@floomhq/floom 1.0.56 → 1.0.58

package/README.md

@@ -26,6 +26,7 @@ The package is designed for `npx -y @floomhq/floom ...`. Global installs expose
 
 - `npx -y @floomhq/floom login` — sign in with Google. New accounts are created on first login. Token stored at `~/.floom/config.json`.
 - `npx -y @floomhq/floom init [path]` — create a starter skill folder at `<path>/SKILL.md`. Passing an existing-style `file.md` path still creates that Markdown file.
+- `npx -y @floomhq/floom scan <path>` — check a skill file or package for high-confidence secrets, prompt-injection text, exfiltration instructions, and unsupported package layout before publishing.
 - `npx -y @floomhq/floom publish <path>` — upload a skill folder or Markdown file. Folder packages use `<slug>/SKILL.md` plus optional `references/`, `examples/`, `scripts/`, and `assets/`. Optional `--public` / `--private` / `--unlisted`, `--type knowledge|instruction|workflow|skill`, `--installs-as <target>`, and `--skill-version <label>`.
 - `npx -y @floomhq/floom share <slug>` — email-share one of your skills. Optional `--add <email>`, `--remove <email>`, and `--list`.
 - `npx -y @floomhq/floom list` — show your published skills. Optional `--json`.

package/dist/daemon.js

@@ -11,6 +11,7 @@ const SERVICE_NAME = "floom-sync.service";
 const LAUNCHD_LABEL = "dev.floom.sync";
 const LOG_PATH = join(CONFIG_DIR, "daemon.log");
 const STATUS_PATH = join(CONFIG_DIR, "daemon-status.json");
+const NATIVE_BASELINE_VERSION = 2;
 const MIN_INTERVAL_SECONDS = 30;
 const MIN_TIMEOUT_SECONDS = 30;
 function targetsFor(value) {
@@ -127,12 +128,15 @@ async function runTarget(target, opts) {
         }
     }
     if (opts.push && ok) {
-        if (opts.yolo && !(await fileExists(nativeManifestPath))) {
+        if (opts.yolo && !(await fileExists(nativeBaselinePath(target)))) {
             const baselineResult = await runCommand([String(opts.timeoutSeconds), "watch", "--push", "--once", "--target", target, "--no-yolo"], { FLOOM_SYNC_MANIFEST_PATH: nativeManifestPath });
             if (baselineResult.code !== 0 || baselineResult.timedOut) {
                 ok = false;
                 error = baselineResult.timedOut ? "native baseline timed out" : `${baselineResult.stdout}\n${baselineResult.stderr}`.trim() || "native baseline failed";
             }
+            else {
+                await writeNativeBaselineMarker(target);
+            }
         }
     }
     if (opts.push && ok) {
@@ -169,6 +173,18 @@ async function fileExists(path) {
         throw err;
     }
 }
+function nativeBaselinePath(target) {
+    return join(CONFIG_DIR, "native-sync-manifests", `${target}.baseline-v${NATIVE_BASELINE_VERSION}.json`);
+}
+async function writeNativeBaselineMarker(target) {
+    const path = nativeBaselinePath(target);
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    await writeFile(path, `${JSON.stringify({
+        version: NATIVE_BASELINE_VERSION,
+        target,
+        created_at: new Date().toISOString(),
+    }, null, 2)}\n`, { mode: 0o600 });
+}
 async function sleep(ms) {
     await new Promise((resolve) => setTimeout(resolve, ms));
 }

package/dist/push-watch.js

@@ -14,6 +14,7 @@ const PUSH_MANIFEST_PATH = join(CONFIG_DIR, "push-manifest.json");
 const MAX_SCAN_DEPTH = 8;
 const SKIP_DIRS = new Set([".cache", ".git", ".next", ".pytest_cache", "__pycache__", "build", "coverage", "dist", "node_modules", "out"]);
 const SLUG_RE = /^[A-Za-z0-9_-]{1,128}$/;
+const PROJECTION_MANIFEST_FILENAMES = [".floom-cli-sync-manifest.json", ".floom-sync-manifest.json"];
 function emptyManifest() {
     return { version: MANIFEST_VERSION, files: {} };
 }
@@ -103,6 +104,65 @@ function slugFromSyncManifest(root, skillFilePath, syncManifest) {
     const entry = syncManifest.files[key];
     return entry?.slug ?? null;
 }
+async function readProjectionManifest(root, target, syncManifest) {
+    const manifest = { version: 1, files: { ...syncManifest.files } };
+    const candidates = [
+        ...PROJECTION_MANIFEST_FILENAMES.map((name) => join(root, name)),
+        join(CONFIG_DIR, "native-sync-manifests", `${target}.json`),
+        ...PROJECTION_MANIFEST_FILENAMES.map((name) => join(CONFIG_DIR, "skill-cache", target, name)),
+    ];
+    const seen = new Set();
+    for (const candidate of candidates) {
+        const resolved = resolve(candidate);
+        if (seen.has(resolved))
+            continue;
+        seen.add(resolved);
+        const extra = await readSyncManifestFile(resolved);
+        Object.assign(manifest.files, extra.files);
+    }
+    return manifest;
+}
+async function readSyncManifestFile(path) {
+    try {
+        const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+        try {
+            const parsed = JSON.parse(await handle.readFile("utf8"));
+            if (parsed.version !== 1 || !parsed.files || typeof parsed.files !== "object")
+                return { version: 1, files: {} };
+            const files = {};
+            for (const [key, entry] of Object.entries(parsed.files)) {
+                if (entry &&
+                    typeof entry === "object" &&
+                    typeof entry.hash === "string" &&
+                    typeof entry.slug === "string" &&
+                    typeof entry.target === "string" &&
+                    typeof entry.syncedAt === "string" &&
+                    entry.target === key &&
+                    SLUG_RE.test(entry.slug)) {
+                    files[key] = entry;
+                }
+            }
+            return { version: 1, files };
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return { version: 1, files: {} };
+        if (err instanceof SyntaxError)
+            return { version: 1, files: {} };
+        throw err;
+    }
+}
+function isFloomCacheRoot(root, target) {
+    const relativeRoot = relative(resolve(CONFIG_DIR, "skill-cache", target), resolve(root));
+    return relativeRoot === "" || (!relativeRoot.startsWith(`..${sep}`) && relativeRoot !== ".." && !isAbsolute(relativeRoot));
+}
+function isExplicitlyPublished(entry) {
+    return entry?.source === "published" || entry?.source === "updated";
+}
 function slugFromPushManifest(key, pushManifest) {
     return pushManifest.files[key]?.slug ?? null;
 }
@@ -133,6 +193,8 @@ export async function pushWatchOnce(opts) {
     const root = targetSkillsDir(opts.target);
     const pushManifest = await readPushManifest();
     const syncManifest = await readSyncManifest();
+    const projectionManifest = await readProjectionManifest(root, opts.target, syncManifest);
+    const cacheRoot = isFloomCacheRoot(root, opts.target);
     const packages = await findSkillPackages(root);
     const activePushKeys = new Set();
     const activeSyncKeys = new Set();
@@ -155,13 +217,18 @@ export async function pushWatchOnce(opts) {
         }
         const key = safeRootRelative(root, skillPackage.skillPath);
         const pushKey = pushManifestKey(opts.target, key);
-        activePushKeys.add(pushKey);
         activeSyncKeys.add(manifestKey(root, skillPackage.skillPath));
         for (const file of skillPackage.packageFiles) {
             activeSyncKeys.add(manifestKey(root, join(dirname(skillPackage.skillPath), ...file.path.split("/"))));
         }
         const hash = hashPackage(key, skillPackage.skillBody, skillPackage.packageFiles);
         const pushed = pushManifest.files[pushKey];
+        const projectionSlug = slugFromSyncManifest(root, skillPackage.skillPath, projectionManifest);
+        if (cacheRoot || (projectionSlug !== null && !isExplicitlyPublished(pushed))) {
+            skipped += 1;
+            continue;
+        }
+        activePushKeys.add(pushKey);
         if (pushed?.hash === hash) {
             if (!isUnchangedSyncedPackage(root, skillPackage, syncManifest)) {
                 adopted += 1;
@@ -183,6 +250,7 @@ export async function pushWatchOnce(opts) {
                 slug: pushedSlug ?? syncedSlug ?? fallbackSlug ?? key,
                 path: key,
                 pushedAt: new Date().toISOString(),
+                source: pushed?.source ?? "adopted",
             };
             adopted += 1;
             continue;
@@ -209,7 +277,7 @@ export async function pushWatchOnce(opts) {
             try {
                 await publishSkillPath({ file: packagePath, update: true, updateSlug: slug, quiet: true });
                 updated += 1;
-                pushManifest.files[pushKey] = { hash, slug, path: key, pushedAt: new Date().toISOString() };
+                pushManifest.files[pushKey] = { hash, slug, path: key, pushedAt: new Date().toISOString(), source: "updated" };
                 markPackageSynced(root, skillPackage, syncManifest, slug);
                 syncManifestChanged = true;
                 await writeSyncManifest(syncManifest);
@@ -218,7 +286,7 @@ export async function pushWatchOnce(opts) {
                 if (err instanceof Error && /Skill not found/i.test(err.message)) {
                     const result = await publishSkillPath({ file: packagePath, visibility: "unlisted", quiet: true });
                     published += 1;
-                    pushManifest.files[pushKey] = { hash, slug: result.data.slug, path: key, pushedAt: new Date().toISOString() };
+                    pushManifest.files[pushKey] = { hash, slug: result.data.slug, path: key, pushedAt: new Date().toISOString(), source: "published" };
                     markPackageSynced(root, skillPackage, syncManifest, result.data.slug);
                     syncManifestChanged = true;
                     await writeSyncManifest(syncManifest);
@@ -234,7 +302,7 @@ export async function pushWatchOnce(opts) {
         try {
             const result = await publishSkillPath({ file: packagePath, visibility: "unlisted", quiet: true });
             published += 1;
-            pushManifest.files[pushKey] = { hash, slug: result.data.slug, path: key, pushedAt: new Date().toISOString() };
+            pushManifest.files[pushKey] = { hash, slug: result.data.slug, path: key, pushedAt: new Date().toISOString(), source: "published" };
             markPackageSynced(root, skillPackage, syncManifest, result.data.slug);
             syncManifestChanged = true;
             await writeSyncManifest(syncManifest);

package/dist/sync.js

@@ -152,6 +152,7 @@ function syncPackageFiles(target, body, files) {
 }
 async function planPackageSync(root, files, manifest) {
     let missing = 0;
+    let missingTracked = 0;
     let unchanged = 0;
     let remoteChanged = 0;
     let firstMissingTarget = null;
@@ -176,6 +177,10 @@ async function planPackageSync(root, files, manifest) {
             return { kind: "conflict", target: state.conflictTarget ?? file.target, reason: state.reason };
         if (state.kind === "missing") {
             firstMissingTarget ??= file.target;
+            if (tracked) {
+                missingTracked += 1;
+                continue;
+            }
             missing += 1;
             continue;
         }
@@ -195,15 +200,20 @@ async function planPackageSync(root, files, manifest) {
     }
     if (unchanged === files.length)
         return { kind: "unchanged" };
+    if (missing + missingTracked === files.length)
+        return { kind: "write" };
+    if (missingTracked > 0) {
+        return {
+            kind: "conflict",
+            target: firstMissingTarget ?? files[0]?.target ?? root,
+            reason: "local package is only partially installed",
+        };
+    }
     if (missing === 0 && remoteChanged > 0)
         return { kind: "update" };
     if (missing === files.length)
         return { kind: "write" };
-    return {
-        kind: "conflict",
-        target: firstMissingTarget ?? files[0]?.target ?? root,
-        reason: "local package is only partially installed",
-    };
+    return { kind: "update" };
 }
 async function overwriteTrackedFile(root, target, body, expectedHash) {
     const parent = await openSafeParentDirectory(root, target, false);
@@ -410,9 +420,20 @@ export async function sync(opts = {}) {
                             for (const file of packageFiles) {
                                 const targetKey = manifestKey(root, file.target);
                                 const tracked = manifest.files[targetKey];
-                                if (!tracked)
-                                    throw conflictError("existing file is not tracked by Floom sync", "EEXIST");
-                                await overwriteTrackedFile(root, file.target, file.bytes, tracked.hash);
+                                if (tracked) {
+                                    await overwriteTrackedFile(root, file.target, file.bytes, tracked.hash);
+                                    continue;
+                                }
+                                const state = await localState(file.target);
+                                if (state.kind === "missing") {
+                                    await writeSyncedFile(root, file.target, file.bytes);
+                                    continue;
+                                }
+                                if (state.kind === "conflict")
+                                    throw conflictError(state.reason, "EEXIST");
+                                if (state.hash === file.hash)
+                                    continue;
+                                throw conflictError("existing file is not tracked by Floom sync", "EEXIST");
                             }
                         }
                         else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floomhq/floom",
-  "version": "1.0.56",
+  "version": "1.0.58",
   "description": "Sync AI skills across agents and machines.",
   "license": "MIT",
   "type": "module",