@csark0812/skeleton 1.5.5 → 1.5.7

package/dist/hooks/customize-on-skill-read.js

@@ -3028,6 +3028,7 @@ var require_utils = __commonJS((exports, module) => {
   var isHexPair = RegExp.prototype.test.bind(/^[\da-f]{2}$/iu);
   var isUnreserved = RegExp.prototype.test.bind(/^[\da-z\-._~]$/iu);
   var isPathCharacter = RegExp.prototype.test.bind(/^[\da-z\-._~!$&'()*+,;=:@/]$/iu);
+  var isQueryFragmentCharacter = RegExp.prototype.test.bind(/^[\da-z\-._~!$&'()*+,;=:@/?]$/iu);
   function stringArrayToHexStripped(input) {
     let acc = "";
     let code = 0;
@@ -3171,7 +3172,7 @@ var require_utils = __commonJS((exports, module) => {
             continue;
           }
         } else if (input[0] === "/") {
-          if (input[1] === "." || input[1] === "/") {
+          if (input[1] === ".") {
             output.push("/");
             break;
           }
@@ -3253,10 +3254,30 @@ var require_utils = __commonJS((exports, module) => {
     }
     return output;
   }
+  var BYTE_HEX = new Array(256);
+  {
+    const HEX_DIGITS = "0123456789ABCDEF";
+    for (let i = 0;i < 256; i++) {
+      BYTE_HEX[i] = "%" + HEX_DIGITS[i >> 4] + HEX_DIGITS[i & 15];
+    }
+  }
+  function isEscapeSafe(cp) {
+    return cp >= 48 && cp <= 57 || cp >= 65 && cp <= 90 || cp >= 97 && cp <= 122 || cp === 42 || cp === 43 || cp === 45 || cp === 46 || cp === 47 || cp === 64 || cp === 95;
+  }
+  function percentEncodeNonAscii(cp) {
+    if (cp < 2048) {
+      return BYTE_HEX[192 | cp >> 6] + BYTE_HEX[128 | cp & 63];
+    }
+    if (cp < 65536) {
+      return BYTE_HEX[224 | cp >> 12] + BYTE_HEX[128 | cp >> 6 & 63] + BYTE_HEX[128 | cp & 63];
+    }
+    return BYTE_HEX[240 | cp >> 18] + BYTE_HEX[128 | cp >> 12 & 63] + BYTE_HEX[128 | cp >> 6 & 63] + BYTE_HEX[128 | cp & 63];
+  }
   function normalizePathEncoding(input) {
     let output = "";
     for (let i = 0;i < input.length; i++) {
-      if (input[i] === "%" && i + 2 < input.length) {
+      const ch = input[i];
+      if (ch === "%" && i + 2 < input.length) {
         const hex = input.slice(i + 1, i + 3);
         if (isHexPair(hex)) {
           const normalizedHex = hex.toUpperCase();
@@ -3270,10 +3291,66 @@ var require_utils = __commonJS((exports, module) => {
           continue;
         }
       }
-      if (isPathCharacter(input[i])) {
-        output += input[i];
+      if (isPathCharacter(ch)) {
+        output += ch;
       } else {
-        output += escape(input[i]);
+        const code = input.charCodeAt(i);
+        if (code < 128) {
+          output += isEscapeSafe(code) ? ch : BYTE_HEX[code];
+        } else if (code < 55296 || code > 57343) {
+          output += percentEncodeNonAscii(code);
+        } else if (code <= 56319 && i + 1 < input.length) {
+          const low = input.charCodeAt(i + 1);
+          if (low >= 56320 && low <= 57343) {
+            output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+            i++;
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
+        } else {
+          output += percentEncodeNonAscii(65533);
+        }
+      }
+    }
+    return output;
+  }
+  function normalizeQueryFragmentEncoding(input) {
+    let output = "";
+    for (let i = 0;i < input.length; i++) {
+      const ch = input[i];
+      if (ch === "%" && i + 2 < input.length) {
+        const hex = input.slice(i + 1, i + 3);
+        if (isHexPair(hex)) {
+          const normalizedHex = hex.toUpperCase();
+          const decoded = String.fromCharCode(parseInt(normalizedHex, 16));
+          if (isUnreserved(decoded)) {
+            output += decoded;
+          } else {
+            output += "%" + normalizedHex;
+          }
+          i += 2;
+          continue;
+        }
+      }
+      if (isQueryFragmentCharacter(ch)) {
+        output += ch;
+      } else {
+        const code = input.charCodeAt(i);
+        if (code < 128) {
+          output += isEscapeSafe(code) ? ch : BYTE_HEX[code];
+        } else if (code < 55296 || code > 57343) {
+          output += percentEncodeNonAscii(code);
+        } else if (code <= 56319 && i + 1 < input.length) {
+          const low = input.charCodeAt(i + 1);
+          if (low >= 56320 && low <= 57343) {
+            output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+            i++;
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
+        } else {
+          output += percentEncodeNonAscii(65533);
+        }
       }
     }
     return output;
@@ -3281,7 +3358,8 @@ var require_utils = __commonJS((exports, module) => {
   function escapePreservingEscapes(input) {
     let output = "";
     for (let i = 0;i < input.length; i++) {
-      if (input[i] === "%" && i + 2 < input.length) {
+      const ch = input[i];
+      if (ch === "%" && i + 2 < input.length) {
         const hex = input.slice(i + 1, i + 3);
         if (isHexPair(hex)) {
           output += "%" + hex.toUpperCase();
@@ -3289,7 +3367,22 @@ var require_utils = __commonJS((exports, module) => {
           continue;
         }
       }
-      output += escape(input[i]);
+      const code = input.charCodeAt(i);
+      if (code < 128) {
+        output += isEscapeSafe(code) ? ch : BYTE_HEX[code];
+      } else if (code < 55296 || code > 57343) {
+        output += percentEncodeNonAscii(code);
+      } else if (code <= 56319 && i + 1 < input.length) {
+        const low = input.charCodeAt(i + 1);
+        if (low >= 56320 && low <= 57343) {
+          output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+          i++;
+        } else {
+          output += percentEncodeNonAscii(65533);
+        }
+      } else {
+        output += percentEncodeNonAscii(65533);
+      }
     }
     return output;
   }
@@ -3323,6 +3416,7 @@ var require_utils = __commonJS((exports, module) => {
     reescapeHostDelimiters,
     normalizePercentEncoding,
     normalizePathEncoding,
+    normalizeQueryFragmentEncoding,
     escapePreservingEscapes,
     removeDotSegments,
     isIPv4,
@@ -3508,7 +3602,7 @@ var require_schemes = __commonJS((exports, module) => {
 
 // node_modules/fast-uri/index.js
 var require_fast_uri = __commonJS((exports, module) => {
-  var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, escapePreservingEscapes, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
+  var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, normalizeQueryFragmentEncoding, escapePreservingEscapes, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
   var { SCHEMES, getSchemeHandler } = require_schemes();
   function normalize(uri, options) {
     if (typeof uri === "string") {
@@ -3520,7 +3614,12 @@ var require_fast_uri = __commonJS((exports, module) => {
   }
   function resolve(baseURI, relativeURI, options) {
     const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
-    const resolved = resolveComponent(parse(baseURI, schemelessOptions), parse(relativeURI, schemelessOptions), schemelessOptions, true);
+    const { parsed: baseParsed, malformedAuthorityOrPort: baseMalformed } = parseWithStatus(baseURI, schemelessOptions);
+    const { parsed: relativeParsed, malformedAuthorityOrPort: relativeMalformed } = parseWithStatus(relativeURI, schemelessOptions);
+    if (baseMalformed || relativeMalformed) {
+      throw new Error(baseParsed.error || relativeParsed.error || "URI is malformed.");
+    }
+    const resolved = resolveComponent(baseParsed, relativeParsed, schemelessOptions, true);
     schemelessOptions.skipEscape = true;
     return serialize(resolved, schemelessOptions);
   }
@@ -3646,6 +3745,8 @@ var require_fast_uri = __commonJS((exports, module) => {
     return uriTokens.join("");
   }
   var URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u;
+  var AUTHORITY_PREFIX = /^(?:[^#/:?]+:)?\/\/([^/?#]*)/;
+  var AUTHORITY_INTRODUCER_REGION = /^(?:[^#/:?]+:)?([/\\\t\n\r]*)/;
   function getParseError(parsed, matches) {
     if (matches[2] !== undefined && parsed.path && parsed.path[0] !== "/") {
       return 'URI path must start with "/" when authority is present.';
@@ -3675,9 +3776,28 @@ var require_fast_uri = __commonJS((exports, module) => {
         uri = "//" + uri;
       }
     }
+    const authorityMatch = uri.match(AUTHORITY_PREFIX);
+    if (authorityMatch !== null && authorityMatch[1].indexOf("\\") !== -1) {
+      parsed.error = "URI authority must not contain a literal backslash.";
+      malformedAuthorityOrPort = true;
+    }
+    const introducerMatch = uri.match(AUTHORITY_INTRODUCER_REGION);
+    if (introducerMatch !== null) {
+      const region = introducerMatch[1];
+      const normalizedRegion = region.replace(/[\t\n\r]/g, "");
+      if (normalizedRegion.length >= 2) {
+        if (normalizedRegion.slice(0, 2) !== "//") {
+          parsed.error = parsed.error || "URI authority must not contain a literal backslash.";
+          malformedAuthorityOrPort = true;
+        } else if (region.length !== normalizedRegion.length) {
+          parsed.error = parsed.error || "URI authority introducer must not contain whitespace.";
+          malformedAuthorityOrPort = true;
+        }
+      }
+    }
     const matches = uri.match(URI_PARSE);
     if (matches) {
-      parsed.scheme = matches[1];
+      parsed.scheme = matches[1] === undefined ? undefined : matches[1].toLowerCase();
       parsed.userinfo = matches[3];
       parsed.host = matches[4];
       parsed.port = parseInt(matches[5], 10);
@@ -3736,12 +3856,11 @@ var require_fast_uri = __commonJS((exports, module) => {
         if (parsed.path) {
           parsed.path = normalizePathEncoding(parsed.path);
         }
+        if (parsed.query) {
+          parsed.query = normalizeQueryFragmentEncoding(parsed.query);
+        }
         if (parsed.fragment) {
-          try {
-            parsed.fragment = encodeURI(decodeURIComponent(parsed.fragment));
-          } catch {
-            parsed.error = parsed.error || "URI malformed";
-          }
+          parsed.fragment = normalizeQueryFragmentEncoding(parsed.fragment);
         }
       }
       if (schemeHandler && schemeHandler.parse) {
@@ -13236,6 +13355,10 @@ var require_public_api = __commonJS((exports) => {
 
 // src/hooks/customize-on-skill-read.ts
 import { readFileSync as readFileSync4 } from "node:fs";
+import process3 from "node:process";
+
+// src/hooks/run.ts
+import process2 from "node:process";
 
 // src/audit/core/shared.ts
 var REGISTRY_REL_PATH = ".skeleton/registry.md";
@@ -13312,6 +13435,7 @@ import { basename, join as join4, relative as relative3 } from "node:path";
 var import_ajv = __toESM(require_ajv(), 1);
 import { existsSync as existsSync2, readFileSync } from "node:fs";
 import { dirname, join as join2 } from "node:path";
+import process from "node:process";
 import { fileURLToPath } from "node:url";
 
 // node_modules/yaml/dist/index.js
@@ -13456,9 +13580,6 @@ function parseRegistry(root) {
   }
   return { paths: [...new Set(paths)], hasTableHeader };
 }
-function parseRegistryPaths(root) {
-  return parseRegistry(root).paths;
-}
 
 // src/customize/resolve.ts
 function customizeDir(root) {
@@ -13468,7 +13589,7 @@ function customizePathForSlug(root, slug) {
   return join4(customizeDir(root), `${slug}.md`);
 }
 function findCustomizeViaRegistry(root, slug) {
-  for (const rel of parseRegistryPaths(root)) {
+  for (const rel of parseRegistry(root).paths) {
     const expected = `${REGISTRY_DIR_REL}/customize/${slug}.md`;
     if (normalizeRelPath(rel) === expected && existsSync4(join4(root, rel))) {
       return rel;
@@ -13521,11 +13642,11 @@ function readAlwaysInclude(root, basenames, skipBasename) {
 function resolveCustomize(root, slug) {
   const slugFile = resolveSlugFile(root, slug);
   const alwaysNames = alwaysIncludeBasenames(root);
-  const skip = slugFile.path != null ? basename(slugFile.path) : null;
+  const skip = slugFile.path !== null && slugFile.path !== undefined ? basename(slugFile.path) : null;
   const always = readAlwaysInclude(root, alwaysNames, skip);
   const parts = [];
   const included = [];
-  if (slugFile.content != null && slugFile.content.trim().length > 0) {
+  if (slugFile.content !== null && slugFile.content !== undefined && slugFile.content.trim().length > 0) {
     parts.push(slugFile.content.trimEnd());
     if (slugFile.path)
       included.push(slugFile.path);
@@ -13583,7 +13704,7 @@ function extractSkillSlug(payload) {
   }
   const path = extractPath(payload);
   if (path)
-    return slugFromPath(path, process.cwd());
+    return slugFromPath(path, process2.cwd());
   return null;
 }
 function cursorResponse(content) {
@@ -13635,4 +13756,4 @@ Customize override for /${slug} (from ${from}):
 }
 
 // src/hooks/customize-on-skill-read.ts
-process.stdout.write(runCustomizeHook(readFileSync4(0, "utf8")));
+process3.stdout.write(runCustomizeHook(readFileSync4(0, "utf8")));

package/dist/plugin-types.js

@@ -1,11 +1,12 @@
 // src/audit/core/report.ts
-function issue(rule, file, message, opts) {
+function issue(rule, file, details) {
+  const message = typeof details === "string" ? details : details.message;
   return {
     rule,
     file,
-    link: opts?.link,
+    link: typeof details === "string" ? undefined : details.link,
     message,
-    severity: opts?.severity ?? "error"
+    severity: typeof details === "string" ? "error" : details.severity ?? "error"
   };
 }
 // src/audit/core/shared.ts

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@csark0812/skeleton",
-	"version": "1.5.5",
+	"version": "1.5.7",
 	"description": "SSOT audit CLI for agent harness repos",
 	"type": "module",
 	"bin": {
@@ -68,11 +68,15 @@
 		"yaml": "^2.8.0"
 	},
 	"devDependencies": {
-		"@biomejs/biome": "^2.5.3",
+		"@biomejs/biome": "2.5.6",
 		"@cursor/sdk": "^1.0.23",
 		"@post-print/agent-test": "^0.2.7",
 		"@types/bun": "^1.3.8",
 		"@types/github-slugger": "^2.0.0",
 		"typescript": "~7.0.2"
+	},
+	"overrides": {
+		"undici": ">=6.23.0",
+		"fast-uri": ">=3.1.4"
 	}
 }