datex-studio-cli 0.5.6__tar.gz → 0.5.7__tar.gz

{datex_studio_cli-0.5.6 → datex_studio_cli-0.5.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: datex-studio-cli
-Version: 0.5.6
+Version: 0.5.7
 Summary: CLI for Datex Studio low-code platform, designed for LLM-based AI agents
 Project-URL: Homepage, https://github.com/datex/datex-studio-cli
 Project-URL: Documentation, https://github.com/datex/datex-studio-cli

{datex_studio_cli-0.5.6 → datex_studio_cli-0.5.7}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "datex-studio-cli"
-version = "0.5.6"
+version = "0.5.7"
 description = "CLI for Datex Studio low-code platform, designed for LLM-based AI agents"
 readme = "README.md"
 license = "MIT"

{datex_studio_cli-0.5.6 → datex_studio_cli-0.5.7}/src/dxs/__init__.py

@@ -1,4 +1,4 @@
 """Datex Studio CLI - Command-line interface for Datex Studio platform."""
 
-__version__ = "0.5.6"
+__version__ = "0.5.7"
 __app_name__ = "dxs"

datex_studio_cli-0.5.7/src/dxs/commands/skills.py

@@ -0,0 +1,656 @@
+"""Skill management: dxs skills (issue #95).
+
+Replaces ``npx skills add/update`` for Datex skills. Bundles come from the
+Quartermaster companion service, which resolves the running CLI version
+against the skills repo's ``compat.yaml`` and serves the matching ref —
+clients need no GitHub account, npm, or Node. Files land exactly where
+``npx skills`` put them (``~/.agents/skills`` + symlinks into each agent's
+skills directory), so Claude Code and Codex need no configuration.
+"""
+
+from __future__ import annotations
+
+import os
+import shlex
+import subprocess
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any
+
+import click
+
+from dxs import __version__
+from dxs.cli import handle_errors
+from dxs.context import DxsContext, pass_context
+from dxs.core.auth import require_auth
+from dxs.core.quartermaster.client import QuartermasterClient
+from dxs.core.skills.discovery import scan_projects
+from dxs.core.skills.frontmatter import installed_depends
+from dxs.core.skills.inspection import (
+    DIRECTORY_CONFLICT_GUIDANCE,
+    forget_migrated_npx_entries,
+    inspect_layout,
+    npx_lock_path,
+)
+from dxs.core.skills.installer import install_bundle, remove_skill
+from dxs.core.skills.layout import AGENTS, Layout, layout_for
+from dxs.core.skills.lock import Lock, LockEntry, read_lock, write_lock
+from dxs.core.skills.protection import CheckoutProtection, installation_paths
+from dxs.core.skills.resolver import ResolutionError, closure
+from dxs.utils.errors import DxsError, ValidationError
+from dxs.utils.responses import list_response
+from dxs.utils.restricted import check_restricted_mode_for_option, restrict_in_restricted_mode
+
+CATALOG_PATH = "/skills/v1/catalog"
+BUNDLE_PATH = "/skills/v1/bundle"
+MANIFEST_NAME = "MANIFEST.json"
+
+
+def _scope_options(f: Any) -> Any:
+    f = click.option(
+        "--project",
+        is_flag=True,
+        help="Use the current directory (.agents/skills + skills-lock.json) instead of ~",
+    )(f)
+    return f
+
+
+def _agent_option(f: Any) -> Any:
+    return click.option(
+        "--agent",
+        "agents",
+        multiple=True,
+        type=click.Choice(list(AGENTS)),
+        help="Agent(s) to link the skill into; default: all",
+    )(f)
+
+
+def _resolve_agents(agents: tuple[str, ...]) -> tuple[str, ...]:
+    return tuple(agents) if agents else tuple(AGENTS)
+
+
+def _fetch_catalog(client: QuartermasterClient) -> dict[str, Any]:
+    body = client.get_json(CATALOG_PATH, params={"cli_version": __version__})
+    if not isinstance(body, dict) or not isinstance(body.get("skills"), list):
+        raise DxsError(
+            code="DXS-QM-003",
+            message="Quartermaster returned an unexpected catalog shape",
+        )
+    return body
+
+
+def _read_manifest(bundle: bytes) -> dict[str, Any]:
+    """Read ``MANIFEST.json`` from the bundle root.
+
+    It used to arrive as an ``X-Skills-Manifest`` response header, but it grows
+    with the catalog -- a path and a 64-char sha256 per skill -- and nginx 502s
+    when a response header block overflows a proxy buffer, which capped the
+    bundle at 27 skills. Missing or unreadable is not fatal: the skills still
+    install, the lock just records no hash, so every one reads as outdated.
+    """
+    import io
+    import json
+    import tarfile
+
+    try:
+        with tarfile.open(fileobj=io.BytesIO(bundle), mode="r:gz") as tar:
+            member = tar.extractfile(MANIFEST_NAME)
+            if member is None:
+                return {}
+            manifest = json.loads(member.read())
+    except (tarfile.TarError, KeyError, ValueError, OSError):
+        return {}
+    return manifest if isinstance(manifest, dict) else {}
+
+
+def _fetch_bundle(client: QuartermasterClient, names: list[str]) -> tuple[bytes, dict[str, Any]]:
+    body, headers = client.get_bytes(
+        BUNDLE_PATH, params={"cli_version": __version__, "skill": names}
+    )
+    return body, {
+        "ref": headers.get("x-skills-ref", ""),
+        "commit": headers.get("x-skills-commit", ""),
+        "manifest": _read_manifest(body),
+    }
+
+
+def _install(
+    ctx: DxsContext,
+    client: QuartermasterClient,
+    layout: Layout,
+    names: list[str],
+    agents: tuple[str, ...],
+    *,
+    force: bool,
+    status: str,
+) -> list[dict[str, Any]]:
+    """Download ``names``, install them, record the lock, and report per skill."""
+    protection = CheckoutProtection()
+    protection.assert_writable(
+        [
+            npx_lock_path(layout),
+            *(path for name in names for path in installation_paths(layout, name)),
+        ]
+    )
+    lock = read_lock(layout.lock_path, strict=True)
+    read_lock(npx_lock_path(layout), strict=True)
+    owned_copies = {
+        name: tuple(a for a in entry.agents if a not in entry.conflicts)
+        for name, entry in lock.skills.items()
+        if entry.link_mode == "copy"
+    }
+    bundle, meta = _fetch_bundle(client, names)
+    results = install_bundle(bundle, layout, agents, force=force, owned_copies=owned_copies)
+    now = datetime.now(timezone.utc).isoformat()
+    report: list[dict[str, Any]] = []
+    conflicts: dict[str, tuple[str, ...]] = {}
+    for result in results:
+        info = meta["manifest"].get(result.name, {})
+        linked = tuple(a for a in agents if a not in result.conflicts)
+        previous = lock.skills.get(result.name)
+        unresolved = tuple(a for a in previous.conflicts if a not in agents) if previous else ()
+        lock.skills[result.name] = LockEntry(
+            name=result.name,
+            skill_path=f"{info.get('path', '')}/SKILL.md".lstrip("/"),
+            computed_hash=str(info.get("hash", "")),
+            ref=str(meta["ref"]),
+            commit=str(meta["commit"]),
+            cli_version=__version__,
+            installed_at=now,
+            agents=tuple(dict.fromkeys((*lock.skills[result.name].agents, *agents)))
+            if result.name in lock.skills
+            else agents,
+            conflicts=(*unresolved, *result.conflicts),
+            link_mode=result.link_mode,
+        )
+        if result.conflicts:
+            conflicts[result.name] = result.conflicts
+        report.append(
+            {
+                "name": result.name,
+                "status": status,
+                "ref": meta["ref"],
+                "commit": meta["commit"],
+                "agents": list(linked),
+                "link_mode": result.link_mode,
+                "conflicts": list(result.conflicts),
+            }
+        )
+    write_lock(layout.lock_path, lock)
+    ctx.log(f"Installed {len(results)} skill(s) into {layout.canonical}")
+    forget_migrated_npx_entries(
+        layout, [r.name for r in results if not lock.skills[r.name].conflicts]
+    )
+    if conflicts:
+        lines = [
+            f"{name}: {', '.join(layout.agent_dirs[a].as_posix() + '/' + name for a in ags)}"
+            for name, ags in conflicts.items()
+        ]
+        raise DxsError(
+            code="DXS-SKILLS-003",
+            message=(
+                "Installed, but could not link into agent directories that already hold a real "
+                "directory of the same name: " + "; ".join(lines)
+            ),
+            details={"conflicts": {n: list(a) for n, a in conflicts.items()}},
+            suggestions=[
+                DIRECTORY_CONFLICT_GUIDANCE,
+            ],
+        )
+    return report
+
+
+def _lock_or_empty_error(layout: Layout) -> Lock:
+    lock = read_lock(layout.lock_path)
+    if not lock.skills:
+        raise DxsError(
+            code="DXS-SKILLS-002",
+            message=f"No dxs-managed skills are installed ({layout.scope} scope)",
+            suggestions=[
+                "Run 'dxs skills add --all' to install every Datex skill",
+                "Run 'dxs skills list --available' to see what can be installed",
+            ],
+        )
+    return lock
+
+
+@click.group()
+def skills() -> None:
+    """Manage Datex agent skills (Claude Code, Codex) via Quartermaster."""
+
+
+@skills.command("add")
+@click.argument("names", nargs=-1)
+@click.option("--all", "install_all", is_flag=True, help="Install every skill in the catalog")
+@_scope_options
+@_agent_option
+@click.option("--force", is_flag=True, help="Replace real directories that block linking")
+@pass_context
+@handle_errors
+@require_auth
+@restrict_in_restricted_mode("writes skill files into agent directories")
+def add_cmd(
+    ctx: DxsContext,
+    names: tuple[str, ...],
+    install_all: bool,
+    project: bool,
+    agents: tuple[str, ...],
+    force: bool,
+) -> None:
+    """Install skills (and their dependencies) for this CLI version.
+
+    Examples:
+        dxs skills add report-creator
+        dxs skills add --all
+        dxs skills add report-creator --project --agent claude
+    """
+    if not names and not install_all:
+        raise ValidationError(
+            message="Name at least one skill, or pass --all",
+            code="DXS-SKILLS-005",
+            suggestions=["dxs skills list --available", "dxs skills add --all"],
+        )
+    layout = layout_for(project)
+    with QuartermasterClient() as client:
+        catalog = _fetch_catalog(client)
+        requested = [s["name"] for s in catalog["skills"]] if install_all else list(names)
+        try:
+            ordered = closure(requested, catalog["skills"])
+        except ResolutionError as exc:
+            raise DxsError(
+                code="DXS-SKILLS-001",
+                message=str(exc),
+                suggestions=["Run 'dxs skills list --available' to see the catalog"],
+            ) from exc
+        report = _install(
+            ctx, client, layout, ordered, _resolve_agents(agents), force=force, status="installed"
+        )
+    ctx.output(
+        list_response(
+            report, "skills", scope=layout.scope, ref=catalog.get("ref"), line=catalog.get("line")
+        )
+    )
+
+
+@skills.command("update")
+@click.argument("names", nargs=-1)
+@_scope_options
+@click.option("--force", is_flag=True, help="Replace real directories that block linking")
+@pass_context
+@handle_errors
+@require_auth
+@restrict_in_restricted_mode("rewrites skill files in agent directories")
+def update_cmd(ctx: DxsContext, names: tuple[str, ...], project: bool, force: bool) -> None:
+    """Refresh installed skills to what this CLI version expects.
+
+    Re-downloads a skill when its content changed upstream or when it was
+    installed against a different dxs version, or its files/links need repair.
+    Legacy Datex npx installations are adopted; retired skills are reported, not removed.
+    """
+    layout = layout_for(project)
+    before = {row["name"]: row for row in inspect_layout(layout)}
+    eligible = {name: row for name, row in before.items() if row["status"] != "unmanaged"}
+    if not eligible:
+        _lock_or_empty_error(layout)
+    targets = list(names) if names else sorted(eligible)
+    unknown = [n for n in targets if n not in eligible]
+    if unknown:
+        raise DxsError(
+            code="DXS-SKILLS-001",
+            message=f"not installed by dxs or npx Datex skills: {', '.join(unknown)}",
+            suggestions=["Run 'dxs skills doctor' to inspect installed skills"],
+        )
+    if all(before[name]["status"] == "protected" for name in targets):
+        ctx.output(list_response([before[name] for name in targets], "skills", scope=layout.scope))
+        return
+    with QuartermasterClient() as client:
+        catalog = _fetch_catalog(client)
+        by_name = {s["name"]: s for s in catalog["skills"]}
+        lock = read_lock(layout.lock_path)
+        changed = [
+            name
+            for name in targets
+            if before[name]["status"] != "protected"
+            and (
+                name not in by_name
+                or before[name]["status"] != "ok"
+                or lock.skills[name].computed_hash != by_name[name]["hash"]
+            )
+        ]
+        actions, retired, protected = _refresh_layout(
+            ctx, client, catalog, layout, before, changed, force=force
+        )
+    after = {row["name"]: row for row in inspect_layout(layout)}
+    report = []
+    for name in sorted(set(targets) | set(actions)):
+        row = after[name]
+        if name in protected:
+            row["status"] = "protected"
+            row["problems"] = [protected[name]]
+            row["fix"] = None
+        elif row["status"] == "protected":
+            pass
+        elif name in retired:
+            row["status"] = "retired"
+        elif name in actions and row["status"] == "ok":
+            row["status"] = (
+                "migrated" if before.get(name, {}).get("status") == "legacy" else "updated"
+            )
+        elif name not in actions:
+            row["status"] = "current"
+        report.append(row)
+    ctx.output(
+        list_response(
+            report, "skills", scope=layout.scope, ref=catalog.get("ref"), line=catalog.get("line")
+        )
+    )
+    if any(row["status"] == "broken" for row in report):
+        raise SystemExit(1)
+
+
+@skills.command("list")
+@click.option("--available", is_flag=True, help="Also list the catalog for this CLI version")
+@_scope_options
+@pass_context
+@handle_errors
+def list_cmd(ctx: DxsContext, available: bool, project: bool) -> None:
+    """List dxs-managed skills (offline), or the whole catalog with --available."""
+    layout = layout_for(project)
+    lock = read_lock(layout.lock_path)
+    if not available:
+        installed: list[dict[str, Any]] = [
+            {
+                "name": e.name,
+                "scope": layout.scope,
+                "cli_version": e.cli_version,
+                "ref": e.ref,
+                "commit": e.commit,
+                "agents": list(e.agents),
+                "link_mode": e.link_mode,
+                "installed_at": e.installed_at,
+            }
+            for _, e in sorted(lock.skills.items())
+        ]
+        ctx.output(list_response(installed, "skills", scope=layout.scope))
+        return
+    with QuartermasterClient() as client:
+        catalog = _fetch_catalog(client)
+    items: list[dict[str, Any]] = []
+    for skill in catalog["skills"]:
+        entry = lock.skills.get(skill["name"])
+        if entry is None:
+            status = "available"
+        elif entry.computed_hash != skill["hash"] or entry.cli_version != __version__:
+            status = "outdated"
+        else:
+            status = "current"
+        items.append(
+            {
+                "name": skill["name"],
+                "description": skill.get("description", ""),
+                "depends": list(skill.get("depends", [])),
+                "installed": entry is not None,
+                "status": status,
+            }
+        )
+    ctx.output(
+        list_response(
+            items, "skills", scope=layout.scope, ref=catalog.get("ref"), line=catalog.get("line")
+        )
+    )
+
+
+@skills.command("remove")
+@click.argument("names", nargs=-1, required=True)
+@_scope_options
+@pass_context
+@handle_errors
+@restrict_in_restricted_mode("deletes skill files from agent directories")
+def remove_cmd(ctx: DxsContext, names: tuple[str, ...], project: bool) -> None:
+    """Remove dxs-managed skills. Dependents that remain are reported."""
+    layout = layout_for(project)
+    lock = read_lock(layout.lock_path)
+    unknown = [n for n in names if n not in lock.skills]
+    if unknown:
+        raise DxsError(
+            code="DXS-SKILLS-001",
+            message=f"not installed by dxs: {', '.join(unknown)}",
+            suggestions=["Run 'dxs skills list' to see what dxs manages"],
+        )
+    report = []
+    for name in names:
+        entry = lock.skills[name]
+        dependents = sorted(
+            other
+            for other in lock.skills
+            if other not in names and name in installed_depends(layout.canonical / other)
+        )
+        installed_agents = tuple(a for a in entry.agents if a not in entry.conflicts)
+        removed = remove_skill(name, layout, installed_agents, entry.link_mode)
+        del lock.skills[name]
+        if dependents:
+            ctx.log(f"Warning: {name} is still required by {', '.join(dependents)}")
+        report.append({"name": name, "removed": removed, "dependents": dependents})
+    write_lock(layout.lock_path, lock)
+    ctx.output(list_response(report, "skills", scope=layout.scope))
+
+
+def _refresh_layout(
+    ctx: DxsContext,
+    client: QuartermasterClient,
+    catalog: dict[str, Any],
+    layout: Layout,
+    before: dict[str, dict[str, Any]],
+    targets: list[str],
+    *,
+    force: bool,
+) -> tuple[set[str], set[str], dict[str, str]]:
+    """Refresh dependency closures without broadening unrelated agent placements."""
+    by_name = {s["name"]: s for s in catalog["skills"]}
+    lock = read_lock(layout.lock_path)
+    retired = {name for name in targets if name not in by_name}
+    placements: dict[str, tuple[str, ...]] = {}
+    protected: dict[str, str] = {}
+    for name in targets:
+        if name in retired:
+            continue
+        dependencies = closure([name], catalog["skills"])
+        protected_dependencies = [
+            n for n in dependencies if before.get(n, {}).get("status") == "protected"
+        ]
+        if protected_dependencies:
+            protected[name] = (
+                "Skipped: dependency belongs to a protected contributor checkout: "
+                + ", ".join(protected_dependencies)
+            )
+            continue
+        for dependency in dependencies:
+            existing = before.get(dependency)
+            if existing and existing["status"] == "unmanaged":
+                raise DxsError(
+                    code="DXS-SKILLS-007",
+                    message=f"Cannot replace unmanaged dependency {dependency} in {layout.root}",
+                )
+            agents = tuple(before[name]["agents"])
+            previous = placements.get(dependency, tuple(existing["agents"]) if existing else ())
+            placements[dependency] = tuple(dict.fromkeys((*previous, *agents)))
+    groups: dict[tuple[str, ...], list[str]] = {}
+    for name, agents in placements.items():
+        entry = lock.skills.get(name)
+        if (
+            name not in targets
+            and entry
+            and before[name]["status"] == "ok"
+            and entry.computed_hash == by_name[name]["hash"]
+            and set(agents) == set(entry.agents)
+        ):
+            continue
+        if any(agent not in AGENTS for agent in agents):
+            raise DxsError(code="DXS-SKILLS-007", message=f"Unsupported agent placement for {name}")
+        groups.setdefault(agents, []).append(name)
+    attempted: set[str] = set()
+    for agents, names in groups.items():
+        try:
+            _install(ctx, client, layout, names, agents, force=force, status="updated")
+        except DxsError as exc:
+            if exc.code != "DXS-SKILLS-003":
+                raise
+            # Partial installs are recorded; the caller reports their health.
+        attempted.update(names)
+    return attempted, retired, protected
+
+
+@require_auth
+def _repair_layouts(ctx: DxsContext, layouts: list[Layout], *, force: bool) -> list[dict[str, Any]]:
+    reports: list[dict[str, Any]] = []
+    with QuartermasterClient() as client:
+        catalog = _fetch_catalog(client)
+        for layout in layouts:
+            before = {row["name"]: row for row in inspect_layout(layout)}
+            targets = [
+                name
+                for name, row in before.items()
+                if row["status"] in ("broken", "stale", "legacy")
+            ]
+            actions, retired, protected = _refresh_layout(
+                ctx, client, catalog, layout, before, targets, force=force
+            )
+            for row in inspect_layout(layout):
+                if row["name"] in protected:
+                    row["status"] = "protected"
+                    row["problems"] = [protected[row["name"]]]
+                    row["fix"] = None
+                elif row["name"] in retired:
+                    row["status"] = "retired"
+                    row["problems"].append(
+                        "No longer available in the catalog for this CLI version"
+                    )
+                    row["fix"] = None
+                elif row["name"] in actions and row["status"] == "ok":
+                    row["action"] = (
+                        "migrated"
+                        if before.get(row["name"], {}).get("status") == "legacy"
+                        else "repaired"
+                    )
+                reports.append(row)
+    return reports
+
+
+@skills.command("doctor")
+@click.option("--project", is_flag=True, help="Inspect only current-project skills")
+@click.option("--user", "user_only", is_flag=True, help="Inspect only user skills")
+@click.option(
+    "--scan",
+    "scan_roots",
+    multiple=True,
+    type=click.Path(exists=True, file_okay=False, path_type=Path),
+    help="Search this workspace for Datex project installs (repeatable; replaces default scopes)",
+)
+@click.option(
+    "--max-depth",
+    default=4,
+    show_default=True,
+    type=click.IntRange(0, 64),
+    help="Scan depth below each root; zero inspects only the root",
+)
+@click.option(
+    "--max-directories",
+    default=10000,
+    show_default=True,
+    type=click.IntRange(min=1),
+    help="Maximum directories visited across scan roots",
+)
+@click.option("--fix", is_flag=True, help="Migrate Datex skills and repair managed installations")
+@click.option("--force", is_flag=True, help="With --fix, replace real directories blocking links")
+@pass_context
+@handle_errors
+def doctor_cmd(
+    ctx: DxsContext,
+    project: bool,
+    user_only: bool,
+    scan_roots: tuple[Path, ...],
+    max_depth: int,
+    max_directories: int,
+    fix: bool,
+    force: bool,
+) -> None:
+    """Inspect user/current-project skills and scan the parent directory for other projects.
+
+    Scans are bounded by --max-depth and --max-directories. Use --fix to repair
+    all reported Datex installations, or --project/--user to limit the scope.
+    """
+    if force and not fix:
+        raise click.UsageError("--force requires --fix")
+    if fix:
+        check_restricted_mode_for_option("--fix", "rewrites skill files and installer records")
+    if sum((project, user_only, bool(scan_roots))) > 1:
+        raise click.UsageError("Choose only one of --project, --user, or --scan")
+    protection = CheckoutProtection()
+    default_scan = not (project or user_only or scan_roots)
+    roots = (Path.cwd().parent,) if default_scan else scan_roots
+    scan = (
+        scan_projects(
+            roots, max_depth=max_depth, max_directories=max_directories, protection=protection
+        )
+        if roots
+        else None
+    )
+    if default_scan:
+        # Always inspect the user and current project, even when their files are
+        # untracked or a scan limit prevents discovery. Prefer user scope if the
+        # home directory also appears among discovered project roots.
+        layouts = [layout_for(False), layout_for(True), *(scan.layouts if scan else [])]
+        by_root: dict[Path, Layout] = {}
+        for layout in layouts:
+            by_root.setdefault(layout.root.resolve(), layout)
+        layouts = list(by_root.values())
+    elif scan is not None:
+        layouts = scan.layouts
+    else:
+        layouts = [layout_for(project)]
+    report: list[dict[str, Any]] = []
+    errors: list[str] = []
+    valid_layouts: list[Layout] = []
+    for layout in layouts:
+        try:
+            report.extend(inspect_layout(layout, protection))
+            valid_layouts.append(layout)
+        except (DxsError, OSError) as exc:
+            errors.append(f"{layout.scope} ({layout.root}): {exc}")
+    if fix and any(row["status"] in ("broken", "stale", "legacy") for row in report):
+        report = _repair_layouts(ctx, valid_layouts, force=force)
+    if scan is not None:
+        for row in report:
+            if row["fix"] and row["scope"] == "project":
+                quoted_root = (
+                    subprocess.list2cmdline([row["root"]])
+                    if os.name == "nt"
+                    else shlex.quote(row["root"])
+                )
+                row["fix"] = f"dxs skills doctor --scan {quoted_root} --max-depth 0 --fix" + (
+                    " --force" if row["status"] == "broken" else ""
+                )
+    metadata: dict[str, Any] = {
+        "scope": "all" if default_scan else "scan" if scan else "project" if project else "user",
+        "cli_version": __version__,
+    }
+    if scan is not None:
+        metadata["scan"] = {
+            "roots": [str(p.resolve()) for p in roots],
+            "default": default_scan,
+            "visited": scan.visited,
+            "depth_limited": scan.depth_limited,
+            "limit_reached": scan.limit_reached,
+            "errors": scan.errors,
+            "max_depth": max_depth,
+            "max_directories": max_directories,
+        }
+    metadata["protected_checkouts"] = sorted(str(p) for p in protection.protected)
+    metadata["errors"] = errors
+    ctx.output(list_response(report, "skills", **metadata))
+    if errors:
+        raise SystemExit(1)
+    if scan is not None and (scan.limit_reached or scan.errors):
+        raise SystemExit(1)
+    if any(row["status"] not in ("ok", "unmanaged", "protected") for row in report):
+        raise SystemExit(1)