@floomhq/floom 1.0.16 → 1.0.18

package/dist/package.js

@@ -253,6 +253,7 @@ export function normalizeRemotePackageFiles(input) {
         throw new FloomError("Skill package response has too many files.");
     }
     let totalBytes = 0;
+    const seenPaths = new Set();
     return input.map((raw) => {
         if (!raw || typeof raw !== "object")
             throw new FloomError("Invalid skill package response.");
@@ -260,6 +261,10 @@ export function normalizeRemotePackageFiles(input) {
         if (typeof file.path !== "string")
             throw new FloomError("Invalid skill package response.");
         validatePackageRelativePath(file.path);
+        const pathKey = file.path.toLowerCase();
+        if (seenPaths.has(pathKey))
+            throw new FloomError(`Duplicate package file: ${file.path}`);
+        seenPaths.add(pathKey);
         let bytes;
         if (typeof file.content_base64 === "string") {
             if (file.encoding !== undefined && file.encoding !== "base64") {

package/dist/secrets.js

@@ -13,7 +13,7 @@ const SECRET_PATTERNS = [
 ];
 const GENERIC_ASSIGNMENT_RE = /\b(?:api[_-]?key|secret|access[_-]?token|auth[_-]?token|bearer[_-]?token)\b\s*[:=]\s*["']?([A-Za-z0-9_./+=-]{24,})["']?/gi;
 const PROVIDER_LIKE_ASSIGNMENT_RE = /\b(?:api[_-]?key|secret|access[_-]?token|auth[_-]?token|bearer[_-]?token)\b\s*[:=]\s*["']?((?:sk|pk|rk)-[A-Za-z0-9_-]{8,}|sbp_[A-Za-z0-9]{12,}|xox[baprs]-[A-Za-z0-9-]{12,})["']?/gi;
-const PLACEHOLDER_RE = /(?:^|[_./+=-])(?:your|example|placeholder|replace|changeme|todo|xxx|demo|dummy|fake|redacted)(?:$|[_./+=-])/i;
+const PLACEHOLDER_RE = /(?:^|[_./+=-])(?:your|example|sample|placeholder|replace|changeme|todo|xxx|test|demo|dummy|fake|mock|staging|dev|local|redacted)(?:$|[_./+=-])/i;
 const PROMPT_INJECTION_PATTERNS = [
     { label: "Prompt injection instruction", regex: /\bignore (?:all )?(?:previous|prior|above|earlier) instructions\b/gi },
     { label: "Prompt injection instruction", regex: /\bdisregard (?:all )?(?:previous|prior|above|earlier) instructions\b/gi },

package/dist/sync.js

@@ -159,6 +159,7 @@ function syncPackageFiles(target, body, files) {
 async function planPackageSync(root, files, manifest) {
     let missing = 0;
     let unchanged = 0;
+    let firstMissingTarget = null;
     for (const file of files) {
         const targetKey = manifestKey(root, file.target);
         const tracked = manifest.files[targetKey];
@@ -179,8 +180,7 @@ async function planPackageSync(root, files, manifest) {
         if (state.kind === "conflict")
             return { kind: "conflict", target: state.conflictTarget ?? file.target, reason: state.reason };
         if (state.kind === "missing") {
-            if (tracked && files.length > 1)
-                return { kind: "conflict", target: file.target, reason: "local package file missing since the last Floom sync" };
+            firstMissingTarget ??= file.target;
             missing += 1;
             continue;
         }
@@ -196,10 +196,9 @@ async function planPackageSync(root, files, manifest) {
         return { kind: "unchanged" };
     if (missing === files.length)
         return { kind: "write" };
-    const missingFile = files.find((file) => !manifest.files[manifestKey(root, file.target)]);
     return {
         kind: "conflict",
-        target: missingFile?.target ?? files[0]?.target ?? root,
+        target: firstMissingTarget ?? files[0]?.target ?? root,
         reason: "local package is only partially installed",
     };
 }
@@ -301,6 +300,7 @@ export async function sync(opts = {}) {
             const activeTargetKeys = new Set();
             const pruneBlockedSlugs = new Set();
             let manifestChanged = false;
+            let synced = 0;
             const noteConflict = (target, reason) => {
                 conflicts += 1;
                 const rel = manifestKey(root, target);
@@ -334,6 +334,7 @@ export async function sync(opts = {}) {
                     }
                     const remotePackageFiles = normalizeRemotePackageFiles(skill.package_files ?? skill.files);
                     const packageFiles = syncPackageFiles(target, skill.body_md, remotePackageFiles);
+                    synced += 1;
                     for (const file of packageFiles)
                         activeTargetKeys.add(manifestKey(root, file.target));
                     const plan = await planPackageSync(root, packageFiles, manifest);
@@ -421,7 +422,6 @@ export async function sync(opts = {}) {
                 throw err;
             }
             spinner?.stop();
-            const synced = activeTargetKeys.size;
             const skippedNote = skipped > 0 ? c.dim(` (${skipped} skipped — invalid path)`) : "";
             const conflictNote = conflicts > 0 ? c.dim(`, ${conflicts} conflict${conflicts === 1 ? "" : "s"} skipped`) : "";
             const result = { synced, unchanged, updated, skipped, conflicts };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floomhq/floom",
-  "version": "1.0.16",
+  "version": "1.0.18",
   "description": "Sync AI skills across agents and machines.",
   "license": "MIT",
   "type": "module",