@klhapp/skillmux 1.9.2 → 1.10.0

package/src/commands/sync.ts

@@ -0,0 +1,232 @@
+import { existsSync } from "node:fs";
+import { hostname } from "node:os";
+import { expandHome, loadConfig } from "../config";
+import {
+  parseManifest,
+  resolveManifestPath,
+  validateManifest,
+} from "../manifest";
+import { emitSuccess, isInteractive, warn } from "../output";
+import {
+  installPostMergeHook,
+  resolveProjectPinDir,
+  restoreMonolith as restoreMonolithTarget,
+  syncProjectTargets,
+  syncTarget,
+  type ProjectGroupInput,
+} from "../sync";
+import { confirmAction } from "./shared";
+
+function parseSyncArgs(args: string[]): {
+  dryRun: boolean;
+  restoreMonolith: boolean;
+  installHook: boolean;
+  yes: boolean;
+  isJson: boolean;
+} {
+  let dryRun = false;
+  let restoreMonolith = false;
+  let installHook = false;
+  let yes = false;
+  let isJson = false;
+  for (const arg of args) {
+    if (arg === "--dry-run") dryRun = true;
+    else if (arg === "--restore-monolith") restoreMonolith = true;
+    else if (arg === "--install-hook") installHook = true;
+    else if (arg === "--yes") yes = true;
+    else if (arg === "--json") isJson = true;
+    else throw new Error(`unknown sync option: ${arg}`);
+  }
+  return { dryRun, restoreMonolith, installHook, yes, isJson };
+}
+
+/**
+ * A target directory that doesn't exist yet is about to be created by `sync`.
+ * `manifest.targets[*].dir` is vault content — readable and writable by whatever
+ * populated the vault (a shared git-backed vault pulled in, or a hand-edit) — and
+ * `sync` can run unattended via the `--install-hook` post-merge hook. Without this
+ * gate, a tampered manifest naming a brand-new path gets that directory silently
+ * created (and populated with symlinks) the next time anyone pulls. Creation for
+ * an as-yet-unseen directory therefore requires either `--yes` or an interactive
+ * confirmation; once the directory exists, later syncs never hit this path again.
+ */
+async function confirmNewSyncTarget(
+  label: string,
+  dir: string,
+  yes: boolean,
+  isJson: boolean,
+): Promise<boolean> {
+  if (yes) return true;
+  if (!isInteractive()) {
+    if (!isJson) {
+      console.log(
+        `${label}: skipped — ${dir} does not exist yet; creating it requires approval. Re-run "skillmux sync --yes", or run "skillmux sync" interactively, once you've confirmed this target is expected.`,
+      );
+    }
+    return false;
+  }
+  return confirmAction(`${label}: create new target directory ${dir}?`);
+}
+
+interface SyncTargetSummary {
+  target: string;
+  status:
+    | "synced"
+    | "skipped_host_mismatch"
+    | "restored"
+    | "not_owned"
+    | "skipped_not_approved";
+  added?: string[];
+  removed?: string[];
+  skipped?: string[];
+  projects?: {
+    group: string;
+    pin_dir: string;
+    added: string[];
+    removed: string[];
+    skipped: string[];
+  }[];
+}
+
+export async function runSync(args: string[]): Promise<void> {
+  const { dryRun, restoreMonolith, installHook, yes, isJson } = parseSyncArgs(args);
+  const config = await loadConfig();
+  const vaultPath = expandHome(config.vault_path);
+  const log = (line: string) => {
+    if (!isJson) console.log(line);
+  };
+  const warnLine = (line: string) => {
+    if (!isJson) warn(line);
+  };
+
+  let hookInstalled: boolean | undefined;
+  if (installHook) {
+    const result = installPostMergeHook(vaultPath);
+    hookInstalled = result.installed;
+    log(result.installed ? "installed post-merge hook" : "post-merge hook already installed");
+  }
+
+  const manifestPath = resolveManifestPath(vaultPath);
+  if (!manifestPath) {
+    emitSuccess({ isJson }, { hook_installed: hookInstalled ?? null, targets: [] }, () =>
+      console.log("no skillmux.toml found at vault root — nothing to sync"),
+    );
+    return;
+  }
+
+  const manifest = parseManifest(await Bun.file(manifestPath).text());
+  const localVaultPaths = config.local_vault_paths.map(expandHome);
+  const { notes } = validateManifest(manifest, vaultPath, localVaultPaths);
+  for (const note of notes) log(`note: ${note}`);
+
+  const currentHost = hostname();
+  const targetSummaries: SyncTargetSummary[] = [];
+  for (const [targetName, target] of Object.entries(manifest.targets)) {
+    if (target.host !== undefined && target.host !== currentHost) {
+      log(
+        `${targetName}: skipped (host ${target.host} does not match current host ${currentHost})`,
+      );
+      targetSummaries.push({ target: targetName, status: "skipped_host_mismatch" });
+      continue;
+    }
+    const targetDir = expandHome(target.dir);
+
+    if (restoreMonolith) {
+      const result = restoreMonolithTarget(targetDir, vaultPath);
+      log(
+        result.restored
+          ? `${targetName}: restored to a vault symlink`
+          : `${targetName}: not owned by skillmux, left untouched`,
+      );
+      targetSummaries.push({
+        target: targetName,
+        status: result.restored ? "restored" : "not_owned",
+      });
+      continue;
+    }
+
+    if (!dryRun && !existsSync(targetDir)) {
+      const approved = await confirmNewSyncTarget(targetName, targetDir, yes, isJson);
+      if (!approved) {
+        if (isInteractive()) {
+          log(`${targetName}: skipped — creating ${targetDir} was not approved`);
+        }
+        targetSummaries.push({ target: targetName, status: "skipped_not_approved" });
+        continue;
+      }
+    }
+
+    const suffix = dryRun ? " (dry-run)" : "";
+    const result = syncTarget(
+      {
+        vaultPath,
+        targetDir,
+        targetName,
+        coreSkillIds: manifest.core.skills,
+        localVaultPaths,
+      },
+      { dryRun },
+    );
+    log(`${targetName}: +${result.added.length} -${result.removed.length}${suffix}`);
+    if (result.skipped.length > 0) {
+      warnLine(`refused to sync ${result.skipped.join(", ")} — skill directory contains a symlink`);
+    }
+    const summary: SyncTargetSummary = {
+      target: targetName,
+      status: "synced",
+      added: result.added,
+      removed: result.removed,
+      skipped: result.skipped,
+    };
+
+    if (target.project_groups.length > 0) {
+      const allGroups = manifest.project ?? {};
+      const projectGroups: Record<string, ProjectGroupInput> = {};
+      for (const groupName of target.project_groups) {
+        const group = allGroups[groupName]!;
+        const approvedPaths: string[] = [];
+        for (const path of group.paths) {
+          // Mirror syncProjectTargets' own `if (!existsSync(path)) continue` so we
+          // never prompt for a project path it would silently skip anyway.
+          if (!existsSync(path)) continue;
+          const pinDir = resolveProjectPinDir(targetDir, path);
+          if (dryRun || existsSync(pinDir)) {
+            approvedPaths.push(path);
+            continue;
+          }
+          const approved = await confirmNewSyncTarget(`${targetName}/${groupName}`, pinDir, yes, isJson);
+          if (approved) approvedPaths.push(path);
+        }
+        projectGroups[groupName] = { ...group, paths: approvedPaths };
+      }
+      const projectResults = syncProjectTargets(
+        { vaultPath, targetDir, targetName, projectGroups, localVaultPaths },
+        { dryRun },
+      );
+      summary.projects = projectResults.map((projectResult) => ({
+        group: projectResult.group,
+        pin_dir: projectResult.pinDir,
+        added: projectResult.added,
+        removed: projectResult.removed,
+        skipped: projectResult.skipped,
+      }));
+      for (const projectResult of projectResults) {
+        log(
+          `  ${projectResult.group} -> ${projectResult.pinDir}: +${projectResult.added.length} -${projectResult.removed.length}${suffix}`,
+        );
+        if (projectResult.skipped.length > 0) {
+          warnLine(
+            `refused to sync ${projectResult.skipped.join(", ")} — skill directory contains a symlink`,
+          );
+        }
+      }
+    }
+    targetSummaries.push(summary);
+  }
+
+  emitSuccess(
+    { isJson },
+    { hook_installed: hookInstalled ?? null, notes, targets: targetSummaries },
+    () => {},
+  );
+}

package/src/commands/target.ts

@@ -63,14 +63,16 @@ export async function runTarget(
       !(await confirmIfNeeded({
         confirmed: args.includes("--yes"),
         isJson: options.isJson,
-        prompt: `Adopt target ${name} at ${path}?`,
+        prompt: `adopt target ${name} at ${path}?`,
         nonInteractiveError:
           "skillmux target add requires --yes when run non-interactively",
       }))
     )
       return;
     applyInit(vaultPath, [{ name, dir: path }]);
-    console.log(`target "${name}" added at ${path}`);
+    emitSuccess({ isJson: options.isJson }, { name, dir: path }, () =>
+      console.log(`target "${name}" added at ${path}`),
+    );
     return;
   }
 
@@ -84,24 +86,34 @@ export async function runTarget(
       );
     }
     if (options.dryRun) {
-      console.log(`target remove: ${name} (files preserved, dry-run)`);
+      emitSuccess(
+        { isJson: options.isJson },
+        { name, preserved_dir: manifest.targets[name]!.dir },
+        () => console.log(`target remove: ${name} (files preserved, dry-run)`),
+      );
       return;
     }
     if (
       !(await confirmIfNeeded({
         confirmed: args.includes("--yes"),
         isJson: options.isJson,
-        prompt: `Remove target ${name} from the manifest and preserve its files?`,
+        prompt: `remove target ${name} from the manifest and preserve its files?`,
         nonInteractiveError:
           "skillmux target remove requires --yes when run non-interactively",
       }))
     )
       return;
     const targets = { ...manifest.targets };
+    const removedDir = manifest.targets[name]!.dir;
     delete targets[name];
     writeManifestAtomic(manifestPath, { ...manifest, targets });
-    console.log(
-      `target "${name}" removed from the manifest; files preserved at ${manifest.targets[name]!.dir}`,
+    emitSuccess(
+      { isJson: options.isJson },
+      { name, preserved_dir: removedDir },
+      () =>
+        console.log(
+          `target "${name}" removed from the manifest; files preserved at ${removedDir}`,
+        ),
     );
     return;
   }

package/src/commands/update.ts

@@ -2,6 +2,7 @@ import { rmSync } from "node:fs";
 import { join } from "node:path";
 import { expandHome, loadConfig } from "../config";
 import {
+  assertHostAllowed,
   cloneToTemp,
   installIntoVault,
   isLocalFileUrl,
@@ -17,6 +18,7 @@ import { type ScanFinding, type ScanSeverity, scanExitCode } from "../scan";
 import { SKILL_ID_PATTERN } from "../vault";
 import { confirmIfNeeded } from "./shared";
 import { checkOutdated } from "./outdated";
+import { isGlobalFlag } from "../global-flags";
 
 type UpdateKind = "update" | "up_to_date" | "skip_drift" | "skip_scan_failed" | "skip_read_error";
 
@@ -37,6 +39,7 @@ async function resolveCandidateOrigins(
   vaultPath: string,
   skillId: string | undefined,
   allowLocalSource: boolean,
+  allowedHosts: string[] | undefined,
 ): Promise<{ skillId: string; origin: SkillOrigin }[]> {
   if (skillId) {
     // skillId (the CLI's positional <skill-id>) is joined straight into vaultPath
@@ -65,7 +68,7 @@ async function resolveCandidateOrigins(
     }
     return [{ skillId, origin }];
   }
-  const outdated = await checkOutdated(vaultPath, { allowLocalSource });
+  const outdated = await checkOutdated(vaultPath, { allowLocalSource, allowedHosts });
   return outdated
     .filter((result) => result.status === "outdated")
     .map((result) => ({ skillId: result.skill_id, origin: readSkillOrigin(join(vaultPath, result.skill_id))! }));
@@ -76,6 +79,7 @@ async function buildPlan(
   candidates: { skillId: string; origin: SkillOrigin }[],
   failOn: ScanSeverity | undefined,
   force: boolean,
+  allowedHosts: string[] | undefined,
 ): Promise<UpdatePlanItem[]> {
   const plan: UpdatePlanItem[] = [];
   for (const { skillId, origin } of candidates) {
@@ -118,6 +122,7 @@ async function buildPlan(
       continue;
     }
 
+    assertHostAllowed(origin.source_url, allowedHosts);
     const cloneDir = await cloneToTemp(origin.source_url);
     const resolved = resolveSkillDir(cloneDir, skillId, origin.skill_path);
     const base = {
@@ -191,7 +196,7 @@ function parseUpdateArgs(args: string[]): {
         throw new Error("--fail-on must be low, medium, or high");
       }
       failOn = value;
-    } else if (arg === "--json") {
+    } else if (isGlobalFlag(arg, "--json")) {
       // handled globally
     } else if (arg?.startsWith("--")) {
       throw new Error(`unknown update option: ${arg}`);
@@ -206,10 +211,11 @@ function parseUpdateArgs(args: string[]): {
 
 export async function runUpdate(args: string[], options: { isJson: boolean }): Promise<void> {
   const { skillId, yes, dryRun, force, failOn, allowLocalSource } = parseUpdateArgs(args);
-  const vaultPath = expandHome((await loadConfig()).vault_path);
+  const config = await loadConfig();
+  const vaultPath = expandHome(config.vault_path);
 
-  const candidates = await resolveCandidateOrigins(vaultPath, skillId, allowLocalSource);
-  const plan = await buildPlan(vaultPath, candidates, failOn, force);
+  const candidates = await resolveCandidateOrigins(vaultPath, skillId, allowLocalSource, config.egress?.allowed_hosts);
+  const plan = await buildPlan(vaultPath, candidates, failOn, force, config.egress?.allowed_hosts);
   try {
     const toWrite = plan.filter((item) => item.kind === "update");
 

package/src/concurrency-limiter.ts

@@ -0,0 +1,61 @@
+export class ConcurrencyLimiter {
+  private inFlight = 0;
+
+  constructor(private readonly max: number) {}
+
+  tryAcquire(): boolean {
+    if (this.inFlight >= this.max) return false;
+    this.inFlight++;
+    return true;
+  }
+
+  release(): void {
+    this.inFlight = Math.max(0, this.inFlight - 1);
+  }
+}
+
+/**
+ * Wraps a response body so `release` fires when the stream actually finishes
+ * (fully drained or cancelled by a client disconnect) instead of as soon as
+ * the Response object is constructed. For a buffered body this happens almost
+ * immediately; for an open SSE stream it defers release until the connection
+ * really closes, so a concurrency limiter reflects true connection lifetime.
+ */
+export function releaseOnStreamClose(
+  body: ReadableStream<Uint8Array> | null,
+  release: () => void,
+): ReadableStream<Uint8Array> | null {
+  if (!body) {
+    release();
+    return null;
+  }
+
+  const reader = body.getReader();
+  let released = false;
+  const releaseOnce = () => {
+    if (released) return;
+    released = true;
+    release();
+  };
+
+  return new ReadableStream<Uint8Array>({
+    async pull(controller) {
+      try {
+        const { done, value } = await reader.read();
+        if (done) {
+          controller.close();
+          releaseOnce();
+          return;
+        }
+        controller.enqueue(value);
+      } catch (error) {
+        controller.error(error);
+        releaseOnce();
+      }
+    },
+    cancel(reason) {
+      releaseOnce();
+      return reader.cancel(reason);
+    },
+  });
+}

package/src/config-service.ts

@@ -4,6 +4,7 @@ import { dirname, join } from "node:path";
 import { DEFAULT_CONFIG_PATH, expandHome, loadConfig } from "./config";
 import { describeDeployment } from "./deployment";
 import type { Config } from "./types";
+import { stringifyToml } from "./toml-writer";
 
 export type ConfigSource = "default" | "toml" | "environment";
 export type ConfigSourceMap = Record<string, ConfigSource>;
@@ -373,57 +374,6 @@ export async function setDottedKey(
   };
 }
 
-export function stringifyToml(obj: Record<string, any>): string {
-  let out = "";
-  const topLevel: Record<string, any> = {};
-  const sections: Record<string, any> = {};
-
-  for (const [k, v] of Object.entries(obj)) {
-    if (typeof v === "object" && v !== null && !Array.isArray(v)) {
-      sections[k] = v;
-    } else {
-      topLevel[k] = v;
-    }
-  }
-
-  for (const [k, v] of Object.entries(topLevel)) {
-    out += `${k} = ${formatTomlVal(v)}\n`;
-  }
-  if (Object.keys(topLevel).length > 0) out += "\n";
-
-  for (const [secName, secObj] of Object.entries(sections)) {
-    out += stringifyTomlSection([secName], secObj);
-  }
-
-  return out;
-}
-
-function stringifyTomlSection(path: string[], obj: Record<string, any>): string {
-  let out = `[${path.join(".")}]\n`;
-  const subSections: Record<string, any> = {};
-
-  for (const [k, v] of Object.entries(obj)) {
-    if (typeof v === "object" && v !== null && !Array.isArray(v)) {
-      subSections[k] = v;
-    } else {
-      out += `${k} = ${formatTomlVal(v)}\n`;
-    }
-  }
-  out += "\n";
-
-  for (const [subName, subObj] of Object.entries(subSections)) {
-    out += stringifyTomlSection([...path, subName], subObj);
-  }
-
-  return out;
-}
-
-function formatTomlVal(v: unknown): string {
-  if (typeof v === "string") return JSON.stringify(v);
-  if (typeof v === "boolean" || typeof v === "number") return String(v);
-  if (Array.isArray(v)) return JSON.stringify(v);
-  return JSON.stringify(v);
-}
 
 export async function getLocalConfigStatus(configPath?: string): Promise<ConfigStatusResponse> {
   const { effective } = await getEffectiveConfig(configPath);

package/src/config.ts

@@ -87,10 +87,15 @@ const configSchema = z.object({
       enabled: z.boolean(),
       token_env: z.string().min(1),
     }).strict().optional(),
+    max_body_bytes: z.number().int().positive().optional(),
+    max_concurrent_requests: z.number().int().min(0).optional(),
   }).strict().optional(),
   audit: z.object({
     retention_days: z.number().int().min(0).default(90),
   }).strict().default({ retention_days: 90 }),
+  egress: z.object({
+    allowed_hosts: z.array(z.string().min(1)).optional(),
+  }).strict().optional(),
 }).strict().refine((cfg) => {
   const hasReranker = cfg.inference.mode === "remote" && !!cfg.inference.reranker;
   if (hasReranker && cfg.output.max_top_k > cfg.recall.k_rerank) {

package/src/context.ts

@@ -12,7 +12,12 @@ export interface ContextConfig {
   contexts: Record<string, ContextRecord>;
 }
 
-export type ResolvedTarget =
+/**
+ * Context resolution: `local` = this CLI process has the Skillmux runtime (vault,
+ * index, audit db, embeddings/reranker clients) loaded in-process; `remote` = this
+ * CLI process is a thin network client to a separate process elsewhere that owns that runtime.
+ */
+export type ResolvedContext =
   | { type: "local"; name: "local" }
   | { type: "remote"; name: string; server: string; token_env?: string };
 
@@ -127,10 +132,10 @@ export async function useContext(name: string, filePath?: string): Promise<void>
   await saveContextConfig(config, filePath);
 }
 
-export async function resolveTarget(
+export async function resolveContext(
   flags: { context?: string; server?: string },
   filePath?: string
-): Promise<ResolvedTarget> {
+): Promise<ResolvedContext> {
   // Precedence 1: Explicit flags
   if (flags.context && flags.server) {
     throw new Error("Cannot specify both --context and --server");