@jarel/myskills 0.1.0-beta.3 → 0.1.0-beta.4

package/README.md

@@ -174,7 +174,7 @@ Update the CLI with:
 npm install -g @jarel/myskills@alpha
 ```
 
-The `0.1.0-beta.3` source manifest is configured for the `beta` dist-tag. The release-verification workflow packs and installs the candidate without publishing it.
+The `0.1.0-beta.4` source manifest is configured for the `beta` dist-tag. The release-verification workflow packs and installs the candidate without publishing it.
 
 `validate`, `scan`, and `submit` accept a manifest file, package directory, or local `.zip` package. `login` prompts for the API URL when one is not supplied; the default is the local API at `http://localhost:3001`, and custom hosted URLs can be entered manually. Successful login stores the selected API URL in local CLI config so later commands can omit `--api-url`. API URL resolution is `--api-url`, then `MYSKILLS_API_URL`, then saved config, then `http://localhost:3001`.
 

package/dist/index.js

@@ -1385,7 +1385,7 @@ var require_yauzl = __commonJS({
 
 // src/cli.ts
 import { createHash } from "node:crypto";
-import { cp, mkdir, readFile as readFile3, rm, stat, writeFile } from "node:fs/promises";
+import { cp, mkdir, readFile as readFile2, rm, stat, writeFile } from "node:fs/promises";
 import path3 from "node:path";
 
 // ../../node_modules/zod/v4/classic/external.js
@@ -17185,7 +17185,8 @@ var architecturePatternMigrationLimits = {
 };
 
 // src/codex-readonly-adapter.ts
-import { open, lstat as lstat2, readFile as readFile2, readdir as readdir2 } from "node:fs/promises";
+import { constants as fsConstants } from "node:fs";
+import { open, lstat as lstat2, readdir as readdir2 } from "node:fs/promises";
 import path2 from "node:path";
 var codexAdapterProfiles = ["personal", "work", "shared"];
 var codexAdapterDescriptor = Object.freeze({
@@ -17454,10 +17455,14 @@ var CodexReadOnlyArchitectureTargetAdapter = class {
   }
   async #readMetadataFile(relativeName) {
     const filePath = path2.join(this.#root, relativeName);
+    let handle;
     try {
-      const entry = await lstat2(filePath);
-      if (entry.isSymbolicLink() || !entry.isFile() || entry.size > MAX_METADATA_BYTES) return { status: "invalid" };
-      const text = await readFile2(filePath, "utf8");
+      handle = await open(filePath, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW | fsConstants.O_NONBLOCK);
+      const entry = await handle.stat();
+      if (!entry.isFile()) return { status: "invalid" };
+      const { buffer, bytesRead } = await readBounded(handle, MAX_METADATA_BYTES);
+      if (bytesRead > MAX_METADATA_BYTES) return { status: "invalid" };
+      const text = buffer.toString("utf8", 0, bytesRead);
       let value;
       try {
         value = JSON.parse(text);
@@ -17468,6 +17473,8 @@ var CodexReadOnlyArchitectureTargetAdapter = class {
     } catch (error51) {
       if (isMissingFileError(error51)) return { status: "missing" };
       return { status: "invalid" };
+    } finally {
+      await handle?.close().catch(() => void 0);
     }
   }
   async #readSkills(profileResolutions, routerPolicy, findings) {
@@ -17663,9 +17670,9 @@ function parseRouterPolicyEntry(value, findings) {
 async function readFrontmatter(filePath) {
   let handle;
   try {
-    const entry = await lstat2(filePath);
-    if (entry.isSymbolicLink() || !entry.isFile()) return { status: "invalid" };
-    handle = await open(filePath, "r");
+    handle = await open(filePath, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW | fsConstants.O_NONBLOCK);
+    const entry = await handle.stat();
+    if (!entry.isFile()) return { status: "invalid" };
     const openingDelimiter = await readOpeningDelimiter(handle);
     if (!openingDelimiter.valid) return { status: "missing" };
     const lines = [];
@@ -17685,6 +17692,16 @@ async function readFrontmatter(filePath) {
     await handle?.close().catch(() => void 0);
   }
 }
+async function readBounded(handle, maximumBytes) {
+  const buffer = Buffer.alloc(maximumBytes + 1);
+  let bytesRead = 0;
+  while (bytesRead < buffer.length) {
+    const result = await handle.read(buffer, bytesRead, buffer.length - bytesRead, bytesRead);
+    if (result.bytesRead === 0) break;
+    bytesRead += result.bytesRead;
+  }
+  return { buffer, bytesRead };
+}
 async function readOpeningDelimiter(handle) {
   const buffer = Buffer.alloc(4);
   const result = await handle.read(buffer, 0, buffer.length, null);
@@ -17799,7 +17816,7 @@ function isMissingFileError(error51) {
 
 // src/cli.ts
 var DEFAULT_API_URL = "http://localhost:3001";
-var CLI_VERSION = "0.1.0-beta.3";
+var CLI_VERSION = "0.1.0-beta.4";
 var CLI_VISIBILITY_SCOPES = ["public", "authenticated", "organization", "team", "private", "explicit-users"];
 var LOGIN_AUTH_METHODS = ["password", "api-key"];
 var OBSERVED_IDENTIFIER_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
@@ -18801,7 +18818,7 @@ async function readCodexAdapterContext(parsed) {
   }
   let text;
   try {
-    text = await readFile3(path3.resolve(contextPath), "utf8");
+    text = await readFile2(path3.resolve(contextPath), "utf8");
   } catch {
     throw new CliError("The context JSON file could not be read.", 2, "CODEX_TARGET_CONTEXT_INVALID");
   }
@@ -18948,7 +18965,7 @@ async function submissionPayload(packagePath, manifest) {
       manifest,
       archive: {
         filename: path3.basename(packagePath),
-        contentBase64: (await readFile3(packagePath)).toString("base64")
+        contentBase64: (await readFile2(packagePath)).toString("base64")
       }
     };
   }
@@ -19234,7 +19251,7 @@ function installRoot(parsed, runtime) {
 }
 async function readInstallRegistry(root) {
   try {
-    return parseInstallRegistry(await readFile3(installRegistryPath(root), "utf8"), root);
+    return parseInstallRegistry(await readFile2(installRegistryPath(root), "utf8"), root);
   } catch (error51) {
     if (isNodeError(error51) && error51.code === "ENOENT") {
       return { version: 1, installations: {} };
@@ -19911,7 +19928,7 @@ async function readObservedStateFixture(inputPath) {
   const resolvedPath = path3.resolve(inputPath);
   let text;
   try {
-    text = await readFile3(resolvedPath, "utf8");
+    text = await readFile2(resolvedPath, "utf8");
   } catch {
     throw new CliError("Observed-state fixture could not be read.", 2, "OBSERVED_STATE_INVALID");
   }
@@ -21099,7 +21116,7 @@ function isNodeError2(error51) {
 }
 
 // src/token-store.ts
-import { chmod, mkdir as mkdir2, readFile as readFile4, rm as rm2, writeFile as writeFile2 } from "node:fs/promises";
+import { chmod, mkdir as mkdir2, readFile as readFile3, rm as rm2, writeFile as writeFile2 } from "node:fs/promises";
 import os2 from "node:os";
 import path5 from "node:path";
 var KEYRING_SERVICE = "ai.jarel.myskills.cli";
@@ -21200,7 +21217,7 @@ function tokenFilePath(env) {
 }
 async function readPayload2(filePath) {
   try {
-    const raw = await readFile4(filePath, "utf8");
+    const raw = await readFile3(filePath, "utf8");
     return parsePayload2(raw);
   } catch (error51) {
     if (isNodeError3(error51) && error51.code === "ENOENT") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jarel/myskills",
-  "version": "0.1.0-beta.3",
+  "version": "0.1.0-beta.4",
   "description": "Command-line client for publishing, discovering, installing, updating, and rolling back MySkills packages.",
   "license": "Apache-2.0",
   "private": false,
@@ -41,8 +41,8 @@
     "test": "node ../../scripts/run-node-tests.mjs --import tsx --extensions .test.ts"
   },
   "devDependencies": {
-    "@myskills-app/core": "0.1.0-beta.3",
-    "@myskills-app/skill-package": "0.1.0-beta.3",
+    "@myskills-app/core": "0.1.0-beta.4",
+    "@myskills-app/skill-package": "0.1.0-beta.4",
     "esbuild": "^0.28.2",
     "tsx": "^4.23.12"
   },