@yottameta/yotta-vetter 0.1.3 → 0.1.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/CHANGELOG.md +14 -0
  2. package/README.md +28 -39
  3. package/README.zh-CN.md +28 -39
  4. package/SKILL.md +1 -1
  5. package/package.json +1 -1
  6. package/scripts/yotta_vetter.py +2 -2
package/CHANGELOG.md CHANGED
@@ -1,5 +1,19 @@
1
1
  # 更新日志
2
2
 
3
+ ## v0.1.5 (2026-08-29)
4
+
5
+ - 安装方式统一为四方式（对齐发布规范 §3.3.1）：方式一 `npx -y @yottameta/yotta-vetter --agent <name>` / `--dir <dir>`（推荐，走 npm 源）；方式二 `git clone https://github.com/YottaMeta/yotta-vetter.git`；方式三 GitHub Download ZIP；方式四 `bash install.sh --agent/--dir/--list`。移除 `npx skills` 与 `-g` 推荐；中英双 README 安装节同步。
6
+ - 版本对齐：package.json / SKILL.md / CHANGELOG / 引擎 VERSION / 测试断言 / README 锚点 = 0.1.5。
7
+ - 维护修复：签名数据文件跳过列表加入 hardening_rules.py。
8
+ - 无功能变更（仅文档与版本同步）。
9
+
10
+ ## v0.1.4 (2026-08-29)
11
+
12
+ 维护性修复（签名数据豁免）：
13
+
14
+ - 规则表豁免列表加入 `verify_rules.py`（yotta-verify 规则表）：元审检查 yotta-verify 时
15
+ 规则表自身字面量不再误报（keychain / id_rsa / DPAPI 等检测模式属签名数据）。
16
+
3
17
  ## v0.1.3 (2026-08-28)
4
18
 
5
19
  中英双语 README 对齐 + 版本统一（老张拍板「英文门面 + 中文全档」）：
package/README.md CHANGED
@@ -41,7 +41,7 @@
41
41
  | **Semi-automated source** | source checks stars / last-updated / license with a local cache; degrades gracefully offline |
42
42
  | **Deep-scan handoff** | high-and-above automatically guides you into yotta-security-audit |
43
43
  | **Zero dependency** | Python 3.8+ standard library; no daemon / database; Windows + Linux |
44
- | **Ecosystem distribution** | GitHub + npm synced; install via npx / install.sh / manual copy |
44
+ | **Ecosystem distribution** | GitHub + npm synced; four install methods (npx / git clone / Download ZIP / install.sh) |
45
45
 
46
46
  ## Commands / four-phase review protocol
47
47
 
@@ -87,53 +87,42 @@ python3 scripts/yotta_vetter.py source github:YottaMeta/yotta-memory
87
87
 
88
88
  ## Install
89
89
 
90
- Pick any one of the three methods; skill files are fetched from **npm** (GitHub is slower without a proxy; npm can use a domestic mirror).
90
+ Pick any of the four methods below; the order is the recommended priority. Skill files always come from **npm** (GitHub can be slow without a proxy; npm supports mirrors).
91
91
 
92
- ### Method 1: npm (recommended, one-liner)
93
- ```bash
94
- # domestic mirror (optional): npm config set registry https://registry.npmmirror.com
95
- npx -y @yottameta/yotta-vetter -g
96
- npx -y @yottameta/yotta-vetter --dir <your-skills-dir> # any agent: install to a specific directory
92
+ ### Method 1: npm one-liner (recommended)
93
+
94
+ ```text
95
+ # Optional China mirror: npm config set registry https://registry.npmmirror.com
96
+ npx -y @yottameta/yotta-vetter --agent <agent-name> # install to the agent's default user-level skills dir
97
+ npx -y @yottameta/yotta-vetter --dir <your-skills-dir> # point to the skills dir itself (e.g. ~/.codex/skills)
97
98
  ```
98
- > Not in the preset list? Use --dir to point at the agent's skills directory, or manual copy (method 3). --list shows each agent's default directory. You can also npm pack @yottameta/yotta-vetter and unpack it to install via method 2 / 3.
99
99
 
100
- ### Method 2: install.sh one-shot
101
- ```bash
102
- bash install.sh -g # user level; bash install.sh --list shows all directories
103
- bash install.sh --agent codex # specific agent (--list shows available ones)
104
- bash install.sh # project level: auto-detect existing .claude/.cursor/.codex skills dirs
105
- bash install.sh --dir /path/to/skills
100
+ - `--agent <name>` installs to that agent's default user-level directory; `--list` shows each agent's default directory.
101
+ - `--dir <path>` installs to the given directory; for agents not in the preset list, point `--dir` at their skills directory.
102
+ - If the mirror has not synced the new package (404): add `--registry=https://registry.npmjs.org/` (a proxy may be needed in China), or wait for the mirror cache.
103
+
104
+ ### Method 2: git clone (developers / git available)
105
+
106
+ ```text
107
+ git clone https://github.com/YottaMeta/yotta-vetter.git <your-skills-dir>/yotta-vetter
106
108
  ```
107
- > Covers 17 agent families including Trae / Qwen / Comate / CodeBuddy / Kimi. Windows users: works with Git Bash; otherwise use method 3.
108
109
 
109
- ### Method 3: manual copy
110
- Copy the whole `yotta-vetter` folder into the target agent's skills directory. Common locations (user level; Windows uses %USERPROFILE%, Linux/macOS uses ~):
110
+ ### Method 3: GitHub Download ZIP (manual / no git)
111
111
 
112
- | Agent | User-level directory | Project-level directory |
113
- |---|---|---|
114
- | Codex | %USERPROFILE%\.codex\skills\yotta-vetter\ | .codex\skills\ |
115
- | Claude Code | %USERPROFILE%\.claude\skills\yotta-vetter\ | .claude\skills\ |
116
- | Cursor | %USERPROFILE%\.cursor\skills\yotta-vetter\ | .cursor\skills\ |
117
- | Windsurf | %USERPROFILE%\.codeium\windsurf\skills\yotta-vetter\ | .windsurf\skills\ |
118
- | opencode | %USERPROFILE%\.config\opencode\skills\yotta-vetter\ | .opencode\skills\ |
119
- | Gemini | %USERPROFILE%\.gemini\skills\yotta-vetter\ | .gemini\skills\ |
120
- | Goose | %USERPROFILE%\.config\goose\skills\yotta-vetter\ | .goose\skills\ |
121
- | Amp | %USERPROFILE%\.config\agents\skills\yotta-vetter\ | .agents\skills\ |
122
- | Kiro | %USERPROFILE%\.kiro\skills\yotta-vetter\ | .kiro\skills\ |
123
- | WorkBuddy | %USERPROFILE%\.workbuddy\skills\yotta-vetter\ | .workbuddy\skills\ |
124
- | Trae Code CLI | %USERPROFILE%\.traecli\skills\yotta-vetter\ | .traecli\skills\ |
125
- | Trae IDE (CN) | %USERPROFILE%\.trae-cn\skills\yotta-vetter\ | .trae\skills\ |
126
- | Qwen Code | %USERPROFILE%\.qwen\skills\yotta-vetter\ | .qwen\skills\ |
127
- | Comate | %USERPROFILE%\.comate\skills\yotta-vetter\ | .comate\skills\ |
128
- | CodeBuddy | %USERPROFILE%\.codebuddy\skills\yotta-vetter\ | .codebuddy\skills\ |
129
- | Kimi | %USERPROFILE%\.kimi\skills\yotta-vetter\ | .kimi\skills\ |
130
- | Generic AGENTS.md | %USERPROFILE%\.agents\skills\yotta-vetter\ | .agents\skills\ |
131
-
132
- > If Codex's CODEX_HOME is set, it overrides the default; the same applies to opencode's XDG_CONFIG_HOME. .agents\skills is not a universal directory — only OpenCode / Cursor / Cline / Amp / Kimi / Gemini CLI / GitHub Copilot etc. read it; **Claude Code and Codex do not read it by default**. When unsure, use --dir or let the agent install it.
112
+ On the GitHub repository `YottaMeta/yotta-vetter`, click **Code → Download ZIP**, unzip it and put the `yotta-vetter` folder into the agent's skills directory.
113
+
114
+ ### Method 4: install.sh (multi-agent one-liner script)
115
+
116
+ ```text
117
+ bash install.sh --agent <name> # install to the agent's default user-level directory
118
+ bash install.sh --dir <path> # install to the given directory
119
+ bash install.sh --list # list agents -> default directories
120
+ ```
133
121
 
122
+ > Method 1 uses the npm registry (npmmirror / npmjs) and does not depend on GitHub; Methods 2/3 use GitHub and may fail without a proxy in China.
134
123
  ## Upgrade / uninstall
135
124
 
136
- - **Upgrade**: reinstall the latest version to overwrite — npx -y @yottameta/yotta-vetter -g or rerun bash install.sh -g. Old files inside the skill folder are overwritten; other project files are untouched.
125
+ - **Upgrade**: reinstall the latest version to overwrite — rerun the install command you used (e.g. `npx -y @yottameta/yotta-vetter --agent <name>` or `bash install.sh --agent <name>`). Old files in the skill directory are replaced; other project files are untouched.
137
126
  - **Uninstall**: delete the yotta-vetter folder under the target agent's skills directory (see the table above). The skill stops taking effect after removal.
138
127
 
139
128
  ## FAQ
package/README.zh-CN.md CHANGED
@@ -41,7 +41,7 @@
41
41
  | **来源半自动** | source 命令查 stars/更新时间/许可证，本地缓存、无网络自动降级 |
42
42
  | **联动深度扫描** | high 及以上自动引导跑 yotta-security-audit |
43
43
  | **零依赖** | Python 3.8+ 标准库，无 daemon / 无数据库；Windows + Linux 通用 |
44
- | **生态分发** | GitHub + npm 双源同步发布；npx / install.sh / 手动复制三种安装方式 |
44
+ | **生态分发** | GitHub + npm 双源同步发布；npx / git clone / Download ZIP / install.sh 四种安装方式 |
45
45
 
46
46
  ## 功能体系 / 四阶段审查协议
47
47
 
@@ -87,53 +87,42 @@ python3 scripts/yotta_vetter.py source github:YottaMeta/yotta-memory
87
87
 
88
88
  ## 安装
89
89
 
90
- 三种方式任选其一，技能文件统一从 **npm** 获取（GitHub 无代理时较慢，npm 可配国内镜像加速）。
90
+ 以下四种方式任选，顺序即推荐优先级；技能文件一律从 **npm** 获取（GitHub 无代理较慢，npm 支持镜像）。
91
91
 
92
- ### 方式一：npm（推荐，一行安装）
93
- ```bash
94
- # 国内加速（可选）：npm config set registry https://registry.npmmirror.com
95
- npx -y @yottameta/yotta-vetter -g
96
- npx -y @yottameta/yotta-vetter --dir <你的技能目录> # 任意智能体：指定目录安装
92
+ ### 方式一：npm 一行装（推荐）
93
+
94
+ ```text
95
+ # 可选国内加速：npm config set registry https://registry.npmmirror.com
96
+ npx -y @yottameta/yotta-vetter --agent <智能体名称> # 装到指定智能体默认用户级技能目录
97
+ npx -y @yottameta/yotta-vetter --dir <智能体的技能目录> # 指到技能目录本身（如 ~/.codex/skills）
97
98
  ```
98
- > 智能体不在预置列表里？用 `--dir` 指定它的 skills 目录，或手动复制（方式三）。`--list` 可查看各智能体对应的默认目录。想手动拿文件也可 `npm pack @yottameta/yotta-vetter` 解包后按方式二/三安装。
99
99
 
100
- ### 方式二：install.sh 一键安装
101
- ```bash
102
- bash install.sh -g # 用户级；bash install.sh --list 查看全部目录
103
- bash install.sh --agent codex # 指定智能体（--list 可查看可用项）
104
- bash install.sh # 项目级：自动检测已存在的 .claude/.cursor/.codex 等 skills 目录
105
- bash install.sh --dir /path/to/skills
100
+ - `--agent <name>` 自动装到该智能体默认用户级目录；`--list` 可查看各智能体默认目录。
101
+ - `--dir <路径>` 装到指定的技能目录；未收录的智能体用 `--dir` 指到它的技能目录。
102
+ - npmmirror 未同步新包（404）：加 `--registry=https://registry.npmjs.org/`（国内需代理），或稍等镜像缓存。
103
+
104
+ ### 方式二：git clone（开发者 / 有 git 环境）
105
+
106
+ ```text
107
+ git clone https://github.com/YottaMeta/yotta-vetter.git <智能体的技能目录>/yotta-vetter
106
108
  ```
107
- > 覆盖 17 类智能体，含国内 Trae / Qwen / Comate / CodeBuddy / Kimi。Windows 用户：装有 Git Bash 即可用；否则用方式三手动复制。
108
109
 
109
- ### 方式三：手动复制
110
- 把整个 `yotta-vetter` 文件夹复制到目标智能体的 skills 目录。常见位置（用户级；Windows 用 `%USERPROFILE%`，Linux/macOS 用 `~`）：
110
+ ### 方式三：GitHub 下载压缩包（手动 / 无 git 环境）
111
111
 
112
- | 智能体 | 用户级目录 | 项目级目录 |
113
- |---|---|---|
114
- | Codex | `%USERPROFILE%\.codex\skills\yotta-vetter\` | `.codex\skills\` |
115
- | Claude Code | `%USERPROFILE%\.claude\skills\yotta-vetter\` | `.claude\skills\` |
116
- | Cursor | `%USERPROFILE%\.cursor\skills\yotta-vetter\` | `.cursor\skills\` |
117
- | Windsurf | `%USERPROFILE%\.codeium\windsurf\skills\yotta-vetter\` | `.windsurf\skills\` |
118
- | opencode | `%USERPROFILE%\.config\opencode\skills\yotta-vetter\` | `.opencode\skills\` |
119
- | Gemini | `%USERPROFILE%\.gemini\skills\yotta-vetter\` | `.gemini\skills\` |
120
- | Goose | `%USERPROFILE%\.config\goose\skills\yotta-vetter\` | `.goose\skills\` |
121
- | Amp | `%USERPROFILE%\.config\agents\skills\yotta-vetter\` | `.agents\skills\` |
122
- | Kiro | `%USERPROFILE%\.kiro\skills\yotta-vetter\` | `.kiro\skills\` |
123
- | WorkBuddy | `%USERPROFILE%\.workbuddy\skills\yotta-vetter\` | `.workbuddy\skills\` |
124
- | Trae Code CLI | `%USERPROFILE%\.traecli\skills\yotta-vetter\` | `.traecli\skills\` |
125
- | Trae IDE（国内） | `%USERPROFILE%\.trae-cn\skills\yotta-vetter\` | `.trae\skills\` |
126
- | Qwen Code | `%USERPROFILE%\.qwen\skills\yotta-vetter\` | `.qwen\skills\` |
127
- | Comate | `%USERPROFILE%\.comate\skills\yotta-vetter\` | `.comate\skills\` |
128
- | CodeBuddy | `%USERPROFILE%\.codebuddy\skills\yotta-vetter\` | `.codebuddy\skills\` |
129
- | Kimi | `%USERPROFILE%\.kimi\skills\yotta-vetter\` | `.kimi\skills\` |
130
- | 通用 AGENTS.md | `%USERPROFILE%\.agents\skills\yotta-vetter\` | `.agents\skills\` |
131
-
132
- > Codex 默认目录若设置了环境变量 `CODEX_HOME`，以该变量为准；opencode 若设置 `XDG_CONFIG_HOME` 同理。`.agents\skills` 并非通用目录，仅 OpenCode / Cursor / Cline / Amp / Kimi / Gemini CLI / GitHub Copilot 等会读取，**Claude Code 与 Codex 默认不读**。不确定时用 `--dir` 指定，或让该智能体自行安装。
112
+ 在 GitHub 仓库 `YottaMeta/yotta-vetter` 点 **Code → Download ZIP**，解压后把 `yotta-vetter` 文件夹放进智能体技能目录。
113
+
114
+ ### 方式四：install.sh（多智能体一键脚本）
115
+
116
+ ```text
117
+ bash install.sh --agent <name> # 装到指定智能体默认用户级目录
118
+ bash install.sh --dir <path> # 装到指定目录
119
+ bash install.sh --list # 列出智能体 -> 默认目录
120
+ ```
133
121
 
122
+ > 方式一走 npm 源（npmmirror / npmjs），不依赖 GitHub；方式二 / 三走 GitHub，国内无代理可能失败。
134
123
  ## 升级 / 卸载
135
124
 
136
- - **升级**：重新安装最新版覆盖即可——`npx -y @yottameta/yotta-vetter -g` 或重跑 `bash install.sh -g`。技能目录内的旧文件会被覆盖；不影响项目中已有的其他文件。
125
+ - **升级**：重新安装最新版覆盖即可——重跑你用的安装命令（如 `npx -y @yottameta/yotta-vetter --agent <name>` 或 `bash install.sh --agent <name>`）。技能目录内旧文件会被替换；不影响项目中其他文件。
137
126
  - **卸载**：删除目标智能体 skills 目录下的 `yotta-vetter` 文件夹（各智能体目录见上表）即可。卸载后本技能不再生效。
138
127
 
139
128
  ## 常见问题
package/SKILL.md CHANGED
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  name: yotta-vetter
3
- version: 0.1.3
3
+ version: 0.1.5
4
4
  description: 元审 —— 安装任何技能前的安全审查协议：四阶段 checklist（来源→代码→权限→风险）+ 轻量 checker，与元安联动深度扫描。触发：安装/评估任何技能前、从市场或 GitHub 获取技能、审查他人分享的技能、任何「要装未知代码」的场景；或用户说 审查/审查技能/vetting/技能安全审查/检查技能 等。边界：checker 只做初审与报告，结论需人工确认；绝不代替最终决策。
5
5
  license: MIT
6
6
  ---
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@yottameta/yotta-vetter",
3
- "version": "0.1.3",
3
+ "version": "0.1.5",
4
4
  "description": "Yuanshen (元审) — the security review protocol before installing any skill: a four-phase checklist (source → code → permissions → risk) + a lightweight checker, with deep-scan handoff to yotta-security-audit. Triggers before installing/evaluating any skill or reviewing unknown code. Boundaries: initial review & report only; human confirmation required.",
5
5
  "license": "MIT",
6
6
  "keywords": [
package/scripts/yotta_vetter.py CHANGED
@@ -48,7 +48,7 @@ _HERE = Path(__file__).resolve().parent
48
48
  sys.path.insert(0, str(_HERE))
49
49
  import vetter_rules # noqa: E402
50
50
 
51
- VERSION = "0.1.3"
51
+ VERSION = "0.1.5"
52
52
  TOOL_NAME = "yotta-vetter"
53
53
  MAX_FILE_SIZE = 1_000_000
54
54
  MAX_LINE_LEN = vetter_rules.MAX_LINE_LEN
@@ -125,7 +125,7 @@ def collect_files(root):
125
125
  try:
126
126
  if p.suffix.lower() not in TEXT_EXTENSIONS and p.name.lower() not in DOTFILE_NAMES:
127
127
  continue
128
- if p.name in ("audit_rules.py", "vetter_rules.py"):
128
+ if p.name in ("audit_rules.py", "vetter_rules.py", "verify_rules.py", "hardening_rules.py"):
129
129
  continue # 签名数据文件（规则表）
130
130
  if p.stat().st_size > MAX_FILE_SIZE:
131
131
  continue