synabun 2.0.10 → 2.2.0

package/neural-interface/public/shared/skills/studio/sx-install-flow.js

@@ -0,0 +1,282 @@
+// ═══════════════════════════════════════════
+// SynaBun Neural Interface — Skills Studio 2.0: install in one go
+// ═══════════════════════════════════════════
+//
+// The one flow behind every Install of the Studio (the Publish tab's button, Review's "Approve & install", the
+// workspace banner): the service plans the install (POST /v2/installations/plan), the owner is asked one question
+// only when the plan asks one (a folder SynaBun did not install or that changed since, the scan's findings: what
+// lib/skills/deploy.js needs confirmed), and the install sends exactly that plan (its digest, the decisions per
+// target). A plan that changed under it is planned again, once, and asked again. The outcome comes back as data
+// (sx-install.js installOutcome) with its words. Every protection of the service is kept: nothing is written
+// without a plan, nothing replaced without its digest, nothing blocked is sent.
+
+import { scanFindingText } from './sx-scan.js';
+import { studioErrorText } from './sx-errors.js';
+import { html, setHTML } from './sx-dom.js';
+import { BLOCK_CODES, planModel, resultModel } from './sx-plan.js';
+import { installTargets, wholeTarget } from './sx-subject.js';
+import { confirmations, installOutcome, parseTargetKey, reviewDestinations, assistantsOf, installedRuntimesOf, alsoInstallTargets, alsoInstallRevision, alsoInstallScope } from './sx-install.js';
+
+// ── One install at a time per skill ──
+// Every surface that installs (the Publish tab's button, Review's card, the workspace banner) takes this lock for
+// the skill before it approves or plans, and lets it go when the flow ends, however it ends. While it is held every
+// surface shows the install as on its way and refuses a second one (a click, or Enter on a button it disables).
+const _busy = new Map();        // skillId → since
+const _watchers = new Set();    // told when a lock is taken or let go
+
+/** Whether an install of this skill is on its way, from any surface. */
+export const installBusy = (skillId) => !!skillId && _busy.has(skillId);
+
+/**
+ * Take the lock for a skill: what lets it go, or null when it is held already (the caller refuses).
+ * @param {string} skillId
+ * @returns {(() => void)|null}
+ */
+export function acquireInstall(skillId) {
+  if (!skillId || _busy.has(skillId)) return null;
+  _busy.set(skillId, Date.now());
+  tell(skillId, true);
+  let done = false;
+  return () => { if (done) return; done = true; _busy.delete(skillId); tell(skillId, false); };
+}
+
+/** Be told when a lock is taken or let go (the surfaces draw the install as on its way, or not). */
+export function onInstallBusy(fn) { _watchers.add(fn); return () => _watchers.delete(fn); }
+function tell(skillId, busy) { for (const fn of _watchers) { try { fn({ skillId, busy }); } catch { /* a watcher's own trouble */ } } }
+
+/** The words of a target: "Claude Code · all projects", "Codex · project Repo", "Claude Code · account work". */
+export function targetWords(ctx, tg) {
+  const { t } = ctx;
+  const runtime = t(`skillsStudio.runtime.${['claude', 'codex', 'opencode', 'antigravity', 'agents'].includes(tg?.runtime) ? tg.runtime : 'claude'}`);
+  if (tg?.scope === 'project') return t('skillsStudio.publish.targetProject', { runtime, project: tg.projectLabel || ctx.projects?.find((p) => p.path === tg.projectPath)?.label || tg.projectPath || '' });
+  if (tg?.accountId && tg.accountId !== 'default') return t('skillsStudio.publish.targetAccount', { runtime, account: tg.accountId });
+  return t('skillsStudio.publish.targetUser', { runtime });
+}
+
+/** The words of a target key (an install's result names targets by key). */
+export const keyWords = (ctx, key) => targetWords(ctx, parseTargetKey(key));
+
+/** A folder path, short: the home folder as ~ (the full path stays in the element's title). */
+export function shortPath(path) {
+  return String(path || '').replace(/^\/Users\/[^/]+(?=\/)/, '~').replace(/^\/home\/[^/]+(?=\/)/, '~').replace(/^[A-Za-z]:\\Users\\[^\\]+(?=\\)/, '~');
+}
+
+/** The owner's assistants in effect (read with the Library: GET /v2/status `assistants`), or null on an older server. */
+export function assistantsNow(ctx) { return assistantsOf(ctx.data?.status || null); }
+
+/** The runtimes the resolver found on this computer (GET /v2/status `assistants.installed`), or null when not known. */
+export function installedNow(ctx) { return installedRuntimesOf(ctx.data?.status || null); }
+
+/**
+ * "Also install for Codex · OpenCode": the assistants in effect that a skill installed somewhere does not reach yet
+ * (sx-install.js alsoInstallTargets), with their words. Empty when there is nothing to add.
+ */
+export function alsoInstall(ctx, { skill, row }) {
+  // A skill installed for one project only adds to that project (sx-install.js alsoInstallScope); its words say so.
+  const scope = alsoInstallScope(skill);
+  const project = scope.startsWith('project:') ? scope.slice(8) : null;
+  const targets = alsoInstallTargets({ skill, row, targets: targetsNow(ctx, { projects: project ? [project] : [] }), assistants: assistantsNow(ctx), installed: installedNow(ctx) });
+  return { targets: targets.map(wholeTarget), words: targets.map((t) => (project ? targetWords(ctx, t) : ctx.t(`skillsStudio.runtime.${t.runtime}`))).join(' · ') };
+}
+
+/**
+ * One press: the version that is installed already (sx-install.js alsoInstallRevision) goes to the assistants that lack it, through the one flow (the plan, one question only when it asks one,
+ * then exactly that plan). The outcome's words come back for a toast or a banner; null when nothing was to add.
+ */
+export async function alsoInstallNow(ctx, { skill, row }) {
+  const { t } = ctx;
+  const { targets } = alsoInstall(ctx, { skill, row });
+  if (!targets.length || ctx.guest) return null;
+  const revisionId = alsoInstallRevision(skill);
+  if (!revisionId) return { kind: 'error', line: t('skillsStudio.publish.noVersion'), lines: [] };
+  const release = acquireInstall(skill.skillId);
+  if (!release) return { kind: 'error', line: t('skillsStudio.publish.busyElsewhere'), lines: [] };
+  let out;
+  try { out = await installFlow(ctx, { revisionId, targets }); } catch (err) { out = { status: 'failed', error: studioErrorText(ctx.t, err) }; } finally { release(); }
+  return flowWords(ctx, out);
+}
+
+/** The targets a skill can be installed into now, with the shared folder as Settings has it (read with the Library). */
+export function targetsNow(ctx, { projects = [] } = {}) {
+  const config = ctx.data?.config || { sharedAgentsRoot: false };
+  return installTargets({ roots: ctx.data?.catalog?.roots || [], config, projects: ctx.projects.filter((p) => projects.includes(p.path)) });
+}
+
+/**
+ * Where a review's install goes (sx-install.js reviewDestinations), from the same targets every surface uses: the
+ * label a button shows and the targets its click sends are one computation. `targets` as requests name them;
+ * `words` each destination in words; `missing` what the submission named that is not available here, with why.
+ */
+export function reviewTargets(ctx, { review, skill, row }) {
+  const projects = [...new Set((review?.targets || []).filter((x) => x?.scope === 'project' && x.projectPath && ctx.projects.some((p) => p.path === x.projectPath)).map((x) => x.projectPath))];
+  const all = targetsNow(ctx, { projects });
+  const d = reviewDestinations({ review, targets: all, skill, row, assistants: assistantsNow(ctx) });
+  return {
+    targets: d.targets.map(wholeTarget), all, keys: d.keys, named: d.named, fallback: d.fallback,
+    words: all.filter((t) => d.keys.has(t.key)).map((t) => targetWords(ctx, t)),
+    missing: d.missing.map((m) => ({ ...m, words: targetWords(ctx, m.target), why: ctx.t(`skillsStudio.publish.unavailable.${m.reason}`) })),
+  };
+}
+
+/**
+ * The workspaces of a skill read it again (its installations, pointers) after an install from another surface, so
+ * their header pill, banners and Publish say what the Library row says. `resetPublish` starts their Publish over.
+ */
+export async function refreshSkillWorkspaces(ctx, skillId, { resetPublish = false } = {}) {
+  if (!skillId) return;
+  let fresh = null;
+  try { fresh = (await ctx.api.fetchSkill(skillId)).skill; } catch { return; }
+  for (const ws of ctx.workspaces.values()) {
+    if (ws.skill?.skillId !== skillId) continue;
+    ws.skill = fresh;
+    if (resetPublish) { ws.pub = null; ws.publishReviewId = null; ws.publishRevisionId = null; }
+  }
+}
+
+/**
+ * The refresh hints of an outcome, worded (one per runtime that needs something). A runtime the resolver did not
+ * find on this computer is said as such: the copy waits in its folder, and nothing lists it until it is installed.
+ */
+export function refreshWords(ctx, outcome) {
+  const installed = installedNow(ctx);
+  return (outcome?.refresh || []).map((x) => {
+    const kind = Array.isArray(installed) && ['claude', 'codex', 'opencode', 'antigravity'].includes(x.runtime) && !installed.includes(x.runtime) ? 'not-installed' : x.kind;
+    return ctx.t(`skillsStudio.publish.refresh.${kind}`, { runtime: ctx.t(`skillsStudio.runtime.${x.runtime}`) });
+  });
+}
+
+/** Why a runtime's settings turn the skill off, in words (sx-plan.js eligibility reason). */
+export function eligibilityWords(ctx, runtime, reason) {
+  const { t } = ctx;
+  const name = t(`skillsStudio.runtime.${['claude', 'codex', 'opencode', 'antigravity', 'agents'].includes(runtime) ? runtime : 'claude'}`);
+  const file = shortPath(reason?.file || '');
+  const kind = ['codex-config', 'claude-override', 'claude-deny', 'opencode-permission', 'unreadable', 'invalid-json'].includes(reason?.kind) ? reason.kind : 'other';
+  return t(`skillsStudio.publish.eligibility.reason.${kind}`, { runtime: name, file, pattern: reason?.pattern || '*', rule: reason?.rule || reason?.key || '' });
+}
+
+/**
+ * The owner pressed "Enable for <runtime>" on a plan line: the runtime setting that turns the skill off is changed by
+ * the server over a backup (POST /v2/eligibility/enable); the words of what happened come back for a toast. A plan
+ * is made again by the caller: this changes no file of the skill.
+ * @returns {Promise<{ ok: boolean, line: string }>}
+ */
+export async function enableFor(ctx, { runtime, line }) {
+  const { t } = ctx;
+  const name = t(`skillsStudio.runtime.${runtime}`);
+  const target = parseTargetKey(line.targetKey);
+  const sep = line.destination && line.destination.includes('\\') && !line.destination.includes('/') ? '\\' : '/';
+  const body = { runtime, name: line.destination ? line.destination.split(/[\\/]/).pop() : '', skillMd: `${line.destination}${sep}SKILL.md`, accountId: target.accountId, projectPath: target.projectPath };
+  const said = (out) => (out.changed === false ? { ok: true, line: t('skillsStudio.publish.enableNothing', { runtime: name }) } : { ok: out.ok !== false, line: t('skillsStudio.publish.enabled', { runtime: name, file: shortPath(out.file || ''), backup: shortPath(out.backup || '') }) });
+  try {
+    return said(await ctx.api.enableSkillsEligibility(body));
+  } catch (err) {
+    // OpenCode's rules deny every skill: loosened only after the owner's word (the server refuses first).
+    if (err?.code === 'deny_all' && runtime === 'opencode' && typeof ctx.ask === 'function') {
+      const answer = await ctx.ask({
+        title: t('skillsStudio.publish.enableDenyAllTitle', { runtime: name }),
+        lines: [t('skillsStudio.publish.enableDenyAllBody', { file: shortPath(err.body?.file || err.file || '') })],
+        buttons: [{ id: 'cancel', label: t('skillsStudio.dialog.cancel') }, { id: 'go', label: t('skillsStudio.publish.enableDenyAllGo'), kind: 'danger' }],
+        focus: 'cancel',
+      });
+      if (answer !== 'go') return { ok: false, line: t('skillsStudio.publish.enableFailed', { runtime: name, error: studioErrorText(ctx.t, err) }) };
+      try { return said(await ctx.api.enableSkillsEligibility({ ...body, confirmDenyAll: true })); } catch (e2) { return { ok: false, line: t('skillsStudio.publish.enableFailed', { runtime: name, error: studioErrorText(ctx.t, e2) }) }; }
+    }
+    return { ok: false, line: t('skillsStudio.publish.enableFailed', { runtime: name, error: studioErrorText(ctx.t, err) }) };
+  }
+}
+
+/** An outcome in words: the line, the hints for open sessions, what failed. */
+export function outcomeWords(ctx, outcome) {
+  const { t } = ctx;
+  const where = outcome.ok.map((k) => keyWords(ctx, k)).join(', ');
+  const failed = outcome.failed.map((f) => keyWords(ctx, f.targetKey)).join(', ');
+  const reason = (f) => f?.code && BLOCK_CODES.includes(f.code) ? t(`skillsStudio.publish.blocked.${f.code}`) : f?.code || f?.reason ? studioErrorText(t, f) : f ? t(`skillsStudio.publish.result.${f.status}`) : failed;
+  const line = outcome.ok.length && !outcome.failed.length ? t('skillsStudio.publish.doneFor', { where })
+    : outcome.ok.length ? t('skillsStudio.publish.doneSome', { where, failed })
+      : t('skillsStudio.publish.doneNone', { reason: reason(outcome.failed[0]) });
+  return { line, refresh: refreshWords(ctx, outcome), failed: outcome.failed.map((f) => `${keyWords(ctx, f.targetKey)}: ${reason(f)}`) };
+}
+
+/** What blocks a plan's targets, in words (one line per target). */
+export function blockedWords(ctx, rows) {
+  const { t } = ctx;
+  return (rows || []).map((r) => t('skillsStudio.publish.blockedFor', { target: keyWords(ctx, r.targetKey), reason: r.blocked.map((b) => t(`skillsStudio.publish.blocked.${b.code}`)).join(' ') }));
+}
+
+/**
+ * Ask what the plan asks, in one question, or nothing when it asks nothing.
+ * @returns {Promise<object|null>} the decisions to send (empty when nothing was asked), null when the owner said no
+ */
+export async function askConfirmations(ctx, model) {
+  const { t } = ctx;
+  const c = confirmations(model);
+  if (!c.replace.length && !c.scan.length) return c.decisions;
+  const box = document.createElement('div');
+  box.className = 'sx-confirm-list';
+  setHTML(box, html`${c.replace.map((r) => html`<p class="sx-confirm-item"><strong>${keyWords(ctx, r.targetKey)}</strong>: <span class="sx-mono">${shortPath(r.destination)}</span> ${t(`skillsStudio.publish.confirmWhy.${r.replace.state === 'modified' ? 'modified' : 'unowned'}`)} ${t('skillsStudio.publish.confirmReplaced')}</p>`)}
+    ${c.scan.map((r) => html`<div class="sx-confirm-item"><p><strong>${keyWords(ctx, r.targetKey)}</strong>: ${t('skillsStudio.publish.confirmScanLine')}</p>
+      <ul class="sx-findings">${r.scanAck.findings.map((f) => html`<li class="sx-finding sx-finding--${f.severity}"><span class="sx-finding-sev">${t(`skillsStudio.review.severity.${['critical', 'high', 'medium', 'low'].includes(f.severity) ? f.severity : 'low'}`)}</span> ${scanFindingText(t, f)}${f.file ? html` <span class="sx-mono sx-dim">${f.file}${f.line ? `:${f.line}` : ''}</span>` : ''}</li>`)}</ul></div>`)}`);
+  const answer = await ctx.ask({
+    title: t('skillsStudio.publish.confirmTitle'),
+    lines: [t(c.replace.length ? 'skillsStudio.publish.confirmBodyReplace' : 'skillsStudio.publish.confirmBodyScan')],
+    extra: box,
+    buttons: [{ id: 'cancel', label: t('skillsStudio.dialog.cancel') }, { id: 'go', label: t(c.replace.length ? 'skillsStudio.publish.confirmGo' : 'skillsStudio.publish.confirmGoScan'), kind: c.replace.length ? 'danger' : 'primary' }],
+    focus: 'cancel',
+    wide: c.scan.length > 0,
+  });
+  return answer === 'go' ? c.decisions : null;
+}
+
+/**
+ * Plan, ask only what must be asked, install exactly that plan.
+ * @param {object} ctx the Studio's context
+ * @param {{ revisionId: string, targets: object[], reviewId?: string|null, plan?: object|null, onPlanned?: (model: object) => void }} o
+ *   plan: a plan already made for exactly this ask (sx-plan.js planModel): used instead of asking for one
+ * @returns {Promise<{ status: 'done'|'blocked'|'cancelled'|'plan-failed'|'failed'|'gone', plan?: object, results?: object[], outcome?: object, blocked?: object[], error?: string }>}
+ */
+export async function installFlow(ctx, { revisionId, targets, reviewId = null, plan = null, onPlanned = null }) {
+  const gen = ctx.gen();
+  let model = plan;
+  for (let attempt = 0; attempt < 2; attempt++) {
+    if (!model) {
+      try { model = planModel((await ctx.api.planSkillsInstall(revisionId, targets)).plan); } catch (err) { return { status: 'plan-failed', error: studioErrorText(ctx.t, err) }; }
+      if (!ctx.alive(gen)) return { status: 'gone' };
+      onPlanned?.(model);
+    }
+    const c = confirmations(model);
+    if (!c.ready.length) return { status: 'blocked', plan: model, blocked: c.blocked };
+    const decisions = await askConfirmations(ctx, model);
+    if (!ctx.alive(gen)) return { status: 'gone' };
+    if (decisions === null) return { status: 'cancelled', plan: model };
+    let result = null;
+    try {
+      result = await ctx.api.installSkillsRevision({ revisionId, targets, planDigest: model.planDigest, decisions, ...(reviewId ? { reviewId } : {}) });
+    } catch (err) {
+      if (!ctx.alive(gen)) return { status: 'gone' };
+      if (err?.status === 207 && err.body) result = err.body;
+      else if (err?.code === 'plan_changed' && err.body?.plan) { model = planModel(err.body.plan); onPlanned?.(model); continue; }   // what is there changed meanwhile: planned again, asked again
+      else return { status: 'failed', error: studioErrorText(ctx.t, err), plan: model };
+    }
+    if (!ctx.alive(gen)) return { status: 'gone' };
+    const results = resultModel(result);
+    return { status: 'done', plan: model, results, outcome: installOutcome(results), blocked: c.blocked };
+  }
+  return { status: 'failed', error: ctx.t('skillsStudio.publish.planChanged'), plan: model };
+}
+
+/**
+ * The words a finished flow gets, for a toast and a notice: null when nothing is to be said (gone, cancelled).
+ * @returns {{ kind: 'info'|'error', line: string, lines: string[] }|null}
+ */
+export function flowWords(ctx, out) {
+  const { t } = ctx;
+  if (!out || out.status === 'gone' || out.status === 'cancelled') return null;
+  if (out.status === 'done') {
+    const w = outcomeWords(ctx, out.outcome);
+    const extra = [...w.refresh, ...w.failed, ...blockedWords(ctx, out.blocked)];
+    return { kind: out.outcome.all ? 'info' : 'error', line: w.line, lines: extra };
+  }
+  if (out.status === 'blocked') return { kind: 'error', line: t('skillsStudio.publish.notInstalledBlocked'), lines: blockedWords(ctx, out.blocked) };
+  if (out.status === 'plan-failed') return { kind: 'error', line: t('skillsStudio.publish.planFailed', { error: out.error }), lines: [] };
+  return { kind: 'error', line: t('skillsStudio.publish.installFailed', { error: out.error || '' }), lines: [] };
+}

package/neural-interface/public/shared/skills/studio/sx-install.js

@@ -0,0 +1,313 @@
+// ═══════════════════════════════════════════
+// SynaBun Neural Interface — Skills Studio 2.0: the simple install flow, as data
+// ═══════════════════════════════════════════
+//
+// Installing an approved skill is one decision (where) and one press (Install). This module decides, without a
+// page: the one status a library skill shows everywhere (the workspace header, its Library row, the banner), what
+// is ticked when Publish opens (the review's targets, else where the skill already is, else Claude Code for every
+// project: never everything), the simple picker (one tile per runtime in one scope; everything else, accounts,
+// the shared folder, other projects, lives under Advanced and is only reported here), the version picked by
+// default (the approved one when the latest was made by an agent and is not approved), the one line each target
+// of a plan gets (what will happen there, as a code the view words), what an install must ask first (a folder
+// SynaBun did not install or that changed since, the scan's findings) and never asks otherwise, the words of the
+// one button, and the outcome of an install. The plan and the install themselves stay the service's
+// (lib/skills/deploy.js) through sx-plan.js: nothing here changes what is sent, only what is asked and shown.
+// No DOM; imports sx-subject.js and sx-plan.js only.
+
+import { targetKey, targetState, defaultTargets, seenThrough } from './sx-subject.js';
+import { installableRows, decisionsOf } from './sx-plan.js';
+
+export const STATUS_CODES = Object.freeze(['draft', 'review', 'changes', 'approved', 'installed', 'outdated', 'none']);
+export const LINE_CODES = Object.freeze(['create', 'replace-owned', 'replace-modified', 'replace-unowned', 'identical', 'blocked']);
+// What a tile says of a runtime: the target's state, 'via-claude' when OpenCode sees the skill through Claude Code's
+// folder (ticked, or holding it) and is not ticked itself, 'unavailable' when there is no folder for it here.
+export const TILE_STATES = Object.freeze(['installed', 'outdated', 'present', 'bridge', 'none', 'off', 'unavailable', 'via-claude', 'not-installed']);
+
+/** The runtimes that are installed on this computer (the status' `assistants.installed`), or null when not known. */
+export function installedRuntimesOf(source) {
+  const list_ = source?.assistants?.installed ?? source?.installed ?? null;
+  return Array.isArray(list_) ? list_.filter((r) => typeof r === 'string') : null;
+}
+
+/**
+ * "Also install for Codex · OpenCode": the assistants in effect (user scope, default account) that do not have a
+ * skill that is installed somewhere already; empty when nothing is missing, when nothing is installed yet (Publish
+ * is the way), or when the skill is not a library skill. A runtime known not to be installed here is left out.
+ * @param {{ skill?: object|null, row?: object|null, targets: object[], assistants?: string[]|null, installed?: string[]|null }} o
+ * @returns {object[]} targets of installTargets()
+ */
+export function alsoInstallTargets({ skill = null, row = null, targets = [], assistants = null, installed = null } = {}) {
+  if (!skill || row?.source === 'synabun' || !list(skill.installations).length) return [];
+  const wanted = Array.isArray(assistants) && assistants.length ? assistants : [];
+  const scope = alsoInstallScope(skill);
+  return SIMPLE_RUNTIMES.filter((r) => wanted.includes(r) && !(Array.isArray(installed) && !installed.includes(r)))
+    .map((r) => list(targets).find((t) => t.key === keyIn(r, scope)) || null)
+    .filter((t) => t && !t.off && !['installed', 'outdated', 'present'].includes(targetState(t, { skill, row }).state));
+}
+
+/**
+ * The scope "Also install for …" adds to: the one project every installation is in (a skill installed for one
+ * project only is never offered to every project), else the owner's ('user').
+ */
+export function alsoInstallScope(skill) {
+  const installs = list(skill?.installations);
+  const projects = new Set(installs.map((i) => (i?.scope === 'project' && i.projectPath ? i.projectPath : '')));
+  return projects.size === 1 && !projects.has('') ? `project:${[...projects][0]}` : 'user';
+}
+
+/**
+ * The version "Also install for …" sends: the one the installations hold (the one most of them hold when they
+ * differ; on a tie the approved one, then the latest), else the approved one, else the latest; null for none.
+ */
+export function alsoInstallRevision(skill) {
+  const held = list(skill?.installations).map((i) => i?.sourceRevisionId).filter((r) => typeof r === 'string' && r);
+  const pointers = skill?.pointers || {};
+  if (!held.length) return pointers.approved || pointers.latest || null;
+  const count = new Map();
+  for (const r of held) count.set(r, (count.get(r) || 0) + 1);
+  const rank = (r) => (r === pointers.approved ? 2 : r === pointers.latest ? 1 : 0);
+  return [...count.entries()].sort((a, b) => b[1] - a[1] || rank(b[0]) - rank(a[0]) || held.indexOf(a[0]) - held.indexOf(b[0]))[0][0];
+}
+export const BUTTON_CODES = Object.freeze(['install', 'update', 'installed', 'checking', 'installing', 'nothing', 'blocked']);
+export const SIMPLE_RUNTIMES = Object.freeze(['claude', 'codex', 'opencode', 'antigravity']);
+// The runtimes with a project folder of their own. Antigravity has none: in a project it reads .agents/skills, the
+// Codex tile's folder, so a project scope shows no Antigravity tile (the plan says Antigravity reads that folder).
+const PROJECT_RUNTIMES = new Set(['claude', 'codex', 'opencode']);
+const inProject = (scope) => String(scope || '').startsWith('project:');
+const APPROVED_STATES = ['approved', 'partial', 'publish_failed'];
+
+const list = (v) => (Array.isArray(v) ? v : []);
+
+/** Where an installation is, as a target (the view words it: "Claude Code · all projects"). */
+export function whereOf(i) {
+  const scope = i?.scope === 'project' ? 'project' : 'user';
+  return { runtime: i?.runtime || 'claude', scope, projectPath: scope === 'project' ? i.projectPath || null : null, accountId: scope === 'user' ? i?.accountId || 'default' : 'default', outdated: !!i?.updateAvailable };
+}
+
+/**
+ * The one status of a library skill: draft (no version yet), in review, changes asked for, approved but not
+ * installed, installed (where), installed with an update available, or not installed. Null for what is not a
+ * library skill (a plugin's, SynaBun's own, a folder not adopted): those keep their source and health.
+ * @param {{ skill?: object|null, row?: object|null }} o the library summary (GET /skills) and its Library row
+ */
+export function installStatus({ skill = null, row = null } = {}) {
+  if (!skill || row?.source === 'synabun') return null;
+  const installs = list(skill.installations);
+  const review = row?.review || null;
+  const reviewState = review?.state || null;
+  if (installs.length) {
+    const outdated = !row?.keptUpdate && installs.some((i) => !!i.updateAvailable);
+    return { code: outdated ? 'outdated' : 'installed', where: installs.map(whereOf), reviewState, reviewId: review?.reviewId || null };
+  }
+  if (reviewState === 'pending') return { code: 'review', where: [], reviewState, reviewId: review.reviewId };
+  if (reviewState === 'changes_requested') return { code: 'changes', where: [], reviewState, reviewId: review.reviewId };
+  if (APPROVED_STATES.includes(reviewState)) return { code: 'approved', where: [], reviewState, reviewId: review.reviewId };
+  if (!skill.revisions) return { code: 'draft', where: [], reviewState: null, reviewId: null };
+  return { code: 'none', where: [], reviewState: null, reviewId: null };
+}
+
+/**
+ * What is ticked when Publish opens: the targets the review named (those that exist and are on), else where the
+ * skill already is, else the owner's assistants (sx-subject.js defaultTargets: never everything, no second copy
+ * for a runtime that reads a ticked folder).
+ * @param {{ review?: object|null, targets: object[], skill?: object|null, row?: object|null, assistants?: string[]|null }} o targets: sx-subject.js installTargets()
+ * @returns {Set<string>} target keys
+ */
+export function defaultSelection({ review = null, targets = [], skill = null, row = null, assistants = null } = {}) {
+  const named = list(review?.targets).filter((x) => x && typeof x.runtime === 'string');
+  const keys = new Set(named.map((x) => targetKey(x)));
+  const fromReview = targets.filter((x) => !x.off && keys.has(x.key)).map((x) => x.key);
+  if (fromReview.length) return new Set(fromReview);
+  // The review named targets and none of them is here (another computer's project, the shared folder off): nothing
+  // is ticked, and the view says what is missing; never a silent fallback to the assistants.
+  if (named.length) return new Set();
+  return defaultTargets(targets, { skill, row, assistants });
+}
+
+/** The assistants in effect (GET /v2/config or /status `assistants.effective`), or null when the server has none. */
+export function assistantsOf(source) {
+  const list_ = source?.assistants?.effective ?? source?.effective ?? null;
+  return Array.isArray(list_) && list_.length ? list_.filter((r) => typeof r === 'string') : null;
+}
+
+/** The scope a selection sits in: 'user', 'project:<path>' when every ticked target is of one project, else null (mixed). */
+export function scopeOf(checked, targets) {
+  const picked = list(targets).filter((t) => checked?.has?.(t.key));
+  const scopes = new Set(picked.map((t) => (t.scope === 'project' ? `project:${t.projectPath}` : 'user')));
+  if (scopes.size === 1) return [...scopes][0];
+  return scopes.size ? null : 'user';
+}
+
+/** The key of a runtime's target in a scope ('user' or 'project:<path>'), the default account. */
+export const keyIn = (runtime, scope) => (scope && scope.startsWith('project:') ? `${runtime}:project:${scope.slice(8)}` : `${runtime}:user:default`);
+
+/**
+ * The simple picker: one tile per runtime for the scope chosen (ticked or not, what is there now), and whatever
+ * else is ticked (another account, the shared folder, another project: changed under Advanced only).
+ * @param {{ targets: object[], checked: Set<string>, scope: string, skill?: object|null, row?: object|null, revisionId?: string|null }} o
+ */
+export function simplePicker({ targets = [], checked = new Set(), scope = 'user', skill = null, row = null, revisionId = null, installed = null } = {}) {
+  const tiles = SIMPLE_RUNTIMES.filter((runtime) => !inProject(scope) || PROJECT_RUNTIMES.has(runtime)).map((runtime) => {
+    const key = keyIn(runtime, scope);
+    const target = list(targets).find((t) => t.key === key) || null;
+    const st = target ? targetState(target, { skill, row, revisionId }) : { state: 'none', path: null };
+    const on = !!target && checked.has(key);
+    const available = !!target && !target.off;
+    // A terminal OpenCode reads Claude Code's folder: with that one ticked (or holding the skill) and OpenCode not
+    // ticked, the tile says so; SynaBun's own OpenCode panel does not read it, so the tile also says a copy is needed.
+    const via = available && !on && st.state === 'none' ? seenThrough(runtime, list(targets), checked, { scope, skill, row }) : null;
+    // A runtime the resolver did not find on this computer: said on the tile (the folder can still be written for a
+    // later install of the runtime; nothing fails), never ticked by default (the detected assistants leave it out).
+    const notInstalled = Array.isArray(installed) && !installed.includes(runtime);
+    const tileState = !available ? 'unavailable' : notInstalled && st.state === 'none' ? 'not-installed' : via ? 'via-claude' : st.state;
+    return { runtime, key, target, on, available, state: target ? st.state : 'none', path: st.path || target?.path || null, via, notInstalled, tileState };
+  });
+  const own = new Set(tiles.map((x) => x.key));
+  // What is ticked beyond the tiles, and would be sent: a target that is off (the shared folder turned off in
+  // Settings) is never sent, so it is neither counted nor listed.
+  const extra = list(targets).filter((t) => checked.has(t.key) && !own.has(t.key) && !t.off);
+  return { tiles, extra };
+}
+
+/** The selection moved to another scope: each ticked tile of `from` is ticked in `to` instead; the rest stays. */
+export function moveScope(checked, from, to) {
+  const next = new Set();
+  for (const key of checked || []) {
+    const runtime = SIMPLE_RUNTIMES.find((r) => key === keyIn(r, from));
+    // A runtime with no folder of its own in the new scope (Antigravity in a project) is not ticked there.
+    if (runtime && inProject(to) && !PROJECT_RUNTIMES.has(runtime)) continue;
+    next.add(runtime ? keyIn(runtime, to) : key);
+  }
+  return next;
+}
+
+/**
+ * The version Publish picks by default: the one asked for, else what SynaBun ships for its own skill, else the
+ * latest, unless the latest was made by an agent and is not the approved one (then the approved one: the latest
+ * would be refused until it is reviewed).
+ * @param {{ skill?: object|null, revisions?: object[], bundled?: boolean, asked?: string|null }} o
+ */
+export function defaultRevisionId({ skill = null, revisions = [], bundled = false, asked = null } = {}) {
+  if (asked) return asked;
+  const p = skill?.pointers || {};
+  if (bundled) return p.upstream || p.approved || p.latest || null;
+  const latest = list(revisions).find((r) => r.revisionId === p.latest) || null;
+  const agentMade = !!latest && ['assistant', 'agent'].includes(latest.author?.kind);
+  if (agentMade && p.approved && p.approved !== p.latest) return p.approved;
+  return p.latest || p.approved || null;
+}
+
+/** The one plain label of a version in the install path (the rest, candidate and best, stay in Versions). */
+export function plainLabel(labels) {
+  const l = list(labels);
+  if (l.includes('approved')) return 'approved';
+  if (l.includes('upstream')) return 'upstream';
+  if (l.includes('latest')) return 'latest';
+  return null;
+}
+
+/**
+ * One line per target of a plan (sx-plan.js planModel): what will happen there, as a code. `asks` says what the
+ * owner is asked before it goes (a folder to replace, the scan's findings); `notes` are secondary facts.
+ */
+export function planLines(model) {
+  return list(model?.rows).map((row) => {
+    let code = 'create';
+    if (row.blocked.length) code = 'blocked';
+    else if (row.state === 'identical') code = 'identical';
+    else if (row.replace) code = row.replace.state === 'modified' ? 'replace-modified' : 'replace-unowned';
+    else if (row.state === 'owned') code = 'replace-owned';
+    return {
+      targetKey: row.targetKey, runtime: row.runtime, scope: row.scope, accountId: row.accountId, projectPath: row.projectPath,
+      code, destination: row.destination || null,
+      blocked: row.blocked, asks: { replace: !!row.replace, scan: !!row.scanAck },
+      alsoReadBy: row.affectedRuntimes.filter((r) => r !== row.runtime),
+      overlap: row.overlap, transforms: row.transforms, refresh: row.refresh, name: row.name || '',
+      // The runtimes whose own settings turn a skill of this name off here (the view offers "Enable for …").
+      disabledFor: Object.entries(row.eligibility || {}).filter(([, e]) => e.state === 'disabled').map(([runtime, e]) => ({ runtime, reason: e.reason })),
+      unknownFor: Object.entries(row.eligibility || {}).filter(([, e]) => e.state === 'unknown' && e.reason).map(([runtime, e]) => ({ runtime, reason: e.reason })),
+    };
+  });
+}
+
+/**
+ * What an install must ask first, and nothing else: the folders to replace (not SynaBun's, or changed since) and
+ * the scan findings to read; what is blocked is said, never asked; the rest goes without a question.
+ * @returns {{ replace: object[], scan: object[], blocked: object[], ready: object[], decisions: object }} decisions:
+ *   what the install sends when the owner confirms everything asked (sx-plan.js decisionsOf)
+ */
+export function confirmations(model) {
+  const rows = list(model?.rows);
+  const replace = rows.filter((r) => !r.blocked.length && r.replace);
+  const scan = rows.filter((r) => !r.blocked.length && r.scanAck);
+  const blocked = rows.filter((r) => r.blocked.length);
+  const keys = { replace: replace.map((r) => r.targetKey), scan: scan.map((r) => r.targetKey) };
+  return { replace, scan, blocked, ready: installableRows(model, keys), decisions: decisionsOf(model, keys) };
+}
+
+/**
+ * The one button: its code and whether it can be pressed.
+ * @param {{ picked: number, states?: string[], model?: object|null, checking?: boolean, busy?: boolean, error?: boolean }} o
+ *   picked: how many targets are ticked; states: what each ticked target has now (targetState); model: the plan
+ */
+export function installButton({ picked = 0, states = [], model = null, checking = false, busy = false, error = false } = {}) {
+  if (busy) return { code: 'installing', enabled: false };
+  if (!picked) return { code: 'nothing', enabled: false };
+  if (checking || (!model && !error)) return { code: 'checking', enabled: false };
+  if (error) return { code: 'install', enabled: false };
+  const rows = list(model?.rows);
+  if (rows.length && rows.every((r) => r.blocked.length)) return { code: 'blocked', enabled: false };
+  if (rows.length && rows.every((r) => r.blocked.length || r.state === 'identical')) return { code: 'installed', enabled: false };
+  return { code: states.includes('outdated') ? 'update' : 'install', enabled: true };
+}
+
+/** An install's outcome (sx-plan.js resultModel), summed up: where it went, where it did not, how sessions pick it up. */
+export function installOutcome(results) {
+  const rows = list(results);
+  const ok = rows.filter((r) => r.status === 'committed');
+  const failed = rows.filter((r) => r.status !== 'committed');
+  const refresh = [];
+  for (const r of ok) for (const x of r.refresh) if (x.kind !== 'automatic' && !refresh.some((y) => y.runtime === x.runtime && y.kind === x.kind)) refresh.push({ runtime: x.runtime, kind: x.kind });
+  return { ok: ok.map((r) => r.targetKey), failed: failed.map((r) => ({ targetKey: r.targetKey, status: r.status, reason: r.error || r.reasons[0]?.message || '', ...(r.code || r.reasons[0]?.code ? { code: r.code || r.reasons[0].code } : {}) })), refresh, all: rows.length > 0 && !failed.length };
+}
+
+/** A target key back as a target ({ runtime, scope, accountId, projectPath }): the words the view gives it. */
+export function parseTargetKey(key) {
+  const s = String(key || '');
+  const at = s.indexOf(':');
+  const runtime = at > 0 ? s.slice(0, at) : s;
+  const rest = at > 0 ? s.slice(at + 1) : '';
+  if (rest.startsWith('project:')) return { runtime, scope: 'project', projectPath: rest.slice(8), accountId: 'default' };
+  return { runtime, scope: 'user', projectPath: null, accountId: rest.startsWith('user:') ? rest.slice(5) || 'default' : 'default' };
+}
+
+/**
+ * Where a review's install goes, said whole, never a silent fallback: the targets the submission named that exist
+ * here and are on (`missing` names each one that does not, with why: no folder for it, or the shared folder turned
+ * off); when it named none, where the skill is already installed, else Claude Code for every project (`fallback`
+ * says which). When it named targets and none is available, nothing (`targets` empty): the caller refuses and
+ * says why, and never installs elsewhere.
+ * @param {{ review?: object|null, targets: object[], skill?: object|null, row?: object|null, assistants?: string[]|null }} o targets: installTargets()
+ * @returns {{ keys: Set<string>, targets: object[], named: object[], missing: { target: object, reason: 'off'|'missing' }[],
+ *   fallback: 'installed'|'claude'|'assistants'|null, projects: string[] }}
+ */
+export function reviewDestinations({ review = null, targets = [], skill = null, row = null, assistants = null } = {}) {
+  const named = list(review?.targets).filter((x) => x && typeof x.runtime === 'string');
+  const projects = [...new Set(named.filter((x) => x.scope === 'project' && x.projectPath).map((x) => x.projectPath))];
+  const all = list(targets);
+  if (named.length) {
+    const keys = new Set();
+    const missing = [];
+    for (const x of named) {
+      const key = targetKey(x);
+      const have = all.find((t) => t.key === key);
+      if (have && !have.off) keys.add(key);
+      else missing.push({ target: x, reason: have?.off ? 'off' : 'missing' });
+    }
+    return { keys, targets: all.filter((t) => keys.has(t.key)).map((t) => t.target), named, missing, fallback: null, projects };
+  }
+  const there = all.filter((t) => !t.off && ['installed', 'outdated', 'present'].includes(targetState(t, { skill, row }).state));
+  const keys = there.length ? new Set(there.map((t) => t.key)) : defaultTargets(all, { skill, row, assistants });
+  const onlyClaude = [...keys].every((k) => k === keyIn('claude', 'user'));
+  return { keys, targets: all.filter((t) => keys.has(t.key)).map((t) => t.target), named, missing: [], fallback: there.length ? 'installed' : (onlyClaude ? 'claude' : 'assistants'), projects };
+}