commandmate 0.11.4 → 0.12.1

package/dist/server/src/lib/skills/uninstall-plan.js

@@ -0,0 +1,479 @@
+"use strict";
+/**
+ * Uninstall Plan: proving a Skill directory is safe to remove (Issue #1236)
+ *
+ * The inverse of #1233's install plan, and deliberately not its mirror image.
+ * An install may write into an empty destination; an uninstall must delete, and
+ * deletion is the one operation a user cannot undo from CommandMate. So this
+ * module answers a narrower question: *is every single file under the install
+ * root provably one that CommandMate wrote and that nobody has touched since?*
+ *
+ * Anything else — a locally edited file, a file the receipt never recorded, a
+ * recorded file that has gone missing, a symlink, an unreadable receipt, a scan
+ * that hit its bound — makes the plan non-removable. There is no partial
+ * uninstall: "delete the seven files we are sure about and leave the eighth"
+ * would silently destroy a Skill the user had customised while telling them the
+ * operation succeeded.
+ *
+ * The token contract is #1233's, reused rather than re-derived: the same TTL,
+ * the same single-use semantics, the same LRU bound, and the same
+ * {@link SkillPlanError} codes, so a drifting or replayed uninstall token is
+ * answered exactly like a drifting or replayed install token.
+ *
+ * Apply is {@link module:lib/skills/uninstall-apply}. This module never deletes.
+ *
+ * @module lib/skills/uninstall-plan
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SKILL_UNINSTALL_PLAN_TOKEN_PATTERN = exports.SKILL_UNINSTALL_RELOAD_MESSAGE_KEYS = exports.SKILL_UNINSTALL_NEXT_ACTION_KEYS = exports.SKILL_UNINSTALL_REASON_MESSAGE_KEYS = exports.SkillUninstallReason = void 0;
+exports.assessSkillUninstall = assessSkillUninstall;
+exports.computeSkillUninstallBindingHash = computeSkillUninstallBindingHash;
+exports.sweepSkillUninstallPlans = sweepSkillUninstallPlans;
+exports.getSkillUninstallPlan = getSkillUninstallPlan;
+exports.consumeSkillUninstallPlan = consumeSkillUninstallPlan;
+exports.discardSkillUninstallPlan = discardSkillUninstallPlan;
+exports.resetSkillUninstallPlanCacheForTesting = resetSkillUninstallPlanCacheForTesting;
+exports.getSkillUninstallPlanCount = getSkillUninstallPlanCount;
+exports.createSkillUninstallPlan = createSkillUninstallPlan;
+exports.readSkillReceiptDigest = readSkillReceiptDigest;
+const crypto_1 = require("crypto");
+const constants_1 = require("../../lib/skills/constants");
+const integrity_1 = require("../../lib/skills/integrity");
+const install_plan_1 = require("../../lib/skills/install-plan");
+const constants_2 = require("../../lib/skills/constants");
+const preview_diff_1 = require("../../lib/skills/preview-diff");
+/** Stable machine reasons, one per disposition plus the plan-level failures. */
+exports.SkillUninstallReason = {
+    /** Recorded, unchanged, and therefore deletable. */
+    MANAGED_UNCHANGED: 'SKILL_UNINSTALL_MANAGED_UNCHANGED',
+    /** Recorded but locally edited. Deleting it would destroy the user's work. */
+    LOCAL_MODIFICATION: 'SKILL_UNINSTALL_LOCAL_MODIFICATION',
+    /** Recorded but absent, so the install is no longer the one the receipt describes. */
+    RECEIPT_ORPHAN: 'SKILL_UNINSTALL_RECEIPT_ORPHAN',
+    /** Present but unrecorded: a user file, or another tool's output. */
+    UNMANAGED_FILE: 'SKILL_UNINSTALL_UNMANAGED_FILE',
+    /** Present as a symlink, a directory entry or another non-regular entry. */
+    NOT_A_REGULAR_FILE: 'SKILL_UNINSTALL_NOT_A_REGULAR_FILE',
+    /** No install root exists at all. */
+    NOT_INSTALLED: 'SKILL_UNINSTALL_NOT_INSTALLED',
+    /** The install root exists but carries no CommandMate receipt. */
+    RECEIPT_MISSING: 'SKILL_UNINSTALL_RECEIPT_MISSING',
+    /** A receipt file exists but cannot be parsed. */
+    RECEIPT_UNREADABLE: 'SKILL_UNINSTALL_RECEIPT_UNREADABLE',
+    /** The receipt describes a different Skill than the one being uninstalled. */
+    RECEIPT_FOREIGN: 'SKILL_UNINSTALL_RECEIPT_FOREIGN',
+    /** The directory walk hit a bound, so absence of unknown files is unproven. */
+    TREE_SCAN_TRUNCATED: 'SKILL_UNINSTALL_TREE_SCAN_TRUNCATED',
+};
+/** i18n key explaining why one path cannot be removed (UX-07). */
+exports.SKILL_UNINSTALL_REASON_MESSAGE_KEYS = {
+    [exports.SkillUninstallReason.MANAGED_UNCHANGED]: 'skills.uninstall.reason.managedUnchanged',
+    [exports.SkillUninstallReason.LOCAL_MODIFICATION]: 'skills.uninstall.reason.localModification',
+    [exports.SkillUninstallReason.RECEIPT_ORPHAN]: 'skills.uninstall.reason.receiptOrphan',
+    [exports.SkillUninstallReason.UNMANAGED_FILE]: 'skills.uninstall.reason.unmanagedFile',
+    [exports.SkillUninstallReason.NOT_A_REGULAR_FILE]: 'skills.uninstall.reason.notARegularFile',
+    [exports.SkillUninstallReason.NOT_INSTALLED]: 'skills.uninstall.reason.notInstalled',
+    [exports.SkillUninstallReason.RECEIPT_MISSING]: 'skills.uninstall.reason.receiptMissing',
+    [exports.SkillUninstallReason.RECEIPT_UNREADABLE]: 'skills.uninstall.reason.receiptUnreadable',
+    [exports.SkillUninstallReason.RECEIPT_FOREIGN]: 'skills.uninstall.reason.receiptForeign',
+    [exports.SkillUninstallReason.TREE_SCAN_TRUNCATED]: 'skills.uninstall.reason.treeScanTruncated',
+};
+/** i18n key for what the user should do next, per outcome (UX-07). */
+exports.SKILL_UNINSTALL_NEXT_ACTION_KEYS = {
+    /** Every file checked out; the plan can be applied. */
+    removable: 'skills.uninstall.nextAction.removable',
+    /** Something is ambiguous, so nothing will be deleted until the user resolves it. */
+    blocked: 'skills.uninstall.nextAction.blocked',
+    succeeded: 'skills.uninstall.nextAction.succeeded',
+    committedReconciling: 'skills.uninstall.nextAction.committedReconciling',
+    failed: 'skills.uninstall.nextAction.failed',
+};
+/** i18n key per agent support level, so UI and CLI say the same thing (UX-01). */
+exports.SKILL_UNINSTALL_RELOAD_MESSAGE_KEYS = {
+    native: 'skills.uninstall.reload.native',
+    commandmate_runtime: 'skills.uninstall.reload.commandmateRuntime',
+    unsupported: 'skills.uninstall.reload.unsupported',
+    unknown: 'skills.uninstall.reload.unknown',
+};
+function blocker(code, path) {
+    return { code, path, messageKey: exports.SKILL_UNINSTALL_REASON_MESSAGE_KEYS[code] };
+}
+const DISPOSITION_REASON = {
+    remove: exports.SkillUninstallReason.MANAGED_UNCHANGED,
+    modified: exports.SkillUninstallReason.LOCAL_MODIFICATION,
+    missing: exports.SkillUninstallReason.RECEIPT_ORPHAN,
+    unknown: exports.SkillUninstallReason.UNMANAGED_FILE,
+};
+/** Stat bucket each disposition counts towards. */
+const DISPOSITION_STAT = {
+    remove: 'removable',
+    modified: 'modified',
+    missing: 'missing',
+    unknown: 'unknown',
+};
+/**
+ * Decide what uninstall would do to every path under the install root.
+ *
+ * The receipt is the ownership record, and it is read from the directory it
+ * describes rather than from the database: the index can be rebuilt from the
+ * receipt but never the other way round, and a delete that trusted the index
+ * would act on a claim instead of on evidence.
+ *
+ * The receipt does not list itself, so it is folded in here under its own
+ * on-disk digest. Without that it would read as an unmanaged file and every
+ * uninstall would block on the very file that authorises it.
+ */
+function assessSkillUninstall(installRootAbs, skillId, options = {}) {
+    const installRoot = (0, preview_diff_1.skillInstallRootFor)(options.rootPrefix ?? constants_2.SKILL_INSTALL_ROOT_PREFIX, skillId);
+    const existing = options.existing ?? (0, preview_diff_1.readExistingSkillTree)(installRootAbs);
+    const currentTreeHash = (0, preview_diff_1.computeSkillTreeHash)(existing.files);
+    const empty = {
+        installRoot,
+        present: existing.present,
+        receipt: null,
+        receiptDigest: null,
+        entries: [],
+        blockers: [],
+        removable: false,
+        currentTreeHash,
+        stats: { removable: 0, modified: 0, missing: 0, unknown: 0, irregular: 0 },
+    };
+    if (!existing.present) {
+        return { ...empty, blockers: [blocker(exports.SkillUninstallReason.NOT_INSTALLED, installRoot)] };
+    }
+    const blockers = [];
+    if (existing.truncated) {
+        blockers.push(blocker(exports.SkillUninstallReason.TREE_SCAN_TRUNCATED, installRoot));
+    }
+    const receiptFile = existing.files.find((file) => file.path === install_plan_1.SKILL_RECEIPT_FILENAME);
+    const receipt = receiptFile ? (0, install_plan_1.parseInstalledReceipt)(receiptFile.bytes) : null;
+    if (!receiptFile) {
+        blockers.push(blocker(exports.SkillUninstallReason.RECEIPT_MISSING, `${installRoot}/${install_plan_1.SKILL_RECEIPT_FILENAME}`));
+    }
+    else if (receipt === null) {
+        blockers.push(blocker(exports.SkillUninstallReason.RECEIPT_UNREADABLE, `${installRoot}/${install_plan_1.SKILL_RECEIPT_FILENAME}`));
+    }
+    else if (receipt.skill_id !== skillId) {
+        blockers.push(blocker(exports.SkillUninstallReason.RECEIPT_FOREIGN, `${installRoot}/${install_plan_1.SKILL_RECEIPT_FILENAME}`));
+    }
+    // A receipt that cannot be trusted makes ownership unknowable for every path,
+    // so nothing below could promote a file to `remove` anyway.
+    const trustedReceipt = receiptFile && receipt !== null && receipt.skill_id === skillId ? receipt : null;
+    const recorded = new Map();
+    if (trustedReceipt && receiptFile) {
+        for (const file of trustedReceipt.files) {
+            recorded.set(file.path, {
+                sha256: file.sha256,
+                executable: file.executable,
+                size: file.size,
+            });
+        }
+        recorded.set(install_plan_1.SKILL_RECEIPT_FILENAME, {
+            sha256: receiptFile.sha256,
+            executable: false,
+            size: receiptFile.size,
+        });
+    }
+    const existingByPath = new Map(existing.files.map((file) => [file.path, file]));
+    const entries = [];
+    const stats = {
+        removable: 0,
+        modified: 0,
+        missing: 0,
+        unknown: 0,
+        irregular: 0,
+    };
+    for (const relative of [...new Set([...recorded.keys(), ...existingByPath.keys()])].sort()) {
+        const owned = recorded.get(relative) ?? null;
+        const onDisk = existingByPath.get(relative) ?? null;
+        let disposition;
+        if (owned === null)
+            disposition = 'unknown';
+        else if (onDisk === null)
+            disposition = 'missing';
+        else if ((0, integrity_1.digestMatches)(onDisk.sha256, owned.sha256) &&
+            onDisk.executable === owned.executable) {
+            disposition = 'remove';
+        }
+        else
+            disposition = 'modified';
+        const reason = DISPOSITION_REASON[disposition];
+        entries.push({
+            path: `${installRoot}/${relative}`,
+            relativePath: relative,
+            disposition,
+            reason,
+            generated: relative === install_plan_1.SKILL_RECEIPT_FILENAME,
+            recordedSha256: owned?.sha256 ?? null,
+            currentSha256: onDisk?.sha256 ?? null,
+            size: onDisk?.size ?? owned?.size ?? null,
+            executable: onDisk?.executable ?? owned?.executable ?? false,
+        });
+        stats[DISPOSITION_STAT[disposition]] += 1;
+        if (disposition !== 'remove') {
+            blockers.push(blocker(reason, `${installRoot}/${relative}`));
+        }
+    }
+    for (const irregular of existing.irregularPaths) {
+        const repoPath = irregular ? `${installRoot}/${irregular}` : installRoot;
+        entries.push({
+            path: repoPath,
+            relativePath: irregular,
+            disposition: 'irregular',
+            reason: exports.SkillUninstallReason.NOT_A_REGULAR_FILE,
+            generated: false,
+            recordedSha256: recorded.get(irregular)?.sha256 ?? null,
+            currentSha256: null,
+            size: null,
+            executable: false,
+        });
+        stats.irregular += 1;
+        blockers.push(blocker(exports.SkillUninstallReason.NOT_A_REGULAR_FILE, repoPath));
+    }
+    return {
+        installRoot,
+        present: true,
+        receipt: trustedReceipt,
+        receiptDigest: receiptFile?.sha256 ?? null,
+        entries: entries.sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0)),
+        blockers,
+        removable: trustedReceipt !== null && blockers.length === 0,
+        currentTreeHash,
+        stats,
+    };
+}
+function canonicalJson(value) {
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value) ?? 'null';
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(',')}]`;
+    const entries = Object.entries(value)
+        .filter(([, v]) => v !== undefined)
+        .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+    return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`).join(',')}}`;
+}
+/** Digest of a binding, used to compare two of them without leaking either. */
+function computeSkillUninstallBindingHash(binding) {
+    return (0, crypto_1.createHash)('sha256').update(canonicalJson(binding)).digest('hex');
+}
+const cache = globalThis.__skillUninstallPlans ??
+    (globalThis.__skillUninstallPlans = { records: new Map() });
+/** Token grammar. Anything else is rejected before the store is consulted. */
+exports.SKILL_UNINSTALL_PLAN_TOKEN_PATTERN = /^[0-9a-f]{48}$/;
+const SKILL_UNINSTALL_PLAN_TOKEN_BYTES = 24;
+/**
+ * Drop every expired plan.
+ *
+ * @param keep Token to leave in place so its own lookup can still answer
+ *   `EXPIRED` rather than the ambiguous `NOT_FOUND`
+ * @returns Number of plans dropped
+ */
+function sweepExpired(now, keep) {
+    let dropped = 0;
+    for (const record of [...cache.records.values()]) {
+        if (record.token !== keep && now >= record.expiresAt) {
+            cache.records.delete(record.token);
+            dropped += 1;
+        }
+    }
+    return dropped;
+}
+function sweep(now) {
+    sweepExpired(now);
+    while (cache.records.size >= install_plan_1.SKILL_PLAN_MAX_ENTRIES) {
+        const oldest = [...cache.records.values()].sort((a, b) => a.createdAt - b.createdAt)[0];
+        if (!oldest)
+            break;
+        cache.records.delete(oldest.token);
+    }
+}
+/**
+ * Reclaim expired plans without creating one.
+ *
+ * The install cache's counterpart ({@link module:lib/skills/install-plan}).
+ * An uninstall plan pins no snapshot, but it does hold the assessed tree, and
+ * the two caches must not diverge in when they let go of it.
+ *
+ * @returns Number of plans dropped
+ */
+function sweepSkillUninstallPlans(options = {}) {
+    return sweepExpired(options.now ?? Date.now());
+}
+function requireRecord(token, now) {
+    if (!exports.SKILL_UNINSTALL_PLAN_TOKEN_PATTERN.test(token)) {
+        throw new install_plan_1.SkillPlanError(install_plan_1.SkillPlanErrorCode.NOT_FOUND);
+    }
+    const record = cache.records.get(token);
+    // Every token access reclaims the siblings that expired meanwhile, so a plan
+    // nobody applies is not held until the next plan is created.
+    sweepExpired(now, token);
+    if (!record)
+        throw new install_plan_1.SkillPlanError(install_plan_1.SkillPlanErrorCode.NOT_FOUND);
+    const presented = Buffer.from(token, 'utf-8');
+    const stored = Buffer.from(record.token, 'utf-8');
+    if (presented.length !== stored.length || !(0, crypto_1.timingSafeEqual)(presented, stored)) {
+        throw new install_plan_1.SkillPlanError(install_plan_1.SkillPlanErrorCode.NOT_FOUND);
+    }
+    if (now >= record.expiresAt) {
+        cache.records.delete(record.token);
+        throw new install_plan_1.SkillPlanError(install_plan_1.SkillPlanErrorCode.EXPIRED);
+    }
+    if (record.consumedAt !== null)
+        throw new install_plan_1.SkillPlanError(install_plan_1.SkillPlanErrorCode.CONSUMED);
+    return record;
+}
+/** Read a stored plan. Does not spend the token. */
+function getSkillUninstallPlan(token, options = {}) {
+    return requireRecord(token, options.now ?? Date.now());
+}
+/**
+ * Spend a token.
+ *
+ * Binding equality is checked before staleness, so a token presented for the
+ * wrong target is never told anything about the right one. The receipt digest
+ * is part of the observation as well as of the binding: branch and tree hash
+ * would already catch a content change, but the digest is what proves this is
+ * still *the same install* rather than a reinstall that happens to be identical.
+ */
+function consumeSkillUninstallPlan(token, expected, observed, options = {}) {
+    const now = options.now ?? Date.now();
+    const record = requireRecord(token, now);
+    const { binding } = record;
+    const sameActor = binding.actor.type === expected.actor.type && binding.actor.id === expected.actor.id;
+    if (!sameActor ||
+        binding.worktreeId !== expected.worktreeId ||
+        binding.skillId !== expected.skillId) {
+        throw new install_plan_1.SkillPlanError(install_plan_1.SkillPlanErrorCode.BINDING_MISMATCH);
+    }
+    if (!record.dto.removable)
+        throw new install_plan_1.SkillPlanError(install_plan_1.SkillPlanErrorCode.NOT_INSTALLABLE);
+    if (observed.branch !== binding.branch ||
+        observed.headCommit !== binding.headCommit ||
+        observed.currentTreeHash !== binding.currentTreeHash ||
+        observed.receiptDigest === null ||
+        !(0, integrity_1.digestMatches)(observed.receiptDigest, binding.receiptDigest)) {
+        throw new install_plan_1.SkillPlanError(install_plan_1.SkillPlanErrorCode.STALE);
+    }
+    record.consumedAt = now;
+    return record;
+}
+/** Drop a plan. Safe to call twice. */
+function discardSkillUninstallPlan(token) {
+    cache.records.delete(token);
+}
+/** @internal */
+function resetSkillUninstallPlanCacheForTesting() {
+    cache.records.clear();
+}
+/** @internal Number of plans currently held. */
+function getSkillUninstallPlanCount() {
+    return cache.records.size;
+}
+/**
+ * Assess the install root and register a plan under a fresh token.
+ *
+ * A non-removable assessment still produces a plan: the user is entitled to see
+ * *which* file is blocking and why, and #1233 established that a plan the apply
+ * step will refuse is more useful than an opaque error. Apply declines to spend
+ * such a token, so the preview cannot become a delete by accident.
+ *
+ * @throws SkillPlanError — `NOT_FOUND` when nothing is installed at the target.
+ */
+function createSkillUninstallPlan(input) {
+    if (!constants_1.SKILL_ID_PATTERN.test(input.skillId) || input.skillId.length > constants_1.SKILL_ID_MAX_LENGTH) {
+        throw new install_plan_1.SkillPlanError(install_plan_1.SkillPlanErrorCode.TARGET_UNSAFE);
+    }
+    const now = input.now ?? Date.now();
+    const assessment = assessSkillUninstall(input.installRootAbs, input.skillId);
+    if (!assessment.present) {
+        throw new install_plan_1.SkillPlanError(install_plan_1.SkillPlanErrorCode.NOT_FOUND);
+    }
+    const token = (0, crypto_1.randomBytes)(SKILL_UNINSTALL_PLAN_TOKEN_BYTES).toString('hex');
+    const expiresAt = now + install_plan_1.SKILL_PLAN_TTL_MS;
+    const receipt = assessment.receipt;
+    const receiptEntry = assessment.entries.find((entry) => entry.generated) ?? null;
+    const binding = {
+        actor: input.actor,
+        operation: 'uninstall',
+        worktreeId: input.worktree.id,
+        skillId: input.skillId,
+        version: receipt?.version ?? '',
+        receiptDigest: assessment.receiptDigest ?? '',
+        branch: input.git.branch,
+        headCommit: input.git.headCommit,
+        currentTreeHash: assessment.currentTreeHash,
+    };
+    const dto = {
+        token,
+        expiresAt: new Date(expiresAt).toISOString().replace(/\.\d{3}Z$/, 'Z'),
+        removable: assessment.removable,
+        blockers: assessment.blockers,
+        nextActionKey: assessment.removable
+            ? exports.SKILL_UNINSTALL_NEXT_ACTION_KEYS.removable
+            : exports.SKILL_UNINSTALL_NEXT_ACTION_KEYS.blocked,
+        target: {
+            worktreeId: input.worktree.id,
+            worktreeName: input.worktree.name,
+            repositoryName: input.worktree.repositoryName,
+            branch: input.git.branch,
+            headState: input.git.headState,
+            headCommit: input.git.headCommit,
+            workingTreeDirty: input.git.dirty,
+            installRoot: assessment.installRoot,
+            currentTreeHash: assessment.currentTreeHash,
+        },
+        skill: {
+            id: input.skillId,
+            version: receipt?.version ?? '',
+            source: receipt
+                ? { ...receipt.source }
+                : { repository: '', ref: '', commit: '' },
+            artifact: {
+                assetName: receipt?.artifact.asset_name ?? '',
+                sha256: receipt?.artifact.sha256 ?? '',
+            },
+            effectiveRisk: receipt?.effective_risk ?? 'low',
+            agents: (receipt?.agent_compatibility ?? []).map((entry) => ({
+                agent: entry.agent,
+                support: entry.support,
+                messageKey: exports.SKILL_UNINSTALL_RELOAD_MESSAGE_KEYS[entry.support],
+            })),
+        },
+        receipt: {
+            path: `${assessment.installRoot}/${install_plan_1.SKILL_RECEIPT_FILENAME}`,
+            sha256: assessment.receiptDigest ?? '',
+            size: receiptEntry?.size ?? 0,
+        },
+        removals: assessment.entries.filter((entry) => entry.disposition === 'remove'),
+        retained: assessment.entries.filter((entry) => entry.disposition !== 'remove'),
+        stats: assessment.stats,
+    };
+    const record = {
+        token,
+        binding,
+        bindingHash: computeSkillUninstallBindingHash(binding),
+        createdAt: now,
+        expiresAt,
+        consumedAt: null,
+        worktreePath: input.worktree.path,
+        // A blocked plan has no trusted receipt; apply refuses it before this is read.
+        receipt: receipt ?? {},
+        assessment,
+        dto,
+    };
+    sweep(now);
+    cache.records.set(token, record);
+    return record;
+}
+/**
+ * Digest of the receipt currently on disk, or null when there is none.
+ *
+ * Apply re-reads this immediately before spending the token, so a reinstall
+ * between plan and apply is drift rather than a silent substitution.
+ */
+function readSkillReceiptDigest(existing) {
+    const file = existing.files.find((entry) => entry.path === install_plan_1.SKILL_RECEIPT_FILENAME);
+    if (!file)
+        return null;
+    return (0, install_plan_1.parseInstalledReceipt)(file.bytes) === null ? null : (0, integrity_1.computeSha256Hex)(file.bytes);
+}

package/dist/server/src/types/skills.js

@@ -0,0 +1,17 @@
+"use strict";
+/**
+ * Agent Skills distribution contract types (Issue #1228)
+ *
+ * Canonical TypeScript shapes for the four documents of the distribution
+ * contract. See docs/design/agent-skills-distribution.md for the ADR that
+ * fixes the semantics of every field below.
+ *
+ * Ownership of each display field (Issue #1232):
+ * - manifest  : capability, expected outcome, provider, license, permissions
+ * - catalog   : version, changelog, resolved commit SHA, artifact info
+ * - inspection: scripts / executables / computed risk
+ * - receipt   : what actually landed in the worktree
+ *
+ * @module types/skills
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "commandmate",
-  "version": "0.11.4",
+  "version": "0.12.1",
   "description": "A local control plane for agent CLIs — orchestration and visibility for Claude Code, Codex, Gemini CLI, and more across Git worktrees",
   "keywords": [
     "claude-code",