fix(kimaki): allowlist managed skills

README.md

@@ -330,11 +330,11 @@ Local installs run as your current user — no root, no service user, no chown.
 
 The default chat bridge for OpenCode. On VPS and macOS launchd installs, wp-coding-agents starts Kimaki with native 0.13 skill filters and installs post-upgrade hooks that:
 
-- **Disable unwanted bundled skills** — Kimaki ships with skills for frameworks and tools that aren't relevant to WordPress agent workflows. The disable list (`bridges/kimaki/skills-disable-list.txt`) is rendered as `--disable-skill` startup flags, so package-managed skill directories are left intact.
+- **Allow only managed bundled skills** — Kimaki ships with skills for frameworks and tools that aren't relevant to WordPress agent workflows. The allowlist (`bridges/kimaki/skills-enable-list.txt`) is rendered as `--enable-skill` startup flags, so future Kimaki skills stay hidden by default and package-managed skill directories are left intact.
 - **Filter redundant context** — A plugin strips Kimaki's built-in memory injection and scheduling instructions from the agent context, since DM handles those concerns. Saves ~2,400 tokens per session.
 - **Use native cwd routing for DMC worktrees** — When Data Machine Code creates or reuses an existing checkout, launch the Discord helper thread with `kimaki send --cwd <workspace-path> ...`. Kimaki records the thread/worktree metadata itself; wp-coding-agents does not write Kimaki's SQLite database.
 
-To customize the managed skill filters, edit `bridges/kimaki/skills-disable-list.txt` before running setup, or edit `/opt/kimaki-config/skills-disable-list.txt` on a VPS or `$KIMAKI_DATA_DIR/kimaki-config/skills-disable-list.txt` on a local install after setup.
+To customize the managed skill filters, edit `bridges/kimaki/skills-enable-list.txt` before running setup, or edit `/opt/kimaki-config/skills-enable-list.txt` on a VPS or `$KIMAKI_DATA_DIR/kimaki-config/skills-enable-list.txt` on a local install after setup.
 
 On local installs, Kimaki installs globally via npm but without a systemd service. Run it manually:
 

bridges/kimaki.sh

@@ -2,12 +2,12 @@
 # bridges/kimaki.sh — Kimaki Discord bridge.
 #
 # Owns install (local launchd / VPS systemd / Linux-local manual), upgrade-time
-# config sync (plugins, post-upgrade.sh, skill filters, regression test),
+# config sync (plugins, post-upgrade.sh, skill allowlist, regression test),
 # systemd + launchd template rendering, summary blocks, and the per-bridge
-# assets at bridges/kimaki/ (plugins/, post-upgrade.sh, skills-disable-list.txt).
+# assets at bridges/kimaki/ (plugins/, post-upgrade.sh, skills-enable-list.txt).
 #
 # Install layout:
-#   VPS:   /opt/kimaki-config/{plugins,post-upgrade.sh,skills-disable-list.txt}
+#   VPS:   /opt/kimaki-config/{plugins,post-upgrade.sh,skills-enable-list.txt}
 #          + /etc/systemd/system/kimaki.service (ExecStartPre runs post-upgrade.sh)
 #   Local: $KIMAKI_DATA_DIR/kimaki-config/ for plugins, post-upgrade.sh +
 #          skill filters (executed inline at upgrade time — no launchd
@@ -334,7 +334,7 @@ bridge_sync_config() {
   # Resolve paths per environment.
   #   VPS:   plugins live at /opt/kimaki-config/plugins (referenced by opencode.json,
   #          and by ExecStartPre in kimaki.service). Config dir holds plugins +
-  #          post-upgrade.sh + skills-disable-list.txt.
+  #          post-upgrade.sh + skills-enable-list.txt.
   #   Local: opencode.json points at $KIMAKI_DATA_DIR/kimaki-config/plugins, the
   #          durable source that survives `npm update -g kimaki`. Existing configs
   #          that still reference package-local plugin paths are migrated by the
@@ -414,7 +414,7 @@ bridge_sync_config() {
     done
   fi
 
-  # Stage post-upgrade.sh and skills-disable-list.txt in KIMAKI_CONFIG_DIR.
+  # Stage post-upgrade.sh and skills-enable-list.txt in KIMAKI_CONFIG_DIR.
   # On VPS this is read by ExecStartPre. On local we execute it inline below.
   if [ "$DRY_RUN" = false ]; then
     mkdir -p "$KIMAKI_CONFIG_DIR" 2>/dev/null || true
@@ -435,16 +435,16 @@ bridge_sync_config() {
     fi
   fi
 
-  if [ -f "$SCRIPT_DIR/bridges/kimaki/skills-disable-list.txt" ]; then
+  if [ -f "$SCRIPT_DIR/bridges/kimaki/skills-enable-list.txt" ]; then
     if [ "$DRY_RUN" = true ]; then
-      if ! cmp -s "$SCRIPT_DIR/bridges/kimaki/skills-disable-list.txt" "$KIMAKI_CONFIG_DIR/skills-disable-list.txt" 2>/dev/null; then
-        echo -e "${BLUE}[dry-run]${NC} Would update $KIMAKI_CONFIG_DIR/skills-disable-list.txt"
+      if ! cmp -s "$SCRIPT_DIR/bridges/kimaki/skills-enable-list.txt" "$KIMAKI_CONFIG_DIR/skills-enable-list.txt" 2>/dev/null; then
+        echo -e "${BLUE}[dry-run]${NC} Would update $KIMAKI_CONFIG_DIR/skills-enable-list.txt"
       fi
     else
-      if ! cmp -s "$SCRIPT_DIR/bridges/kimaki/skills-disable-list.txt" "$KIMAKI_CONFIG_DIR/skills-disable-list.txt" 2>/dev/null; then
-        cp "$SCRIPT_DIR/bridges/kimaki/skills-disable-list.txt" "$KIMAKI_CONFIG_DIR/skills-disable-list.txt"
-        log "  Updated $KIMAKI_CONFIG_DIR/skills-disable-list.txt"
-        UPDATED_ITEMS+=("kimaki-config/skills-disable-list.txt")
+      if ! cmp -s "$SCRIPT_DIR/bridges/kimaki/skills-enable-list.txt" "$KIMAKI_CONFIG_DIR/skills-enable-list.txt" 2>/dev/null; then
+        cp "$SCRIPT_DIR/bridges/kimaki/skills-enable-list.txt" "$KIMAKI_CONFIG_DIR/skills-enable-list.txt"
+        log "  Updated $KIMAKI_CONFIG_DIR/skills-enable-list.txt"
+        UPDATED_ITEMS+=("kimaki-config/skills-enable-list.txt")
       fi
     fi
   fi
@@ -694,19 +694,44 @@ $skill_filter_plist_args
 EOF
 }
 
+_kimaki_skill_filter_mode() {
+  if [ -n "${KIMAKI_SKILL_ENABLES_FILE:-}" ] \
+    || { [ -n "${KIMAKI_CONFIG_DIR:-}" ] && [ -f "$KIMAKI_CONFIG_DIR/skills-enable-list.txt" ]; } \
+    || { [ -n "${KIMAKI_DATA_DIR:-}" ] && [ -f "$KIMAKI_DATA_DIR/kimaki-config/skills-enable-list.txt" ]; } \
+    || [ -f "$SCRIPT_DIR/bridges/kimaki/skills-enable-list.txt" ]; then
+    printf '%s\n' "enable"
+    return 0
+  fi
+
+  printf '%s\n' "disable"
+}
+
 _kimaki_skill_filter_source() {
+  if [ "$(_kimaki_skill_filter_mode)" = "enable" ]; then
+    if [ -n "${KIMAKI_SKILL_ENABLES_FILE:-}" ]; then
+      printf '%s\n' "$KIMAKI_SKILL_ENABLES_FILE"
+    elif [ -n "${KIMAKI_CONFIG_DIR:-}" ] && [ -f "$KIMAKI_CONFIG_DIR/skills-enable-list.txt" ]; then
+      printf '%s\n' "$KIMAKI_CONFIG_DIR/skills-enable-list.txt"
+    elif [ -n "${KIMAKI_DATA_DIR:-}" ] && [ -f "$KIMAKI_DATA_DIR/kimaki-config/skills-enable-list.txt" ]; then
+      printf '%s\n' "$KIMAKI_DATA_DIR/kimaki-config/skills-enable-list.txt"
+    else
+      printf '%s\n' "$SCRIPT_DIR/bridges/kimaki/skills-enable-list.txt"
+    fi
+    return 0
+  fi
+
   if [ -n "${KIMAKI_SKILL_FILTERS_FILE:-}" ]; then
     printf '%s\n' "$KIMAKI_SKILL_FILTERS_FILE"
   elif [ -n "${KIMAKI_CONFIG_DIR:-}" ] && [ -f "$KIMAKI_CONFIG_DIR/skills-disable-list.txt" ]; then
     printf '%s\n' "$KIMAKI_CONFIG_DIR/skills-disable-list.txt"
   elif [ -n "${KIMAKI_DATA_DIR:-}" ] && [ -f "$KIMAKI_DATA_DIR/kimaki-config/skills-disable-list.txt" ]; then
     printf '%s\n' "$KIMAKI_DATA_DIR/kimaki-config/skills-disable-list.txt"
   else
-    printf '%s\n' "$SCRIPT_DIR/bridges/kimaki/skills-disable-list.txt"
+    printf '%s\n' ""
   fi
 }
 
-_kimaki_each_disabled_skill() {
+_kimaki_each_filtered_skill() {
   local filters_file skill
   filters_file="$(_kimaki_skill_filter_source)"
   [ -f "$filters_file" ] || return 0
@@ -719,20 +744,30 @@ _kimaki_each_disabled_skill() {
 }
 
 _kimaki_skill_filter_args_shell() {
-  local out="" skill
+  local out="" skill flag
+  if [ "$(_kimaki_skill_filter_mode)" = "enable" ]; then
+    flag="--enable-skill"
+  else
+    flag="--disable-skill"
+  fi
   while IFS= read -r skill; do
-    out="$out --disable-skill $skill"
-  done < <(_kimaki_each_disabled_skill)
+    out="$out $flag $skill"
+  done < <(_kimaki_each_filtered_skill)
   printf '%s' "$out"
 }
 
 _kimaki_skill_filter_args_plist() {
-  local out="" skill
+  local out="" skill flag
+  if [ "$(_kimaki_skill_filter_mode)" = "enable" ]; then
+    flag="--enable-skill"
+  else
+    flag="--disable-skill"
+  fi
   while IFS= read -r skill; do
-    out="$out        <string>--disable-skill</string>
+    out="$out        <string>$flag</string>
         <string>$skill</string>
 "
-  done < <(_kimaki_each_disabled_skill)
+  done < <(_kimaki_each_filtered_skill)
   printf '%s' "$out"
 }
 

bridges/kimaki/skills-enable-list.txt

@@ -0,0 +1,4 @@
+# Skills to enable in managed Kimaki services.
+# One skill name per line. Lines starting with # are ignored.
+
+upgrade-wp-coding-agents

tests/__snapshots__/bridges/kimaki-launchd

@@ -11,32 +11,8 @@
         <string>/home/chubes/.kimaki</string>
         <string>--auto-restart</string>
         <string>--no-critique</string>
-        <string>--disable-skill</string>
-        <string>batch</string>
-        <string>--disable-skill</string>
-        <string>critique</string>
-        <string>--disable-skill</string>
-        <string>egaki</string>
-        <string>--disable-skill</string>
-        <string>errore</string>
-        <string>--disable-skill</string>
-        <string>goke</string>
-        <string>--disable-skill</string>
-        <string>lintcn</string>
-        <string>--disable-skill</string>
-        <string>npm-package</string>
-        <string>--disable-skill</string>
-        <string>playwriter</string>
-        <string>--disable-skill</string>
-        <string>spiceflow</string>
-        <string>--disable-skill</string>
-        <string>termcast</string>
-        <string>--disable-skill</string>
-        <string>tuistory</string>
-        <string>--disable-skill</string>
-        <string>usecomputer</string>
-        <string>--disable-skill</string>
-        <string>zele</string>
+        <string>--enable-skill</string>
+        <string>upgrade-wp-coding-agents</string>
     </array>
     <key>WorkingDirectory</key>
     <string>/var/www/site</string>

tests/__snapshots__/bridges/kimaki-systemd

@@ -22,7 +22,7 @@ Environment=DATAMACHINE_SITE_PATH=/var/www/site
 # tolerate exit code 1 (no matches found, the happy path on a clean box).
 ExecStartPre=-/usr/bin/pkill -TERM -u chubes -f "opencode-ai/bin/.*serve"
 ExecStartPre=/opt/kimaki-config/post-upgrade.sh
-ExecStart=/usr/bin/kimaki --data-dir /home/chubes/.kimaki --auto-restart --no-critique --disable-skill batch --disable-skill critique --disable-skill egaki --disable-skill errore --disable-skill goke --disable-skill lintcn --disable-skill npm-package --disable-skill playwriter --disable-skill spiceflow --disable-skill termcast --disable-skill tuistory --disable-skill usecomputer --disable-skill zele
+ExecStart=/usr/bin/kimaki --data-dir /home/chubes/.kimaki --auto-restart --no-critique --enable-skill upgrade-wp-coding-agents
 Restart=always
 RestartSec=10
 

upgrade.sh

@@ -11,9 +11,9 @@
 #      to its latest tag when installed.
 #   3. Sync chat-bridge config (dispatches per bridge)
 #        kimaki:
-#          VPS:   /opt/kimaki-config (plugins + post-upgrade.sh + skill filters)
+#          VPS:   /opt/kimaki-config (plugins + post-upgrade.sh + skill allowlist)
 #          Local: $KIMAKI_DATA_DIR/kimaki-config/ for plugins,
-#                 post-upgrade.sh + skill filters, and runs post-upgrade.sh inline (no launchd
+#                 post-upgrade.sh + skill allowlist, and runs post-upgrade.sh inline (no launchd
 #                 ExecStartPre hook).
 #        cc-connect: no per-install artifacts; reports binary version and
 #          reminds user to `npm update -g cc-connect`.
@@ -332,7 +332,7 @@ update_data_machine_plugins() {
 
 # ============================================================================
 # Phase 3: Sync chat-bridge config
-#   kimaki    → plugins + post-upgrade.sh + skills-disable-list (see below).
+#   kimaki    → plugins + post-upgrade.sh + skills-enable-list (see below).
 #   cc-connect → no per-install artifacts beyond the npm package; config.toml
 #                is user-owned. Report version and remind user to
 #                `npm update -g cc-connect` for upstream updates.