@hasna/skills 0.10.0 → 0.10.2

package/bin/mcp.js

@@ -20019,7 +20019,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.10.0",
+    version: "0.10.2",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -20974,10 +20974,16 @@ var init_transport = __esm(() => {
   ]);
 });
 
+// src/lib/cli-credential-profile.ts
+function selectedCliSkillsCredentialProfile() {
+  return cliCredentialProfile;
+}
+var cliCredentialProfile;
+
 // src/lib/instance-credentials.ts
 import { closeSync as closeSync3, constants, fstatSync as fstatSync3, lstatSync as lstatSync2, openSync as openSync3, readSync } from "fs";
 function selectedSkillsProfile(env, explicit) {
-  const selected = explicit ?? env.HASNA_PROFILE;
+  const selected = explicit ?? selectedCliSkillsCredentialProfile() ?? env.HASNA_PROFILE;
   if (selected === undefined)
     return null;
   const profile = selected.trim();
@@ -21263,11 +21269,13 @@ function snapshotSkillsEnvironment(env) {
   return Object.freeze(snapshot);
 }
 function snapshotSkillsOptions(env, options) {
+  const profile = options.credentials?.profile ?? selectedCliSkillsCredentialProfile();
+  const credentials = profile === undefined ? options.credentials : { ...options.credentials, profile };
   if (env !== process.env)
-    return options;
-  return { ...options, credentials: { ...options.credentials, keychain: {
-    ...options.credentials?.keychain,
-    enabled: options.credentials?.keychain?.enabled ?? true
+    return credentials === options.credentials ? options : { ...options, credentials };
+  return { ...options, credentials: { ...credentials, keychain: {
+    ...credentials?.keychain,
+    enabled: credentials?.keychain?.enabled ?? true
   } } };
 }
 function resolveSkillsFleetOrThrow(env, options) {
@@ -21355,8 +21363,9 @@ async function resolveSkillsApiKey(env = process.env, options = {}) {
 }
 async function resolveSkillsConnection(env = process.env, options = {}) {
   const snapshotEnv = snapshotSkillsEnvironment(env);
-  const assertFilesUnchanged = selectsSkillsLocalMode(snapshotEnv) ? () => {} : captureSkillsCredentialFiles(skillsProfileCredentialFiles(snapshotEnv, options.credentials?.profile));
-  const fleet = resolveSkillsFleet(snapshotEnv, snapshotSkillsOptions(env, options));
+  const resolvedOptions = snapshotSkillsOptions(env, options);
+  const assertFilesUnchanged = selectsSkillsLocalMode(snapshotEnv) ? () => {} : captureSkillsCredentialFiles(skillsProfileCredentialFiles(snapshotEnv, resolvedOptions.credentials?.profile));
+  const fleet = resolveSkillsFleet(snapshotEnv, resolvedOptions);
   if (fleet.mode === "local" && env === process.env)
     noticeLocalSkillsMode();
   if (fleet.mode !== "hosted")
@@ -46391,7 +46400,9 @@ var init_skill_version = __esm(() => {
 
 // src/lib/selection-cache.ts
 import { createHash as createHash7, randomUUID } from "crypto";
-import { closeSync as closeSync6, constants as constants3, fstatSync as fstatSync6, fsyncSync, lstatSync as lstatSync8, mkdirSync as mkdirSync3, openSync as openSync6, readSync as readSync3, renameSync, unlinkSync, writeFileSync as writeFileSync3 } from "fs";
+import { spawnSync as spawnSync2 } from "child_process";
+import { closeSync as closeSync6, constants as constants3, fstatSync as fstatSync6, fsyncSync, lstatSync as lstatSync8, mkdirSync as mkdirSync3, openSync as openSync6, readFileSync as readFileSync10, readlinkSync as readlinkSync2, readSync as readSync3, renameSync, unlinkSync, writeFileSync as writeFileSync3 } from "fs";
+import { hostname as hostname3 } from "os";
 import { dirname as dirname8, join as join14, parse as parse7, resolve as resolve7 } from "path";
 import { isDeepStrictEqual } from "util";
 function selectionCacheRoot(options = {}) {
@@ -46661,6 +46672,164 @@ function readSkillSessionSnapshotIfExists(sessionId, options = {}) {
 function skillSessionSnapshotBinding(snapshot) {
   return { sessionId: snapshot.sessionId, generation: snapshot.generation, receiptSha256: snapshot.receiptSha256 };
 }
+function localBootId() {
+  try {
+    if (process.platform === "linux") {
+      const value = readFileSync10("/proc/sys/kernel/random/boot_id", "utf8").trim();
+      return /^[a-f0-9-]{36}$/i.test(value) ? value : null;
+    }
+    if (process.platform === "darwin") {
+      const result = spawnSync2("/usr/sbin/sysctl", ["-n", "kern.boottime"], { encoding: "utf8", timeout: 3000, env: { LC_ALL: "C" } });
+      if (result.status !== 0 || result.error)
+        return null;
+      const seconds = /\bsec\s*=\s*(\d+)\b/.exec(result.stdout)?.[1];
+      return seconds ? `darwin:${seconds}` : null;
+    }
+  } catch {}
+  return null;
+}
+function processStart(pid) {
+  if (!Number.isSafeInteger(pid) || pid <= 0)
+    return { state: "unknown" };
+  if (process.platform === "linux") {
+    try {
+      const stat = readFileSync10(`/proc/${pid}/stat`, "utf8");
+      const close = stat.lastIndexOf(")");
+      const start = close < 0 ? undefined : stat.slice(close + 2).trim().split(/\s+/)[19];
+      return start && /^\d+$/.test(start) ? { state: "alive", start: `linux:${start}` } : { state: "unknown" };
+    } catch (error61) {
+      return { state: error61.code === "ENOENT" ? "absent" : "unknown" };
+    }
+  }
+  if (process.platform === "darwin") {
+    const result = spawnSync2("/bin/ps", ["-p", String(pid), "-o", "lstart="], { encoding: "utf8", timeout: 3000, env: { LC_ALL: "C" } });
+    if (result.error || result.signal)
+      return { state: "unknown" };
+    const start = result.stdout.trim();
+    if (result.status === 1 && !start && !result.stderr.trim())
+      return { state: "absent" };
+    return result.status === 0 && start ? { state: "alive", start: `darwin:${start}` } : { state: "unknown" };
+  }
+  return { state: "unknown" };
+}
+function localLockIdentity() {
+  const bootId = localBootId(), owner = processStart(process.pid);
+  if (!bootId || owner.state !== "alive")
+    return null;
+  let pidNamespace;
+  if (process.platform === "linux") {
+    try {
+      pidNamespace = readlinkSync2("/proc/self/ns/pid");
+    } catch {
+      return null;
+    }
+    if (!/^pid:\[\d+\]$/.test(pidNamespace))
+      return null;
+  }
+  return { host: hostname3(), bootId, pidNamespace, processStart: owner.start };
+}
+function readSessionLock(sessionId, options) {
+  const path = `${sessionReceiptPath(sessionId, options)}.write-lock`;
+  const before = lstatSync8(path, { throwIfNoEntry: false });
+  if (!before)
+    return null;
+  if (!before.isFile() || before.nlink !== 1 || process.getuid && before.uid !== process.getuid()) {
+    throw new SkillSelectionError("SESSION_WRITE_LOCKED", "The session lock is not a private regular file; recovery requires review.");
+  }
+  const bytes = readRegularFile(path, SESSION_LOCK_MAX_BYTES);
+  const after = lstatSync8(path, { throwIfNoEntry: false });
+  if (!bytes || !after?.isFile() || before.dev !== after.dev || before.ino !== after.ino || before.mtimeMs !== after.mtimeMs) {
+    throw new SkillSelectionError("SESSION_WRITE_LOCKED", "The session lock changed during inspection; recovery requires review.");
+  }
+  let marker;
+  try {
+    marker = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+  } catch {
+    throw new SkillSelectionError("SESSION_WRITE_LOCKED", "The session lock is unreadable; recovery requires review.");
+  }
+  if (!marker || ![1, 2].includes(marker.schemaVersion) || marker.sessionId !== sessionId || !/^[a-f0-9-]{36}$/i.test(marker.operationId) || !Number.isSafeInteger(marker.pid) || marker.pid <= 0 || marker.schemaVersion === 2 && (!marker.host || !marker.bootId || !marker.processStart || process.platform === "linux" && !marker.pidNamespace)) {
+    throw new SkillSelectionError("SESSION_WRITE_LOCKED", "The session lock has invalid ownership metadata; recovery requires review.");
+  }
+  return { path, bytes, marker, sha256: sha256Hex(bytes), dev: after.dev, ino: after.ino, mtimeMs: after.mtimeMs };
+}
+function writerIsGone(lock, explicitLocalHost) {
+  if (Date.now() - lock.mtimeMs < SESSION_LOCK_MIN_AGE_MS)
+    return false;
+  const owner = processStart(lock.marker.pid);
+  if (owner.state === "unknown")
+    return false;
+  if (lock.marker.schemaVersion === 1)
+    return explicitLocalHost && owner.state === "absent";
+  const local = localLockIdentity();
+  if (!local || lock.marker.host !== local.host || lock.marker.bootId !== local.bootId || lock.marker.pidNamespace !== local.pidNamespace)
+    return false;
+  return owner.state === "absent" || owner.state === "alive" && owner.start !== lock.marker.processStart;
+}
+function archiveSessionLock(lock, receipt, explicitLocalHost) {
+  const guardPath = `${lock.path}.recovery-guard`;
+  let guardFd;
+  try {
+    guardFd = openSync6(guardPath, constants3.O_WRONLY | constants3.O_CREAT | constants3.O_EXCL | constants3.O_NOFOLLOW, 384);
+  } catch (error61) {
+    if (error61.code === "EEXIST")
+      return null;
+    throw error61;
+  }
+  const guardStat = fstatSync6(guardFd);
+  try {
+    writeFileSync3(guardFd, `${JSON.stringify({ schemaVersion: 1, pid: process.pid, operationId: randomUUID() })}
+`);
+    fsyncSync(guardFd);
+    const cacheOptions = { cacheDir: dirname8(dirname8(lock.path)) };
+    const current = readSessionLock(lock.marker.sessionId, cacheOptions);
+    if (!current || current.dev !== lock.dev || current.ino !== lock.ino || current.sha256 !== lock.sha256 || current.mtimeMs !== lock.mtimeMs || !writerIsGone(current, explicitLocalHost))
+      return null;
+    const currentReceipt = readSkillSessionSnapshotIfExists(lock.marker.sessionId, cacheOptions);
+    if (currentReceipt?.sha256 !== receipt?.sha256 || currentReceipt?.generation !== receipt?.generation)
+      return null;
+    const directory = join14(dirname8(dirname8(lock.path)), "session-lock-recoveries", randomUUID());
+    const archivePath = join14(directory, "original.write-lock");
+    const recordPath = join14(directory, "recovery.json");
+    assertRegularPath(archivePath, true);
+    archiveBytes(recordPath, Buffer.from(`${JSON.stringify({
+      schemaVersion: 1,
+      sessionId: lock.marker.sessionId,
+      originalPath: lock.path,
+      lockSha256: lock.sha256,
+      lockMtime: new Date(lock.mtimeMs).toISOString(),
+      lockPid: lock.marker.pid,
+      receiptSha256: receipt?.sha256 ?? null,
+      receiptGeneration: receipt?.generation ?? null,
+      status: "prepared"
+    })}
+`));
+    syncDirectory(directory);
+    syncDirectory(dirname8(directory));
+    const finalLock = readSessionLock(lock.marker.sessionId, cacheOptions);
+    if (!finalLock || finalLock.dev !== lock.dev || finalLock.ino !== lock.ino || finalLock.sha256 !== lock.sha256 || readSkillSessionSnapshotIfExists(lock.marker.sessionId, cacheOptions)?.sha256 !== receipt?.sha256)
+      return null;
+    let moved = false;
+    try {
+      renameSync(lock.path, archivePath);
+      moved = true;
+      syncDirectory(directory);
+      syncDirectory(dirname8(lock.path));
+      if (sha256Hex(readRegularFile(archivePath, SESSION_LOCK_MAX_BYTES)) !== lock.sha256) {
+        throw new Error("Archived lock bytes changed");
+      }
+    } catch (error61) {
+      if (moved)
+        throw new SkillSelectionError("SESSION_LOCK_RECOVERY_INCOMPLETE", "The lock moved, but durable recovery could not be confirmed; inspect the preserved recovery directory and session receipt.");
+      throw error61;
+    }
+    return archivePath;
+  } finally {
+    closeSync6(guardFd);
+    const current = lstatSync8(guardPath, { throwIfNoEntry: false });
+    if (current?.isFile() && current.dev === guardStat.dev && current.ino === guardStat.ino)
+      unlinkSync(guardPath);
+  }
+}
 function withSessionWriteLocks(sessionIds, options, action) {
   const operationId = randomUUID();
   const locks = [...new Set(sessionIds)].map((sessionId) => ({ sessionId, path: `${sessionReceiptPath(sessionId, options)}.write-lock` })).sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
@@ -46680,13 +46849,30 @@ function withSessionWriteLocks(sessionIds, options, action) {
       try {
         fd = openSync6(lock.path, constants3.O_WRONLY | constants3.O_CREAT | constants3.O_EXCL | constants3.O_NOFOLLOW, 384);
       } catch (error61) {
-        if (error61.code === "EEXIST")
-          throw new SkillSelectionError("SESSION_WRITE_LOCKED", "Another Skills process owns a required session write lock; retry after it completes. A surviving lock requires explicit recovery review.");
-        throw error61;
+        if (error61.code !== "EEXIST")
+          throw error61;
+        try {
+          const stale = readSessionLock(lock.sessionId, options);
+          const receipt = stale && readSkillSessionSnapshotIfExists(lock.sessionId, options);
+          if (stale?.marker.schemaVersion === 2 && writerIsGone(stale, false)) {
+            archiveSessionLock(stale, receipt, false);
+          }
+        } catch (recoveryError) {
+          if (recoveryError instanceof SkillSelectionError && recoveryError.code === "SESSION_LOCK_RECOVERY_INCOMPLETE")
+            throw recoveryError;
+        }
+        try {
+          fd = openSync6(lock.path, constants3.O_WRONLY | constants3.O_CREAT | constants3.O_EXCL | constants3.O_NOFOLLOW, 384);
+        } catch (retryError) {
+          if (retryError.code === "EEXIST")
+            throw new SkillSelectionError("SESSION_WRITE_LOCKED", "Another Skills process owns a required session write lock; retry after it completes. A surviving legacy lock requires explicit recovery review.");
+          throw retryError;
+        }
       }
       const stat = fstatSync6(fd);
       owned.push({ path: lock.path, fd, dev: stat.dev, ino: stat.ino });
-      writeFileSync3(fd, `${JSON.stringify({ schemaVersion: 1, operationId, sessionId: lock.sessionId, pid: process.pid })}
+      const identity3 = localLockIdentity();
+      writeFileSync3(fd, `${JSON.stringify({ schemaVersion: identity3 ? 2 : 1, operationId, sessionId: lock.sessionId, pid: process.pid, ...identity3 })}
 `);
     }
     return action(assertOwned);
@@ -46749,7 +46935,17 @@ function syncDirectory(path) {
     closeSync6(fd);
   }
 }
-var SkillSelectionError, MAX_CACHED_PROFILE_AGE_MS, SELECTION_LOCK_FILE = "selection.lock.json";
+function archiveBytes(path, bytes) {
+  assertRegularPath(path, true);
+  const fd = openSync6(path, constants3.O_WRONLY | constants3.O_CREAT | constants3.O_EXCL | constants3.O_NOFOLLOW, 384);
+  try {
+    writeFileSync3(fd, bytes);
+    fsyncSync(fd);
+  } finally {
+    closeSync6(fd);
+  }
+}
+var SkillSelectionError, MAX_CACHED_PROFILE_AGE_MS, SELECTION_LOCK_FILE = "selection.lock.json", SESSION_LOCK_MAX_BYTES = 4096, SESSION_LOCK_MIN_AGE_MS = 30000;
 var init_selection_cache = __esm(() => {
   init_config();
   init_skill_bundle();
@@ -46807,7 +47003,7 @@ function capturePreparationProcess(child, platform = process.platform, signalGro
 }
 
 // src/lib/dependency-preparation.ts
-import { constants as constants4, closeSync as closeSync7, fstatSync as fstatSync7, lstatSync as lstatSync9, mkdirSync as mkdirSync4, openSync as openSync7, readFileSync as readFileSync10, readdirSync as readdirSync5, rmdirSync, unlinkSync as unlinkSync2, ftruncateSync, writeSync } from "fs";
+import { constants as constants4, closeSync as closeSync7, fstatSync as fstatSync7, lstatSync as lstatSync9, mkdirSync as mkdirSync4, openSync as openSync7, readFileSync as readFileSync11, readdirSync as readdirSync5, rmdirSync, unlinkSync as unlinkSync2, ftruncateSync, writeSync } from "fs";
 import { join as join15 } from "path";
 function hasDependencyPreparationMarker(skillPath) {
   try {
@@ -46837,7 +47033,7 @@ function claimPreparation(skillPath) {
         return;
       if (!lstatSync9(state).isFile() || lstatSync9(state).isSymbolicLink() || lstatSync9(state).size > 1024)
         return;
-      const previous = JSON.parse(readFileSync10(state, "utf8"));
+      const previous = JSON.parse(readFileSync11(state, "utf8"));
       if (previous.version !== 1 || previous.status !== "failed" || Object.keys(previous).length !== 2)
         return;
     }
@@ -47389,7 +47585,7 @@ var init_skill_aliases = __esm(() => {
 });
 
 // src/lib/project-state.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync11, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync12, writeFileSync as writeFileSync4 } from "fs";
 import { join as join17 } from "path";
 function getProjectStateDir(targetDir = process.cwd()) {
   return join17(targetDir, SKILLS_PROJECT_DIR);
@@ -47402,7 +47598,7 @@ function loadProjectConfig(targetDir = process.cwd()) {
   if (!existsSync8(path))
     return null;
   try {
-    return normalizeProjectConfig(JSON.parse(readFileSync11(path, "utf-8")));
+    return normalizeProjectConfig(JSON.parse(readFileSync12(path, "utf-8")));
   } catch {
     return null;
   }
@@ -47510,7 +47706,7 @@ var init_project_state = __esm(() => {
 });
 
 // src/lib/installer.ts
-import { existsSync as existsSync9, readFileSync as readFileSync12, rmSync } from "fs";
+import { existsSync as existsSync9, readFileSync as readFileSync13, rmSync } from "fs";
 import { join as join18 } from "path";
 import { homedir as homedir2 } from "os";
 function getSkillPath(name) {
@@ -47598,7 +47794,7 @@ function readBundledSkillVersion(name) {
   if (!existsSync9(pkgPath))
     return "unknown";
   try {
-    const pkg = JSON.parse(readFileSync12(pkgPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync13(pkgPath, "utf-8"));
     return pkg.version || "unknown";
   } catch {
     return "unknown";
@@ -47662,7 +47858,7 @@ var init_skill_doc_file = __esm(() => {
 });
 
 // src/lib/skillinfo.ts
-import { existsSync as existsSync10, readFileSync as readFileSync13 } from "fs";
+import { existsSync as existsSync10, readFileSync as readFileSync14 } from "fs";
 import { join as join19 } from "path";
 function isInstructionSkillDir(skillPath, meta3) {
   if (meta3?.kind === "instruction")
@@ -47671,7 +47867,7 @@ function isInstructionSkillDir(skillPath, meta3) {
   if (!existsSync10(skillMdPath))
     return false;
   try {
-    return parseSkillFrontmatter(readFileSync13(skillMdPath, "utf-8"))?.kind === "instruction";
+    return parseSkillFrontmatter(readFileSync14(skillMdPath, "utf-8"))?.kind === "instruction";
   } catch {
     return false;
   }
@@ -47706,7 +47902,7 @@ function getSkillRequirements(name) {
   const meta3 = getSkill(name);
   let dependencies = {};
   try {
-    dependencies = JSON.parse(readFileSync13(join19(skillPath, "package.json"), "utf8")).dependencies || {};
+    dependencies = JSON.parse(readFileSync14(join19(skillPath, "package.json"), "utf8")).dependencies || {};
   } catch {}
   return getSkillRequirementsFromContent(name, texts, dependencies, meta3);
 }
@@ -47774,7 +47970,7 @@ async function runSkill(name, args, options = {}) {
   }
   let entryPoint2;
   try {
-    const pkg = JSON.parse(readFileSync13(pkgPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync14(pkgPath, "utf-8"));
     if (pkg.bin) {
       const binValues = Object.values(pkg.bin);
       entryPoint2 = binValues[0];
@@ -47819,7 +48015,7 @@ async function runSkill(name, args, options = {}) {
 function detectProjectSkills(cwd = process.cwd()) {
   let pkg;
   try {
-    pkg = JSON.parse(readFileSync13(join19(cwd, "package.json"), "utf8"));
+    pkg = JSON.parse(readFileSync14(join19(cwd, "package.json"), "utf8"));
   } catch {
     return { detected: [], recommended: [] };
   }
@@ -47858,7 +48054,7 @@ function extractEnvVars(text2) {
 function readIfExists(path) {
   try {
     if (existsSync10(path)) {
-      return readFileSync13(path, "utf-8");
+      return readFileSync14(path, "utf-8");
     }
   } catch {}
   return null;
@@ -48976,7 +49172,7 @@ var init_codex_hook_discovery_recovery = __esm(() => {
 
 // src/lib/agent-discovery.ts
 import { createHash as createHash14 } from "crypto";
-import { lstatSync as lstatSync16, readFileSync as readFileSync14, readdirSync as readdirSync6, realpathSync as realpathSync3 } from "fs";
+import { lstatSync as lstatSync16, readFileSync as readFileSync15, readdirSync as readdirSync6, realpathSync as realpathSync3 } from "fs";
 import { basename as basename7, dirname as dirname14, isAbsolute as isAbsolute13, join as join23, resolve as resolve13, sep as sep4 } from "path";
 import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
 function parseConfig(text2, path, toml = false) {
@@ -49008,7 +49204,7 @@ function read(path, changes) {
     return null;
   if (!stat2.isFile() || stat2.size > 16 * 1024 * 1024)
     throw new Error(`Unsupported or oversized native discovery input: ${path}`);
-  return readFileSync14(path, "utf8");
+  return readFileSync15(path, "utf8");
 }
 function projected(source, changes, budget = discoveryByteBudget()) {
   if (source.hashMode === "claude-settings-v1" || source.hashMode === "claude-settings-v2" || source.hashMode === "claude-settings-v3") {
@@ -49885,7 +50081,7 @@ var init_search = __esm(() => {
 });
 
 // src/lib/registry.ts
-import { existsSync as existsSync12, readFileSync as readFileSync15, readdirSync as readdirSync8 } from "fs";
+import { existsSync as existsSync12, readFileSync as readFileSync16, readdirSync as readdirSync8 } from "fs";
 import { join as join26 } from "path";
 function parseSkillMdFrontmatter(content) {
   const match = content.match(/^---\n([\s\S]*?)\n---/);
@@ -49932,7 +50128,7 @@ function discoverSkillsInDir(dir, source = "custom") {
         continue;
       let content;
       try {
-        content = readFileSync15(skillMdPath, "utf-8");
+        content = readFileSync16(skillMdPath, "utf-8");
       } catch {
         continue;
       }
@@ -49969,7 +50165,7 @@ function findExtensionSkillPath(name) {
         continue;
       let content;
       try {
-        content = readFileSync15(skillMdPath, "utf-8");
+        content = readFileSync16(skillMdPath, "utf-8");
       } catch {
         continue;
       }
@@ -51161,7 +51357,7 @@ var init_remote_workspace_leave = __esm(() => {
 });
 
 // src/lib/auth-store.ts
-import { chmodSync, existsSync as existsSync13, mkdirSync as mkdirSync8, readFileSync as readFileSync16, renameSync as renameSync4, statSync as statSync8, unlinkSync as unlinkSync4, writeFileSync as writeFileSync7 } from "fs";
+import { chmodSync, existsSync as existsSync13, mkdirSync as mkdirSync8, readFileSync as readFileSync17, renameSync as renameSync4, statSync as statSync8, unlinkSync as unlinkSync4, writeFileSync as writeFileSync7 } from "fs";
 import { basename as basename10, dirname as dirname17, join as join27 } from "path";
 function getAuthFilePath(env = process.env) {
   return skillsCredentialFilePath(env);
@@ -53175,7 +53371,7 @@ var init_remote_auth = __esm(() => {
 });
 
 // src/lib/workspace-profile.ts
-import { constants as constants11, closeSync as closeSync14, fstatSync as fstatSync14, lstatSync as lstatSync18, mkdirSync as mkdirSync9, mkdtempSync as mkdtempSync2, openSync as openSync14, readFileSync as readFileSync17, renameSync as renameSync5, rmSync as rmSync4, writeFileSync as writeFileSync8 } from "fs";
+import { constants as constants11, closeSync as closeSync14, fstatSync as fstatSync14, lstatSync as lstatSync18, mkdirSync as mkdirSync9, mkdtempSync as mkdtempSync2, openSync as openSync14, readFileSync as readFileSync18, renameSync as renameSync5, rmSync as rmSync4, writeFileSync as writeFileSync8 } from "fs";
 function stat2(path) {
   try {
     return lstatSync18(path);
@@ -53193,7 +53389,7 @@ function safeText(file2) {
     const s = fstatSync14(fd);
     if (!s.isFile() || s.size > 65536 || ![256, 384].includes(s.mode & 4095) || process.getuid && s.uid !== process.getuid())
       return fail("The selected profile must use bounded owner-only regular files.");
-    return readFileSync17(fd, "utf8");
+    return readFileSync18(fd, "utf8");
   } finally {
     closeSync14(fd);
   }
@@ -55649,7 +55845,7 @@ var init_credential_state = __esm(() => {
 
 // src/lib/run-state.ts
 import { createHash as createHash17, randomBytes } from "crypto";
-import { existsSync as existsSync14, mkdirSync as mkdirSync11, readFileSync as readFileSync18, readdirSync as readdirSync9, statSync as statSync9, writeFileSync as writeFileSync10 } from "fs";
+import { existsSync as existsSync14, mkdirSync as mkdirSync11, readFileSync as readFileSync19, readdirSync as readdirSync9, statSync as statSync9, writeFileSync as writeFileSync10 } from "fs";
 import { extname, join as join29, relative as relative5 } from "path";
 function createSkillRun(params, targetDir = process.cwd()) {
   const now = new Date;
@@ -55721,7 +55917,7 @@ function appendRunEvent(context2, event, data = {}) {
   const line = JSON.stringify({ ts: new Date().toISOString(), event, ...data }) + `
 `;
   const path = join29(context2.runDir, "events.ndjson");
-  const previous = existsSync14(path) ? readFileSync18(path, "utf-8") : "";
+  const previous = existsSync14(path) ? readFileSync19(path, "utf-8") : "";
   writeFileSync10(path, previous + line);
 }
 function findSkillRun(runId, targetDir = process.cwd()) {
@@ -55759,7 +55955,7 @@ function collectRunArtifacts(context2) {
   const artifacts = [];
   for (const path of walkFiles(context2.exportDir)) {
     const stat3 = statSync9(path);
-    const bytes = readFileSync18(path);
+    const bytes = readFileSync19(path);
     artifacts.push({
       path: toProjectRelative(context2.targetDir, path),
       mime: mimeForPath(path),
@@ -55774,7 +55970,7 @@ function readRunRecord(runDir) {
   if (!existsSync14(path))
     return null;
   try {
-    return JSON.parse(readFileSync18(path, "utf-8"));
+    return JSON.parse(readFileSync19(path, "utf-8"));
   } catch {
     return null;
   }
@@ -56034,8 +56230,8 @@ var init_cloud_executions = __esm(() => {
 
 // node_modules/@hasna/secrets/dist/sdk.js
 import { isIP as isIP2 } from "net";
-import { spawnSync as spawnSync2 } from "child_process";
-import { closeSync as closeSync16, fstatSync as fstatSync16, openSync as openSync16, readFileSync as readFileSync19 } from "fs";
+import { spawnSync as spawnSync3 } from "child_process";
+import { closeSync as closeSync16, fstatSync as fstatSync16, openSync as openSync16, readFileSync as readFileSync20 } from "fs";
 import { O_NOFOLLOW as O_NOFOLLOW3, O_NONBLOCK as O_NONBLOCK3, O_RDONLY as O_RDONLY3 } from "constants";
 import { createRequire as createRequire2 } from "module";
 import { hostname as osHostname2 } from "os";
@@ -56161,7 +56357,7 @@ function readAppConfigFile2(path) {
       unsafe("the file is not owned by the current user");
     if (before.size > MAX_CREDENTIAL_FILE_BYTES2)
       unsafe("the file exceeds the size limit");
-    const bytes = readFileSync19(fd);
+    const bytes = readFileSync20(fd);
     const after = fstatSync16(fd);
     if (!configFileReadsCoherent2(before, after)) {
       unsafe("the file changed while being read");
@@ -56309,7 +56505,7 @@ function isAmbientEnvironment2(env) {
   return env === process.env || env[AMBIENT_ENVIRONMENT2] === true;
 }
 function defaultKeychainRunner2(argv) {
-  const result = spawnSync2(KEYCHAIN_SECURITY_BIN2, [...argv], {
+  const result = spawnSync3(KEYCHAIN_SECURITY_BIN2, [...argv], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"],
     timeout: KEYCHAIN_SPAWN_TIMEOUT_MS2
@@ -58643,7 +58839,7 @@ var init_resource_meta_tools = __esm(() => {
 });
 
 // src/lib/scheduler.ts
-import { existsSync as existsSync17, readFileSync as readFileSync20, writeFileSync as writeFileSync12, mkdirSync as mkdirSync14 } from "fs";
+import { existsSync as existsSync17, readFileSync as readFileSync21, writeFileSync as writeFileSync12, mkdirSync as mkdirSync14 } from "fs";
 import { join as join34 } from "path";
 function getSchedulesPath(targetDir = process.cwd()) {
   return join34(targetDir, ".skills", "schedules.json");
@@ -58652,7 +58848,7 @@ function loadSchedules(targetDir = process.cwd()) {
   const path = getSchedulesPath(targetDir);
   if (existsSync17(path)) {
     try {
-      return JSON.parse(readFileSync20(path, "utf-8"));
+      return JSON.parse(readFileSync21(path, "utf-8"));
     } catch {}
   }
   return { version: 1, schedules: [] };
@@ -58935,7 +59131,7 @@ import { createHash as createHash19, createHmac } from "crypto";
 import {
   existsSync as existsSync18,
   mkdirSync as mkdirSync15,
-  readFileSync as readFileSync21,
+  readFileSync as readFileSync22,
   readdirSync as readdirSync11,
   statSync as statSync11,
   writeFileSync as writeFileSync13
@@ -59003,7 +59199,7 @@ function exportSkillsLocalSnapshot(targetDir = process.cwd(), options = {}) {
   const files = [];
   if (existsSync18(projectStateDir)) {
     for (const filePath of walkFiles2(projectStateDir)) {
-      const bytes = readFileSync21(filePath);
+      const bytes = readFileSync22(filePath);
       const relativePath = toPosix(relative6(targetDir, filePath));
       files.push({
         path: relativePath,
@@ -62205,7 +62401,7 @@ async function handleMcpHttpNodeRequest(req, res) {
   return true;
 }
 async function startSkillsMcpHttpServer(options = {}) {
-  const hostname3 = options.hostname ?? "127.0.0.1";
+  const hostname4 = options.hostname ?? "127.0.0.1";
   const port = options.port ?? parseMcpHttpPort(process.argv.slice(2));
   const httpServer = createServer(async (req, res) => {
     try {
@@ -62223,11 +62419,11 @@ async function startSkillsMcpHttpServer(options = {}) {
   });
   await new Promise((resolve19, reject) => {
     httpServer.once("error", reject);
-    httpServer.listen(port, hostname3, () => resolve19());
+    httpServer.listen(port, hostname4, () => resolve19());
   });
   const address = httpServer.address();
   const listenPort = typeof address === "object" && address ? address.port : port;
-  console.error(`skills-mcp HTTP listening on http://${hostname3}:${listenPort}/mcp`);
+  console.error(`skills-mcp HTTP listening on http://${hostname4}:${listenPort}/mcp`);
   return httpServer;
 }
 var MCP_HTTP_DEFAULT_PORT = 8836, MCP_HTTP_SERVICE_NAME = "skills";

package/bin/migrate.js

@@ -7,7 +7,7 @@ import { join as join5 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.0",
+  version: "0.10.2",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -201,15 +201,11 @@ function resolveServerConfig(env = process.env) {
     requestBodyLimitBytes: parsePositiveInt(env.HASNA_SKILLS_REQUEST_BODY_LIMIT_BYTES, 1e6),
     skillBundleLimitBytes: parsePositiveInt(env.HASNA_SKILLS_BUNDLE_LIMIT_BYTES, 25000000),
     tombstoneWindowMs: parsePositiveInt(env.HASNA_SKILLS_TOMBSTONE_WINDOW_MS, 7 * 24 * 60 * 60 * 1000),
-    publicBaseUrl: (env.SKILLS_PUBLIC_BASE_URL || localOrigin(host, port)).replace(/\/+$/, ""),
+    publicBaseUrl: (env.SKILLS_PUBLIC_BASE_URL || "").replace(/\/+$/, ""),
     nodeEnv,
     allowEphemeralStore: env.HASNA_SKILLS_ALLOW_EPHEMERAL_STORE === "1"
   };
 }
-function localOrigin(host, port) {
-  const hostname = host === "0.0.0.0" || host === "::" ? "localhost" : host;
-  return `http://${hostname.includes(":") ? `[${hostname}]` : hostname}:${port}`;
-}
 function parsePositiveInt(value, fallback) {
   const parsed = Number.parseInt(value ?? "", 10);
   return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;

package/bin/server.js

@@ -24122,7 +24122,7 @@ var init_dist_es9 = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.10.0",
+  version: "0.10.2",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -42903,15 +42903,11 @@ function resolveServerConfig(env = process.env) {
     requestBodyLimitBytes: parsePositiveInt(env.HASNA_SKILLS_REQUEST_BODY_LIMIT_BYTES, 1e6),
     skillBundleLimitBytes: parsePositiveInt(env.HASNA_SKILLS_BUNDLE_LIMIT_BYTES, 25000000),
     tombstoneWindowMs: parsePositiveInt(env.HASNA_SKILLS_TOMBSTONE_WINDOW_MS, 7 * 24 * 60 * 60 * 1000),
-    publicBaseUrl: (env.SKILLS_PUBLIC_BASE_URL || localOrigin(host, port)).replace(/\/+$/, ""),
+    publicBaseUrl: (env.SKILLS_PUBLIC_BASE_URL || "").replace(/\/+$/, ""),
     nodeEnv,
     allowEphemeralStore: env.HASNA_SKILLS_ALLOW_EPHEMERAL_STORE === "1"
   };
 }
-function localOrigin(host, port) {
-  const hostname = host === "0.0.0.0" || host === "::" ? "localhost" : host;
-  return `http://${hostname.includes(":") ? `[${hostname}]` : hostname}:${port}`;
-}
 function parsePositiveInt(value, fallback) {
   const parsed = Number.parseInt(value ?? "", 10);
   return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
@@ -44150,6 +44146,9 @@ async function createSkillsFetchHandler(options = {}) {
   const config = { ...resolveServerConfig(), ...options.config };
   if (!options.store)
     assertDurableTarget(resolveDatabaseTarget(config.databaseUrl), config);
+  if (!config.publicBaseUrl) {
+    throw new Error("refusing to start: set SKILLS_PUBLIC_BASE_URL to this Skills server's public API origin; a bound socket is not an authority for client receipts.");
+  }
   const store = options.store ?? await createStore({
     databaseUrl: config.databaseUrl,
     bootstrapApiKey: config.bootstrapApiKey