@poping/yome 0.0.2 → 0.0.3

package/dist/yomeSkills/installGithub.js

@@ -0,0 +1,192 @@
+// cli/src/yomeSkills/installGithub.ts — install a skill from a GitHub repo.
+//
+// Phase 2 source forms (per spec 8.5 / 11.2):
+//   yome skill install github:owner/repo
+//   yome skill install github:owner/repo@v1.2.0           (tag/branch/sha)
+//   yome skill install github:owner/repo#path/to/skill    (subdir within repo)
+//   yome skill install https://github.com/owner/repo
+//   yome skill install https://github.com/owner/repo/tree/<ref>/path/to/skill
+//
+// Strategy:
+//   1. Parse source → { owner, repo, ref?, subPath? }
+//   2. git clone --depth=1 [-b ref] <https-url> <tmp-dir>
+//   3. cd into <tmp-dir>/<subPath?> and treat it as a local skill
+//   4. Delegate to installFromLocal() — same manifest validation,
+//      same install location, same overwrite/force semantics.
+//
+// We deliberately use plain `git clone` (no `gh`) because public skill repos
+// don't require auth and we want install to work for anonymous users too.
+import { spawnSync } from 'node:child_process';
+import { existsSync, mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { installFromLocal } from './install.js';
+import { writeInstallMeta } from './installMeta.js';
+import { readManifest } from './manifest.js';
+const DEFAULT_HUB_BASE = 'https://yome.work';
+function getHubBase() {
+    return (process.env.YOME_HUB_BASE ?? DEFAULT_HUB_BASE).replace(/\/+$/, '');
+}
+/**
+ * Best-effort hub lookup for a skill's expected sha256 fingerprint at
+ * the given version. Returns null if the hub doesn't know about this
+ * slug, doesn't have a fingerprint for that version (older publish), or
+ * is unreachable. The caller treats null as "no verification possible,
+ * proceed".
+ */
+async function fetchExpectedSha256(slug, version) {
+    try {
+        const url = `${getHubBase()}/api/hub/skills/${encodeURIComponent(slug)}?version=${encodeURIComponent(version)}`;
+        const r = await fetch(url, { headers: { Accept: 'application/json' } });
+        if (!r.ok)
+            return null;
+        const j = (await r.json());
+        if (!j || j.ok !== true)
+            return null;
+        const sha = j.version?.tarball_sha256 ?? null;
+        return sha && sha.length >= 32 ? sha : null;
+    }
+    catch {
+        return null;
+    }
+}
+const GITHUB_SHORT_RE = /^github:([^/]+)\/([^@#]+)(?:@([^#]+))?(?:#(.+))?$/i;
+const GITHUB_HTTPS_RE = /^https?:\/\/github\.com\/([^/]+)\/([^/]+?)(?:\.git)?(?:\/(?:tree|blob)\/([^/]+)(?:\/(.+))?)?\/?$/i;
+export function parseGithubSource(source) {
+    const trimmed = source.trim();
+    let owner = null;
+    let repo = null;
+    let ref;
+    let subPath;
+    const short = GITHUB_SHORT_RE.exec(trimmed);
+    if (short) {
+        [, owner, repo, ref, subPath] = short;
+    }
+    else {
+        const long = GITHUB_HTTPS_RE.exec(trimmed);
+        if (long) {
+            [, owner, repo, ref, subPath] = long;
+        }
+    }
+    if (!owner || !repo)
+        return null;
+    return {
+        owner,
+        repo,
+        ref: ref || undefined,
+        subPath: subPath ? subPath.replace(/^\/+|\/+$/g, '') : undefined,
+        cloneUrl: `https://github.com/${owner}/${repo}.git`,
+    };
+}
+export function isGithubSource(source) {
+    return /^github:/i.test(source) || /^https?:\/\/github\.com\//i.test(source);
+}
+function shallowClone(parsed, verbose) {
+    const root = mkdtempSync(join(tmpdir(), 'yome-skill-clone-'));
+    const cloneDir = join(root, parsed.repo);
+    const args = ['clone', '--depth=1'];
+    if (parsed.ref)
+        args.push('-b', parsed.ref);
+    args.push(parsed.cloneUrl, cloneDir);
+    if (verbose)
+        console.log(`$ git ${args.join(' ')}`);
+    const r = spawnSync('git', args, { encoding: 'utf-8' });
+    if (verbose && r.stdout)
+        console.log(r.stdout.trimEnd());
+    if (verbose && r.stderr)
+        console.error(r.stderr.trimEnd());
+    if (r.status !== 0) {
+        rmSync(root, { recursive: true, force: true });
+        const detail = r.stderr?.trim() || `git exited with status ${r.status ?? 'unknown'}`;
+        return { ok: false, reason: `git clone failed: ${detail}` };
+    }
+    return { ok: true, cloneDir };
+}
+/**
+ * Clone the repo into a tmp dir, then delegate to `installFromLocal`. Always
+ * cleans up the tmp clone, even on failure. If `expectedSha256` is provided,
+ * we verify the installed bytes match before declaring success.
+ */
+export async function installFromGithub(source, opts = {}) {
+    const parsed = parseGithubSource(source);
+    if (!parsed) {
+        return { ok: false, reason: `not a GitHub source: ${source}` };
+    }
+    // git availability check — `git --version` should always succeed if installed.
+    const probe = spawnSync('git', ['--version'], { encoding: 'utf-8' });
+    if (probe.status !== 0) {
+        return { ok: false, reason: 'git is not installed or not in PATH' };
+    }
+    const cloned = shallowClone(parsed, !!opts.verbose);
+    if (!cloned.ok)
+        return cloned;
+    let cleanupRoot = resolve(cloned.cloneDir, '..');
+    try {
+        const skillDir = parsed.subPath ? join(cloned.cloneDir, parsed.subPath) : cloned.cloneDir;
+        if (!existsSync(skillDir)) {
+            return { ok: false, reason: `subpath "${parsed.subPath}" does not exist in ${parsed.owner}/${parsed.repo}` };
+        }
+        if (!existsSync(join(skillDir, 'yome-skill.json'))) {
+            return { ok: false, reason: `${parsed.owner}/${parsed.repo}${parsed.subPath ? `/${parsed.subPath}` : ''} has no yome-skill.json` };
+        }
+        // If the caller didn't pre-fetch an expectedSha256, do it now from
+        // the hub. Best-effort — hub unreachable or no fingerprint → null,
+        // and the install proceeds without verification (back-compat).
+        if (!opts.skipVerify && !opts.expectedSha256) {
+            const cloneManifest = readManifest(skillDir);
+            if (cloneManifest) {
+                opts.expectedSha256 = await fetchExpectedSha256(cloneManifest.slug, cloneManifest.version);
+            }
+        }
+        const result = await installFromLocal(skillDir, opts);
+        if (result.ok && result.slug) {
+            // installFromLocal stamped the meta with `local:<tmp clone path>`; rewrite
+            // it to the github: shorthand so `yome skill update` knows what to refetch.
+            try {
+                writeInstallMeta(result.slug, {
+                    source: githubSourceToShorthand(parsed),
+                    installed_at: new Date().toISOString(),
+                    manifest_version: result.slug ? '' : '',
+                });
+                // Keep the version field accurate by reading the manifest at dest.
+                const m = readManifest(result.installedAt);
+                if (m) {
+                    writeInstallMeta(result.slug, {
+                        source: githubSourceToShorthand(parsed),
+                        installed_at: new Date().toISOString(),
+                        manifest_version: m.version,
+                    });
+                }
+            }
+            catch { /* best effort */ }
+            // Post-install sha256 verification. If the hub had no fingerprint
+            // for this version (older publish), expectedSha256 is null/undefined
+            // and we skip — the install proceeds. If it doesn't match, we
+            // tear down the install dir to leave the system in a clean state.
+            if (!opts.skipVerify && opts.expectedSha256 && result.installedAt) {
+                const { verifySkillSha256 } = await import('./integrity.js');
+                const v = verifySkillSha256(result.installedAt, opts.expectedSha256);
+                if (!v.ok) {
+                    rmSync(result.installedAt, { recursive: true, force: true });
+                    return {
+                        ok: false,
+                        reason: `sha256 mismatch — refusing install. expected ${v.expected.slice(0, 12)}…, got ${v.computed.slice(0, 12)}…`,
+                    };
+                }
+            }
+        }
+        return result;
+    }
+    finally {
+        rmSync(cleanupRoot, { recursive: true, force: true });
+    }
+}
+function githubSourceToShorthand(p) {
+    let s = `github:${p.owner}/${p.repo}`;
+    if (p.ref)
+        s += `@${p.ref}`;
+    if (p.subPath)
+        s += `#${p.subPath}`;
+    return s;
+}
+//# sourceMappingURL=installGithub.js.map

package/dist/yomeSkills/installGithub.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"installGithub.js","sourceRoot":"","sources":["../../src/yomeSkills/installGithub.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,EAAE;AACF,8CAA8C;AAC9C,yCAAyC;AACzC,2EAA2E;AAC3E,+EAA+E;AAC/E,qDAAqD;AACrD,8EAA8E;AAC9E,EAAE;AACF,YAAY;AACZ,sDAAsD;AACtD,0DAA0D;AAC1D,kEAAkE;AAClE,kEAAkE;AAClE,8DAA8D;AAC9D,EAAE;AACF,6EAA6E;AAC7E,0EAA0E;AAE1E,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAA2C,MAAM,cAAc,CAAC;AACzF,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAE7C,SAAS,UAAU;IACjB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,mBAAmB,CAAC,IAAY,EAAE,OAAe;IAC9D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,GAAG,UAAU,EAAE,mBAAmB,kBAAkB,CAAC,IAAI,CAAC,YAAY,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;QAChH,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAmE,CAAC;QAC7F,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACrC,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,EAAE,cAAc,IAAI,IAAI,CAAC;QAC9C,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC1B,CAAC;AAWD,MAAM,eAAe,GAAG,oDAAoD,CAAC;AAC7E,MAAM,eAAe,GAAG,mGAAmG,CAAC;AAE5H,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,IAAI,GAAuB,CAAC;IAC5B,IAAI,OAA2B,CAAC;IAEhC,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,KAAK,EAAE,CAAC;QACV,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC;IACxC,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,IAAI,EAAE,CAAC;YACT,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;QACvC,CAAC;IACH,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO;QACL,KAAK;QACL,IAAI;QACJ,GAAG,EAAE,GAAG,IAAI,SAAS;QACrB,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;QAChE,QAAQ,EAAE,sBAAsB,KAAK,IAAI,IAAI,MAAM;KACpD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC/E,CAAC;AAKD,SAAS,YAAY,CAAC,MAA0B,EAAE,OAAgB;IAChE,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAEzC,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,GAAG;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAErC,IAAI,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACpD,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACxD,IAAI,OAAO,IAAI,CAAC,CAAC,MAAM;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACzD,IAAI,OAAO,IAAI,CAAC,CAAC,MAAM;QAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3D,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,0BAA0B,CAAC,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;QACrF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,MAAM,EAAE,EAAE,CAAC;IAC9D,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAWD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAc,EAAE,OAA4C,EAAE;IACpG,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,MAAM,EAAE,EAAE,CAAC;IACjE,CAAC;IAED,+EAA+E;IAC/E,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACrE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;IACtE,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC;IAE9B,IAAI,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC1F,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,MAAM,CAAC,OAAO,uBAAuB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/G,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC,EAAE,CAAC;YACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,yBAAyB,EAAE,CAAC;QACrI,CAAC;QACD,mEAAmE;QACnE,mEAAmE;QACnE,+DAA+D;QAC/D,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YAC7C,MAAM,aAAa,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;YAC7C,IAAI,aAAa,EAAE,CAAC;gBAClB,IAAI,CAAC,cAAc,GAAG,MAAM,mBAAmB,CAAC,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;YAC7F,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACtD,IAAI,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC7B,2EAA2E;YAC3E,4EAA4E;YAC5E,IAAI,CAAC;gBACH,gBAAgB,CAAC,MAAM,CAAC,IAAI,EAAE;oBAC5B,MAAM,EAAE,uBAAuB,CAAC,MAAM,CAAC;oBACvC,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACtC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;iBACxC,CAAC,CAAC;gBACH,mEAAmE;gBACnE,MAAM,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,WAAY,CAAC,CAAC;gBAC5C,IAAI,CAAC,EAAE,CAAC;oBACN,gBAAgB,CAAC,MAAM,CAAC,IAAI,EAAE;wBAC5B,MAAM,EAAE,uBAAuB,CAAC,MAAM,CAAC;wBACvC,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBACtC,gBAAgB,EAAE,CAAC,CAAC,OAAO;qBAC5B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;YAE7B,kEAAkE;YAClE,qEAAqE;YACrE,8DAA8D;YAC9D,kEAAkE;YAClE,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBAClE,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;gBAC7D,MAAM,CAAC,GAAG,iBAAiB,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;gBACrE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;oBACV,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC7D,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,MAAM,EAAE,gDAAgD,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG;qBACpH,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,CAAkE;IACjG,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC,CAAC,GAAG;QAAE,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;IAC5B,IAAI,CAAC,CAAC,OAAO;QAAE,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;IACpC,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/yomeSkills/installMeta.d.ts

@@ -0,0 +1,8 @@
+export interface InstallMeta {
+    source: string;
+    installed_at: string;
+    manifest_version: string;
+}
+export declare function readInstallMeta(slugOrDir: string): InstallMeta | null;
+export declare function writeInstallMeta(slugOrDir: string, meta: InstallMeta): void;
+export declare function clearInstallMeta(slugOrDir: string): void;

package/dist/yomeSkills/installMeta.js

@@ -0,0 +1,76 @@
+// `.install-meta.json` — small per-skill sidecar capturing how the skill
+// was installed. Used by `yome skill update` (to know what to re-pull)
+// and `yome skill list` (to render the source column).
+//
+// Schema (intentionally tiny so it's easy to bump):
+//   {
+//     "source": "github:owner/repo[@ref][#subpath]"
+//             | "local:/abs/path"
+//             | "dev-link:/abs/path"
+//             | "hub:@owner/name"
+//             | "url:<https url>",
+//     "installed_at": "<ISO-8601>",
+//     "manifest_version": "<from yome-skill.json at install time>"
+//   }
+//
+// Missing file = legacy install (pre-meta); `update` treats it as
+// "source unknown — please reinstall manually".
+import { existsSync, readFileSync, writeFileSync, mkdirSync, unlinkSync, } from 'fs';
+import { join, dirname } from 'path';
+import { installPathForSlug } from './paths.js';
+const META_FILENAME = '.install-meta.json';
+function metaPath(slugOrDir) {
+    // Accept either a slug like @yome/ppt OR an absolute install dir.
+    if (slugOrDir.startsWith('/') || slugOrDir.startsWith('.')) {
+        return join(slugOrDir, META_FILENAME);
+    }
+    const dir = installPathForSlug(slugOrDir);
+    if (!dir)
+        throw new Error(`invalid slug: ${slugOrDir}`);
+    return join(dir, META_FILENAME);
+}
+export function readInstallMeta(slugOrDir) {
+    let f;
+    try {
+        f = metaPath(slugOrDir);
+    }
+    catch {
+        return null;
+    }
+    if (!existsSync(f))
+        return null;
+    try {
+        const obj = JSON.parse(readFileSync(f, 'utf-8'));
+        if (typeof obj?.source !== 'string')
+            return null;
+        return {
+            source: String(obj.source),
+            installed_at: String(obj.installed_at ?? ''),
+            manifest_version: String(obj.manifest_version ?? ''),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+export function writeInstallMeta(slugOrDir, meta) {
+    const f = metaPath(slugOrDir);
+    mkdirSync(dirname(f), { recursive: true });
+    writeFileSync(f, JSON.stringify(meta, null, 2) + '\n');
+}
+export function clearInstallMeta(slugOrDir) {
+    let f;
+    try {
+        f = metaPath(slugOrDir);
+    }
+    catch {
+        return;
+    }
+    if (existsSync(f)) {
+        try {
+            unlinkSync(f);
+        }
+        catch { /* ignore */ }
+    }
+}
+//# sourceMappingURL=installMeta.js.map

package/dist/yomeSkills/installMeta.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"installMeta.js","sourceRoot":"","sources":["../../src/yomeSkills/installMeta.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,uEAAuE;AACvE,uDAAuD;AACvD,EAAE;AACF,oDAAoD;AACpD,MAAM;AACN,oDAAoD;AACpD,kCAAkC;AAClC,qCAAqC;AACrC,kCAAkC;AAClC,mCAAmC;AACnC,oCAAoC;AACpC,mEAAmE;AACnE,MAAM;AACN,EAAE;AACF,kEAAkE;AAClE,gDAAgD;AAEhD,OAAO,EACL,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,GAC/D,MAAM,IAAI,CAAC;AACZ,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAQhD,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAE3C,SAAS,QAAQ,CAAC,SAAiB;IACjC,kEAAkE;IAClE,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,GAAG,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,SAAS,EAAE,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,IAAI,CAAS,CAAC;IACd,IAAI,CAAC;QAAC,CAAC,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IACvD,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACjD,IAAI,OAAO,GAAG,EAAE,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACjD,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;YAC1B,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;YAC5C,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC;SACrD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,IAAiB;IACnE,MAAM,CAAC,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC9B,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,IAAI,CAAS,CAAC;IACd,IAAI,CAAC;QAAC,CAAC,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO;IAAC,CAAC;IAClD,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QAClB,IAAI,CAAC;YAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC"}

package/dist/yomeSkills/integrity.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Files & directories that should never contribute to a skill hash.
+ * - VCS plumbing (.git/) is environmental, not skill content.
+ * - .install-meta.json / .yome-disabled / allowed-capabilities.json are
+ *   per-install state files we write *after* the bytes land — including
+ *   them would create chicken-and-egg.
+ * - Build artefacts (node_modules, dist, .DS_Store) are noise.
+ */
+export declare const DEFAULT_IGNORES: ReadonlySet<string>;
+export interface ComputeOptions {
+    /** Override the default ignore set entirely. */
+    ignores?: ReadonlySet<string>;
+}
+/**
+ * Compute the canonical sha256 of a skill directory.
+ * Returns the hex digest (64 chars).
+ */
+export declare function computeSkillSha256(skillDir: string, opts?: ComputeOptions): string;
+export interface VerifyResult {
+    ok: boolean;
+    /** Always present so callers can log. */
+    computed: string;
+    expected: string;
+}
+/** Recompute and compare against an expected hex digest. */
+export declare function verifySkillSha256(skillDir: string, expected: string, opts?: ComputeOptions): VerifyResult;

package/dist/yomeSkills/integrity.js

@@ -0,0 +1,107 @@
+// integrity.ts — content-addressed hash of an installed/source skill.
+//
+// Threat model: a user runs `yome skill install github:Whopus/foo`. Between
+// `git clone` and the bytes landing in ~/.yome/skills the network /
+// CDN / GitHub mirror could substitute different content. We give the
+// hub a sha256 fingerprint at publish time; install verifies it matches.
+//
+// Algorithm (deliberately simple, deterministic, and language-agnostic):
+//
+//   1. Walk the skill directory recursively, collect every file path
+//      relative to the skill root, except those in DEFAULT_IGNORES.
+//   2. Sort paths byte-wise (NFC, no normalisation — "what's on disk").
+//   3. Build a stream of records:
+//        <relative path> NUL <byte length, ASCII> NUL <file bytes> NUL
+//   4. Return the SHA-256 hex digest of the concatenated stream.
+//
+// Properties:
+//   - Same directory tree → same digest, regardless of OS readdir order.
+//   - Adding/removing/renaming any file changes the digest.
+//   - Filesystem perms / mtime do NOT affect the digest (intentionally —
+//     `git clone` resets times, and installing copies don't preserve them).
+import { createHash } from 'node:crypto';
+import { readFileSync, readdirSync, statSync } from 'node:fs';
+import { join, relative, sep } from 'node:path';
+/**
+ * Files & directories that should never contribute to a skill hash.
+ * - VCS plumbing (.git/) is environmental, not skill content.
+ * - .install-meta.json / .yome-disabled / allowed-capabilities.json are
+ *   per-install state files we write *after* the bytes land — including
+ *   them would create chicken-and-egg.
+ * - Build artefacts (node_modules, dist, .DS_Store) are noise.
+ */
+export const DEFAULT_IGNORES = new Set([
+    '.git',
+    'node_modules',
+    'dist',
+    '.next',
+    '.turbo',
+    'coverage',
+    '.DS_Store',
+    '.install-meta.json',
+    '.yome-disabled',
+    'allowed-capabilities.json',
+]);
+/**
+ * Walk dir → return relative paths (slash-separated for portability)
+ * sorted byte-wise.
+ */
+function listFiles(root, ignores) {
+    const out = [];
+    function walk(abs) {
+        let entries;
+        try {
+            entries = readdirSync(abs);
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            if (ignores.has(e))
+                continue;
+            const p = join(abs, e);
+            let st;
+            try {
+                st = statSync(p);
+            }
+            catch {
+                continue;
+            }
+            if (st.isDirectory())
+                walk(p);
+            else if (st.isFile()) {
+                // Normalise to forward-slash so digests are stable cross-platform.
+                out.push(relative(root, p).split(sep).join('/'));
+            }
+        }
+    }
+    walk(root);
+    out.sort();
+    return out;
+}
+/**
+ * Compute the canonical sha256 of a skill directory.
+ * Returns the hex digest (64 chars).
+ */
+export function computeSkillSha256(skillDir, opts = {}) {
+    const ignores = opts.ignores ?? DEFAULT_IGNORES;
+    const files = listFiles(skillDir, ignores);
+    const h = createHash('sha256');
+    const NUL = Buffer.from([0]);
+    for (const rel of files) {
+        const bytes = readFileSync(join(skillDir, rel));
+        h.update(rel, 'utf-8');
+        h.update(NUL);
+        h.update(String(bytes.byteLength), 'utf-8');
+        h.update(NUL);
+        h.update(bytes);
+        h.update(NUL);
+    }
+    return h.digest('hex');
+}
+/** Recompute and compare against an expected hex digest. */
+export function verifySkillSha256(skillDir, expected, opts = {}) {
+    const computed = computeSkillSha256(skillDir, opts);
+    return { ok: computed.toLowerCase() === expected.toLowerCase(), computed, expected };
+}
+//# sourceMappingURL=integrity.js.map

package/dist/yomeSkills/integrity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrity.js","sourceRoot":"","sources":["../../src/yomeSkills/integrity.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,EAAE;AACF,4EAA4E;AAC5E,oEAAoE;AACpE,sEAAsE;AACtE,yEAAyE;AACzE,EAAE;AACF,yEAAyE;AACzE,EAAE;AACF,qEAAqE;AACrE,oEAAoE;AACpE,wEAAwE;AACxE,kCAAkC;AAClC,uEAAuE;AACvE,iEAAiE;AACjE,EAAE;AACF,cAAc;AACd,yEAAyE;AACzE,4DAA4D;AAC5D,yEAAyE;AACzE,4EAA4E;AAE5E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAEhD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC;IAC1D,MAAM;IACN,cAAc;IACd,MAAM;IACN,OAAO;IACP,QAAQ;IACR,UAAU;IACV,WAAW;IACX,oBAAoB;IACpB,gBAAgB;IAChB,2BAA2B;CAC5B,CAAC,CAAC;AAOH;;;GAGG;AACH,SAAS,SAAS,CAAC,IAAY,EAAE,OAA4B;IAC3D,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,SAAS,IAAI,CAAC,GAAW;QACvB,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YAAC,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QACnC,MAAM,CAAC;YAAC,OAAO;QAAC,CAAC;QACjB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,SAAS;YAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACvB,IAAI,EAAE,CAAC;YACP,IAAI,CAAC;gBAAC,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC7C,IAAI,EAAE,CAAC,WAAW,EAAE;gBAAE,IAAI,CAAC,CAAC,CAAC,CAAC;iBACzB,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;gBACrB,mEAAmE;gBACnE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,CAAC;IACX,GAAG,CAAC,IAAI,EAAE,CAAC;IACX,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB,EAAE,OAAuB,EAAE;IAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,eAAe,CAAC;IAChD,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;QAChD,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACvB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC;QAC5C,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AASD,4DAA4D;AAC5D,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,QAAgB,EAAE,OAAuB,EAAE;IAC7F,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACpD,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AACvF,CAAC"}

package/dist/yomeSkills/invoke.d.ts

@@ -0,0 +1,29 @@
+import { type SkillIndexEntry } from './skillsIndex.js';
+export interface InvokeRequest {
+    /** Either '@owner/name' (preferred) or just a domain like 'ppt'. */
+    slugOrDomain: string;
+    /** Action name, e.g. 'new', 'slide.add'. */
+    action: string;
+    positionals?: string[];
+    flags?: Record<string, string | boolean | number | undefined>;
+}
+export interface InvokeResult {
+    ok: boolean;
+    stdout: string;
+    stderr: string;
+    exitCode: number;
+    /** Diagnostic — which skill we resolved to. */
+    resolvedSlug?: string;
+}
+/**
+ * Find the installed skill record for either `@owner/name` or `<domain>`.
+ * Domain lookup picks the first installed skill that owns that domain;
+ * if you have multiple, prefer the explicit slug.
+ */
+export declare function resolveSkill(slugOrDomain: string): SkillIndexEntry | null;
+/**
+ * Run an action. Honors capability grants — anything the manifest
+ * declares as required (and that hasn't been allowed by the user) blocks
+ * the call before we touch osascript.
+ */
+export declare function invokeSkill(req: InvokeRequest): Promise<InvokeResult>;

package/dist/yomeSkills/invoke.js

@@ -0,0 +1,103 @@
+// cli/src/yomeSkills/invoke.ts
+//
+// Top-level entry point for "execute an action on an installed hub
+// skill". Handles slug/domain resolution, capability enforcement, and
+// platform/backend selection. Both the `SkillCall` agent tool and the
+// `yome <domain> <action>` CLI route through this.
+import { homedir } from 'os';
+import { getInstalledFast } from './skillsIndex.js';
+import { readManifest } from './manifest.js';
+import { isCapabilityAllowed } from './capabilities.js';
+import { dispatchMacos, } from '../skills/runner/dispatcher.js';
+/** Expand ~ in a path arg the same way a shell would. */
+function expandTilde(v) {
+    if (typeof v !== 'string')
+        return v;
+    if (v === '~')
+        return homedir();
+    if (v.startsWith('~/'))
+        return homedir() + v.slice(1);
+    return v;
+}
+/**
+ * Find the installed skill record for either `@owner/name` or `<domain>`.
+ * Domain lookup picks the first installed skill that owns that domain;
+ * if you have multiple, prefer the explicit slug.
+ */
+export function resolveSkill(slugOrDomain) {
+    const installed = getInstalledFast();
+    if (slugOrDomain.startsWith('@')) {
+        return installed.find((s) => s.slug === slugOrDomain) ?? null;
+    }
+    return installed.find((s) => s.domain === slugOrDomain) ?? null;
+}
+/**
+ * Run an action. Honors capability grants — anything the manifest
+ * declares as required (and that hasn't been allowed by the user) blocks
+ * the call before we touch osascript.
+ */
+export async function invokeSkill(req) {
+    const entry = resolveSkill(req.slugOrDomain);
+    if (!entry) {
+        return {
+            ok: false, stdout: '', stderr: `skill not installed: ${req.slugOrDomain}`,
+            exitCode: 127,
+        };
+    }
+    if (entry.status !== 'enabled') {
+        return {
+            ok: false, stdout: '', stderr: `skill ${entry.slug} is disabled — enable it via /skills`,
+            exitCode: 1, resolvedSlug: entry.slug,
+        };
+    }
+    const manifest = readManifest(entry.installedAt);
+    if (!manifest) {
+        return {
+            ok: false, stdout: '', stderr: `failed to read manifest at ${entry.installedAt}`,
+            exitCode: 1, resolvedSlug: entry.slug,
+        };
+    }
+    // Enforce declared OS-level capabilities (security model).
+    // Note: manifest.capabilities holds *semantic* labels (calendar:read);
+    // system_capabilities holds the OS-level set we actually gate on.
+    const declared = (manifest.system_capabilities ?? []);
+    const missing = [];
+    for (const cap of declared) {
+        if (!isCapabilityAllowed(entry.slug, cap))
+            missing.push(cap);
+    }
+    if (missing.length > 0) {
+        return {
+            ok: false, stdout: '',
+            stderr: `capability not granted: ${missing.join(', ')}\n` +
+                `Run: yome skill perms ${entry.slug} --grant ${missing[0]}`,
+            exitCode: 13, resolvedSlug: entry.slug,
+        };
+    }
+    // Pick the right backend for this host. We're CLI-on-macOS so the
+    // delivery.macos slot is what we want; if the skill only ships a node
+    // backend, dispatch to that instead (M1 — node backend not implemented
+    // yet, returns an explanatory error).
+    const platform = process.platform;
+    if (platform !== 'darwin') {
+        return {
+            ok: false, stdout: '',
+            stderr: `hub skill execution currently requires macOS (got ${platform})`,
+            exitCode: 1, resolvedSlug: entry.slug,
+        };
+    }
+    const r = await runMacos(entry, req);
+    return { ...r, resolvedSlug: entry.slug };
+}
+async function runMacos(entry, req) {
+    // Expand ~ everywhere — AppleScript's `POSIX file "..."` doesn't honour
+    // tilde, and forcing the LLM to spell out /Users/me/... is annoying.
+    const positionals = (req.positionals ?? []).map((p) => typeof p === 'string' ? expandTilde(p) : p);
+    const flags = {};
+    for (const [k, v] of Object.entries(req.flags ?? {})) {
+        flags[k] = expandTilde(v);
+    }
+    const call = { positionals, flags };
+    return dispatchMacos(entry.installedAt, req.action, call);
+}
+//# sourceMappingURL=invoke.js.map

package/dist/yomeSkills/invoke.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invoke.js","sourceRoot":"","sources":["../../src/yomeSkills/invoke.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,EAAE;AACF,mEAAmE;AACnE,sEAAsE;AACtE,sEAAsE;AACtE,mDAAmD;AAEnD,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAwB,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAsB,MAAM,eAAe,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EACL,aAAa,GAGd,MAAM,gCAAgC,CAAC;AAExC,yDAAyD;AACzD,SAAS,WAAW,CAAC,CAAwC;IAC3D,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,OAAO,EAAE,CAAC;IAChC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,CAAC;AACX,CAAC;AAoBD;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,YAAoB;IAC/C,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;IACrC,IAAI,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,IAAI,IAAI,CAAC;IAChE,CAAC;IACD,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,YAAY,CAAC,IAAI,IAAI,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAkB;IAClD,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,wBAAwB,GAAG,CAAC,YAAY,EAAE;YACzE,QAAQ,EAAE,GAAG;SACd,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO;YACL,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,KAAK,CAAC,IAAI,sCAAsC;YACxF,QAAQ,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,IAAI;SACtC,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACjD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,8BAA8B,KAAK,CAAC,WAAW,EAAE;YAChF,QAAQ,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,IAAI;SACtC,CAAC;IACJ,CAAC;IAED,2DAA2D;IAC3D,uEAAuE;IACvE,kEAAkE;IAClE,MAAM,QAAQ,GAAG,CAAC,QAAQ,CAAC,mBAAmB,IAAI,EAAE,CAEnD,CAAC;IACF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACrB,MAAM,EACJ,2BAA2B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBACjD,yBAAyB,KAAK,CAAC,IAAI,YAAY,OAAO,CAAC,CAAC,CAAC,EAAE;YAC7D,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,IAAI;SACvC,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,sEAAsE;IACtE,uEAAuE;IACvE,sCAAsC;IACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO;YACL,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACrB,MAAM,EAAE,qDAAqD,QAAQ,GAAG;YACxE,QAAQ,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,IAAI;SACtC,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACrC,OAAO,EAAE,GAAG,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;AAC5C,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,KAAsB,EAAE,GAAkB;IAChE,wEAAwE;IACxE,qEAAqE;IACrE,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACpD,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,WAAW,CAAC,CAAC,CAAY,CAAC,CAAC,CAAC,CAAC,CACvD,CAAC;IACF,MAAM,KAAK,GAA0D,EAAE,CAAC;IACxE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;QACrD,KAAK,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IACD,MAAM,IAAI,GAAiB,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IAClD,OAAO,aAAa,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAC5D,CAAC"}

package/dist/yomeSkills/list.d.ts

@@ -0,0 +1,11 @@
+import { type SkillManifest } from './manifest.js';
+export interface InstalledEntry {
+    slug: string;
+    domain: string;
+    version: string;
+    name?: string;
+    description?: string;
+    installedAt: string;
+    manifest: SkillManifest;
+}
+export declare function listInstalled(): InstalledEntry[];

package/dist/yomeSkills/list.js

@@ -0,0 +1,55 @@
+// `yome skill list` — enumerate installed yome-skill.json skills under
+// ~/.yome/skills/<owner>/<name>/. Skills using the legacy SKILL.md
+// markdown format are silently ignored (different system, see existing
+// cli/src/skills/loader.ts).
+import { existsSync, readdirSync, statSync } from 'fs';
+import { join } from 'path';
+import { readManifest } from './manifest.js';
+import { getYomeSkillsRoot } from './paths.js';
+function listChildDirs(dir) {
+    if (!existsSync(dir))
+        return [];
+    try {
+        return readdirSync(dir).filter((n) => {
+            // Skip rollback snapshots — install.ts moves the previous version
+            // sideways to <slug>.previous before overwriting. They have a valid
+            // yome-skill.json so they'd otherwise look like a duplicate install.
+            if (n.endsWith('.previous'))
+                return false;
+            try {
+                return statSync(join(dir, n)).isDirectory();
+            }
+            catch {
+                return false;
+            }
+        });
+    }
+    catch {
+        return [];
+    }
+}
+export function listInstalled() {
+    const root = getYomeSkillsRoot();
+    const out = [];
+    for (const owner of listChildDirs(root)) {
+        const ownerDir = join(root, owner);
+        for (const name of listChildDirs(ownerDir)) {
+            const skillDir = join(ownerDir, name);
+            const manifest = readManifest(skillDir);
+            if (!manifest)
+                continue;
+            out.push({
+                slug: manifest.slug,
+                domain: manifest.domain,
+                version: manifest.version,
+                name: manifest.name,
+                description: manifest.description,
+                installedAt: skillDir,
+                manifest,
+            });
+        }
+    }
+    out.sort((a, b) => a.slug.localeCompare(b.slug));
+    return out;
+}
+//# sourceMappingURL=list.js.map

package/dist/yomeSkills/list.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.js","sourceRoot":"","sources":["../../src/yomeSkills/list.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,mEAAmE;AACnE,uEAAuE;AACvE,6BAA6B;AAE7B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAsB,MAAM,eAAe,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAY/C,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACnC,kEAAkE;YAClE,oEAAoE;YACpE,qEAAqE;YACrE,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC1C,IAAI,CAAC;gBAAC,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,KAAK,CAAC;YAAC,CAAC;QAC9E,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,MAAM,IAAI,GAAG,iBAAiB,EAAE,CAAC;IACjC,MAAM,GAAG,GAAqB,EAAE,CAAC;IAEjC,KAAK,MAAM,KAAK,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACtC,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;YACxC,IAAI,CAAC,QAAQ;gBAAE,SAAS;YACxB,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,WAAW,EAAE,QAAQ;gBACrB,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACjD,OAAO,GAAG,CAAC;AACb,CAAC"}