100,12 +108,13 @@ function ownedPathSet(manifest) {
   return new Set((manifest?.files ?? []).map((entry) => entry.path));
 }
 
-function safeOwnedPath(baseRoot, relative, allowedRoots = []) {
-  if (typeof relative !== 'string' || !relative) return null;
-  const roots = [baseRoot, ...allowedRoots].map((root) => path.resolve(root));
-  const target = path.resolve(relative.startsWith(path.sep) ? relative : path.join(roots[0], relative));
-  if (!roots.some((root) => target === root || target.startsWith(`${root}${path.sep}`))) return null;
-  return target;
+function uniqueRoots(targets, resolveRoot) {
+  const roots = new Map();
+  for (const target of targets) {
+    const root = resolveRoot(target);
+    if (!roots.has(path.resolve(root))) roots.set(path.resolve(root), { root, target });
+  }
+  return [...roots.values()];
 }
 
 function manifestPathFor(baseRoot, destination) {
@@ -113,7 +122,8 @@ function manifestPathFor(baseRoot, destination) {
   return relative.replaceAll(path.sep, '/');
 }
 
-async function copyOwned({ baseRoot, source, destination, priorOwned, newFiles }) {
+async function copyOwned({ baseRoot, source, destination, priorOwned, newFiles, managedRoots = [] }) {
+  await assertSafeManagedPath(baseRoot, destination, managedRoots);
   const relative = manifestPathFor(baseRoot, destination);
   if ((await exists(destination)) && !priorOwned.has(relative)) {
     throw new Error(`Refusing to overwrite existing non-Showdar-managed skill or command: ${destination}`);
@@ -124,37 +134,75 @@ async function copyOwned({ baseRoot, source, destination, priorOwned, newFiles }
   newFiles.push({ path: relative, hash: await hashTree(destination) });
 }
 
-async function initInstallation({ baseRoot, manifestPath, agentsRoot, packageRoot, profile, ai, skillIds, commandNames = [], packageVersion = '0.2.0', scope, skillRootForTarget, commandRoot, managedRoots = [] }) {
+async function initInstallation({ baseRoot, manifestPath, agentsRoot, packageRoot, profile, ai, skillIds, commandNames = [], packageVersion = '0.2.0', scope, skillRootForTarget, commandRoot, managedRoots = [], homeRoot = homedir(), globalSkillRootForTarget = null }) {
   await mkdir(baseRoot, { recursive: true });
+  await assertSafeManagedPath(baseRoot, baseRoot);
+  await assertSafeManagedPath(baseRoot, manifestPath);
+  if (agentsRoot) await assertSafeManagedPath(agentsRoot, path.join(agentsRoot, 'AGENTS.md'));
   const targets = resolveTargets(ai);
-  const prior = await readManifest(manifestPath);
+  const prior = await readManifest(manifestPath, baseRoot);
   const priorOwned = ownedPathSet(prior);
   const desiredPaths = new Set();
 
-  const skillRoots = new Map();
-  for (const target of targets) {
-    const root = skillRootForTarget(target);
-    skillRoots.set(path.resolve(root), root);
+  const skillRoots = uniqueRoots(targets, skillRootForTarget);
+  const globalManifest = scope === 'project' && globalSkillRootForTarget
+    ? await readManifest(globalManifestPath(homeRoot), homeRoot)
+    : null;
+  const globalOwned = ownedPathSet(globalManifest);
+  const globalSatisfaction = [];
+  const installedSkillIds = new Set();
+  const globallySatisfiedSkillIds = new Set();
+  let skippedDuplicates = 0;
+  const skillDestinations = [];
+
+  for (const skillId of skillIds) {
+    if (!(await exists(path.join(packageRoot, 'skills', skillId, 'SKILL.md')))) throw new Error(`Skill asset not found: ${skillId}`);
   }
-  for (const root of skillRoots.values()) {
-    for (const skillId of skillIds) desiredPaths.add(manifestPathFor(baseRoot, path.join(root, skillId)));
+
+  for (const { root, target } of skillRoots) {
+    for (const skillId of skillIds) {
+      const destination = path.join(root, skillId);
+      await assertSafeManagedPath(baseRoot, destination, managedRoots);
+      const relative = manifestPathFor(baseRoot, destination);
+      const destinationExists = await exists(destination);
+      const globalPath = globalSkillRootForTarget ? path.join(globalSkillRootForTarget(target), skillId) : null;
+      if (globalPath) await assertSafeManagedPath(homeRoot, globalPath);
+      const globalRelative = globalPath ? manifestPathFor(homeRoot, globalPath) : null;
+      const globalAvailable = Boolean(globalPath && globalOwned.has(globalRelative) && await exists(globalPath));
+      if (scope === 'project' && globalAvailable && !destinationExists) {
+        skippedDuplicates += 1;
+        globallySatisfiedSkillIds.add(skillId);
+        globalSatisfaction.push({ skill: skillId, target, path: globalRelative });
+      } else {
+        desiredPaths.add(relative);
+        skillDestinations.push({ destination, skillId });
+      }
+    }
   }
   if (targets.includes('opencode')) {
-    for (const name of commandNames) desiredPaths.add(manifestPathFor(baseRoot, path.join(commandRoot(), `${name}.md`)));
+    const root = commandRoot();
+    for (const name of commandNames) {
+      const destination = path.join(root, `${name}.md`);
+      await assertSafeManagedPath(baseRoot, destination, managedRoots);
+      desiredPaths.add(manifestPathFor(baseRoot, destination));
+    }
   }
 
+  const staleTargets = [];
   for (const entry of prior?.files ?? []) {
     const target = safeOwnedPath(baseRoot, entry.path, managedRoots);
-    if (target && !desiredPaths.has(entry.path)) await rm(target, { recursive: true, force: true });
+    if (target && !desiredPaths.has(entry.path)) {
+      await assertSafeManagedPath(baseRoot, target, managedRoots);
+      staleTargets.push(target);
+    }
   }
+  for (const target of staleTargets) await rm(target, { recursive: true, force: true });
 
   const files = [];
-  for (const root of skillRoots.values()) {
-    for (const skillId of skillIds) {
-      const source = path.join(packageRoot, 'skills', skillId);
-      if (!(await exists(path.join(source, 'SKILL.md')))) throw new Error(`Skill asset not found: ${skillId}`);
-      await copyOwned({ baseRoot, source, destination: path.join(root, skillId), priorOwned, newFiles: files });
-    }
+  for (const { destination, skillId } of skillDestinations) {
+    const source = path.join(packageRoot, 'skills', skillId);
+    await copyOwned({ baseRoot, source, destination, priorOwned, newFiles: files, managedRoots });
+    installedSkillIds.add(skillId);
   }
 
   if (targets.includes('opencode')) {
@@ -162,7 +210,7 @@ async function initInstallation({ baseRoot, manifestPath, agentsRoot, packageRoo
     for (const name of commandNames) {
       const source = path.join(packageRoot, 'commands', 'opencode', 'showdar', `${name}.md`);
       if (!(await exists(source))) throw new Error(`OpenCode command asset not found: ${name}`);
-      await copyOwned({ baseRoot, source, destination: path.join(root, `${name}.md`), priorOwned, newFiles: files });
+      await copyOwned({ baseRoot, source, destination: path.join(root, `${name}.md`), priorOwned, newFiles: files, managedRoots });
     }
   }
 
@@ -174,16 +222,28 @@ async function initInstallation({ baseRoot, manifestPath, agentsRoot, packageRoo
     ai,
     targets,
     skills: [...skillIds],
+    satisfiedByGlobal: globalSatisfaction,
     commands: targets.includes('opencode') ? [...commandNames] : [],
     files,
   };
+  await assertSafeManagedPath(baseRoot, manifestPath);
   await mkdir(path.dirname(manifestPath), { recursive: true });
   await writeJsonAtomic(manifestPath, manifest);
   if (agentsRoot) await writeAgentsBlock(agentsRoot, skillIds);
-  return inspectInstallation({ baseRoot, manifestPath, agentsRoot, scope });
+  const result = await inspectInstallation({
+    baseRoot, manifestPath, agentsRoot, scope, homeRoot,
+    globalSkillRootForTarget,
+  });
+  return {
+    ...result,
+    requestedSkills: skillIds.length,
+    installedSkills: installedSkillIds.size,
+    satisfiedByGlobal: globallySatisfiedSkillIds.size,
+    skippedDuplicates,
+  };
 }
 
-export async function initProject({ projectRoot, packageRoot, profile, ai, skillIds, commandNames = [], packageVersion = '0.2.0' }) {
+export async function initProject({ projectRoot, homeRoot = homedir(), packageRoot, profile, ai, skillIds, commandNames = [], packageVersion = '0.2.0' }) {
   return initInstallation({
     baseRoot: projectRoot,
     manifestPath: path.join(projectRoot, PROJECT_MANIFEST),
@@ -195,7 +255,9 @@ export async function initProject({ projectRoot, packageRoot, profile, ai, skill
     commandNames,
     packageVersion,
     scope: 'project',
+    homeRoot,
     skillRootForTarget: (target) => skillRootFor(target, projectRoot),
+    globalSkillRootForTarget: (target) => globalSkillRootFor(target, { homeRoot }),
     commandRoot: () => opencodeCommandRoot(projectRoot),
   });
 }
@@ -219,23 +281,93 @@ export async function initGlobal({ homeRoot = homedir(), packageRoot, profile, a
   });
 }
 
-async function inspectInstallation({ baseRoot, manifestPath, agentsRoot, scope, managedRoots = [] }) {
+async function inspectInstallation({ baseRoot, manifestPath, agentsRoot, scope, managedRoots = [], homeRoot = homedir(), globalSkillRootForTarget = null }) {
   let manifest;
-  try { manifest = await readManifest(manifestPath); }
-  catch (error) { return { installed: true, healthy: false, scope, profile: null, ai: null, targets: [], skills: 0, commands: 0, issues: [error.message] }; }
-  if (!manifest) return { installed: false, healthy: false, scope, profile: null, ai: null, targets: [], skills: 0, commands: 0, issues: ['Showdar is not installed.'] };
+  try { manifest = await readManifest(manifestPath, baseRoot); }
+  catch (error) { return { installed: true, healthy: false, scope, profile: null, ai: null, targets: [], skills: 0, requestedSkills: 0, installedSkills: 0, satisfiedByGlobal: 0, commands: 0, issues: [error.message], warnings: [] }; }
+  if (!manifest) return { installed: false, healthy: false, scope, profile: null, ai: null, targets: [], skills: 0, requestedSkills: 0, installedSkills: 0, satisfiedByGlobal: 0, commands: 0, issues: ['Showdar is not installed.'], warnings: [] };
 
   const issues = [];
+  const warnings = [];
+  const projectOwned = ownedPathSet(manifest);
+  const targets = manifest.targets?.length ? manifest.targets : manifest.ai ? resolveTargets(manifest.ai) : [];
+  const skillIds = manifest.skills ?? [];
+  const globalManifest = scope === 'project' && globalSkillRootForTarget
+    ? await readManifest(globalManifestPath(homeRoot), homeRoot)
+    : null;
+  const globalOwned = ownedPathSet(globalManifest);
+  const globalSatisfiedPaths = new Set();
+  const installedSkillIds = new Set();
+  const globallySatisfiedSkillIds = new Set();
+  const recordedGlobalSkills = new Set((manifest.satisfiedByGlobal ?? []).map((entry) => entry?.skill).filter(Boolean));
+
+  if (scope === 'project' && globalSkillRootForTarget) {
+    const projectRoots = uniqueRoots(targets, (target) => skillRootFor(target, baseRoot));
+    const globalRoots = uniqueRoots(targets, globalSkillRootForTarget);
+    const globalSkills = new Set();
+    for (const { root } of globalRoots) {
+      const prefix = `${manifestPathFor(homeRoot, root)}/`;
+      for (const entry of globalManifest?.files ?? []) {
+        if (!entry.path.startsWith(prefix)) continue;
+        const skillId = entry.path.slice(prefix.length).split('/')[0];
+        if (!skillId.startsWith('showdar-')) continue;
+        const globalTarget = safeOwnedPath(homeRoot, entry.path);
+        if (globalTarget && globalTarget.startsWith(`${root}${path.sep}`) && globalOwned.has(entry.path)) {
+          await assertSafeManagedPath(homeRoot, globalTarget);
+          if (await exists(globalTarget)) globalSkills.add(skillId);
+        }
+      }
+    }
+    const extra = [...globalSkills].filter((skillId) => !skillIds.includes(skillId)).sort();
+    if (extra.length) warnings.push(`Global Showdar installation exposes skills outside project profile "${manifest.profile ?? 'unknown'}": ${extra.join(', ')}. Project deduplication prevents duplicate copies but cannot hide globally installed skills. For strict project profile isolation: showdar remove --scope global`);
+
+    for (const { root, target } of projectRoots) {
+      for (const skillId of skillIds) {
+        const projectPath = path.join(root, skillId);
+        const projectRelative = manifestPathFor(baseRoot, projectPath);
+        const projectExists = await exists(projectPath);
+        const projectIsOwned = projectOwned.has(projectRelative);
+        const globalPath = path.join(globalSkillRootForTarget(target), skillId);
+        const globalRelative = manifestPathFor(homeRoot, globalPath);
+        await assertSafeManagedPath(baseRoot, projectPath);
+        await assertSafeManagedPath(homeRoot, globalPath);
+        const globalExists = await exists(globalPath);
+        const globalIsOwned = globalOwned.has(globalRelative);
+
+        if (projectExists && projectIsOwned) installedSkillIds.add(skillId);
+        if (projectExists && projectIsOwned && globalExists && globalIsOwned) {
+          warnings.push(`Duplicate Showdar skill discovery:\n  ${skillId}\n    project: ${projectPath}\n    global: ${globalPath}\n  To prefer project isolation: showdar remove --scope global`);
+        } else if (!projectExists && globalExists && globalIsOwned) {
+          globalSatisfiedPaths.add(projectRelative);
+          globallySatisfiedSkillIds.add(skillId);
+        } else if (!projectExists && !globalExists) {
+          issues.push(recordedGlobalSkills.has(skillId)
+            ? `Globally satisfied skill is missing: ${skillId} (${globalPath})`
+            : `Missing requested skill: ${projectPath}`);
+        } else if (projectExists && !projectIsOwned) {
+          issues.push(`Project skill path is not Showdar-owned: ${projectPath}`);
+        } else if (globalExists && !globalIsOwned) {
+          warnings.push(`Global skill path is not Showdar-owned: ${globalPath}`);
+        }
+      }
+    }
+  }
+
   for (const entry of manifest.files ?? []) {
     const target = safeOwnedPath(baseRoot, entry.path, managedRoots);
     if (!target) { issues.push(`Invalid managed path: ${entry.path}`); continue; }
-    if (!(await exists(target))) { issues.push(`Missing managed path: ${entry.path}`); continue; }
+    await assertSafeManagedPath(baseRoot, target, managedRoots);
+    if (!(await exists(target))) {
+      if (!globalSatisfiedPaths.has(entry.path)) issues.push(`Missing managed path: ${entry.path}`);
+      continue;
+    }
     const actual = await hashTree(target);
     if (actual !== entry.hash) issues.push(`Managed path drift detected: ${entry.path}`);
   }
 
   if (agentsRoot) {
     const agentsFile = path.join(agentsRoot, 'AGENTS.md');
+    await assertSafeManagedPath(agentsRoot, agentsFile);
     if (!(await exists(agentsFile))) issues.push('Missing AGENTS.md routing block');
     else {
       const text = await readFile(agentsFile, 'utf8');
@@ -250,26 +382,42 @@ async function inspectInstallation({ baseRoot, manifestPath, agentsRoot, scope,
     profile: manifest.profile ?? null,
     ai: manifest.ai ?? null,
     targets: manifest.targets ?? [],
-    skills: (manifest.skills ?? []).length,
+    skills: skillIds.length,
+    requestedSkills: skillIds.length,
+    installedSkills: scope === 'project' && globalSkillRootForTarget ? installedSkillIds.size : skillIds.length,
+    satisfiedByGlobal: scope === 'project' && globalSkillRootForTarget ? globallySatisfiedSkillIds.size : 0,
     commands: (manifest.commands ?? []).length,
     issues,
+    warnings,
   };
 }
 
 async function removeInstallation({ baseRoot, manifestPath, agentsRoot, managedRoots = [] }) {
+  await assertSafeManagedPath(baseRoot, manifestPath);
   let manifest;
-  try { manifest = await readManifest(manifestPath); }
+  try { manifest = await readManifest(manifestPath, baseRoot); }
   catch { manifest = null; }
   for (const entry of manifest?.files ?? []) {
     const target = safeOwnedPath(baseRoot, entry.path, managedRoots);
-    if (target) await rm(target, { recursive: true, force: true });
+    if (target) {
+      await assertSafeManagedPath(baseRoot, target, managedRoots);
+      await rm(target, { recursive: true, force: true });
+    }
   }
+  await assertSafeManagedPath(baseRoot, manifestPath);
   await rm(manifestPath, { force: true });
   if (agentsRoot) await removeAgentsBlock(agentsRoot);
 }
 
-export async function inspectProject(projectRoot) {
-  return inspectInstallation({ baseRoot: projectRoot, manifestPath: path.join(projectRoot, PROJECT_MANIFEST), agentsRoot: projectRoot, scope: 'project' });
+export async function inspectProject(projectRoot, { homeRoot = homedir() } = {}) {
+  return inspectInstallation({
+    baseRoot: projectRoot,
+    manifestPath: path.join(projectRoot, PROJECT_MANIFEST),
+    agentsRoot: projectRoot,
+    scope: 'project',
+    homeRoot,
+    globalSkillRootForTarget: (target) => globalSkillRootFor(target, { homeRoot }),
+  });
 }
 
 export async function inspectGlobal({ homeRoot = homedir() } = {}) {