@pilllesss/yorn 1.0.0

package/dist/skills/graphify/references/update.md

@@ -0,0 +1,210 @@
+# graphify reference: incremental update and cluster-only
+
+Load this only when the user passed `--update` or `--cluster-only`. A first-time full build never reads this file.
+
+## For --update (incremental re-extraction)
+
+Use when you've added or modified files since the last run. Only re-extracts changed files - saves tokens and time.
+
+```bash
+$(cat graphify-out/.graphify_python) -c "
+import sys, json
+from graphify.detect import detect_incremental, save_manifest
+from pathlib import Path
+
+result = detect_incremental(Path('INPUT_PATH'))
+new_total = result.get('new_total', 0)
+print(json.dumps(result, indent=2, ensure_ascii=False))
+Path('graphify-out/.graphify_incremental.json').write_text(json.dumps(result, ensure_ascii=False), encoding=\"utf-8\")
+deleted = list(result.get('deleted_files', []))
+if new_total == 0 and not deleted:
+    print('No files changed since last run. Nothing to update.')
+    raise SystemExit(0)
+if deleted:
+    print(f'{len(deleted)} deleted file(s) to prune.')
+if new_total > 0:
+    print(f'{new_total} new/changed file(s) to re-extract.')
+"
+```
+
+Then populate `.graphify_detect.json` so Steps 3A–6 (which read it unconditionally) see the right state for an incremental run. `files` carries the changed subset (drives Step 3A AST + Step 3B0 cache check on only what changed); `all_files` carries the full corpus for any step that needs corpus-wide context:
+
+```bash
+$(cat graphify-out/.graphify_python) -c "
+import json
+from pathlib import Path
+r = json.loads(Path('graphify-out/.graphify_incremental.json').read_text(encoding=\"utf-8\"))
+Path('graphify-out/.graphify_detect.json').write_text(json.dumps({
+    'files': r.get('new_files', {}),
+    'all_files': r.get('files', {}),
+    'total_files': r.get('new_total', 0),
+    'total_words': r.get('total_words', 0),
+    'skipped_sensitive': r.get('skipped_sensitive', []),
+    'needs_graph': True,
+}, ensure_ascii=False), encoding=\"utf-8\")
+"
+```
+
+If new files exist, first check whether all changed files are code files:
+
+```bash
+$(cat graphify-out/.graphify_python) -c "
+import json
+from pathlib import Path
+
+result = json.loads(open('graphify-out/.graphify_incremental.json', encoding='utf-8').read()) if Path('graphify-out/.graphify_incremental.json').exists() else {}
+code_exts = {'.py','.ts','.js','.go','.rs','.java','.cpp','.c','.rb','.swift','.kt','.cs','.scala','.php','.cc','.cxx','.hpp','.h','.kts','.lua','.toc','.f','.F','.f90','.F90','.f95','.F95','.f03','.F03','.f08','.F08'}
+new_files = result.get('new_files', {})
+all_changed = [f for files in new_files.values() for f in files]
+code_only = all(Path(f).suffix.lower() in code_exts for f in all_changed)
+print('code_only:', code_only)
+"
+```
+
+If `code_only` is True: print `[graphify update] Code-only changes detected - skipping semantic extraction (no LLM needed)`, run only Step 3A (AST) on the changed files, skip Step 3B entirely (no subagents), then go straight to merge and Steps 4–8.
+
+If `code_only` is False (any changed file is a doc/paper/image/video): **first, if any changed file is in `new_files['video']`, run `references/transcribe.md` (Step 2.5) on those files, then rewrite `.graphify_detect.json` to move the resulting transcript paths into `files['document']` and drop `files['video']`** — otherwise raw `.mp4/.mp3` paths are fed to semantic subagents as unreadable media (#1392). Then run the full Steps 3A–3C pipeline as normal.
+
+
+If no new files exist (only deletions), create an empty extraction so the merge step can prune:
+
+```bash
+if [ ! -f graphify-out/.graphify_extract.json ]; then
+    echo '[graphify update] Only deletions -- creating empty extraction for merge.'
+    $(cat graphify-out/.graphify_python) -c "
+import json
+from pathlib import Path
+Path('graphify-out/.graphify_extract.json').write_text(json.dumps({'nodes':[],'edges':[],'hyperedges':[],'input_tokens':0,'output_tokens':0}), encoding='utf-8')
+"
+fi
+```
+
+
+Then:
+
+```bash
+$(cat graphify-out/.graphify_python) -c "
+import json
+from pathlib import Path
+from graphify.build import build_merge
+from graphify.detect import save_manifest
+
+# Load new extraction and incremental state
+new_extraction = json.loads(Path('graphify-out/.graphify_extract.json').read_text(encoding=\"utf-8\"))
+incremental = json.loads(Path('graphify-out/.graphify_incremental.json').read_text(encoding=\"utf-8\"))
+deleted = list(incremental.get('deleted_files', []))
+# prune_sources is ONLY for genuinely DELETED files. Changed/re-extracted files are
+# handled by build_merge's replace-on-re-extract (#1344): every source_file in
+# new_chunks is dropped from the base before merge, so old/stale nodes don't survive.
+# Do NOT add `changed` here: with root= passed, prune_set relativizes to the same base
+# as the freshly merged nodes and would DELETE the re-extracted content (#1178 is moot
+# now that replace — not the dedup pass — reconciles changed files).
+prune = list(deleted) or None
+
+# Use build_merge() — reads graph.json directly without NetworkX round-trip
+# so edge direction (calls, implements, imports) is always preserved (#801).
+# Pass root= so prune_sources (absolute paths from detect_incremental) are
+# relativized to match the graph's relative source_file values; without it
+# nothing is pruned and stale nodes accumulate on every update (#1361).
+# directed=IS_DIRECTED: replace IS_DIRECTED with True if --directed was given, else
+# False. Without it a --directed --update silently rebuilds undirected and collapses
+# reciprocal A<->B edges (#1392).
+G = build_merge(
+    [new_extraction],
+    graph_path='graphify-out/graph.json',
+    prune_sources=prune,
+    root='INPUT_PATH',
+    directed=IS_DIRECTED,
+)
+print(f'[graphify update] Merged: {G.number_of_nodes()} nodes, {G.number_of_edges()} edges')
+
+# Write merged result back to .graphify_extract.json so Step 4 sees the full graph
+merged_out = {
+    'nodes': [{'id': n, **d} for n, d in G.nodes(data=True)],
+    'edges': [
+        # Explicit source/target last so they win over any stale attrs in d.
+        {**{k: val for k, val in d.items() if k not in ('_src', '_tgt', 'source', 'target')},
+         'source': d.get('_src', u), 'target': d.get('_tgt', v)}
+        for u, v, d in G.edges(data=True)
+    ],
+    # G.graph["hyperedges"] holds hyperedges from both existing graph.json
+    # and new_extraction (build_merge combines them). Falling back to
+    # new_extraction only would silently drop prior-run hyperedges (#801).
+    'hyperedges': list(G.graph.get('hyperedges', [])),
+    'input_tokens': new_extraction.get('input_tokens', 0),
+    'output_tokens': new_extraction.get('output_tokens', 0),
+}
+Path('graphify-out/.graphify_extract.json').write_text(json.dumps(merged_out, ensure_ascii=False), encoding=\"utf-8\")
+print(f'[graphify update] Merged extraction written ({len(merged_out[\"nodes\"])} nodes, {len(merged_out[\"edges\"])} edges)')
+
+# Save manifest so next --update diffs against today's state, not the
+# prior run's baseline (prevents ghost-node reports on subsequent updates).
+# root= matches the build_merge call above so the manifest keys stay relative to
+# the scan root — portable across clones/machines, so --update keeps matching
+# cached files instead of missing every one after a move (#1417).
+#
+# Only stamp semantic files (docs/papers/images) that ACTUALLY produced output
+# THIS run (new_extraction is this run's fresh extraction, read above before the
+# merge overwrote the file): a changed doc whose chunk failed must stay unstamped
+# so the next --update re-queues it, otherwise it is marked done and its content
+# is lost forever (#2015). Mirrors the library extract path
+# (cli._stamped_manifest_files + clear_semantic + scan_corpus).
+from graphify.cli import _stamped_manifest_files
+_manifest_files = _stamped_manifest_files(incremental['files'], new_extraction, Path('INPUT_PATH'))
+# Changed semantic files dispatched this run but NOT stamped had their chunk fail
+# or be omitted; clear any stale semantic_hash so they are re-queued (#1948).
+_sem_types = ('document', 'paper', 'image')
+_dispatched = {f for t, fl in incremental.get('new_files', {}).items() if t in _sem_types for f in fl}
+_stamped = {f for fl in _manifest_files.values() for f in fl}
+_cleared = _dispatched - _stamped
+# scan_corpus = the RAW full corpus so in-root files newly excluded since last run
+# are dropped rather than masquerading as deletions; untouched rows preserved (#1908).
+_scan = {f for fl in incremental['files'].values() for f in fl}
+save_manifest(_manifest_files, root='INPUT_PATH', scan_corpus=_scan, clear_semantic=_cleared or None)
+print('[graphify update] Manifest saved.')
+"
+```
+
+Then run Steps 4–8 on the merged graph as normal.
+
+After Step 4, show the graph diff:
+
+```bash
+$(cat graphify-out/.graphify_python) -c "
+import json
+from graphify.analyze import graph_diff
+from graphify.build import build_from_json
+from networkx.readwrite import json_graph
+import networkx as nx
+from pathlib import Path
+
+# Load old graph (before update) from backup written before merge
+old_data = json.loads(Path('graphify-out/.graphify_old.json').read_text(encoding=\"utf-8\")) if Path('graphify-out/.graphify_old.json').exists() else None
+new_extract = json.loads(Path('graphify-out/.graphify_extract.json').read_text(encoding=\"utf-8\"))
+G_new = build_from_json(new_extract, directed=IS_DIRECTED)
+
+if old_data:
+    G_old = json_graph.node_link_graph(old_data, edges='links')
+    diff = graph_diff(G_old, G_new)
+    print(diff['summary'])
+    if diff['new_nodes']:
+        print('New nodes:', ', '.join(n['label'] for n in diff['new_nodes'][:5]))
+    if diff['new_edges']:
+        print('New edges:', len(diff['new_edges']))
+"
+```
+
+Before the merge step, save the old graph: `cp graphify-out/graph.json graphify-out/.graphify_old.json`
+Clean up after: `rm -f graphify-out/.graphify_old.json`
+
+---
+
+## For --cluster-only
+
+Skip Steps 1–3. Re-run clustering on the existing graph:
+
+```bash
+graphify cluster-only .
+```
+
+`graphify cluster-only .` is **self-contained**: it re-clusters, names communities, and regenerates `GRAPH_REPORT.md`, `graph.json`, and `graph.html` from the existing graph. **Do not re-run Steps 5–9** — they read intermediate files (`.graphify_extract.json`, `.graphify_detect.json`, `.graphify_analysis.json`) that a prior build's cleanup (Step 9) already deleted, so they raise `FileNotFoundError` (#1392). When it finishes, present the refreshed `GRAPH_REPORT.md` summary as usual.

package/dist/skills/screenshot/SKILL.md

@@ -0,0 +1,267 @@
+---
+name: "screenshot"
+description: "Use when the user explicitly asks for a desktop or system screenshot (full screen, specific app or window, or a pixel region), or when tool-specific capture capabilities are unavailable and an OS-level capture is needed."
+---
+
+
+# Screenshot Capture
+
+Follow these save-location rules every time:
+
+1) If the user specifies a path, save there.
+2) If the user asks for a screenshot without a path, save to the OS default screenshot location.
+3) If Codex needs a screenshot for its own inspection, save to the temp directory.
+
+## Tool priority
+
+- Prefer tool-specific screenshot capabilities when available (for example: a Figma MCP/skill for Figma files, or Playwright/agent-browser tools for browsers and Electron apps).
+- Use this skill when explicitly asked, for whole-system desktop captures, or when a tool-specific capture cannot get what you need.
+- Otherwise, treat this skill as the default for desktop apps without a better-integrated capture tool.
+
+## macOS permission preflight (reduce repeated prompts)
+
+On macOS, run the preflight helper once before window/app capture. It checks
+Screen Recording permission, explains why it is needed, and requests it in one
+place.
+
+The helpers route Swift's module cache to `$TMPDIR/codex-swift-module-cache`
+to avoid extra sandbox module-cache prompts.
+
+```bash
+bash <path-to-skill>/scripts/ensure_macos_permissions.sh
+```
+
+To avoid multiple sandbox approval prompts, combine preflight + capture in one
+command when possible:
+
+```bash
+bash <path-to-skill>/scripts/ensure_macos_permissions.sh && \
+python3 <path-to-skill>/scripts/take_screenshot.py --app "Codex"
+```
+
+For Codex inspection runs, keep the output in temp:
+
+```bash
+bash <path-to-skill>/scripts/ensure_macos_permissions.sh && \
+python3 <path-to-skill>/scripts/take_screenshot.py --app "<App>" --mode temp
+```
+
+Use the bundled scripts to avoid re-deriving OS-specific commands.
+
+## macOS and Linux (Python helper)
+
+Run the helper from the repo root:
+
+```bash
+python3 <path-to-skill>/scripts/take_screenshot.py
+```
+
+Common patterns:
+
+- Default location (user asked for "a screenshot"):
+
+```bash
+python3 <path-to-skill>/scripts/take_screenshot.py
+```
+
+- Temp location (Codex visual check):
+
+```bash
+python3 <path-to-skill>/scripts/take_screenshot.py --mode temp
+```
+
+- Explicit location (user provided a path or filename):
+
+```bash
+python3 <path-to-skill>/scripts/take_screenshot.py --path output/screen.png
+```
+
+- App/window capture by app name (macOS only; substring match is OK; captures all matching windows):
+
+```bash
+python3 <path-to-skill>/scripts/take_screenshot.py --app "Codex"
+```
+
+- Specific window title within an app (macOS only):
+
+```bash
+python3 <path-to-skill>/scripts/take_screenshot.py --app "Codex" --window-name "Settings"
+```
+
+- List matching window ids before capturing (macOS only):
+
+```bash
+python3 <path-to-skill>/scripts/take_screenshot.py --list-windows --app "Codex"
+```
+
+- Pixel region (x,y,w,h):
+
+```bash
+python3 <path-to-skill>/scripts/take_screenshot.py --mode temp --region 100,200,800,600
+```
+
+- Focused/active window (captures only the frontmost window; use `--app` to capture all windows):
+
+```bash
+python3 <path-to-skill>/scripts/take_screenshot.py --mode temp --active-window
+```
+
+- Specific window id (use --list-windows on macOS to discover ids):
+
+```bash
+python3 <path-to-skill>/scripts/take_screenshot.py --window-id 12345
+```
+
+The script prints one path per capture. When multiple windows or displays match, it prints multiple paths (one per line) and adds suffixes like `-w<windowId>` or `-d<display>`. View each path sequentially with the image viewer tool, and only manipulate images if needed or requested.
+
+### Workflow examples
+
+- "Take a look at <App> and tell me what you see": capture to temp, then view each printed path in order.
+
+```bash
+bash <path-to-skill>/scripts/ensure_macos_permissions.sh && \
+python3 <path-to-skill>/scripts/take_screenshot.py --app "<App>" --mode temp
+```
+
+- "The design from Figma is not matching what is implemented": use a Figma MCP/skill to capture the design first, then capture the running app with this skill (typically to temp) and compare the raw screenshots before any manipulation.
+
+### Multi-display behavior
+
+- On macOS, full-screen captures save one file per display when multiple monitors are connected.
+- On Linux and Windows, full-screen captures use the virtual desktop (all monitors in one image); use `--region` to isolate a single display when needed.
+
+### Linux prerequisites and selection logic
+
+The helper automatically selects the first available tool:
+
+1) `scrot`
+2) `gnome-screenshot`
+3) ImageMagick `import`
+
+If none are available, ask the user to install one of them and retry.
+
+Coordinate regions require `scrot` or ImageMagick `import`.
+
+`--app`, `--window-name`, and `--list-windows` are macOS-only. On Linux, use
+`--active-window` or provide `--window-id` when available.
+
+## Windows (PowerShell helper)
+
+Run the PowerShell helper:
+
+```powershell
+powershell -ExecutionPolicy Bypass -File <path-to-skill>/scripts/take_screenshot.ps1
+```
+
+Common patterns:
+
+- Default location:
+
+```powershell
+powershell -ExecutionPolicy Bypass -File <path-to-skill>/scripts/take_screenshot.ps1
+```
+
+- Temp location (Codex visual check):
+
+```powershell
+powershell -ExecutionPolicy Bypass -File <path-to-skill>/scripts/take_screenshot.ps1 -Mode temp
+```
+
+- Explicit path:
+
+```powershell
+powershell -ExecutionPolicy Bypass -File <path-to-skill>/scripts/take_screenshot.ps1 -Path "C:\Temp\screen.png"
+```
+
+- Pixel region (x,y,w,h):
+
+```powershell
+powershell -ExecutionPolicy Bypass -File <path-to-skill>/scripts/take_screenshot.ps1 -Mode temp -Region 100,200,800,600
+```
+
+- Active window (ask the user to focus it first):
+
+```powershell
+powershell -ExecutionPolicy Bypass -File <path-to-skill>/scripts/take_screenshot.ps1 -Mode temp -ActiveWindow
+```
+
+- Specific window handle (only when provided):
+
+```powershell
+powershell -ExecutionPolicy Bypass -File <path-to-skill>/scripts/take_screenshot.ps1 -WindowHandle 123456
+```
+
+## Direct OS commands (fallbacks)
+
+Use these when you cannot run the helpers.
+
+### macOS
+
+- Full screen to a specific path:
+
+```bash
+screencapture -x output/screen.png
+```
+
+- Pixel region:
+
+```bash
+screencapture -x -R100,200,800,600 output/region.png
+```
+
+- Specific window id:
+
+```bash
+screencapture -x -l12345 output/window.png
+```
+
+- Interactive selection or window pick:
+
+```bash
+screencapture -x -i output/interactive.png
+```
+
+### Linux
+
+- Full screen:
+
+```bash
+scrot output/screen.png
+```
+
+```bash
+gnome-screenshot -f output/screen.png
+```
+
+```bash
+import -window root output/screen.png
+```
+
+- Pixel region:
+
+```bash
+scrot -a 100,200,800,600 output/region.png
+```
+
+```bash
+import -window root -crop 800x600+100+200 output/region.png
+```
+
+- Active window:
+
+```bash
+scrot -u output/window.png
+```
+
+```bash
+gnome-screenshot -w -f output/window.png
+```
+
+## Error handling
+
+- On macOS, run `bash <path-to-skill>/scripts/ensure_macos_permissions.sh` first to request Screen Recording in one place.
+- If you see "screen capture checks are blocked in the sandbox", "could not create image from display", or Swift `ModuleCache` permission errors in a sandboxed run, rerun the command with escalated permissions.
+- If macOS app/window capture returns no matches, run `--list-windows --app "AppName"` and retry with `--window-id`, and make sure the app is visible on screen.
+- If Linux region/window capture fails, check tool availability with `command -v scrot`, `command -v gnome-screenshot`, and `command -v import`.
+- If saving to the OS default location fails with permission errors in a sandbox, rerun the command with escalated permissions.
+- Always report the saved file path in the response.

package/dist/skills/screenshot/scripts/ensure_macos_permissions.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ "$(uname)" != "Darwin" ]]; then
+  echo "ensure_macos_permissions.sh only supports macOS" >&2
+  exit 1
+fi
+
+if ! command -v swift >/dev/null 2>&1; then
+  echo "swift is required to check macOS screen capture permissions" >&2
+  exit 1
+fi
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PERM_SWIFT="$SCRIPT_DIR/macos_permissions.swift"
+MODULE_CACHE="${TMPDIR:-/tmp}/codex-swift-module-cache"
+mkdir -p "$MODULE_CACHE"
+
+screen_capture_status() {
+  local json
+  json="$(swift -module-cache-path "$MODULE_CACHE" "$PERM_SWIFT" "$@")"
+  python3 -c 'import json, sys; data=json.loads(sys.argv[1]); print("1" if data.get("screenCapture") else "0")' "$json"
+}
+
+if [[ -n "${CODEX_SANDBOX:-}" ]]; then
+  echo "Screen capture checks are blocked in the sandbox; rerun with escalated permissions." >&2
+  exit 3
+fi
+
+if [[ "$(screen_capture_status)" == "1" ]]; then
+  echo "Screen Recording permission already granted."
+  exit 0
+fi
+
+cat <<'MSG'
+This workflow needs macOS Screen Recording permission to capture screenshots.
+macOS will show a single system prompt for Screen Recording. Approve it, then
+return here. If macOS opens System Settings instead of prompting, enable Screen
+Recording for your terminal and rerun the command.
+MSG
+
+# Request permission once after explaining why it is needed.
+screen_capture_status --request >/dev/null || true
+
+if [[ "$(screen_capture_status)" != "1" ]]; then
+  cat <<'MSG'
+Screen Recording is still not granted.
+Open System Settings > Privacy & Security > Screen Recording and enable it for
+your terminal (and Codex if needed), then rerun your screenshot command.
+MSG
+  exit 2
+fi
+
+echo "Screen Recording permission granted."

package/dist/skills/screenshot/scripts/macos_display_info.swift

@@ -0,0 +1,22 @@
+import AppKit
+import Foundation
+
+struct Response: Encodable {
+  let count: Int
+  let displays: [Int]
+}
+
+let count = max(NSScreen.screens.count, 1)
+let displays = Array(1...count)
+
+let response = Response(count: count, displays: displays)
+let encoder = JSONEncoder()
+encoder.outputFormatting = [.sortedKeys]
+
+if let data = try? encoder.encode(response),
+   let json = String(data: data, encoding: .utf8) {
+  print(json)
+} else {
+  fputs("{\"count\":\(count)}\n", stderr)
+  exit(1)
+}

package/dist/skills/screenshot/scripts/macos_permissions.swift

@@ -0,0 +1,40 @@
+import CoreGraphics
+import Foundation
+
+struct Status: Encodable {
+  let screenCapture: Bool
+  let requested: Bool
+}
+
+let shouldRequest = CommandLine.arguments.contains("--request")
+
+@available(macOS 10.15, *)
+func screenCaptureGranted(request: Bool) -> Bool {
+  if CGPreflightScreenCaptureAccess() {
+    return true
+  }
+  if request {
+    _ = CGRequestScreenCaptureAccess()
+    return CGPreflightScreenCaptureAccess()
+  }
+  return false
+}
+
+let granted: Bool
+if #available(macOS 10.15, *) {
+  granted = screenCaptureGranted(request: shouldRequest)
+} else {
+  granted = true
+}
+
+let status = Status(screenCapture: granted, requested: shouldRequest)
+let encoder = JSONEncoder()
+encoder.outputFormatting = [.sortedKeys]
+
+if let data = try? encoder.encode(status),
+   let json = String(data: data, encoding: .utf8) {
+  print(json)
+} else {
+  fputs("{\"requested\":\(shouldRequest),\"screenCapture\":\(granted)}\n", stderr)
+  exit(1)
+}