@hasna/skills 0.8.6 → 0.8.7

package/bin/index.js

@@ -36868,7 +36868,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.8.6",
+    version: "0.8.7",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -38212,6 +38212,35 @@ function isSafeRelativePath(value) {
   const normalized = normalize(value).replace(/\\/g, "/");
   return normalized !== ".." && !normalized.startsWith("../") && !normalized.includes("/../");
 }
+function validateRuntimeEntry(skillPath, entrypoint, issues, warnings) {
+  if (typeof entrypoint !== "string" || !isSafeRelativePath(entrypoint) || /^[a-zA-Z]:/.test(entrypoint) || entrypoint.includes("\\") || entrypoint.split("/").some((part) => !part || part === "." || part === "..")) {
+    add2(issues, "skill.runtime_entrypoint_unsafe", "runtime.entrypoint must be a canonical relative file path inside the skill directory");
+    return;
+  }
+  const parts = entrypoint.split("/");
+  let current = skillPath;
+  for (let index = 0;index < parts.length; index++) {
+    current = join8(current, parts[index]);
+    let info;
+    try {
+      info = lstatSync(current);
+    } catch {
+      add2(issues, "skill.runtime_entrypoint_missing", "The declared runtime.entrypoint is missing or inaccessible");
+      return;
+    }
+    if (info.isSymbolicLink()) {
+      add2(issues, "skill.runtime_entrypoint_symlink", "runtime.entrypoint must not traverse symbolic links");
+      return;
+    }
+    if (index < parts.length - 1 ? !info.isDirectory() : !info.isFile()) {
+      add2(issues, "skill.runtime_entrypoint_not_file", "runtime.entrypoint must resolve to a regular file");
+      return;
+    }
+    if (index === parts.length - 1 && info.size < 50) {
+      add2(warnings, "skill.runtime_entrypoint_minimal", `Source entry point is very small (${info.size}B)`);
+    }
+  }
+}
 function isHostedPackageMetadata(pkg) {
   return isHostedMetadataPackage(pkg);
 }
@@ -38447,10 +38476,22 @@ function validateSkillDirectory(name, skillPath, registryMeta) {
   } else {
     metadata.runtime = hostedMetadata ? "hosted" : "local";
     const srcDir = join8(skillPath, "src");
+    let declaredEntrypoint;
+    const manifestPath = join8(skillPath, "skill.json");
+    if (!hostedMetadata && existsSync8(manifestPath)) {
+      try {
+        const manifest = asRecord(readJsonFile(manifestPath));
+        declaredEntrypoint = asRecord(manifest?.runtime)?.entrypoint;
+      } catch {
+        add2(issues, "skill.manifest_invalid", "skill.json must contain valid JSON");
+      }
+    }
     if (hostedMetadata) {
       if (existsSync8(srcDir)) {
         add2(issues, "skill.hosted_source_forbidden", "Hosted metadata skills must not include local implementation source");
       }
+    } else if (declaredEntrypoint !== undefined && declaredEntrypoint !== null) {
+      validateRuntimeEntry(skillPath, declaredEntrypoint, issues, warnings);
     } else if (!existsSync8(srcDir)) {
       add2(issues, "skill.src_missing", "Missing src/ directory");
     } else if (!existsSync8(join8(srcDir, "index.ts")) && !existsSync8(join8(srcDir, "index.js"))) {
@@ -40028,7 +40069,11 @@ function validatePortableSkillDirectory(name, skillPath) {
           "package.missing",
           "package.bin_missing",
           "skill.src_missing",
-          "skill.src_index_missing"
+          "skill.src_index_missing",
+          "skill.runtime_entrypoint_unsafe",
+          "skill.runtime_entrypoint_missing",
+          "skill.runtime_entrypoint_symlink",
+          "skill.runtime_entrypoint_not_file"
         ]);
         for (let i = issues.length - 1;i >= 0; i--) {
           if (executableOnlyCodes.has(issues[i].code))

package/bin/mcp.js

@@ -20019,7 +20019,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.8.6",
+    version: "0.8.7",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -36478,6 +36478,35 @@ function isSafeRelativePath(value) {
   const normalized = normalize(value).replace(/\\/g, "/");
   return normalized !== ".." && !normalized.startsWith("../") && !normalized.includes("/../");
 }
+function validateRuntimeEntry(skillPath, entrypoint, issues, warnings) {
+  if (typeof entrypoint !== "string" || !isSafeRelativePath(entrypoint) || /^[a-zA-Z]:/.test(entrypoint) || entrypoint.includes("\\") || entrypoint.split("/").some((part) => !part || part === "." || part === "..")) {
+    add(issues, "skill.runtime_entrypoint_unsafe", "runtime.entrypoint must be a canonical relative file path inside the skill directory");
+    return;
+  }
+  const parts = entrypoint.split("/");
+  let current = skillPath;
+  for (let index = 0;index < parts.length; index++) {
+    current = join7(current, parts[index]);
+    let info;
+    try {
+      info = lstatSync3(current);
+    } catch {
+      add(issues, "skill.runtime_entrypoint_missing", "The declared runtime.entrypoint is missing or inaccessible");
+      return;
+    }
+    if (info.isSymbolicLink()) {
+      add(issues, "skill.runtime_entrypoint_symlink", "runtime.entrypoint must not traverse symbolic links");
+      return;
+    }
+    if (index < parts.length - 1 ? !info.isDirectory() : !info.isFile()) {
+      add(issues, "skill.runtime_entrypoint_not_file", "runtime.entrypoint must resolve to a regular file");
+      return;
+    }
+    if (index === parts.length - 1 && info.size < 50) {
+      add(warnings, "skill.runtime_entrypoint_minimal", `Source entry point is very small (${info.size}B)`);
+    }
+  }
+}
 function isHostedPackageMetadata(pkg) {
   return isHostedMetadataPackage(pkg);
 }
@@ -36713,10 +36742,22 @@ function validateSkillDirectory(name, skillPath, registryMeta) {
   } else {
     metadata.runtime = hostedMetadata ? "hosted" : "local";
     const srcDir = join7(skillPath, "src");
+    let declaredEntrypoint;
+    const manifestPath = join7(skillPath, "skill.json");
+    if (!hostedMetadata && existsSync4(manifestPath)) {
+      try {
+        const manifest = asRecord(readJsonFile(manifestPath));
+        declaredEntrypoint = asRecord(manifest?.runtime)?.entrypoint;
+      } catch {
+        add(issues, "skill.manifest_invalid", "skill.json must contain valid JSON");
+      }
+    }
     if (hostedMetadata) {
       if (existsSync4(srcDir)) {
         add(issues, "skill.hosted_source_forbidden", "Hosted metadata skills must not include local implementation source");
       }
+    } else if (declaredEntrypoint !== undefined && declaredEntrypoint !== null) {
+      validateRuntimeEntry(skillPath, declaredEntrypoint, issues, warnings);
     } else if (!existsSync4(srcDir)) {
       add(issues, "skill.src_missing", "Missing src/ directory");
     } else if (!existsSync4(join7(srcDir, "index.ts")) && !existsSync4(join7(srcDir, "index.js"))) {
@@ -38176,7 +38217,11 @@ function validatePortableSkillDirectory(name, skillPath) {
           "package.missing",
           "package.bin_missing",
           "skill.src_missing",
-          "skill.src_index_missing"
+          "skill.src_index_missing",
+          "skill.runtime_entrypoint_unsafe",
+          "skill.runtime_entrypoint_missing",
+          "skill.runtime_entrypoint_symlink",
+          "skill.runtime_entrypoint_not_file"
         ]);
         for (let i = issues.length - 1;i >= 0; i--) {
           if (executableOnlyCodes.has(issues[i].code))

package/bin/migrate.js

@@ -7,7 +7,7 @@ import { join as join5 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.8.6",
+  version: "0.8.7",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/bin/server.js

@@ -83749,7 +83749,7 @@ var require_protocols9 = __commonJS((exports) => {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.8.6",
+  version: "0.8.7",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/bin/worker.js

@@ -76168,7 +76168,7 @@ import { randomUUID as randomUUID6 } from "crypto";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.8.6",
+  version: "0.8.7",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/dist/index.js

@@ -7376,6 +7376,35 @@ function isSafeRelativePath(value) {
   const normalized = normalize(value).replace(/\\/g, "/");
   return normalized !== ".." && !normalized.startsWith("../") && !normalized.includes("/../");
 }
+function validateRuntimeEntry(skillPath, entrypoint, issues, warnings) {
+  if (typeof entrypoint !== "string" || !isSafeRelativePath(entrypoint) || /^[a-zA-Z]:/.test(entrypoint) || entrypoint.includes("\\") || entrypoint.split("/").some((part) => !part || part === "." || part === "..")) {
+    add(issues, "skill.runtime_entrypoint_unsafe", "runtime.entrypoint must be a canonical relative file path inside the skill directory");
+    return;
+  }
+  const parts = entrypoint.split("/");
+  let current = skillPath;
+  for (let index = 0;index < parts.length; index++) {
+    current = join4(current, parts[index]);
+    let info;
+    try {
+      info = lstatSync(current);
+    } catch {
+      add(issues, "skill.runtime_entrypoint_missing", "The declared runtime.entrypoint is missing or inaccessible");
+      return;
+    }
+    if (info.isSymbolicLink()) {
+      add(issues, "skill.runtime_entrypoint_symlink", "runtime.entrypoint must not traverse symbolic links");
+      return;
+    }
+    if (index < parts.length - 1 ? !info.isDirectory() : !info.isFile()) {
+      add(issues, "skill.runtime_entrypoint_not_file", "runtime.entrypoint must resolve to a regular file");
+      return;
+    }
+    if (index === parts.length - 1 && info.size < 50) {
+      add(warnings, "skill.runtime_entrypoint_minimal", `Source entry point is very small (${info.size}B)`);
+    }
+  }
+}
 function isHostedPackageMetadata(pkg) {
   return isHostedMetadataPackage(pkg);
 }
@@ -7611,10 +7640,22 @@ function validateSkillDirectory(name, skillPath, registryMeta) {
   } else {
     metadata.runtime = hostedMetadata ? "hosted" : "local";
     const srcDir = join4(skillPath, "src");
+    let declaredEntrypoint;
+    const manifestPath = join4(skillPath, "skill.json");
+    if (!hostedMetadata && existsSync4(manifestPath)) {
+      try {
+        const manifest = asRecord(readJsonFile(manifestPath));
+        declaredEntrypoint = asRecord(manifest?.runtime)?.entrypoint;
+      } catch {
+        add(issues, "skill.manifest_invalid", "skill.json must contain valid JSON");
+      }
+    }
     if (hostedMetadata) {
       if (existsSync4(srcDir)) {
         add(issues, "skill.hosted_source_forbidden", "Hosted metadata skills must not include local implementation source");
       }
+    } else if (declaredEntrypoint !== undefined && declaredEntrypoint !== null) {
+      validateRuntimeEntry(skillPath, declaredEntrypoint, issues, warnings);
     } else if (!existsSync4(srcDir)) {
       add(issues, "skill.src_missing", "Missing src/ directory");
     } else if (!existsSync4(join4(srcDir, "index.ts")) && !existsSync4(join4(srcDir, "index.js"))) {
@@ -9146,7 +9187,11 @@ function validatePortableSkillDirectory(name, skillPath) {
           "package.missing",
           "package.bin_missing",
           "skill.src_missing",
-          "skill.src_index_missing"
+          "skill.src_index_missing",
+          "skill.runtime_entrypoint_unsafe",
+          "skill.runtime_entrypoint_missing",
+          "skill.runtime_entrypoint_symlink",
+          "skill.runtime_entrypoint_not_file"
         ]);
         for (let i = issues.length - 1;i >= 0; i--) {
           if (executableOnlyCodes.has(issues[i].code))
@@ -37660,7 +37705,7 @@ import { dirname as dirname14, relative as relative7 } from "path";
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.8.6",
+  version: "0.8.7",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {

package/dist/sdk/index.js

@@ -96141,7 +96141,7 @@ async function resolveExecutionGrant(input) {
 // package.json
 var package_default = {
   name: "@hasna/skills",
-  version: "0.8.6",
+  version: "0.8.7",
   description: "Skills library for AI coding agents",
   type: "module",
   bin: {
@@ -98480,6 +98480,35 @@ function isSafeRelativePath(value) {
   const normalized = normalize(value).replace(/\\/g, "/");
   return normalized !== ".." && !normalized.startsWith("../") && !normalized.includes("/../");
 }
+function validateRuntimeEntry(skillPath, entrypoint, issues, warnings) {
+  if (typeof entrypoint !== "string" || !isSafeRelativePath(entrypoint) || /^[a-zA-Z]:/.test(entrypoint) || entrypoint.includes("\\") || entrypoint.split("/").some((part) => !part || part === "." || part === "..")) {
+    add(issues, "skill.runtime_entrypoint_unsafe", "runtime.entrypoint must be a canonical relative file path inside the skill directory");
+    return;
+  }
+  const parts = entrypoint.split("/");
+  let current = skillPath;
+  for (let index = 0;index < parts.length; index++) {
+    current = join18(current, parts[index]);
+    let info;
+    try {
+      info = lstatSync13(current);
+    } catch {
+      add(issues, "skill.runtime_entrypoint_missing", "The declared runtime.entrypoint is missing or inaccessible");
+      return;
+    }
+    if (info.isSymbolicLink()) {
+      add(issues, "skill.runtime_entrypoint_symlink", "runtime.entrypoint must not traverse symbolic links");
+      return;
+    }
+    if (index < parts.length - 1 ? !info.isDirectory() : !info.isFile()) {
+      add(issues, "skill.runtime_entrypoint_not_file", "runtime.entrypoint must resolve to a regular file");
+      return;
+    }
+    if (index === parts.length - 1 && info.size < 50) {
+      add(warnings, "skill.runtime_entrypoint_minimal", `Source entry point is very small (${info.size}B)`);
+    }
+  }
+}
 function isHostedPackageMetadata(pkg) {
   return isHostedMetadataPackage(pkg);
 }
@@ -98715,10 +98744,22 @@ function validateSkillDirectory(name, skillPath, registryMeta) {
   } else {
     metadata.runtime = hostedMetadata ? "hosted" : "local";
     const srcDir = join18(skillPath, "src");
+    let declaredEntrypoint;
+    const manifestPath = join18(skillPath, "skill.json");
+    if (!hostedMetadata && existsSync6(manifestPath)) {
+      try {
+        const manifest = asRecord(readJsonFile(manifestPath));
+        declaredEntrypoint = asRecord(manifest?.runtime)?.entrypoint;
+      } catch {
+        add(issues, "skill.manifest_invalid", "skill.json must contain valid JSON");
+      }
+    }
     if (hostedMetadata) {
       if (existsSync6(srcDir)) {
         add(issues, "skill.hosted_source_forbidden", "Hosted metadata skills must not include local implementation source");
       }
+    } else if (declaredEntrypoint !== undefined && declaredEntrypoint !== null) {
+      validateRuntimeEntry(skillPath, declaredEntrypoint, issues, warnings);
     } else if (!existsSync6(srcDir)) {
       add(issues, "skill.src_missing", "Missing src/ directory");
     } else if (!existsSync6(join18(srcDir, "index.ts")) && !existsSync6(join18(srcDir, "index.js"))) {
@@ -100216,7 +100257,11 @@ function validatePortableSkillDirectory(name, skillPath) {
           "package.missing",
           "package.bin_missing",
           "skill.src_missing",
-          "skill.src_index_missing"
+          "skill.src_index_missing",
+          "skill.runtime_entrypoint_unsafe",
+          "skill.runtime_entrypoint_missing",
+          "skill.runtime_entrypoint_symlink",
+          "skill.runtime_entrypoint_not_file"
         ]);
         for (let i = issues.length - 1;i >= 0; i--) {
           if (executableOnlyCodes.has(issues[i].code))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/skills",
-  "version": "0.8.6",
+  "version": "0.8.7",
   "description": "Skills library for AI coding agents",
   "type": "module",
   "bin": {