@floomhq/floom 1.0.32 → 1.0.34

package/dist/errors.js

@@ -28,6 +28,9 @@ export function friendlyHttp(status, action) {
     if (status === 413) {
         return new FloomError("That file is too large to publish.");
     }
+    if (status === 429) {
+        return new FloomError("Floom is rate limiting requests.", "The CLI retries rate-limited requests automatically. Try again in a moment if this persists.");
+    }
     if (status >= 500) {
         return new FloomError("Floom is having trouble right now.", "Try again in a moment.");
     }

package/dist/lib/api.js

@@ -11,30 +11,39 @@ export async function floomFetch(url, action, opts = {}) {
         headers.authorization = `Bearer ${opts.token}`;
     if (opts.body !== undefined)
         headers["content-type"] = "application/json";
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), requestTimeoutMs(opts.timeoutMs));
-    let res;
-    try {
-        res = await fetch(url, {
-            method: opts.method ?? "GET",
-            headers,
-            signal: controller.signal,
-            ...(opts.body !== undefined ? { body: JSON.stringify(opts.body) } : {}),
-        });
-    }
-    catch (err) {
-        if (err.name === "AbortError") {
-            throw new FloomError(`Request timed out while trying to ${action}.`, "Try again in a moment.");
+    const attempts = Math.max(1, 1 + rateLimitRetries(opts.rateLimitRetries));
+    for (let attempt = 0; attempt < attempts; attempt += 1) {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), requestTimeoutMs(opts.timeoutMs));
+        let res;
+        try {
+            res = await fetch(url, {
+                method: opts.method ?? "GET",
+                headers,
+                signal: controller.signal,
+                ...(opts.body !== undefined ? { body: JSON.stringify(opts.body) } : {}),
+            });
         }
-        throw friendlyNetwork(err);
-    }
-    finally {
-        clearTimeout(timer);
-    }
-    if (opts.checkOk !== false && !res.ok) {
-        throw friendlyHttp(res.status, action);
+        catch (err) {
+            if (err.name === "AbortError") {
+                throw new FloomError(`Request timed out while trying to ${action}.`, "Try again in a moment.");
+            }
+            throw friendlyNetwork(err);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        if (res.status === 429 && attempt < attempts - 1) {
+            await drainResponse(res);
+            await sleep(rateLimitDelayMs(res, attempt));
+            continue;
+        }
+        if (opts.checkOk !== false && !res.ok) {
+            throw friendlyHttp(res.status, action);
+        }
+        return res;
     }
-    return res;
+    throw new FloomError(`Request failed (HTTP 429) while trying to ${action}.`);
 }
 function requestTimeoutMs(override) {
     if (override !== undefined)
@@ -44,6 +53,50 @@ function requestTimeoutMs(override) {
         return fromEnv;
     return DEFAULT_TIMEOUT_MS;
 }
+function rateLimitRetries(override) {
+    if (override !== undefined)
+        return Math.max(0, Math.floor(override));
+    const fromEnv = Number(process.env.FLOOM_RATE_LIMIT_RETRIES);
+    if (Number.isFinite(fromEnv) && fromEnv >= 0)
+        return Math.floor(fromEnv);
+    return 8;
+}
+function rateLimitDelayMs(res, attempt) {
+    const retryAfter = res.headers.get("retry-after");
+    if (retryAfter) {
+        const seconds = Number(retryAfter);
+        if (Number.isFinite(seconds) && seconds >= 0) {
+            return capRateLimitDelay(seconds * 1000);
+        }
+        const dateMs = Date.parse(retryAfter);
+        if (Number.isFinite(dateMs)) {
+            return capRateLimitDelay(Math.max(0, dateMs - Date.now()));
+        }
+    }
+    const resetSeconds = Number(res.headers.get("x-ratelimit-reset"));
+    if (Number.isFinite(resetSeconds) && resetSeconds > 0) {
+        return capRateLimitDelay(Math.max(0, (resetSeconds * 1000) - Date.now()));
+    }
+    const base = Number(process.env.FLOOM_RATE_LIMIT_RETRY_MS);
+    const fallback = Number.isFinite(base) && base >= 0 ? base : 1_000;
+    return capRateLimitDelay(fallback * (attempt + 1));
+}
+function capRateLimitDelay(ms) {
+    const fromEnv = Number(process.env.FLOOM_RATE_LIMIT_MAX_WAIT_MS);
+    const max = Number.isFinite(fromEnv) && fromEnv > 0 ? fromEnv : 65_000;
+    return Math.min(Math.max(0, ms), max);
+}
+async function drainResponse(res) {
+    try {
+        await res.arrayBuffer();
+    }
+    catch {
+        // Ignore bodies from rate-limit responses; the retry decision is header-based.
+    }
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
 export async function getJson(url, action, token) {
     const res = await floomFetch(url, action, token ? { token } : {});
     return (await res.json());

package/dist/package.js

@@ -216,7 +216,7 @@ async function collectPackageFiles(root) {
             continue;
         if (await isIgnored(entry.name))
             continue;
-        if (entry.isDirectory() && await isNestedSkillDir(join(root, entry.name)))
+        if (entry.isDirectory() && await hasNestedSkillDir(join(root, entry.name)))
             continue;
         if (entry.isSymbolicLink())
             continue;
@@ -287,16 +287,39 @@ async function collectDir(root, dir, files, isIgnored, addBytes) {
         await collectFile(fullPath, rel, files, addBytes);
     }
 }
-async function isNestedSkillDir(path) {
+async function hasNestedSkillDir(path) {
+    return hasNestedSkillDirInner(path, 0);
+}
+async function hasNestedSkillDirInner(path, depth) {
+    if (depth > 8)
+        return false;
     try {
         const stat = await lstat(join(path, "SKILL.md"));
-        return stat.isFile();
+        if (stat.isFile())
+            return true;
+    }
+    catch (err) {
+        if (err.code !== "ENOENT")
+            throw err;
+    }
+    let entries;
+    try {
+        entries = await readdir(path, { withFileTypes: true });
     }
     catch (err) {
         if (err.code === "ENOENT")
             return false;
         throw err;
     }
+    for (const entry of entries) {
+        if (!entry.isDirectory() || entry.isSymbolicLink())
+            continue;
+        if (isGeneratedPackageEntry(entry.name, true))
+            continue;
+        if (await hasNestedSkillDirInner(join(path, entry.name), depth + 1))
+            return true;
+    }
+    return false;
 }
 async function collectFile(fullPath, rel, files, addBytes) {
     const normalized = rel.split(sep).join("/");

package/dist/secrets.js

@@ -23,7 +23,6 @@ const PROMPT_INJECTION_PATTERNS = [
 ];
 const DATA_EXFILTRATION_PATTERNS = [
     { label: "Data exfiltration instruction", regex: /\b(?:send|post|upload|exfiltrate|copy) (?:[^.\n]{0,80})\b(?:api keys?|tokens?|secrets?|environment variables|\.env|credentials)\b(?:[^.\n]{0,120})\b(?:to|into) https?:\/\//gi },
-    { label: "Data exfiltration instruction", regex: /\b(?:curl|wget|fetch)\b[^\n]{0,160}\b(?:api keys?|tokens?|secrets?|environment variables|\.env|credentials)\b/gi },
     { label: "Credential harvesting instruction", regex: /\b(?:collect|harvest|steal|extract) (?:[^.\n]{0,80})\b(?:api keys?|tokens?|secrets?|environment variables|\.env|credentials)\b/gi },
 ];
 function redact(value) {
@@ -46,6 +45,9 @@ function pushFinding(findings, seen, label, line, value) {
     seen.add(key);
     findings.push({ label, line, preview: redact(value) });
 }
+function isDocumentedEnvReference(value) {
+    return /\b(?:process\.env|import\.meta\.env|os\.environ)\b/.test(value);
+}
 export function detectSecrets(input) {
     const findings = [];
     const seen = new Set();
@@ -61,6 +63,8 @@ export function detectSecrets(input) {
         const value = match[1] ?? "";
         if (!value || PLACEHOLDER_RE.test(value))
             continue;
+        if (isDocumentedEnvReference(value))
+            continue;
         pushFinding(findings, seen, "Possible secret assignment", lineNumberAt(input, match.index ?? 0), value);
     }
     PROVIDER_LIKE_ASSIGNMENT_RE.lastIndex = 0;
@@ -68,6 +72,8 @@ export function detectSecrets(input) {
         const value = match[1] ?? "";
         if (!value)
             continue;
+        if (isDocumentedEnvReference(value))
+            continue;
         pushFinding(findings, seen, "Provider-like secret assignment", lineNumberAt(input, match.index ?? 0), value);
     }
     return findings.sort((a, b) => a.line - b.line || a.label.localeCompare(b.label));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floomhq/floom",
-  "version": "1.0.32",
+  "version": "1.0.34",
   "description": "Sync AI skills across agents and machines.",
   "license": "MIT",
   "type": "module",