@fased/fased 0.1.62 → 0.1.64

package/dist/agents/skills/workspace.js

@@ -2,6 +2,7 @@ import { CONFIG_DIR, resolveUserPath } from "../../utils.js";
 import { createSubsystemLogger } from "../../logging/subsystem.js";
 import { normalizeSkillFilter } from "./filter.js";
 import { resolveEffectiveAgentSkillFilter } from "./agent-filter.js";
+import { isMarketplaceSkillDir, marketplaceSkillIdsFromEntries } from "./trust.js";
 import { resolveSandboxPath } from "../sandbox-paths.js";
 import { parseFrontmatter, resolveFasedAgentMetadata, resolveSkillInvocationPolicy, resolveSkillKey } from "./frontmatter.js";
 import { shouldIncludeSkill } from "./config.js";
@@ -17,6 +18,7 @@ import { formatSkillsForPrompt, loadSkillsFromDir } from "@mariozechner/pi-codin
 const fsp = syncFs.promises;
 const skillsLogger = createSubsystemLogger("skills");
 const skillCommandDebugOnce = new Set();
+const CLAUDE_BUNDLE_MANIFEST_MAX_BYTES = 64 * 1024;
 /**
 * Replace the user's home directory prefix with `~` in skill file paths
 * to reduce system prompt token usage. Models understand `~` expansion,
@@ -392,6 +394,7 @@ function buildWorkspaceSkillSnapshot(workspaceDir, opts) {
 		})),
 		...skillFilter === undefined ? {} : { skillFilter },
 		resolvedSkills,
+		marketplaceSkillIds: marketplaceSkillIdsFromEntries(eligible),
 		version: opts?.snapshotVersion
 	};
 }
@@ -407,6 +410,116 @@ function resolveEffectiveSkillFilter(opts) {
 	}
 	return undefined;
 }
+function isExplicitlyEnabledClaudeBundle(pluginId, config) {
+	const plugins = config?.plugins;
+	if (plugins?.enabled === false || plugins?.deny?.includes(pluginId)) {
+		return false;
+	}
+	if (plugins?.allow?.length && !plugins.allow.includes(pluginId)) {
+		return false;
+	}
+	return plugins?.entries?.[pluginId]?.enabled === true;
+}
+function stripMarkdownFrontmatter(content) {
+	const normalized = content.replace(/\r\n?/gu, "\n");
+	if (!normalized.startsWith("---\n")) {
+		return normalized.trim();
+	}
+	const end = normalized.indexOf("\n---", 4);
+	if (end < 0) {
+		return "";
+	}
+	return normalized.slice(end + 4).replace(/^\n/u, "").trim();
+}
+function listImmediateDirectories(root) {
+	try {
+		return syncFs.readdirSync(root, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.isSymbolicLink()).map((entry) => path.join(root, entry.name));
+	} catch {
+		return [];
+	}
+}
+function loadClaudeBundleCommandSpecs(params) {
+	const roots = [
+		...listImmediateDirectories(path.join(CONFIG_DIR, "extensions")),
+		...listImmediateDirectories(path.join(params.workspaceDir, ".fased", "extensions")),
+		...(params.config?.plugins?.load?.paths ?? []).map((entry) => resolveUserPath(entry))
+	];
+	const seen = new Set();
+	const specs = [];
+	for (const unresolvedRoot of roots) {
+		let root;
+		try {
+			const stat = syncFs.lstatSync(unresolvedRoot);
+			if (!stat.isDirectory() || stat.isSymbolicLink()) {
+				continue;
+			}
+			root = syncFs.realpathSync(unresolvedRoot);
+		} catch {
+			continue;
+		}
+		if (seen.has(root) || isMarketplaceSkillDir(root)) {
+			continue;
+		}
+		seen.add(root);
+		const manifestPath = path.join(root, ".claude-plugin", "plugin.json");
+		let pluginId = "";
+		try {
+			const stat = syncFs.lstatSync(manifestPath);
+			if (!stat.isFile() || stat.isSymbolicLink() || stat.size <= 0 || stat.size > CLAUDE_BUNDLE_MANIFEST_MAX_BYTES) {
+				continue;
+			}
+			const manifest = JSON.parse(syncFs.readFileSync(manifestPath, "utf8"));
+			pluginId = typeof manifest.name === "string" ? manifest.name.trim() : "";
+		} catch {
+			continue;
+		}
+		if (!pluginId || !isExplicitlyEnabledClaudeBundle(pluginId, params.config)) {
+			continue;
+		}
+		const commandsDir = path.join(root, "commands");
+		let entries;
+		try {
+			const stat = syncFs.lstatSync(commandsDir);
+			if (!stat.isDirectory() || stat.isSymbolicLink()) {
+				continue;
+			}
+			entries = syncFs.readdirSync(commandsDir, { withFileTypes: true });
+		} catch {
+			continue;
+		}
+		for (const entry of entries.filter((candidate) => candidate.isFile() && !candidate.isSymbolicLink()).toSorted((left, right) => left.name.localeCompare(right.name)).slice(0, params.maxCandidates)) {
+			if (path.extname(entry.name).toLowerCase() !== ".md") {
+				continue;
+			}
+			const filePath = path.join(commandsDir, entry.name);
+			let content;
+			try {
+				const stat = syncFs.lstatSync(filePath);
+				if (stat.size <= 0 || stat.size > params.maxFileBytes) {
+					continue;
+				}
+				content = syncFs.readFileSync(filePath, "utf8");
+			} catch {
+				continue;
+			}
+			const frontmatter = parseFrontmatter(content);
+			const skillName = frontmatter.name?.trim();
+			const description = frontmatter.description?.trim();
+			const promptTemplate = stripMarkdownFrontmatter(content);
+			if (!skillName || !description || !promptTemplate) {
+				continue;
+			}
+			specs.push({
+				name: sanitizeSkillCommandName(skillName),
+				skillName,
+				description: description.length > SKILL_COMMAND_DESCRIPTION_MAX_LENGTH ? `${description.slice(0, SKILL_COMMAND_DESCRIPTION_MAX_LENGTH - 1)}…` : description,
+				promptTemplate,
+				sourceFilePath: filePath
+			});
+		}
+	}
+	return specs;
+}
 function resolveWorkspaceSkillPromptState(workspaceDir, opts) {
 	const skillEntries = opts?.entries ?? loadSkillEntries(workspaceDir, opts);
 	const eligible = filterSkillEntries(skillEntries, opts?.config, resolveEffectiveSkillFilter(opts), opts?.eligibility);
@@ -599,9 +712,24 @@ function buildWorkspaceSkillCommandSpecs(workspaceDir, opts) {
 			name: unique,
 			skillName: rawName,
 			description,
+			sourceFilePath: entry.skill.filePath,
 			...dispatch ? { dispatch } : {}
 		});
 	}
+	const limits = resolveSkillsLimits(opts?.config);
+	for (const bundleCommand of loadClaudeBundleCommandSpecs({
+		workspaceDir,
+		config: opts?.config,
+		maxCandidates: limits.maxCandidatesPerRoot,
+		maxFileBytes: limits.maxSkillFileBytes
+	})) {
+		const unique = resolveUniqueSkillCommandName(bundleCommand.name, used);
+		used.add(unique.toLowerCase());
+		specs.push({
+			...bundleCommand,
+			name: unique
+		});
+	}
 	return specs;
 }
 

package/dist/agents/skills-clawhub.js

@@ -163,9 +163,17 @@ async function resolveInstallVersion(params) {
 	if (!resolvedVersion) {
 		throw new Error(`Skill "${params.slug}" has no installable version.`);
 	}
+	const versionMetadataMatches = detail.latestVersion?.version === resolvedVersion;
+	const expectedIntegrity = versionMetadataMatches ? detail.latestVersion?.integrity : undefined;
+	const expectedSha256 = versionMetadataMatches ? detail.latestVersion?.sha256 : undefined;
+	if (!expectedIntegrity && !expectedSha256) {
+		throw new Error(`Skill "${params.slug}"@${resolvedVersion} has no registry-published archive digest; refusing an unverifiable install.`);
+	}
 	return {
 		detail,
-		version: resolvedVersion
+		version: resolvedVersion,
+		expectedIntegrity,
+		expectedSha256
 	};
 }
 async function installExtractedSkill(params) {
@@ -259,10 +267,10 @@ function buildMarketplaceUpdateReview(params) {
 		message: finding.message
 	}));
 	const reasons = [];
-	if (params.isUpdate && params.permissions.risky && permissionDigestChanged) {
+	if (params.permissions.risky && permissionDigestChanged) {
 		reasons.push("requested permissions changed");
 	}
-	if (params.isUpdate && addedScanFindings.length > 0) {
+	if (addedScanFindings.length > 0) {
 		reasons.push("archive scan added reviewable findings");
 	}
 	return {
@@ -278,7 +286,7 @@ function buildMarketplaceUpdateReview(params) {
 }
 function assertUpdateReviewAllowed(params) {
 	if (params.review.approvalRequired && params.allowPermissionChanges !== true) {
-		throw new Error(`ClawHub skill update requires permission review (${params.review.reasons.join(", ")}); rerun with explicit permission-change approval.`);
+		throw new Error(`ClawHub skill install or update requires permission review (${params.review.reasons.join(", ")}); rerun with explicit permission-change approval.`);
 	}
 }
 async function performClawHubSkillInstall(params) {
@@ -289,7 +297,7 @@ async function performClawHubSkillInstall(params) {
 			allowRegistries: params.allowRegistries,
 			allowTrackedLegacyOrigin: params.force && Boolean(params.previousOrigin)
 		});
-		const { detail, version } = await resolveInstallVersion({
+		const { detail, version, expectedIntegrity, expectedSha256 } = await resolveInstallVersion({
 			slug: params.slug,
 			version: params.version,
 			baseUrl: params.baseUrl
@@ -305,12 +313,15 @@ async function performClawHubSkillInstall(params) {
 		const archive = await downloadClawHubSkillArchive({
 			slug: params.slug,
 			version,
-			baseUrl: params.baseUrl
+			baseUrl: params.baseUrl,
+			expectedIntegrity,
+			expectedSha256
 		});
 		try {
 			let extractedPermissions = null;
 			let archiveScan = null;
 			let updateReview = null;
+			let contentSha256 = null;
 			const install = await withExtractedArchiveRoot({
 				archivePath: archive.archivePath,
 				tempDirPrefix: "fased-skill-clawhub-",
@@ -327,6 +338,7 @@ async function performClawHubSkillInstall(params) {
 					}
 					params.logger?.info?.(`Marketplace archive scan for ${params.slug}: ${formatArchiveScanFindings(scan)}`);
 					const inspection = await inspectSkillMarketplaceManifest(rootDir);
+					contentSha256 = await computeSkillFingerprint(rootDir);
 					extractedPermissions = inspection.permissions;
 					updateReview = buildMarketplaceUpdateReview({
 						previousOrigin: params.previousOrigin,
@@ -360,6 +372,9 @@ async function performClawHubSkillInstall(params) {
 			if (!updateReview) {
 				throw new Error("failed to review marketplace skill update");
 			}
+			if (!contentSha256) {
+				throw new Error("failed to fingerprint marketplace skill content");
+			}
 			const installedAt = Date.now();
 			await writeClawHubSkillOrigin(install.targetDir, {
 				version: 1,
@@ -367,6 +382,9 @@ async function performClawHubSkillInstall(params) {
 				slug: params.slug,
 				installedVersion: version,
 				installedAt,
+				archiveSha256: archive.sha256,
+				archiveIntegrityVerified: archive.integrityVerified,
+				contentSha256,
 				permissions: extractedPermissions,
 				installScan: archiveScan,
 				lastUpdateReview: updateReview
@@ -374,7 +392,10 @@ async function performClawHubSkillInstall(params) {
 			const lock = await readClawHubSkillsLockfile(params.workspaceDir);
 			lock.skills[params.slug] = {
 				version,
-				installedAt
+				installedAt,
+				archiveSha256: archive.sha256,
+				archiveIntegrityVerified: archive.integrityVerified,
+				contentSha256
 			};
 			await writeClawHubSkillsLockfile(params.workspaceDir, lock);
 			return {
@@ -432,7 +453,7 @@ async function previewTrackedSkillUpdateFromClawHub(params) {
 			allowRegistries: params.allowRegistries,
 			allowTrackedLegacyOrigin: Boolean(params.previousOrigin)
 		});
-		const { version } = await resolveInstallVersion({
+		const { version, expectedIntegrity, expectedSha256 } = await resolveInstallVersion({
 			slug: params.slug,
 			baseUrl: params.baseUrl
 		});
@@ -440,7 +461,9 @@ async function previewTrackedSkillUpdateFromClawHub(params) {
 		const archive = await downloadClawHubSkillArchive({
 			slug: params.slug,
 			version,
-			baseUrl: params.baseUrl
+			baseUrl: params.baseUrl,
+			expectedIntegrity,
+			expectedSha256
 		});
 		try {
 			const targetDir = resolveSkillInstallDir(params.workspaceDir, params.slug);
@@ -505,7 +528,7 @@ async function previewSkillInstallFromClawHub(params) {
 			registry,
 			allowRegistries: params.allowRegistries
 		});
-		const { detail, version } = await resolveInstallVersion({
+		const { detail, version, expectedIntegrity, expectedSha256 } = await resolveInstallVersion({
 			slug,
 			version: params.version,
 			baseUrl: params.baseUrl
@@ -521,7 +544,9 @@ async function previewSkillInstallFromClawHub(params) {
 		const archive = await downloadClawHubSkillArchive({
 			slug,
 			version,
-			baseUrl: params.baseUrl
+			baseUrl: params.baseUrl,
+			expectedIntegrity,
+			expectedSha256
 		});
 		try {
 			let permissions = null;

package/dist/agents/skills-marketplace-scan.js

@@ -76,6 +76,25 @@ const SUSPICIOUS_SCRIPT_EXTENSIONS = new Set([
 	".sh",
 	".zsh"
 ]);
+const REVIEWABLE_CODE_EXTENSIONS = new Set([
+	".cjs",
+	".go",
+	".js",
+	".jsx",
+	".mjs",
+	".py",
+	".rb",
+	".rs",
+	".ts",
+	".tsx"
+]);
+const MARKDOWN_EXTENSIONS = new Set([".md", ".mdx"]);
+const MARKDOWN_INSTRUCTION_RISKS = [
+	/ignore\s+(?:all\s+)?(?:previous|prior|system|developer)\s+instructions?/iu,
+	/(?:upload|send|exfiltrat|leak)[^\n]{0,80}(?:secret|credential|token|private\s+key|seed\s+phrase)/iu,
+	/(?:\.ssh|\.aws|\.gnupg|\.env|process\.env|private\s+key|seed\s+phrase)/iu,
+	/curl\s+[^\n|]{0,160}\|\s*(?:ba)?sh/iu
+];
 const DEPENDENCY_MANIFEST_FILE_NAMES = new Set([
 	"Cargo.toml",
 	"Gemfile",
@@ -132,6 +151,13 @@ function inspectMarketplaceFilePath(params) {
 			path: params.path,
 			message: `skill archive contains script file "${basename}"`
 		});
+	} else if (REVIEWABLE_CODE_EXTENSIONS.has(ext)) {
+		addFinding(params.findings, {
+			severity: "warn",
+			code: "executable_source_file",
+			path: params.path,
+			message: `skill archive contains executable source file "${basename}"; review it before granting tools`
+		});
 	}
 	if (DEPENDENCY_MANIFEST_FILE_NAMES.has(basename)) {
 		addFinding(params.findings, {
@@ -142,6 +168,22 @@ function inspectMarketplaceFilePath(params) {
 		});
 	}
 }
+async function inspectMarketplaceMarkdown(params) {
+	const fullPath = path.join(params.rootDir, params.relativePath);
+	const stat = await fs.stat(fullPath);
+	if (stat.size > MAX_FILE_BYTES) {
+		return;
+	}
+	const content = await fs.readFile(fullPath, "utf8");
+	if (MARKDOWN_INSTRUCTION_RISKS.some((pattern) => pattern.test(content))) {
+		addFinding(params.findings, {
+			severity: "warn",
+			code: "instruction_risk",
+			path: toPosix(params.relativePath),
+			message: "skill instructions reference prompt overrides, secrets, sensitive paths, or shell-pipe execution; manual review is required"
+		});
+	}
+}
 async function inspectMarketplaceSourceCode(params) {
 	try {
 		const summary = await scanDirectoryWithSummary(params.rootDir, {
@@ -289,6 +331,13 @@ async function scanSkillMarketplaceArchive(rootDir) {
 				path: posixPath,
 				findings
 			});
+			if (MARKDOWN_EXTENSIONS.has(path.posix.extname(entry.name.toLowerCase()))) {
+				await inspectMarketplaceMarkdown({
+					rootDir,
+					relativePath,
+					findings
+				});
+			}
 		}
 	}
 	await inspectMarketplaceSourceCode({

package/dist/agents/tools/marketplace-offer-draft-tool.js

@@ -417,7 +417,7 @@ function createMarketplaceSearchTool(params) {
 					orders: orders.filter((entry) => {
 						const paymentStatus = entry.order.paymentIntent?.status;
 						const settlementStatus = entry.order.settlement?.status;
-						return paymentStatus === "verified" || settlementStatus === "settled" || Boolean(entry.order.invoiceId || entry.order.receiptId || entry.order.txRef);
+						return paymentStatus === "verified" || settlementStatus === "settled" || settlementStatus === "verified";
 					})
 				});
 			}

package/dist/agents/tools/mining-tool.js

@@ -447,7 +447,7 @@ For scheduled or conditional automation, create a scheduled task whose isolated
 					});
 				}
 				case "capital_init": return jsonResult(await callGateway("sat.initMinerCapital", gatewayOpts, { authority: readStringParam(params, "authority") }));
-				case "reserve_top_up": return jsonResult(await callGateway("sat.bootstrapRegistryReserve", gatewayOpts, {}));
+				case "reserve_top_up": return jsonResult(await callGateway("sat.topUpRegistryReserve", gatewayOpts, { targetBalanceLamports: 0 }));
 				case "deposit_capital": return jsonResult(await callGateway("sat.depositMinerCapital", gatewayOpts, { lamports: parseLamportsInput(params) }));
 				case "withdraw_capital": return jsonResult(await callGateway("sat.withdrawMinerCapital", gatewayOpts, { lamports: parseLamportsInput(params) }));
 				case "set_commit": return jsonResult(await callGateway("sat.setActiveCommit", gatewayOpts, {

package/dist/agents/tools/session-status-tool.js

@@ -119,7 +119,7 @@ async function resolveModelOverride(params) {
 		throw new Error(`Unrecognized model "${raw}".`);
 	}
 	const key = modelKey(resolved.ref.provider, resolved.ref.model);
-	if (allowed.allowedKeys.size > 0 && !allowed.allowedKeys.has(key)) {
+	if (!allowed.allowAny && !allowed.allowedKeys.has(key)) {
 		throw new Error(`Model "${key}" is not allowed.`);
 	}
 	const isDefault = resolved.ref.provider === configDefault.provider && resolved.ref.model === configDefault.model;