@poping/yome 0.0.2 → 0.0.4

package/dist/ui/useThrottledStream.d.ts

@@ -0,0 +1,7 @@
+export interface ThrottledStream {
+    displayText: string;
+    append: (delta: string) => void;
+    reset: () => void;
+    flush: () => void;
+}
+export declare function useThrottledStream(intervalMs?: number): ThrottledStream;

package/dist/ui/useThrottledStream.js

@@ -0,0 +1,63 @@
+// useThrottledStream — coalesce high-frequency text deltas into ~30fps UI updates.
+//
+// LLM streams emit dozens of token deltas per second. Calling React setState
+// on every delta forces Ink to reconcile + paint the entire tree per token —
+// which on long sessions snowballs into terminal IO storms (the root cause of
+// the "long session crashes my terminal" bug). Claude Code / Gemini CLI both
+// solve this by debouncing the live region: tokens are appended to a ref, and
+// React state is updated on a timer.
+//
+// This hook returns:
+//   - displayText: the throttled state suitable for rendering
+//   - append:      O(1) ref-mutation, safe to call from inside an LLM stream
+//   - reset:       clear buffer + state (call on /new, on done, before next run)
+//   - flush:       force-publish ref buffer to state immediately
+//
+// Frame rate is capped at ~30 fps (33ms) by default — Ink's own renderer caps
+// at 30 fps anyway, so anything faster is wasted work.
+import { useCallback, useEffect, useRef, useState } from 'react';
+const DEFAULT_INTERVAL_MS = 33;
+export function useThrottledStream(intervalMs = DEFAULT_INTERVAL_MS) {
+    const [displayText, setDisplayText] = useState('');
+    const bufferRef = useRef('');
+    const lastPublishedRef = useRef('');
+    const timerRef = useRef(null);
+    const ensureTimer = useCallback(() => {
+        if (timerRef.current)
+            return;
+        timerRef.current = setInterval(() => {
+            if (bufferRef.current !== lastPublishedRef.current) {
+                lastPublishedRef.current = bufferRef.current;
+                setDisplayText(bufferRef.current);
+            }
+        }, intervalMs);
+    }, [intervalMs]);
+    const stopTimer = useCallback(() => {
+        if (timerRef.current) {
+            clearInterval(timerRef.current);
+            timerRef.current = null;
+        }
+    }, []);
+    const append = useCallback((delta) => {
+        bufferRef.current += delta;
+        ensureTimer();
+    }, [ensureTimer]);
+    const flush = useCallback(() => {
+        if (bufferRef.current !== lastPublishedRef.current) {
+            lastPublishedRef.current = bufferRef.current;
+            setDisplayText(bufferRef.current);
+        }
+    }, []);
+    const reset = useCallback(() => {
+        stopTimer();
+        bufferRef.current = '';
+        lastPublishedRef.current = '';
+        setDisplayText('');
+    }, [stopTimer]);
+    // Cleanup on unmount — critical for long sessions to avoid orphaned timers.
+    useEffect(() => {
+        return () => stopTimer();
+    }, [stopTimer]);
+    return { displayText, append, reset, flush };
+}
+//# sourceMappingURL=useThrottledStream.js.map

package/dist/ui/useThrottledStream.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useThrottledStream.js","sourceRoot":"","sources":["../../src/ui/useThrottledStream.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,qCAAqC;AACrC,EAAE;AACF,qBAAqB;AACrB,8DAA8D;AAC9D,6EAA6E;AAC7E,iFAAiF;AACjF,iEAAiE;AACjE,EAAE;AACF,8EAA8E;AAC9E,uDAAuD;AAEvD,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjE,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAS/B,MAAM,UAAU,kBAAkB,CAAC,aAAqB,mBAAmB;IACzE,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,gBAAgB,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,MAAM,CAAwC,IAAI,CAAC,CAAC;IAErE,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,EAAE;QACnC,IAAI,QAAQ,CAAC,OAAO;YAAE,OAAO;QAC7B,QAAQ,CAAC,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE;YAClC,IAAI,SAAS,CAAC,OAAO,KAAK,gBAAgB,CAAC,OAAO,EAAE,CAAC;gBACnD,gBAAgB,CAAC,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;gBAC7C,cAAc,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACpC,CAAC;QACH,CAAC,EAAE,UAAU,CAAC,CAAC;IACjB,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAEjB,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;QACjC,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrB,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAChC,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC;QAC1B,CAAC;IACH,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,KAAa,EAAE,EAAE;QAC3C,SAAS,CAAC,OAAO,IAAI,KAAK,CAAC;QAC3B,WAAW,EAAE,CAAC;IAChB,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IAElB,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,IAAI,SAAS,CAAC,OAAO,KAAK,gBAAgB,CAAC,OAAO,EAAE,CAAC;YACnD,gBAAgB,CAAC,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;YAC7C,cAAc,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;IACH,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,SAAS,EAAE,CAAC;QACZ,SAAS,CAAC,OAAO,GAAG,EAAE,CAAC;QACvB,gBAAgB,CAAC,OAAO,GAAG,EAAE,CAAC;QAC9B,cAAc,CAAC,EAAE,CAAC,CAAC;IACrB,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAEhB,4EAA4E;IAC5E,SAAS,CAAC,GAAG,EAAE;QACb,OAAO,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;IAC3B,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAEhB,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC/C,CAAC"}

package/dist/yomeSkills/auth.d.ts

@@ -0,0 +1,20 @@
+export interface YomeAuthState {
+    /** Opaque token issued by /api/cli/auth/exchange. 64 hex chars. */
+    yome_token: string;
+    /** Supabase auth.users.id — the Yome principal. */
+    yome_user_id: string;
+    /** Provider used at login time ("github" today; future: apple/wechat/email). */
+    provider: 'github' | 'apple' | 'email' | 'wechat';
+    /** Provider-side display name at login time, for whoami output. */
+    provider_login?: string;
+    /** ISO-8601 timestamp the token expires. */
+    expires_at: string;
+    /** ISO-8601 timestamp the token was first written. */
+    obtained_at: string;
+}
+export declare function getAuthFilePath(): string;
+export declare function readAuthState(): YomeAuthState | null;
+export declare function writeAuthState(state: YomeAuthState): void;
+export declare function clearAuthState(): boolean;
+/** Bearer header object suitable for fetch({headers}). null if logged out. */
+export declare function bearerHeader(): Record<string, string> | null;

package/dist/yomeSkills/auth.js

@@ -0,0 +1,70 @@
+// CLI-side auth state for `yome login` / `yome whoami` / hub-authenticated
+// commands like `yome skill publish`.
+//
+// Yome's identity model:
+//   - Yome user (Supabase auth.users) is the principal.
+//   - GitHub / Apple / WeChat / email are *providers* attached to that user.
+//   - The CLI cannot hold a Supabase session, so after the user authenticates
+//     against any provider, the hub mints us an opaque "yome_token" tied to
+//     the Yome user_id. That token is what we persist here.
+//
+// We store a single JSON file at ~/.yome/auth.json with mode 0600. Token is
+// plaintext — same trust model as gh CLI's keyring fallback / npm's
+// authToken — but with strict perms so other local users cannot read it.
+//
+// Why no encryption: a passphrase prompt every command would defeat the
+// point of CLI auth, and any keychain integration is platform-specific
+// (macOS Security framework, Linux libsecret). Plain mode 0600 is the
+// pragmatic baseline.
+import { existsSync, mkdirSync, readFileSync, writeFileSync, unlinkSync, chmodSync, } from 'fs';
+import { homedir } from 'os';
+import { join, dirname } from 'path';
+export function getAuthFilePath() {
+    return join(homedir(), '.yome', 'auth.json');
+}
+export function readAuthState() {
+    const f = getAuthFilePath();
+    if (!existsSync(f))
+        return null;
+    try {
+        const text = readFileSync(f, 'utf-8');
+        const obj = JSON.parse(text);
+        if (typeof obj !== 'object' || obj == null)
+            return null;
+        if (typeof obj.yome_token !== 'string' || typeof obj.yome_user_id !== 'string')
+            return null;
+        return obj;
+    }
+    catch {
+        return null;
+    }
+}
+export function writeAuthState(state) {
+    const f = getAuthFilePath();
+    mkdirSync(dirname(f), { recursive: true });
+    writeFileSync(f, JSON.stringify(state, null, 2) + '\n', { mode: 0o600 });
+    // mode in writeFileSync only applies on file CREATION; chmod again to
+    // guarantee the perms even when the file existed already.
+    try {
+        chmodSync(f, 0o600);
+    }
+    catch { /* best effort on Windows */ }
+}
+export function clearAuthState() {
+    const f = getAuthFilePath();
+    if (!existsSync(f))
+        return false;
+    try {
+        unlinkSync(f);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Bearer header object suitable for fetch({headers}). null if logged out. */
+export function bearerHeader() {
+    const s = readAuthState();
+    return s ? { Authorization: `Bearer ${s.yome_token}` } : null;
+}
+//# sourceMappingURL=auth.js.map

package/dist/yomeSkills/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/yomeSkills/auth.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,sCAAsC;AACtC,EAAE;AACF,yBAAyB;AACzB,wDAAwD;AACxD,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,4DAA4D;AAC5D,EAAE;AACF,4EAA4E;AAC5E,oEAAoE;AACpE,yEAAyE;AACzE,EAAE;AACF,wEAAwE;AACxE,uEAAuE;AACvE,sEAAsE;AACtE,sBAAsB;AAEtB,OAAO,EACL,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,GAC1E,MAAM,IAAI,CAAC;AACZ,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAiBrC,MAAM,UAAU,eAAe;IAC7B,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,MAAM,CAAC,GAAG,eAAe,EAAE,CAAC;IAC5B,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;QACxD,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC5F,OAAO,GAAoB,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAoB;IACjD,MAAM,CAAC,GAAG,eAAe,EAAE,CAAC;IAC5B,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,sEAAsE;IACtE,0DAA0D;IAC1D,IAAI,CAAC;QAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,4BAA4B,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,MAAM,CAAC,GAAG,eAAe,EAAE,CAAC;IAC5B,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,CAAC;QAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AAC7D,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,YAAY;IAC1B,MAAM,CAAC,GAAG,aAAa,EAAE,CAAC;IAC1B,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAChE,CAAC"}

package/dist/yomeSkills/blacklist.d.ts

@@ -0,0 +1,33 @@
+export interface BlacklistEntry {
+    slug: string;
+    reason: string;
+    detail?: string | null;
+    added_at: string;
+}
+export interface BlacklistCache {
+    fetched_at: string;
+    entries: BlacklistEntry[];
+}
+export declare const DEFAULT_HUB_BASE = "https://yome.work";
+export declare function getCachePath(): string;
+export declare function readBlacklistCache(): BlacklistCache | null;
+export declare function writeBlacklistCache(c: BlacklistCache): void;
+export interface RefreshOptions {
+    /** Hub base URL override; default = env YOME_HUB_BASE or https://yome.work. */
+    hubBase?: string;
+    /** Test seam — replaces global fetch. */
+    fetcher?: typeof fetch;
+    /** Force refresh even if the cache is still fresh. */
+    force?: boolean;
+}
+/**
+ * Pull the latest blacklist from the hub if needed, write it to the
+ * cache, return whatever we ended up with. Network errors are swallowed
+ * — the previous cache is returned instead so install never breaks
+ * because of a transient hub outage.
+ */
+export declare function refreshBlacklist(opts?: RefreshOptions): Promise<BlacklistCache>;
+/** Sync lookup against the cache only. Returns the entry or null. */
+export declare function isBlacklistedSync(slug: string): BlacklistEntry | null;
+/** Fetch + check. Use during install. */
+export declare function pingBlacklist(slug: string, opts?: RefreshOptions): Promise<BlacklistEntry | null>;

package/dist/yomeSkills/blacklist.js

@@ -0,0 +1,101 @@
+// blacklist.ts — local cache + lookups for the hub's skill blacklist.
+//
+// Lifecycle:
+//   - `yome skill install` calls `pingBlacklist(slug)` which (a) refreshes
+//     the cache if older than 5 min, (b) returns the matching entry if
+//     the slug is denied.
+//   - `yome skill list` consults the cache (no network) so it's instant.
+//   - The CLI agent runtime, on every skill load, checks
+//     `isBlacklistedSync(slug)` against the cache.
+//
+// The cache lives at ~/.yome/blacklist-cache.json. Format:
+//
+//     { fetched_at: ISO,
+//       entries: [{ slug, reason, detail?, added_at }] }
+//
+// We intentionally cache even when `entries` is empty so the next `list`
+// doesn't need a network call.
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+export const DEFAULT_HUB_BASE = 'https://yome.work';
+const CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes
+export function getCachePath() {
+    return join(homedir(), '.yome', 'blacklist-cache.json');
+}
+export function readBlacklistCache() {
+    const f = getCachePath();
+    if (!existsSync(f))
+        return null;
+    try {
+        const obj = JSON.parse(readFileSync(f, 'utf-8'));
+        if (!obj || typeof obj !== 'object')
+            return null;
+        if (!Array.isArray(obj.entries))
+            return null;
+        return obj;
+    }
+    catch {
+        return null;
+    }
+}
+export function writeBlacklistCache(c) {
+    const f = getCachePath();
+    mkdirSync(dirname(f), { recursive: true });
+    writeFileSync(f, JSON.stringify(c, null, 2) + '\n');
+}
+function isFresh(c) {
+    const t = Date.parse(c.fetched_at);
+    if (!Number.isFinite(t))
+        return false;
+    return (Date.now() - t) < CACHE_TTL_MS;
+}
+/**
+ * Pull the latest blacklist from the hub if needed, write it to the
+ * cache, return whatever we ended up with. Network errors are swallowed
+ * — the previous cache is returned instead so install never breaks
+ * because of a transient hub outage.
+ */
+export async function refreshBlacklist(opts = {}) {
+    const cached = readBlacklistCache();
+    if (cached && isFresh(cached) && !opts.force)
+        return cached;
+    const hubBase = (opts.hubBase ?? process.env.YOME_HUB_BASE ?? DEFAULT_HUB_BASE).replace(/\/+$/, '');
+    const fetcher = opts.fetcher ?? fetch;
+    try {
+        const resp = await fetcher(`${hubBase}/api/hub/blacklist`, { headers: { Accept: 'application/json' } });
+        if (!resp.ok)
+            return cached ?? { fetched_at: new Date().toISOString(), entries: [] };
+        const j = (await resp.json());
+        if (!j || j.ok !== true || !Array.isArray(j.entries)) {
+            return cached ?? { fetched_at: new Date().toISOString(), entries: [] };
+        }
+        const fresh = {
+            fetched_at: new Date().toISOString(),
+            entries: j.entries.map((e) => ({
+                slug: e.slug,
+                reason: e.reason,
+                detail: e.detail ?? null,
+                added_at: e.added_at,
+            })),
+        };
+        writeBlacklistCache(fresh);
+        return fresh;
+    }
+    catch {
+        return cached ?? { fetched_at: new Date().toISOString(), entries: [] };
+    }
+}
+/** Sync lookup against the cache only. Returns the entry or null. */
+export function isBlacklistedSync(slug) {
+    const c = readBlacklistCache();
+    if (!c)
+        return null;
+    return c.entries.find((e) => e.slug === slug) ?? null;
+}
+/** Fetch + check. Use during install. */
+export async function pingBlacklist(slug, opts = {}) {
+    const c = await refreshBlacklist(opts);
+    return c.entries.find((e) => e.slug === slug) ?? null;
+}
+//# sourceMappingURL=blacklist.js.map

package/dist/yomeSkills/blacklist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"blacklist.js","sourceRoot":"","sources":["../../src/yomeSkills/blacklist.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,EAAE;AACF,aAAa;AACb,2EAA2E;AAC3E,uEAAuE;AACvE,0BAA0B;AAC1B,yEAAyE;AACzE,yDAAyD;AACzD,mDAAmD;AACnD,EAAE;AACF,2DAA2D;AAC3D,EAAE;AACF,yBAAyB;AACzB,yDAAyD;AACzD,EAAE;AACF,yEAAyE;AACzE,+BAA+B;AAE/B,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAc1C,MAAM,CAAC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AACpD,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AAEhD,MAAM,UAAU,YAAY;IAC1B,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,MAAM,CAAC,GAAG,YAAY,EAAE,CAAC;IACzB,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,OAAO,GAAqB,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,CAAiB;IACnD,MAAM,CAAC,GAAG,YAAY,EAAE,CAAC;IACzB,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,OAAO,CAAC,CAAiB;IAChC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,YAAY,CAAC;AACzC,CAAC;AAWD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAuB,EAAE;IAC9D,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;IACpC,IAAI,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC;IAE5D,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACpG,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,OAAO,oBAAoB,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;QACxG,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,MAAM,IAAI,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACrF,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAiD,CAAC;QAC9E,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YACrD,OAAO,MAAM,IAAI,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACzE,CAAC;QACD,MAAM,KAAK,GAAmB;YAC5B,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC7B,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI;gBACxB,QAAQ,EAAE,CAAC,CAAC,QAAQ;aACrB,CAAC,CAAC;SACJ,CAAC;QACF,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,IAAI,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACzE,CAAC;AACH,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,CAAC,GAAG,kBAAkB,EAAE,CAAC;IAC/B,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC;AACxD,CAAC;AAED,yCAAyC;AACzC,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,OAAuB,EAAE;IACzE,MAAM,CAAC,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvC,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC;AACxD,CAAC"}

package/dist/yomeSkills/capabilities.d.ts

@@ -0,0 +1,54 @@
+export declare const KNOWN_CAPABILITIES: readonly ["fs:read", "fs:write", "fs:delete", "applescript", "network", "shell"];
+export type Capability = (typeof KNOWN_CAPABILITIES)[number];
+export interface AllowedCapabilities {
+    /** Schema version for forward compatibility. */
+    version: 1;
+    /** ISO-8601 timestamp when the user (or auto-grant) decided. */
+    granted_at: string;
+    /** Subset of the manifest's declared capabilities the user said yes to. */
+    allowed: Capability[];
+    /** "user" / "auto-official" / "yes-flag". */
+    granted_by: 'user' | 'auto-official' | 'yes-flag';
+}
+export declare function describeCapability(c: Capability): string;
+/** Strip duplicates and unknown entries from a manifest's `capabilities`. */
+export declare function normaliseDeclared(declared: readonly string[] | undefined): Capability[];
+export declare function isOfficialSlug(slug: string): boolean;
+export declare function readAllowedCapabilities(slug: string): AllowedCapabilities | null;
+export declare function writeAllowedCapabilities(slug: string, ac: AllowedCapabilities): void;
+/**
+ * Decide which capabilities to grant during a fresh install.
+ *
+ * Rules:
+ *   - Empty declared → grant nothing (no prompt).
+ *   - Official slug → auto-grant everything declared.
+ *   - `assumeYes` (--yes) → grant everything declared, mark "yes-flag".
+ *   - Otherwise → ask the user (TTY).
+ *     - In non-TTY, default to **deny** (return ok=false, reason).
+ */
+export interface GrantOptions {
+    /** Bypass the prompt and grant everything (CI / -y). */
+    assumeYes?: boolean;
+    /** Test seam: replace the prompt with a deterministic answer. */
+    prompt?: (declared: readonly Capability[], slug: string) => Promise<boolean>;
+    /** Test seam: control TTY detection. */
+    isTty?: boolean;
+    /** Override clock for tests. */
+    now?: () => Date;
+}
+export interface GrantResult {
+    ok: boolean;
+    granted?: AllowedCapabilities;
+    /** Set when ok=false (user declined / non-TTY). */
+    reason?: string;
+}
+export declare function decideCapabilities(slug: string, declared: readonly string[] | undefined, opts?: GrantOptions): Promise<GrantResult>;
+/** True iff the skill is currently allowed to use `cap`. */
+export declare function isCapabilityAllowed(slug: string, cap: Capability): boolean;
+/**
+ * Revoke a single capability from an installed skill.
+ * Returns true if the file was modified.
+ */
+export declare function revokeCapability(slug: string, cap: Capability, now?: () => Date): boolean;
+/** Re-grant a previously revoked capability (must be in the manifest's declared list to take effect). */
+export declare function grantCapability(slug: string, cap: Capability, now?: () => Date): boolean;

package/dist/yomeSkills/capabilities.js

@@ -0,0 +1,175 @@
+// capabilities.ts — declared / granted *system* capabilities for installed
+// skills.
+//
+// Note on naming: yome-skill.json has had a `capabilities` field since
+// schema v1, but it's used for *semantic* labels ("calendar:read",
+// "ppt:write") that drive the marketplace UI. M9 introduces a separate
+// `system_capabilities` field for the security model — the OS-level
+// resources a skill needs (fs:read, network, applescript, …). At install
+// time we show the user the system_capabilities list and ask "Allow?".
+// The decision is persisted to <skillDir>/allowed-capabilities.json. The
+// agent runtime later refuses any command that exercises a system
+// capability that isn't allowed.
+//
+// "Official" first-party skills (slug starts with "@yome/") get an
+// auto-allow grant — we trust ourselves and don't want to badger the
+// user during the bundled install path. Third-party skills always
+// prompt unless the user passes `--yes`.
+//
+// The system-capability vocabulary is deliberately small + frozen for
+// v0.1. Anything not in KNOWN_CAPABILITIES is silently dropped from a
+// manifest (so the prompt only ever shows things we actually enforce).
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { createInterface } from 'node:readline';
+import { installPathForSlug } from './paths.js';
+export const KNOWN_CAPABILITIES = [
+    'fs:read',
+    'fs:write',
+    'fs:delete',
+    'applescript',
+    'network',
+    'shell',
+];
+const HUMAN_DESCRIPTIONS = {
+    'fs:read': 'read files in your home / working directory',
+    'fs:write': 'create or modify files in your home / working directory',
+    'fs:delete': 'delete files in your home / working directory',
+    applescript: 'drive macOS applications via Apple Events (PowerPoint, Calendar, Reminders, …)',
+    network: 'make outbound HTTP/HTTPS requests',
+    shell: 'run arbitrary shell commands',
+};
+export function describeCapability(c) {
+    return HUMAN_DESCRIPTIONS[c] ?? c;
+}
+/** Strip duplicates and unknown entries from a manifest's `capabilities`. */
+export function normaliseDeclared(declared) {
+    if (!declared)
+        return [];
+    const seen = new Set();
+    for (const c of declared) {
+        if (KNOWN_CAPABILITIES.includes(c)) {
+            seen.add(c);
+        }
+    }
+    return [...seen].sort();
+}
+export function isOfficialSlug(slug) {
+    return slug.startsWith('@yome/');
+}
+function allowedFilePath(slug) {
+    const dir = installPathForSlug(slug);
+    return dir ? join(dir, 'allowed-capabilities.json') : null;
+}
+export function readAllowedCapabilities(slug) {
+    const f = allowedFilePath(slug);
+    if (!f || !existsSync(f))
+        return null;
+    try {
+        const obj = JSON.parse(readFileSync(f, 'utf-8'));
+        if (obj && typeof obj === 'object' && Array.isArray(obj.allowed)) {
+            return obj;
+        }
+    }
+    catch { /* ignored */ }
+    return null;
+}
+export function writeAllowedCapabilities(slug, ac) {
+    const f = allowedFilePath(slug);
+    if (!f)
+        throw new Error(`cannot derive install dir for ${slug}`);
+    writeFileSync(f, JSON.stringify(ac, null, 2) + '\n');
+}
+export async function decideCapabilities(slug, declared, opts = {}) {
+    const norm = normaliseDeclared(declared);
+    const now = (opts.now ?? (() => new Date()))().toISOString();
+    if (norm.length === 0) {
+        return {
+            ok: true,
+            granted: { version: 1, allowed: [], granted_at: now, granted_by: 'auto-official' },
+        };
+    }
+    if (isOfficialSlug(slug)) {
+        return {
+            ok: true,
+            granted: { version: 1, allowed: norm, granted_at: now, granted_by: 'auto-official' },
+        };
+    }
+    if (opts.assumeYes) {
+        return {
+            ok: true,
+            granted: { version: 1, allowed: norm, granted_at: now, granted_by: 'yes-flag' },
+        };
+    }
+    // Need a yes/no decision from the human.
+    const answer = opts.prompt
+        ? await opts.prompt(norm, slug)
+        : await defaultPrompt(norm, slug, opts.isTty);
+    if (!answer) {
+        return { ok: false, reason: 'user declined the capability grant' };
+    }
+    return {
+        ok: true,
+        granted: { version: 1, allowed: norm, granted_at: now, granted_by: 'user' },
+    };
+}
+async function defaultPrompt(declared, slug, isTtyOverride) {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const stdinTty = (typeof process.stdin === 'object' && process.stdin.isTTY) === true;
+    const isTty = isTtyOverride ?? stdinTty;
+    if (!isTty) {
+        process.stderr.write(`! ${slug} requires capabilities (${declared.join(', ')}). ` +
+            `Re-run with --yes to allow non-interactively, or in a TTY.\n`);
+        return false;
+    }
+    process.stdout.write(`\n${slug} requests the following capabilities:\n`);
+    for (const c of declared) {
+        process.stdout.write(`  - ${c}: ${describeCapability(c)}\n`);
+    }
+    process.stdout.write('Allow? [y/N]: ');
+    return await new Promise((resolve) => {
+        const rl = createInterface({ input: process.stdin, output: process.stdout, terminal: false });
+        rl.once('line', (line) => {
+            rl.close();
+            resolve(/^y(es)?$/i.test(line.trim()));
+        });
+    });
+}
+/** True iff the skill is currently allowed to use `cap`. */
+export function isCapabilityAllowed(slug, cap) {
+    const ac = readAllowedCapabilities(slug);
+    if (!ac)
+        return false;
+    return ac.allowed.includes(cap);
+}
+/**
+ * Revoke a single capability from an installed skill.
+ * Returns true if the file was modified.
+ */
+export function revokeCapability(slug, cap, now = () => new Date()) {
+    const ac = readAllowedCapabilities(slug);
+    if (!ac)
+        return false;
+    const before = ac.allowed.length;
+    ac.allowed = ac.allowed.filter((x) => x !== cap);
+    if (ac.allowed.length === before)
+        return false;
+    ac.granted_at = now().toISOString();
+    ac.granted_by = 'user';
+    writeAllowedCapabilities(slug, ac);
+    return true;
+}
+/** Re-grant a previously revoked capability (must be in the manifest's declared list to take effect). */
+export function grantCapability(slug, cap, now = () => new Date()) {
+    const ac = readAllowedCapabilities(slug) ?? {
+        version: 1, allowed: [], granted_at: now().toISOString(), granted_by: 'user',
+    };
+    if (ac.allowed.includes(cap))
+        return false;
+    ac.allowed = [...ac.allowed, cap].sort();
+    ac.granted_at = now().toISOString();
+    ac.granted_by = 'user';
+    writeAllowedCapabilities(slug, ac);
+    return true;
+}
+//# sourceMappingURL=capabilities.js.map

package/dist/yomeSkills/capabilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../../src/yomeSkills/capabilities.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,UAAU;AACV,EAAE;AACF,uEAAuE;AACvE,mEAAmE;AACnE,uEAAuE;AACvE,oEAAoE;AACpE,yEAAyE;AACzE,uEAAuE;AACvE,yEAAyE;AACzE,kEAAkE;AAClE,iCAAiC;AACjC,EAAE;AACF,mEAAmE;AACnE,qEAAqE;AACrE,kEAAkE;AAClE,yCAAyC;AACzC,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,uEAAuE;AAEvE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEhD,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,SAAS;IACT,UAAU;IACV,WAAW;IACX,aAAa;IACb,SAAS;IACT,OAAO;CACC,CAAC;AAcX,MAAM,kBAAkB,GAA+B;IACrD,SAAS,EAAE,6CAA6C;IACxD,UAAU,EAAE,yDAAyD;IACrE,WAAW,EAAE,+CAA+C;IAC5D,WAAW,EAAE,gFAAgF;IAC7F,OAAO,EAAE,mCAAmC;IAC5C,KAAK,EAAE,8BAA8B;CACtC,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAAC,CAAa;IAC9C,OAAO,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,iBAAiB,CAAC,QAAuC;IACvE,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAc,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAK,kBAAwC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,IAAI,CAAC,GAAG,CAAC,CAAe,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACrC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACjD,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACjE,OAAO,GAA0B,CAAC;QACpC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,aAAa,CAAC,CAAC;IACzB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,IAAY,EAAE,EAAuB;IAC5E,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,EAAE,CAAC,CAAC;IACjE,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AACvD,CAAC;AA8BD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAY,EACZ,QAAuC,EACvC,OAAqB,EAAE;IAEvB,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;IAE7D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,EAAE,EAAE,IAAI;YACR,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,eAAe,EAAE;SACnF,CAAC;IACJ,CAAC;IAED,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,EAAE,EAAE,IAAI;YACR,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,eAAe,EAAE;SACrF,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,OAAO;YACL,EAAE,EAAE,IAAI;YACR,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE;SAChF,CAAC;IACJ,CAAC;IAED,yCAAyC;IACzC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM;QACxB,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC;QAC/B,CAAC,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAEhD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;IACrE,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE;KAC5E,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,QAA+B,EAC/B,IAAY,EACZ,aAAuB;IAEvB,8DAA8D;IAC9D,MAAM,QAAQ,GAAG,CAAC,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAK,OAAO,CAAC,KAAa,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;IAC9F,MAAM,KAAK,GAAG,aAAa,IAAI,QAAQ,CAAC;IACxC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,KAAK,IAAI,2BAA2B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;YAC5D,8DAA8D,CAC/D,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,yCAAyC,CAAC,CAAC;IACzE,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAEvC,OAAO,MAAM,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,EAAE;QAC5C,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9F,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACvB,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,GAAe;IAC/D,MAAM,EAAE,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IACtB,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,GAAe,EAAE,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;IAChG,MAAM,EAAE,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IACtB,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IACjC,EAAE,CAAC,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;IACjD,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC/C,EAAE,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IACpC,EAAE,CAAC,UAAU,GAAG,MAAM,CAAC;IACvB,wBAAwB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,GAAe,EAAE,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;IAC/F,MAAM,EAAE,GAAG,uBAAuB,CAAC,IAAI,CAAC,IAAI;QAC1C,OAAO,EAAE,CAAU,EAAE,OAAO,EAAE,EAAkB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,MAAe;KAC/G,CAAC;IACF,IAAI,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,EAAE,CAAC,OAAO,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,EAAE,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IACpC,EAAE,CAAC,UAAU,GAAG,MAAM,CAAC;IACvB,wBAAwB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/yomeSkills/capabilityGuard.d.ts

@@ -0,0 +1,31 @@
+import { type Capability } from './capabilities.js';
+export interface CapDecision {
+    allowed: boolean;
+    /** Human-readable reason on denial (suitable for printing to the user). */
+    reason?: string;
+    /** Where the decision came from — useful in logs. */
+    source: 'sidecar' | 'official-no-sidecar' | 'unknown-skill' | 'unknown-cap';
+}
+/** Snapshot of denials since process start. Used by `yome skill doctor` v2. */
+export declare function getDenialCounts(): Array<{
+    slug: string;
+    capability: string;
+    count: number;
+}>;
+/** Reset counters (test seam). */
+export declare function resetDenialCounts(): void;
+/**
+ * Synchronous capability check — safe to call from inside a tool dispatch
+ * hot path. Reads two small files (manifest + allowed-cap sidecar) but
+ * does not block on network or DB.
+ *
+ * @returns Decision with `allowed: true` ⇒ proceed; otherwise deny and
+ * surface `reason` to the LLM so it can pick a different action.
+ */
+export declare function checkCapability(slug: string, cap: Capability | string): CapDecision;
+/**
+ * Throwing variant — convenience for dispatchers that prefer exceptions
+ * over decision objects. Errors are tagged so callers can render them
+ * cleanly to the LLM.
+ */
+export declare function assertCapability(slug: string, cap: Capability | string): void;