skillwiki 0.10.111 → 0.10.112

package/dist/{index-projection-2K672CBO.js → index-projection-UNZG5UJZ.js}

@@ -4,11 +4,11 @@ import {
   UNMANAGED_START,
   renderRootIndex,
   writeRootIndexProjection
-} from "./chunk-MRPJ7X7W.js";
-import "./chunk-I6IRJCUJ.js";
-import "./chunk-X5GL2FCU.js";
-import "./chunk-GQWCTJTU.js";
-import "./chunk-UIEQIJXP.js";
+} from "./chunk-IR2DI4Y5.js";
+import "./chunk-KJG2CSYD.js";
+import "./chunk-TKX6PSWZ.js";
+import "./chunk-EE7W3GLA.js";
+import "./chunk-7POLZOFY.js";
 export {
   UNMANAGED_END,
   UNMANAGED_START,

package/dist/{journal-QU5IDXQF.js → journal-5IW3TZ5F.js}

@@ -3,9 +3,9 @@ import {
   readJournal,
   upsertJournal,
   writeJournal
-} from "./chunk-KWEYA3OE.js";
-import "./chunk-GQWCTJTU.js";
-import "./chunk-UIEQIJXP.js";
+} from "./chunk-FCA3RRNF.js";
+import "./chunk-EE7W3GLA.js";
+import "./chunk-7POLZOFY.js";
 export {
   readJournal,
   upsertJournal,

package/dist/{managed-write-preflight-GRSHQYKC.js → managed-write-preflight-L7IRQ76C.js}

@@ -6,13 +6,13 @@ import {
   runManagedWritePeerGate,
   runManagedWritePreflight,
   runManagedWriteTransaction
-} from "./chunk-HBJLFPQP.js";
-import "./chunk-5IBLXGLY.js";
-import "./chunk-I6IRJCUJ.js";
-import "./chunk-X5GL2FCU.js";
-import "./chunk-PYPPG7RF.js";
-import "./chunk-GQWCTJTU.js";
-import "./chunk-UIEQIJXP.js";
+} from "./chunk-Q6EZF37H.js";
+import "./chunk-CKQPUHM2.js";
+import "./chunk-KJG2CSYD.js";
+import "./chunk-TKX6PSWZ.js";
+import "./chunk-EE7W3GLA.js";
+import "./chunk-SKOLE6US.js";
+import "./chunk-7POLZOFY.js";
 export {
   DEFAULT_MANAGED_WRITE_WAIT_MS,
   MANAGED_WRITE_POLL_INTERVAL_MS,

package/dist/mcp-auth-env-X5MI5IX6.js

@@ -0,0 +1,25 @@
+#!/usr/bin/env node
+import {
+  MCP_HOST_ID_ENV,
+  MCP_TOKEN_ENV,
+  MCP_URL_ENV,
+  isMcpOnlyLeaf,
+  mcpAuthFromEnv,
+  mergeMcpAuthIntoEnv,
+  nonEmptyEnvValue,
+  redactMcpSecret,
+  resolveMcpAuthEnv
+} from "./chunk-DOHWNPAZ.js";
+import "./chunk-SKOLE6US.js";
+import "./chunk-7POLZOFY.js";
+export {
+  MCP_HOST_ID_ENV,
+  MCP_TOKEN_ENV,
+  MCP_URL_ENV,
+  isMcpOnlyLeaf,
+  mcpAuthFromEnv,
+  mergeMcpAuthIntoEnv,
+  nonEmptyEnvValue,
+  redactMcpSecret,
+  resolveMcpAuthEnv
+};

package/dist/{migrate-PIB4QA54.js → migrate-RO4BJP5T.js}

@@ -6,11 +6,12 @@ import {
   refreshInstalledClipPlist,
   stableCliBinary,
   xml
-} from "./chunk-TDBUJUYH.js";
-import "./chunk-6OQLBNKR.js";
-import "./chunk-PYPPG7RF.js";
-import "./chunk-GQWCTJTU.js";
-import "./chunk-UIEQIJXP.js";
+} from "./chunk-25OXNFDV.js";
+import "./chunk-EE7W3GLA.js";
+import "./chunk-ABRYBO4T.js";
+import "./chunk-LOVLZNLX.js";
+import "./chunk-SKOLE6US.js";
+import "./chunk-7POLZOFY.js";
 export {
   CLIP_MIGRATION_HINT,
   migrateClipOutbox,

package/dist/mirror-H5BTBAON.js

@@ -0,0 +1,151 @@
+#!/usr/bin/env node
+import {
+  writeRegularExclusive
+} from "./chunk-K3M6OSUW.js";
+import {
+  parseDestination
+} from "./chunk-ZRGZBAVS.js";
+import "./chunk-QESNTTVY.js";
+
+// src/clip-outbox/mirror.ts
+import { mkdir, rmdir } from "fs/promises";
+import { dirname, join } from "path";
+import { GetObjectCommand } from "@aws-sdk/client-s3";
+var ADMIT = /^raw\/(articles|assets)\/[A-Za-z0-9._/-]+$/;
+function admitMirrorPath(path) {
+  return ADMIT.test(path) && !path.split("/").some((part) => part === ".." || part === "." || !part);
+}
+function orderMirrorPaths(paths) {
+  const unique = [...new Set(paths.filter(admitMirrorPath))];
+  return [...unique.filter((path) => path.startsWith("raw/assets/")), ...unique.filter((path) => path.startsWith("raw/articles/"))];
+}
+function eventsUrlFromMcp(mcpUrl) {
+  const url = new URL(mcpUrl);
+  url.pathname = "/events";
+  url.search = "";
+  url.hash = "";
+  return url.toString();
+}
+function wikiFetchPullLockDir(home) {
+  return join(home, "Library", "Caches", "vault-sync", "wiki-fetch", "pull.lock.d");
+}
+async function acquireWikiFetchPullLock(home) {
+  const lockDir = wikiFetchPullLockDir(home);
+  await mkdir(dirname(lockDir), { recursive: true });
+  try {
+    await mkdir(lockDir);
+  } catch (error) {
+    if (error.code === "EEXIST") return null;
+    throw error;
+  }
+  return async () => {
+    await rmdir(lockDir).catch(() => void 0);
+  };
+}
+function parseChangedSseBlock(block) {
+  let event = "message";
+  let data = "";
+  for (const line of block.split(/\r?\n/)) {
+    if (line.startsWith("event:")) event = line.slice(6).trim();
+    else if (line.startsWith("data:")) data += line.slice(5).trimStart();
+  }
+  if (event !== "changed" || !data) return null;
+  try {
+    const parsed = JSON.parse(data);
+    if (parsed.vault_id !== "central" || !Array.isArray(parsed.paths)) return null;
+    return { vault_id: "central", paths: parsed.paths.filter((path) => typeof path === "string") };
+  } catch {
+    return null;
+  }
+}
+async function applyMirrorPaths(opts) {
+  const ordered = orderMirrorPaths(opts.paths);
+  const release = await opts.lock();
+  if (!release) return { copied: [], skipped: ordered };
+  try {
+    const copied = [];
+    const skipped = [];
+    for (const rel of ordered) {
+      const body = await opts.getObject(rel);
+      if (!body) {
+        skipped.push(rel);
+        continue;
+      }
+      const result = await opts.write(rel, body);
+      if (result === "conflict") skipped.push(rel);
+      else copied.push(rel);
+    }
+    return { copied, skipped };
+  } finally {
+    await release();
+  }
+}
+function createS3GetObject(opts) {
+  const prefix = opts.prefix ?? "";
+  const resolveKey = (rel) => [prefix, rel].filter(Boolean).join("/");
+  return async (key) => {
+    if (!admitMirrorPath(key)) return null;
+    try {
+      const response = await opts.client.send(new GetObjectCommand({ Bucket: opts.bucket, Key: resolveKey(key) }));
+      if (!response.Body) return null;
+      const bytes = Buffer.from(await response.Body.transformToByteArray());
+      return bytes.length > opts.maxBytes ? null : bytes;
+    } catch (error) {
+      const status = error.$metadata?.httpStatusCode;
+      if (status === 404 || error.name === "NoSuchKey") return null;
+      throw error;
+    }
+  };
+}
+async function startMirrorListener(input) {
+  const fetchImpl = input.fetchImpl ?? fetch;
+  const write = (rel, body) => writeRegularExclusive(input.config.mirrorRoot, rel, body);
+  const lock = input.lock ?? (() => acquireWikiFetchPullLock(input.home));
+  let delayMs = 1e3;
+  while (!input.signal.aborted) {
+    try {
+      const response = await fetchImpl(input.eventsUrl, {
+        headers: { Authorization: `Bearer ${input.mcpToken}`, Accept: "text/event-stream" },
+        signal: input.signal
+      });
+      if (!response.ok || !response.body) throw new Error("sse unavailable");
+      delayMs = 1e3;
+      let buffer = "";
+      const reader = response.body.getReader();
+      const decoder = new TextDecoder();
+      while (!input.signal.aborted) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        buffer += decoder.decode(value, { stream: true }).replaceAll("\r\n", "\n");
+        let split;
+        while ((split = buffer.indexOf("\n\n")) >= 0) {
+          const block = buffer.slice(0, split);
+          buffer = buffer.slice(split + 2);
+          const changed = parseChangedSseBlock(block);
+          if (!changed) continue;
+          await applyMirrorPaths({ paths: changed.paths, getObject: input.getObject, write, lock });
+        }
+      }
+    } catch (error) {
+      if (input.signal.aborted) return;
+      if (error.name === "AbortError") return;
+      await new Promise((resolve) => setTimeout(resolve, delayMs));
+      delayMs = Math.min(delayMs * 2, 3e4);
+    }
+  }
+}
+function parseDestinationForMirror(destination) {
+  return parseDestination(destination);
+}
+export {
+  acquireWikiFetchPullLock,
+  admitMirrorPath,
+  applyMirrorPaths,
+  createS3GetObject,
+  eventsUrlFromMcp,
+  orderMirrorPaths,
+  parseChangedSseBlock,
+  parseDestinationForMirror,
+  startMirrorListener,
+  wikiFetchPullLockDir
+};

package/dist/runtime-VMFYW2K3.js

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+import {
+  assertClipS3Endpoint,
+  conditionalCreateProven,
+  evidencePath,
+  isRfc1918OrLoopback,
+  loadClipCredentials,
+  validateRuntime
+} from "./chunk-ABRYBO4T.js";
+import "./chunk-LOVLZNLX.js";
+import "./chunk-SKOLE6US.js";
+import "./chunk-7POLZOFY.js";
+export {
+  assertClipS3Endpoint,
+  conditionalCreateProven,
+  evidencePath,
+  isRfc1918OrLoopback,
+  loadClipCredentials,
+  validateRuntime
+};

package/dist/skillwiki-mcp.js

@@ -1,19 +1,21 @@
 #!/usr/bin/env node
 import {
   runSkillwikiMcpStdio
-} from "./chunk-OJJBZDPR.js";
-import "./chunk-JQV5KNPT.js";
+} from "./chunk-APKDTEVV.js";
+import "./chunk-RR6VDWSI.js";
 import "./chunk-7I2TPIV5.js";
-import "./chunk-MRPJ7X7W.js";
-import "./chunk-HBJLFPQP.js";
-import "./chunk-5IBLXGLY.js";
-import "./chunk-I6IRJCUJ.js";
-import "./chunk-X5GL2FCU.js";
-import "./chunk-TDBUJUYH.js";
-import "./chunk-6OQLBNKR.js";
-import "./chunk-PYPPG7RF.js";
-import "./chunk-GQWCTJTU.js";
-import "./chunk-UIEQIJXP.js";
+import "./chunk-IR2DI4Y5.js";
+import "./chunk-Q6EZF37H.js";
+import "./chunk-CKQPUHM2.js";
+import "./chunk-KJG2CSYD.js";
+import "./chunk-TKX6PSWZ.js";
+import "./chunk-DOHWNPAZ.js";
+import "./chunk-25OXNFDV.js";
+import "./chunk-EE7W3GLA.js";
+import "./chunk-ABRYBO4T.js";
+import "./chunk-LOVLZNLX.js";
+import "./chunk-SKOLE6US.js";
+import "./chunk-7POLZOFY.js";
 
 // src/mcp-entry.ts
 runSkillwikiMcpStdio().catch((error) => {

package/dist/sources-AOYP6ROO.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+import {
+  runSourcesPending
+} from "./chunk-RR6VDWSI.js";
+import "./chunk-CKQPUHM2.js";
+import "./chunk-TKX6PSWZ.js";
+import "./chunk-7POLZOFY.js";
+export {
+  runSourcesPending
+};

package/dist/{watcher-MHG46J3R.js → watcher-MGHQD3UI.js}

@@ -1,35 +1,35 @@
 #!/usr/bin/env node
 import {
-  sha256Hex
-} from "./chunk-ZRGZBAVS.js";
+  readJournal,
+  upsertJournal,
+  writeJournal
+} from "./chunk-FCA3RRNF.js";
 import {
   buildReadyHint
 } from "./chunk-OSL4J7GF.js";
 import {
-  runFetchGuardSync
-} from "./chunk-I2J3IJB7.js";
-import "./chunk-QESNTTVY.js";
+  readRegular
+} from "./chunk-K3M6OSUW.js";
 import {
-  readJournal,
-  upsertJournal,
-  writeJournal
-} from "./chunk-KWEYA3OE.js";
-import "./chunk-GQWCTJTU.js";
+  sha256Hex
+} from "./chunk-ZRGZBAVS.js";
+import "./chunk-QESNTTVY.js";
+import "./chunk-EE7W3GLA.js";
 import {
-  ipv4InCidr,
-  isBlockedHost
-} from "./chunk-UIEQIJXP.js";
+  assertPublicHttpsUrl
+} from "./chunk-LOVLZNLX.js";
+import "./chunk-7POLZOFY.js";
 
 // src/clip-outbox/watcher.ts
 import { createRequire } from "module";
 import { randomBytes as randomBytes2 } from "crypto";
 import { mkdir as mkdir2, readdir, rmdir, unlink, writeFile } from "fs/promises";
-import { basename, join as join2, resolve as resolve3 } from "path";
+import { basename, join as join2, resolve as resolve2 } from "path";
 
 // src/clip-outbox/seal.ts
 import { randomBytes } from "crypto";
-import { mkdir, open as open2 } from "fs/promises";
-import { dirname, join, relative as relative3 } from "path";
+import { mkdir, open } from "fs/promises";
+import { dirname, join, relative as relative2 } from "path";
 import yaml from "js-yaml";
 
 // src/clip-outbox/localize.ts
@@ -108,60 +108,6 @@ function localAssetRelPath(target) {
   return void 0;
 }
 
-// src/clip-outbox/ssrf.ts
-import { isIP } from "net";
-import { lookup as dnsLookup } from "dns/promises";
-var extraBlockedV4 = [
-  ["0.0.0.0", 8],
-  ["100.64.0.0", 10],
-  ["192.0.2.0", 24],
-  ["198.18.0.0", 15],
-  ["198.51.100.0", 24],
-  ["203.0.113.0", 24],
-  ["224.0.0.0", 4],
-  ["240.0.0.0", 4]
-];
-function isBlockedAddress(address) {
-  if (isBlockedHost(address)) return true;
-  const version = isIP(address);
-  if (version === 4) {
-    return extraBlockedV4.some(([base, prefix]) => ipv4InCidr(address, base, prefix));
-  }
-  if (version === 6) {
-    const lower = address.toLowerCase();
-    return lower === "::" || lower === "::1" || lower.startsWith("fc") || lower.startsWith("fd") || lower.startsWith("fe80:");
-  }
-  return false;
-}
-async function assertPublicHttpsUrl(url, lookup = defaultLookup) {
-  const guard = runFetchGuardSync({ url });
-  if (!guard.result.ok) {
-    return { ok: false, reason: guard.result.error };
-  }
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    return { ok: false, reason: "MALFORMED_URL" };
-  }
-  if (isBlockedAddress(parsed.hostname)) {
-    return { ok: false, reason: "HOST_BLOCKED" };
-  }
-  try {
-    const addresses = await lookup(parsed.hostname);
-    if (addresses.length === 0) return { ok: false, reason: "DNS_EMPTY" };
-    if (addresses.some(isBlockedAddress)) return { ok: false, reason: "HOST_BLOCKED" };
-  } catch {
-    return { ok: false, reason: "DNS_FAILED" };
-  }
-  return { ok: true, href: parsed.href };
-}
-async function defaultLookup(hostname) {
-  if (isIP(hostname)) return [hostname];
-  const v4 = await dnsLookup(hostname, { all: true, verbatim: true });
-  return v4.map((row) => row.address);
-}
-
 // src/clip-outbox/localize.ts
 var LocalizeError = class extends Error {
   constructor(message, code = "LOCALIZE_HELD") {
@@ -279,42 +225,6 @@ async function downloadImage(href, config, fetchImpl, lookup) {
   throw new LocalizeError("too many redirects");
 }
 
-// src/clip-outbox/files.ts
-import { constants } from "fs";
-import { lstat, open, realpath } from "fs/promises";
-import { isAbsolute as isAbsolute2, relative as relative2, resolve as resolve2, sep } from "path";
-async function readRegular(root, path, maxBytes) {
-  const rel = relative2(root, path);
-  if (!rel || rel.startsWith(`..${sep}`) || rel === ".." || isAbsolute2(rel)) throw new Error("unsafe input path");
-  let current = resolve2(root);
-  for (const part of ["", ...rel.split(sep)]) {
-    current = resolve2(current, part);
-    const st = await lstat(current);
-    if (st.isSymbolicLink()) throw new Error("symlink input refused");
-    if (current !== path && !st.isDirectory()) throw new Error("invalid input parent");
-  }
-  const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
-  try {
-    const before = await handle.stat();
-    if (!before.isFile() || before.size > maxBytes) throw new Error("input type or size refused");
-    const bytes = Buffer.alloc(before.size + 1);
-    let bytesRead = 0;
-    while (bytesRead < bytes.length) {
-      const chunk = await handle.read(bytes, bytesRead, bytes.length - bytesRead, bytesRead);
-      if (chunk.bytesRead === 0) break;
-      bytesRead += chunk.bytesRead;
-    }
-    const after = await handle.stat();
-    if (await realpath(path) !== path) throw new Error("input path changed during read");
-    const leaf = await lstat(path);
-    if (leaf.ino !== before.ino || leaf.dev !== before.dev) throw new Error("input identity changed during read");
-    if (bytesRead !== before.size || after.size !== before.size || after.mtimeMs !== before.mtimeMs) throw new Error("input changed during read");
-    return bytes.subarray(0, bytesRead);
-  } finally {
-    await handle.close();
-  }
-}
-
 // src/clip-outbox/seal.ts
 var UnstableCapture = class extends Error {
 };
@@ -325,7 +235,7 @@ function snapshotPath(config, entry, key) {
 }
 async function durableFile(root, path, bytes) {
   await mkdir(dirname(path), { recursive: true, mode: 448 });
-  const f = await open2(path, "wx", 384);
+  const f = await open(path, "wx", 384);
   try {
     await f.writeFile(bytes);
     await f.sync();
@@ -334,7 +244,7 @@ async function durableFile(root, path, bytes) {
   }
   let dir = dirname(path);
   while (true) {
-    const handle = await open2(dir, "r");
+    const handle = await open(dir, "r");
     try {
       await handle.sync();
     } finally {
@@ -383,7 +293,7 @@ async function sealCapture(config, entry, deps = {}) {
   return { ...entry, sourceSha256: sha256Hex(article), assetKeys: [...objects.keys()].filter((k) => k !== entry.articleKey), sha256: Object.fromEntries([...objects].map(([k, b]) => [k, sha256Hex(b)])), sizes: Object.fromEntries([...objects].map(([k, b]) => [k, b.length])), receipts: {}, state: "sealed", reason: void 0, attempts: 0, retryAt: void 0, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
 }
 function admittedArticle(root, path) {
-  const rel = relative3(root, path).replaceAll("\\", "/");
+  const rel = relative2(root, path).replaceAll("\\", "/");
   if (!rel.startsWith("raw/articles/") || !rel.endsWith(".md")) return false;
   return rel.split("/").every((part) => part !== "." && part !== ".." && !part.startsWith(".") && !/[\x00-\x1f]/.test(part) && !part.endsWith("~"));
 }
@@ -580,7 +490,7 @@ async function startClipWorker(config, deps) {
         requestScan();
         return;
       }
-      const absolute = resolve3(path);
+      const absolute = resolve2(path);
       if (admittedArticle(config.root, absolute)) schedule(absolute);
       else if (absolute.startsWith(join2(config.root, "raw/assets") + "/")) {
         for (const entry of entries) if (!entry.sourceSha256 && entry.source) schedule(entry.source);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillwiki",
-  "version": "0.10.111",
+  "version": "0.10.112",
   "type": "module",
   "bin": {
     "skillwiki": "dist/cli.js",

package/skills/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "skillwiki",
-  "version": "0.10.111",
+  "version": "0.10.112",
   "skills": "./",
   "description": "Project-aware Karpathy-style knowledge base for Claude Code: 22 prompt-only skills (wiki-*, proj-*, using-skillwiki, skillwiki-mcp, skillwiki-connect) backed by the deterministic `skillwiki` CLI.",
   "author": {

package/skills/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "skillwiki",
-  "version": "0.10.111",
+  "version": "0.10.112",
   "description": "Project-aware Karpathy-style knowledge base for Codex with 22 prompt-only skills backed by the deterministic skillwiki CLI.",
   "author": {
     "name": "karlorz",

package/skills/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "skillwiki",
-  "version": "0.10.111",
+  "version": "0.10.112",
   "description": "Project-aware Karpathy-style knowledge base: 22 prompt-only skills (wiki-*, proj-*, using-skillwiki, skillwiki-mcp, skillwiki-connect) backed by HTTP MCP wiki_capture.",
   "author": {
     "name": "karlorz"

package/skills/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skillwiki/skills",
-  "version": "0.10.111",
+  "version": "0.10.112",
   "private": true,
   "files": [
     "wiki-*",

package/skills/skills/using-skillwiki/SKILL.md

@@ -183,7 +183,7 @@ If the vault has `.WIKI_GIT_FROZEN`:
 ## Skill Map
 | Skill | When to Invoke |
 |-------|----------------|
-| `wiki-init` | Bootstrap a vault and install `_Templates/web-clipper/llm-wiki-clippings.json` plus import guidance. File-level clips use a dedicated `~/Obsidian/clip-outbox` vault, not `~/wiki`; `skillwiki doctor` reports clip-channel rows; `wiki_capture` is not clip ingress. |
+| `wiki-init` | Bootstrap a vault and install `_Templates/web-clipper/llm-wiki-clippings.json` plus import guidance. File-level clips use a dedicated `~/Obsidian/clip-outbox` vault, not `~/wiki`; `skillwiki doctor` reports clip-channel rows including the inbound `com.karlchow.skillwiki-mirror-sse` listener, which upgrades never auto-load; `wiki_capture` is not clip ingress. |
 | `wiki-ingest` | Convert URLs, files, or pasted text into typed-knowledge pages |
 | `wiki-query` | Search typed knowledge by default; work-queue / doctor / MCP diagnose questions use `wiki_context` or `--scope work` / `--scope all`; explicitly requested fresh/raw evidence uses the separate pending channel |
 | `wiki-lint` | Vault health and lint checks; use `health` for whole-system reports and `lint --summary` for bounded lint buckets |

package/skills/skills/wiki-init/SKILL.md

@@ -41,6 +41,9 @@ None for the first run.
    worker localizes required v1 HTTPS images before freeze, writes
    `![[raw/assets/...]]` embeds, and uploads `raw/assets/<capture-id>/note.md`.
    `wiki_capture` is not clip ingress. Never use `.txt` as the only index.
+   The inbound production SSE listener is a separate attended
+   `skillwiki clip-outbox install-or-migrate --load-mirror` job; package
+   upgrade never auto-loads it and never watches `~/wiki` as clip input.
 8. **Suggest first sources.** Propose 3–5 initial sources (URLs, papers, articles) appropriate to the domain. Prompt the user to provide the first one to ingest, then hand off to wiki-ingest.
 
 ## Stop conditions

package/skills/using-skillwiki/SKILL.md

@@ -183,7 +183,7 @@ If the vault has `.WIKI_GIT_FROZEN`:
 ## Skill Map
 | Skill | When to Invoke |
 |-------|----------------|
-| `wiki-init` | Bootstrap a vault and install `_Templates/web-clipper/llm-wiki-clippings.json` plus import guidance. File-level clips use a dedicated `~/Obsidian/clip-outbox` vault, not `~/wiki`; `skillwiki doctor` reports clip-channel rows; `wiki_capture` is not clip ingress. |
+| `wiki-init` | Bootstrap a vault and install `_Templates/web-clipper/llm-wiki-clippings.json` plus import guidance. File-level clips use a dedicated `~/Obsidian/clip-outbox` vault, not `~/wiki`; `skillwiki doctor` reports clip-channel rows including the inbound `com.karlchow.skillwiki-mirror-sse` listener, which upgrades never auto-load; `wiki_capture` is not clip ingress. |
 | `wiki-ingest` | Convert URLs, files, or pasted text into typed-knowledge pages |
 | `wiki-query` | Search typed knowledge by default; work-queue / doctor / MCP diagnose questions use `wiki_context` or `--scope work` / `--scope all`; explicitly requested fresh/raw evidence uses the separate pending channel |
 | `wiki-lint` | Vault health and lint checks; use `health` for whole-system reports and `lint --summary` for bounded lint buckets |

package/skills/wiki-init/SKILL.md

@@ -41,6 +41,9 @@ None for the first run.
    worker localizes required v1 HTTPS images before freeze, writes
    `![[raw/assets/...]]` embeds, and uploads `raw/assets/<capture-id>/note.md`.
    `wiki_capture` is not clip ingress. Never use `.txt` as the only index.
+   The inbound production SSE listener is a separate attended
+   `skillwiki clip-outbox install-or-migrate --load-mirror` job; package
+   upgrade never auto-loads it and never watches `~/wiki` as clip input.
 8. **Suggest first sources.** Propose 3–5 initial sources (URLs, papers, articles) appropriate to the domain. Prompt the user to provide the first one to ingest, then hand off to wiki-ingest.
 
 ## Stop conditions

package/templates/launchd/com.karlchow.skillwiki-mirror-sse.plist

@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key><string>com.karlchow.skillwiki-mirror-sse</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>@NODE_BINARY@</string>
+    <string>@CLI_BINARY@</string>
+    <string>clip-outbox</string><string>mirror-watch</string>
+  </array>
+  <key>EnvironmentVariables</key>
+  <dict><key>HOME</key><string>@HOME@</string><key>SKILLWIKI_HOME</key><string>@HOME@</string></dict>
+  <key>KeepAlive</key><true/>
+  <key>RunAtLoad</key><true/>
+  <key>ThrottleInterval</key><integer>10</integer>
+  <key>StandardOutPath</key><string>@LOG_ROOT@/clip-mirror-sse.log</string>
+  <key>StandardErrorPath</key><string>@LOG_ROOT@/clip-mirror-sse-error.log</string>
+</dict>
+</plist>