@elisym/sdk 0.21.1 → 0.23.0

package/dist/skills.js

@@ -56,6 +56,14 @@ function runScript(cmd, args, opts) {
     }
   });
 }
+var SECRET_ENV_VARS = ["ANTHROPIC_API_KEY", "OPENAI_API_KEY"];
+function scopedToolEnv() {
+  const env = { ...process.env };
+  for (const key of SECRET_ENV_VARS) {
+    delete env[key];
+  }
+  return env;
+}
 var ScriptSkill = class {
   name;
   description;
@@ -177,13 +185,21 @@ var ScriptSkill = class {
       if (value === void 0) {
         continue;
       }
+      const stringValue = String(value);
+      if (stringValue.startsWith("-")) {
+        return `Error: tool "${toolDef.name}" argument "${param.name}" must not begin with "-".`;
+      }
       if (param.required && index === 0) {
-        args.push(String(value));
+        args.push(stringValue);
       } else {
-        args.push(`--${param.name}`, String(value));
+        args.push(`--${param.name}`, stringValue);
       }
     }
-    const result = await runScript(cmd, args, { cwd: this.skillDir, signal });
+    const result = await runScript(cmd, args, {
+      cwd: this.skillDir,
+      signal,
+      env: scopedToolEnv()
+    });
     if (result.spawnError) {
       return `Error: ${result.spawnError.message}`;
     }
@@ -246,6 +262,16 @@ var ScriptBillingExhaustedError = class extends Error {
     this.stderr = stderr;
   }
 };
+var ScriptExecutionError = class extends Error {
+  exitCode;
+  detail;
+  constructor(exitCode, detail, summary) {
+    super(summary ?? `script failed (exit ${exitCode ?? "unknown"})`);
+    this.name = "ScriptExecutionError";
+    this.exitCode = exitCode;
+    this.detail = detail;
+  }
+};
 
 // src/skills/staticScriptSkill.ts
 var StaticScriptSkill = class {
@@ -284,19 +310,23 @@ var StaticScriptSkill = class {
       env: this.scriptEnv
     });
     if (result.spawnError) {
-      throw new Error(`script spawn failed: ${result.spawnError.message}`);
+      throw new ScriptExecutionError(
+        null,
+        result.spawnError.message,
+        "script could not be started"
+      );
     }
     if (result.code === SCRIPT_EXIT_BILLING_EXHAUSTED) {
       throw new ScriptBillingExhaustedError(result.code, result.stdout, result.stderr);
     }
     if (result.code !== 0) {
       const detail = result.stderr.trim() || result.stdout.trim() || "(no output)";
-      throw new Error(`script failed (exit ${result.code}): ${detail}`);
+      throw new ScriptExecutionError(result.code, detail);
     }
     const output = result.stdout.trim();
     if (output === "") {
       const detail = result.stderr.trim() || "(no stderr)";
-      throw new Error(`script exited 0 but produced empty output: ${detail}`);
+      throw new ScriptExecutionError(result.code, detail, "script produced empty output");
     }
     return { data: output };
   }
@@ -338,19 +368,23 @@ var DynamicScriptSkill = class {
       env: this.scriptEnv
     });
     if (result.spawnError) {
-      throw new Error(`script spawn failed: ${result.spawnError.message}`);
+      throw new ScriptExecutionError(
+        null,
+        result.spawnError.message,
+        "script could not be started"
+      );
     }
     if (result.code === SCRIPT_EXIT_BILLING_EXHAUSTED) {
       throw new ScriptBillingExhaustedError(result.code, result.stdout, result.stderr);
     }
     if (result.code !== 0) {
       const detail = result.stderr.trim() || result.stdout.trim() || "(no output)";
-      throw new Error(`script failed (exit ${result.code}): ${detail}`);
+      throw new ScriptExecutionError(result.code, detail);
     }
     const output = result.stdout.trim();
     if (output === "") {
       const detail = result.stderr.trim() || "(no stderr)";
-      throw new Error(`script exited 0 but produced empty output: ${detail}`);
+      throw new ScriptExecutionError(result.code, detail, "script produced empty output");
     }
     return { data: output };
   }
@@ -364,7 +398,12 @@ function resolveInsidePath(rootDir, value) {
   }
   return candidate;
 }
-var LAMPORTS_PER_SOL = 1e9;
+var LIMITS = {
+  // Upper bound for execution budgets (`max_execution_secs` / `execution_timeout_secs`).
+  // Distinct from MAX_TIMEOUT_SECS (the result-wait cap): execution budgets may be
+  // hours, so this exists only to keep `secs * 1000` within Node's setTimeout limit
+  // (2_147_483_647 ms) - a larger value overflows and fires the timer immediately.
+  MAX_EXECUTION_SECS: 2147483};
 var NATIVE_SOL = {
   chain: "solana",
   token: "sol",
@@ -441,11 +480,15 @@ var VALID_MODES = [
   "dynamic-script"
 ];
 function solToLamports(sol) {
-  const asNumber = typeof sol === "string" ? Number(sol) : sol;
-  if (!Number.isFinite(asNumber) || asNumber < 0) {
+  const asString = (typeof sol === "string" ? sol : String(sol)).trim();
+  if (/^0+(?:\.0+)?$/.test(asString)) {
+    return 0n;
+  }
+  try {
+    return parseAssetAmount(NATIVE_SOL, asString);
+  } catch {
     throw new Error(`Invalid SOL amount: ${sol}`);
   }
-  return BigInt(Math.round(asNumber * LAMPORTS_PER_SOL));
 }
 function resolveSkillAsset(skillName, token, mint) {
   if (token === void 0 || token === null) {
@@ -667,6 +710,11 @@ function validateMaxExecutionSecs(skillName, raw) {
       `SKILL.md "${skillName}": "max_execution_secs" must be a non-negative integer (0 = unlimited)`
     );
   }
+  if (raw > LIMITS.MAX_EXECUTION_SECS) {
+    throw new Error(
+      `SKILL.md "${skillName}": "max_execution_secs" must be <= ${LIMITS.MAX_EXECUTION_SECS} (larger values overflow setTimeout)`
+    );
+  }
   return raw;
 }
 function validateSkillFrontmatter(frontmatter, systemPrompt, options = {}) {
@@ -704,7 +752,7 @@ function validateSkillFrontmatter(frontmatter, systemPrompt, options = {}) {
     }
     const priceString = typeof priceRaw === "number" ? String(priceRaw) : priceRaw;
     if (asset === NATIVE_SOL) {
-      priceSubunits = solToLamports(priceRaw);
+      priceSubunits = solToLamports(priceString);
     } else {
       try {
         priceSubunits = parseAssetAmount(asset, priceString);
@@ -829,6 +877,14 @@ function validateSkillFrontmatter(frontmatter, systemPrompt, options = {}) {
   };
 }
 function buildSkillFromParsed(parsed, skillDir, logger) {
+  let imageFile = parsed.imageFile;
+  if (imageFile !== void 0 && resolveInsidePath(skillDir, imageFile) === null) {
+    logger.warn?.(
+      { skill: parsed.name, imageFile },
+      'SKILL.md "image_file" escapes the skill directory; ignoring it'
+    );
+    imageFile = void 0;
+  }
   switch (parsed.mode) {
     case "llm":
       return new ScriptSkill({
@@ -843,7 +899,7 @@ function buildSkillFromParsed(parsed, skillDir, logger) {
         maxToolRounds: parsed.maxToolRounds,
         llmOverride: parsed.llmOverride,
         image: parsed.image,
-        imageFile: parsed.imageFile,
+        imageFile,
         logger
       });
     case "static-file": {
@@ -866,7 +922,7 @@ function buildSkillFromParsed(parsed, skillDir, logger) {
         asset: parsed.asset,
         outputFilePath,
         image: parsed.image,
-        imageFile: parsed.imageFile,
+        imageFile,
         llmOverride: parsed.llmOverride
       });
     }
@@ -892,7 +948,7 @@ function buildSkillFromParsed(parsed, skillDir, logger) {
         scriptArgs: parsed.scriptArgs,
         scriptTimeoutMs: parsed.scriptTimeoutMs ?? DEFAULT_SCRIPT_TIMEOUT_MS,
         image: parsed.image,
-        imageFile: parsed.imageFile,
+        imageFile,
         llmOverride: parsed.llmOverride
       });
     }