Reference

Trove files

All four are generated by dex learn (or dex catalog / dex notices) and checked by dex validate. Don’t edit them by hand.

trove/catalog.json

{
  "generator": "dex-trove 0.1.0",
  "count": 970,
  "items": [ { …dex.json… }, … ]
}

Every item’s dex.json, sorted by (kind, id). It is rebuilt from the files on disk, so it can never list an item that isn’t there. The CLI (list, search, show, install, ananke sync) and the docs export read it.

trove/EXCLUDED.json

{
  "count": 37,
  "excluded": [
    {
      "source": "anthropic",
      "kind": "skill",
      "name": "docx",
      "path": "skills/docx",
      "reason": "license-denied",
      "detail": "LicenseRef-Proprietary — skills/docx/LICENSE.txt: restrictive terms ('governed by your agreement with')"
    }
  ]
}

One record per refused candidate: source, kind, (slugified) name, upstream path, reason and human-readable evidence. Re-learning a source replaces that source’s records and keeps the others. The Excluded page renders it with links to the upstream path at the learned commit.

trove/trove.lock.json

{
  "sources": {
    "awesome-copilot": {
      "repo": "https://github.com/github/awesome-copilot",
      "ref": "main",
      "commit": "613efc8c21d9b3ce642dff361d17006cd9967e28",
      "learned_at": "2026-10-20T03:29:01+00:00",
      "items": { "agent": 222, "hook": 8, "instruction": 192, "plugin": 72, "skill": 435, "workflow": 8 },
      "excluded": 32
    }
  }
}

The commit each source was learned at, with counts. Together with the item directories this makes a release reproducible. Sources removed from sources.yaml are dropped from the lock.

THIRD_PARTY_NOTICES.md

Aggregated attribution, shipped in the wheel and sdist (license-files in pyproject.toml):

1. a section per source (in sources.yaml order): source URL, licence counts (e.g. MIT (922 items)) and every distinct copyright line;
2. Licence texts: each distinct licence text found in items (LICENSE* files and LICENSE.upstream), de-duplicated by hash, with the sources that use it.

dex validate fails in a checkout if the file is out of date.

Edit this page on GitHub ↗