@clinebot/core 0.0.11 → 0.0.12

package/src/runtime/runtime-builder.test.ts

@@ -301,4 +301,71 @@ Disabled skill.`,
 
 		runtime.shutdown("test");
 	});
+
+	it("scopes skills tool to session-configured skills", async () => {
+		const cwd = mkdtempSync(join(tmpdir(), "runtime-builder-skills-scoped-"));
+		const commitDir = join(cwd, ".cline", "skills", "commit");
+		const reviewDir = join(cwd, ".cline", "skills", "review");
+		mkdirSync(commitDir, { recursive: true });
+		mkdirSync(reviewDir, { recursive: true });
+		writeFileSync(
+			join(commitDir, "SKILL.md"),
+			`---
+name: commit
+---
+Commit skill.`,
+			"utf8",
+		);
+		writeFileSync(
+			join(reviewDir, "SKILL.md"),
+			`---
+name: review
+---
+Review skill.`,
+			"utf8",
+		);
+
+		const runtime = new DefaultRuntimeBuilder().build({
+			config: {
+				providerId: "anthropic",
+				modelId: "claude-sonnet-4-6",
+				apiKey: "key",
+				systemPrompt: "test",
+				cwd,
+				enableTools: true,
+				enableSpawnAgent: false,
+				enableAgentTeams: false,
+				skills: ["commit"],
+			},
+		});
+
+		const skillsTool = runtime.tools.find((tool) => tool.name === "skills");
+		expect(skillsTool).toBeDefined();
+		if (!skillsTool) {
+			throw new Error("Expected skills tool.");
+		}
+
+		const known = await skillsTool.execute(
+			{ skill: "commit" },
+			{
+				agentId: "agent-1",
+				conversationId: "conv-1",
+				iteration: 1,
+			},
+		);
+		expect(known).toContain("<command-name>commit</command-name>");
+
+		const blocked = await skillsTool.execute(
+			{ skill: "review" },
+			{
+				agentId: "agent-1",
+				conversationId: "conv-1",
+				iteration: 1,
+			},
+		);
+		expect(blocked).toContain('Skill "review" not found.');
+		expect(blocked).toContain("Available skills: commit");
+
+		runtime.shutdown("test");
+	});
 });

package/src/runtime/runtime-builder.ts

@@ -86,27 +86,72 @@ const SKILL_FILE_NAME = "SKILL.md";
 
 function listAvailableSkillNames(
 	watcher: UserInstructionConfigWatcher,
+	allowedSkillNames?: ReadonlyArray<string>,
 ): string[] {
-	return listConfiguredSkills(watcher)
+	return listConfiguredSkills(watcher, allowedSkillNames)
 		.filter((skill) => !skill.disabled)
 		.map((skill) => skill.name.trim())
 		.filter((name) => name.length > 0)
 		.sort((a, b) => a.localeCompare(b));
 }
 
+function normalizeSkillToken(token: string): string {
+	return token.trim().replace(/^\/+/, "").toLowerCase();
+}
+
+function toAllowedSkillSet(
+	allowedSkillNames?: ReadonlyArray<string>,
+): Set<string> | undefined {
+	if (!allowedSkillNames || allowedSkillNames.length === 0) {
+		return undefined;
+	}
+	const normalized = allowedSkillNames
+		.map(normalizeSkillToken)
+		.filter((token) => token.length > 0);
+	return normalized.length > 0 ? new Set(normalized) : undefined;
+}
+
+function isSkillAllowed(
+	skillId: string,
+	skillName: string,
+	allowedSkills?: Set<string>,
+): boolean {
+	if (!allowedSkills) {
+		return true;
+	}
+	const normalizedId = normalizeSkillToken(skillId);
+	const normalizedName = normalizeSkillToken(skillName);
+	const bareId = normalizedId.includes(":")
+		? (normalizedId.split(":").at(-1) ?? normalizedId)
+		: normalizedId;
+	const bareName = normalizedName.includes(":")
+		? (normalizedName.split(":").at(-1) ?? normalizedName)
+		: normalizedName;
+	return (
+		allowedSkills.has(normalizedId) ||
+		allowedSkills.has(normalizedName) ||
+		allowedSkills.has(bareId) ||
+		allowedSkills.has(bareName)
+	);
+}
+
 function listConfiguredSkills(
 	watcher: UserInstructionConfigWatcher,
+	allowedSkillNames?: ReadonlyArray<string>,
 ): SkillsExecutorMetadataItem[] {
+	const allowedSkills = toAllowedSkillSet(allowedSkillNames);
 	const snapshot = watcher.getSnapshot("skill");
-	return [...snapshot.entries()].map(([id, record]) => {
-		const skill = record.item as SkillConfig;
-		return {
-			id,
-			name: skill.name.trim(),
-			description: skill.description?.trim(),
-			disabled: skill.disabled === true,
-		};
-	});
+	return [...snapshot.entries()]
+		.map(([id, record]) => {
+			const skill = record.item as SkillConfig;
+			return {
+				id,
+				name: skill.name.trim(),
+				description: skill.description?.trim(),
+				disabled: skill.disabled === true,
+			};
+		})
+		.filter((skill) => isSkillAllowed(skill.id, skill.name, allowedSkills));
 }
 
 function hasSkillsFiles(workspacePath: string): boolean {
@@ -141,14 +186,21 @@ function hasSkillsFiles(workspacePath: string): boolean {
 function resolveSkillRecord(
 	watcher: UserInstructionConfigWatcher,
 	requestedSkill: string,
+	allowedSkillNames?: ReadonlyArray<string>,
 ): { id: string; skill: SkillConfig } | { error: string } {
+	const allowedSkills = toAllowedSkillSet(allowedSkillNames);
 	const normalized = requestedSkill.trim().replace(/^\/+/, "").toLowerCase();
 	if (!normalized) {
 		return { error: "Missing skill name." };
 	}
 
 	const snapshot = watcher.getSnapshot("skill");
-	const exact = snapshot.get(normalized);
+	const scopedEntries = [...snapshot.entries()].filter(([id, record]) => {
+		const skill = record.item as SkillConfig;
+		return isSkillAllowed(id, skill.name, allowedSkills);
+	});
+	const scopedSnapshot = new Map(scopedEntries);
+	const exact = scopedSnapshot.get(normalized);
 	if (exact) {
 		const skill = exact.item as SkillConfig;
 		if (skill.disabled === true) {
@@ -166,7 +218,7 @@ function resolveSkillRecord(
 		? (normalized.split(":").at(-1) ?? normalized)
 		: normalized;
 
-	const suffixMatches = [...snapshot.entries()].filter(([id]) => {
+	const suffixMatches = [...scopedSnapshot.entries()].filter(([id]) => {
 		if (id === bareName) {
 			return true;
 		}
@@ -193,7 +245,7 @@ function resolveSkillRecord(
 		};
 	}
 
-	const available = listAvailableSkillNames(watcher);
+	const available = listAvailableSkillNames(watcher, allowedSkillNames);
 	return {
 		error:
 			available.length > 0
@@ -205,11 +257,12 @@ function resolveSkillRecord(
 function createSkillsExecutor(
 	watcher: UserInstructionConfigWatcher,
 	watcherReady: Promise<void>,
+	allowedSkillNames?: ReadonlyArray<string>,
 ): SkillsExecutorWithMetadata {
 	const runningSkills = new Set<string>();
 	const executor: SkillsExecutorWithMetadata = async (skillName, args) => {
 		await watcherReady;
-		const resolved = resolveSkillRecord(watcher, skillName);
+		const resolved = resolveSkillRecord(watcher, skillName, allowedSkillNames);
 		if ("error" in resolved) {
 			return resolved.error;
 		}
@@ -235,7 +288,7 @@ function createSkillsExecutor(
 		}
 	};
 	Object.defineProperty(executor, "configuredSkills", {
-		get: () => listConfiguredSkills(watcher),
+		get: () => listConfiguredSkills(watcher, allowedSkillNames),
 		enumerable: true,
 		configurable: false,
 	});
@@ -340,11 +393,12 @@ export class DefaultRuntimeBuilder implements RuntimeBuilder {
 			userInstructionWatcher &&
 			(watcherProvided ||
 				hasSkillsFiles(config.cwd) ||
-				listConfiguredSkills(userInstructionWatcher).length > 0)
+				listConfiguredSkills(userInstructionWatcher, config.skills).length > 0)
 		) {
 			skillsExecutor = createSkillsExecutor(
 				userInstructionWatcher,
 				watcherReady,
+				config.skills,
 			);
 		}
 

package/src/runtime/sandbox/subprocess-sandbox.ts

@@ -15,9 +15,19 @@ interface SandboxResponseMessage {
 	error?: { message: string; stack?: string };
 }
 
+interface SandboxEventMessage {
+	type: "event";
+	name: string;
+	payload?: unknown;
+}
+
 export interface SubprocessSandboxOptions {
-	bootstrapScript: string;
+	/** Inline script to execute via `node -e`. Mutually exclusive with {@link bootstrapFile}. */
+	bootstrapScript?: string;
+	/** Path to a JavaScript file to execute via `node <file>`. Mutually exclusive with {@link bootstrapScript}. */
+	bootstrapFile?: string;
 	name?: string;
+	onEvent?: (event: { name: string; payload?: unknown }) => void;
 }
 
 export interface SandboxCallOptions {
@@ -52,16 +62,16 @@ export class SubprocessSandbox {
 			return;
 		}
 
-		const child = spawn(
-			process.execPath,
-			["-e", this.options.bootstrapScript],
-			{
-				stdio: ["ignore", "ignore", "ignore", "ipc"],
-			},
-		);
+		const args = this.options.bootstrapFile
+			? [this.options.bootstrapFile]
+			: ["-e", this.options.bootstrapScript ?? ""];
+
+		const child = spawn(process.execPath, args, {
+			stdio: ["ignore", "ignore", "ignore", "ipc"],
+		});
 		this.process = child;
 		child.on("message", (message) => {
-			this.onMessage(message as SandboxResponseMessage);
+			this.onMessage(message as SandboxResponseMessage | SandboxEventMessage);
 		});
 		child.on("error", (error) => {
 			this.failPending(
@@ -171,8 +181,22 @@ export class SubprocessSandbox {
 		this.failPending(new Error(`${this.options.name ?? "sandbox"} shutdown`));
 	}
 
-	private onMessage(message: SandboxResponseMessage): void {
-		if (!message || message.type !== "response" || !message.id) {
+	private onMessage(
+		message: SandboxResponseMessage | SandboxEventMessage,
+	): void {
+		if (!message) {
+			return;
+		}
+		if (message.type === "event") {
+			if (typeof message.name === "string" && message.name.length > 0) {
+				this.options.onEvent?.({
+					name: message.name,
+					payload: message.payload,
+				});
+			}
+			return;
+		}
+		if (message.type !== "response" || !message.id) {
 			return;
 		}
 		const pending = this.pending.get(message.id);

package/src/session/default-session-manager.e2e.test.ts

@@ -11,8 +11,9 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import type { AgentResult } from "@clinebot/agents";
 import type { LlmsProviders } from "@clinebot/llms";
+import { setClineDir, setHomeDir } from "@clinebot/shared/storage";
 import { nanoid } from "nanoid";
-import { afterEach, describe, expect, it, vi } from "vitest";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import type { SessionSource, SessionStatus } from "../types/common";
 import { DefaultSessionManager } from "./default-session-manager";
 import type { SessionManifest } from "./session-manifest";
@@ -222,12 +223,30 @@ class LocalFileSessionService {
 }
 
 describe("DefaultSessionManager e2e", () => {
+	const envSnapshot = {
+		HOME: process.env.HOME,
+		CLINE_DIR: process.env.CLINE_DIR,
+	};
 	const tempDirs: string[] = [];
+	let isolatedHomeDir = "";
+
+	beforeEach(() => {
+		isolatedHomeDir = mkdtempSync(join(tmpdir(), "core-session-home-"));
+		process.env.HOME = isolatedHomeDir;
+		process.env.CLINE_DIR = join(isolatedHomeDir, ".cline");
+		setHomeDir(isolatedHomeDir);
+		setClineDir(process.env.CLINE_DIR);
+	});
 
 	afterEach(() => {
+		process.env.HOME = envSnapshot.HOME;
+		process.env.CLINE_DIR = envSnapshot.CLINE_DIR;
+		setHomeDir(envSnapshot.HOME ?? "~");
+		setClineDir(envSnapshot.CLINE_DIR ?? join("~", ".cline"));
 		for (const dir of tempDirs.splice(0)) {
 			rmSync(dir, { recursive: true, force: true });
 		}
+		rmSync(isolatedHomeDir, { recursive: true, force: true });
 	});
 
 	it("runs an interactive lifecycle with real artifact files", async () => {