@klhapp/skillmux 1.12.0 → 1.13.0

package/src/provenance.ts

@@ -1,99 +0,0 @@
-import { existsSync, lstatSync, readFileSync, writeFileSync } from "node:fs";
-import { basename, dirname, join } from "node:path";
-import { isGitUrl } from "./install";
-import { SKILLMUX_ORIGIN_FILENAME, listSupportingFiles } from "./vault";
-
-export { SKILLMUX_ORIGIN_FILENAME };
-
-export interface SkillOrigin {
-  schema_version: 1;
-  source_url: string;
-  skill_path?: string;
-  commit: string;
-  installed_at: string;
-  content_hash: string;
-}
-
-function validateOrigin(origin: SkillOrigin, path: string): SkillOrigin {
-  if (origin.schema_version !== 1) throw new Error(`${path}: unsupported .skillmux-origin schema_version`);
-  if (typeof origin.source_url !== "string" || origin.source_url.length === 0) {
-    throw new Error(`${path}: .skillmux-origin is missing source_url`);
-  }
-  if (!isGitUrl(origin.source_url)) {
-    throw new Error(`${path}: .skillmux-origin has a source_url that is not a recognized git protocol`);
-  }
-  if (typeof origin.commit !== "string" || !/^[0-9a-f]{40}$/.test(origin.commit)) {
-    throw new Error(`${path}: .skillmux-origin has an invalid commit`);
-  }
-  if (typeof origin.installed_at !== "string") throw new Error(`${path}: .skillmux-origin is missing installed_at`);
-  if (typeof origin.content_hash !== "string" || !/^[a-f0-9]{64}$/.test(origin.content_hash)) {
-    throw new Error(`${path}: .skillmux-origin has an invalid content_hash`);
-  }
-  return origin;
-}
-
-/** Same defense-in-depth as readSkill/hashSkillContent: a tampered vault entry
- *  (shared git-backed vault pulled in, or a hand-edit) could symlink the sidecar
- *  itself to an arbitrary host file — refuse to follow it rather than feeding
- *  that file's bytes into JSON.parse and, on a schema-shaped coincidence, into
- *  the git commands `outdated`/`update` run against `source_url`. */
-export function readSkillOrigin(dir: string): SkillOrigin | null {
-  // The skill directory itself must be checked separately from the sidecar's own
-  // leaf check below: `lstat` only refuses to follow the *final* path component,
-  // so a symlinked skill directory containing a real, non-symlink sidecar at its
-  // target would otherwise resolve straight through to arbitrary host content.
-  if (existsSync(dir) && lstatSync(dir).isSymbolicLink()) {
-    throw new Error(`${dir}: refusing to read .skillmux-origin — the skill directory is a symlink`);
-  }
-  const path = join(dir, SKILLMUX_ORIGIN_FILENAME);
-  if (!existsSync(path)) return null;
-  if (lstatSync(path).isSymbolicLink()) {
-    throw new Error(`${path}: refusing to read .skillmux-origin — it is a symlink`);
-  }
-  return validateOrigin(JSON.parse(readFileSync(path, "utf-8")), path);
-}
-
-export function writeSkillOrigin(
-  dir: string,
-  params: {
-    source_url: string;
-    skill_path?: string;
-    commit: string;
-    installed_at: string;
-    content_hash: string;
-  },
-): void {
-  const origin: SkillOrigin = { schema_version: 1, ...params };
-  writeFileSync(join(dir, SKILLMUX_ORIGIN_FILENAME), JSON.stringify(origin, null, 2));
-}
-
-/** Deterministic sha256 over every file in a skill directory (SKILL.md plus every
- *  file listSupportingFiles returns), used for local-drift detection. listSupportingFiles
- *  already excludes symlinks it finds, but SKILL.md is read separately (same reason
- *  readSkill/deliverSkill guard it independently in vault.ts/router-core.ts) — this is
- *  a local, already-installed vault dir, not the freshly cloned candidate that
- *  validateSkillCandidate has vetted, so a swapped-in symlinked SKILL.md must be
- *  refused here rather than followed. `dir` itself is checked too: every per-file
- *  lstat below only refuses to follow a symlinked *leaf*, so a symlinked `dir`
- *  containing real (non-symlink) files at its target would otherwise resolve
- *  straight through to arbitrary host content. */
-export function hashSkillContent(dir: string): string {
-  const vaultPath = dirname(dir);
-  const skillId = basename(dir);
-  if (lstatSync(dir).isSymbolicLink()) {
-    throw new Error(`refusing to hash ${skillId}: the skill directory is a symlink`);
-  }
-  const hasher = new Bun.CryptoHasher("sha256");
-  const files = ["SKILL.md", ...listSupportingFiles(vaultPath, skillId)];
-  for (const rel of files) {
-    const path = join(dir, rel);
-    if (lstatSync(path).isSymbolicLink()) {
-      throw new Error(`refusing to hash ${skillId}/${rel}: it is a symlink`);
-    }
-    hasher.update(rel);
-    hasher.update("\0");
-    hasher.update(readFileSync(path));
-    hasher.update("\0");
-  }
-  return hasher.digest("hex");
-}

package/src/rate-limiter.ts

@@ -1,137 +0,0 @@
-interface Bucket {
-  tokens: number;
-  lastRefillMs: number;
-}
-
-// SMX-93: bounds memory even when an attacker (behind a trust_proxy-honored
-// reverse proxy) mints unbounded distinct X-Forwarded-For values, or a
-// long-running deployment simply accumulates many distinct legitimate
-// clients over time. Past this many entries, the least-recently-used
-// bucket is evicted to make room — active clients are never evicted ahead
-// of idle ones.
-const DEFAULT_MAX_BUCKETS = 10_000;
-
-export interface RateLimitCheckInput {
-  nowMs: number;
-  auth_enabled: boolean;
-  req: Request;
-  server: {
-    requestIP(request: Request): { address: string } | null;
-  };
-}
-
-export interface RateLimitCheckResult {
-  allowed: boolean;
-  retryAfterSeconds?: number;
-  headers: Record<string, string>;
-}
-
-export class RateLimiter {
-  private enabled: boolean;
-  private requests_per_minute: number;
-  private trust_proxy: boolean;
-  private max_buckets: number;
-  private buckets = new Map<string, Bucket>();
-
-  constructor(config: {
-    enabled: boolean;
-    requests_per_minute: number;
-    trust_proxy?: boolean;
-    max_buckets?: number;
-  }) {
-    this.enabled = config.enabled;
-    this.requests_per_minute = config.requests_per_minute;
-    this.trust_proxy = config.trust_proxy ?? false;
-    this.max_buckets = config.max_buckets ?? DEFAULT_MAX_BUCKETS;
-  }
-
-  check(input: RateLimitCheckInput): RateLimitCheckResult {
-    if (!this.enabled) {
-      return { allowed: true, headers: {} };
-    }
-
-    // 1. Resolve identifier
-    let id = "127.0.0.1";
-    if (input.auth_enabled) {
-      const authHeader = input.req.headers.get("authorization") || "";
-      const token = authHeader.startsWith("Bearer ") ? authHeader.slice(7) : authHeader;
-      if (token) {
-        id = token;
-      }
-    } else {
-      const ipAddr = input.server.requestIP(input.req)?.address;
-      if (ipAddr) {
-        id = ipAddr;
-      } else if (this.trust_proxy) {
-        // X-Forwarded-For is client-supplied and spoofable; only honor it
-        // when trust_proxy opts in (i.e. a trusted reverse proxy sets it).
-        const xff = input.req.headers.get("x-forwarded-for");
-        if (xff) {
-          id = xff.split(",", 1)[0]?.trim() || id;
-        }
-      }
-    }
-
-    // 2. Retrieve or initialize bucket
-    let bucket = this.buckets.get(id);
-    if (bucket) {
-      // Map iteration order is insertion order, so re-inserting on touch
-      // marks this entry as most-recently-used and moves it out of the
-      // eviction path below.
-      this.buckets.delete(id);
-      this.buckets.set(id, bucket);
-    } else {
-      if (this.buckets.size >= this.max_buckets) {
-        const oldestId = this.buckets.keys().next().value;
-        if (oldestId !== undefined) {
-          this.buckets.delete(oldestId);
-        }
-      }
-      bucket = {
-        tokens: this.requests_per_minute,
-        lastRefillMs: input.nowMs,
-      };
-      this.buckets.set(id, bucket);
-    }
-
-    // 3. Refill tokens
-    const elapsedMs = input.nowMs - bucket.lastRefillMs;
-    if (elapsedMs > 0) {
-      const refillRatePerMs = this.requests_per_minute / (60 * 1000);
-      const refilled = elapsedMs * refillRatePerMs;
-      bucket.tokens = Math.min(this.requests_per_minute, bucket.tokens + refilled);
-      bucket.lastRefillMs = input.nowMs;
-    }
-
-    // 4. Determine allowed status
-    let allowed = false;
-    if (bucket.tokens >= 1) {
-      bucket.tokens -= 1;
-      allowed = true;
-    }
-
-    // Calculate headers
-    const headers: Record<string, string> = {
-      "X-RateLimit-Limit": this.requests_per_minute.toString(),
-      "X-RateLimit-Remaining": Math.floor(bucket.tokens).toString(),
-    };
-
-    const refillRatePerSec = this.requests_per_minute / 60;
-    const missingTokens = this.requests_per_minute - bucket.tokens;
-    const resetTimeSeconds = Math.ceil(input.nowMs / 1000 + (missingTokens / refillRatePerSec));
-    headers["X-RateLimit-Reset"] = resetTimeSeconds.toString();
-
-    if (allowed) {
-      return { allowed, headers };
-    } else {
-      const neededTokens = 1 - bucket.tokens;
-      const retryAfterSeconds = Math.ceil(neededTokens / refillRatePerSec);
-      headers["Retry-After"] = retryAfterSeconds.toString();
-      return {
-        allowed,
-        retryAfterSeconds,
-        headers,
-      };
-    }
-  }
-}

package/src/readiness.ts

@@ -1,30 +0,0 @@
-import type { RetrievalCapability } from "./types";
-
-export interface ReadinessSnapshot {
-  status: "starting" | "ready" | "not_ready" | "stopping";
-  retrieval: RetrievalCapability | null;
-  skills: number;
-  index_current: boolean;
-  embedding: "pending" | "ready" | "unavailable";
-  reranker: "not_configured" | "pending" | "ready" | "unavailable";
-  error?: string;
-}
-
-export class ReadinessState {
-  private snapshot: ReadinessSnapshot = {
-    status: "starting",
-    retrieval: null,
-    skills: 0,
-    index_current: false,
-    embedding: "pending",
-    reranker: "not_configured",
-  };
-
-  get(): ReadinessSnapshot {
-    return { ...this.snapshot };
-  }
-
-  set(snapshot: ReadinessSnapshot): void {
-    this.snapshot = { ...snapshot };
-  }
-}

package/src/redact.ts

@@ -1,52 +0,0 @@
-const PLACEHOLDER = "[REDACTED]";
-
-// Strips userinfo (user:pass@) from URLs unconditionally, since a
-// credential-bearing git URL (private-repo PAT auth) is typed by the user
-// directly and never resolved from a config `*_env` key, so it can't be
-// caught by the config-driven scrub below.
-const URL_USERINFO = /:\/\/[^/\s@]*@/g;
-
-function redactUrlCredentials(text: string): string {
-  return text.replace(URL_USERINFO, `://${PLACEHOLDER}@`);
-}
-
-/**
- * Walks the config tree for every string-valued key ending in `_env`
- * (api_key_env, token_env, auth_token_env, and any future one) and resolves
- * each to its current environment value.
- */
-function collectSecretValues(value: unknown): string[] {
-  const secrets: string[] = [];
-  const visit = (node: unknown): void => {
-    if (Array.isArray(node)) {
-      for (const item of node) visit(item);
-      return;
-    }
-    if (node === null || typeof node !== "object") return;
-    for (const [key, val] of Object.entries(node as Record<string, unknown>)) {
-      if (key.endsWith("_env") && typeof val === "string") {
-        const resolved = process.env[val];
-        if (resolved) secrets.push(resolved);
-      } else {
-        visit(val);
-      }
-    }
-  };
-  visit(value);
-  return secrets;
-}
-
-/**
- * Builds a redactor bound to the currently effective config: a pure
- * `(text) => text` closure that scrubs any resolved `*_env` secret value.
- */
-export function buildRedactor(config: unknown): (text: string) => string {
-  const secrets = collectSecretValues(config);
-  return (text: string): string => {
-    let result = redactUrlCredentials(text);
-    for (const secret of secrets) {
-      result = result.split(secret).join(PLACEHOLDER);
-    }
-    return result;
-  };
-}