@hasna/skills 0.5.2 → 0.5.3

package/bin/worker.js

@@ -5456,7 +5456,7 @@ var require_checksum = __commonJS((exports) => {
       }
     };
   }
-  var BLOCK = 64;
+  var BLOCK2 = 64;
   var DIGEST_LENGTH = 32;
   var MAX_HASHABLE_LENGTH = 2 ** 53 - 1;
 
@@ -5476,13 +5476,13 @@ var require_checksum = __commonJS((exports) => {
         this.inner = new Sha256Js;
         this.outer = new Sha256Js;
         const { inner, outer } = this;
-        const pad = new Uint8Array(BLOCK * 2);
-        for (let i = 0;i < BLOCK; ++i) {
+        const pad = new Uint8Array(BLOCK2 * 2);
+        for (let i = 0;i < BLOCK2; ++i) {
           pad[i] = 54 ^ key[i];
-          pad[i + BLOCK] = 92 ^ key[i];
+          pad[i + BLOCK2] = 92 ^ key[i];
         }
-        inner.update(pad.subarray(0, BLOCK));
-        outer.update(pad.subarray(BLOCK));
+        inner.update(pad.subarray(0, BLOCK2));
+        outer.update(pad.subarray(BLOCK2));
       }
     }
     update(data) {
@@ -5503,7 +5503,7 @@ var require_checksum = __commonJS((exports) => {
       while (byteLength > 0) {
         this.buffer[this.bufferLength++] = chunk[position++];
         byteLength--;
-        if (this.bufferLength === BLOCK) {
+        if (this.bufferLength === BLOCK2) {
           this.hashBuffer();
           this.bufferLength = 0;
         }
@@ -5535,18 +5535,18 @@ var require_checksum = __commonJS((exports) => {
       const bitsHashed = this.bytesHashed * 8;
       const bufferView = new DataView(buffer.buffer, buffer.byteOffset, buffer.byteLength);
       bufferView.setUint8(bufferLength++, 128);
-      if ((bufferLength - 1) % BLOCK >= BLOCK - 8) {
-        for (let i = bufferLength;i < BLOCK; ++i) {
+      if ((bufferLength - 1) % BLOCK2 >= BLOCK2 - 8) {
+        for (let i = bufferLength;i < BLOCK2; ++i) {
           bufferView.setUint8(i, 0);
         }
         this.hashBufferWith(state, buffer);
         bufferLength = 0;
       }
-      for (let i = bufferLength;i < BLOCK - 8; ++i) {
+      for (let i = bufferLength;i < BLOCK2 - 8; ++i) {
         bufferView.setUint8(i, 0);
       }
-      bufferView.setUint32(BLOCK - 8, Math.floor(bitsHashed / 4294967296), false);
-      bufferView.setUint32(BLOCK - 4, bitsHashed, false);
+      bufferView.setUint32(BLOCK2 - 8, Math.floor(bitsHashed / 4294967296), false);
+      bufferView.setUint32(BLOCK2 - 4, bitsHashed, false);
       this.hashBufferWith(state, buffer);
       const out = new Uint8Array(DIGEST_LENGTH);
       for (let i = 0;i < 8; ++i) {
@@ -5559,16 +5559,16 @@ var require_checksum = __commonJS((exports) => {
     }
     static normalizeKey(secret) {
       const key = toUint8Array(secret);
-      if (key.byteLength > BLOCK) {
+      if (key.byteLength > BLOCK2) {
         const h = new Sha256Js;
         h.update(key);
         const out = h.digestSync();
-        const padded = new Uint8Array(BLOCK);
+        const padded = new Uint8Array(BLOCK2);
         padded.set(out);
         return padded;
       }
-      if (key.byteLength < BLOCK) {
-        const padded = new Uint8Array(BLOCK);
+      if (key.byteLength < BLOCK2) {
+        const padded = new Uint8Array(BLOCK2);
         padded.set(key);
         return padded;
       }
@@ -5580,7 +5580,7 @@ var require_checksum = __commonJS((exports) => {
     hashBufferWith(state, buffer) {
       const w = this.w ??= new Int32Array(64);
       let s0 = state[0], s1 = state[1], s2 = state[2], s3 = state[3], s4 = state[4], s5 = state[5], s6 = state[6], s7 = state[7];
-      for (let i = 0;i < BLOCK; ++i) {
+      for (let i = 0;i < BLOCK2; ++i) {
         if (i < 16) {
           w[i] = (buffer[i * 4] & 255) << 24 | (buffer[i * 4 + 1] & 255) << 16 | (buffer[i * 4 + 2] & 255) << 8 | buffer[i * 4 + 3] & 255;
         } else {
@@ -23103,7 +23103,7 @@ import { randomUUID as randomUUID4 } from "crypto";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.5.2",
+  version: "0.5.3",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -23225,7 +23225,40 @@ var package_default = {
   }
 };
 
+// src/lib/skill-entry-path.ts
+class SkillEntryPaths {
+  files = new Set;
+  directories = new Set;
+  add(path, maxBytes, invalid, limit) {
+    if (path.length > maxBytes)
+      limit();
+    const encoded = new TextEncoder().encode(path);
+    if (encoded.byteLength > maxBytes)
+      limit();
+    if (new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(encoded) !== path)
+      invalid("Invalid UTF-8 entry path");
+    if (!path || /[\\:\x00-\x1f\x7f]/u.test(path))
+      invalid("Unsafe entry path");
+    if (path.split("/").some((segment) => !segment || segment === "." || segment === ".."))
+      invalid("Unsafe entry path segment");
+    const key = path.normalize("NFC").toLowerCase().normalize("NFC");
+    if (this.files.has(key) || this.directories.has(key))
+      invalid("Duplicate or conflicting entry path");
+    const parents = key.split("/");
+    parents.pop();
+    while (parents.length) {
+      const parent = parents.join("/");
+      if (this.files.has(parent))
+        invalid("Conflicting entry file ancestor");
+      this.directories.add(parent);
+      parents.pop();
+    }
+    this.files.add(key);
+  }
+}
+
 // src/lib/skill-bundle.ts
+var BLOCK = 512;
 var ANY_SEGMENT_EXCLUDES = new Set([
   ".git",
   ".ds_store",
@@ -23353,6 +23386,144 @@ function ownBytes(view) {
   out.set(source);
   return out;
 }
+var SKILL_BUNDLE_INSPECTION_LIMITS = Object.freeze({
+  compressedBytes: 16 * 1024 * 1024,
+  decompressedBytes: 64 * 1024 * 1024,
+  entries: 1024,
+  fileBytes: 16 * 1024 * 1024,
+  pathBytes: 100,
+  timeoutMs: 5000
+});
+
+class SkillBundleInspectionError extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "SkillBundleInspectionError";
+  }
+}
+function invalidBundle(message) {
+  throw new SkillBundleInspectionError("BUNDLE_INVALID", message);
+}
+class BoundedTarReader {
+  limits;
+  check;
+  header = new Uint8Array(BLOCK);
+  headerOffset = 0;
+  pending;
+  bodyOffset = 0;
+  padding = 0;
+  zeroBlocks = 0;
+  entries = [];
+  paths = new SkillEntryPaths;
+  fileBytes = 0;
+  constructor(limits, check) {
+    this.limits = limits;
+    this.check = check;
+  }
+  push(chunk) {
+    let offset = 0;
+    while (offset < chunk.byteLength) {
+      this.check();
+      if (this.pending) {
+        const count = Math.min(this.pending.bytes.byteLength - this.bodyOffset, chunk.byteLength - offset);
+        this.pending.bytes.set(chunk.subarray(offset, offset + count), this.bodyOffset);
+        offset += count;
+        this.bodyOffset += count;
+        if (this.bodyOffset === this.pending.bytes.byteLength) {
+          this.entries.push(this.pending);
+          this.pending = undefined;
+        }
+      } else if (this.padding) {
+        const count = Math.min(this.padding, chunk.byteLength - offset);
+        if (chunk.subarray(offset, offset + count).some((byte) => byte !== 0))
+          invalidBundle("Nonzero tar body padding");
+        offset += count;
+        this.padding -= count;
+      } else {
+        const count = Math.min(BLOCK - this.headerOffset, chunk.byteLength - offset);
+        this.header.set(chunk.subarray(offset, offset + count), this.headerOffset);
+        offset += count;
+        this.headerOffset += count;
+        if (this.headerOffset === BLOCK) {
+          this.readHeader();
+          this.headerOffset = 0;
+        }
+      }
+    }
+  }
+  finish() {
+    this.check();
+    if (this.pending || this.padding || this.headerOffset || this.zeroBlocks < 2)
+      invalidBundle("Truncated tar bundle");
+    return this.entries;
+  }
+  readHeader() {
+    this.check();
+    const h = this.header;
+    if (h.every((byte) => byte === 0)) {
+      this.zeroBlocks++;
+      return;
+    }
+    if (this.zeroBlocks)
+      invalidBundle("Nonzero tar data after terminator");
+    if (this.entries.length >= this.limits.entries)
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle entry limit exceeded");
+    let checksum = 0;
+    for (let i = 0;i < BLOCK; i++)
+      checksum += i >= 148 && i < 156 ? 32 : h[i];
+    if (tarOctal(h.subarray(148, 156)) !== checksum)
+      invalidBundle("Invalid tar header checksum");
+    if (new TextDecoder().decode(h.subarray(257, 265)) !== "ustar\x00" + "00")
+      invalidBundle("Unsupported tar format");
+    if (h[156] !== 48 && h[156] !== 0 || h.subarray(157, 257).some((b) => b !== 0) || h.subarray(345).some((b) => b !== 0))
+      invalidBundle("Unsupported tar entry or path prefix");
+    const mode = tarOctal(h.subarray(100, 108));
+    if (mode > 511)
+      invalidBundle("Unsupported tar permission bits");
+    tarOctal(h.subarray(108, 116));
+    tarOctal(h.subarray(116, 124));
+    tarOctal(h.subarray(136, 148));
+    const size = tarOctal(h.subarray(124, 136));
+    if (size > this.limits.fileBytes || this.fileBytes + size > this.limits.decompressedBytes) {
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle file byte limit exceeded");
+    }
+    const name = h.subarray(0, 100);
+    const end = name.indexOf(0);
+    if (end !== -1 && name.subarray(end).some((b) => b !== 0))
+      invalidBundle("Invalid tar path padding");
+    const raw = end === -1 ? name : name.subarray(0, end);
+    if (raw.byteLength > this.limits.pathBytes)
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle path byte limit exceeded");
+    let path;
+    try {
+      path = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(raw);
+    } catch {
+      return invalidBundle("Invalid UTF-8 bundle path");
+    }
+    this.paths.add(path, this.limits.pathBytes, invalidBundle, () => {
+      throw new SkillBundleInspectionError("BUNDLE_LIMIT", "Bundle path byte limit exceeded");
+    });
+    this.fileBytes += size;
+    this.pending = { path, mode, bytes: new Uint8Array(new ArrayBuffer(size)) };
+    this.bodyOffset = 0;
+    this.padding = (BLOCK - size % BLOCK) % BLOCK;
+    if (!size) {
+      this.entries.push(this.pending);
+      this.pending = undefined;
+    }
+  }
+}
+function tarOctal(field) {
+  const text = new TextDecoder().decode(field);
+  if (!/^[0-7]+[\0 ]*$/.test(text))
+    invalidBundle("Invalid tar octal field");
+  const value = Number.parseInt(text, 8);
+  if (!Number.isSafeInteger(value))
+    invalidBundle("Tar integer is out of range");
+  return value;
+}
 
 // ../../node_modules/.bun/@aws-sdk+checksums@3.1000.29/node_modules/@aws-sdk/checksums/dist-cjs/submodules/flexible-checksums/index.js
 var { setFeature } = require_client2();
@@ -32525,7 +32696,7 @@ var import_node_http_handler2 = __toESM(require_dist_cjs6(), 1);
 var { toUint8Array: toUint8Array2, concatBytes } = require_serde();
 var { createHmac, createHash: createHash2 } = __require("crypto");
 var { Sha256: Sha2562, Sha256Js, Sha256Node } = require_checksum();
-var BLOCK = 64;
+var BLOCK2 = 64;
 var DIGEST_LENGTH = 20;
 var INIT = new Int32Array([1732584193, 4023233417, 2562383102, 271733878, 3285377520]);
 var K2 = new Int32Array([1518500249, 1859775393, 2400959708, 3395469782]);
@@ -32534,7 +32705,7 @@ class Sha1Js {
   digestLength = DIGEST_LENGTH;
   state = Int32Array.from(INIT);
   w;
-  buffer = new Uint8Array(BLOCK);
+  buffer = new Uint8Array(BLOCK2);
   bufferLength = 0;
   bytesHashed = 0;
   finished = false;
@@ -32545,13 +32716,13 @@ class Sha1Js {
       const key = Sha1Js.normalizeKey(secret);
       this.inner = new Sha1Js;
       this.outer = new Sha1Js;
-      const pad = new Uint8Array(BLOCK * 2);
-      for (let i3 = 0;i3 < BLOCK; ++i3) {
+      const pad = new Uint8Array(BLOCK2 * 2);
+      for (let i3 = 0;i3 < BLOCK2; ++i3) {
         pad[i3] = 54 ^ key[i3];
-        pad[i3 + BLOCK] = 92 ^ key[i3];
+        pad[i3 + BLOCK2] = 92 ^ key[i3];
       }
-      this.inner.update(pad.subarray(0, BLOCK));
-      this.outer.update(pad.subarray(BLOCK));
+      this.inner.update(pad.subarray(0, BLOCK2));
+      this.outer.update(pad.subarray(BLOCK2));
     }
   }
   update(data) {
@@ -32566,19 +32737,19 @@ class Sha1Js {
     let { length } = data;
     this.bytesHashed += length;
     if (this.bufferLength > 0) {
-      while (length > 0 && this.bufferLength < BLOCK) {
+      while (length > 0 && this.bufferLength < BLOCK2) {
         this.buffer[this.bufferLength++] = data[pos++];
         --length;
       }
-      if (this.bufferLength === BLOCK) {
+      if (this.bufferLength === BLOCK2) {
         this.hashBuffer(this.buffer, 0);
         this.bufferLength = 0;
       }
     }
-    while (length >= BLOCK) {
+    while (length >= BLOCK2) {
       this.hashBuffer(data, pos);
-      pos += BLOCK;
-      length -= BLOCK;
+      pos += BLOCK2;
+      length -= BLOCK2;
     }
     while (length > 0) {
       this.buffer[this.bufferLength++] = data[pos++];
@@ -32599,7 +32770,7 @@ class Sha1Js {
   }
   reset() {
     this.state = Int32Array.from(INIT);
-    this.buffer = new Uint8Array(BLOCK);
+    this.buffer = new Uint8Array(BLOCK2);
     this.bufferLength = 0;
     this.bytesHashed = 0;
   }
@@ -32610,19 +32781,19 @@ class Sha1Js {
     const bitsHi = this.bytesHashed / 536870912 | 0;
     const bitsLo = this.bytesHashed << 3;
     buffer[bufferLength++] = 128;
-    if (bufferLength > BLOCK - 8) {
-      for (let i3 = bufferLength;i3 < BLOCK; ++i3) {
+    if (bufferLength > BLOCK2 - 8) {
+      for (let i3 = bufferLength;i3 < BLOCK2; ++i3) {
         buffer[i3] = 0;
       }
       this.hashBufferWith(state, buffer, 0);
       bufferLength = 0;
     }
-    for (let i3 = bufferLength;i3 < BLOCK - 8; ++i3) {
+    for (let i3 = bufferLength;i3 < BLOCK2 - 8; ++i3) {
       buffer[i3] = 0;
     }
-    const v2 = new DataView(buffer.buffer, buffer.byteOffset, BLOCK);
-    v2.setUint32(BLOCK - 8, bitsHi, false);
-    v2.setUint32(BLOCK - 4, bitsLo, false);
+    const v2 = new DataView(buffer.buffer, buffer.byteOffset, BLOCK2);
+    v2.setUint32(BLOCK2 - 8, bitsHi, false);
+    v2.setUint32(BLOCK2 - 4, bitsLo, false);
     this.hashBufferWith(state, buffer, 0);
     const out = new Uint8Array(DIGEST_LENGTH);
     out[0] = state[0] >>> 24 & 255;
@@ -32649,15 +32820,15 @@ class Sha1Js {
   }
   static normalizeKey(secret) {
     const key = toUint8Array2(secret);
-    if (key.byteLength > BLOCK) {
+    if (key.byteLength > BLOCK2) {
       const h3 = new Sha1Js;
       h3.update(key);
       const digest = h3.digestSync();
-      const padded2 = new Uint8Array(BLOCK);
+      const padded2 = new Uint8Array(BLOCK2);
       padded2.set(digest);
       return padded2;
     }
-    const padded = new Uint8Array(BLOCK);
+    const padded = new Uint8Array(BLOCK2);
     padded.set(key);
     return padded;
   }
@@ -35094,6 +35265,20 @@ var VALID_PROVENANCE_SOURCES = new Set(["official", "custom", "remote", "private
 
 // src/lib/skill-hash.ts
 var HASH_EXCLUDE_DIRS = new Set([".git", "node_modules", "dist", "build", ".turbo"]);
+var CONTENT_HASH_LIMITS = Object.freeze({
+  entries: 1024,
+  rawBytes: 64 * 1024 * 1024,
+  normalizedBytes: 64 * 1024 * 1024,
+  fileBytes: 16 * 1024 * 1024,
+  normalizedFileBytes: 16 * 1024 * 1024,
+  pathBytes: 100,
+  manifestBytes: 16 * 1024,
+  manifestDepth: 64,
+  timeoutMs: 5000
+});
+var typedArrayPrototype = Object.getPrototypeOf(Uint8Array.prototype);
+var byteLengthOf = Object.getOwnPropertyDescriptor(typedArrayPrototype, "byteLength").get;
+var bufferOf = Object.getOwnPropertyDescriptor(typedArrayPrototype, "buffer").get;
 
 // src/lib/portable-skills-files.ts
 var ANY_SEGMENT_COPY_EXCLUDES = new Set([

package/dist/cli/commands/invitation-recovery.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from "commander";
+export declare function registerInvitationRecoveryCommands(invitations: Command): void;

package/dist/cli/commands/invitation-verification.d.ts

@@ -0,0 +1,8 @@
+/** Bounded two-line stdin protocol: fresh OTP first, acceptance token second. */
+export declare function readInvitationSecrets(): Promise<{
+    code: string;
+    token: string;
+}>;
+/** Secret remains local to this prompt, never argv, history, logs or profile state. */
+export declare function promptInvitationToken(): Promise<string | null>;
+export declare function promptInvitationRecoveryCode(): Promise<string | null>;

package/dist/cli/commands/workspace-invitations.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from "commander";
+export declare function registerWorkspaceInvitationCommands(workspace: Command): void;

package/dist/index.d.ts

@@ -24,7 +24,8 @@ export { addSchedule, listSchedules, removeSchedule, setScheduleEnabled, getDueS
 export { parseSkillFrontmatter, validateRegistryConsistency, validateSkillDirectory, type RegistryConsistencyResult, type SkillFrontmatter, type SkillValidationMessage, type SkillValidationResult, } from "./lib/skill-validation.js";
 export { PORTABLE_SKILL_DEFAULT_VERSION, PORTABLE_SKILL_SCHEMA, PORTABLE_SKILL_STANDARD, findPortableSkill, getPortableSkillPath, getPortableSkillsRoot, listPortableSkillMetas, listPortableSkills, normalizePortableSkillName, portPortableSkill, portPortableSkillDirectory, readPortableSkillManifest, runPortableSkill, scaffoldPortableSkill, validatePortableSkillDirectory, writeCorpusSkill, type BulkPortImportedEntry, type BulkPortPortableSkillOptions, type BulkPortResult, type BulkPortSkippedEntry, type CorpusSkillMeta, type PortableSkillCommand, type PortableSkillInput, type PortableSkillManifest, type PortableSkillProvenance, type PortableSkillRunOptions, type PortableSkillRunResult, type PortableSkillRuntimeContract, type PortableSkillSummary, type SkillKind, type SkillRuntimeName, type SkillSandboxMode, type SkillSystemDep, type WriteCorpusSkillInput, } from "./lib/portable-skills.js";
 export { SKILL_RUNTIMES, SKILL_SANDBOX_MODES, SKILL_SYSTEM_DEPS_ALLOWLIST, } from "./lib/portable-skills-types.js";
-export { canonicalizeManifest, computeContentHash, normalizeLineEndings, verifyContentHash, type ContentHashVerification, } from "./lib/skill-hash.js";
+export { canonicalizeManifest, computeContentHash, computeContentHashFromEntries, verifyContentHashFromEntries, CONTENT_HASH_LIMITS, ContentHashInputError, type ContentHashLimits, type ContentHashOptions, type ContentHashInputErrorCode, normalizeLineEndings, verifyContentHash, type ContentHashVerification, } from "./lib/skill-hash.js";
+export { revisionIdOf, type RevisionContent } from "./lib/revision.js";
 export { validatePortableManifestContract, type PortableContractOptions, } from "./lib/skill-contract.js";
 export { pullSkills, PullSkillError, type PullSkillsOptions, type PullSkillsResult, type PulledSkillResult, type SkillPullClient, } from "./lib/pull.js";
 export { SYNC_AGENTS, SYNC_MARKER_FILE, SYNC_MARKER_MANAGED_BY, adaptSkillMdForAgent, agentGlobalSkillsDir, isSyncAgent, pointerSkillMd, removeManagedAgentSkill, resolveSyncAgents, syncSkillsToAgents, writeManagedAgentSkill, writeManagedSkillDir, type AgentSyncAction, type ManagedDirWriteResult, type SyncActionKind, type SyncAgent, type SyncMarker, type SyncSkillsOptions, type SyncSkillsResult, type WriteManagedAgentSkillParams, } from "./lib/agent-sync.js";
@@ -48,3 +49,6 @@ export { WorkspaceContextInputError, WorkspaceIdentityMismatchError } from "./li
 export { RemoteWorkspaceSelectionError } from "./lib/remote-client.js";
 export type { LeaveRemoteWorkspace, RemoteWorkspaceLeaveResult, RemoteWorkspaceLeaveErrorCode } from "./lib/remote-workspace-leave.js";
 export { WorkspaceLeaveInputError, RemoteWorkspaceLeaveError, RemoteWorkspaceLeaveUnconfirmedError } from "./lib/remote-workspace-leave.js";
+export type { RemoteWorkspaceInvitation, RemoteWorkspaceInvitationsPage, RemoteWorkspaceInvitationResult, RemoteWorkspaceInvitationAcceptance, ListRemoteWorkspaceInvitations, IssueRemoteWorkspaceInvitation, ResendRemoteWorkspaceInvitation, RevokeRemoteWorkspaceInvitation, AcceptRemoteWorkspaceInvitation, RemoteWorkspaceInvitationErrorCode } from "./lib/remote-invitations.js";
+export { WorkspaceInvitationInputError, RemoteWorkspaceInvitationError, RemoteWorkspaceInvitationUnconfirmedError, RemoteWorkspaceInvitationReadError } from "./lib/remote-invitations.js";
+export { InvitationEmailInputError, RemoteInvitationEmailError, RemoteInvitationEmailUnconfirmedError, type RequestInvitationEmailChallenge, type AcceptInvitationEmailChallenge, type RemoteInvitationEmailChallenge, type RemoteInvitationEmailAcceptance, type RemoteInvitationEmailErrorCode } from "./lib/remote-invitation-recovery.js";