botmux 2.84.0 → 2.85.0

package/dist/core/skills/resource-reader.d.ts

@@ -0,0 +1,9 @@
+import type { SessionSkillManifest } from './types.js';
+export interface SkillResourceReadResult {
+    path: string;
+    content: string;
+}
+export declare function readSkillResource(manifest: SessionSkillManifest, skillName: string, relativePath: string): SkillResourceReadResult;
+export declare function readSkillEntrypoint(manifest: SessionSkillManifest, skillName: string): SkillResourceReadResult;
+export declare function listSkillResources(manifest: SessionSkillManifest, skillName: string): string[];
+//# sourceMappingURL=resource-reader.d.ts.map

package/dist/core/skills/resource-reader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-reader.d.ts","sourceRoot":"","sources":["../../../src/core/skills/resource-reader.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAIvD,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAOD,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,oBAAoB,EAC9B,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,uBAAuB,CAgBzB;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,GAAG,uBAAuB,CAI9G;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAkD9F"}

package/dist/core/skills/resource-reader.js

@@ -0,0 +1,97 @@
+import { lstatSync, readFileSync, readdirSync, realpathSync } from 'node:fs';
+import { join, relative, resolve } from 'node:path';
+const MAX_RESOURCE_BYTES = 256 * 1024;
+function assertRelativePath(path) {
+    if (path.startsWith('/') || path.includes('\0'))
+        throw new Error('invalid_skill_resource_path');
+    if (path.split(/[\\/]/).includes('..'))
+        throw new Error('path_outside_skill_root');
+}
+export function readSkillResource(manifest, skillName, relativePath) {
+    assertRelativePath(relativePath);
+    const skill = manifest.prioritySkills.find((s) => s.name === skillName);
+    if (!skill)
+        throw new Error('skill_not_in_session_manifest');
+    const root = realpathSync(skill.rootDir);
+    let target;
+    try {
+        target = realpathSync(resolve(join(root, relativePath)));
+    }
+    catch {
+        throw new Error('skill_resource_not_found');
+    }
+    if (!(target === root || target.startsWith(root + '/')))
+        throw new Error('path_outside_skill_root');
+    const stat = lstatSync(target);
+    if (!stat.isFile())
+        throw new Error('skill_resource_not_file');
+    if (stat.size > MAX_RESOURCE_BYTES)
+        throw new Error('skill_resource_too_large');
+    return { path: relativePath, content: readFileSync(target, 'utf-8') };
+}
+export function readSkillEntrypoint(manifest, skillName) {
+    const skill = manifest.prioritySkills.find((s) => s.name === skillName);
+    if (!skill)
+        throw new Error('skill_not_in_session_manifest');
+    return readSkillResource(manifest, skillName, skill.entrypoint);
+}
+export function listSkillResources(manifest, skillName) {
+    const skill = manifest.prioritySkills.find((s) => s.name === skillName);
+    if (!skill)
+        throw new Error('skill_not_in_session_manifest');
+    const root = realpathSync(skill.rootDir);
+    const out = [];
+    function withinRoot(path) {
+        return path === root || path.startsWith(root + '/');
+    }
+    function walk(dir, depth) {
+        if (depth > 4 || out.length >= 200)
+            return;
+        let entries;
+        try {
+            entries = readdirSync(dir);
+        }
+        catch {
+            return;
+        }
+        for (const name of entries) {
+            if (out.length >= 200)
+                return;
+            const path = join(dir, name);
+            let stat;
+            try {
+                stat = lstatSync(path);
+            }
+            catch {
+                continue;
+            }
+            if (stat.isSymbolicLink())
+                continue;
+            if (stat.isDirectory()) {
+                let realDir;
+                try {
+                    realDir = realpathSync(path);
+                }
+                catch {
+                    continue;
+                }
+                if (withinRoot(realDir))
+                    walk(path, depth + 1);
+            }
+            else if (stat.isFile()) {
+                let realFile;
+                try {
+                    realFile = realpathSync(path);
+                }
+                catch {
+                    continue;
+                }
+                if (withinRoot(realFile))
+                    out.push(relative(root, path));
+            }
+        }
+    }
+    walk(root, 0);
+    return out.sort();
+}
+//# sourceMappingURL=resource-reader.js.map

package/dist/core/skills/resource-reader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-reader.js","sourceRoot":"","sources":["../../../src/core/skills/resource-reader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpD,MAAM,kBAAkB,GAAG,GAAG,GAAG,IAAI,CAAC;AAOtC,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAChG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;AACrF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,QAA8B,EAC9B,SAAiB,EACjB,YAAoB;IAEpB,kBAAkB,CAAC,YAAY,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IACxE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACpG,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC/D,IAAI,IAAI,CAAC,IAAI,GAAG,kBAAkB;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAChF,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAA8B,EAAE,SAAiB;IACnF,MAAM,KAAK,GAAG,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IACxE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC7D,OAAO,iBAAiB,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,QAA8B,EAAE,SAAiB;IAClF,MAAM,KAAK,GAAG,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IACxE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,GAAG,GAAa,EAAE,CAAC;IAEzB,SAAS,UAAU,CAAC,IAAY;QAC9B,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;IACtD,CAAC;IAED,SAAS,IAAI,CAAC,GAAW,EAAE,KAAa;QACtC,IAAI,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG;YAAE,OAAO;QAC3C,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG;gBAAE,OAAO;YAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC7B,IAAI,IAAI,CAAC;YACT,IAAI,CAAC;gBACH,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,cAAc,EAAE;gBAAE,SAAS;YACpC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBACvB,IAAI,OAAe,CAAC;gBACpB,IAAI,CAAC;oBACH,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;gBAC/B,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,IAAI,UAAU,CAAC,OAAO,CAAC;oBAAE,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YACjD,CAAC;iBAAM,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;gBACzB,IAAI,QAAgB,CAAC;gBACrB,IAAI,CAAC;oBACH,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;gBAChC,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,IAAI,UAAU,CAAC,QAAQ,CAAC;oBAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACd,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC"}

package/dist/core/skills/session-resolver.d.ts

@@ -0,0 +1,14 @@
+import type { CliId } from '../../adapters/cli/types.js';
+import type { BotSkillPolicy, SessionSkillManifest, SkillPackage } from './types.js';
+export declare function resolveSessionSkillManifest(opts: {
+    sessionId: string;
+    cliId: CliId;
+    workingDir: string;
+    botPolicy: BotSkillPolicy | undefined;
+    globalProjectSkills?: 'off' | 'trusted' | 'all';
+    globalDelivery?: 'auto' | 'prompt' | 'native';
+    registrySkills: SkillPackage[];
+    projectSkills: SkillPackage[];
+    now?: () => string;
+}): SessionSkillManifest | null;
+//# sourceMappingURL=session-resolver.d.ts.map

package/dist/core/skills/session-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-resolver.d.ts","sourceRoot":"","sources":["../../../src/core/skills/session-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAGrF,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,KAAK,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,cAAc,GAAG,SAAS,CAAC;IACtC,mBAAmB,CAAC,EAAE,KAAK,GAAG,SAAS,GAAG,KAAK,CAAC;IAChD,cAAc,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAC9C,cAAc,EAAE,YAAY,EAAE,CAAC;IAC/B,aAAa,EAAE,YAAY,EAAE,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,GAAG,oBAAoB,GAAG,IAAI,CAoB9B"}

package/dist/core/skills/session-resolver.js

@@ -0,0 +1,24 @@
+import { resolveSkillPolicy } from './policy.js';
+export function resolveSessionSkillManifest(opts) {
+    const resolved = resolveSkillPolicy({
+        registrySkills: opts.registrySkills,
+        projectSkills: opts.projectSkills,
+        globalProjectSkills: opts.globalProjectSkills,
+        globalDelivery: opts.globalDelivery,
+        botPolicy: opts.botPolicy,
+        workingDir: opts.workingDir,
+    });
+    if (!resolved.enabled)
+        return null;
+    return {
+        sessionId: opts.sessionId,
+        cliId: opts.cliId,
+        workingDir: opts.workingDir,
+        policyMode: resolved.mode,
+        delivery: resolved.delivery,
+        prioritySkills: resolved.prioritySkills,
+        diagnostics: resolved.diagnostics,
+        generatedAt: opts.now ? opts.now() : new Date().toISOString(),
+    };
+}
+//# sourceMappingURL=session-resolver.js.map

package/dist/core/skills/session-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-resolver.js","sourceRoot":"","sources":["../../../src/core/skills/session-resolver.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,UAAU,2BAA2B,CAAC,IAU3C;IACC,MAAM,QAAQ,GAAG,kBAAkB,CAAC;QAClC,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;QAC7C,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,UAAU,EAAE,QAAQ,CAAC,IAAI;QACzB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAC9D,CAAC;AACJ,CAAC"}

package/dist/core/skills/session-runtime.d.ts

@@ -0,0 +1,14 @@
+import type { CliId } from '../../adapters/cli/types.js';
+import type { BotSkillPolicy, SessionSkillManifest } from './types.js';
+export interface PreparedSessionSkillPrompt {
+    prompt: string;
+    manifest: SessionSkillManifest | null;
+}
+export declare function prepareSessionSkillPrompt(opts: {
+    sessionId: string;
+    cliId: CliId;
+    workingDir: string;
+    prompt: string;
+    botPolicy: BotSkillPolicy | undefined;
+}): PreparedSessionSkillPrompt;
+//# sourceMappingURL=session-runtime.d.ts.map

package/dist/core/skills/session-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-runtime.d.ts","sourceRoot":"","sources":["../../../src/core/skills/session-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AAGzD,OAAO,KAAK,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAMvE,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,oBAAoB,GAAG,IAAI,CAAC;CACvC;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,KAAK,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,cAAc,GAAG,SAAS,CAAC;CACvC,GAAG,0BAA0B,CAsB7B"}

package/dist/core/skills/session-runtime.js

@@ -0,0 +1,32 @@
+import { readGlobalConfig } from '../../global-config.js';
+import { readSkillRegistry } from '../../services/skill-registry-store.js';
+import { discoverProjectSkills } from './discovery.js';
+import { writeSessionSkillManifest } from './manifest-store.js';
+import { renderSkillCatalogBlock } from './prompt.js';
+import { resolveSessionSkillManifest } from './session-resolver.js';
+export function prepareSessionSkillPrompt(opts) {
+    if (!opts.botPolicy || opts.prompt.trim().length === 0) {
+        return { prompt: opts.prompt, manifest: null };
+    }
+    const globalSkills = readGlobalConfig().skills;
+    const manifest = resolveSessionSkillManifest({
+        sessionId: opts.sessionId,
+        cliId: opts.cliId,
+        workingDir: opts.workingDir,
+        botPolicy: opts.botPolicy,
+        globalProjectSkills: globalSkills?.trustProjectSkills,
+        globalDelivery: globalSkills?.delivery,
+        registrySkills: Object.values(readSkillRegistry().skills),
+        projectSkills: discoverProjectSkills(opts.workingDir),
+    });
+    if (!manifest || manifest.prioritySkills.length === 0)
+        return { prompt: opts.prompt, manifest };
+    writeSessionSkillManifest(manifest);
+    if (opts.prompt.includes('<botmux_skills'))
+        return { prompt: opts.prompt, manifest };
+    return {
+        prompt: `${opts.prompt}\n\n${renderSkillCatalogBlock(manifest)}`,
+        manifest,
+    };
+}
+//# sourceMappingURL=session-runtime.js.map

package/dist/core/skills/session-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-runtime.js","sourceRoot":"","sources":["../../../src/core/skills/session-runtime.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAE3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAOpE,MAAM,UAAU,yBAAyB,CAAC,IAMzC;IACC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvD,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;IACD,MAAM,YAAY,GAAG,gBAAgB,EAAE,CAAC,MAAM,CAAC;IAC/C,MAAM,QAAQ,GAAG,2BAA2B,CAAC;QAC3C,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,mBAAmB,EAAE,YAAY,EAAE,kBAAkB;QACrD,cAAc,EAAE,YAAY,EAAE,QAAQ;QACtC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,MAAM,CAAC;QACzD,aAAa,EAAE,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC;KACtD,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;IAChG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;IACrF,OAAO;QACL,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,OAAO,uBAAuB,CAAC,QAAQ,CAAC,EAAE;QAChE,QAAQ;KACT,CAAC;AACJ,CAAC"}

package/dist/core/skills/sources.d.ts

@@ -0,0 +1,21 @@
+export interface ParsedSkillInstallSource {
+    kind: 'local' | 'git' | 'github';
+    value: string;
+    github?: {
+        owner: string;
+        repo: string;
+        path?: string;
+        ref?: string;
+    };
+}
+export declare function redactGitUrlCredentials(raw: string): string;
+export declare function assertNoGitUrlCredentials(raw: string): void;
+export declare function assertAllowedGitProtocol(raw: string): void;
+/** Refuse refs that could be mistaken for a `git checkout` option (leading `-`)
+ *  or carry control characters. Real branch/tag/commit refs never start with a
+ *  dash, so this is safe to reject outright. */
+export declare function assertSafeGitRef(ref: string | undefined): void;
+export declare function assertSafeGitSkillPath(path: string): void;
+export declare function parseSkillInstallSource(raw: string): ParsedSkillInstallSource;
+export declare function githubToGitUrl(owner: string, repo: string): string;
+//# sourceMappingURL=sources.d.ts.map

package/dist/core/skills/sources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sources.d.ts","sourceRoot":"","sources":["../../../src/core/skills/sources.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,OAAO,GAAG,KAAK,GAAG,QAAQ,CAAC;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACvE;AAUD,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAQ3D;AAED,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAM3D;AAeD,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAU1D;AAED;;gDAEgD;AAChD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAG9D;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAIzD;AAmDD,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,wBAAwB,CAsB7E;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAElE"}

package/dist/core/skills/sources.js

@@ -0,0 +1,155 @@
+import { isAbsolute } from 'node:path';
+function parseMaybeUrl(raw) {
+    try {
+        return new URL(raw.replace(/^git\+/, ''));
+    }
+    catch {
+        return null;
+    }
+}
+export function redactGitUrlCredentials(raw) {
+    const url = parseMaybeUrl(raw);
+    if (!url)
+        return raw;
+    if (!url.username && !url.password)
+        return raw;
+    url.username = url.username ? '***' : '';
+    url.password = url.password ? '***' : '';
+    const redacted = url.toString();
+    return raw.startsWith('git+') ? `git+${redacted}` : redacted;
+}
+export function assertNoGitUrlCredentials(raw) {
+    const url = parseMaybeUrl(raw);
+    if (!url)
+        return;
+    if ((url.protocol === 'http:' || url.protocol === 'https:') && (url.username || url.password)) {
+        throw new Error('git_url_credentials_not_allowed');
+    }
+}
+/** Refuse git transports that execute commands. git's `ext::` (and other
+ *  remote-helper) transports run an arbitrary shell command on clone, turning
+ *  "install a skill" into RCE on the daemon host. Only the standard fetch
+ *  transports are allowed; `file:`/bare local paths are permitted because they
+ *  are equivalent to the already-supported local-directory install. `git` is
+ *  also invoked with a matching `GIT_ALLOW_PROTOCOL` allowlist as
+ *  defense-in-depth. scp-like `user@host:path` carries no URL scheme and is SSH. */
+const ALLOWED_GIT_PROTOCOLS = new Set(['https:', 'http:', 'ssh:', 'git:', 'file:']);
+function isScpLikeGitUrl(raw) {
+    return !raw.includes('://') && /^[A-Za-z0-9._-]+@[^/]+:/.test(raw);
+}
+export function assertAllowedGitProtocol(raw) {
+    if (isScpLikeGitUrl(raw))
+        return; // scp short form → SSH
+    const url = parseMaybeUrl(raw);
+    // No parseable scheme → git treats it as a local path (same trust as a local
+    // directory install). A parseable scheme must be on the allowlist; `ext:` and
+    // friends fall through to the throw.
+    if (!url)
+        return;
+    if (!ALLOWED_GIT_PROTOCOLS.has(url.protocol)) {
+        throw new Error('git_url_protocol_not_allowed');
+    }
+}
+/** Refuse refs that could be mistaken for a `git checkout` option (leading `-`)
+ *  or carry control characters. Real branch/tag/commit refs never start with a
+ *  dash, so this is safe to reject outright. */
+export function assertSafeGitRef(ref) {
+    if (ref === undefined)
+        return;
+    if (!ref || ref.startsWith('-') || /[\0\s]/.test(ref))
+        throw new Error('invalid_git_ref');
+}
+export function assertSafeGitSkillPath(path) {
+    if (!path || path.includes('\0'))
+        throw new Error('invalid_git_skill_path');
+    if (isAbsolute(path) || /^[A-Za-z]:[\\/]/.test(path))
+        throw new Error('invalid_git_skill_path');
+    if (path.split(/[\\/]+/).filter(Boolean).includes('..'))
+        throw new Error('invalid_git_skill_path');
+}
+function decodeUrlPart(part) {
+    try {
+        return decodeURIComponent(part);
+    }
+    catch {
+        throw new Error('invalid_github_skill_source');
+    }
+}
+function hasRawPathTraversal(raw) {
+    return /(?:^|[\\/])(?:\.\.|%2e%2e)(?=$|[\\/#?])/i.test(raw);
+}
+function parseGitHubBrowserUrl(raw) {
+    const url = parseMaybeUrl(raw);
+    if (!url)
+        return null;
+    if (url.protocol !== 'https:' && url.protocol !== 'http:')
+        return null;
+    if (url.hostname !== 'github.com' && url.hostname !== 'www.github.com')
+        return null;
+    if (hasRawPathTraversal(raw))
+        throw new Error('invalid_git_skill_path');
+    const parts = url.pathname.split('/').filter(Boolean).map(decodeUrlPart);
+    if (parts.length < 2)
+        throw new Error('invalid_github_skill_source');
+    const [owner, repoWithSuffix] = parts;
+    const repo = repoWithSuffix.endsWith('.git') ? repoWithSuffix.slice(0, -'.git'.length) : repoWithSuffix;
+    if (!owner || !repo)
+        throw new Error('invalid_github_skill_source');
+    let ref;
+    let path;
+    if (parts[2] === 'tree' || parts[2] === 'blob') {
+        const rest = parts.slice(3);
+        if (rest.length === 0)
+            throw new Error('invalid_github_skill_source');
+        const skillsIndex = rest.indexOf('skills');
+        if (skillsIndex > 0) {
+            ref = rest.slice(0, skillsIndex).join('/');
+            path = rest.slice(skillsIndex).join('/');
+        }
+        else {
+            ref = rest[0];
+            path = rest.slice(1).join('/') || undefined;
+        }
+        const pathParts = path?.split('/');
+        if (parts[2] === 'blob' && pathParts?.[pathParts.length - 1]?.toLowerCase() === 'skill.md') {
+            path = pathParts.slice(0, -1).join('/') || undefined;
+        }
+    }
+    if (path)
+        assertSafeGitSkillPath(path);
+    return {
+        kind: 'github',
+        value: raw,
+        github: { owner, repo, ...(path ? { path } : {}), ...(ref ? { ref } : {}) },
+    };
+}
+export function parseSkillInstallSource(raw) {
+    if (raw.startsWith('github:')) {
+        const rest = raw.slice('github:'.length);
+        const parts = rest.split('/').filter(Boolean);
+        if (parts.length < 2)
+            throw new Error('invalid_github_skill_source');
+        const path = parts.slice(2).join('/') || undefined;
+        if (path)
+            assertSafeGitSkillPath(path);
+        return {
+            kind: 'github',
+            value: raw,
+            github: { owner: parts[0], repo: parts[1], path },
+        };
+    }
+    assertNoGitUrlCredentials(raw);
+    const githubSource = parseGitHubBrowserUrl(raw);
+    if (githubSource)
+        return githubSource;
+    if (raw.startsWith('git+') || raw.endsWith('.git') || raw.startsWith('git@')) {
+        const value = raw.replace(/^git\+/, '');
+        assertAllowedGitProtocol(value);
+        return { kind: 'git', value };
+    }
+    return { kind: 'local', value: raw };
+}
+export function githubToGitUrl(owner, repo) {
+    return `https://github.com/${owner}/${repo}.git`;
+}
+//# sourceMappingURL=sources.js.map

package/dist/core/skills/sources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sources.js","sourceRoot":"","sources":["../../../src/core/skills/sources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAQvC,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,GAAW;IACjD,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,CAAC;IACrB,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ;QAAE,OAAO,GAAG,CAAC;IAC/C,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACzC,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAChC,OAAO,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,GAAW;IACnD,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG;QAAE,OAAO;IACjB,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9F,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED;;;;;;oFAMoF;AACpF,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpF,SAAS,eAAe,CAAC,GAAW;IAClC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,yBAAyB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,GAAW;IAClD,IAAI,eAAe,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,uBAAuB;IACzD,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAC/B,6EAA6E;IAC7E,8EAA8E;IAC9E,qCAAqC;IACrC,IAAI,CAAC,GAAG;QAAE,OAAO;IACjB,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED;;gDAEgD;AAChD,MAAM,UAAU,gBAAgB,CAAC,GAAuB;IACtD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO;IAC9B,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;AAC5F,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5E,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAChG,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;AACrG,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAW;IACtC,OAAO,0CAA0C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW;IACxC,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACvE,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,GAAG,CAAC,QAAQ,KAAK,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACpF,IAAI,mBAAmB,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACxE,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACzE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACrE,MAAM,CAAC,KAAK,EAAE,cAAc,CAAC,GAAG,KAAK,CAAC;IACtC,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;IACxG,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACpE,IAAI,GAAuB,CAAC;IAC5B,IAAI,IAAwB,CAAC;IAC7B,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACtE,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;YACpB,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC3C,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACd,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC;QAC9C,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,SAAS,EAAE,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,UAAU,EAAE,CAAC;YAC3F,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC;QACvD,CAAC;IACH,CAAC;IACD,IAAI,IAAI;QAAE,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACvC,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,GAAG;QACV,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;KAC5E,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,GAAW;IACjD,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACrE,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC;QACnD,IAAI,IAAI;YAAE,sBAAsB,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,GAAG;YACV,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;SAClD,CAAC;IACJ,CAAC;IACD,yBAAyB,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,YAAY,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IACtC,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7E,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACxC,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAChC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,IAAY;IACxD,OAAO,sBAAsB,KAAK,IAAI,IAAI,MAAM,CAAC;AACnD,CAAC"}

package/dist/core/skills/types.d.ts

@@ -0,0 +1,71 @@
+import type { CliId } from '../../adapters/cli/types.js';
+export type SkillSource = {
+    type: 'bundled';
+    packageName: string;
+} | {
+    type: 'user';
+    root: string;
+} | {
+    type: 'project';
+    root: string;
+} | {
+    type: 'admin';
+    root: string;
+} | {
+    type: 'local-copy';
+    originalPath: string;
+} | {
+    type: 'local-link';
+    path: string;
+} | {
+    type: 'git';
+    url: string;
+    path: string;
+    ref?: string;
+    commit?: string;
+} | {
+    type: 'github';
+    owner: string;
+    repo: string;
+    path: string;
+    ref?: string;
+    commit?: string;
+};
+export interface SkillPackage {
+    id: string;
+    name: string;
+    displayName?: string;
+    description?: string;
+    version?: string;
+    tags: string[];
+    rootDir: string;
+    entrypoint: string;
+    source: SkillSource;
+    checksum?: string;
+    installedAt?: string;
+    updatedAt?: string;
+}
+export type SkillSelector = `skill:${string}`;
+export interface BotSkillPolicy {
+    include?: SkillSelector[];
+}
+export interface ResolvedSkill extends SkillPackage {
+    priorityReason: string;
+}
+export interface SkillDiagnostic {
+    level: 'info' | 'warn' | 'error';
+    code: string;
+    message: string;
+    skillName?: string;
+}
+export interface SessionSkillManifest {
+    sessionId: string;
+    cliId: CliId;
+    workingDir: string;
+    policyMode: 'priority';
+    delivery?: 'auto' | 'prompt' | 'native';
+    prioritySkills: ResolvedSkill[];
+    diagnostics: SkillDiagnostic[];
+    generatedAt: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/skills/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/skills/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AAEzD,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACzE;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjG,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,aAAa,GAAG,SAAS,MAAM,EAAE,CAAC;AAE9C,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,aAAc,SAAQ,YAAY;IACjD,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,KAAK,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,UAAU,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACxC,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC,WAAW,EAAE,eAAe,EAAE,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;CACrB"}

package/dist/core/skills/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/core/skills/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/core/skills/types.ts"],"names":[],"mappings":""}

package/dist/core/startup-commands.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Startup commands — per-bot slash commands the worker types into a freshly
+ * spawned CLI right after it's ready, BEFORE the user's first prompt (e.g.
+ * `/effort ultracode`, `/model opus`). Extracted into a leaf module so both
+ * bots.json parsing ({@link ../bot-registry.js}) and the `/botconfig` config
+ * store ({@link ../services/bot-config-store.js}) share one normalization
+ * without a circular import.
+ *
+ * Unlike {@link ./passthrough-commands.js}'s customPassthroughCommands — which
+ * are single-token slash commands routed through the daemon — a startup command
+ * is a whole input LINE typed verbatim into the CLI's TUI, so it MAY carry
+ * space-delimited arguments (`/effort ultracode`). That's why the free-text
+ * parser splits on comma/newline only (never whitespace) and the per-entry
+ * normalizer keeps internal spaces intact.
+ */
+/**
+ * Normalize a single startup command: collapse embedded newlines (each command
+ * must submit as one line), trim, and ensure a leading `/` (so users can type
+ * `effort ultracode` or `/effort ultracode`). Returns null for empty / too-long
+ * input. Internal spaces (arguments) are preserved.
+ */
+export declare function normalizeStartupCommand(cmd: unknown): string | null;
+/**
+ * Parse free-text dashboard / `/botconfig` input into a normalized, order-
+ * preserving, deduped startup-command list. Commands are separated by comma OR
+ * newline (NOT whitespace, since a command's arguments are space-delimited).
+ * Mirrors the normalization {@link ../bot-registry.js}'s parseBotConfigsFromText
+ * applies when loading bots.json, so a round-trip through the card is stable.
+ */
+export declare function parseStartupCommandsInput(raw: string): string[];
+/** Normalize an array (bots.json form) of startup commands. */
+export declare function normalizeStartupCommandList(arr: unknown): string[];
+/**
+ * Whether a spawn should (re-)run startupCommands. They run on a genuinely fresh
+ * CLI process; a reattach to a LIVE persistent (tmux/zellij/herdr) pane — e.g. a
+ * daemon restart recovering an existing session — is the SAME CLI with its
+ * effort/model/context already established, so re-typing `/effort` (idempotent)
+ * or `/clear`,`/compact` (NOT idempotent) would corrupt it. Skip on reattach.
+ */
+export declare function shouldRunStartupCommandsOnSpawn(opts: {
+    willReattachPersistent: boolean;
+}): boolean;
+/**
+ * Whether to defer the initial prompt from launch-args to the normal input queue
+ * so startupCommands precede it. Only when commands exist AND the CLI bakes the
+ * first prompt into launch args (passesInitialPromptViaArgs, e.g. Gemini `-i`):
+ * an args-baked prompt would execute BEFORE flushPending's startup-command hook,
+ * breaking the "before the first message" contract. Adopt never spawns fresh.
+ * Default path (no startupCommands) is untouched, so args-CLIs keep their robust
+ * `-i` delivery unless a bot opts in.
+ */
+export declare function shouldDeferInitialPromptForStartup(opts: {
+    hasStartupCommands: boolean;
+    adoptMode: boolean;
+    passesInitialPromptViaArgs: boolean;
+}): boolean;
+//# sourceMappingURL=startup-commands.d.ts.map

package/dist/core/startup-commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"startup-commands.d.ts","sourceRoot":"","sources":["../../src/core/startup-commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAOnE;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAO/D;AAED,+DAA+D;AAC/D,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,EAAE,CAQlE;AAED;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAAC,IAAI,EAAE;IAAE,sBAAsB,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAElG;AAED;;;;;;;;GAQG;AACH,wBAAgB,kCAAkC,CAAC,IAAI,EAAE;IACvD,kBAAkB,EAAE,OAAO,CAAC;IAC5B,SAAS,EAAE,OAAO,CAAC;IACnB,0BAA0B,EAAE,OAAO,CAAC;CACrC,GAAG,OAAO,CAEV"}