@lesliechan721/aw 0.1.0-beta.11 → 0.1.0-beta.13

package/dist/authoring/scripts/validate-plugin.mjs

@@ -1706,35 +1706,6 @@ function defaultConfigValues(manifest) {
     }
     return values;
 }
-function collectScalarLeafTokens(value) {
-    if (typeof value === 'string')
-        return value === '' ? [] : [value];
-    if (typeof value === 'number' || typeof value === 'boolean')
-        return [String(value)];
-    if (value === null || typeof value !== 'object')
-        return [];
-    return Object.values(value).flatMap(collectScalarLeafTokens);
-}
-function collectSensitiveDefaultConfigValues(manifest) {
-    return Object.values(manifest.config?.fields ?? {}).flatMap((field) => {
-        if (!isRecord(field) || !Object.prototype.hasOwnProperty.call(field, 'default')) {
-            return [];
-        }
-        const value = field.default;
-        if (field.sensitive === true)
-            return collectScalarLeafTokens(value);
-        if (field.type !== 'object' || value === null || typeof value !== 'object') {
-            return [];
-        }
-        return Object.entries(value).flatMap(([property, childValue]) => {
-            const child = field.properties?.[property]
-                ?? (field.additionalProperties === false ? undefined : field.additionalProperties);
-            return isRecord(child) && child.sensitive === true
-                ? collectScalarLeafTokens(childValue)
-                : [];
-        });
-    });
-}
 function configFieldContainsSensitiveValue(field) {
     if (!isRecord(field))
         return false;
@@ -1941,10 +1912,15 @@ function validateArtifactTargetEntry(entry, index, manifest, pluginDir) {
             error(`${fieldName}.refreshKeys[${refreshIndex}]: unknown config key "${refreshKey}"`);
             continue;
         }
-        if (delivery?.mode === 'codex-native'
-            && configFieldContainsSensitiveValue(manifest.config?.fields?.[refreshKey])) {
-            error(`codexNativeRenderSensitiveRefreshKey: ${fieldName}.refreshKeys[${refreshIndex}]: ` +
-                `codex-native renderers cannot read sensitive config field "${refreshKey}"`);
+        const sensitiveRefreshKey = configFieldContainsSensitiveValue(manifest.config?.fields?.[refreshKey]);
+        const skillTarget = artifactTarget === 'codex.skill'
+            || artifactTarget === 'claude.skill'
+            || artifactTarget === 'agent-skills.skill';
+        if (skillTarget && sensitiveRefreshKey) {
+            const native = delivery?.mode === 'codex-native';
+            error(`${native ? 'codexNativeRenderSensitiveRefreshKey' : 'skillRenderSensitiveRefreshKey'}: ` +
+                `${fieldName}.refreshKeys[${refreshIndex}]: ` +
+                `${native ? 'codex-native renderers' : 'Skill renderers'} cannot read sensitive config field "${refreshKey}"`);
         }
     }
     if (target.requiresCodexProjectConfig !== undefined &&
@@ -2382,15 +2358,11 @@ function validateRenderedSkillTree(options) {
     if (!readme || readme.toString('utf8').trim() === '') {
         error(`${fieldName} final file tree must contain a non-empty README.md`);
     }
-    const sensitiveValues = collectSensitiveDefaultConfigValues(manifest);
     for (const [relativePath, content] of files) {
         const text = content.toString('utf8');
         if (/\{\{[^{}]+\}\}/u.test(text)) {
             error(`${fieldName} final file tree contains an unresolved template in "${relativePath}"`);
         }
-        if (sensitiveValues.some((value) => text.includes(value))) {
-            error(`${fieldName} final file tree exposes sensitive config in "${relativePath}"`);
-        }
     }
     if (declaration.target === 'codex.skill') {
         const openAiYaml = files.get('agents/openai.yaml');
@@ -2586,7 +2558,7 @@ function validateRenderedArtifactPlan(plan, declarations, scopeLabel, options) {
         }
     }
 }
-function resolveArtifactRendererFixtureRequests(declarations) {
+function resolveArtifactRendererFixtureRequests(declarations, manifest) {
     const awOwned = new Map();
     const codexNative = new Map();
     for (const declaration of declarations) {
@@ -2619,21 +2591,40 @@ function resolveArtifactRendererFixtureRequests(declarations) {
             awOwned.set(key, request);
         }
     }
-    return [...awOwned.values(), ...codexNative.values()];
+    const partitionedAwOwned = [...awOwned.values()].flatMap((request) => {
+        const hasSkill = request.declarations.some((declaration) => declaration.target === 'codex.skill'
+            || declaration.target === 'claude.skill'
+            || declaration.target === 'agent-skills.skill');
+        const hasSensitiveNonSkill = request.declarations.some((declaration) => declaration.target !== 'codex.skill'
+            && declaration.target !== 'claude.skill'
+            && declaration.target !== 'agent-skills.skill'
+            && declaration.refreshKeys.some((key) => configFieldContainsSensitiveValue(manifest.config?.fields?.[key])));
+        if (!hasSkill || !hasSensitiveNonSkill)
+            return [request];
+        const skillDeclarations = request.declarations.filter((declaration) => declaration.target === 'codex.skill'
+            || declaration.target === 'claude.skill'
+            || declaration.target === 'agent-skills.skill');
+        const nonSkillDeclarations = request.declarations.filter((declaration) => !skillDeclarations.includes(declaration));
+        return [
+            { ...request, declarations: skillDeclarations },
+            { ...request, declarations: nonSkillDeclarations },
+        ];
+    });
+    return [...partitionedAwOwned, ...codexNative.values()];
 }
 function runArtifactRendererFixture(pluginDir, manifest, renderEntry, declarations, resolvedRuntimeImports, skillValidationTools) {
     if (!renderEntry || declarations.length === 0)
         return;
-    const requests = resolveArtifactRendererFixtureRequests(declarations);
+    const requests = resolveArtifactRendererFixtureRequests(declarations, manifest);
     const values = defaultConfigValues(manifest);
     const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'aw-artifact-render-'));
     try {
-        for (const request of requests) {
+        for (const [requestIndex, request] of requests.entries()) {
             const { kind, surface, scope, configScope, declarations: scopedDeclarations, } = request;
             const distribution = surface === 'agent-skills' ? surface : undefined;
             const platform = distribution ? undefined : surface;
             const event = distribution ? 'materialize' : 'install';
-            const requestRoot = path.join(tempRoot, `${kind}-${surface}-${scope}`);
+            const requestRoot = path.join(tempRoot, `${requestIndex}-${kind}-${surface}-${scope}`);
             const rendererAwHome = path.join(requestRoot, 'aw-home');
             const rendererCodexHome = path.join(requestRoot, 'codex-home');
             const rendererClaudeHome = path.join(requestRoot, 'claude-home');