@floomhq/floom 1.0.55 → 1.0.57

package/README.md

@@ -26,6 +26,7 @@ The package is designed for `npx -y @floomhq/floom ...`. Global installs expose
 
 - `npx -y @floomhq/floom login` — sign in with Google. New accounts are created on first login. Token stored at `~/.floom/config.json`.
 - `npx -y @floomhq/floom init [path]` — create a starter skill folder at `<path>/SKILL.md`. Passing an existing-style `file.md` path still creates that Markdown file.
+- `npx -y @floomhq/floom scan <path>` — check a skill file or package for high-confidence secrets, prompt-injection text, exfiltration instructions, and unsupported package layout before publishing.
 - `npx -y @floomhq/floom publish <path>` — upload a skill folder or Markdown file. Folder packages use `<slug>/SKILL.md` plus optional `references/`, `examples/`, `scripts/`, and `assets/`. Optional `--public` / `--private` / `--unlisted`, `--type knowledge|instruction|workflow|skill`, `--installs-as <target>`, and `--skill-version <label>`.
 - `npx -y @floomhq/floom share <slug>` — email-share one of your skills. Optional `--add <email>`, `--remove <email>`, and `--list`.
 - `npx -y @floomhq/floom list` — show your published skills. Optional `--json`.

package/dist/audit.js

@@ -5,6 +5,7 @@ import { getJson, postJson } from "./lib/api.js";
 import { FloomError } from "./errors.js";
 import { c, symbols } from "./ui.js";
 const FIXTURE_RE = /\b(?:cli lifecycle audit fixture|launch gate|temp skill|test fixture|audit fixture)\b/i;
+const ARCHIVE_CHUNK_SIZE = 1000;
 function contentHash(skill) {
     return skill.content_sha256 ?? skill.content_hash ?? undefined;
 }
@@ -71,10 +72,21 @@ function scoreSkill(skill, duplicateGroup) {
         reasons,
         ...(hash ? { content_hash: hash } : {}),
         ...(duplicateGroup ? { duplicate_group: duplicateGroup } : {}),
-        recommended_action: score >= 70 ? "archive" : "review",
+        recommended_action: archiveRecommended(reasons) ? "archive" : "review",
         safe: !reasons.includes("possible_secret"),
     };
 }
+function archiveRecommended(reasons) {
+    if (reasons.includes("possible_secret"))
+        return true;
+    if (reasons.includes("launch_or_test_fixture"))
+        return true;
+    if (reasons.includes("blank_title") && reasons.includes("duplicate_content_hash"))
+        return true;
+    if (reasons.includes("near_empty_body") && reasons.includes("duplicate_content_hash"))
+        return true;
+    return false;
+}
 async function loadOwnedSkills() {
     const cfg = await readConfig();
     if (!cfg)
@@ -123,7 +135,20 @@ async function applyArchivePlan(planPath, yes, json) {
         throw new FloomError("Not signed in.", "Run `npx -y @floomhq/floom login` first.");
     const raw = JSON.parse(await readFile(planPath, "utf8"));
     const slugs = archiveSlugsFromPlan(raw);
-    const payload = await postJson(`${resolveApiUrl(cfg)}/api/v1/me/skills/archive`, yes ? "archive skills" : "preview skill archive", cfg.accessToken, { slugs, dry_run: !yes });
+    const chunks = [];
+    for (let i = 0; i < slugs.length; i += ARCHIVE_CHUNK_SIZE)
+        chunks.push(slugs.slice(i, i + ARCHIVE_CHUNK_SIZE));
+    const responses = [];
+    for (const chunk of chunks) {
+        responses.push(await postJson(`${resolveApiUrl(cfg)}/api/v1/me/skills/archive`, yes ? "archive skills" : "preview skill archive", cfg.accessToken, { slugs: chunk, dry_run: !yes }));
+    }
+    const payload = {
+        dry_run: responses.every((response) => response.dry_run),
+        requested: responses.reduce((sum, response) => sum + response.requested, 0),
+        matched: responses.flatMap((response) => response.matched),
+        missing: responses.flatMap((response) => response.missing),
+        ...(yes ? { archived: responses.flatMap((response) => response.archived ?? []) } : {}),
+    };
     if (json) {
         process.stdout.write(`${JSON.stringify(payload, null, 2)}\n`);
         return;

package/dist/daemon.js

@@ -11,6 +11,7 @@ const SERVICE_NAME = "floom-sync.service";
 const LAUNCHD_LABEL = "dev.floom.sync";
 const LOG_PATH = join(CONFIG_DIR, "daemon.log");
 const STATUS_PATH = join(CONFIG_DIR, "daemon-status.json");
+const NATIVE_BASELINE_VERSION = 2;
 const MIN_INTERVAL_SECONDS = 30;
 const MIN_TIMEOUT_SECONDS = 30;
 function targetsFor(value) {
@@ -127,12 +128,15 @@ async function runTarget(target, opts) {
         }
     }
     if (opts.push && ok) {
-        if (opts.yolo && !(await fileExists(nativeManifestPath))) {
+        if (opts.yolo && !(await fileExists(nativeBaselinePath(target)))) {
             const baselineResult = await runCommand([String(opts.timeoutSeconds), "watch", "--push", "--once", "--target", target, "--no-yolo"], { FLOOM_SYNC_MANIFEST_PATH: nativeManifestPath });
             if (baselineResult.code !== 0 || baselineResult.timedOut) {
                 ok = false;
                 error = baselineResult.timedOut ? "native baseline timed out" : `${baselineResult.stdout}\n${baselineResult.stderr}`.trim() || "native baseline failed";
             }
+            else {
+                await writeNativeBaselineMarker(target);
+            }
         }
     }
     if (opts.push && ok) {
@@ -169,6 +173,18 @@ async function fileExists(path) {
         throw err;
     }
 }
+function nativeBaselinePath(target) {
+    return join(CONFIG_DIR, "native-sync-manifests", `${target}.baseline-v${NATIVE_BASELINE_VERSION}.json`);
+}
+async function writeNativeBaselineMarker(target) {
+    const path = nativeBaselinePath(target);
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    await writeFile(path, `${JSON.stringify({
+        version: NATIVE_BASELINE_VERSION,
+        target,
+        created_at: new Date().toISOString(),
+    }, null, 2)}\n`, { mode: 0o600 });
+}
 async function sleep(ms) {
     await new Promise((resolve) => setTimeout(resolve, ms));
 }

package/dist/push-watch.js

@@ -6,7 +6,7 @@ import { CONFIG_DIR } from "./config.js";
 import { FloomError } from "./errors.js";
 import { publishSkillPath } from "./publish.js";
 import { readSkillPackage } from "./package.js";
-import { manifestKey, markSynced, readSyncManifest, writeSyncManifest } from "./sync-manifest.js";
+import { manifestKey, markSynced, readSyncManifest, unmarkSynced, writeSyncManifest } from "./sync-manifest.js";
 import { c, symbols } from "./ui.js";
 import { targetSkillsDir } from "./targets.js";
 const MANIFEST_VERSION = 1;
@@ -14,6 +14,7 @@ const PUSH_MANIFEST_PATH = join(CONFIG_DIR, "push-manifest.json");
 const MAX_SCAN_DEPTH = 8;
 const SKIP_DIRS = new Set([".cache", ".git", ".next", ".pytest_cache", "__pycache__", "build", "coverage", "dist", "node_modules", "out"]);
 const SLUG_RE = /^[A-Za-z0-9_-]{1,128}$/;
+const PROJECTION_MANIFEST_FILENAMES = [".floom-cli-sync-manifest.json", ".floom-sync-manifest.json"];
 function emptyManifest() {
     return { version: MANIFEST_VERSION, files: {} };
 }
@@ -103,6 +104,65 @@ function slugFromSyncManifest(root, skillFilePath, syncManifest) {
     const entry = syncManifest.files[key];
     return entry?.slug ?? null;
 }
+async function readProjectionManifest(root, target, syncManifest) {
+    const manifest = { version: 1, files: { ...syncManifest.files } };
+    const candidates = [
+        ...PROJECTION_MANIFEST_FILENAMES.map((name) => join(root, name)),
+        join(CONFIG_DIR, "native-sync-manifests", `${target}.json`),
+        ...PROJECTION_MANIFEST_FILENAMES.map((name) => join(CONFIG_DIR, "skill-cache", target, name)),
+    ];
+    const seen = new Set();
+    for (const candidate of candidates) {
+        const resolved = resolve(candidate);
+        if (seen.has(resolved))
+            continue;
+        seen.add(resolved);
+        const extra = await readSyncManifestFile(resolved);
+        Object.assign(manifest.files, extra.files);
+    }
+    return manifest;
+}
+async function readSyncManifestFile(path) {
+    try {
+        const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+        try {
+            const parsed = JSON.parse(await handle.readFile("utf8"));
+            if (parsed.version !== 1 || !parsed.files || typeof parsed.files !== "object")
+                return { version: 1, files: {} };
+            const files = {};
+            for (const [key, entry] of Object.entries(parsed.files)) {
+                if (entry &&
+                    typeof entry === "object" &&
+                    typeof entry.hash === "string" &&
+                    typeof entry.slug === "string" &&
+                    typeof entry.target === "string" &&
+                    typeof entry.syncedAt === "string" &&
+                    entry.target === key &&
+                    SLUG_RE.test(entry.slug)) {
+                    files[key] = entry;
+                }
+            }
+            return { version: 1, files };
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return { version: 1, files: {} };
+        if (err instanceof SyntaxError)
+            return { version: 1, files: {} };
+        throw err;
+    }
+}
+function isFloomCacheRoot(root, target) {
+    const relativeRoot = relative(resolve(CONFIG_DIR, "skill-cache", target), resolve(root));
+    return relativeRoot === "" || (!relativeRoot.startsWith(`..${sep}`) && relativeRoot !== ".." && !isAbsolute(relativeRoot));
+}
+function isExplicitlyPublished(entry) {
+    return entry?.source === "published" || entry?.source === "updated";
+}
 function slugFromPushManifest(key, pushManifest) {
     return pushManifest.files[key]?.slug ?? null;
 }
@@ -133,11 +193,16 @@ export async function pushWatchOnce(opts) {
     const root = targetSkillsDir(opts.target);
     const pushManifest = await readPushManifest();
     const syncManifest = await readSyncManifest();
+    const projectionManifest = await readProjectionManifest(root, opts.target, syncManifest);
+    const cacheRoot = isFloomCacheRoot(root, opts.target);
     const packages = await findSkillPackages(root);
+    const activePushKeys = new Set();
+    const activeSyncKeys = new Set();
     let published = 0;
     let updated = 0;
     let adopted = 0;
     let skipped = 0;
+    let syncManifestChanged = false;
     for (const packagePath of packages) {
         let skillPackage;
         try {
@@ -152,12 +217,23 @@ export async function pushWatchOnce(opts) {
         }
         const key = safeRootRelative(root, skillPackage.skillPath);
         const pushKey = pushManifestKey(opts.target, key);
+        activeSyncKeys.add(manifestKey(root, skillPackage.skillPath));
+        for (const file of skillPackage.packageFiles) {
+            activeSyncKeys.add(manifestKey(root, join(dirname(skillPackage.skillPath), ...file.path.split("/"))));
+        }
         const hash = hashPackage(key, skillPackage.skillBody, skillPackage.packageFiles);
         const pushed = pushManifest.files[pushKey];
+        const projectionSlug = slugFromSyncManifest(root, skillPackage.skillPath, projectionManifest);
+        if (cacheRoot || (projectionSlug !== null && !isExplicitlyPublished(pushed))) {
+            skipped += 1;
+            continue;
+        }
+        activePushKeys.add(pushKey);
         if (pushed?.hash === hash) {
             if (!isUnchangedSyncedPackage(root, skillPackage, syncManifest)) {
                 adopted += 1;
                 markPackageSynced(root, skillPackage, syncManifest, pushed.slug);
+                syncManifestChanged = true;
                 await writeSyncManifest(syncManifest);
             }
             else {
@@ -174,6 +250,7 @@ export async function pushWatchOnce(opts) {
                 slug: pushedSlug ?? syncedSlug ?? fallbackSlug ?? key,
                 path: key,
                 pushedAt: new Date().toISOString(),
+                source: pushed?.source ?? "adopted",
             };
             adopted += 1;
             continue;
@@ -200,16 +277,18 @@ export async function pushWatchOnce(opts) {
             try {
                 await publishSkillPath({ file: packagePath, update: true, updateSlug: slug, quiet: true });
                 updated += 1;
-                pushManifest.files[pushKey] = { hash, slug, path: key, pushedAt: new Date().toISOString() };
+                pushManifest.files[pushKey] = { hash, slug, path: key, pushedAt: new Date().toISOString(), source: "updated" };
                 markPackageSynced(root, skillPackage, syncManifest, slug);
+                syncManifestChanged = true;
                 await writeSyncManifest(syncManifest);
             }
             catch (err) {
                 if (err instanceof Error && /Skill not found/i.test(err.message)) {
                     const result = await publishSkillPath({ file: packagePath, visibility: "unlisted", quiet: true });
                     published += 1;
-                    pushManifest.files[pushKey] = { hash, slug: result.data.slug, path: key, pushedAt: new Date().toISOString() };
+                    pushManifest.files[pushKey] = { hash, slug: result.data.slug, path: key, pushedAt: new Date().toISOString(), source: "published" };
                     markPackageSynced(root, skillPackage, syncManifest, result.data.slug);
+                    syncManifestChanged = true;
                     await writeSyncManifest(syncManifest);
                     continue;
                 }
@@ -223,8 +302,9 @@ export async function pushWatchOnce(opts) {
         try {
             const result = await publishSkillPath({ file: packagePath, visibility: "unlisted", quiet: true });
             published += 1;
-            pushManifest.files[pushKey] = { hash, slug: result.data.slug, path: key, pushedAt: new Date().toISOString() };
+            pushManifest.files[pushKey] = { hash, slug: result.data.slug, path: key, pushedAt: new Date().toISOString(), source: "published" };
             markPackageSynced(root, skillPackage, syncManifest, result.data.slug);
+            syncManifestChanged = true;
             await writeSyncManifest(syncManifest);
         }
         catch (err) {
@@ -234,7 +314,19 @@ export async function pushWatchOnce(opts) {
             }
         }
     }
+    for (const key of Object.keys(pushManifest.files)) {
+        if (key.startsWith(`${opts.target}:`) && !activePushKeys.has(key))
+            delete pushManifest.files[key];
+    }
+    for (const key of Object.keys(syncManifest.files)) {
+        if (!activeSyncKeys.has(key)) {
+            unmarkSynced(syncManifest, key);
+            syncManifestChanged = true;
+        }
+    }
     await writePushManifest(pushManifest);
+    if (syncManifestChanged)
+        await writeSyncManifest(syncManifest);
     if (!opts.quiet && (published > 0 || updated > 0 || adopted > 0)) {
         process.stdout.write(`${symbols.ok}  Floom push watch: ${packages.length} scanned, ${published} published, ${updated} updated, ${adopted} adopted\n`);
     }

package/dist/sync.js

@@ -547,7 +547,7 @@ async function loadSyncPayload(apiUrl, token) {
         if (!Array.isArray(payload.skills))
             throw new FloomError("Invalid sync response.");
         all.push(...payload.skills);
-        fullSync = payload.full_sync === true;
+        fullSync = fullSync || payload.full_sync === true;
         if (!payload.next_cursor) {
             return { skills: all, full_sync: fullSync };
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floomhq/floom",
-  "version": "1.0.55",
+  "version": "1.0.57",
   "description": "Sync AI skills across agents and machines.",
   "license": "MIT",
   "type": "module",