@poping/yome 0.0.2 → 0.0.4

package/dist/yomeSkills/install.js

@@ -0,0 +1,143 @@
+// `yome skill install <source>` — install a skill into ~/.yome/skills/.
+//
+// During Phase 1 (per spec 8.5) we support local-path installs only:
+//   yome skill install ./skills/yome-skill-ppt
+//   yome skill install /abs/path/to/yome-skill-foo
+// Phase 2 will add registry / git installs:
+//   yome skill install @yome/ppt           (registry resolution)
+//   yome skill install github:owner/repo   (git clone)
+//
+// Install strategy:
+//   - Read source/yome-skill.json, validate slug+domain+version
+//   - Compute install path ~/.yome/skills/<owner>/<name>/
+//   - If already installed and not --force, error out
+//   - Recursively copy source → install path (skip node_modules / .git / dist)
+//   - Done; no post-install hooks in this phase
+import { copyFileSync, existsSync, mkdirSync, readdirSync, renameSync, rmSync, statSync } from 'fs';
+import { join, resolve } from 'path';
+import { readManifest, validateManifest } from './manifest.js';
+import { installPathForSlug, parseSlug } from './paths.js';
+import { writeInstallMeta } from './installMeta.js';
+import { decideCapabilities, writeAllowedCapabilities } from './capabilities.js';
+import { refreshIndex } from './skillsIndex.js';
+import { pingBlacklist } from './blacklist.js';
+const IGNORE = new Set(['node_modules', '.git', 'dist', '.DS_Store', '.next', '.turbo', 'coverage']);
+function copyDir(src, dest, log) {
+    let count = 0;
+    if (!existsSync(dest))
+        mkdirSync(dest, { recursive: true });
+    for (const entry of readdirSync(src)) {
+        if (IGNORE.has(entry))
+            continue;
+        const s = join(src, entry);
+        const d = join(dest, entry);
+        const st = statSync(s);
+        if (st.isDirectory()) {
+            count += copyDir(s, d, log);
+        }
+        else if (st.isFile()) {
+            copyFileSync(s, d);
+            log?.(`  + ${entry}`);
+            count++;
+        }
+    }
+    return count;
+}
+export async function installFromLocal(source, opts = {}) {
+    const abs = resolve(source);
+    if (!existsSync(abs))
+        return { ok: false, reason: `source path does not exist: ${abs}` };
+    if (!statSync(abs).isDirectory())
+        return { ok: false, reason: `source is not a directory: ${abs}` };
+    const manifest = readManifest(abs);
+    if (!manifest)
+        return { ok: false, reason: `${abs}/yome-skill.json missing or unreadable` };
+    const v = validateManifest(manifest);
+    if (!v.ok)
+        return { ok: false, reason: `manifest invalid: ${v.errors.join('; ')}` };
+    const slugParts = parseSlug(manifest.slug);
+    if (!slugParts)
+        return { ok: false, reason: `slug "${manifest.slug}" is malformed` };
+    const dest = installPathForSlug(manifest.slug);
+    if (!dest)
+        return { ok: false, reason: `cannot derive install path for ${manifest.slug}` };
+    // Blacklist gate — done before we touch the filesystem.
+    if (!opts.skipBlacklist) {
+        try {
+            const hit = await pingBlacklist(manifest.slug);
+            if (hit) {
+                return {
+                    ok: false,
+                    reason: `${manifest.slug} is on the yome.work blacklist (${hit.reason})${hit.detail ? `: ${hit.detail}` : ''}`,
+                };
+            }
+        }
+        catch { /* offline → ignore, conservative no-block */ }
+    }
+    // Capability prompt — done before we touch the filesystem so a
+    // declined install leaves no trace.
+    const decision = await decideCapabilities(manifest.slug, manifest.system_capabilities, { assumeYes: opts.yes });
+    if (!decision.ok) {
+        return { ok: false, reason: decision.reason ?? 'capability grant declined' };
+    }
+    if (existsSync(dest)) {
+        if (!opts.force) {
+            return { ok: false, reason: `${manifest.slug} already installed at ${dest} (use --force to overwrite)` };
+        }
+        // Move the existing install aside as the rollback snapshot. We keep
+        // exactly ONE previous version (per spec 11.4-D "保留最近 2 个版本").
+        // The snapshot lives next to the install dir so it shares the slug's
+        // capability grant / parent directory layout.
+        try {
+            const snap = `${dest}.previous`;
+            if (existsSync(snap))
+                rmSync(snap, { recursive: true, force: true });
+            // os.rename is atomic; if it fails (cross-filesystem etc) we fall
+            // back to copy-then-delete via a recursive helper inlined below.
+            try {
+                renameSync(dest, snap);
+            }
+            catch {
+                copyDir(dest, snap);
+                rmSync(dest, { recursive: true, force: true });
+            }
+        }
+        catch {
+            // If snapshotting fails for any reason we still proceed — losing
+            // rollback ability is better than losing the install itself.
+            try {
+                rmSync(dest, { recursive: true, force: true });
+            }
+            catch { /* ignore */ }
+        }
+    }
+    const log = opts.verbose ? (s) => process.stdout.write(s + '\n') : undefined;
+    const copied = copyDir(abs, dest, log);
+    // Persist how we got here so `yome skill update` can replay later.
+    try {
+        writeInstallMeta(manifest.slug, {
+            source: `local:${abs}`,
+            installed_at: new Date().toISOString(),
+            manifest_version: manifest.version,
+        });
+    }
+    catch { /* best effort */ }
+    // Write the capability grant alongside the install meta.
+    try {
+        if (decision.granted)
+            writeAllowedCapabilities(manifest.slug, decision.granted);
+    }
+    catch { /* best effort */ }
+    // Refresh the fast lookup index.
+    try {
+        refreshIndex();
+    }
+    catch { /* best effort */ }
+    return {
+        ok: true,
+        slug: manifest.slug,
+        installedAt: dest,
+        copiedFiles: copied,
+    };
+}
+//# sourceMappingURL=install.js.map

package/dist/yomeSkills/install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.js","sourceRoot":"","sources":["../../src/yomeSkills/install.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,EAAE;AACF,qEAAqE;AACrE,+CAA+C;AAC/C,mDAAmD;AACnD,4CAA4C;AAC5C,iEAAiE;AACjE,uDAAuD;AACvD,EAAE;AACF,oBAAoB;AACpB,gEAAgE;AAChE,0DAA0D;AAC1D,sDAAsD;AACtD,+EAA+E;AAC/E,gDAAgD;AAEhD,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AACpG,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAqB/C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;AAErG,SAAS,OAAO,CAAC,GAAW,EAAE,IAAY,EAAE,GAAyB;IACnE,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QAChC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC5B,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;YACrB,KAAK,IAAI,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QAC9B,CAAC;aAAM,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;YACvB,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACnB,GAAG,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;YACtB,KAAK,EAAE,CAAC;QACV,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc,EAAE,OAAuB,EAAE;IAC9E,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,GAAG,EAAE,EAAE,CAAC;IACzF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,GAAG,EAAE,EAAE,CAAC;IAEpG,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,wCAAwC,EAAE,CAAC;IAE5F,MAAM,CAAC,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IAEpF,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,QAAQ,CAAC,IAAI,gBAAgB,EAAE,CAAC;IACrF,MAAM,IAAI,GAAG,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;IAE3F,wDAAwD;IACxD,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC/C,IAAI,GAAG,EAAE,CAAC;gBACR,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,mCAAmC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;iBAC/G,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,6CAA6C,CAAC,CAAC;IAC3D,CAAC;IAED,+DAA+D;IAC/D,oCAAoC;IACpC,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,mBAAmB,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAChH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,2BAA2B,EAAE,CAAC;IAC/E,CAAC;IAED,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,yBAAyB,IAAI,6BAA6B,EAAE,CAAC;QAC3G,CAAC;QACD,oEAAoE;QACpE,+DAA+D;QAC/D,qEAAqE;QACrE,8CAA8C;QAC9C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,GAAG,IAAI,WAAW,CAAC;YAChC,IAAI,UAAU,CAAC,IAAI,CAAC;gBAAE,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACrE,kEAAkE;YAClE,iEAAiE;YACjE,IAAI,CAAC;gBACH,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACpB,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,6DAA6D;YAC7D,IAAI,CAAC;gBAAC,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAEvC,mEAAmE;IACnE,IAAI,CAAC;QACH,gBAAgB,CAAC,QAAQ,CAAC,IAAI,EAAE;YAC9B,MAAM,EAAE,SAAS,GAAG,EAAE;YACtB,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACtC,gBAAgB,EAAE,QAAQ,CAAC,OAAO;SACnC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAE7B,yDAAyD;IACzD,IAAI,CAAC;QACH,IAAI,QAAQ,CAAC,OAAO;YAAE,wBAAwB,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAE7B,iCAAiC;IACjC,IAAI,CAAC;QAAC,YAAY,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAEnD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,WAAW,EAAE,IAAI;QACjB,WAAW,EAAE,MAAM;KACpB,CAAC;AACJ,CAAC"}

package/dist/yomeSkills/installFromHubTarball.d.ts

@@ -0,0 +1,26 @@
+import { type InstallResult } from './install.js';
+export interface InstallFromHubExtra {
+    /** Override version. When omitted we install the slug's latest non-deprecated. */
+    version?: string;
+    /** Pass through to installFromLocal — auto-grant capabilities, useful in CI. */
+    yes?: boolean;
+    /** Pass through. */
+    force?: boolean;
+    verbose?: boolean;
+    /** Install a deprecated version on purpose. Default false. */
+    allowDeprecated?: boolean;
+    /** Disable post-install sha256 verification (dev/debug). Default false. */
+    skipVerify?: boolean;
+}
+export interface InstallFromHubResult extends InstallResult {
+    /** Distinguish "really came from hub" from "fell through to github". */
+    source?: 'hub' | 'fallback';
+    /** The exact version installed (resolved on the hub). */
+    resolvedVersion?: string;
+}
+/**
+ * Install a slug by pulling the hub-cached tarball. Returns ok=false +
+ * a structured reason whenever the hub doesn't have a usable tarball
+ * — the caller can then fall back to a GitHub clone.
+ */
+export declare function installFromHubTarball(slug: string, opts?: InstallFromHubExtra): Promise<InstallFromHubResult>;

package/dist/yomeSkills/installFromHubTarball.js

@@ -0,0 +1,161 @@
+// cli/src/yomeSkills/installFromHubTarball.ts
+//
+// Hub-cached tarball install path. Used by `yome skill install <slug>`
+// and as the fast path inside `installFromGithub` when the hub already
+// has bytes for the version the user is asking for.
+//
+// Why this exists:
+//   - Sub-second installs vs 5-30s for `git clone --depth=1` from China.
+//   - GitHub repo can be deleted / transferred / temporarily unreachable
+//     and the cached tarball still works.
+//   - The bytes we install are byte-identical to what publisher's
+//     tarball_sha256 was computed against — no race window between
+//     publish-time and install-time on the upstream repo.
+//
+// Pipeline:
+//   1. GET /api/hub/skills/<slug>?version=<v>  (resolve version + sha)
+//   2. GET /api/hub/skills/<slug>/versions/<v>/tarball  (302 → public URL)
+//   3. Stream the tar.gz into a tmp dir
+//   4. Extract via the system `tar -xzf` (same binary cli installs require)
+//   5. Verify sha256 of the extracted tree == hub sha256 == sha256 in the
+//      X-Yome-Skill-Sha256 header from step 2
+//   6. Hand the extracted dir to `installFromLocal()` for the rest of
+//      the install (capability prompt, rollback snapshot, meta write)
+//
+// On any failure the caller falls back to `installFromGithub`. The
+// retry path is opaque — the user just sees one install attempt.
+import { spawnSync } from 'node:child_process';
+import { writeFileSync, mkdtempSync, rmSync, existsSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { installFromLocal } from './install.js';
+import { writeInstallMeta } from './installMeta.js';
+import { computeSkillSha256 } from './integrity.js';
+import { readManifest } from './manifest.js';
+const DEFAULT_HUB_BASE = 'https://yome.work';
+function getHubBase() {
+    return (process.env.YOME_HUB_BASE ?? DEFAULT_HUB_BASE).replace(/\/+$/, '');
+}
+/** GET /api/hub/skills/<slug>[?version=v] — returns null on any failure. */
+async function fetchHubMeta(slug, version) {
+    try {
+        const url = `${getHubBase()}/api/hub/skills/${encodeURIComponent(slug)}` +
+            (version ? `?version=${encodeURIComponent(version)}` : '');
+        const r = await fetch(url, { headers: { Accept: 'application/json' } });
+        if (!r.ok)
+            return null;
+        const j = (await r.json());
+        if (!j || j.ok !== true || !j.skill || !j.version)
+            return null;
+        return {
+            skill: {
+                slug: String(j.skill.slug ?? slug),
+                github_full_name: j.skill.github_full_name ?? null,
+                effective_latest_version: j.skill.effective_latest_version ?? null,
+            },
+            ver: {
+                version: String(j.version.version),
+                tarball_sha256: j.version.tarball_sha256 ?? null,
+                deprecated: !!j.version.deprecated,
+                deprecation_reason: j.version.deprecation_reason ?? null,
+                replaced_by_version: j.version.replaced_by_version ?? null,
+            },
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Install a slug by pulling the hub-cached tarball. Returns ok=false +
+ * a structured reason whenever the hub doesn't have a usable tarball
+ * — the caller can then fall back to a GitHub clone.
+ */
+export async function installFromHubTarball(slug, opts = {}) {
+    const meta = await fetchHubMeta(slug, opts.version);
+    if (!meta) {
+        return { ok: false, source: 'hub', reason: `hub has no record for ${slug}${opts.version ? `@${opts.version}` : ''}` };
+    }
+    // Deprecation gate (mirror installFromGithub).
+    if (meta.ver.deprecated && !opts.allowDeprecated) {
+        const replaced = meta.ver.replaced_by_version
+            ? ` Use --version ${meta.ver.replaced_by_version} instead, or pass --allow-deprecated to override.`
+            : ' Pass --allow-deprecated to install it anyway.';
+        const why = meta.ver.deprecation_reason ? ` Reason: ${meta.ver.deprecation_reason}.` : '';
+        return { ok: false, source: 'hub', reason: `${slug}@${meta.ver.version} is deprecated.${why}${replaced}` };
+    }
+    // Resolve tarball URL via the hub redirect.
+    const tarUrl = `${getHubBase()}/api/hub/skills/${encodeURIComponent(slug)}/versions/${encodeURIComponent(meta.ver.version)}/tarball`;
+    let resp;
+    try {
+        resp = await fetch(tarUrl, { redirect: 'follow' });
+    }
+    catch (e) {
+        return { ok: false, source: 'hub', reason: `tarball fetch failed: ${e.message}` };
+    }
+    if (!resp.ok) {
+        if (resp.status === 410) {
+            return { ok: false, source: 'hub', reason: `${slug}@${meta.ver.version} has no cached tarball (legacy publish; will fall back to git clone)` };
+        }
+        return { ok: false, source: 'hub', reason: `tarball fetch HTTP ${resp.status}` };
+    }
+    const tarBytes = Buffer.from(await resp.arrayBuffer());
+    if (tarBytes.length === 0) {
+        return { ok: false, source: 'hub', reason: `tarball was empty` };
+    }
+    // Extract to tmp dir.
+    const cleanupRoot = mkdtempSync(join(tmpdir(), 'yome-hub-install-'));
+    const extractDir = join(cleanupRoot, 'skill');
+    try {
+        const tarFile = join(cleanupRoot, 'skill.tar.gz');
+        writeFileSync(tarFile, tarBytes);
+        const mk = spawnSync('mkdir', ['-p', extractDir], { encoding: 'utf-8' });
+        if (mk.status !== 0) {
+            return { ok: false, source: 'hub', reason: `mkdir failed: ${mk.stderr || ''}` };
+        }
+        const ut = spawnSync('tar', ['-xzf', tarFile, '-C', extractDir], { encoding: 'utf-8' });
+        if (ut.status !== 0) {
+            return { ok: false, source: 'hub', reason: `tar -xzf failed: ${(ut.stderr || '').trim()}` };
+        }
+        // Verify sha256 of extracted tree against hub-recorded sha.
+        if (!opts.skipVerify && meta.ver.tarball_sha256) {
+            const computed = computeSkillSha256(extractDir);
+            if (computed.toLowerCase() !== meta.ver.tarball_sha256.toLowerCase()) {
+                return {
+                    ok: false,
+                    source: 'hub',
+                    reason: `sha256 mismatch on hub tarball — refusing install. expected ${meta.ver.tarball_sha256.slice(0, 12)}…, got ${computed.slice(0, 12)}…`,
+                };
+            }
+        }
+        if (!existsSync(join(extractDir, 'yome-skill.json'))) {
+            return { ok: false, source: 'hub', reason: `extracted tarball has no yome-skill.json — hub artefact corrupted` };
+        }
+        // Hand off to local install. installFromLocal handles capability
+        // prompt + rollback snapshot + index refresh.
+        const result = await installFromLocal(extractDir, {
+            force: opts.force,
+            verbose: opts.verbose,
+            yes: opts.yes,
+            // skipBlacklist: false (default; hub blacklist still applies)
+        });
+        if (result.ok && result.slug) {
+            // Overwrite the meta with the hub source so `yome skill update`
+            // re-pulls from hub instead of the tmp dir.
+            try {
+                const installed = readManifest(result.installedAt);
+                writeInstallMeta(result.slug, {
+                    source: `hub:${slug}@${meta.ver.version}`,
+                    installed_at: new Date().toISOString(),
+                    manifest_version: installed?.version ?? meta.ver.version,
+                });
+            }
+            catch { /* best effort */ }
+        }
+        return { ...result, source: 'hub', resolvedVersion: meta.ver.version };
+    }
+    finally {
+        rmSync(cleanupRoot, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=installFromHubTarball.js.map

package/dist/yomeSkills/installFromHubTarball.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"installFromHubTarball.js","sourceRoot":"","sources":["../../src/yomeSkills/installFromHubTarball.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,EAAE;AACF,uEAAuE;AACvE,uEAAuE;AACvE,oDAAoD;AACpD,EAAE;AACF,mBAAmB;AACnB,yEAAyE;AACzE,yEAAyE;AACzE,0CAA0C;AAC1C,kEAAkE;AAClE,mEAAmE;AACnE,0DAA0D;AAC1D,EAAE;AACF,YAAY;AACZ,uEAAuE;AACvE,2EAA2E;AAC3E,wCAAwC;AACxC,4EAA4E;AAC5E,0EAA0E;AAC1E,8CAA8C;AAC9C,sEAAsE;AACtE,sEAAsE;AACtE,EAAE;AACF,mEAAmE;AACnE,iEAAiE;AAEjE,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACzE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAA2C,MAAM,cAAc,CAAC;AACzF,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAE7C,SAAS,UAAU;IACjB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC7E,CAAC;AAoCD,4EAA4E;AAC5E,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,OAAgB;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,GACP,GAAG,UAAU,EAAE,mBAAmB,kBAAkB,CAAC,IAAI,CAAC,EAAE;YAC5D,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7D,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAIxB,CAAC;QACF,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC/D,OAAO;YACL,KAAK,EAAE;gBACL,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC;gBAClC,gBAAgB,EAAG,CAAC,CAAC,KAAK,CAAC,gBAA2B,IAAI,IAAI;gBAC9D,wBAAwB,EAAG,CAAC,CAAC,KAAK,CAAC,wBAAmC,IAAI,IAAI;aAC/E;YACD,GAAG,EAAE;gBACH,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;gBAClC,cAAc,EAAG,CAAC,CAAC,OAAO,CAAC,cAAyB,IAAI,IAAI;gBAC5D,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU;gBAClC,kBAAkB,EAAG,CAAC,CAAC,OAAO,CAAC,kBAA6B,IAAI,IAAI;gBACpE,mBAAmB,EAAG,CAAC,CAAC,OAAO,CAAC,mBAA8B,IAAI,IAAI;aACvE;SACF,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAY,EAAE,OAA4B,EAAE;IACtF,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;IACxH,CAAC;IAED,+CAA+C;IAC/C,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;QACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,mBAAmB;YAC3C,CAAC,CAAC,kBAAkB,IAAI,CAAC,GAAG,CAAC,mBAAmB,mDAAmD;YACnG,CAAC,CAAC,gDAAgD,CAAC;QACrD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,GAAG,CAAC,kBAAkB,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,kBAAkB,GAAG,GAAG,QAAQ,EAAE,EAAE,CAAC;IAC7G,CAAC;IAED,4CAA4C;IAC5C,MAAM,MAAM,GAAG,GAAG,UAAU,EAAE,mBAAmB,kBAAkB,CAAC,IAAI,CAAC,aAAa,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC;IACrI,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,yBAA0B,CAAW,CAAC,OAAO,EAAE,EAAE,CAAC;IAC/F,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,sEAAsE,EAAE,CAAC;QACjJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;IACnF,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACvD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACnE,CAAC;IAED,sBAAsB;IACtB,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;QAClD,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACjC,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACzE,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,MAAM,IAAI,EAAE,EAAE,EAAE,CAAC;QAClF,CAAC;QACD,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACxF,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,CAAC,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;QAC9F,CAAC;QAED,4DAA4D;QAC5D,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;YAChD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;YAChD,IAAI,QAAQ,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,EAAE,EAAE,CAAC;gBACrE,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,KAAK;oBACb,MAAM,EAAE,+DAA+D,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG;iBAC9I,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,mEAAmE,EAAE,CAAC;QACnH,CAAC;QAED,iEAAiE;QACjE,8CAA8C;QAC9C,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE;YAChD,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,8DAA8D;SAC/D,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC7B,gEAAgE;YAChE,4CAA4C;YAC5C,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,WAAY,CAAC,CAAC;gBACpD,gBAAgB,CAAC,MAAM,CAAC,IAAI,EAAE;oBAC5B,MAAM,EAAE,OAAO,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE;oBACzC,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACtC,gBAAgB,EAAE,SAAS,EAAE,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO;iBACzD,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QAC/B,CAAC;QAED,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IACzE,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;AACH,CAAC"}

package/dist/yomeSkills/installGithub.d.ts

@@ -0,0 +1,33 @@
+import { type InstallOptions, type InstallResult } from './install.js';
+export interface ParsedGithubSource {
+    owner: string;
+    repo: string;
+    ref?: string;
+    subPath?: string;
+    /** The https clone URL we will hand to `git clone`. */
+    cloneUrl: string;
+}
+export declare function parseGithubSource(source: string): ParsedGithubSource | null;
+export declare function isGithubSource(source: string): boolean;
+interface GithubInstallExtra {
+    /** When set, after install we recompute sha256 of the install dir and
+     *  compare against this value. Mismatch → uninstall + error.
+     *  When omitted (e.g. older publish without sha256), verification is skipped. */
+    expectedSha256?: string | null;
+    /** Disable post-install sha256 verification entirely (dev/debug). */
+    skipVerify?: boolean;
+    /**
+     * Install a deprecated version on purpose. Without this flag, the cli
+     * refuses with a pointer to `replaced_by_version`. Default false so
+     * users get a loud signal when they're about to install something the
+     * author marked as superseded.
+     */
+    allowDeprecated?: boolean;
+}
+/**
+ * Clone the repo into a tmp dir, then delegate to `installFromLocal`. Always
+ * cleans up the tmp clone, even on failure. If `expectedSha256` is provided,
+ * we verify the installed bytes match before declaring success.
+ */
+export declare function installFromGithub(source: string, opts?: InstallOptions & GithubInstallExtra): Promise<InstallResult>;
+export {};

package/dist/yomeSkills/installGithub.js

@@ -0,0 +1,213 @@
+// cli/src/yomeSkills/installGithub.ts — install a skill from a GitHub repo.
+//
+// Phase 2 source forms (per spec 8.5 / 11.2):
+//   yome skill install github:owner/repo
+//   yome skill install github:owner/repo@v1.2.0           (tag/branch/sha)
+//   yome skill install github:owner/repo#path/to/skill    (subdir within repo)
+//   yome skill install https://github.com/owner/repo
+//   yome skill install https://github.com/owner/repo/tree/<ref>/path/to/skill
+//
+// Strategy:
+//   1. Parse source → { owner, repo, ref?, subPath? }
+//   2. git clone --depth=1 [-b ref] <https-url> <tmp-dir>
+//   3. cd into <tmp-dir>/<subPath?> and treat it as a local skill
+//   4. Delegate to installFromLocal() — same manifest validation,
+//      same install location, same overwrite/force semantics.
+//
+// We deliberately use plain `git clone` (no `gh`) because public skill repos
+// don't require auth and we want install to work for anonymous users too.
+import { spawnSync } from 'node:child_process';
+import { existsSync, mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { installFromLocal } from './install.js';
+import { writeInstallMeta } from './installMeta.js';
+import { readManifest } from './manifest.js';
+const DEFAULT_HUB_BASE = 'https://yome.work';
+function getHubBase() {
+    return (process.env.YOME_HUB_BASE ?? DEFAULT_HUB_BASE).replace(/\/+$/, '');
+}
+async function fetchHubVersionMeta(slug, version) {
+    const empty = {
+        tarball_sha256: null,
+        deprecated: false,
+        deprecation_reason: null,
+        replaced_by_version: null,
+    };
+    try {
+        const url = `${getHubBase()}/api/hub/skills/${encodeURIComponent(slug)}?version=${encodeURIComponent(version)}`;
+        const r = await fetch(url, { headers: { Accept: 'application/json' } });
+        if (!r.ok)
+            return empty;
+        const j = (await r.json());
+        if (!j || j.ok !== true || !j.version)
+            return empty;
+        const sha = j.version.tarball_sha256 ?? null;
+        return {
+            tarball_sha256: sha && sha.length >= 32 ? sha : null,
+            deprecated: !!j.version.deprecated,
+            deprecation_reason: j.version.deprecation_reason ?? null,
+            replaced_by_version: j.version.replaced_by_version ?? null,
+        };
+    }
+    catch {
+        return empty;
+    }
+}
+const GITHUB_SHORT_RE = /^github:([^/]+)\/([^@#]+)(?:@([^#]+))?(?:#(.+))?$/i;
+const GITHUB_HTTPS_RE = /^https?:\/\/github\.com\/([^/]+)\/([^/]+?)(?:\.git)?(?:\/(?:tree|blob)\/([^/]+)(?:\/(.+))?)?\/?$/i;
+export function parseGithubSource(source) {
+    const trimmed = source.trim();
+    let owner = null;
+    let repo = null;
+    let ref;
+    let subPath;
+    const short = GITHUB_SHORT_RE.exec(trimmed);
+    if (short) {
+        [, owner, repo, ref, subPath] = short;
+    }
+    else {
+        const long = GITHUB_HTTPS_RE.exec(trimmed);
+        if (long) {
+            [, owner, repo, ref, subPath] = long;
+        }
+    }
+    if (!owner || !repo)
+        return null;
+    return {
+        owner,
+        repo,
+        ref: ref || undefined,
+        subPath: subPath ? subPath.replace(/^\/+|\/+$/g, '') : undefined,
+        cloneUrl: `https://github.com/${owner}/${repo}.git`,
+    };
+}
+export function isGithubSource(source) {
+    return /^github:/i.test(source) || /^https?:\/\/github\.com\//i.test(source);
+}
+function shallowClone(parsed, verbose) {
+    const root = mkdtempSync(join(tmpdir(), 'yome-skill-clone-'));
+    const cloneDir = join(root, parsed.repo);
+    const args = ['clone', '--depth=1'];
+    if (parsed.ref)
+        args.push('-b', parsed.ref);
+    args.push(parsed.cloneUrl, cloneDir);
+    if (verbose)
+        console.log(`$ git ${args.join(' ')}`);
+    const r = spawnSync('git', args, { encoding: 'utf-8' });
+    if (verbose && r.stdout)
+        console.log(r.stdout.trimEnd());
+    if (verbose && r.stderr)
+        console.error(r.stderr.trimEnd());
+    if (r.status !== 0) {
+        rmSync(root, { recursive: true, force: true });
+        const detail = r.stderr?.trim() || `git exited with status ${r.status ?? 'unknown'}`;
+        return { ok: false, reason: `git clone failed: ${detail}` };
+    }
+    return { ok: true, cloneDir };
+}
+/**
+ * Clone the repo into a tmp dir, then delegate to `installFromLocal`. Always
+ * cleans up the tmp clone, even on failure. If `expectedSha256` is provided,
+ * we verify the installed bytes match before declaring success.
+ */
+export async function installFromGithub(source, opts = {}) {
+    const parsed = parseGithubSource(source);
+    if (!parsed) {
+        return { ok: false, reason: `not a GitHub source: ${source}` };
+    }
+    // git availability check — `git --version` should always succeed if installed.
+    const probe = spawnSync('git', ['--version'], { encoding: 'utf-8' });
+    if (probe.status !== 0) {
+        return { ok: false, reason: 'git is not installed or not in PATH' };
+    }
+    const cloned = shallowClone(parsed, !!opts.verbose);
+    if (!cloned.ok)
+        return cloned;
+    let cleanupRoot = resolve(cloned.cloneDir, '..');
+    try {
+        const skillDir = parsed.subPath ? join(cloned.cloneDir, parsed.subPath) : cloned.cloneDir;
+        if (!existsSync(skillDir)) {
+            return { ok: false, reason: `subpath "${parsed.subPath}" does not exist in ${parsed.owner}/${parsed.repo}` };
+        }
+        if (!existsSync(join(skillDir, 'yome-skill.json'))) {
+            return { ok: false, reason: `${parsed.owner}/${parsed.repo}${parsed.subPath ? `/${parsed.subPath}` : ''} has no yome-skill.json` };
+        }
+        // Hub lookup: fetch sha256 fingerprint AND deprecation status in
+        // one shot, since we're already paying the round-trip cost. Best-
+        // effort — hub unreachable / no record → empty meta and the install
+        // proceeds without verification (back-compat with offline / legacy
+        // versions).
+        const cloneManifest = readManifest(skillDir);
+        if (cloneManifest) {
+            const meta = await fetchHubVersionMeta(cloneManifest.slug, cloneManifest.version);
+            if (meta.deprecated && !opts.allowDeprecated) {
+                const replaced = meta.replaced_by_version
+                    ? ` Use --version ${meta.replaced_by_version} instead, or pass --allow-deprecated to override.`
+                    : ' Pass --allow-deprecated to install it anyway.';
+                const why = meta.deprecation_reason ? ` Reason: ${meta.deprecation_reason}.` : '';
+                return {
+                    ok: false,
+                    reason: `${cloneManifest.slug}@${cloneManifest.version} is deprecated.${why}${replaced}`,
+                };
+            }
+            if (meta.deprecated && opts.allowDeprecated) {
+                const why = meta.deprecation_reason ? ` (${meta.deprecation_reason})` : '';
+                console.warn(`! installing deprecated ${cloneManifest.slug}@${cloneManifest.version}${why}`);
+            }
+            if (!opts.skipVerify && !opts.expectedSha256) {
+                opts.expectedSha256 = meta.tarball_sha256;
+            }
+        }
+        const result = await installFromLocal(skillDir, opts);
+        if (result.ok && result.slug) {
+            // installFromLocal stamped the meta with `local:<tmp clone path>`; rewrite
+            // it to the github: shorthand so `yome skill update` knows what to refetch.
+            try {
+                writeInstallMeta(result.slug, {
+                    source: githubSourceToShorthand(parsed),
+                    installed_at: new Date().toISOString(),
+                    manifest_version: result.slug ? '' : '',
+                });
+                // Keep the version field accurate by reading the manifest at dest.
+                const m = readManifest(result.installedAt);
+                if (m) {
+                    writeInstallMeta(result.slug, {
+                        source: githubSourceToShorthand(parsed),
+                        installed_at: new Date().toISOString(),
+                        manifest_version: m.version,
+                    });
+                }
+            }
+            catch { /* best effort */ }
+            // Post-install sha256 verification. If the hub had no fingerprint
+            // for this version (older publish), expectedSha256 is null/undefined
+            // and we skip — the install proceeds. If it doesn't match, we
+            // tear down the install dir to leave the system in a clean state.
+            if (!opts.skipVerify && opts.expectedSha256 && result.installedAt) {
+                const { verifySkillSha256 } = await import('./integrity.js');
+                const v = verifySkillSha256(result.installedAt, opts.expectedSha256);
+                if (!v.ok) {
+                    rmSync(result.installedAt, { recursive: true, force: true });
+                    return {
+                        ok: false,
+                        reason: `sha256 mismatch — refusing install. expected ${v.expected.slice(0, 12)}…, got ${v.computed.slice(0, 12)}…`,
+                    };
+                }
+            }
+        }
+        return result;
+    }
+    finally {
+        rmSync(cleanupRoot, { recursive: true, force: true });
+    }
+}
+function githubSourceToShorthand(p) {
+    let s = `github:${p.owner}/${p.repo}`;
+    if (p.ref)
+        s += `@${p.ref}`;
+    if (p.subPath)
+        s += `#${p.subPath}`;
+    return s;
+}
+//# sourceMappingURL=installGithub.js.map

package/dist/yomeSkills/installGithub.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"installGithub.js","sourceRoot":"","sources":["../../src/yomeSkills/installGithub.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,EAAE;AACF,8CAA8C;AAC9C,yCAAyC;AACzC,2EAA2E;AAC3E,+EAA+E;AAC/E,qDAAqD;AACrD,8EAA8E;AAC9E,EAAE;AACF,YAAY;AACZ,sDAAsD;AACtD,0DAA0D;AAC1D,kEAAkE;AAClE,kEAAkE;AAClE,8DAA8D;AAC9D,EAAE;AACF,6EAA6E;AAC7E,0EAA0E;AAE1E,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAA2C,MAAM,cAAc,CAAC;AACzF,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAE7C,SAAS,UAAU;IACjB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC7E,CAAC;AAiBD,KAAK,UAAU,mBAAmB,CAAC,IAAY,EAAE,OAAe;IAC9D,MAAM,KAAK,GAAqB;QAC9B,cAAc,EAAE,IAAI;QACpB,UAAU,EAAE,KAAK;QACjB,kBAAkB,EAAE,IAAI;QACxB,mBAAmB,EAAE,IAAI;KAC1B,CAAC;IACF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,GAAG,UAAU,EAAE,mBAAmB,kBAAkB,CAAC,IAAI,CAAC,YAAY,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;QAChH,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QACxB,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAQxB,CAAC;QACF,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QACpD,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC;QAC7C,OAAO;YACL,cAAc,EAAE,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;YACpD,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU;YAClC,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,IAAI,IAAI;YACxD,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,IAAI,IAAI;SAC3D,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AAC3B,CAAC;AAWD,MAAM,eAAe,GAAG,oDAAoD,CAAC;AAC7E,MAAM,eAAe,GAAG,mGAAmG,CAAC;AAE5H,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,IAAI,GAAuB,CAAC;IAC5B,IAAI,OAA2B,CAAC;IAEhC,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,KAAK,EAAE,CAAC;QACV,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC;IACxC,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,IAAI,EAAE,CAAC;YACT,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;QACvC,CAAC;IACH,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO;QACL,KAAK;QACL,IAAI;QACJ,GAAG,EAAE,GAAG,IAAI,SAAS;QACrB,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;QAChE,QAAQ,EAAE,sBAAsB,KAAK,IAAI,IAAI,MAAM;KACpD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC/E,CAAC;AAKD,SAAS,YAAY,CAAC,MAA0B,EAAE,OAAgB;IAChE,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAEzC,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,GAAG;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAErC,IAAI,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACpD,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACxD,IAAI,OAAO,IAAI,CAAC,CAAC,MAAM;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACzD,IAAI,OAAO,IAAI,CAAC,CAAC,MAAM;QAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3D,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,0BAA0B,CAAC,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;QACrF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,MAAM,EAAE,EAAE,CAAC;IAC9D,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAkBD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAc,EAAE,OAA4C,EAAE;IACpG,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,MAAM,EAAE,EAAE,CAAC;IACjE,CAAC;IAED,+EAA+E;IAC/E,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACrE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;IACtE,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC;IAE9B,IAAI,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC1F,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,MAAM,CAAC,OAAO,uBAAuB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/G,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC,EAAE,CAAC;YACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,yBAAyB,EAAE,CAAC;QACrI,CAAC;QACD,iEAAiE;QACjE,kEAAkE;QAClE,oEAAoE;QACpE,mEAAmE;QACnE,aAAa;QACb,MAAM,aAAa,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;YAClF,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;gBAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB;oBACvC,CAAC,CAAC,kBAAkB,IAAI,CAAC,mBAAmB,mDAAmD;oBAC/F,CAAC,CAAC,gDAAgD,CAAC;gBACrD,MAAM,GAAG,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,kBAAkB,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClF,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EACJ,GAAG,aAAa,CAAC,IAAI,IAAI,aAAa,CAAC,OAAO,kBAAkB,GAAG,GAAG,QAAQ,EAAE;iBACnF,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;gBAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,kBAAkB,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3E,OAAO,CAAC,IAAI,CACV,2BAA2B,aAAa,CAAC,IAAI,IAAI,aAAa,CAAC,OAAO,GAAG,GAAG,EAAE,CAC/E,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;gBAC7C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;YAC5C,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACtD,IAAI,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC7B,2EAA2E;YAC3E,4EAA4E;YAC5E,IAAI,CAAC;gBACH,gBAAgB,CAAC,MAAM,CAAC,IAAI,EAAE;oBAC5B,MAAM,EAAE,uBAAuB,CAAC,MAAM,CAAC;oBACvC,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACtC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;iBACxC,CAAC,CAAC;gBACH,mEAAmE;gBACnE,MAAM,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,WAAY,CAAC,CAAC;gBAC5C,IAAI,CAAC,EAAE,CAAC;oBACN,gBAAgB,CAAC,MAAM,CAAC,IAAI,EAAE;wBAC5B,MAAM,EAAE,uBAAuB,CAAC,MAAM,CAAC;wBACvC,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBACtC,gBAAgB,EAAE,CAAC,CAAC,OAAO;qBAC5B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;YAE7B,kEAAkE;YAClE,qEAAqE;YACrE,8DAA8D;YAC9D,kEAAkE;YAClE,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;gBAClE,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;gBAC7D,MAAM,CAAC,GAAG,iBAAiB,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;gBACrE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;oBACV,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC7D,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,MAAM,EAAE,gDAAgD,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG;qBACpH,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,CAAkE;IACjG,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC,CAAC,GAAG;QAAE,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;IAC5B,IAAI,CAAC,CAAC,OAAO;QAAE,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;IACpC,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/yomeSkills/installMeta.d.ts

@@ -0,0 +1,8 @@
+export interface InstallMeta {
+    source: string;
+    installed_at: string;
+    manifest_version: string;
+}
+export declare function readInstallMeta(slugOrDir: string): InstallMeta | null;
+export declare function writeInstallMeta(slugOrDir: string, meta: InstallMeta): void;
+export declare function clearInstallMeta(slugOrDir: string): void;