@younndai/lyt-skills 0.12.1 → 0.13.1

package/CONTRIBUTING.md

@@ -0,0 +1,61 @@
+# Contributing to Lyt (Link Your Think™)
+
+Thank you for your interest in contributing to Lyt, a YounndAI™ product by
+MARLINK TRADING SRL.
+
+> Lyt is in public **alpha**. The surface is moving quickly; please open an
+> issue or a discussion before starting non-trivial work so we can confirm
+> direction and avoid duplicated effort.
+
+## Contributor License Agreement (REQUIRED)
+
+Before we can accept your contribution, we need you to sign a Contributor
+License Agreement (CLA). The CLA is a one-time legal document that confirms:
+
+- You have the right to grant us the license terms specified in the CLA
+- You grant us a broad, perpetual license to use, modify, and re-license your contribution
+- You receive no special contributor rights: no royalties, governance, trademark rights, private license-back, approval rights, or claims against future relicensing or posture changes
+- Your contribution is provided "as is" without warranty
+
+### Which CLA do I sign?
+
+- **[Individual CLA](https://github.com/YounndAI/lyt/blob/main/CLA.md)** — if you are
+  contributing on your own behalf, on your own time, and your employer has no
+  claim to your intellectual-property output.
+- **[Entity CLA](https://github.com/YounndAI/lyt/blob/main/CLA-entity.md)** — if you are
+  contributing as an employee or contractor on behalf of an employer or
+  organization. The Entity CLA covers all contributors your organization
+  authorizes (listed in its Schedule A).
+
+If you are unsure, sign **both**.
+
+### How to sign
+
+When you open your first pull request, our [CLA bot](https://cla-assistant.io)
+will comment with a link to sign. You can sign electronically via GitHub OAuth
+— no paperwork required. Once signed, your future contributions are
+automatically covered. **Pull requests cannot be merged until the CLA bot
+confirms a signed CLA is on file for all contributors.**
+
+## Code contribution checklist
+
+- [ ] Signed the appropriate CLA (see above)
+- [ ] Apache-2.0 copyright header included in any new source files (see existing files for the exact block)
+- [ ] Code follows existing project conventions (TypeScript strict mode, libSQL-only data layer, cross-platform paths)
+- [ ] Focused tests added for new functionality; `npm run build`, `npm run typecheck`, and `npm test` green
+- [ ] Documentation updated for user-facing changes
+- [ ] Trademark indicators (™) on first prominent use of any YounndAI or Lyt mark in new documentation
+- [ ] CHANGELOG.md updated where the change is user-facing
+
+## Code of conduct
+
+We follow the [Contributor Covenant Code of Conduct](https://github.com/YounndAI/lyt/blob/main/CODE_OF_CONDUCT.md).
+By contributing, you agree to abide by its terms.
+
+## Questions?
+
+- General questions: [GitHub Discussions](https://github.com/YounndAI/lyt/discussions)
+- Legal questions: office@younndai.com
+- Security questions: see [SECURITY.md](SECURITY.md)
+
+Thank you for contributing!

package/NOTICE

@@ -12,12 +12,12 @@ Licensed under the Apache License, Version 2.0. See LICENSE.
 Trademark notice
 ----------------------------------------------------------------------
 
-YounndAI™ and LYT™ are trademarks of MARLINK TRADING SRL.
+YounndAI™ and Lyt (Link Your Think™) are trademarks of MARLINK TRADING SRL.
 
 The Apache License, Version 2.0 does not grant permission to use the
 trade names, trademarks, service marks, or product names of
 MARLINK TRADING SRL, except as required for describing the origin of
 this work and reproducing the content of this NOTICE file.
 
-See TRADEMARK.md for the trademark usage policy.
+See https://github.com/YounndAI/lyt/blob/main/TRADEMARK.md for the trademark usage policy.
 For trademark usage permissions, contact: office@younndai.com

package/README.md

@@ -9,7 +9,7 @@
 <p align="center">
   <strong>@younndai/lyt-skills</strong><br />
   Agent-harness skills — let Claude Code, Codex, and any agent runtime drive your markdown vaults as first-class operators.<br />
-  <em>Part of the Lyt™ toolchain — federated markdown vaults you own, made legible to AI.</em>
+  <em>Part of the Lyt (Link Your Think™) toolchain — federated markdown vaults you own, made legible to AI.</em>
 </p>
 
 <p align="center">
@@ -24,7 +24,7 @@
 
 ## What is this?
 
-`@younndai/lyt-skills` is where [Lyt™](https://github.com/YounndAI/lyt)'s **AI-first** design becomes tangible: eleven harness skills that let AI agents — Claude Code, Codex, and generic agent runtimes — drive your markdown vaults as **first-class operators**. Install once and your agent can capture notes, search your pod, prime on context, adopt a vault, explore meshes, and sync vaults — through the same governed operation set you use, under the same permission semantics. This is the "install once, every agent runtime knows Lyt" layer.
+`@younndai/lyt-skills` is where [Lyt](https://github.com/YounndAI/lyt)'s **AI-first** design becomes tangible: eleven harness skills that let AI agents — Claude Code, Codex, and generic agent runtimes — drive your markdown vaults as **first-class operators**. Install once and your agent can capture notes, search your pod, prime on context, adopt a vault, explore meshes, and sync vaults — through the same governed operation set you use, under the same permission semantics. This is the "install once, every agent runtime knows Lyt" layer.
 
 The `/lyt-capture` skill wraps the `knowledge-capture` pattern verb from the `lyt pattern run` runtime, so structured note capture shows up as a first-class agent skill inside any vault; the read/orient + addressing + lifecycle skills (`/lyt-pod`, `/lyt-search`, `/lyt-recall`, `/lyt-primer-context`, `/lyt-mesh-explore`, `/lyt-sync`, `/lyt-alias`, `/lyt-adopt`, `/lyt-update`) wrap the corresponding CLI verbs directly. Pairs with [`@younndai/lyt-vault`](https://www.npmjs.com/package/@younndai/lyt-vault), which ships the bundled `knowledge-capture` pattern the capture/recall skills resolve against (workflow patterns are bring-your-own via `lyt pattern install`).
 

package/SECURITY.md

@@ -0,0 +1,45 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+If you discover a security vulnerability in Lyt, please report it
+responsibly:
+
+1. **DO NOT** file a public GitHub issue.
+2. Email **office@younndai.com** with:
+   - A description of the vulnerability and its potential impact
+   - Steps to reproduce, or a proof of concept (if safe to share)
+   - Affected versions
+   - Suggested severity: **Critical**, **High**, or **Moderate**
+
+Responsible disclosure preserves the safety of every downstream user.
+
+## Response timeline
+
+| Action                  | SLA              |
+| ----------------------- | ---------------- |
+| Acknowledgement         | 72 hours         |
+| Initial assessment      | 7 calendar days  |
+| Remediation or advisory | 30 calendar days |
+
+Critical issues are prioritized and may be patched ahead of the stated window
+where feasible.
+
+## Supported versions
+
+Lyt is in public **alpha**. Security fixes are applied to the latest published
+`alpha` release only. Pin to a released version and update promptly when a new
+alpha ships.
+
+## Responsible disclosure
+
+We commit to:
+
+- Acknowledging your report within the timeline above
+- Working with you to verify and reproduce the vulnerability
+- Coordinating a public disclosure date that gives users time to update
+- Crediting you in the security advisory (unless you prefer anonymity)
+
+---
+
+© 2026 MARLINK TRADING SRL (YounndAI).

package/dist/commands/skills-install.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skills-install.d.ts","sourceRoot":"","sources":["../../src/commands/skills-install.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,OAAO,EAAU,MAAM,WAAW,CAAC;AAY5C,wBAAgB,4BAA4B,IAAI,OAAO,CAgCtD"}
+{"version":3,"file":"skills-install.d.ts","sourceRoot":"","sources":["../../src/commands/skills-install.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,OAAO,EAAU,MAAM,WAAW,CAAC;AAkB5C,wBAAgB,4BAA4B,IAAI,OAAO,CA2CtD"}

package/dist/commands/skills-install.js

@@ -1,9 +1,25 @@
+/*
+ * Copyright 2026 MARLINK TRADING SRL (YounndAI)
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 import { Command, Option } from "commander";
-import { symlinkSkillsTriRuntime, ALL_RUNTIMES } from "../symlink.js";
+import { symlinkSkillsTriRuntime, ALL_RUNTIMES, getBundledSkillsDir, listBundledSkills, } from "../symlink.js";
 export function buildSkillsInstallSubcommand() {
     const cmd = new Command("install");
     cmd
         .description("Symlink bundled Lyt skills into Claude Code / Codex / .agents runtimes")
+        .argument("[names...]", "Install only the named bundled skills")
         .addOption(new Option("--runtime <name>", "Target runtime")
         .choices(["claude", "codex", "agents", "all"])
         .default("all"))
@@ -11,11 +27,21 @@ export function buildSkillsInstallSubcommand() {
         .option("-f, --force", "Overwrite divergent symlinks or copied directories", false)
         .option("--source <dir>", "Override bundled skills source directory (test seam)")
         .option("--json", "Emit deterministic JSON shape", false)
-        .action((opts) => {
+        .action((names, opts) => {
         const runtimes = resolveRuntimes(opts.runtime ?? "all");
+        const sourceDir = opts.source ?? getBundledSkillsDir();
+        const validNames = [...listBundledSkills(sourceDir)].sort();
+        const validNameSet = new Set(validNames);
+        const unknownNames = [...new Set(names.filter((name) => !validNameSet.has(name)))].sort();
+        if (unknownNames.length > 0) {
+            printUnknownSkills(unknownNames, validNames, opts.json ?? false);
+            process.exitCode = 1;
+            return;
+        }
         const result = symlinkSkillsTriRuntime({
             sourceDir: opts.source,
             runtimes,
+            skillNames: names.length > 0 ? names : undefined,
             copy: opts.copy ?? false,
             force: opts.force ?? false,
         });
@@ -31,6 +57,17 @@ export function buildSkillsInstallSubcommand() {
     });
     return cmd;
 }
+function printUnknownSkills(unknownNames, validNames, json) {
+    if (json) {
+        process.stdout.write(JSON.stringify({
+            error: "unknown-skill",
+            unknownSkills: unknownNames,
+            validSkills: validNames,
+        }, null, 2) + "\n");
+        return;
+    }
+    console.error(`Unknown Lyt skill name(s): ${unknownNames.join(", ")}\nValid skill names: ${validNames.join(", ")}`);
+}
 function resolveRuntimes(name) {
     if (name === "all")
         return ALL_RUNTIMES;

package/dist/commands/skills-install.js.map

@@ -1 +1 @@
-{"version":3,"file":"skills-install.js","sourceRoot":"","sources":["../../src/commands/skills-install.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAE5C,OAAO,EAAE,uBAAuB,EAAE,YAAY,EAAgB,MAAM,eAAe,CAAC;AAUpF,MAAM,UAAU,4BAA4B;IAC1C,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC;IACnC,GAAG;SACA,WAAW,CAAC,wEAAwE,CAAC;SACrF,SAAS,CACR,IAAI,MAAM,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;SAC7C,OAAO,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;SAC7C,OAAO,CAAC,KAAK,CAAC,CAClB;SACA,MAAM,CAAC,QAAQ,EAAE,iDAAiD,EAAE,KAAK,CAAC;SAC1E,MAAM,CAAC,aAAa,EAAE,oDAAoD,EAAE,KAAK,CAAC;SAClF,MAAM,CAAC,gBAAgB,EAAE,sDAAsD,CAAC;SAChF,MAAM,CAAC,QAAQ,EAAE,+BAA+B,EAAE,KAAK,CAAC;SACxD,MAAM,CAAC,CAAC,IAA0B,EAAE,EAAE;QACrC,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,uBAAuB,CAAC;YACrC,SAAS,EAAE,IAAI,CAAC,MAAM;YACtB,QAAQ;YACR,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,KAAK;YACxB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,KAAK;SAC3B,CAAC,CAAC;QAEH,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC/D,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC;QAED,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,QAAQ,KAAK,CAAC;YAAE,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAClD,CAAC,CAAC,CAAC;IACL,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,YAAY,CAAC;IACxC,OAAO,CAAC,IAAe,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,UAAU,CAAC,MAAkD;IAEpE,OAAO,CAAC,GAAG,CAAC,6BAA6B,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAC7D,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAE/C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC;IAC9D,CAAC;IAID,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,mBAAmB,CAAC,CAAC;IAClF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAE1B,OAAO,CAAC,IAAI,CACV,OAAO,UAAU,CAAC,MAAM,0FAA0F,CACnH,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAE3B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,MAAkD;IACtE,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/B,IAAI,CAAC,CAAC,MAAM,KAAK,wBAAwB;YAAE,OAAO,CAAC,CAAC;QAKpD,IAAI,CAAC,CAAC,MAAM,KAAK,mBAAmB;YAAE,IAAI,GAAG,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"skills-install.js","sourceRoot":"","sources":["../../src/commands/skills-install.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAE5C,OAAO,EACL,uBAAuB,EACvB,YAAY,EACZ,mBAAmB,EACnB,iBAAiB,GAElB,MAAM,eAAe,CAAC;AAUvB,MAAM,UAAU,4BAA4B;IAC1C,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC;IACnC,GAAG;SACA,WAAW,CAAC,wEAAwE,CAAC;SACrF,QAAQ,CAAC,YAAY,EAAE,uCAAuC,CAAC;SAC/D,SAAS,CACR,IAAI,MAAM,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;SAC7C,OAAO,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;SAC7C,OAAO,CAAC,KAAK,CAAC,CAClB;SACA,MAAM,CAAC,QAAQ,EAAE,iDAAiD,EAAE,KAAK,CAAC;SAC1E,MAAM,CAAC,aAAa,EAAE,oDAAoD,EAAE,KAAK,CAAC;SAClF,MAAM,CAAC,gBAAgB,EAAE,sDAAsD,CAAC;SAChF,MAAM,CAAC,QAAQ,EAAE,+BAA+B,EAAE,KAAK,CAAC;SACxD,MAAM,CAAC,CAAC,KAAe,EAAE,IAA0B,EAAE,EAAE;QACtD,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,IAAI,mBAAmB,EAAE,CAAC;QACvD,MAAM,UAAU,GAAG,CAAC,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5D,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QACzC,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1F,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,kBAAkB,CAAC,YAAY,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC;YACjE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,uBAAuB,CAAC;YACrC,SAAS,EAAE,IAAI,CAAC,MAAM;YACtB,QAAQ;YACR,UAAU,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;YAChD,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,KAAK;YACxB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,KAAK;SAC3B,CAAC,CAAC;QAEH,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC/D,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC;QAED,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,QAAQ,KAAK,CAAC;YAAE,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAClD,CAAC,CAAC,CAAC;IACL,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CACzB,YAA+B,EAC/B,UAA6B,EAC7B,IAAa;IAEb,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CACZ;YACE,KAAK,EAAE,eAAe;YACtB,aAAa,EAAE,YAAY;YAC3B,WAAW,EAAE,UAAU;SACxB,EACD,IAAI,EACJ,CAAC,CACF,GAAG,IAAI,CACT,CAAC;QACF,OAAO;IACT,CAAC;IAED,OAAO,CAAC,KAAK,CACX,8BAA8B,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,wBAAwB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACrG,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,YAAY,CAAC;IACxC,OAAO,CAAC,IAAe,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,UAAU,CAAC,MAAkD;IAEpE,OAAO,CAAC,GAAG,CAAC,6BAA6B,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAC7D,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAE/C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC;IAC9D,CAAC;IAID,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,mBAAmB,CAAC,CAAC;IAClF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAE1B,OAAO,CAAC,IAAI,CACV,OAAO,UAAU,CAAC,MAAM,0FAA0F,CACnH,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAE3B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,MAAkD;IACtE,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/B,IAAI,CAAC,CAAC,MAAM,KAAK,wBAAwB;YAAE,OAAO,CAAC,CAAC;QAKpD,IAAI,CAAC,CAAC,MAAM,KAAK,mBAAmB;YAAE,IAAI,GAAG,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/commands/skills-list.js

@@ -1,3 +1,18 @@
+/*
+ * Copyright 2026 MARLINK TRADING SRL (YounndAI)
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 import { Command, Option } from "commander";
 import { listSkillsTriRuntime } from "../list.js";
 import { ALL_RUNTIMES } from "../symlink.js";

package/dist/commands/skills.js

@@ -1,3 +1,18 @@
+/*
+ * Copyright 2026 MARLINK TRADING SRL (YounndAI)
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 import { Command } from "commander";
 import { buildSkillsInstallSubcommand } from "./skills-install.js";
 import { buildSkillsListSubcommand } from "./skills-list.js";

package/dist/index.js

@@ -1,3 +1,18 @@
+/*
+ * Copyright 2026 MARLINK TRADING SRL (YounndAI)
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 export { symlinkSkillsTriRuntime, getRuntimeTargetDir, getBundledSkillsDir, listBundledSkills, ALL_RUNTIMES, } from "./symlink.js";
 export { listSkillsTriRuntime } from "./list.js";
 export { buildSkillsCommand } from "./commands/skills.js";

package/dist/list.js

@@ -1,3 +1,18 @@
+/*
+ * Copyright 2026 MARLINK TRADING SRL (YounndAI)
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 import { existsSync, lstatSync, readFileSync, readlinkSync, statSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { ALL_RUNTIMES, getBundledSkillsDir, getRuntimeTargetDir, listBundledSkills, } from "./symlink.js";

package/dist/symlink.js

@@ -1,3 +1,18 @@
+/*
+ * Copyright 2026 MARLINK TRADING SRL (YounndAI)
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 import { cpSync, existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, readlinkSync, renameSync, rmSync, statSync, symlinkSync, } from "node:fs";
 import { homedir, platform } from "node:os";
 import { basename, dirname, join, resolve } from "node:path";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@younndai/lyt-skills",
-  "version": "0.12.1",
+  "version": "0.13.1",
   "description": "Lyt harness skills — 11 skills (/lyt-capture, /lyt-recall, /lyt-pattern, /lyt-pod, /lyt-mesh-explore, /lyt-primer-context, /lyt-search, /lyt-sync, /lyt-alias, /lyt-adopt, /lyt-update) symlinked tri-runtime into ~/.claude/skills/, ~/.codex/skills/, ~/.agents/skills/. Composed into the `lyt skills install` and `lyt skills list` meta-CLI verbs.",
   "homepage": "https://linkyourthink.com",
   "repository": {
@@ -37,10 +37,12 @@
     "skills",
     "README.md",
     "LICENSE",
-    "NOTICE"
+    "NOTICE",
+    "CONTRIBUTING.md",
+    "SECURITY.md"
   ],
   "scripts": {
-    "build": "tsc",
+    "build": "tsc && node ../../scripts/public-release/stamp-dist-license-headers.mjs",
     "typecheck": "tsc --noEmit && tsc --project tsconfig.reparse-helper.json --noEmit",
     "test": "vitest run",
     "test:watch": "vitest",
@@ -49,7 +51,7 @@
     "prepublishOnly": "node ../../scripts/check-no-vendored-deps.mjs --root ../.. && node ../../scripts/public-release/scan-tarball.mjs lyt-skills"
   },
   "dependencies": {
-    "@younndai/lyt-vault": "^0.12.1",
+    "@younndai/lyt-vault": "^0.13.1",
     "commander": "^12.1.0"
   },
   "devDependencies": {

package/skills/lyt-sync/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: lyt-sync
 description: >
-  Sync a Lyt vault — pull from its GitHub repo, auto-commit any uncommitted local changes (with an inferred commit message or a handler-supplied one), then push back to origin gated on the 6-reason writable verdict from `vault info --json`. Trigger when the user runs /lyt-sync, or says "sync this vault", "pull and push", "sync my notes", "push my changes", or similar phrasing. Wraps `git pull --rebase`, dirty-tree detection, commit, and push under the hood. Read-only / subscriber / orphan / no-remote / gh-offline vaults pull but skip push and surface a reason-specific handler message. Pairs with /lyt-capture.
+  Sync one exact registered Lyt vault through `lyt sync --vault <qualified-vault> --json`. Lyt owns local reconciliation, first private publication through a trusted mesh target, remote validation, and truthful outcomes. Trigger when the user runs /lyt-sync, or asks to sync, pull, push, or publish one vault. Genuine local/no-target, read-only, subscriber, and offline vaults remain non-publishing. Pairs with /lyt-capture.
 visibility: public
 lyt-version: 0.4.0
 capabilities: [read, write]
@@ -11,7 +11,7 @@ requires_writable_vault: false
 
 # /lyt-sync
 
-Sync a Lyt vault — pull, detect-and-commit local changes, push (gated on the writable verdict). The skill always runs; the push step gates internally on the 6-reason `writable` contract from `lyt vault info --json`, so even read-only / subscriber / orphan / no-remote vaults pull cleanly without touching origin.
+Sync one exact vault through `lyt sync --vault <qualified-vault> --json`. Lyt owns repository creation, remote attachment, commits, pulls, pushes, validation, and truthful terminal status; never reproduce those boundaries with manual `gh` or raw Git commands.
 
 ## When to invoke
 
@@ -26,120 +26,36 @@ When the user runs `/lyt-sync`, or says something like:
 
 If the user says "save and sync" or "/lyt-capture then sync", run /lyt-capture first, then /lyt-sync on the destination vault.
 
-**Pod-wide sync: the `lyt sync` verb.** This skill's per-vault git flow (below) is the documented default for a **single named vault**. When the user wants to **sync everything** ("sync all my vaults", "sync my whole pod", "sync everything"), there is a real pod-wide CLI verb: `lyt sync` (no vault argument) syncs all registered active vaults — commit + push + pull --rebase — and also runs the federation publish pass. `lyt sync --watch` is a foreground daemon that auto-commits watched vaults (event-driven). `lyt sync --check` reports per-vault freshness without writing. There is **no** `lyt sync --mesh` flag; mesh-scoped sync is not a current verb.
+**Pod-wide sync is explicit.** Only "sync everything" uses bare `lyt sync`, which processes all registered active vaults and runs the federation publication pass. `lyt sync --watch` is the foreground watcher; `lyt sync --check` is read-only. There is no `lyt sync --mesh` flag.
 
-## Phase 1 — Resolve the target vault
+## Phase 1 — Resolve one exact vault
 
-Follow this chain, in order, and stop at the first success (mirrors /lyt-capture Phase 1):
+1. Use the Handler's explicit qualified `{mesh}/{vault}` address when supplied.
+2. Otherwise resolve `$LYT_ACTIVE_VAULT`, then `lyt vault info --by-path <cwd> --json` when cwd is inside a registered vault.
+3. If neither resolves exactly, ask. Never guess a path or bare name. Use the canonical qualified name returned by `lyt vault info ... --json`.
 
-1. **`--vault <path>` argument** — if the user passed one in the invocation, use it as-is (resolve to absolute path if relative).
-2. **`$LYT_ACTIVE_VAULT` environment variable** — if set, use it.
-3. **`~/lyt/vaults/<handle>/main/`** — the default convention per the unified `{handle}/{repo}` naming (Windows: `%USERPROFILE%\lyt\vaults\<handle>\main`). Resolve `<handle>` from the pod identity (`identity.yon` / `pod.yon`); never hardcode it.
+## Phase 2 — Apply the publication gate
 
-Do **not** guess from cwd. If `--vault` / env var / home convention all miss, ask the user which vault to target — fabricating a path from cwd would silently operate on the wrong tree.
+Read `lyt vault info <qualified-vault> --json`. Local writes may proceed when `vault.localWritable` is true. Before an outward action, read `vault.publishable`; on `"unknown"`, run `lyt vault refresh <qualified-vault>` and re-read it. If it remains unknown, pause and ask. Lyt performs the final trusted-target, ownership, read-only, and origin checks.
 
-If the resolved path **does not exist or is not a Lyt vault** (no `.lyt/vault.yon` inside), do **not** attempt git operations. Stop and tell the user:
+If the Handler did not already request an outward sync, ask before continuing. Use `--no-publish` when the Handler wants local reconciliation only.
 
-> The target vault `<path>` doesn't exist (or isn't a Lyt vault — no `.lyt/vault.yon`). Use `lyt vault init <name>`, or pass `--vault <existing-path>`.
-
-**Path-shape safety check.** Before invoking `git -C <vault-path>`, reject any resolved path that begins with `-` or `--` (defensive against a crafted `--vault` argument, `$LYT_ACTIVE_VAULT` env value, or any other resolver-input that could smuggle a flag-shaped token into the git positional). The `.lyt/vault.yon` existence check above already filters most invalid paths; this `--`-leading rejection closes the remaining flag-injection surface (the gh-flag-injection defense family). Resolved paths MUST be absolute and MUST start with a drive letter (Windows) or `/` (POSIX) before they enter any `git` argv.
-
-## Phase 2 — Pull with rebase
-
-Shell out to git directly with the vault path as `cwd`:
-
-```
-git -C <vault-path> pull --rebase
-```
-
-(On Windows, `git -C <path>` works with quoted paths, but the lyt-vault precedent — `flows/clone.ts`, `flows/repair.ts`, `util/git-history.ts` — uses `spawnSync` with `cwd: <vault-path>` so the path doesn't need to be embedded in argv. Skill prose recommends the `cwd` shape for cross-platform stability.)
-
-**On rebase conflict** (`git pull --rebase` exits non-zero with conflict markers): do NOT attempt auto-resolution. Surface a structured result to the handler and halt:
-
-```json
-{
-  "status": "conflict",
-  "vault": "<vault-name>",
-  "conflicted_files": ["<path1>", "<path2>"],
-  "message": "git pull --rebase failed; resolve the listed conflicts manually, then re-invoke /lyt-sync."
-}
-```
-
-The handler-facing prose to surface: _"Sync halted on rebase conflict in `<vault-name>`. Resolve the conflicts in `<files>`, then run `/lyt-sync` again."_
-
-## Phase 3 — Detect + commit local changes
-
-Run `git -C <vault-path> status --porcelain`. If the output is empty, skip to Phase 4 with a "no local changes" note for the handler. Otherwise:
-
-1. Parse the porcelain output into a `GitDiffSummary`-shaped object (`{staged: string[], modified: string[]}`). Porcelain v1 (the default) emits one line per change with a 2-character prefix: column 1 is the index/staged status, column 2 is the working-tree status. Treat any line whose column-1 char is not space or `?` as **staged** (e.g. `A `, `M `, `MM`, `D `); treat any line whose column-2 char is not space (or whose prefix is `??`) as **modified**. Strip the 3-character prefix to recover the file path. Files that appear staged AND modified land in both arrays — that's tolerated; the helper sorts and de-orders naturally and the resulting message just lists the file once or twice depending on its multi-state shape.
-2. Decide on a commit message. The skill exposes one **caller-options**-style choice:
-
-- `options.commit-message: "auto"` _(default)_ — call the `inferCommitMessage(diff)` heuristic to summarise the diff:
-- 0 files → `"no changes"` _(defensive; unreached because porcelain was non-empty)_
-- 1 file (non-mesh.yon) → `"sync: <filename>"`
-- 1 file (mesh.yon, at any depth) → `"sync: mesh.yon update"`
-- 2-4 files → `"sync: N files (<comma list>)"`
-- > 4 files → `"sync: N files (<first 3>, +M more)"`
-- `options.commit-message: "prompt-handler"` — pause and ask the handler for a one-line message; do not invent one.
-
-The heuristic is `inferCommitMessage`; the skill prose reproduces the rules above so an agent can run them inline without importing.
-
-3. Stage and commit. **Pass the message via argv, NOT through shell interpolation.** The shell-syntax pseudocode below is for documentation only; agents executing this skill MUST translate it to an argv-safe `spawnSync` / `execFileSync` call so a filename containing shell metacharacters (backticks, `$()`, `;`, `"`) inside the inferred message can't escape into command execution. Concretely:
+## Phase 3 — Invoke Lyt once
 
 ```
-# Pseudocode (DO NOT shell-interpolate):
-git -C <vault-path> add -A
-git -C <vault-path> commit -m "<message>"
-
-# Actual exec shape (argv array; cross-platform-safe):
-spawnSync("git", ["-C", vaultPath, "add", "-A"]);
-spawnSync("git", ["-C", vaultPath, "commit", "-m", message]);
+lyt sync --vault <qualified-vault> --json
 ```
 
-The matching precedent is `execFileSync("git", ["clone", opts.url, target])` — the same argv-array shape used everywhere the lyt-vault flow layer shells to git.
-
-Do **not** add a `Co-Authored-By` trailer (per the project's `CLAUDE.md` commit conventions). Do **not** add an `@STAMP` block — that is a `.yon`-write concern handled by lyt-runner, not the sync skill.
-
-## Phase 4 — Push (gated on the 6-reason writable verdict)
+Never replace this with raw `git` or `gh`. For an owned vault whose home mesh has a trusted target, Lyt may create the exact missing **private** repository, connect it, establish the first upstream, and publish only this vault. A genuine local/no-target vault remains local; subscriber/read-only vaults never publish.
 
-Invoke `lyt vault info <vault-name> --json` and parse the `vault.writable` and `vault.writableDetermination` fields per the read-only-awareness contract. The verdict is tri-state (`true | false | "unknown"`); the determination is one of **6 reasons** the skill must branch on explicitly.
-
-The actual reason strings emitted by `vault info --json` are listed in the **emitted name** column. The **semantic name** column gives the human-readable synonym; the SKILL.md surface uses the semantic name in handler-facing prose, but the comparison MUST be against the emitted name.
-
-| Emitted name (writableDetermination) | Semantic name               | writable    | Phase 4 behavior                                                                                                                                               |
-| ------------------------------------ | --------------------------- | ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `gh-viewerCanPush-true`              | **home-pushable-true**      | `true`      | Push: `git -C <vault-path> push`. Report: _"Synced and pushed N commits to origin."_                                                                           |
-| `gh-viewerCanPush-false`             | **home-not-pushable-false** | `false`     | Skip push. Report: _"Skipped push: you don't have push permission on `<vault.gitUrl>`. Request write access from the owner, or capture into a vault you own."_ |
-| `subscriber-default-false`           | (subscriber)                | `false`     | Skip push. Report: _"Skipped push: this is a subscriber vault. Subscriber vaults pull but don't push. Capture into your home vault instead."_                  |
-| `gh-unavailable`                     | (gh-offline)                | `"unknown"` | Skip push. Report: _"Skipped push: gh CLI is unavailable (offline / rate-limited / not authenticated). Re-try when network is available."_                     |
-| `no-remote`                          | (no-remote)                 | `"unknown"` | Skip push. Report: _"Skipped push: vault has no git remote configured. Configure a remote with `gh repo create` or `git remote add origin <url>`."_            |
-| `orphan-vault`                       | (orphan)                    | `"unknown"` | Skip push. Report: _"Skipped push: vault has no mesh role (orphan). Re-attach it with `lyt repair --target <vault> --apply --mesh <mesh>` (the single-orphan-vault verb; `lyt mesh adopt --cluster` is for orphan-MESH clusters, not one vault)."_                                |
-
-**Note on emitted vs semantic names.** The semantic names `home-pushable-true` and `home-not-pushable-false` are documentation aliases for the actual emitted strings `gh-viewerCanPush-true` and `gh-viewerCanPush-false`, kept so future renames of the underlying enum don't silently break the skill prose. The 4 other reason strings (`subscriber-default-false`, `gh-unavailable`, `no-remote`, `orphan-vault`) are identical in both surfaces.
-
-Final handler-facing result shape:
-
-```json
-{
-  "status": "ok",
-  "vault": "<vault-name>",
-  "pulled": true,
-  "committed_message": "<message>" | null,
-  "pushed": true | false,
-  "skipped_push_reason": "<one of the 6 writableDetermination values>" | null,
-  "handler_message": "<reason-specific prose from the table above>"
-}
-```
+## Phase 4 — Surface the result
 
-## Rules
+- `published`, `already-online`: success.
+- `local-only-no-push-target`, `skipped-readonly`, `publish-held`: no online action.
+- `publish-deferred`, `origin-mismatch`, `sync-incomplete`: failure; preserve the non-zero exit status and surface the message.
+- Conflicts: halt and ask the Handler to resolve them; never auto-resolve.
 
-- **MUST NOT auto-resolve a rebase conflict.** Halt with the structured-output shape in Phase 2 and let the handler resolve manually.
-- **MUST gate push on `vault.writable` / `vault.writableDetermination`.** Never `git push` unless `writableDetermination === "gh-viewerCanPush-true"` (equivalently, `writable === true`). The other 5 reasons all skip push.
-- **MUST branch on all 6 reasons.** Each has a distinct handler-facing message; collapsing them into a generic "can't push" message loses semantic signal the handler needs to recover.
-- **MUST NOT add a `Co-Authored-By` trailer** to the auto-commit. Per the project's `CLAUDE.md` commit conventions, unless the user explicitly requests one.
-- **MUST NOT touch any vault other than the resolved target.** This skill's per-vault flow is single-vault. A pod-wide multi-vault sweep is the `lyt sync` verb (no vault argument — see "Pod-wide sync" above) or `mesh clone-all`, not this skill's per-vault path. There is no `lyt sync --mesh` flag.
-- **MUST NOT modify `.lyt/vault.yon`, `.lyt/mesh.yon`, ledger YONs, or `@STAMP` blocks.** Those are runner / writer concerns; sync only commits handler-authored content as-is.
-- **MUST NOT silently degrade `writable === "unknown"` to push.** Surface the reason to the handler.
+Rules: touch only the resolved vault; preserve the structured outcome; never infer success from quiet output; never work around Lyt's refusal to delete, forget, or abandon a mesh main vault. Vaults are editor-neutral by default; Obsidian is an explicit `lyt vault init --template obsidian-default` opt-in.
 
 ## Companion skills