[0libote]

Repository skills can now be checked and updated without creating duplicate agent copies. Update review stays attached to the existing installation, shows the exact folder and affected global readers, compares incoming files and instructions, and requires explicit replacement consent. Shared folders and links into managed skill folders update in place.

This consolidates #47 with source-discovery, library and Codex hook improvements. Thanks to @0libote for the original contribution.

Behavior

• Published skills take precedence over lower-priority agent-specific copies of the same name. Complete folders stay together; unique agent variants remain available. Explicit folder links select a variant, while equally preferred duplicates remain ambiguous.
• Repository imports retain their source and a complete file fingerprint, including executable flags. Manual checks fetch each source once per action. Ordinary inventory refreshes never fetch repositories, and local edits are distinguished from upstream changes.
• Review update shows added, changed and removed files; installed/incoming SKILL.md; the current destination; known global readers; and local-edit warnings. Replacement consent and the Update action stay visible on short screens. Copying to another agent remains a separate operation.
• The server binds updates to discovered installation IDs, immutable source snapshots and reviewed revisions. It rechecks permissions, links, tracking metadata, supporting files and readers before publication. Existing atomic staging/restore behavior is reused. Lost responses retry the same reviewed operation; conflicts and expiry require another review and fresh consent.
• Hide bundled skills filters system entries locally without changing availability. Other-agent folders remain manageable when explicitly selected, with advisory detection hints.
• Codex plugin hooks are grouped by plugin, with an inspector link for the owning plugin. Review shows the full native command, matcher, timeout and source. Trust and enablement are separate, pending actions show progress, and settings changes are serialized and verified. Full legacy and composite native trust tokens are preserved, including Codex 0.164.0's plugin-content component. Managed/incompletely inspectable hooks stay read-only. No hook or model turn runs during review.

Imports remain bounded and never execute source scripts. Updates replace complete folders, including explicitly reviewed local edits and removed supporting files. No scheduled checks, automatic skill replacements, or runtime dependencies are added. Filesystem conflict checks preserve the existing boundary documented in the Context guide; external processes do not share an application transaction.

Validation

• 794 Node tests passed, including all seven providers, shared-folder updates, managed links, retargeting, concurrent edits, provenance changes, local-file bounds, rollback and full native hook tokens.
• 28 browser configurations passed: 12 Skills, 8 hook-review and 8 update-review configurations in light/dark, desktop, phone and embedded layouts. Update recovery covers slow/failed reads, stale writes, expiry, lost responses, long paths, comparison controls, consent and pending-save guards. Narrow touch-target checks also pass.
• Native Codex 0.164.0, Claude Code 2.1.310 and OpenCode 2.1.4 import/reviewed-update/removal checks passed with disabled/denied settings preserved byte for byte. Native Codex hook trust, separate enablement, restart persistence and changed-definition rejection passed; no hooks ran.
• Syntax, shellcheck, four shell suites (77 checks), 29 harness checks, generated mise metadata and git diff --check passed.
• Native T3 preview checked the actual console interactively. Test mutations use in-memory APIs or disposable homes. Docker is unavailable locally; hosted CI builds/tests both image variants on amd64 and arm64.

Screenshots

Fresh captures from the final implementation at matching viewports:

Update review — desktop

Update review — phone