@almyty/skills 1.3.0 → 1.5.1

package/dist/client.d.ts

@@ -7,7 +7,14 @@ export interface GatewayInfo {
     id: string;
     name: string;
     type: string;
+    /** The gateway's address, e.g. /petstore; the install ref resolves by it first. */
+    endpoint?: string;
 }
+/**
+ * The gateway segment of an install ref: the address slug, else the name
+ * as a clean slug (a-z0-9, single dashes), the two forms the server resolves.
+ */
+export declare function gatewayRefSlug(gw: Pick<GatewayInfo, 'name' | 'endpoint'>): string;
 export interface ParsedRef {
     type: 'gateway' | 'skill' | 'search' | 'uuid';
     orgSlug?: string;

package/dist/client.js

@@ -1,3 +1,13 @@
+/**
+ * The gateway segment of an install ref: the address slug, else the name
+ * as a clean slug (a-z0-9, single dashes), the two forms the server resolves.
+ */
+export function gatewayRefSlug(gw) {
+    const fromEndpoint = (gw.endpoint ?? '').replace(/^\/+/, '');
+    if (fromEndpoint)
+        return fromEndpoint;
+    return (gw.name ?? '').toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|(?<!-)-+$/g, '');
+}
 export function parseRef(ref) {
     if (!ref)
         return { type: 'search', raw: ref };
@@ -91,6 +101,7 @@ export class AlmytyClient {
             id: gw.id,
             name: gw.name,
             type: gw.type,
+            endpoint: gw.endpoint ?? undefined,
         }));
     }
     async searchSkills(query) {
@@ -173,7 +184,7 @@ export class AlmytyClient {
                 }
                 if (trimmed.length > room)
                     trimmed = trimmed.slice(-room);
-                return `${gw}-${trimmed.replace(/^-+|-+$/g, '')}`;
+                return `${gw}-${trimmed.replace(/^-+|(?<!-)-+$/g, '')}`;
             };
             const match = allTools.find((gt) => {
                 const t = gt.tool || gt;

package/dist/index.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { resolveCredentials } from './auth.js';
-import { AlmytyClient, parseRef } from './client.js';
+import { AlmytyClient, gatewayRefSlug, parseRef } from './client.js';
 import { getAllTargets } from './agents.js';
 import { installSkills, removeSkills, listInstalledSkills } from './installer.js';
 import { loadConfig, resolveTargets } from './config.js';
@@ -101,7 +101,7 @@ async function main() {
             }
             console.log('\nYour gateways:\n');
             for (const gw of gateways) {
-                const slug = gw.name.toLowerCase().replace(/\s+/g, '-');
+                const slug = gatewayRefSlug(gw);
                 console.log(`  ${gw.name}`);
                 console.log(`    Type: ${gw.type}`);
                 console.log(`    Use:  npx @almyty/skills install <org>/${slug}`);

package/dist/installer.d.ts

@@ -11,6 +11,18 @@
  */
 import type { SkillFile } from './client.js';
 import type { AgentTarget } from './agents.js';
+/** Marker line we expect inside every SKILL.md frontmatter we wrote.
+ *  The leading run stops at a line break: as `^\s*` in a multiline regex
+ *  every line start rescanned all the blank lines after it, and 100 KB of
+ *  them in a SKILL.md (its content is the gateway's) took seven seconds.
+ *  A match that crossed blank lines also matches from the last of them. */
+export declare const ALMYTY_MARKER: RegExp;
+/**
+ * A SKILL.md is a page of markdown; anything bigger than this is not a
+ * skill the backend generated and is refused rather than written into an
+ * editor's config.
+ */
+export declare const MAX_SKILL_BYTES: number;
 export interface InstallResult {
     agent: string;
     skillsDir: string;

package/dist/installer.js

@@ -9,13 +9,17 @@
  * and `installed` now reads the `metadata.author: almyty` line
  * already present in every SKILL.md we generate.
  */
-import { writeFileSync, mkdirSync, existsSync, readdirSync, rmSync, readFileSync } from 'fs';
+import { writeFileSync, mkdirSync, existsSync, readdirSync, rmSync, readFileSync, lstatSync } from 'fs';
 import { join, resolve, sep } from 'path';
 /** Legacy prefix from <=v1.0.9 — older installs still use this dir
  *  name. Kept here so `remove`/`installed` continue to find them. */
 const LEGACY_SKILL_PREFIX = 'almyty-';
-/** Marker line we expect inside every SKILL.md frontmatter we wrote. */
-const ALMYTY_MARKER = /^\s*author:\s*almyty\s*$/m;
+/** Marker line we expect inside every SKILL.md frontmatter we wrote.
+ *  The leading run stops at a line break: as `^\s*` in a multiline regex
+ *  every line start rescanned all the blank lines after it, and 100 KB of
+ *  them in a SKILL.md (its content is the gateway's) took seven seconds.
+ *  A match that crossed blank lines also matches from the last of them. */
+export const ALMYTY_MARKER = /^[^\S\n\r\u2028\u2029]*author:\s*almyty\s*$/m;
 /**
  * Skill names come from the backend/gateway and are used to build
  * filesystem paths under skillsDir. A malicious or compromised gateway
@@ -40,6 +44,26 @@ function isInside(baseDir, candidate) {
     const target = resolve(candidate);
     return target === base || target.startsWith(base + sep);
 }
+/**
+ * A SKILL.md is a page of markdown; anything bigger than this is not a
+ * skill the backend generated and is refused rather than written into an
+ * editor's config.
+ */
+export const MAX_SKILL_BYTES = 1024 * 1024;
+/**
+ * True when the path exists and is a symbolic link. The name check and
+ * `isInside` work on the path string; a link already sitting at
+ * `<skillsDir>/<name>` (or at its SKILL.md) would still send the write
+ * somewhere else, so links are refused rather than followed.
+ */
+function isSymlink(path) {
+    try {
+        return lstatSync(path).isSymbolicLink();
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Strip the legacy `name: almyty-<x>` line in the SKILL.md frontmatter
  * to `name: <x>` so the agent-visible identifier is the skill's own
@@ -100,6 +124,14 @@ export function installSkills(skills, target, options = {}) {
             console.warn(`Skipping skill whose path escapes the skills directory: ${skill.name}`);
             continue;
         }
+        if (isSymlink(skillDir) || isSymlink(skillFile)) {
+            console.warn(`Skipping skill whose path is a symbolic link: ${skill.name}`);
+            continue;
+        }
+        if (typeof skill.content !== 'string' || Buffer.byteLength(skill.content, 'utf-8') > MAX_SKILL_BYTES) {
+            console.warn(`Skipping skill with missing or oversized content: ${skill.name}`);
+            continue;
+        }
         if (existsSync(skillFile))
             overwritten++;
         if (dryRun) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@almyty/skills",
-  "version": "1.3.0",
+  "version": "1.5.1",
   "publishConfig": {
     "access": "public"
   },
@@ -35,7 +35,7 @@
   "author": "almyty",
   "license": "Apache-2.0",
   "dependencies": {
-    "@almyty/client": "^1.2.0",
+    "@almyty/client": "^1.5.0",
     "@clack/prompts": "^1.2.0"
   },
   "devDependencies": {