v0.4.0

Adds two new configuration blocks to melon.yaml: custom index and source policy.

The index block lets teams point melon search at a private skill registry alongside (or instead of) the public melon index. GitHub web URLs and path-style references are automatically normalized, so the same format used for dependencies works here too.

The policy block lets teams restrict which GitHub repositories skills can be installed from via an allowed_sources allowlist with glob support. Blocked sources are rejected at melon add, melon search, and melon install before any network calls are made.

Also includes a performance improvement: melon add and melon remove now operate on only the target dependency rather than re-resolving and reinstalling the full dependency graph.

Changelog

• c889621 Merge pull request #35 from playsthisgame/index-url
• c14676e creating a policy that allows users to set a allowed_sources field such that we can only install from approved sources
• 05149a0 fixing a typo in the readme