@khanhcan148/mk 0.1.16 → 0.1.18

package/src/lib/auth.js

@@ -155,7 +155,13 @@ export async function startDeviceFlow(opts = {}) {
         'Content-Type': 'application/x-www-form-urlencoded',
         Accept: 'application/json'
       },
-      body: `client_id=${GITHUB_CLIENT_ID}&device_code=${device_code}&grant_type=urn:ietf:params:oauth:grant-type:device_code`
+      // Use URLSearchParams to prevent parameter injection if device_code ever contains '&' chars
+      // (mirrors the same safe pattern used in Step 1 above for the initial device-code request).
+      body: new URLSearchParams({
+        client_id: GITHUB_CLIENT_ID,
+        device_code,
+        grant_type: 'urn:ietf:params:oauth:grant-type:device_code'
+      }).toString()
     });
 
     const tokenData = await tokenRes.json();

package/src/lib/checksum.js

@@ -1,13 +1,28 @@
 import { createHash } from 'node:crypto';
-import { readFileSync } from 'node:fs';
+import { createReadStream } from 'node:fs';
 
 /**
- * Compute SHA-256 checksum of a file.
+ * Compute SHA-256 checksum of a file asynchronously using a streaming pipeline.
+ * Using createReadStream avoids loading the entire file into memory, which is
+ * important for large binary assets in the kit. Promise.all callers can parallelise
+ * multiple checksums without blocking the event loop.
+ *
  * @param {string} filePath - Absolute path to file
- * @returns {string} Checksum string prefixed with 'sha256:'
+ * @returns {Promise<string>} Checksum string prefixed with 'sha256:'
  */
 export function computeChecksum(filePath) {
-  const content = readFileSync(filePath);
-  const hash = createHash('sha256').update(content).digest('hex');
-  return `sha256:${hash}`;
+  return new Promise((resolve, reject) => {
+    const hash = createHash('sha256');
+    const stream = createReadStream(filePath);
+    stream.on('data', (chunk) => hash.update(chunk));
+    stream.on('end', () => resolve(`sha256:${hash.digest('hex')}`));
+    // H6: wrap the raw fs.Error so the absolute path in err.path never reaches
+    // user stderr while preserving the causal chain for debuggers. The top-level
+    // message is the errno code (callers branch on err.code; err.cause retains
+    // the original for stack-trace inspection when needed).
+    stream.on('error', (e) => {
+      const code = e && e.code ? e.code : 'checksum read failed';
+      reject(new Error(code, e ? { cause: e } : undefined));
+    });
+  });
 }

package/src/lib/concurrency.js

@@ -0,0 +1,36 @@
+/**
+ * Default in-flight worker cap for `pLimit` over file-descriptor-bound tasks.
+ *
+ * 16 is 8× typical disk parallelism and well under macOS default `ulimit -n 256`.
+ * Chosen empirically — higher values don't meaningfully speed up SHA-256 of
+ * kit-sized files, and lower values serialise too aggressively on SSD.
+ */
+export const DEFAULT_CONCURRENCY_CAP = 16;
+
+/**
+ * Bounded-concurrency helper for fan-out over async tasks.
+ *
+ * M3 — `Promise.all(items.map(computeChecksum))` opens N file descriptors at
+ * once. On installs with hundreds of files this blows past the default
+ * `ulimit -n` (256 on macOS) and causes EMFILE. `pLimit` caps the in-flight
+ * worker pool; results preserve input order via explicit index assignment.
+ *
+ * @template T
+ * @param {Array<() => Promise<T>>} tasks  Array of thunks. Each thunk is
+ *   invoked at most once by exactly one worker.
+ * @param {number} cap  Max concurrent workers (>=1).
+ * @returns {Promise<T[]>}  Results indexed to match `tasks`.
+ */
+export async function pLimit(tasks, cap) {
+  const results = new Array(tasks.length);
+  let next = 0;
+  const workerCount = Math.max(1, Math.min(cap, tasks.length));
+  const workers = Array.from({ length: workerCount }, async () => {
+    while (next < tasks.length) {
+      const idx = next++;
+      results[idx] = await tasks[idx]();
+    }
+  });
+  await Promise.all(workers);
+  return results;
+}

package/src/lib/constants.js

@@ -8,6 +8,14 @@ export const KIT_SUBDIRS = ['agents', 'skills', 'workflows', 'hooks'];
  */
 export const MANIFEST_FILENAME = '.mk-manifest.json';
 
+/**
+ * Skills that are internal to the kit and must NOT be distributed to end users.
+ * Each entry is matched as a full directory segment: `/skills/<name>/`.
+ * The trailing `/` in the match pattern prevents false positives on substring names
+ * (e.g. `mk-selftest-extended` is NOT matched by `mk-selftest`).
+ */
+export const KIT_INTERNAL_SKILLS = ['mk-selftest'];
+
 /**
  * Files/patterns to exclude during copy
  */