Skillcaddy Manager

Treat Skillcaddy as a central skill library with explicit project/global/Hermes symlink activation. Keep one execution loop across every branch: state -> route -> preflight -> act -> verify.

Core Loop

1. Resolve the Skillcaddy repository and target project. Default the project to the current working directory only when the user did not provide one.
   • Complete when both absolute paths are known.
2. For recommendations, audits, or mutations, read GET /api/state?projectPath=<encoded-path>. For source acquisition, updates, or migration, also inspect the source registry with npm run source -- list and npm run source -- inspect <source-id>. If the server is unavailable, inspect the equivalent paths listed under Core Model.
   • Complete when repository, source registry, project, global, Hermes, Claude, metadata, and advice state relevant to the request are known.
3. Route to the required branch and load only its reference; load multiple references only when the request combines branches:
   • Discovery, source acquisition/update/migration, enable/disable, audit, health, Git update, bootstrap, Web/TUI: OPERATIONS.md
   • Recommendations: RECOMMENDATION_GUIDE.md
   • Notes, tags, autoEnable, migration, batch Chinese notes: METADATA.md
   • Complete when the selected branch, target identities, and completion criterion are explicit.
4. For a mutation, apply the Mutation Gate before acting. Prefer the existing API, TUI, or repository commands over ad hoc filesystem changes.
   • Complete when the preflight accounts for every affected item and all blocking ownership or alias issues are resolved.
5. Execute the narrowest requested operation, rescan state, and report the observed result.
   • Complete when the post-operation state proves every requested item succeeded, remained unchanged, was skipped, or failed with a stated reason.

Core Model

Scope	Location	Role
Bundled	skills/<name>/	Skills shipped by this repository
Central	official/, github/, personal/, archived/	Source libraries
Source registry	.skillcaddy/sources/	Sidecar identity, provenance, integrity, install path, and discovered skill paths
Project	<project>/.agents/skills/	Codex-compatible activation symlinks
Project Claude	<project>/.claude/skills/	Claude compatibility symlinks
Global Agents	~/.agents/skills/	Shared user-level links managed by Skillcaddy
Global Claude	~/.claude/skills/	Read-only external Agent directory; Skillcaddy does not write it
Hermes	~/.hermes/skills/	Explicit independent scope for eligible official/github/personal sources
Collection setup	collection-metadata/<source>/<collection>.json	Tracked, read-only setup contract and readiness checks

Preserve these invariants:

• Enable and disable operations are explicit about project or global scope; source skill directories remain intact.
• Project enablement writes <project>/.agents/skills/ and best-effort syncs project Claude links. Global enablement writes only ~/.agents/skills/ and does not require a project.
• Project and global aliases may coexist; project state is the higher-priority context when an Agent applies its normal precedence rules.
• Never take over an occupied ordinary entry, foreign symlink, or broken link. Same-target enablement is an unchanged result.
• Global disable may remove only a symlink whose target is provably inside the current Skillcaddy root's allowed source folders; foreign links and ordinary entries are read-only.
• Source acquisition changes only the central library. It never implies enablement, setup, or execution of acquired code.
• add is for a new source identity. Only a matching source-registry record authorizes update; a destination collision never does.
• An explicit combined request runs acquisition first, rescans state, resolves one requested acquired skill, and enables only that selection.
• Unknown setup readiness produces no reminder or gate. Declared setup reminders remain non-blocking; publisher runtime preflight owns proprietary credentials and setup.
• archived/ skills require an explicit user request.
• GitHub-backed source directories remain free of Skillcaddy metadata; write catalog metadata to the sidecar store.
• Collection activation and project readiness are separate: setup may be missing after links are enabled.
• Interactive setup is never executed silently; obtain confirmation and let the declared setup skill own project edits.
• Repository behavior in lib/skillStore.js, lib/projectActions.js, and lib/claudeStore.js is authoritative when documentation and implementation differ.
• The fixed default Web manager URL is http://127.0.0.1:4173.
• The clone-backed skillcaddy entry keeps no-argument TUI compatibility and also supports start, stop, restart, -u for registered Git source updates, and read-only -a analysis.
• Global bootstrap is explicit: run npm run install:cli and npm run check:cli from the clone; the installed command provides both CLI and TUI, while install:tui remains a compatibility alias.
• Source update and repair CLIs require an explicit --project; global links are always scanned in addition to that project context.
• If a registered Git checkout was manually advanced with git pull, use npm run source -- repair <source-id> --project <project-dir> to explicitly adopt the clean fast-forward state into the sidecar registry; never edit the registry directly.

Mutation Gate

Before changing state, present a compact preflight containing:

Action	Skill	Source/collection	Alias	Target path	Advice/result

Account for skills that will be changed, left unchanged, skipped, or rejected. Include relevant /api/state.advice and metadata writes.

Require confirmation before proceeding when:

• one request matches multiple skills and the user has not selected one;
• a project or global alias points to a different target;
• a project or global entry is not a symlink or is externally managed;
• a GitHub source has uncommitted changes before update;
• a breaking source replacement affects a known project or global link;
• a source identity is ambiguous or a destination collision is not backed by a matching registry record;
• the request reaches into archived/ without naming the archived target;
• the request would delete a source skill rather than a project link;
• an advice item exposes a destructive or ownership ambiguity.
• an affected collection reports missing or partial interactive setup.

Surface informational duplicate-name and global-shadowing advice, but do not block solely on it. Use the full skill ID and a confirmed alias to resolve duplicates.

Reporting

For summaries, distinguish repository availability, project enablement, global presence, Claude compatibility, and unmanaged or broken state. Prefer:

Action	Skill	Source	Alias	Result	Notes

End with the verification performed: rescan/API state, validation command, tests, or server URL.