@floomhq/floom 1.0.33 → 1.0.35

package/dist/package.js

@@ -216,7 +216,7 @@ async function collectPackageFiles(root) {
             continue;
         if (await isIgnored(entry.name))
             continue;
-        if (entry.isDirectory() && await isNestedSkillDir(join(root, entry.name)))
+        if (entry.isDirectory() && await hasNestedSkillDir(join(root, entry.name)))
             continue;
         if (entry.isSymbolicLink())
             continue;
@@ -287,16 +287,39 @@ async function collectDir(root, dir, files, isIgnored, addBytes) {
         await collectFile(fullPath, rel, files, addBytes);
     }
 }
-async function isNestedSkillDir(path) {
+async function hasNestedSkillDir(path) {
+    return hasNestedSkillDirInner(path, 0);
+}
+async function hasNestedSkillDirInner(path, depth) {
+    if (depth > 8)
+        return false;
     try {
         const stat = await lstat(join(path, "SKILL.md"));
-        return stat.isFile();
+        if (stat.isFile())
+            return true;
+    }
+    catch (err) {
+        if (err.code !== "ENOENT")
+            throw err;
+    }
+    let entries;
+    try {
+        entries = await readdir(path, { withFileTypes: true });
     }
     catch (err) {
         if (err.code === "ENOENT")
             return false;
         throw err;
     }
+    for (const entry of entries) {
+        if (!entry.isDirectory() || entry.isSymbolicLink())
+            continue;
+        if (isGeneratedPackageEntry(entry.name, true))
+            continue;
+        if (await hasNestedSkillDirInner(join(path, entry.name), depth + 1))
+            return true;
+    }
+    return false;
 }
 async function collectFile(fullPath, rel, files, addBytes) {
     const normalized = rel.split(sep).join("/");

package/dist/push-watch.js

@@ -155,7 +155,14 @@ export async function pushWatchOnce(opts) {
         const hash = hashPackage(key, skillPackage.skillBody, skillPackage.packageFiles);
         const pushed = pushManifest.files[pushKey];
         if (pushed?.hash === hash) {
-            skipped += 1;
+            if (!isUnchangedSyncedPackage(root, skillPackage, syncManifest)) {
+                markPackageSynced(root, skillPackage, syncManifest, pushed.slug);
+                await writeSyncManifest(syncManifest);
+                adopted += 1;
+            }
+            else {
+                skipped += 1;
+            }
             continue;
         }
         if (!opts.yolo) {

package/dist/secrets.js

@@ -23,7 +23,6 @@ const PROMPT_INJECTION_PATTERNS = [
 ];
 const DATA_EXFILTRATION_PATTERNS = [
     { label: "Data exfiltration instruction", regex: /\b(?:send|post|upload|exfiltrate|copy) (?:[^.\n]{0,80})\b(?:api keys?|tokens?|secrets?|environment variables|\.env|credentials)\b(?:[^.\n]{0,120})\b(?:to|into) https?:\/\//gi },
-    { label: "Data exfiltration instruction", regex: /\b(?:curl|wget|fetch)\b[^\n]{0,160}\b(?:api keys?|tokens?|secrets?|environment variables|\.env|credentials)\b/gi },
     { label: "Credential harvesting instruction", regex: /\b(?:collect|harvest|steal|extract) (?:[^.\n]{0,80})\b(?:api keys?|tokens?|secrets?|environment variables|\.env|credentials)\b/gi },
 ];
 function redact(value) {
@@ -46,6 +45,9 @@ function pushFinding(findings, seen, label, line, value) {
     seen.add(key);
     findings.push({ label, line, preview: redact(value) });
 }
+function isDocumentedEnvReference(value) {
+    return /\b(?:process\.env|import\.meta\.env|os\.environ)\b/.test(value);
+}
 export function detectSecrets(input) {
     const findings = [];
     const seen = new Set();
@@ -61,6 +63,8 @@ export function detectSecrets(input) {
         const value = match[1] ?? "";
         if (!value || PLACEHOLDER_RE.test(value))
             continue;
+        if (isDocumentedEnvReference(value))
+            continue;
         pushFinding(findings, seen, "Possible secret assignment", lineNumberAt(input, match.index ?? 0), value);
     }
     PROVIDER_LIKE_ASSIGNMENT_RE.lastIndex = 0;
@@ -68,6 +72,8 @@ export function detectSecrets(input) {
         const value = match[1] ?? "";
         if (!value)
             continue;
+        if (isDocumentedEnvReference(value))
+            continue;
         pushFinding(findings, seen, "Provider-like secret assignment", lineNumberAt(input, match.index ?? 0), value);
     }
     return findings.sort((a, b) => a.line - b.line || a.label.localeCompare(b.label));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floomhq/floom",
-  "version": "1.0.33",
+  "version": "1.0.35",
   "description": "Sync AI skills across agents and machines.",
   "license": "MIT",
   "type": "module",