@poping/yome 0.0.2 → 0.0.4

package/dist/yomeSkills/installMeta.js

@@ -0,0 +1,76 @@
+// `.install-meta.json` — small per-skill sidecar capturing how the skill
+// was installed. Used by `yome skill update` (to know what to re-pull)
+// and `yome skill list` (to render the source column).
+//
+// Schema (intentionally tiny so it's easy to bump):
+//   {
+//     "source": "github:owner/repo[@ref][#subpath]"
+//             | "local:/abs/path"
+//             | "dev-link:/abs/path"
+//             | "hub:@owner/name"
+//             | "url:<https url>",
+//     "installed_at": "<ISO-8601>",
+//     "manifest_version": "<from yome-skill.json at install time>"
+//   }
+//
+// Missing file = legacy install (pre-meta); `update` treats it as
+// "source unknown — please reinstall manually".
+import { existsSync, readFileSync, writeFileSync, mkdirSync, unlinkSync, } from 'fs';
+import { join, dirname } from 'path';
+import { installPathForSlug } from './paths.js';
+const META_FILENAME = '.install-meta.json';
+function metaPath(slugOrDir) {
+    // Accept either a slug like @yome/ppt OR an absolute install dir.
+    if (slugOrDir.startsWith('/') || slugOrDir.startsWith('.')) {
+        return join(slugOrDir, META_FILENAME);
+    }
+    const dir = installPathForSlug(slugOrDir);
+    if (!dir)
+        throw new Error(`invalid slug: ${slugOrDir}`);
+    return join(dir, META_FILENAME);
+}
+export function readInstallMeta(slugOrDir) {
+    let f;
+    try {
+        f = metaPath(slugOrDir);
+    }
+    catch {
+        return null;
+    }
+    if (!existsSync(f))
+        return null;
+    try {
+        const obj = JSON.parse(readFileSync(f, 'utf-8'));
+        if (typeof obj?.source !== 'string')
+            return null;
+        return {
+            source: String(obj.source),
+            installed_at: String(obj.installed_at ?? ''),
+            manifest_version: String(obj.manifest_version ?? ''),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+export function writeInstallMeta(slugOrDir, meta) {
+    const f = metaPath(slugOrDir);
+    mkdirSync(dirname(f), { recursive: true });
+    writeFileSync(f, JSON.stringify(meta, null, 2) + '\n');
+}
+export function clearInstallMeta(slugOrDir) {
+    let f;
+    try {
+        f = metaPath(slugOrDir);
+    }
+    catch {
+        return;
+    }
+    if (existsSync(f)) {
+        try {
+            unlinkSync(f);
+        }
+        catch { /* ignore */ }
+    }
+}
+//# sourceMappingURL=installMeta.js.map

package/dist/yomeSkills/installMeta.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"installMeta.js","sourceRoot":"","sources":["../../src/yomeSkills/installMeta.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,uEAAuE;AACvE,uDAAuD;AACvD,EAAE;AACF,oDAAoD;AACpD,MAAM;AACN,oDAAoD;AACpD,kCAAkC;AAClC,qCAAqC;AACrC,kCAAkC;AAClC,mCAAmC;AACnC,oCAAoC;AACpC,mEAAmE;AACnE,MAAM;AACN,EAAE;AACF,kEAAkE;AAClE,gDAAgD;AAEhD,OAAO,EACL,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,GAC/D,MAAM,IAAI,CAAC;AACZ,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAQhD,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAE3C,SAAS,QAAQ,CAAC,SAAiB;IACjC,kEAAkE;IAClE,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,GAAG,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,SAAS,EAAE,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,IAAI,CAAS,CAAC;IACd,IAAI,CAAC;QAAC,CAAC,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IACvD,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACjD,IAAI,OAAO,GAAG,EAAE,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACjD,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;YAC1B,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;YAC5C,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC;SACrD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,IAAiB;IACnE,MAAM,CAAC,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC9B,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,IAAI,CAAS,CAAC;IACd,IAAI,CAAC;QAAC,CAAC,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO;IAAC,CAAC;IAClD,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QAClB,IAAI,CAAC;YAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC"}

package/dist/yomeSkills/integrity.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Files & directories that should never contribute to a skill hash.
+ * - VCS plumbing (.git/) is environmental, not skill content.
+ * - .install-meta.json / .yome-disabled / allowed-capabilities.json are
+ *   per-install state files we write *after* the bytes land — including
+ *   them would create chicken-and-egg.
+ * - Build artefacts (node_modules, dist, .DS_Store) are noise.
+ */
+export declare const DEFAULT_IGNORES: ReadonlySet<string>;
+export interface ComputeOptions {
+    /** Override the default ignore set entirely. */
+    ignores?: ReadonlySet<string>;
+}
+/**
+ * Compute the canonical sha256 of a skill directory.
+ * Returns the hex digest (64 chars).
+ */
+export declare function computeSkillSha256(skillDir: string, opts?: ComputeOptions): string;
+export interface VerifyResult {
+    ok: boolean;
+    /** Always present so callers can log. */
+    computed: string;
+    expected: string;
+}
+/** Recompute and compare against an expected hex digest. */
+export declare function verifySkillSha256(skillDir: string, expected: string, opts?: ComputeOptions): VerifyResult;

package/dist/yomeSkills/integrity.js

@@ -0,0 +1,107 @@
+// integrity.ts — content-addressed hash of an installed/source skill.
+//
+// Threat model: a user runs `yome skill install github:Whopus/foo`. Between
+// `git clone` and the bytes landing in ~/.yome/skills the network /
+// CDN / GitHub mirror could substitute different content. We give the
+// hub a sha256 fingerprint at publish time; install verifies it matches.
+//
+// Algorithm (deliberately simple, deterministic, and language-agnostic):
+//
+//   1. Walk the skill directory recursively, collect every file path
+//      relative to the skill root, except those in DEFAULT_IGNORES.
+//   2. Sort paths byte-wise (NFC, no normalisation — "what's on disk").
+//   3. Build a stream of records:
+//        <relative path> NUL <byte length, ASCII> NUL <file bytes> NUL
+//   4. Return the SHA-256 hex digest of the concatenated stream.
+//
+// Properties:
+//   - Same directory tree → same digest, regardless of OS readdir order.
+//   - Adding/removing/renaming any file changes the digest.
+//   - Filesystem perms / mtime do NOT affect the digest (intentionally —
+//     `git clone` resets times, and installing copies don't preserve them).
+import { createHash } from 'node:crypto';
+import { readFileSync, readdirSync, statSync } from 'node:fs';
+import { join, relative, sep } from 'node:path';
+/**
+ * Files & directories that should never contribute to a skill hash.
+ * - VCS plumbing (.git/) is environmental, not skill content.
+ * - .install-meta.json / .yome-disabled / allowed-capabilities.json are
+ *   per-install state files we write *after* the bytes land — including
+ *   them would create chicken-and-egg.
+ * - Build artefacts (node_modules, dist, .DS_Store) are noise.
+ */
+export const DEFAULT_IGNORES = new Set([
+    '.git',
+    'node_modules',
+    'dist',
+    '.next',
+    '.turbo',
+    'coverage',
+    '.DS_Store',
+    '.install-meta.json',
+    '.yome-disabled',
+    'allowed-capabilities.json',
+]);
+/**
+ * Walk dir → return relative paths (slash-separated for portability)
+ * sorted byte-wise.
+ */
+function listFiles(root, ignores) {
+    const out = [];
+    function walk(abs) {
+        let entries;
+        try {
+            entries = readdirSync(abs);
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            if (ignores.has(e))
+                continue;
+            const p = join(abs, e);
+            let st;
+            try {
+                st = statSync(p);
+            }
+            catch {
+                continue;
+            }
+            if (st.isDirectory())
+                walk(p);
+            else if (st.isFile()) {
+                // Normalise to forward-slash so digests are stable cross-platform.
+                out.push(relative(root, p).split(sep).join('/'));
+            }
+        }
+    }
+    walk(root);
+    out.sort();
+    return out;
+}
+/**
+ * Compute the canonical sha256 of a skill directory.
+ * Returns the hex digest (64 chars).
+ */
+export function computeSkillSha256(skillDir, opts = {}) {
+    const ignores = opts.ignores ?? DEFAULT_IGNORES;
+    const files = listFiles(skillDir, ignores);
+    const h = createHash('sha256');
+    const NUL = Buffer.from([0]);
+    for (const rel of files) {
+        const bytes = readFileSync(join(skillDir, rel));
+        h.update(rel, 'utf-8');
+        h.update(NUL);
+        h.update(String(bytes.byteLength), 'utf-8');
+        h.update(NUL);
+        h.update(bytes);
+        h.update(NUL);
+    }
+    return h.digest('hex');
+}
+/** Recompute and compare against an expected hex digest. */
+export function verifySkillSha256(skillDir, expected, opts = {}) {
+    const computed = computeSkillSha256(skillDir, opts);
+    return { ok: computed.toLowerCase() === expected.toLowerCase(), computed, expected };
+}
+//# sourceMappingURL=integrity.js.map

package/dist/yomeSkills/integrity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrity.js","sourceRoot":"","sources":["../../src/yomeSkills/integrity.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,EAAE;AACF,4EAA4E;AAC5E,oEAAoE;AACpE,sEAAsE;AACtE,yEAAyE;AACzE,EAAE;AACF,yEAAyE;AACzE,EAAE;AACF,qEAAqE;AACrE,oEAAoE;AACpE,wEAAwE;AACxE,kCAAkC;AAClC,uEAAuE;AACvE,iEAAiE;AACjE,EAAE;AACF,cAAc;AACd,yEAAyE;AACzE,4DAA4D;AAC5D,yEAAyE;AACzE,4EAA4E;AAE5E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAEhD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC;IAC1D,MAAM;IACN,cAAc;IACd,MAAM;IACN,OAAO;IACP,QAAQ;IACR,UAAU;IACV,WAAW;IACX,oBAAoB;IACpB,gBAAgB;IAChB,2BAA2B;CAC5B,CAAC,CAAC;AAOH;;;GAGG;AACH,SAAS,SAAS,CAAC,IAAY,EAAE,OAA4B;IAC3D,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,SAAS,IAAI,CAAC,GAAW;QACvB,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YAAC,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QACnC,MAAM,CAAC;YAAC,OAAO;QAAC,CAAC;QACjB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,SAAS;YAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACvB,IAAI,EAAE,CAAC;YACP,IAAI,CAAC;gBAAC,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC7C,IAAI,EAAE,CAAC,WAAW,EAAE;gBAAE,IAAI,CAAC,CAAC,CAAC,CAAC;iBACzB,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;gBACrB,mEAAmE;gBACnE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,CAAC;IACX,GAAG,CAAC,IAAI,EAAE,CAAC;IACX,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB,EAAE,OAAuB,EAAE;IAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,eAAe,CAAC;IAChD,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;QAChD,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACvB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC;QAC5C,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AASD,4DAA4D;AAC5D,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,QAAgB,EAAE,OAAuB,EAAE;IAC7F,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACpD,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AACvF,CAAC"}

package/dist/yomeSkills/invoke.d.ts

@@ -0,0 +1,29 @@
+import { type SkillIndexEntry } from './skillsIndex.js';
+export interface InvokeRequest {
+    /** Either '@owner/name' (preferred) or just a domain like 'ppt'. */
+    slugOrDomain: string;
+    /** Action name, e.g. 'new', 'slide.add'. */
+    action: string;
+    positionals?: string[];
+    flags?: Record<string, string | boolean | number | undefined>;
+}
+export interface InvokeResult {
+    ok: boolean;
+    stdout: string;
+    stderr: string;
+    exitCode: number;
+    /** Diagnostic — which skill we resolved to. */
+    resolvedSlug?: string;
+}
+/**
+ * Find the installed skill record for either `@owner/name` or `<domain>`.
+ * Domain lookup picks the first installed skill that owns that domain;
+ * if you have multiple, prefer the explicit slug.
+ */
+export declare function resolveSkill(slugOrDomain: string): SkillIndexEntry | null;
+/**
+ * Run an action. Honors capability grants — anything the manifest
+ * declares as required (and that hasn't been allowed by the user) blocks
+ * the call before we touch osascript.
+ */
+export declare function invokeSkill(req: InvokeRequest): Promise<InvokeResult>;

package/dist/yomeSkills/invoke.js

@@ -0,0 +1,135 @@
+// cli/src/yomeSkills/invoke.ts
+//
+// Top-level entry point for "execute an action on an installed hub
+// skill". Handles slug/domain resolution, capability enforcement, and
+// platform/backend selection. Both the `SkillCall` agent tool and the
+// `yome <domain> <action>` CLI route through this.
+import { homedir } from 'os';
+import { getInstalledFast } from './skillsIndex.js';
+import { readManifest } from './manifest.js';
+import { isCapabilityAllowed } from './capabilities.js';
+import { dispatchMacos, loadMacosBackend, } from '../skills/runner/dispatcher.js';
+import { dispatchNode, hasNodeBackend } from '../skills/runner/nodeBackend.js';
+/** Expand ~ in a path arg the same way a shell would. */
+function expandTilde(v) {
+    if (typeof v !== 'string')
+        return v;
+    if (v === '~')
+        return homedir();
+    if (v.startsWith('~/'))
+        return homedir() + v.slice(1);
+    return v;
+}
+/**
+ * Find the installed skill record for either `@owner/name` or `<domain>`.
+ * Domain lookup picks the first installed skill that owns that domain;
+ * if you have multiple, prefer the explicit slug.
+ */
+export function resolveSkill(slugOrDomain) {
+    const installed = getInstalledFast();
+    if (slugOrDomain.startsWith('@')) {
+        return installed.find((s) => s.slug === slugOrDomain) ?? null;
+    }
+    return installed.find((s) => s.domain === slugOrDomain) ?? null;
+}
+/**
+ * Run an action. Honors capability grants — anything the manifest
+ * declares as required (and that hasn't been allowed by the user) blocks
+ * the call before we touch osascript.
+ */
+export async function invokeSkill(req) {
+    const entry = resolveSkill(req.slugOrDomain);
+    if (!entry) {
+        return {
+            ok: false, stdout: '', stderr: `skill not installed: ${req.slugOrDomain}`,
+            exitCode: 127,
+        };
+    }
+    if (entry.status !== 'enabled') {
+        return {
+            ok: false, stdout: '', stderr: `skill ${entry.slug} is disabled — enable it via /skills`,
+            exitCode: 1, resolvedSlug: entry.slug,
+        };
+    }
+    const manifest = readManifest(entry.installedAt);
+    if (!manifest) {
+        return {
+            ok: false, stdout: '', stderr: `failed to read manifest at ${entry.installedAt}`,
+            exitCode: 1, resolvedSlug: entry.slug,
+        };
+    }
+    // Enforce declared OS-level capabilities (security model).
+    // Note: manifest.capabilities holds *semantic* labels (calendar:read);
+    // system_capabilities holds the OS-level set we actually gate on.
+    const declared = (manifest.system_capabilities ?? []);
+    const missing = [];
+    for (const cap of declared) {
+        if (!isCapabilityAllowed(entry.slug, cap))
+            missing.push(cap);
+    }
+    if (missing.length > 0) {
+        return {
+            ok: false, stdout: '',
+            stderr: `capability not granted: ${missing.join(', ')}\n` +
+                `Run: yome skill perms ${entry.slug} --grant ${missing[0]}`,
+            exitCode: 13, resolvedSlug: entry.slug,
+        };
+    }
+    // Pick the right backend for this host.
+    //
+    // The CLI is a Node process — NOT the macOS Yome.app host. So
+    // `delivery.macos.backend === "bundled"` (= Swift code that lives
+    // inside Yome.app) is unreachable from here.
+    //
+    // Backend resolution order (first viable wins):
+    //   1. OTA Node backend (backends/node/) — works on every platform
+    //      and is the only path inside the daemon, headless, etc.
+    //   2. OTA macOS AppleScript backend (backends/macos/manifest.json) —
+    //      darwin-only; renders templates into osascript invocations.
+    //
+    // On non-darwin hosts the AppleScript option vanishes; we return a
+    // clear diagnostic if the skill has nothing else to fall back to.
+    const positionals = (req.positionals ?? []).map((p) => typeof p === 'string' ? expandTilde(p) : p);
+    const flags = {};
+    for (const [k, v] of Object.entries(req.flags ?? {})) {
+        flags[k] = expandTilde(v);
+    }
+    const call = { positionals, flags };
+    // 1. Node backend — preferred when present (CLI is Node).
+    if (hasNodeBackend(entry.installedAt)) {
+        const r = await dispatchNode(entry.installedAt, req.action, call);
+        return { ...r, resolvedSlug: entry.slug };
+    }
+    // 2. macOS AppleScript backend.
+    const platform = process.platform;
+    if (platform !== 'darwin') {
+        return {
+            ok: false, stdout: '',
+            stderr: `no node backend for ${entry.slug}, and host is ${platform} (macOS AppleScript ` +
+                `fallback unavailable). Ask the skill author to ship a backends/node/ OTA backend.`,
+            exitCode: 1, resolvedSlug: entry.slug,
+        };
+    }
+    if (!loadMacosBackend(entry.installedAt)) {
+        const delivery = (manifest.delivery ?? {});
+        const macosKind = delivery.macos?.backend;
+        const hints = [];
+        if (macosKind === 'bundled') {
+            hints.push('macOS implementation is "bundled" — runs inside Yome.app (Swift), ' +
+                'not from the CLI. Use the macOS app, or have the skill author publish ' +
+                'a backends/macos/ OTA AppleScript backend or a backends/node/ Node backend.');
+        }
+        else {
+            hints.push('skill is missing backends/macos/manifest.json AND backends/node/ — no usable backend for the CLI.');
+        }
+        return {
+            ok: false, stdout: '',
+            stderr: `no backend the CLI can invoke for ${entry.slug}.\n` +
+                hints.map((h) => '  - ' + h).join('\n'),
+            exitCode: 2, resolvedSlug: entry.slug,
+        };
+    }
+    const r = dispatchMacos(entry.installedAt, req.action, call);
+    return { ...r, resolvedSlug: entry.slug };
+}
+//# sourceMappingURL=invoke.js.map

package/dist/yomeSkills/invoke.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invoke.js","sourceRoot":"","sources":["../../src/yomeSkills/invoke.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,EAAE;AACF,mEAAmE;AACnE,sEAAsE;AACtE,sEAAsE;AACtE,mDAAmD;AAEnD,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAwB,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EACL,aAAa,EACb,gBAAgB,GAEjB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAE/E,yDAAyD;AACzD,SAAS,WAAW,CAAC,CAAwC;IAC3D,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,OAAO,EAAE,CAAC;IAChC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,CAAC;AACX,CAAC;AAoBD;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,YAAoB;IAC/C,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;IACrC,IAAI,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,IAAI,IAAI,CAAC;IAChE,CAAC;IACD,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,YAAY,CAAC,IAAI,IAAI,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAkB;IAClD,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,wBAAwB,GAAG,CAAC,YAAY,EAAE;YACzE,QAAQ,EAAE,GAAG;SACd,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO;YACL,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,KAAK,CAAC,IAAI,sCAAsC;YACxF,QAAQ,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,IAAI;SACtC,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACjD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,8BAA8B,KAAK,CAAC,WAAW,EAAE;YAChF,QAAQ,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,IAAI;SACtC,CAAC;IACJ,CAAC;IAED,2DAA2D;IAC3D,uEAAuE;IACvE,kEAAkE;IAClE,MAAM,QAAQ,GAAG,CAAC,QAAQ,CAAC,mBAAmB,IAAI,EAAE,CAEnD,CAAC;IACF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACrB,MAAM,EACJ,2BAA2B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBACjD,yBAAyB,KAAK,CAAC,IAAI,YAAY,OAAO,CAAC,CAAC,CAAC,EAAE;YAC7D,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,IAAI;SACvC,CAAC;IACJ,CAAC;IAED,wCAAwC;IACxC,EAAE;IACF,8DAA8D;IAC9D,kEAAkE;IAClE,6CAA6C;IAC7C,EAAE;IACF,gDAAgD;IAChD,mEAAmE;IACnE,8DAA8D;IAC9D,sEAAsE;IACtE,kEAAkE;IAClE,EAAE;IACF,mEAAmE;IACnE,kEAAkE;IAClE,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACpD,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,WAAW,CAAC,CAAC,CAAY,CAAC,CAAC,CAAC,CAAC,CACvD,CAAC;IACF,MAAM,KAAK,GAA0D,EAAE,CAAC;IACxE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;QACrD,KAAK,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IACD,MAAM,IAAI,GAAiB,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IAElD,0DAA0D;IAC1D,IAAI,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAClE,OAAO,EAAE,GAAG,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;IAC5C,CAAC;IAED,gCAAgC;IAChC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO;YACL,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACrB,MAAM,EACJ,uBAAuB,KAAK,CAAC,IAAI,iBAAiB,QAAQ,sBAAsB;gBAChF,mFAAmF;YACrF,QAAQ,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,IAAI;SACtC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAqD,CAAC;QAC/F,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QAC1C,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,KAAK,CAAC,IAAI,CACR,oEAAoE;gBACpE,wEAAwE;gBACxE,6EAA6E,CAC9E,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,mGAAmG,CAAC,CAAC;QAClH,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACrB,MAAM,EACJ,qCAAqC,KAAK,CAAC,IAAI,KAAK;gBACpD,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YACzC,QAAQ,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,IAAI;SACtC,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC7D,OAAO,EAAE,GAAG,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;AAC5C,CAAC"}

package/dist/yomeSkills/list.d.ts

@@ -0,0 +1,11 @@
+import { type SkillManifest } from './manifest.js';
+export interface InstalledEntry {
+    slug: string;
+    domain: string;
+    version: string;
+    name?: string;
+    description?: string;
+    installedAt: string;
+    manifest: SkillManifest;
+}
+export declare function listInstalled(): InstalledEntry[];

package/dist/yomeSkills/list.js

@@ -0,0 +1,55 @@
+// `yome skill list` — enumerate installed yome-skill.json skills under
+// ~/.yome/skills/<owner>/<name>/. Skills using the legacy SKILL.md
+// markdown format are silently ignored (different system, see existing
+// cli/src/skills/loader.ts).
+import { existsSync, readdirSync, statSync } from 'fs';
+import { join } from 'path';
+import { readManifest } from './manifest.js';
+import { getYomeSkillsRoot } from './paths.js';
+function listChildDirs(dir) {
+    if (!existsSync(dir))
+        return [];
+    try {
+        return readdirSync(dir).filter((n) => {
+            // Skip rollback snapshots — install.ts moves the previous version
+            // sideways to <slug>.previous before overwriting. They have a valid
+            // yome-skill.json so they'd otherwise look like a duplicate install.
+            if (n.endsWith('.previous'))
+                return false;
+            try {
+                return statSync(join(dir, n)).isDirectory();
+            }
+            catch {
+                return false;
+            }
+        });
+    }
+    catch {
+        return [];
+    }
+}
+export function listInstalled() {
+    const root = getYomeSkillsRoot();
+    const out = [];
+    for (const owner of listChildDirs(root)) {
+        const ownerDir = join(root, owner);
+        for (const name of listChildDirs(ownerDir)) {
+            const skillDir = join(ownerDir, name);
+            const manifest = readManifest(skillDir);
+            if (!manifest)
+                continue;
+            out.push({
+                slug: manifest.slug,
+                domain: manifest.domain,
+                version: manifest.version,
+                name: manifest.name,
+                description: manifest.description,
+                installedAt: skillDir,
+                manifest,
+            });
+        }
+    }
+    out.sort((a, b) => a.slug.localeCompare(b.slug));
+    return out;
+}
+//# sourceMappingURL=list.js.map

package/dist/yomeSkills/list.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.js","sourceRoot":"","sources":["../../src/yomeSkills/list.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,mEAAmE;AACnE,uEAAuE;AACvE,6BAA6B;AAE7B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAsB,MAAM,eAAe,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAY/C,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACnC,kEAAkE;YAClE,oEAAoE;YACpE,qEAAqE;YACrE,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC1C,IAAI,CAAC;gBAAC,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,KAAK,CAAC;YAAC,CAAC;QAC9E,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,MAAM,IAAI,GAAG,iBAAiB,EAAE,CAAC;IACjC,MAAM,GAAG,GAAqB,EAAE,CAAC;IAEjC,KAAK,MAAM,KAAK,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACtC,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;YACxC,IAAI,CAAC,QAAQ;gBAAE,SAAS;YACxB,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,WAAW,EAAE,QAAQ;gBACrB,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACjD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/yomeSkills/login.d.ts

@@ -0,0 +1,41 @@
+import { type YomeAuthState } from './auth.js';
+export declare function getClientId(): string;
+export declare function getHubBase(): string;
+interface DeviceCodeResp {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    expires_in: number;
+    interval: number;
+}
+export type Fetcher = (url: string, init?: RequestInit) => Promise<{
+    ok: boolean;
+    status: number;
+    json(): Promise<unknown>;
+    text(): Promise<string>;
+}>;
+export interface LoginOptions {
+    clientId?: string;
+    scopes?: string;
+    /** Override polling for tests (default = response.interval seconds). */
+    pollIntervalMs?: number;
+    /** Hard ceiling so test runs don't hang forever (default 600_000). */
+    timeoutMs?: number;
+    /** Test seam. */
+    fetcher?: Fetcher;
+    /** Hub base URL override (default: env YOME_HUB_BASE or https://yome.work). */
+    hubBase?: string;
+    /** Test seam — called with the verification URI; default = console.log. */
+    onPrompt?: (info: DeviceCodeResp) => void;
+    /** Test seam — sleep override. Default uses setTimeout. */
+    sleep?: (ms: number) => Promise<void>;
+}
+export interface LoginResult {
+    ok: boolean;
+    state?: YomeAuthState;
+    reason?: string;
+    /** Distinguishable error code so the CLI can give a friendly message. */
+    code?: 'no_client_id' | 'github_failed' | 'user_denied' | 'expired' | 'timeout' | 'exchange_failed' | 'yome_user_not_found' | 'network';
+}
+export declare function performLogin(opts?: LoginOptions): Promise<LoginResult>;
+export {};