privateer-agent 0.3.6 → 0.4.0

package/src/remote/remoteBridge.ts

@@ -23,6 +23,42 @@ export interface RelayLike {
   isConnected(): boolean;
   sendNoQuarter(on: boolean): void;
   sendFile(file: { name: string; mediaType: string; base64: string; size: number }): Promise<{ ok: boolean; reason?: string }>;
+  sendNotice(text: string): void;
+  sendCommands(commands: { name: string; description?: string }[]): void;
+  requestSelect(id: string, req: SelectRequest): void;
+  requestInput(id: string, req: InputRequest): void;
+  sendExtensions(payload: ExtensionsPayload): void;
+  sendSkills(payload: SkillsPayload): void;
+}
+
+// The installed-extensions snapshot relayed to the app's extensions manager.
+export interface ExtensionsPayload {
+  installed: { source: string; scope: string; filtered?: boolean; installed?: boolean }[];
+  busy?: boolean;
+  message?: string;
+  needsRestart?: boolean;
+}
+
+// The skills snapshot relayed to the app's skills manager.
+export interface SkillsPayload {
+  items: { name: string; description: string; source: string; editable: boolean; disabled: boolean }[];
+  busy?: boolean;
+  message?: string;
+  needsRestart?: boolean;
+}
+
+// A CLI-initiated selection prompt relayed to the app (e.g. pick a model).
+export interface SelectRequest {
+  title: string;
+  options: { value: string; label: string; hint?: string }[];
+  current?: string;
+}
+
+// A CLI-initiated free-form text prompt relayed to the app (e.g. a skill asking
+// for a value that isn't a fixed choice).
+export interface InputRequest {
+  title: string;
+  placeholder?: string;
 }
 
 export interface RemoteAttachment {
@@ -37,6 +73,26 @@ export interface RemoteBridgeConfig {
   onPrompt: (text: string, attachments: RemoteAttachment[]) => void;
   onInterrupt?: () => void;
   onTerminate?: () => void;
+  // The account signed this terminal out server-side (revoked from the app). The
+  // owner should tear down the login and stop the relay — see RelayCallbacks.onRevoked.
+  onRevoked?: () => void;
+  // A slash command arrived from the app composer (e.g. "/model provider/id").
+  // Route it to the same command dispatcher the local REPL uses.
+  onCommand?: (text: string) => void;
+  // The app's extensions manager opened — the owner should push the installed list.
+  onExtensionsList?: () => void;
+  // The app asked to install / remove a Pi extension by source spec. `sig`+`ts`
+  // authenticate the mutation with the account key (H2) — installing a package is code
+  // execution, so the owner verifies before acting (authorizeControl).
+  onExtensionsAdd?: (source: string, sig?: string, ts?: number) => void;
+  onExtensionsRemove?: (source: string, sig?: string, ts?: number) => void;
+  // The app's skills manager opened — the owner should push the skills list.
+  onSkillsList?: () => void;
+  // The app asked to create/overwrite, delete, or toggle a user skill. Signed (H2) —
+  // a skill is an auto-invoked system-prompt instruction, so mutations are verified.
+  onSkillCreate?: (skill: { name: string; description: string; instructions: string }, sig?: string, ts?: number) => void;
+  onSkillDelete?: (name: string, sig?: string, ts?: number) => void;
+  onSkillSetEnabled?: (name: string, enabled: boolean, sig?: string, ts?: number) => void;
   // A controller (re)attached — the owner should push a transcript snapshot.
   onControllerAttached?: () => void;
   onStatus?: (text: string) => void;
@@ -50,6 +106,8 @@ export class RemoteBridge {
   private remote = false;
   private noQuarter = false;
   private readonly pending = new Map<string, (d: AskOutcome) => void>();
+  private readonly pendingSelects = new Map<string, (v: string | null) => void>();
+  private readonly pendingInputs = new Map<string, (v: string | null) => void>();
   private pendingAttachments: RemoteAttachment[] = [];
 
   constructor(private readonly cfg: RemoteBridgeConfig) {}
@@ -72,10 +130,54 @@ export class RemoteBridge {
     },
     onInterrupt: () => this.cfg.onInterrupt?.(),
     onTerminate: () => this.cfg.onTerminate?.(),
+    onRevoked: () => this.cfg.onRevoked?.(),
+    onCommand: (text) => this.cfg.onCommand?.(text),
+    onExtensionsList: () => this.cfg.onExtensionsList?.(),
+    onExtensionsAdd: (source, sig, ts) => this.cfg.onExtensionsAdd?.(source, sig, ts),
+    onExtensionsRemove: (source, sig, ts) => this.cfg.onExtensionsRemove?.(source, sig, ts),
+    onSkillsList: () => this.cfg.onSkillsList?.(),
+    onSkillCreate: (skill, sig, ts) => this.cfg.onSkillCreate?.(skill, sig, ts),
+    onSkillDelete: (name, sig, ts) => this.cfg.onSkillDelete?.(name, sig, ts),
+    onSkillSetEnabled: (name, enabled, sig, ts) => this.cfg.onSkillSetEnabled?.(name, enabled, sig, ts),
+    // Routines are owned by the daemon, not an interactive session, so its own relay
+    // (not this bridge) handles routines_*. These no-ops just satisfy Required — an
+    // interactive terminal never surfaces the routines manager in the app.
+    onRoutinesList: () => {},
+    onRoutinesSave: () => {},
+    onRoutinesDelete: () => {},
+    onRoutinesSetEnabled: () => {},
+    onRoutinesRun: () => {},
+    // Ad-hoc task spawns are daemon-owned too (they run on / are stood up by the daemon,
+    // not an interactive session), so its own relay handles task_submit/task_spawn. These
+    // no-ops just satisfy Required — an interactive terminal never receives them.
+    onTaskSubmit: () => {},
+    onTaskSpawn: () => {},
+    // Channels, like routines, are owned by the daemon (its channels/run.ts config),
+    // not an interactive session — the daemon's own relay handles channels_*. These
+    // no-ops just satisfy Required; an interactive terminal never surfaces channels.
+    onChannelsList: () => {},
+    onChannelsSave: () => {},
+    onChannelsRemove: () => {},
+    // Workflows, like routines/channels, are daemon-owned — the daemon's own relay handles
+    // workflows_*. These no-ops just satisfy Required; an interactive terminal never
+    // surfaces workflows.
+    onWorkflowsList: () => {},
+    onWorkflowsGet: () => {},
+    onWorkflowsSave: () => {},
+    onWorkflowsRemove: () => {},
+    onWorkflowsRun: () => {},
     onApprovalResponse: (id, decision) => {
       const resolve = this.pending.get(id);
       if (resolve) resolve(decision);
     },
+    onSelectResponse: (id, value) => {
+      const resolve = this.pendingSelects.get(id);
+      if (resolve) resolve(value);
+    },
+    onInputResponse: (id, value) => {
+      const resolve = this.pendingInputs.get(id);
+      if (resolve) resolve(value);
+    },
     onNoQuarter: (on) => {
       this.noQuarter = on;
       this.relay?.sendNoQuarter(on); // echo the ack back so the app's toggle syncs
@@ -120,6 +222,70 @@ export class RemoteBridge {
     });
   };
 
+  // Surface a one-line notice in the app's feed (command feedback).
+  sendNotice(text: string): void {
+    this.relay?.sendNotice(text);
+  }
+
+  // Advertise the terminal's available commands to the app (on attach).
+  sendCommands(commands: { name: string; description?: string }[]): void {
+    this.relay?.sendCommands(commands);
+  }
+
+  // Push the installed-extensions snapshot to the app's extensions manager.
+  sendExtensions(payload: ExtensionsPayload): void {
+    this.relay?.sendExtensions(payload);
+  }
+
+  // Push the skills snapshot to the app's skills manager.
+  sendSkills(payload: SkillsPayload): void {
+    this.relay?.sendSkills(payload);
+  }
+
+  // A CLI-initiated selection prompt: relay the options to the app and await its
+  // choice. Fail closed (null) if no controller, on abort, or on disconnect — the
+  // same posture as remoteAsk. Callers get the chosen `value` or null.
+  selectRemote = (req: SelectRequest, signal?: AbortSignal): Promise<string | null> => {
+    if (!this.relay || !this.relay.isConnected()) return Promise.resolve(null);
+    const id = randomUUID();
+    return new Promise<string | null>((resolve) => {
+      const onAbort = () => settle(null);
+      const settle = (v: string | null) => {
+        this.pendingSelects.delete(id);
+        signal?.removeEventListener("abort", onAbort);
+        resolve(v);
+      };
+      this.pendingSelects.set(id, settle);
+      if (signal) {
+        if (signal.aborted) return onAbort();
+        signal.addEventListener("abort", onAbort, { once: true });
+      }
+      this.relay!.requestSelect(id, req);
+    });
+  };
+
+  // A CLI-initiated free-form text prompt: relay it to the app and await the typed
+  // line. Same fail-closed posture as selectRemote — null if no controller, on
+  // abort, or on disconnect. Callers get the submitted string or null.
+  inputRemote = (req: InputRequest, signal?: AbortSignal): Promise<string | null> => {
+    if (!this.relay || !this.relay.isConnected()) return Promise.resolve(null);
+    const id = randomUUID();
+    return new Promise<string | null>((resolve) => {
+      const onAbort = () => settle(null);
+      const settle = (v: string | null) => {
+        this.pendingInputs.delete(id);
+        signal?.removeEventListener("abort", onAbort);
+        resolve(v);
+      };
+      this.pendingInputs.set(id, settle);
+      if (signal) {
+        if (signal.aborted) return onAbort();
+        signal.addEventListener("abort", onAbort, { once: true });
+      }
+      this.relay!.requestInput(id, req);
+    });
+  };
+
   // ── turn lifecycle + event forwarding ───────────────────────────────────────
 
   // Mark the end of a turn so the next (possibly local) turn isn't treated as
@@ -148,5 +314,11 @@ export class RemoteBridge {
   private rejectAllPending(): void {
     for (const resolve of this.pending.values()) resolve("deny");
     this.pending.clear();
+    // A relayed selection prompt whose controller vanished resolves to "no choice".
+    for (const resolve of this.pendingSelects.values()) resolve(null);
+    this.pendingSelects.clear();
+    // Same for a relayed text prompt: a gone controller resolves to "no input".
+    for (const resolve of this.pendingInputs.values()) resolve(null);
+    this.pendingInputs.clear();
   }
 }

package/src/remote/routinesControl.ts

@@ -0,0 +1,216 @@
+/**
+ * Routine management for the app.
+ *
+ * A UI-agnostic wrapper over the routines store so the app (over the relay) can
+ * see the daemon's saved routines and create / edit / delete / pause / run them —
+ * the sibling of extensionsControl.ts and skillsControl.ts, but for scheduled
+ * tasks rather than Pi packages/skills.
+ *
+ * Unlike those two, routines are owned by the DAEMON (not an interactive Pi
+ * session): they live in routines.json (see routines/store.ts) and fire from the
+ * resident scheduler. So this control is wired into the daemon's own relay
+ * connection (the "Privateer Routines" terminal), not the REPL/TUI. Running a
+ * routine now is the one action that needs the daemon itself, so it's injected as
+ * `runNow` rather than reaching back into the store.
+ *
+ * Framework-agnostic: nothing here imports React or the relay. The caller owns the
+ * frame plumbing and the run seam.
+ */
+import {
+  loadRoutines,
+  upsertRoutine,
+  removeRoutine,
+  findRoutine,
+} from "../routines/store.ts";
+import {
+  DELIVERY_CHANNELS,
+  webhookName,
+  newRoutineId,
+  type Routine,
+} from "../routines/schema.ts";
+import { triggerError, computeNextRun } from "../routines/trigger.ts";
+
+// One routine as surfaced to the app. This is the full Routine shape (the user's
+// own config shown back to the user's own app), so an edit can round-trip every
+// field. NON-secret by nature — the prompt/cwd/model are what the user authored.
+export interface RemoteRoutine {
+  id: string;
+  name: string;
+  cron?: string;
+  at?: string;
+  prompt: string;
+  cwd: string;
+  model?: string;
+  delivery: string[];
+  tools?: string[];
+  enabled: boolean;
+  lastRun?: string;
+  lastStatus?: "ok" | "error";
+  lastError?: string;
+  nextRun?: string;
+}
+
+// An app-submitted create/edit. `id` present → edit that routine (bookkeeping
+// fields are preserved); absent → create a new one. Everything else mirrors the
+// create_routine tool's parameters.
+export interface RoutineDraft {
+  id?: string;
+  name?: string;
+  cron?: string;
+  at?: string;
+  prompt?: string;
+  cwd?: string;
+  model?: string;
+  delivery?: string[];
+  tools?: string[];
+}
+
+export interface RoutinesControl {
+  // All saved routines (enabled + paused), most-recently-scheduled first.
+  list(): RemoteRoutine[];
+  // Create (no id) or edit (id) a routine. Validates the trigger + delivery and
+  // schedules nextRun. On an edit, the existing run bookkeeping is preserved.
+  save(draft: RoutineDraft): { ok: boolean; message?: string };
+  // Remove a routine by id or name. ok:false when nothing matched.
+  remove(idOrName: string): { ok: boolean; message?: string };
+  // Pause/resume a routine. Resuming reschedules nextRun; pausing clears it.
+  setEnabled(idOrName: string, enabled: boolean): { ok: boolean; message?: string };
+  // Run a routine now (fire-and-forget on the daemon). ok:false when not found.
+  run(idOrName: string): { ok: boolean; message?: string };
+}
+
+const KNOWN_CHANNELS = new Set<string>(DELIVERY_CHANNELS);
+
+function cleanStrList(v: unknown): string[] | undefined {
+  if (!Array.isArray(v)) return undefined;
+  const out = v.map((x) => String(x ?? "").trim()).filter(Boolean);
+  return out.length > 0 ? out : undefined;
+}
+
+// Validate a delivery list: each entry is a known channel or "webhook:<name>".
+// (Webhook existence is checked against config by an injected `webhookExists`, so
+// the routine can't silently reference an undeclared endpoint.)
+function deliveryError(delivery: string[], webhookExists: (name: string) => boolean): string | null {
+  for (const entry of delivery) {
+    const hook = webhookName(entry);
+    if (hook === null) {
+      if (!KNOWN_CHANNELS.has(entry)) return `unknown delivery channel "${entry}"`;
+    } else if (!webhookExists(hook)) {
+      return `webhook "${hook}" is not configured on this machine`;
+    }
+  }
+  return null;
+}
+
+function toRemote(r: Routine): RemoteRoutine {
+  return {
+    id: r.id,
+    name: r.name,
+    cron: r.cron,
+    at: r.at,
+    prompt: r.prompt,
+    cwd: r.cwd,
+    model: r.model,
+    delivery: r.delivery,
+    tools: r.tools,
+    enabled: r.enabled,
+    lastRun: r.lastRun,
+    lastStatus: r.lastStatus,
+    lastError: r.lastError,
+    nextRun: r.nextRun,
+  };
+}
+
+export function makeRoutinesControl(opts: {
+  // Working directory for a new routine when the draft omits `cwd` (the daemon's).
+  defaultCwd: () => string;
+  // Is a webhook name declared in config? Guards "webhook:<name>" delivery entries.
+  webhookExists?: (name: string) => boolean;
+  // Fire a routine now — injected by the daemon (its runRoutine). Absent → run is
+  // reported unavailable rather than silently dropped.
+  runNow?: (routine: Routine) => void;
+}): RoutinesControl {
+  const webhookExists = opts.webhookExists ?? (() => false);
+
+  return {
+    list(): RemoteRoutine[] {
+      // Order by soonest next run, then paused ones (no nextRun) last — a stable,
+      // useful order for the app without it having to sort.
+      return loadRoutines()
+        .map(toRemote)
+        .sort((a, b) => {
+          const ta = a.nextRun ? Date.parse(a.nextRun) : Infinity;
+          const tb = b.nextRun ? Date.parse(b.nextRun) : Infinity;
+          return ta - tb;
+        });
+    },
+
+    save(draft: RoutineDraft): { ok: boolean; message?: string } {
+      const name = (draft?.name ?? "").trim();
+      const prompt = (draft?.prompt ?? "").trim();
+      const cron = draft?.cron?.trim() || undefined;
+      const at = draft?.at?.trim() || undefined;
+      if (!name) return { ok: false, message: "A name is required." };
+      if (!prompt) return { ok: false, message: "A prompt is required." };
+
+      const trigErr = triggerError({ cron, at });
+      if (trigErr) return { ok: false, message: trigErr };
+
+      const delivery = cleanStrList(draft?.delivery) ?? ["file"];
+      const delErr = deliveryError(delivery, webhookExists);
+      if (delErr) return { ok: false, message: delErr };
+
+      const existing = draft?.id ? findRoutine(loadRoutines(), draft.id) : undefined;
+      // A rename must not collide with a *different* routine's name.
+      const clash = loadRoutines().find((r) => r.name.toLowerCase() === name.toLowerCase() && r.id !== existing?.id);
+      if (clash) return { ok: false, message: `A routine named "${name}" already exists.` };
+
+      const cwd = (draft?.cwd ?? "").trim() || existing?.cwd || opts.defaultCwd();
+      const model = (draft?.model ?? "").trim() || undefined;
+      const tools = cleanStrList(draft?.tools);
+      const nextRun = computeNextRun({ cron, at })?.toISOString();
+
+      const routine: Routine = {
+        // Preserve id + run bookkeeping on edit; mint a fresh id on create.
+        id: existing?.id ?? newRoutineId(),
+        name,
+        cron,
+        at,
+        prompt,
+        cwd,
+        model,
+        delivery: delivery as Routine["delivery"],
+        tools,
+        // Keep the enabled state on edit; new routines start enabled.
+        enabled: existing?.enabled ?? true,
+        lastRun: existing?.lastRun,
+        lastStatus: existing?.lastStatus,
+        lastError: existing?.lastError,
+        nextRun,
+      };
+      upsertRoutine(routine);
+      return { ok: true, message: existing ? `Updated "${name}".` : `Created "${name}".` };
+    },
+
+    remove(idOrName: string): { ok: boolean; message?: string } {
+      const removed = removeRoutine((idOrName ?? "").trim());
+      return removed ? { ok: true, message: `Removed "${removed.name}".` } : { ok: false, message: "Not found." };
+    },
+
+    setEnabled(idOrName: string, enabled: boolean): { ok: boolean; message?: string } {
+      const r = findRoutine(loadRoutines(), (idOrName ?? "").trim());
+      if (!r) return { ok: false, message: "Not found." };
+      const nextRun = enabled ? computeNextRun(r)?.toISOString() : undefined;
+      upsertRoutine({ ...r, enabled, nextRun });
+      return { ok: true, message: `${enabled ? "Resumed" : "Paused"} "${r.name}".` };
+    },
+
+    run(idOrName: string): { ok: boolean; message?: string } {
+      const r = findRoutine(loadRoutines(), (idOrName ?? "").trim());
+      if (!r) return { ok: false, message: "Not found." };
+      if (!opts.runNow) return { ok: false, message: "The scheduler can't run this right now." };
+      opts.runNow(r);
+      return { ok: true, message: `Running "${r.name}" now.` };
+    },
+  };
+}

package/src/remote/skillsControl.ts

@@ -0,0 +1,205 @@
+/**
+ * Skill management for linked terminals.
+ *
+ * A UI-agnostic wrapper over Pi's skills loader so the app (over the relay) can
+ * see which skills THIS terminal has, and create / edit / delete / toggle the
+ * user's OWN ones — the sibling of extensionsControl.ts (which does the same for
+ * Pi extensions). Both the dev REPL (src/cli/chat.ts) and the shipped TUI
+ * (extensions/privateer-gate.ts) build one of these and route the skills_* relay
+ * frames through it.
+ *
+ * A skill is a directory holding a SKILL.md (YAML frontmatter `name` +
+ * `description`, then a markdown instructions body); Pi auto-loads it into the
+ * system prompt and exposes it as `/skill:name`. See pi.dev/docs/latest/skills.
+ *
+ * Only the user's OWN skills — the ones under <agentDir>/skills/ — are editable.
+ * Skills that come from packages or the project tree surface read-only
+ * (editable:false); we never rewrite or delete files we didn't author.
+ *
+ * Framework-agnostic: nothing here imports React or the relay. The caller owns the
+ * frame plumbing and hands us a SettingsManager (the REPL reuses the session's;
+ * the TUI creates a fresh one — both read the same ~/.privateer/agent/settings.json).
+ */
+import { promises as fs } from "node:fs";
+import * as path from "node:path";
+import { loadSkills } from "@earendil-works/pi-coding-agent";
+import type { SettingsManager } from "@earendil-works/pi-coding-agent";
+
+// One skill as surfaced to the app. NON-PII: a name + description + a coarse
+// `source` label ("user"/"project"/a package name) — no absolute paths. `editable`
+// is true only for the user's own skills under <agentDir>/skills/, which we may
+// rewrite/delete. `disabled` mirrors the SKILL.md `disable-model-invocation` flag.
+export interface RemoteSkill {
+  name: string;
+  description: string;
+  source: string;
+  editable: boolean;
+  disabled: boolean;
+}
+
+export interface SkillDraft {
+  name: string;
+  description: string;
+  instructions: string;
+}
+
+export interface SkillsControl {
+  // All discovered skills (user + project + package), user ones flagged editable.
+  listSkills(): RemoteSkill[];
+  // Create or overwrite a user skill at <agentDir>/skills/<name>/SKILL.md.
+  createSkill(draft: SkillDraft): Promise<{ ok: boolean; message?: string }>;
+  // Delete a user skill's directory. Refuses non-editable (package/project) skills.
+  deleteSkill(name: string): Promise<{ ok: boolean; message?: string }>;
+  // Flip a user skill's `disable-model-invocation` frontmatter (editable only).
+  setEnabled(name: string, enabled: boolean): Promise<{ ok: boolean; message?: string }>;
+}
+
+// A skill name per the Agent Skills standard: lowercase a-z0-9-, ≤64 chars, no
+// leading/trailing/consecutive hyphens. Doubles as the directory name, so this also
+// keeps it filesystem-safe (no slashes, dots, traversal).
+const NAME_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+
+function validName(name: string): boolean {
+  return typeof name === "string" && name.length > 0 && name.length <= 64 && NAME_RE.test(name);
+}
+
+// Serialize a SKILL.md: YAML frontmatter (name, description, and the invocation
+// flag only when disabled) + the instructions body. Values are single-line and
+// name-validated, so a plain quoted scalar is safe without a YAML dependency.
+function renderSkillMd(draft: SkillDraft, disabled: boolean): string {
+  const q = (s: string) => JSON.stringify(String(s ?? "")); // JSON string ⊂ YAML flow scalar
+  const lines = ["---", `name: ${q(draft.name)}`, `description: ${q(draft.description)}`];
+  if (disabled) lines.push("disable-model-invocation: true");
+  lines.push("---", "");
+  const body = (draft.instructions ?? "").replace(/\r\n/g, "\n").trimEnd();
+  return lines.join("\n") + (body ? body + "\n" : "");
+}
+
+export function makeSkillsControl(opts: {
+  cwd: string;
+  agentDir: string;
+  settingsManager: SettingsManager;
+}): SkillsControl {
+  // The user's own global skills live here; only these are editable.
+  const userSkillsDir = path.join(opts.agentDir, "skills");
+
+  // Is this loaded skill one of ours (under <agentDir>/skills/)? Compared on the
+  // skill's baseDir/filePath so a symlinked or package skill of the same name can't
+  // masquerade as editable.
+  function isEditable(baseDir: string | undefined, filePath: string): boolean {
+    const p = path.resolve(baseDir || path.dirname(filePath));
+    const root = path.resolve(userSkillsDir);
+    return p === root || p.startsWith(root + path.sep);
+  }
+
+  function load(): RemoteSkill[] {
+    let skillPaths: string[] = [];
+    try {
+      skillPaths = opts.settingsManager.getSkillPaths() ?? [];
+    } catch {
+      skillPaths = [];
+    }
+    let result;
+    try {
+      result = loadSkills({ cwd: opts.cwd, agentDir: opts.agentDir, skillPaths, includeDefaults: true });
+    } catch {
+      return [];
+    }
+    return result.skills.map((sk) => ({
+      name: sk.name,
+      description: sk.description,
+      source: sk.sourceInfo?.scope === "project" ? "project" : sk.sourceInfo?.source || "user",
+      editable: isEditable(sk.baseDir, sk.filePath),
+      disabled: !!sk.disableModelInvocation,
+    }));
+  }
+
+  // The user skill file to rewrite/delete for `name`. Only ever inside userSkillsDir.
+  function skillDir(name: string): string {
+    return path.join(userSkillsDir, name);
+  }
+
+  return {
+    listSkills(): RemoteSkill[] {
+      return load();
+    },
+
+    async createSkill(draft: SkillDraft): Promise<{ ok: boolean; message?: string }> {
+      const name = (draft?.name ?? "").trim();
+      const description = (draft?.description ?? "").trim();
+      if (!validName(name)) {
+        return { ok: false, message: "Name must be lowercase letters, numbers and single hyphens (max 64)." };
+      }
+      if (!description) return { ok: false, message: "A description is required." };
+      // Refuse to shadow a non-editable skill (package/project) that owns this name.
+      const clash = load().find((s) => s.name === name && !s.editable);
+      if (clash) return { ok: false, message: `A ${clash.source} skill named "${name}" already exists.` };
+      // Preserve the disabled state on edit; a brand-new skill defaults to enabled.
+      const existing = load().find((s) => s.name === name && s.editable);
+      const disabled = existing?.disabled ?? false;
+      try {
+        const dir = skillDir(name);
+        await fs.mkdir(dir, { recursive: true });
+        await fs.writeFile(path.join(dir, "SKILL.md"), renderSkillMd({ name, description, instructions: draft.instructions }, disabled), "utf8");
+        return { ok: true };
+      } catch (e) {
+        return { ok: false, message: (e as Error).message };
+      }
+    },
+
+    async deleteSkill(name: string): Promise<{ ok: boolean; message?: string }> {
+      const n = (name ?? "").trim();
+      if (!validName(n)) return { ok: false, message: "Unknown skill." };
+      const skill = load().find((s) => s.name === n);
+      if (!skill) return { ok: false, message: "Not found." };
+      if (!skill.editable) return { ok: false, message: "That skill is read-only." };
+      try {
+        await fs.rm(skillDir(n), { recursive: true, force: true });
+        return { ok: true };
+      } catch (e) {
+        return { ok: false, message: (e as Error).message };
+      }
+    },
+
+    async setEnabled(name: string, enabled: boolean): Promise<{ ok: boolean; message?: string }> {
+      const n = (name ?? "").trim();
+      if (!validName(n)) return { ok: false, message: "Unknown skill." };
+      const skill = load().find((s) => s.name === n);
+      if (!skill) return { ok: false, message: "Not found." };
+      if (!skill.editable) return { ok: false, message: "That skill is read-only." };
+      try {
+        const file = path.join(skillDir(n), "SKILL.md");
+        const raw = await fs.readFile(file, "utf8");
+        const rewritten = toggleFrontmatterFlag(raw, !enabled);
+        await fs.writeFile(file, rewritten, "utf8");
+        return { ok: true };
+      } catch (e) {
+        return { ok: false, message: (e as Error).message };
+      }
+    },
+  };
+}
+
+// Set or clear `disable-model-invocation` in an existing SKILL.md's frontmatter,
+// preserving the rest of the file byte-for-byte. Rewrites only the flag line.
+function toggleFrontmatterFlag(raw: string, disabled: boolean): string {
+  const nl = raw.includes("\r\n") ? "\r\n" : "\n";
+  const lines = raw.split(/\r?\n/);
+  if (lines[0]?.trim() !== "---") {
+    // No frontmatter — synthesize a minimal one so the flag lands somewhere valid.
+    return `---${nl}disable-model-invocation: ${disabled}${nl}---${nl}${raw}`;
+  }
+  let end = -1;
+  for (let i = 1; i < lines.length; i++) {
+    if (lines[i].trim() === "---") { end = i; break; }
+  }
+  if (end === -1) return raw; // malformed; leave untouched
+  const flagIdx = lines.findIndex((l, i) => i > 0 && i < end && /^\s*disable-model-invocation\s*:/.test(l));
+  if (disabled) {
+    if (flagIdx === -1) lines.splice(end, 0, "disable-model-invocation: true");
+    else lines[flagIdx] = "disable-model-invocation: true";
+  } else if (flagIdx !== -1) {
+    lines.splice(flagIdx, 1);
+  }
+  return lines.join(nl);
+}