opencode-skills-collection 4.0.66 → 4.0.68

package/bundled-skills/ledger-tasks-yylo/SKILL.md

@@ -0,0 +1,219 @@
+---
+name: ledger-tasks-yylo
+description: 'Use YYLO Ledger task management: create, list, search, get, mark, update,
+  archive, deps, ready, order and merge with dependencies.'
+category: project-management
+risk: safe
+source: https://github.com/yylo-dev/yylo-skills
+source_repo: yylo-dev/yylo-skills
+source_type: community
+date_added: '2026-09-19'
+license: MIT
+license_source: https://github.com/yylo-dev/yylo-skills/blob/main/LICENSE
+compatibility: Requires the `yy` CLI (YYLO Ledger 0.3.x+) installed and a routed Ledger
+  controller; git and bash for worktree tasks. Command help (`yy ledger --help`) is
+  authoritative for the installed runtime.
+argument-hint: '[command or workflow question]'
+enable-shell-directives: true
+---
+
+## YYLO Ledger CLI Reference
+
+Use `yy ledger` for all commands. Ledger 0.3.x exposes both the compatible flat task commands and the native ID-first `record|task|wiki|workflow|artifact` groups. `yy kanban` is a labelled compatibility alias for the same controller-routed task runtime.
+
+### Supported task contract
+
+- Preflight installed `yy ledger --version` and `yy ledger --help`; command help is authoritative for the selected runtime.
+- Use the flat task surface for lifecycle task management. Use the dedicated native skills for wiki, workflow, and artifact Records rather than guessing their arguments.
+- New operational PDRs, contracts, plans, reports, receipts, and evidence belong in typed Artifact Records, not product documentation, task bodies/responses, or new `.juno_task/specs` files.
+- If a required native group is absent, fail closed and request a Ledger upgrade. Never invoke mutable source directly or write Ledger store files by hand.
+- Read current task state before mutation, preserve mutation receipts where offered, and never bypass controller routing or lifecycle state with direct file edits.
+- Normal discovery is hot-only unless an explicit cold-archive command is used.
+
+### Opt-in cross-project routing
+
+Cross-project access is disabled by default. The source `.juno_task/config.json` must set `kanbanRegistry.enabled: true` and explicitly list `allowedProjects`; environment overrides are `YYLO_LEDGER_REGISTRY_ENABLED` and `YYLO_LEDGER_REGISTRY_ALLOWED_PROJECTS`. Register with `yy ledger project add ALIAS --path /absolute/project`, then route any command with `--project ALIAS`. The destination wrapper/runtime remains authoritative, and routing failures never fall back to the source board.
+
+### Legacy Task compatibility commands
+
+**CREATE** — Add a new task
+```bash
+yy ledger create "Task description here" --status backlog --tags feature,backend
+```
+Options: `--status` (backlog|todo|in_progress|done), `--tags` (comma/space-separated), `--blocked-by` (task IDs), `--related-tasks` (task IDs)
+
+**LIST** — Browse tasks with summary stats
+```bash
+yy ledger list --limit 5 --sort asc
+yy ledger list --status todo --sort asc
+yy ledger list --status todo,in_progress --limit 10
+```
+
+**SEARCH** — Find tasks by criteria
+```bash
+yy ledger search --status todo --tag backend --limit 10
+yy ledger search --body "OAuth" --open
+yy ledger search --commit abc123
+```
+Filters: `--status`, `--tag`, `--body`, `--response`, `--commit`, `--open` (no agent_response), `--recent`, `--exclude` (exclude tags)
+
+**GET** — Full task details (including dependency info and related task details)
+```bash
+yy ledger get TASK_ID
+```
+
+**MARK** — Update status with required response message
+```bash
+yy ledger mark in_progress --id TASK_ID --response "Starting work on this"
+yy ledger mark done --id TASK_ID --response "Completed: implemented X, tested Y" --commit abc123def
+yy ledger mark todo --id TASK_ID --response "Reopening: found regression"
+```
+Required: `--id` and `--response`. Optional: `--commit` (recommended for done).
+
+**UPDATE** — Modify task fields
+```bash
+yy ledger update TASK_ID --status todo --tags backend,urgent
+yy ledger update TASK_ID --commit abc123def
+yy ledger update TASK_ID --response "Additional context"
+```
+
+**ARCHIVE** — Soft delete (preserves data, sets status to archive)
+```bash
+yy ledger archive TASK_ID
+```
+
+### Immutable cold archive packs
+
+Normal `list`, `search`, `ready`, and `order` are deliberately hot-only. Exact `get TASK_ID` transparently resolves a hot task or a read-only archived task; use `history TASK_ID` explicitly for its ledger. Discover cold tasks only with bounded, projected `archive-search` output:
+
+```bash
+yy ledger archive-search --tag backend --before 2026-01-01 --limit 20 --projection metadata
+```
+
+Before archive maintenance, preflight the installed version/help and obtain explicit owner authorization. The repository and index must be clean, and reports must be durable new paths outside the repository:
+
+```bash
+yy ledger --version
+yy ledger archive-pack plan --status done,archive --older-than 90d --max-tasks 1000 --target-bytes 26214400 --hard-max-bytes 47185920 --report /external/receipts/archive-plan.json
+# Independently inspect selected IDs, revisions, source HEAD, policy, and plan hash.
+yy ledger archive-pack create --plan /external/receipts/archive-plan.json --report /external/receipts/archive-create.json
+yy ledger archive-pack doctor
+yy ledger doctor
+```
+
+A stale plan or selected-task/worktree conflict must fail closed: discard the plan, resolve the conflict, and plan again. Never automate archival, edit/append packs or manifests, restore/reopen an archived ID, use force/lossy controls, or enumerate archive files directly. Create follow-up work as a new hot task related to the archived ID. Production archival, push/deploy, and post-deploy E2E each require separate authorization; agents must not infer it from implementation approval.
+
+### Dependency Management
+
+**DEPS** — View, add, or remove task dependencies
+```bash
+# View dependency info (blockers, dependents, priority score)
+yy ledger deps TASK_ID
+
+# Add blockers (TASK_ID cannot start until BLOCKER1 and BLOCKER2 are done)
+yy ledger deps add --id TASK_ID --blocked-by BLOCKER1 BLOCKER2
+
+# Remove a blocker
+yy ledger deps remove --id TASK_ID --blocked-by BLOCKER1
+```
+Cycle detection prevents circular dependencies automatically.
+
+**READY** — Tasks with all blockers satisfied (safe to work on)
+```bash
+yy ledger ready
+yy ledger ready --tag backend --limit 5
+```
+Returns tasks where status is backlog/todo/in_progress AND all `blocked_by` tasks are done/archive.
+
+**ORDER** — Topological sort of open tasks respecting dependencies
+```bash
+yy ledger order
+yy ledger order --scores
+```
+Use for determining safe parallel execution order.
+
+### Body Markup for Inline Dependencies
+
+Declare dependencies and relations directly in task body text:
+
+```
+[blocked_by]TASK_ID[/blocked_by]          — This task is blocked by TASK_ID
+[blocked_by]ID1, ID2[/blocked_by]         — Blocked by multiple tasks
+[task_id]RELATED_ID[/task_id]             — Reference a related task
+[task_id]ID1 ID2[/task_id]                — Multiple related tasks
+```
+
+These are parsed automatically when the task is created/updated.
+
+### Merge (Multi-Directory Consolidation)
+
+When tasks get scattered across subdirectories:
+```bash
+# First produce and review a deterministic plan
+yy ledger merge ./sub1/.juno_task ./sub2/.juno_task --into ./.juno_task \
+  --dry-run --plan-file /external/ledger-merge-plan.json
+
+# Apply only that reviewed plan and retain its receipt
+yy ledger merge ./sub1/.juno_task ./sub2/.juno_task --into ./.juno_task \
+  --apply-plan /external/ledger-merge-plan.json \
+  --receipt-file /external/ledger-merge-receipt.json
+```
+
+### Output Formats
+
+All commands support: `-f json`, `-f ndjson` (default), `-f xml`, `-f table`
+Add `--raw` for compact output. Add `-p` for pretty print.
+
+### Best Practices
+
+1. **Task sizing**: Create tasks small enough to complete in one iteration without filling the context window
+2. **Status flow**: backlog → todo → in_progress → done (or archive for abandoned tasks)
+3. **Always include `--response`** when using `mark` — document what you did and how you tested it
+4. **Attach commits**: Use `--commit HASH` when marking done, then `update TASK_ID --commit HASH` to link the git history
+5. **Use `ready`** before starting work to find unblocked tasks
+6. **Use `order --scores`** to plan parallel execution pipelines
+7. **Use `[blocked_by]` markup** in task body when creating tasks that depend on others
+8. **Use `[task_id]` markup** in task body to cross-reference related tasks
+9. **Use `get TASK_ID`** to see full task details including resolved dependency and related task info
+10. **Concurrent features are supported** — start each selected task with `yy task start TASK_ID`; each gets a dedicated product worktree, while `yy merge` serializes only target updates
+
+### Canonical Controller Routing
+
+YYLO Ledger mutation resolves the controller in this order: explicit `JUNO_TASK_ROOT`, repository-local registration, then the current project root. Diagnose before orchestration with `.juno_task/scripts/controller_resolver.py --cwd "$PWD" --operation kanban`. The resolver may bootstrap or idempotently confirm a registration, but changing an existing controller requires `yy migrate registration plan` followed by a separately authorized apply. Explicit/registered path or branch errors fail closed—YYLO Ledger never switches Git branches or falls back silently.
+
+Run YYLO Ledger and workflows from the controller. A task checkout may implement/test but routes task/session writes to that controller. An integration-owner checkout stays clean and refuses Kanban/orchestration/session writes in strict mode; launch from the controller and pass the product checkout separately as `TASK_ROOT`.
+
+### Environment Variables
+
+- `JUNO_TASK_ROOT` — Explicit canonical controller/task-storage root (not the product `TASK_ROOT`)
+- `JUNO_CONTROLLER_BRANCH` — Expected controller branch for environment-based routing
+- `JUNO_WORKSPACE_ROLE` — `controller`, `task`, or `integration-owner`
+- `JUNO_WORKSPACE_ENFORCEMENT` — `off`, `warn`, or `strict`
+- `JUNO_DEBUG=true` — Show diagnostic messages
+- `JUNO_VERBOSE=true` — Show informational messages
+- `JUNO_KANBAN_LIST_BODY_TRUNCATE_CHARS=N` — Override list body truncation (default: 1200)
+
+$ARGUMENTS
+
+## When to Use
+
+- You need to interact with the YYLO Ledger task board (create, list, search, get, mark, update, archive, deps, ready, order, merge).
+- You need dependency-aware scheduling (`deps`, `ready`, `order`) or multi-directory consolidation (`merge`).
+- Use the dedicated `wiki-yylo`, `workflow-yylo` and `artifact-yylo` skills for native wiki/workflow/artifact Records instead of guessing their arguments.
+
+## Limitations
+
+- Requires YYLO Ledger 0.3.x+ with the needed command groups; if a group is absent, fail closed and request a Ledger upgrade - never edit store files by hand.
+- Discovery (`list`, `search`, `ready`, `order`) is hot-only; cold tasks need explicit `archive-search`.
+- `archive-pack` and `merge` need explicit owner authorization, a clean tree, and external plan/receipt paths; never automate archival or force past conflicts.
+- Does not grant push, deploy, release, or production-mutation authority.
+
+### Example
+
+```bash
+yy ledger --version && yy ledger --help
+yy ledger ready --limit 5
+yy ledger get TASK_ID
+```
+
+> Adapted from [yylo-dev/yylo-skills](https://github.com/yylo-dev/yylo-skills) (MIT) - v2.0.1; frontmatter, When to Use/Limitations, and safety boundaries added for upstream compliance.

package/bundled-skills/loki-mode/examples/todo-app-generated/backend/package-lock.json

@@ -11,7 +11,7 @@
         "better-sqlite3": "^12.11.1",
         "cors": "^2.8.6",
         "express": "^4.18.2",
-        "express-rate-limit": "^8.6.2"
+        "express-rate-limit": "^8.7.0"
       },
       "devDependencies": {
         "@types/better-sqlite3": "^7.6.13",
@@ -691,9 +691,9 @@
       }
     },
     "node_modules/express-rate-limit": {
-      "version": "8.6.2",
-      "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.6.2.tgz",
-      "integrity": "sha512-YH4ru+eOJxQABscKFfRCy9R7x9QFGdezclVMwwgFFndzS2Xnm0uo6B0ABZsLhcpeptGv2qvuJVWlQr9gQZoC3A==",
+      "version": "8.7.0",
+      "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.7.0.tgz",
+      "integrity": "sha512-hOwV7WOxXfjRpAM1DSJWZDXx3GhplwD8IfwuwvogD8i1Qnkgosw/H45s4ZnFAUHDAhPjlY9hLBvJhKmGMyY26g==",
       "license": "MIT",
       "dependencies": {
         "debug": "^4.4.3",

package/bundled-skills/loki-mode/examples/todo-app-generated/backend/package.json

@@ -12,7 +12,7 @@
     "better-sqlite3": "^12.11.1",
     "cors": "^2.8.6",
     "express": "^4.18.2",
-    "express-rate-limit": "^8.6.2"
+    "express-rate-limit": "^8.7.0"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.13",

package/bundled-skills/meteora-dlmm-pool-screening/SKILL.md

@@ -0,0 +1,166 @@
+---
+name: meteora-dlmm-pool-screening
+risk: safe
+source: community
+source_repo: romankurnovskii/etemaro
+source_type: community
+date_added: "2026-09-17"
+description: >
+  Screen and rank Meteora DLMM pools for LP quality using public Meteora APIs (fee/TVL,
+  bin step, organic score). Read-only: never deploys, swaps, or signs.
+metadata:
+  version: "1.0.0"
+  author: etemaro
+license: MIT
+compatibility: Network access to public Meteora datapi. No API key. The bundled Python 3
+  stdlib screener is embedded in this file under "Screener script".
+---
+
+# Meteora DLMM pool screening
+
+Rank Meteora DLMM pools the way an LP screener should: **hard-filter first, then sort by
+windowed fee / active TVL**. Public APIs only. No keys, no transactions.
+
+The embedded screener script below encodes the gates so every run uses the same numbers.
+Save it to a scratch directory (for example `mktemp -d`), run it with `python3`, and
+delete the copy when done. It only ever **GET**s the public endpoints documented in
+[references/meteora-apis.md](references/meteora-apis.md).
+
+```bash
+python3 screen.py                  # trending volatile (default)
+python3 screen.py --preset stable
+python3 screen.py --query BONK     # pair search; preset defaults to loose
+python3 screen.py --query BONK --preset volatile
+python3 screen.py --json --limit 8
+```
+
+If you do not materialize the script, curl the same endpoints in
+[references/meteora-apis.md](references/meteora-apis.md).
+Always send a `User-Agent` — unauthenticated requests without one get `403`.
+
+## When to use
+
+- User wants a ranked Meteora DLMM candidate list (trending or a token/pair).
+- User asks which bin step / pool to LP for a pair.
+- User wants a fee/TVL screen, not a single-pool deep dive.
+
+Not this skill: deploying, claiming, closing, swapping, wallet hygiene, or a full
+token-holder / narrative research dump. Stop after the ranked table and verdicts.
+
+## Method
+
+1. **Universe** — trending discovery (`category=trending`) unless the user named a token,
+   then query that mint/symbol. Pair query defaults to `--preset loose` so bin-step
+   tradeoffs stay visible; pass `--preset volatile` only when the user wants that gate.
+2. **Hard filters** — reject before ranking. A high fee/TVL pool that fails a gate is a
+   skip, not a "maybe".
+3. **Score** — `fee_active_tvl_ratio * 1000 + organic * 10 + volume / 100 + holders / 100`.
+   Fee/TVL dominates; organic and activity break ties.
+4. **Verdict** — `pass` (clears gates, top of list), `watch` (clears gates but thin
+   activity, unverified token, or awkward bin step), `skip` (failed a gate).
+5. **Stop** — print the table. Do not fetch a wallet, do not build a tx, do not call Etemaro CLI.
+
+## Presets
+
+Defaults match a volatile/narrative Solana LP screen (wide bin step, mid TVL). Change
+preset when the user says stable pair or blue-chip.
+
+| Preset | bin_step | TVL USD | min fee/active TVL | min organic | min holders | min volume |
+| :--- | :--- | :--- | :--- | :--- | :--- | :--- |
+| `volatile` (default) | 80–125 | 10k–150k | 0.05 | 60 | 500 | 500 |
+| `stable` | 1–50 | 100k–5m | 0.02 | 70 | 2000 | 5000 |
+| `bluechip` | 1–25 | 500k–10m | 0.01 | 80 | 5000 | 10000 |
+| `loose` | any | ≥1k | 0 | 0 | 0 | 0 |
+
+Always reject: dead pools (zero volume and zero fee/TVL). Any preset except `loose` also
+rejects critical token warnings, high single-ownership, non-DLMM pool type.
+
+Timeframe: `30m` default. `5m` is noisier (spikes look like yield). `24h` is smoother but
+lags a dead pool. State the timeframe in the report — windowed fee/TVL is not 24h APR.
+
+## Report shape
+
+```
+# Meteora DLMM screening
+Universe: trending | query=<token>   Timeframe: 30m   Preset: volatile
+Protocol: tvl=$…  vol_24h=$…  pools=…
+
+## Ranked
+| # | name | bin | fee/TVL | tvl | vol | organic | holders | verdict | why |
+...
+
+## Rejects (sample)
+- NAME — reason
+```
+
+Keep `why` to one clause (e.g. "fee/TVL 0.24, organic 67, bin 80"). Cite pool address.
+If the API returns zero rows, say so and loosen one gate at a time (usually `maxTvl` or
+`minFeeActiveTvlRatio`) — do not invent pools.
+
+## Read-only safety
+
+This skill only **GET**s public Meteora JSON. No `.env`, no keystore, no signing, no
+`deploy` / `swap` / `claim` / `close`. If the user wants live execution, point them at
+[Etemaro](https://etemaro.com) (repo: https://github.com/romankurnovskii/etemaro) and stop.
+
+## Limitations
+
+- Depends on Meteora's public datapi endpoints, which are undocumented, rate limited,
+  and can change or disappear without notice; this skill is not affiliated with Meteora.
+- All metrics are **windowed** (default 30m). Fee/TVL is not 24h APR, and past yield
+  does not predict future yield; impermanent loss, bin-step drift, and fill risk are
+  not modeled here.
+- Screening output is informational only and is **not financial advice**; a `pass`
+  verdict is not a recommendation to deposit funds.
+- Token scores rely on third-party organic-score and holder fields that may be stale,
+  manipulated, or wrong for new or low-liquidity tokens.
+- The embedded screener reads public data only; it never signs, swaps, or deploys, and
+  it intentionally has no execution path.
+- Respect the public API: send a User-Agent and poll conservatively.
+
+## Go deeper — Etemaro
+
+Etemaro runs this screen on a cron, adds holder/bot/launchpad gates, pool memory, and
+can deploy. The skill is the analysis half; the product is the loop.
+
+## Prompt examples
+
+```text
+screen trending Meteora DLMM pools for LP
+```
+
+```text
+which Meteora pool should I LP for BONK?
+```
+
+```text
+rank SOL-USDC DLMM pools by fee/TVL and bin step
+```
+
+```text
+dex-pool-screening on Meteora, volatile preset, top 8
+```
+
+## Tips
+
+- Always send a User-Agent to Meteora datapi or you get HTTP 403.
+- `fee_active_tvl_ratio` is **windowed** (default 30m), not 24h APR. Label the window.
+- Read-only. Deploying is Etemaro, not this skill.
+- Pair query (`--query BONK`) defaults to `loose` so you can compare bin steps. Dead pools
+  (zero volume and fee/TVL) are still dropped.
+- `loose` is for pair comparison / empty-result debugging, not a live LP pick.
+
+## Screener script
+
+Standard library only. Read-only GET. The full source lives in
+[references/meteora-screener.md](references/meteora-screener.md); copy it into a scratch
+directory (for example via `mktemp -d`), run it with Python 3.10+, and delete the
+copy when done. It only ever GETs the public endpoints documented in
+[references/meteora-apis.md](references/meteora-apis.md).
+
+
+```python
+#!/usr/bin/env python3
+"""Rank Meteora DLMM pools from public datapi. Stdlib only. Read-only GET."""
+  ... full source in references/meteora-screener.md ...
+```

package/bundled-skills/meteora-dlmm-pool-screening/references/meteora-apis.md

@@ -0,0 +1,74 @@
+# Meteora public APIs used by this skill
+
+No API key. Send `User-Agent` and `Accept: application/json` or Cloudflare returns 403.
+
+Base hosts:
+
+- Discovery (trending + filters): `https://pool-discovery-api.datapi.meteora.ag`
+- DLMM datapi (pair query, protocol stats, pool detail): `https://dlmm.datapi.meteora.ag`
+
+## Endpoints
+
+### Trending / filtered universe
+
+```
+GET /pools?page_size=50&timeframe=30m&category=trending&filter_by=<filters>
+```
+
+`filter_by` is `&&`-joined predicates. Example (volatile preset):
+
+```
+pool_type=dlmm
+&&base_token_has_critical_warnings=false
+&&quote_token_has_critical_warnings=false
+&&base_token_has_high_single_ownership=false
+&&tvl>=10000&&tvl<=150000
+&&dlmm_bin_step>=80&&dlmm_bin_step<=125
+&&fee_active_tvl_ratio>=0.05
+&&base_token_organic_score>=60
+&&base_token_holders>=500
+&&volume>=500
+```
+
+Response: `{ total, page_size, data[], has_more }`.
+
+Useful `data[]` fields: `pool_address`, `name`, `pool_type`, `tvl`, `active_tvl`,
+`fee_active_tvl_ratio`, `volume`, `volatility`, `base_token_holders`,
+`dlmm_params.bin_step`, `token_x.{symbol,address,organic_score,market_cap,warnings}`.
+
+### Pair / token query
+
+```
+GET /pools?query=<symbol_or_mint>&sort_by=tvl:desc
+```
+
+on `dlmm.datapi.meteora.ag`. Response `{ total, data[] }`.
+
+Fee/TVL and volume are **buckets**: `{ "30m", "1h", "2h", "4h", "12h", "24h" }`.
+Use the same key as `--timeframe`. Bin step is `pool_config.bin_step`. Address is `address`.
+
+### Protocol snapshot
+
+```
+GET https://dlmm.datapi.meteora.ag/stats/protocol_metrics
+```
+
+`total_tvl`, `volume_24h`, `fee_24h`, `total_pools`. One-line context only.
+
+### Single pool
+
+```
+GET https://dlmm.datapi.meteora.ag/pools/{poolAddress}
+GET https://pool-discovery-api.datapi.meteora.ag/pools?page_size=1&filter_by=pool_address={poolAddress}&timeframe=30m
+```
+
+Discovery lag: a brand-new pool may exist on DLMM datapi before discovery indexes it.
+
+## Score (keep in sync with scripts/screen.py)
+
+```
+score = fee_tvl * 1000 + organic * 10 + volume / 100 + holders / 100
+```
+
+`fee_tvl` is the windowed ratio (`fee_active_tvl_ratio` on discovery, bucketed
+`fee_tvl_ratio[timeframe]` on pair query).