@aragon-agent/cli 0.4.3

package/dist/skills/fetch-source.js

@@ -0,0 +1,448 @@
+/**
+ * Install-source identification and fetching (spec §8.2 / §9.2).
+ *
+ * ══════════════════════════════════════════════════════════════════════════
+ * `skill_install.source` IS A MODEL PARAMETER. Treat it as hostile input.
+ * ══════════════════════════════════════════════════════════════════════════
+ *
+ * Four rules are MUST (§8.2.1 / D20). Breaking any one of them is a shell or
+ * argv injection, not a style problem:
+ *
+ *   1. External processes are started with `execFile(cmd, argv[], {shell:false})`
+ *      only. No `exec()`, no `execSync()`, no `shell: true`, no string
+ *      concatenation of a command line. `tools/bash-tool.ts` DOES use
+ *      `shell: true` — that is the bash tool's deliberate purpose and is NOT a
+ *      precedent for this module. Copy `builtins.ts::copyToClipboard` instead.
+ *
+ *   2. Validate BEFORE building argv. `resolveSource()` is pure and spawns
+ *      nothing; anything that fails here never reaches a subprocess.
+ *
+ *   3. Reject a leading `-` on every model-controlled fragment. This matters
+ *      even with a pure argv array: `git clone --branch --upload-pack=calc.exe`
+ *      makes git execute an arbitrary program. `shell: false` does not help.
+ *      The whitelists below already force an alphanumeric first character; the
+ *      explicit check is a second, separately-tested statement of intent.
+ *
+ *   4. Never let git prompt. A private repo would otherwise hang a headless
+ *      install forever waiting on a credential prompt nobody can see.
+ */
+import { execFile } from 'node:child_process';
+import { mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import process from 'node:process';
+import { promisify } from 'node:util';
+import { extractZip, ARCHIVE_MAX_DOWNLOAD_BYTES } from './archive.js';
+import { isDirectory } from './paths.js';
+const execFileAsync = promisify(execFile);
+export const HTTP_TIMEOUT_MS = 15_000;
+export const GIT_TIMEOUT_MS = 120_000;
+export const MAX_REDIRECTS = 3;
+export const SKILL_MD_DOWNLOAD_MAX_BYTES = 512 * 1024;
+// ---------------------------------------------------------------------------
+// Whitelists (§8.2.1 rule 2)
+// ---------------------------------------------------------------------------
+const OWNER_REPO = /^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/;
+const REF = /^[A-Za-z0-9][A-Za-z0-9._/-]{0,199}$/;
+const SUBDIR = /^[A-Za-z0-9][A-Za-z0-9._/-]{0,255}$/;
+const COMMIT_SHA = /^[0-9a-f]{7,40}$/;
+function rejectsDashPrefix(value) {
+    return value.startsWith('-');
+}
+function validOwnerOrRepo(value) {
+    if (value === '.' || value === '..')
+        return false;
+    if (rejectsDashPrefix(value))
+        return false;
+    return OWNER_REPO.test(value);
+}
+function validRef(value) {
+    if (rejectsDashPrefix(value))
+        return false;
+    if (value.includes('..'))
+        return false;
+    if (value.endsWith('/') || value.endsWith('.'))
+        return false;
+    return REF.test(value);
+}
+function validSubdir(value) {
+    if (rejectsDashPrefix(value))
+        return false;
+    if (value.includes('..'))
+        return false;
+    if (value.startsWith('/'))
+        return false;
+    return SUBDIR.test(value);
+}
+// ---------------------------------------------------------------------------
+// Host policy (§9.2 — SSRF guard)
+// ---------------------------------------------------------------------------
+const IPV4 = /^\d{1,3}(?:\.\d{1,3}){3}$/;
+/** `https:` only, hostname on the allowlist, never an IP literal or loopback. */
+export function checkUrlAllowed(raw, allowedHosts) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return { ok: false, error: `not a valid URL: ${raw}` };
+    }
+    if (url.protocol !== 'https:') {
+        return { ok: false, error: `only https:// sources are allowed (got ${url.protocol}//)` };
+    }
+    const host = url.hostname.toLowerCase();
+    if (host === 'localhost' || host.endsWith('.localhost') || IPV4.test(host) || host.includes(':')) {
+        return { ok: false, error: `IP literals and localhost are not allowed: ${host}` };
+    }
+    if (!allowedHosts.map((h) => h.toLowerCase()).includes(host)) {
+        return {
+            ok: false,
+            error: `host "${host}" is not in skills.allowedHosts (${allowedHosts.join(', ')})`,
+        };
+    }
+    return { ok: true, url };
+}
+const UNSUPPORTED = (source) => ({
+    ok: false,
+    error: `Unsupported skill source: ${source}`,
+});
+const GITHUB_SHORTHAND = /^github:(.+)$/;
+const GIT_HOSTS = new Set(['github.com', 'gitlab.com']);
+/**
+ * Classify and validate an install source.
+ *
+ * Every rejection path returns before any subprocess or socket exists — that
+ * property is what AC-15 asserts (mocked `execFile`, call count 0).
+ */
+export function resolveSource(source, allowedHosts) {
+    const trimmed = source.trim();
+    if (trimmed.length === 0)
+        return UNSUPPORTED(source);
+    // 1. `github:owner/repo[/subdir][#ref]`
+    const shorthand = GITHUB_SHORTHAND.exec(trimmed);
+    if (shorthand)
+        return resolveGithubShorthand(shorthand[1], trimmed, allowedHosts);
+    // 2. Local paths — checked before URLs so a Windows path is never a URL.
+    if (!/^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed) && !trimmed.startsWith('git+')) {
+        if (isDirectory(trimmed))
+            return { ok: true, spec: { kind: 'local-dir', path: trimmed } };
+        if (/\.md$/i.test(trimmed))
+            return { ok: true, spec: { kind: 'local-file', path: trimmed } };
+        return UNSUPPORTED(source);
+    }
+    // 3. Explicit git URL.
+    const isGitPlus = trimmed.startsWith('git+');
+    const bare = isGitPlus ? trimmed.slice(4) : trimmed;
+    const [beforeHash, afterHash] = splitOnce(bare, '#');
+    const ref = afterHash ?? null;
+    if (ref !== null && !validRef(ref)) {
+        return { ok: false, error: `Unsupported skill source: invalid ref "${ref}"` };
+    }
+    const checked = checkUrlAllowed(beforeHash, allowedHosts);
+    if (!checked.ok)
+        return { ok: false, error: `Unsupported skill source: ${checked.error}` };
+    const url = checked.url;
+    const segments = url.pathname.split('/').filter((s) => s.length > 0);
+    const looksGit = isGitPlus ||
+        url.pathname.endsWith('.git') ||
+        (GIT_HOSTS.has(url.hostname.toLowerCase()) &&
+            segments.length >= 2 &&
+            !/\.(md|zip|tar\.gz|tgz)$/i.test(url.pathname));
+    if (looksGit) {
+        if (segments.length < 2)
+            return UNSUPPORTED(source);
+        const owner = segments[0];
+        const repo = segments[1].replace(/\.git$/, '');
+        if (!validOwnerOrRepo(owner) || !validOwnerOrRepo(repo)) {
+            return { ok: false, error: `Unsupported skill source: invalid owner/repo in ${source}` };
+        }
+        const subdir = segments.slice(2).join('/');
+        if (subdir.length > 0 && !validSubdir(subdir)) {
+            return { ok: false, error: `Unsupported skill source: invalid subdirectory "${subdir}"` };
+        }
+        return {
+            ok: true,
+            spec: {
+                kind: 'git',
+                url: `https://${url.hostname}/${owner}/${repo}.git`,
+                ref,
+                subdir: subdir.length > 0 ? subdir : null,
+            },
+        };
+    }
+    if (/\.md$/i.test(url.pathname))
+        return { ok: true, spec: { kind: 'https-md', url: url.toString() } };
+    if (/\.zip$/i.test(url.pathname))
+        return { ok: true, spec: { kind: 'https-zip', url: url.toString() } };
+    return UNSUPPORTED(source);
+}
+/**
+ * Expand `github:owner/repo[/subdir][#ref]`.
+ *
+ * The synthesized URL goes through the SAME host allowlist as an explicit one.
+ * The shorthand is sugar, not a second policy: without this check a user who
+ * narrowed `skills.allowedHosts` to an internal mirror would still see the model
+ * reach github.com, and the setting they trusted to stop that would be silently
+ * inert for the shortest, most likely-to-be-used spelling.
+ */
+function resolveGithubShorthand(rest, original, allowedHosts) {
+    const [pathPart, refPart] = splitOnce(rest, '#');
+    const ref = refPart ?? null;
+    if (ref !== null && !validRef(ref)) {
+        return { ok: false, error: `Unsupported skill source: invalid ref "${ref}"` };
+    }
+    const segments = pathPart.split('/').filter((s) => s.length > 0);
+    if (segments.length < 2)
+        return UNSUPPORTED(original);
+    const owner = segments[0];
+    const repo = segments[1].replace(/\.git$/, '');
+    if (!validOwnerOrRepo(owner) || !validOwnerOrRepo(repo)) {
+        return { ok: false, error: `Unsupported skill source: invalid owner/repo in ${original}` };
+    }
+    const subdir = segments.slice(2).join('/');
+    if (subdir.length > 0 && !validSubdir(subdir)) {
+        return { ok: false, error: `Unsupported skill source: invalid subdirectory "${subdir}"` };
+    }
+    const checked = checkUrlAllowed(`https://github.com/${owner}/${repo}`, allowedHosts);
+    if (!checked.ok)
+        return { ok: false, error: `Unsupported skill source: ${checked.error}` };
+    return {
+        ok: true,
+        spec: {
+            kind: 'git',
+            url: `https://github.com/${owner}/${repo}.git`,
+            ref,
+            subdir: subdir.length > 0 ? subdir : null,
+        },
+    };
+}
+function splitOnce(value, sep) {
+    const idx = value.indexOf(sep);
+    if (idx === -1)
+        return [value, undefined];
+    return [value.slice(0, idx), value.slice(idx + 1)];
+}
+async function defaultRunProcess(file, args, options) {
+    const { stdout } = await execFileAsync(file, args, {
+        // Rule 1: argv array, never a shell.
+        shell: false,
+        windowsHide: true,
+        timeout: GIT_TIMEOUT_MS,
+        ...(options.cwd ? { cwd: options.cwd } : {}),
+        // Rule 4: a credential prompt in a non-interactive install is a hang, not a
+        // question — the user would just see the CLI freeze with no explanation.
+        env: { ...process.env, GIT_TERMINAL_PROMPT: '0', GIT_ASKPASS: '', GCM_INTERACTIVE: 'never' },
+    });
+    return { stdout };
+}
+/** Fetch a resolved source into `stagingDir`, returning where the content landed. */
+export async function fetchSource(spec, stagingDir, deps) {
+    await mkdir(stagingDir, { recursive: true });
+    switch (spec.kind) {
+        case 'local-dir':
+            return {
+                dir: spec.path,
+                source: { kind: 'local-dir', url: spec.path, ref: null, subdir: null },
+            };
+        // Single-file sources land in a dedicated subdirectory, never in
+        // `stagingDir` itself: the installer copies whatever directory we return
+        // into `<stagingDir>/content`, and returning the staging root would make
+        // that a copy of a directory into its own child.
+        case 'local-file': {
+            const dir = join(stagingDir, 'single');
+            await mkdir(dir, { recursive: true });
+            await writeFile(join(dir, 'SKILL.md'), await readFile(spec.path, 'utf-8'), 'utf-8');
+            return { dir, source: { kind: 'local-file', url: spec.path, ref: null, subdir: null } };
+        }
+        case 'https-md': {
+            const dir = join(stagingDir, 'single');
+            await mkdir(dir, { recursive: true });
+            const body = await downloadText(spec.url, SKILL_MD_DOWNLOAD_MAX_BYTES, deps);
+            await writeFile(join(dir, 'SKILL.md'), body, 'utf-8');
+            return { dir, source: { kind: 'https-md', url: spec.url, ref: null, subdir: null } };
+        }
+        case 'https-zip': {
+            const buffer = await downloadBuffer(spec.url, ARCHIVE_MAX_DOWNLOAD_BYTES, deps);
+            const extracted = join(stagingDir, 'unpacked');
+            await extractZip(buffer, extracted);
+            return {
+                dir: await descendToSkillRoot(extracted),
+                source: { kind: 'https-zip', url: spec.url, ref: null, subdir: null },
+            };
+        }
+        case 'git': {
+            const cloneDir = join(stagingDir, 'clone');
+            await gitClone(spec, cloneDir, deps);
+            const root = spec.subdir ? join(cloneDir, spec.subdir) : cloneDir;
+            if (!isDirectory(root)) {
+                throw new Error(`subdirectory "${spec.subdir}" not found in the repository`);
+            }
+            // Read the commit BEFORE dropping .git — after the rm there is nothing
+            // left to ask. A branch name alone cannot answer "is the remote ahead?",
+            // which is what `update --check` needs (F9).
+            const resolvedRef = await readHeadSha(cloneDir, deps);
+            // Drop the VCS metadata: it is not part of the skill and would bloat the
+            // manifest and the size budget by an order of magnitude.
+            await rm(join(cloneDir, '.git'), { recursive: true, force: true });
+            return {
+                dir: await descendToSkillRoot(root),
+                source: { kind: 'git', url: spec.url, ref: spec.ref, subdir: spec.subdir, resolvedRef },
+            };
+        }
+    }
+}
+/**
+ * Clone at a single revision.
+ *
+ * `--branch` accepts branches and tags but NOT a bare commit SHA (P2-6), so a
+ * sha-shaped ref takes the init+fetch+checkout path instead of failing with a
+ * confusing "Remote branch not found".
+ */
+async function gitClone(spec, cloneDir, deps) {
+    const run = deps.runProcess ?? defaultRunProcess;
+    const ref = spec.ref;
+    if (ref && COMMIT_SHA.test(ref)) {
+        await mkdir(cloneDir, { recursive: true });
+        await run('git', ['init', '--quiet'], { cwd: cloneDir });
+        await run('git', ['remote', 'add', 'origin', '--', spec.url], { cwd: cloneDir });
+        await run('git', ['fetch', '--depth', '1', 'origin', '--', ref], { cwd: cloneDir });
+        await run('git', ['checkout', '--quiet', 'FETCH_HEAD'], { cwd: cloneDir });
+        return;
+    }
+    // `--` separates options from operands so a hostile URL can never be read as
+    // a flag, even if every check above were somehow bypassed.
+    const args = ['clone', '--depth', '1', '--quiet'];
+    if (ref)
+        args.push('--branch', ref);
+    args.push('--', spec.url, cloneDir);
+    await run('git', args, {});
+}
+/**
+ * Ask a remote for the sha behind `ref`, without downloading anything.
+ *
+ * Subject to the SAME four rules as every other subprocess here (D20): argv
+ * array, `shell:false`, no leading `-` on any model-influenced fragment, and no
+ * credential prompt. The caller must have re-validated the URL against the host
+ * allowlist first — this function does not do policy.
+ *
+ * Returns `null` for "cannot tell", which is the honest answer for a source
+ * git cannot reach, an unmatched ref, or a non-sha reply.
+ */
+export async function gitLsRemote(url, ref, deps) {
+    if (ref !== null && !validRef(ref))
+        return null;
+    const run = deps.runProcess ?? defaultRunProcess;
+    const args = ['ls-remote', '--exit-code', '--', url];
+    if (ref)
+        args.push(ref);
+    try {
+        const { stdout } = await run('git', args, {});
+        const sha = (stdout ?? '').trim().split(/\s+/)[0] ?? '';
+        return COMMIT_SHA.test(sha) ? sha : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The commit the clone actually landed on, or `null` if git would not say.
+ *
+ * Provenance is an OPTIMISATION here, never a precondition: a shallow clone
+ * that succeeded is a valid install even if `rev-parse` fails, so this swallows
+ * its errors instead of failing the install over a nicety.
+ */
+async function readHeadSha(cloneDir, deps) {
+    const run = deps.runProcess ?? defaultRunProcess;
+    try {
+        const { stdout } = await run('git', ['rev-parse', 'HEAD'], { cwd: cloneDir });
+        const sha = (stdout ?? '').trim();
+        return COMMIT_SHA.test(sha) ? sha : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * A repo whose root has no SKILL.md but exactly one subdirectory that does is
+ * the common `repo/skill-name/SKILL.md` layout — descend into it. Ambiguity
+ * (several candidates) is reported so the user can name the subdirectory.
+ */
+async function descendToSkillRoot(dir) {
+    const { readdirSync, existsSync } = await import('node:fs');
+    if (existsSync(join(dir, 'SKILL.md')))
+        return dir;
+    const candidates = readdirSync(dir, { withFileTypes: true })
+        .filter((e) => e.isDirectory() && !e.name.startsWith('.'))
+        .filter((e) => existsSync(join(dir, e.name, 'SKILL.md')))
+        .map((e) => e.name);
+    if (candidates.length === 1)
+        return join(dir, candidates[0]);
+    if (candidates.length > 1) {
+        throw new Error(`the source contains ${candidates.length} skills (${candidates.join(', ')}); ` +
+            'point at one of them explicitly');
+    }
+    return dir;
+}
+// ---------------------------------------------------------------------------
+// HTTP with a byte ceiling and redirect re-checking
+// ---------------------------------------------------------------------------
+async function httpGet(url, deps) {
+    const doFetch = deps.fetchImpl ?? fetch;
+    let current = url;
+    for (let hop = 0; hop <= MAX_REDIRECTS; hop += 1) {
+        // Re-check EVERY hop: an allowlisted host that 302s to an internal address
+        // would otherwise be a free SSRF.
+        const allowed = checkUrlAllowed(current, deps.allowedHosts);
+        if (!allowed.ok)
+            throw new Error(allowed.error);
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), HTTP_TIMEOUT_MS);
+        let response;
+        try {
+            response = await doFetch(current, {
+                redirect: 'manual',
+                signal: controller.signal,
+                headers: { 'User-Agent': deps.userAgent ?? 'aragon-agent-cli' },
+            });
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        if (response.status >= 300 && response.status < 400) {
+            const location = response.headers.get('location');
+            if (!location)
+                throw new Error(`redirect without a Location header (${response.status})`);
+            current = new URL(location, current).toString();
+            continue;
+        }
+        if (!response.ok)
+            throw new Error(`HTTP ${response.status} fetching ${current}`);
+        return response;
+    }
+    throw new Error(`too many redirects (>${MAX_REDIRECTS})`);
+}
+/** Read a response body, aborting as soon as it passes `maxBytes`. */
+async function readCapped(response, maxBytes) {
+    const declared = Number(response.headers.get('content-length') ?? '0');
+    if (declared > maxBytes) {
+        throw new Error(`response is ${declared} bytes (max ${maxBytes})`);
+    }
+    const chunks = [];
+    let total = 0;
+    const body = response.body;
+    if (!body)
+        return Buffer.alloc(0);
+    // Content-Length is advisory; the running total is the real gate.
+    for await (const chunk of body) {
+        total += chunk.byteLength;
+        if (total > maxBytes)
+            throw new Error(`response exceeded ${maxBytes} bytes`);
+        chunks.push(Buffer.from(chunk));
+    }
+    return Buffer.concat(chunks);
+}
+async function downloadText(url, maxBytes, deps) {
+    return (await readCapped(await httpGet(url, deps), maxBytes)).toString('utf-8');
+}
+async function downloadBuffer(url, maxBytes, deps) {
+    return readCapped(await httpGet(url, deps), maxBytes);
+}

package/dist/skills/installer.d.ts

@@ -0,0 +1,117 @@
+/**
+ * Install pipeline (spec §8.3): resolve → stage → validate → approve → commit.
+ *
+ * ══════════════════════════════════════════════════════════════════════════
+ * THE APPROVAL STEP IS FAIL-CLOSED. "No human channel" means REFUSE.
+ * ══════════════════════════════════════════════════════════════════════════
+ *
+ * `ApprovalGate.canPrompt()` is probed BEFORE `request()` is called, and a
+ * `false` answer aborts the install (§8.3.1 / D17). This is not decoration:
+ * `cli.tsx` hands mutating tools a `confirm` callback that resolves `true` when
+ * no handler is attached. That is a fine default for `--confirm`, which is
+ * opt-in and only reachable with the TUI mounted. For skills it would be a
+ * silent hole — `requireApproval` defaults to `true`, and under `-p` the App
+ * never mounts, so the handler is permanently null. Reusing that callback would
+ * make `aragon -p "install the skill at <url> and use it"` write a third-party
+ * directory into the user's skills root with nobody asked and nothing logged.
+ *
+ * Probing first is what makes the safe behaviour the DEFAULT rather than a rule
+ * someone has to remember.
+ */
+import { type SkillScope, type StagedFile } from '@aragon-agent/core/skills';
+import { MANIFEST_FILENAME } from './manifest.js';
+import type { SkillService } from './service.js';
+export interface InstallResult {
+    ok: boolean;
+    name?: string;
+    version?: string;
+    scope?: SkillScope;
+    dir?: string;
+    fileCount?: number;
+    totalBytes?: number;
+    /** D14 — the Level 1 entry, inlined so the model can see it THIS turn. */
+    catalogLine?: string;
+    error?: string;
+}
+export interface RemoveResult {
+    ok: boolean;
+    /** 'not_found' | 'immutable_scope' | 'cancelled' | 'io_error' */
+    reason?: string;
+    error?: string;
+}
+export interface SkillCreateInput {
+    name: string;
+    description: string;
+    body: string;
+    files?: Array<{
+        path: string;
+        content: string;
+    }>;
+    scope?: SkillScope;
+    activation?: 'auto' | 'manual';
+}
+export type Initiator = 'user' | 'agent';
+/** Where a scope's writable root lives; `null` when the scope cannot be written. */
+export declare function writableRootFor(scope: SkillScope, cwd: string): string | null;
+export declare function approve(service: SkillService, summary: string, tool?: string): Promise<{
+    ok: true;
+} | {
+    ok: false;
+    error: string;
+}>;
+export declare function listStagedFiles(root: string, dir?: string, depth?: number): StagedFile[];
+export declare function absoluteFiles(root: string, files: StagedFile[]): string[];
+/**
+ * Replace `target` with `staged` as close to atomically as Windows allows.
+ *
+ * The displaced directory goes to `.staging/.trash/`, NOT to a sibling of the
+ * skills root. A `<root>/pdf-forms.bak-1785…` left behind by a crash mid-commit
+ * still contains a SKILL.md declaring `name: pdf-forms`, so the very next scan
+ * would find two skills with the same name in the same root and pick whichever
+ * `readdir` happened to return first. The user's experience of that is a skill
+ * that "sometimes" reverts to an old version. `.staging/.trash/` is dot-prefixed
+ * and therefore invisible to the scanner by construction.
+ */
+export declare function commitDirectory(staged: string, target: string): void;
+/**
+ * Run the directory-replacement critical section under the per-root lock (§7).
+ *
+ * WHY THE LOCK IS TAKEN *HERE* AND NOT AT THE TOP OF THE INSTALL (deviation
+ * from spec §7.3, recorded in spec §20):
+ *
+ * The corruption §7.1 describes lives entirely inside `commitDirectory()` plus
+ * the manifest write — staging directories are per-UUID and cannot collide.
+ * Taking the lock earlier would mean holding it across a network fetch AND
+ * across the human approval prompt. `LOCK_TTL_MS` is 60 s, and a user who takes
+ * longer than that to answer would have their lock judged stale and preempted —
+ * so the protection would silently switch itself off in exactly the interactive
+ * case it was written for, while a concurrent install would meanwhile fail with
+ * a lock error during a perfectly legitimate parallel download.
+ *
+ * Spec §6.2 already applies this reasoning to `update` (approval at step 7,
+ * lock at step 8). This is the same rule, applied to the one pipeline whose
+ * approval necessarily comes after the fetch.
+ */
+export declare function withRootLock<T>(root: string, critical: () => T): T;
+export declare function installSkill(service: SkillService, source: string, opts: {
+    scope?: SkillScope;
+    name?: string;
+    initiator: Initiator;
+    cwd: string;
+    installer: string;
+}): Promise<InstallResult>;
+export declare function createSkill(service: SkillService, input: SkillCreateInput & {
+    initiator: Initiator;
+}, opts: {
+    cwd: string;
+    installer: string;
+}): Promise<InstallResult>;
+/**
+ * Refusal is a NORMAL outcome here, not an exception — bundled, env and
+ * `.claude/skills` skills are all legitimately un-removable — which is why this
+ * returns a result object rather than `Promise<void>`.
+ */
+export declare function removeSkill(service: SkillService, name: string): Promise<RemoveResult>;
+/** Assemble a SKILL.md from `skill_create` parameters. */
+export declare function renderSkillMarkdown(input: SkillCreateInput): string;
+export { MANIFEST_FILENAME };