vendor add gains --exclude a,b,c (all mode minus those ids) as the mirror
of --include, for taking the majority of a source while dropping a few
items. Mutual exclusion with --include is a hard error, unknown ids fail
naming the available ones (generalized checkIDEntries).
vendor add and vendor select gain --types (allow-list) and --exclude-types
(deny-list) over the four content types. The filter is stored as the
optional, v2-compatible Selection.exclude_types field and survives vendor
update: new upstream items of an excluded type never enter the work
repository (unlike id expansion, which would silently re-admit them).
--types/--exclude-types replace the filter on select, absent flags keep
it, and --mode all clears it along with include/exclude.
Also fixes materializeTree to create the staging directory for an empty
selection — previously select-to-zero failed at the staging rename.
A flat .md under agents/ or commands/ whose frontmatter contains none of
the definition keys (name, description, mode, agent, model,
argument-hint, temperature, permission) is documentation, not an item:
discovery marks it Skipped with a recorded warning — it never enters a
selection, inventory, availability listing or collision index, but the
warning lands in the lockfile and add/update/select reports like other
discovery warnings. Skills keep their folder+SKILL.md marker, MCP keeps
the .yaml marker. README gains the canonical layout table and the
migration note for folder-style agent repos.
Closes beads: agent-lib-2n7
- skills are found at any depth under the skills dir, so category-nested
layouts (skills/<category>/<id>/SKILL.md) vendor correctly; the folder
basename is the upstream id and the outermost SKILL.md wins over anything
nested inside a skill folder
- web-tree urls pointing directly at a type directory (.../tree/main/skills)
now map that directory as the type root instead of nesting it under the
default layout
- verified against the real github.com/mattpocock/skills repository
(36 skills across categories; include-selection by basename)
- admin-protected client config (flag > AGENT_LIB_CONFIG > platform default),
token used for basic auth only, redacted from all errors and files
- work-repo pull via go-git (bare cache clone + fetch, remote re-pointed on
config change), clean failure keeps previous state
- inventory: own items + external areas from lockfile; MCP inventoried but
never deployed
- manifest v1 records name/type/origin/revision/content-hash per item,
deterministic bytes; folder hashes over sorted relpath+filehash lines so
tree and disk hashes agree
- shared deploy package (atomic temp+rename, exec-bit preserving) now backs
both curator materialization and client deployment
- sync validates and hashes everything before the first mutation; second run
is a byte-level no-op
- flat per-type deployed namespace enforced across own items and all sources
- own-vs-vendored and vendored-vs-vendored collisions abort with both parties named
- --rename upstream=deployed resolves collisions; on-disk folder always equals
deployed name; rename targets are validated against new collisions
- checks run before any tree mutation; validate re-checks the namespace offline
m3ta-chiron