@floomhq/floom-mcp-sync 1.0.10 → 1.0.12

package/README.md

@@ -59,7 +59,7 @@ Version 1 sync does not replace existing local files. Remote updates, existing u
 
 The poll uses HTTP `If-None-Match` against `/api/v1/me/skills`, so unchanged responses are `304` with no body. If a Floom-tracked local file is missing after a `304`, MCP refetches once without the ETag so Version 1 can recreate missing files without overwriting existing files.
 
-Configure the preview poll interval with `FLOOM_SYNC_INTERVAL_MS` (default `60000`, minimum `10000`).
+Configure the poll interval with `FLOOM_SYNC_INTERVAL_MS` (default `60000`, minimum `10000`).
 
 ## Tools
 

package/dist/auto-sync.js

@@ -23,6 +23,17 @@ const PACKAGE_FILE_LIMIT = 100;
 const PACKAGE_TOTAL_BYTES_LIMIT = 1_000_000;
 const PACKAGE_FILE_BYTES_LIMIT = 500_000;
 const BASE64_RE = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
+function hasStructuredPath(skill) {
+    return Boolean(skill.library_slug || skill.folder);
+}
+function dedupeSyncSkills(skills) {
+    const structuredSlugs = new Set();
+    for (const skill of skills) {
+        if (hasStructuredPath(skill))
+            structuredSlugs.add(skill.slug);
+    }
+    return skills.filter((skill) => !structuredSlugs.has(skill.slug) || hasStructuredPath(skill));
+}
 async function localState(path) {
     try {
         const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
@@ -233,7 +244,7 @@ async function manifestHasMissingTrackedFile(manifest, root) {
     }
     return false;
 }
-export async function autoSync(log = (message) => process.stderr.write(`${message}\n`)) {
+export async function autoSync(log = (message) => process.stderr.write(`${message}\n`), signal) {
     const cfg = await readConfig();
     if (!cfg) {
         maybeAuthWarning(log, "[floom] not signed in; skipping sync (run `npx -y @floomhq/floom login`)");
@@ -246,7 +257,7 @@ export async function autoSync(log = (message) => process.stderr.write(`${messag
         const apiUrl = apiUrlFromConfig(cfg);
         let response;
         try {
-            response = await getJsonWithEtag(`${apiUrl}/api/v1/me/skills`, cfg.accessToken, cachedEtag);
+            response = await getJsonWithEtag(`${apiUrl}/api/v1/me/skills`, cfg.accessToken, cachedEtag, signal);
         }
         catch (err) {
             if (err instanceof FloomApiError && err.status === 401) {
@@ -257,7 +268,7 @@ export async function autoSync(log = (message) => process.stderr.write(`${messag
         }
         if (response.status === 304) {
             if (await manifestHasMissingTrackedFile(manifest, root)) {
-                response = await getJsonWithEtag(`${apiUrl}/api/v1/me/skills`, cfg.accessToken, null);
+                response = await getJsonWithEtag(`${apiUrl}/api/v1/me/skills`, cfg.accessToken, null, signal);
             }
             else {
                 maybeHeartbeat(log);
@@ -280,9 +291,12 @@ export async function autoSync(log = (message) => process.stderr.write(`${messag
         }
         for (const skill of payload.skills)
             validateSyncSkillShape(skill);
-        // Version 1 preview syncs owned published skills only.
+        // Version 1 receives published, saved, and subscribed library skills through
+        // the single /me/skills response. If a slug appears both at top level and in
+        // a library/folder placement, keep only the structured placement so agents do
+        // not see duplicate native packages.
         const buckets = [
-            { skills: payload.skills, defaultLib: null },
+            { skills: dedupeSyncSkills(payload.skills), defaultLib: null },
         ];
         let unchanged = 0;
         let updated = 0;
@@ -414,7 +428,7 @@ export async function autoSync(log = (message) => process.stderr.write(`${messag
             if (updated > 0) {
                 // Activation telemetry counts syncs that write new content. Best-effort;
                 // never blocks or throws.
-                void emitSyncCompleted(apiUrl, cfg.accessToken, { total, updated, unchanged }).catch(() => { });
+                void emitSyncCompleted(apiUrl, cfg.accessToken, { total, updated, unchanged }, signal).catch(() => { });
             }
         }
         else if (conflicts > 0) {
@@ -427,9 +441,9 @@ export async function autoSync(log = (message) => process.stderr.write(`${messag
         return { synced: total, unchanged, updated, conflicts };
     });
 }
-async function emitSyncCompleted(apiUrl, token, props) {
+async function emitSyncCompleted(apiUrl, token, props, signal) {
     try {
-        await fetch(`${apiUrl}/api/v1/events`, {
+        const init = {
             method: "POST",
             headers: {
                 "Content-Type": "application/json",
@@ -444,7 +458,10 @@ async function emitSyncCompleted(apiUrl, token, props) {
                     unchanged: props.unchanged,
                 },
             }),
-        });
+        };
+        if (signal)
+            init.signal = signal;
+        await fetch(`${apiUrl}/api/v1/events`, init);
     }
     catch {
         // never throw from telemetry

package/dist/lib/api.js

@@ -20,11 +20,14 @@ async function readError(res) {
     }
     return text;
 }
-export async function getJson(url, token) {
+export async function getJson(url, token, signal) {
     const headers = {};
     if (token)
         headers.authorization = `Bearer ${token}`;
-    const res = await fetch(url, { headers });
+    const init = { headers };
+    if (signal)
+        init.signal = signal;
+    const res = await fetch(url, init);
     if (!res.ok)
         throw new FloomApiError(res.status, await readError(res));
     return (await res.json());
@@ -33,11 +36,14 @@ export async function getJson(url, token) {
  * GET helper that participates in HTTP conditional requests via ETag.
  * Pass the previously-seen ETag (or null on first call). On 304, body is null.
  */
-export async function getJsonWithEtag(url, token, etag) {
+export async function getJsonWithEtag(url, token, etag, signal) {
     const headers = { authorization: `Bearer ${token}` };
     if (etag)
         headers["if-none-match"] = etag;
-    const res = await fetch(url, { headers });
+    const init = { headers };
+    if (signal)
+        init.signal = signal;
+    const res = await fetch(url, init);
     const responseEtag = res.headers.get("etag");
     if (res.status === 304) {
         return { status: 304, body: null, etag: responseEtag ?? etag };
@@ -47,43 +53,55 @@ export async function getJsonWithEtag(url, token, etag) {
     const body = (await res.json());
     return { status: res.status, body, etag: responseEtag };
 }
-export async function getText(url) {
-    const res = await fetch(url);
+export async function getText(url, signal) {
+    const init = {};
+    if (signal)
+        init.signal = signal;
+    const res = await fetch(url, init);
     if (!res.ok)
         throw new FloomApiError(res.status, await readError(res));
     return res.text();
 }
-export async function postJson(url, token, body) {
-    const res = await fetch(url, {
+export async function postJson(url, token, body, signal) {
+    const init = {
         method: "POST",
         headers: {
             authorization: `Bearer ${token}`,
             "content-type": "application/json",
         },
         body: JSON.stringify(body),
-    });
+    };
+    if (signal)
+        init.signal = signal;
+    const res = await fetch(url, init);
     if (!res.ok)
         throw new FloomApiError(res.status, await readError(res));
     return (await res.json());
 }
-export async function putJson(url, token, body) {
-    const res = await fetch(url, {
+export async function putJson(url, token, body, signal) {
+    const init = {
         method: "PUT",
         headers: {
             authorization: `Bearer ${token}`,
             "content-type": "application/json",
         },
         body: JSON.stringify(body),
-    });
+    };
+    if (signal)
+        init.signal = signal;
+    const res = await fetch(url, init);
     if (!res.ok)
         throw new FloomApiError(res.status, await readError(res));
     return (await res.json());
 }
-export async function deleteRequest(url, token) {
-    const res = await fetch(url, {
+export async function deleteRequest(url, token, signal) {
+    const init = {
         method: "DELETE",
         headers: { authorization: `Bearer ${token}` },
-    });
+    };
+    if (signal)
+        init.signal = signal;
+    const res = await fetch(url, init);
     if (!res.ok)
         throw new FloomApiError(res.status, await readError(res));
     return (await res.json());

package/dist/server.js

@@ -5,21 +5,32 @@ import { autoSync } from "./auto-sync.js";
 import { getSkill } from "./tools/get.js";
 import { searchSkills } from "./tools/search.js";
 import { syncStatus } from "./tools/status.js";
-const SERVER_VERSION = "1.0.10";
+const SERVER_VERSION = "1.0.12";
 const DEFAULT_INTERVAL_MS = 60_000;
 const MIN_INTERVAL_MS = 10_000;
 const SEARCH_TYPES = new Set(["knowledge", "instruction", "workflow", "skill"]);
 let syncInFlight = null;
+let syncAbortController = null;
 function runAutoSync() {
-    syncInFlight ??= autoSync().finally(() => {
+    if (syncInFlight)
+        return syncInFlight;
+    const controller = new AbortController();
+    syncAbortController = controller;
+    syncInFlight = autoSync(undefined, controller.signal).finally(() => {
+        if (syncAbortController === controller)
+            syncAbortController = null;
         syncInFlight = null;
     });
     return syncInFlight;
 }
+function abortAutoSync() {
+    syncAbortController?.abort();
+    syncAbortController = null;
+}
 function usage() {
     return `
 floom-mcp-sync v${SERVER_VERSION}
-Floom MCP server for Version 1 preview sync.
+Floom MCP server for Version 1 sync.
 
 Usage
   floom-mcp-sync
@@ -267,6 +278,7 @@ async function main() {
     const pollHandle = startPolling(intervalMs, syncState);
     const shutdown = (signal) => {
         clearInterval(pollHandle);
+        abortAutoSync();
         process.stderr.write(`[floom] received ${signal}, stopping sync poller\n`);
         process.exit(0);
     };
@@ -292,6 +304,7 @@ async function main() {
     }
     finally {
         clearInterval(pollHandle);
+        abortAutoSync();
         process.stderr.write("[floom] stdin closed, stopping sync poller\n");
     }
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@floomhq/floom-mcp-sync",
-  "version": "1.0.10",
-  "description": "Lightweight Floom MCP server for installing, publishing, and startup-syncing skills.",
+  "version": "1.0.12",
+  "description": "Lightweight Floom MCP server for search, on-demand skill fetch, status, and sync.",
   "license": "MIT",
   "type": "module",
   "bin": {
@@ -9,7 +9,12 @@
   },
   "files": [
     "bin",
-    "dist",
+    "dist/auto-sync.js",
+    "dist/lib",
+    "dist/server.js",
+    "dist/tools/get.js",
+    "dist/tools/search.js",
+    "dist/tools/status.js",
     "README.md",
     "LICENSE"
   ],

package/dist/tools/install.js

@@ -1,117 +0,0 @@
-import { constants } from "node:fs";
-import { lstat, mkdir, open } from "node:fs/promises";
-import { createHash } from "node:crypto";
-import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
-import { apiUrlFromConfig, readConfig, DEFAULT_API_URL } from "../lib/config.js";
-import { getText } from "../lib/api.js";
-import { assertValidSlug } from "../lib/slug.js";
-import { skillPath, skillsDir } from "../lib/paths.js";
-const FD_PATH_ROOT = "/proc/self/fd";
-export async function installSkill(slug) {
-    assertValidSlug(slug);
-    const cfg = await readConfig();
-    const apiUrl = cfg ? apiUrlFromConfig(cfg) : (process.env.FLOOM_API_URL ?? DEFAULT_API_URL).replace(/\/$/, "");
-    const body = await getText(`${apiUrl}/s/${slug}.md`);
-    if (typeof body !== "string")
-        throw new Error("Invalid skill response");
-    const target = skillPath(slug);
-    const remoteHash = sha256(body);
-    const existing = await localHash(target);
-    if (existing !== null && existing !== remoteHash) {
-        throw new Error("Local skill already exists with different content");
-    }
-    if (existing === null)
-        await writeInstallFile(target, body);
-    return { slug, path: target, bytes: Buffer.byteLength(body) };
-}
-function sha256(input) {
-    return createHash("sha256").update(input).digest("hex");
-}
-async function localHash(path) {
-    try {
-        const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
-        try {
-            const stat = await handle.stat();
-            if (!stat.isFile())
-                throw new Error("path is blocked by an existing local file or directory");
-            return sha256(await handle.readFile("utf8"));
-        }
-        finally {
-            await handle.close();
-        }
-    }
-    catch (err) {
-        if (err.code === "ENOENT")
-            return null;
-        throw err;
-    }
-}
-async function writeInstallFile(target, body) {
-    const parent = await openSafeParentDirectory(skillsDir(), target);
-    let handle = null;
-    try {
-        handle = await open(childCreatePath(parent, dirname(target), basename(target)), constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
-        await writeAll(handle, body);
-    }
-    finally {
-        await handle?.close();
-        await parent.close();
-    }
-}
-async function openSafeParentDirectory(root, target) {
-    await ensureSafeParentDirectory(root, target);
-    return open(dirname(target), constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
-}
-function childCreatePath(parent, fallbackParent, name) {
-    if (process.platform === "linux")
-        return `${FD_PATH_ROOT}/${parent.fd}/${name}`;
-    return join(resolve(fallbackParent), name);
-}
-async function writeAll(handle, body) {
-    const buffer = Buffer.from(body, "utf8");
-    let offset = 0;
-    while (offset < buffer.length) {
-        const result = await handle.write(buffer, offset, buffer.length - offset, offset);
-        if (result.bytesWritten === 0)
-            throw new Error("failed to write local skill file");
-        offset += result.bytesWritten;
-    }
-}
-async function ensureSafeParentDirectory(root, target) {
-    const resolvedRoot = resolve(root);
-    const resolvedParent = resolve(dirname(target));
-    const relativeParent = relative(resolvedRoot, resolvedParent);
-    if (relativeParent === ".." || relativeParent.startsWith(`..${sep}`) || isAbsolute(relativeParent)) {
-        throw new Error("Invalid skill target path");
-    }
-    await mkdir(resolvedRoot, { recursive: true, mode: 0o700 });
-    await assertSafeDirectory(resolvedRoot);
-    if (!relativeParent || relativeParent === ".")
-        return;
-    let current = resolvedRoot;
-    for (const segment of relativeParent.split(sep).filter(Boolean)) {
-        current = join(current, segment);
-        try {
-            await assertSafeDirectory(current);
-        }
-        catch (err) {
-            if (err.code !== "ENOENT")
-                throw err;
-            await mkdir(current, { mode: 0o700 });
-            await assertSafeDirectory(current);
-        }
-    }
-}
-async function assertSafeDirectory(path) {
-    const stat = await lstat(path);
-    if (stat.isSymbolicLink()) {
-        const err = new Error("path contains a symbolic link");
-        err.code = "ELOOP";
-        throw err;
-    }
-    if (!stat.isDirectory()) {
-        const err = new Error("path is blocked by an existing local file or directory");
-        err.code = "ENOTDIR";
-        throw err;
-    }
-}

package/dist/tools/libraries.js

@@ -1,28 +0,0 @@
-import { apiUrlFromConfig, readConfig, DEFAULT_API_URL } from "../lib/config.js";
-import { deleteRequest, getJson, postJson, putJson } from "../lib/api.js";
-export async function listLibraries() {
-    const cfg = await readConfig();
-    const apiUrl = cfg ? apiUrlFromConfig(cfg) : (process.env.FLOOM_API_URL ?? DEFAULT_API_URL).replace(/\/$/, "");
-    return await getJson(`${apiUrl}/api/v1/libraries`, cfg?.accessToken);
-}
-export async function subscribeLibrary(slug) {
-    const cfg = await readConfig();
-    if (!cfg)
-        throw new Error("Not signed in. Run `npx -y @floomhq/floom login` first.");
-    const apiUrl = apiUrlFromConfig(cfg);
-    return await postJson(`${apiUrl}/api/v1/me/subscriptions`, cfg.accessToken, { library_slug: slug });
-}
-export async function unsubscribeLibrary(slug) {
-    const cfg = await readConfig();
-    if (!cfg)
-        throw new Error("Not signed in. Run `npx -y @floomhq/floom login` first.");
-    const apiUrl = apiUrlFromConfig(cfg);
-    return await deleteRequest(`${apiUrl}/api/v1/me/subscriptions/${encodeURIComponent(slug)}`, cfg.accessToken);
-}
-export async function moveSkill(slug, folder, tags) {
-    const cfg = await readConfig();
-    if (!cfg)
-        throw new Error("Not signed in. Run `npx -y @floomhq/floom login` first.");
-    const apiUrl = apiUrlFromConfig(cfg);
-    return await putJson(`${apiUrl}/api/v1/me/skills/${encodeURIComponent(slug)}/override`, cfg.accessToken, { folder, tags });
-}

package/dist/tools/publish.js

@@ -1,24 +0,0 @@
-import { apiUrlFromConfig, readConfig } from "../lib/config.js";
-import { postJson } from "../lib/api.js";
-export async function publishSkill(name, content, description, visibility = "unlisted", assetType = "skill", installsAs = "claude_skill", version) {
-    const cfg = await readConfig();
-    if (!cfg)
-        throw new Error("Not signed in. Run `npx -y @floomhq/floom login` first.");
-    const apiUrl = apiUrlFromConfig(cfg);
-    const data = await postJson(`${apiUrl}/api/skills`, cfg.accessToken, {
-        title: name,
-        description: description ?? null,
-        body_md: content,
-        visibility,
-        asset_type: assetType,
-        source: "markdown",
-        installs_as: installsAs,
-        version: version ?? null,
-        published_via: "mcp",
-    });
-    return {
-        slug: data.slug,
-        url: data.url ?? `${apiUrl}/s/${data.slug}.md`,
-        ...(data.version ? { version: data.version } : {}),
-    };
-}