opencode-skills-collection 4.0.21 → 4.0.23

package/bundled-skills/generate-nanobanana/references/gemini-3.1-flash-lite-image.md

@@ -0,0 +1,82 @@
+# Gemini 3.1 Flash Lite Image (`gemini-3.1-flash-lite-image`)
+
+## Overview
+Nano Banana 2 Lite is Google's fastest and cheapest Gemini image model — the draft tier for rapid concept exploration and quick visual iteration before promoting a picked result to a higher tier.
+
+## Model Specification
+- **Model ID**: `gemini-3.1-flash-lite-image`
+- **API**: Interactions API (`client.interactions.create`) — this model does not use the older `generate_content` method.
+- **Primary Use**: Image drafts, rapid prototyping, thumbnail concepts.
+- **Cost**: Billable per call. Quote the current price from the live [pricing page](https://ai.google.dev/gemini-api/docs/pricing) and get explicit user approval before every generation — see the skill's cost-approval rule.
+- **Reference images**: Up to 14 supported as additional `image` input parts.
+- **Reproducibility**: No `seed` parameter is documented for this model. Treat every generation as non-deterministic; for "same image but change X" requests, reuse the exact original prompt and reference images rather than promising an identical re-roll.
+
+## Request Shape
+
+### Python SDK (`google-genai`, Interactions API)
+```python
+from google import genai
+import base64
+
+client = genai.Client()
+
+interaction = client.interactions.create(
+    model="gemini-3.1-flash-lite-image",
+    input="A futuristic city skyline at sunset, cyberpunk aesthetic, high detail",
+    response_format={
+        "type": "image",
+        "aspect_ratio": "16:9",
+        "image_size": "1K",
+    },
+)
+
+with open("generations/output.png", "wb") as f:
+    f.write(base64.b64decode(interaction.output_image.data))
+```
+
+### Reference Image Input
+Pass reference images as additional `input` parts (base64-encoded), alongside the text prompt:
+```python
+from google import genai
+import base64
+
+client = genai.Client()
+
+with open("generations/refs/brand/logo.png", "rb") as f:
+    logo_bytes = f.read()
+
+interaction = client.interactions.create(
+    model="gemini-3.1-flash-lite-image",
+    input=[
+        {"type": "text", "text": "Incorporate this logo style into a draft banner for summer sale"},
+        {"type": "image", "data": base64.b64encode(logo_bytes).decode("utf-8"), "mime_type": "image/png"},
+    ],
+    response_format={"type": "image", "aspect_ratio": "16:9"},
+)
+```
+
+### REST API (`curl`)
+```bash
+mkdir -p generations
+cat > generations/lite_image_request.json << 'EOF'
+{
+  "model": "gemini-3.1-flash-lite-image",
+  "input": [
+    {"type": "text", "text": "A futuristic city skyline at sunset, cyberpunk aesthetic, high detail"}
+  ],
+  "response_format": {
+    "type": "image",
+    "aspect_ratio": "16:9",
+    "image_size": "1K"
+  }
+}
+EOF
+
+curl -s -X POST \
+  "https://generativelanguage.googleapis.com/v1beta/interactions" \
+  -H "x-goog-api-key: $GEMINI_API_KEY" \
+  -H "Content-Type: application/json" \
+  -d @generations/lite_image_request.json > generations/lite_image_response.json
+```
+
+The response's `output_image.data` field holds the base64-encoded image bytes; decode and write them to the target file.

package/bundled-skills/generate-nanobanana/references/gemini-omni-flash-preview.md

@@ -0,0 +1,160 @@
+# Gemini Omni Flash Video (`gemini-omni-flash-preview`)
+
+## Overview
+Gemini Omni Flash generates and edits video. It supports text-to-video, image-to-video, subject-reference video, stateful multi-turn video editing, and editing a user's own uploaded video. **Every paid run requires explicit user cost approval before execution — see the skill's cost-approval rule.**
+
+## Model Specification
+- **Model ID**: `gemini-omni-flash-preview`
+- **API**: Interactions API (`client.interactions.create`) — this model does not use the older `generate_videos` or `:predictLongRunning` methods.
+- **Primary Use**: Text-to-video, image-to-video, subject-reference video, video editing.
+- **Cost**: Billable per call, priced per output. Quote the current price from the live [pricing page](https://ai.google.dev/gemini-api/docs/pricing) and get explicit user approval before submitting — one approval covers exactly one run.
+- **Aspect ratios**: `16:9`, `9:16` documented for aspect-ratio-controlled requests.
+- **Reproducibility**: No `seed` parameter is documented for this model. Treat every generation as non-deterministic.
+
+## Request Shape
+
+### Text-to-Video (Python SDK, Interactions API)
+```python
+import base64
+from google import genai
+
+client = genai.Client()
+
+# Quote cost and wait for explicit user approval before running!
+interaction = client.interactions.create(
+    model="gemini-omni-flash-preview",
+    input="A marble rolling fast on a chain reaction style track, continuous smooth shot.",
+)
+with open("generations/marble.mp4", "wb") as f:
+    f.write(base64.b64decode(interaction.output_video.data))
+```
+
+### Control Aspect Ratio
+```python
+interaction = client.interactions.create(
+    model="gemini-omni-flash-preview",
+    input="A futuristic city with neon lights and flying cars, cyberpunk style",
+    response_format={
+        "type": "video",  # optional
+        "aspect_ratio": "9:16",  # supported: "9:16", "16:9"
+    },
+)
+```
+
+### Image-to-Video
+Pass a reference image and instructions as separate `input` parts:
+```python
+import base64
+from google import genai
+
+client = genai.Client()
+
+with open("generations/refs/start_frame.png", "rb") as f:
+    frame_bytes = f.read()
+
+interaction = client.interactions.create(
+    model="gemini-omni-flash-preview",
+    input=[
+        {"type": "image", "data": base64.b64encode(frame_bytes).decode("utf-8"), "mime_type": "image/png"},
+        {"type": "text", "text": "The scene animates smoothly as the character steps forward into the misty forest."},
+    ],
+)
+with open("generations/forest.mp4", "wb") as f:
+    f.write(base64.b64decode(interaction.output_video.data))
+```
+
+### Subject Reference (multiple reference images)
+```python
+interaction = client.interactions.create(
+    model="gemini-omni-flash-preview",
+    input=[
+        {"type": "image", "data": cat_b64, "mime_type": "image/png"},
+        {"type": "image", "data": yarn_b64, "mime_type": "image/png"},
+        {"type": "text", "text": "A cat playfully batting at a ball of yarn."},
+    ],
+)
+```
+
+### Stateful Multi-Turn Video Editing
+Chain an edit onto a prior generation with `previous_interaction_id` — this is the closest thing this model offers to controlled reruns, not a seed:
+```python
+# Turn 1: generate
+res1 = client.interactions.create(model="gemini-omni-flash-preview", input="A woman playing violin outdoors.")
+
+# Turn 2: edit the previous result
+res2 = client.interactions.create(
+    model="gemini-omni-flash-preview",
+    previous_interaction_id=res1.id,
+    input="Make the violin invisible.",
+)
+with open("generations/violin.mp4", "wb") as f:
+    f.write(base64.b64decode(res2.output_video.data))
+```
+
+### Editing a User's Own Uploaded Video
+```python
+import time
+from google import genai
+
+client = genai.Client()
+
+video_file = client.files.upload(file="Video.mp4")
+while video_file.state == "PROCESSING":
+    time.sleep(10)
+    video_file = client.files.get(name=video_file.name)
+if video_file.state == "FAILED":
+    raise ValueError(video_file.state)
+
+interaction = client.interactions.create(
+    model="gemini-omni-flash-preview",
+    input=[
+        {"type": "document", "uri": video_file.uri},
+        {"type": "text", "text": "When the person touches the mirror, make the mirror ripple beautifully like liquid, and the person's arm turns into reflective mirror material"},
+    ],
+)
+with open("generations/mirror.mp4", "wb") as f:
+    f.write(base64.b64decode(interaction.output_video.data))
+```
+
+### Large Outputs: Retrieve via URI Instead of Inline Base64
+For outputs too large for inline base64, request `delivery: "uri"` and poll the Files API until `ACTIVE`:
+```python
+import time
+from google import genai
+
+client = genai.Client()
+
+interaction = client.interactions.create(
+    model="gemini-omni-flash-preview",
+    input="A beautiful sunset over a calm ocean.",
+    response_format={"type": "video", "delivery": "uri"},
+)
+
+video_output = interaction.output_video
+file_name = video_output.uri.split("/")[-1]
+
+while True:
+    f_info = client.files.get(name=f"files/{file_name}")
+    if f_info.state.name == "ACTIVE":
+        break
+    if f_info.state.name == "FAILED":
+        raise RuntimeError("Generation failed.")
+    time.sleep(5)
+
+video_bytes = client.files.download(file=video_output.uri)
+with open("generations/output.mp4", "wb") as f:
+    f.write(video_bytes)
+```
+
+### REST API (`curl`)
+```bash
+curl -X POST "https://generativelanguage.googleapis.com/v1beta/interactions" \
+  -H "x-goog-api-key: $GEMINI_API_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{
+     "model": "gemini-omni-flash-preview",
+     "input": "A marble rolling fast on a chain reaction style track, continuous smooth shot."
+    }'
+```
+
+The response's `output_video.data` field holds base64-encoded video bytes (or `output_video.uri` when `delivery: "uri"` was requested); decode/download and write to the target file. The response envelope also includes an `id` field — log it so multi-turn edits can chain via `previous_interaction_id`.

package/bundled-skills/gh-attach/SKILL.md

@@ -27,7 +27,7 @@ plugin:
     claude: blocked
   setup:
     type: manual
-    summary: "Installs and runs a third-party gh extension that needs a GitHub user_session cookie or GH_ATTACH_SESSION_TOKEN."
+    summary: "Installs a reviewed gh-attach release and, for uploads, uses an explicitly approved interactive browser session cookie."
     docs: SKILL.md
 ---
 
@@ -65,16 +65,17 @@ Use this skill when asked to:
 
 ```bash
 gh auth status                                   # gh installed and authenticated
-gh extension list | grep -q 'gh attach' \
-  || gh extension install sudosubin/gh-attach    # review/pin the extension source first
+gh extension install sudosubin/gh-attach --pin v0.4.2 --force
+gh extension list | grep -F 'sudosubin/gh-attach' # require the reviewed v0.4.2 release
 ```
 
 Uploads use a GitHub `user_session` browser cookie, **not** the `gh` token (that
 endpoint rejects tokens). By default `gh` must be authenticated so `gh-attach` can
 select the matching browser account (Chromium family, Firefox family, or Safari).
-If the wrong account is selected, add `--browser <name> --profile <name>`. For
-headless or CI use, set `GH_ATTACH_SESSION_TOKEN` to the bare `user_session` cookie
-value and treat it as a full account credential.
+If the wrong account is selected, add `--browser <name> --profile <name>`. Obtain
+explicit approval before allowing the pinned extension to access that interactive
+browser profile. Headless and CI uploads are intentionally unsupported: never export,
+store, or pass a raw `user_session` cookie to the extension.
 
 ### Step 2: Upload
 
@@ -123,15 +124,17 @@ an authorization fallback.
   Unicode.
 - For display sizing, embed an HTML tag instead of the bare URL:
   `<img width="800" src="$URL">`.
-- In CI, set `GH_ATTACH_SESSION_TOKEN` from a dedicated bot account.
+- Keep uploads interactive. Do not place a GitHub browser session in CI, an
+  environment variable, a secret store consumed by this extension, or an agent log.
 - `gh-attach` can upload multiple files concurrently and emit Markdown or JSON
   output with jq-style filtering when you need to script around the result.
 
 ## Limitations
 
-- **Session cookie required.** A `user_session` cookie grants full account access
-  (it is not scoped like a PAT), so treat it like a password and prefer a bot
-  account in CI.
+- **Interactive session cookie required.** A `user_session` cookie grants full
+  account access and is not scoped like a PAT. The supported path is the reviewed,
+  pinned extension reading an explicitly approved local browser profile; CI and
+  headless cookie injection are out of scope.
 - **Write access to the target repo is required** to upload.
 - **Private-repo attachments stay private:** the `user-attachments` URL inherits
   repo visibility, so an anonymous fetch on a private repo returns 404 or 403 by
@@ -142,9 +145,10 @@ an authorization fallback.
 
 ## Security & Safety Notes
 
-- The `user_session` cookie and `GH_ATTACH_SESSION_TOKEN` are full-account
-  credentials. Never print them, never paste them on a command line, and never
-  commit them. Prefer a dedicated bot account for headless or CI use.
+- The `user_session` cookie is a full-account credential. Never print, export,
+  paste, log, or commit it, and never make it available to CI or headless agents.
+- Do not install or upgrade `gh-attach` from a moving branch or an unpinned latest
+  release. Re-review and update the exact `--pin` only in a repository change.
 - Uploaded attachments are auto-rendered by GitHub, so only upload files you intend
   to share with everyone who can view the target repository.
 - Confirm the destination `-R <owner>/<repo>` before uploading so an attachment is

package/bundled-skills/loki-mode/autonomy/run.sh

@@ -74,12 +74,34 @@ if [[ -z "${LOKI_RUNNING_FROM_TEMP:-}" ]]; then
     exec "$TEMP_SCRIPT" "$@"
 fi
 
+# A caller can set environment variables before launch, so the child must prove
+# that it is the private self-copy created above before trusting the temp marker.
+CURRENT_TEMP_RUN_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)" || exit 1
+case "$CURRENT_TEMP_RUN_DIR" in
+    "${TMPDIR:-/tmp}"/loki-run.*) ;;
+    *)
+        echo "Invalid Loki temporary self-copy directory; refusing to continue." >&2
+        exit 2
+        ;;
+esac
+if [[ "${BASH_SOURCE[0]}" != "$CURRENT_TEMP_RUN_DIR/run.sh" \
+   || "${LOKI_TEMP_RUN_DIR:-}" != "$CURRENT_TEMP_RUN_DIR" \
+   || ! -O "$CURRENT_TEMP_RUN_DIR" ]]; then
+    echo "Invalid Loki temporary self-copy state; refusing to continue." >&2
+    exit 2
+fi
+
 # Restore original paths when running from temp
 SCRIPT_DIR="${LOKI_ORIGINAL_SCRIPT_DIR:-$SCRIPT_DIR}"
 PROJECT_DIR="${LOKI_ORIGINAL_PROJECT_DIR:-$PROJECT_DIR}"
 
-# Clean up temp script on exit
-trap 'rm -rf -- "${LOKI_TEMP_RUN_DIR:?}" 2>/dev/null' EXIT
+# Remove only the verified self-copy file, then remove its directory only if it
+# is empty. Never recursively delete a path supplied through the environment.
+cleanup_temp_self_copy() {
+    rm -f -- "$CURRENT_TEMP_RUN_DIR/run.sh" 2>/dev/null || true
+    rmdir -- "$CURRENT_TEMP_RUN_DIR" 2>/dev/null || true
+}
+trap cleanup_temp_self_copy EXIT
 
 # Configuration
 MAX_RETRIES=${LOKI_MAX_RETRIES:-50}

package/bundled-skills/loki-mode/examples/todo-app-generated/backend/package-lock.json

@@ -909,9 +909,9 @@
       "license": "ISC"
     },
     "node_modules/ip-address": {
-      "version": "10.2.0",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz",
-      "integrity": "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==",
+      "version": "10.4.0",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.4.0.tgz",
+      "integrity": "sha512-oSK96Grm3aP6OrS263xVxbNDGVL7rzBtYdpGqlDG8iQdoenDoTs/nkki+DflYbAEE8Xl6o5YxhxlrKvI3nqKXQ==",
       "license": "MIT",
       "engines": {
         "node": ">= 12"

package/bundled-skills/loki-mode/examples/todo-app-generated/frontend/package-lock.json

@@ -746,9 +746,9 @@
       }
     },
     "node_modules/nanoid": {
-      "version": "3.3.12",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.12.tgz",
-      "integrity": "sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==",
+      "version": "3.3.17",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.17.tgz",
+      "integrity": "sha512-xQLf0A3HOMlgHq0n247/LRuAOYmB7dXJ/DvAxGvsSBij45XtBSmQycu+F8ODbHwns/XyFZagyL1+J0Offw1E0g==",
       "dev": true,
       "funding": [
         {
@@ -785,9 +785,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.5.18",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.18.tgz",
-      "integrity": "sha512-xdB1oSLHbz1vRWgCDalrCqEFTWzFlhqFC5tIHLMOSUIjhm3XXQ1qrFy8S/ESr1JYRRXqM3c1QFiMZUJdUTqyMQ==",
+      "version": "8.5.25",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.25.tgz",
+      "integrity": "sha512-DTPx3RWSSnWyzLxQnlH0rJP+EW5ekl16ZU4/psbIhA0e53kJfdgaN5vKM+xP7yJtXVu+nfdVFmlgFDEKAe4Pyw==",
       "dev": true,
       "funding": [
         {
@@ -805,7 +805,7 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "nanoid": "^3.3.12",
+        "nanoid": "^3.3.16",
         "picocolors": "^1.1.1",
         "source-map-js": "^1.2.1"
       },