@lmzhen/dsh-tool-skill-manage 0.3.68 → 0.3.69

package/lib/index.js

@@ -37,6 +37,12 @@ const Config = z.object({
 	descriptionStrict: z.boolean().default(false),
 	threatExemptLabels: z.array(z.string()).default([])
 });
+/** v30 REV-02: read the protected-skill list off the (optional) policy
+* snapshot through an `unknown` boundary — the Context augmentation types the
+* getter non-optionally, but at runtime the row can be absent. */
+function policySnapshotOf(source) {
+	return source?.get?.();
+}
 function apply(ctx, rawConfig = {}) {
 	const systemPrompt = ctx.get("systemPrompt");
 	if (systemPrompt) ctx.effect(() => systemPrompt.section({
@@ -64,18 +70,32 @@ function apply(ctx, rawConfig = {}) {
 	async function executeCore(args, origin = "foreground") {
 		const action = args.action;
 		const name = args.name ?? "";
-		if (action === "review") return {
-			ok: true,
-			message: await buildSkillReviewText(),
-			skills: []
-		};
-		if (action === "list") {
+		if (action === "review") try {
+			return {
+				ok: true,
+				message: await buildSkillReviewText(),
+				skills: []
+			};
+		} catch (error) {
+			return {
+				ok: false,
+				message: `skill_manage review: skill tree scan failed (${error instanceof Error ? error.message : String(error)}).`,
+				skills: []
+			};
+		}
+		if (action === "list") try {
 			const list = await library.list();
 			return {
 				ok: true,
 				message: `Listed ${list.length} skills.`,
 				skills: list.map((s) => s.name)
 			};
+		} catch (error) {
+			return {
+				ok: false,
+				message: `skill_manage list: skill tree scan failed (${error instanceof Error ? error.message : String(error)}).`,
+				skills: []
+			};
 		}
 		const scalarArgs = args;
 		for (const field of [
@@ -94,7 +114,14 @@ function apply(ctx, rawConfig = {}) {
 				skills: []
 			};
 		}
-		const missing = (action === void 0 ? [] : {
+		if (origin !== "foreground") {
+			if ((policySnapshotOf(ctx.get("evolutionPolicy"))?.protectedSkillNames)?.includes(name)) return {
+				ok: false,
+				message: `skill_manage: "${name}" is protected by the current policy (protectedSkillNames); replayed/autonomous writes are refused.`,
+				skills: []
+			};
+		}
+		const REQUIRED_ARGS = {
 			create: ["name", "content"],
 			edit: ["name", "content"],
 			update: ["name", "content"],
@@ -113,7 +140,8 @@ function apply(ctx, rawConfig = {}) {
 			restructure: ["name"],
 			pin: ["name"],
 			unpin: ["name"]
-		}[action] ?? []).filter((field) => scalarArgs[field] === void 0 || scalarArgs[field] === null);
+		};
+		const missing = (action === void 0 || typeof action !== "string" || !Object.hasOwn(REQUIRED_ARGS, action) ? [] : REQUIRED_ARGS[action] ?? []).filter((field) => scalarArgs[field] === void 0 || scalarArgs[field] === null);
 		if (missing.length > 0) return {
 			ok: false,
 			message: `skill_manage ${action} requires ${missing.join(", ")}; the tool description lists the arguments per action.`,
@@ -129,6 +157,15 @@ function apply(ctx, rawConfig = {}) {
 				skills: []
 			};
 		}
+		if ((action === "write_file" || action === "remove_file") && typeof args.staged_from_sha256 === "string" && args.staged_from_sha256 !== "") {
+			const currentBytes = await library.readSupportFile(name, args.file_path ?? "").catch(() => void 0);
+			const actual = currentBytes === void 0 || currentBytes === null ? "absent" : contentHash(currentBytes);
+			if (currentBytes === void 0 || actual !== args.staged_from_sha256) return {
+				ok: false,
+				message: `Support file "${args.file_path ?? ""}" of "${name}" changed after this write was staged (or its state could not be verified); refusing to replay the stale snapshot. Re-stage the file operation.`,
+				skills: []
+			};
+		}
 		if ((action === "create" || action === "edit" || action === "update") && args.content) {
 			const parsed = parseFrontmatter(args.content);
 			if (parsed) {
@@ -194,7 +231,12 @@ function apply(ctx, rawConfig = {}) {
 			const protection = summary.protectionUnknown ? " [protection:unknown]" : summary.protectedBy ? ` [${summary.protectedBy}]` : "";
 			return `- ${summary.name} | ${record?.state ?? "active"} | use:${record?.use_count ?? 0} view:${record?.view_count ?? 0} patch:${record?.patch_count ?? 0}${quality}${protection}`;
 		});
-		const groups = computeDedupGroups({ contents: new Map(await Promise.all(list.map(async (summary) => [summary.name, await library.read(summary.name) ?? ""]))) });
+		const contents = /* @__PURE__ */ new Map();
+		for (let offset = 0; offset < list.length; offset += 16) await Promise.all(list.slice(offset, offset + 16).map(async (summary) => {
+			const body = await library.read(summary.name).catch(() => null);
+			contents.set(summary.name, body ?? "");
+		}));
+		const groups = computeDedupGroups({ contents });
 		const dedupLines = groups.slice(0, MAX_DEDUP_GROUPS_IN_REVIEW).map((group) => `- ${group.join(" ~ ")}`);
 		const warned = list.filter((summary) => warnedFlag(summary.name)).map((summary) => summary.name);
 		const warningLine = warned.length === 0 ? "" : `\nWarning skills (${warned.length}): ${warned.join(", ")} — low quality; consider consolidating them before authoring new skills.`;
@@ -286,6 +328,10 @@ function apply(ctx, rawConfig = {}) {
 					const stageCurrent = await library.read(args.name).catch(() => null);
 					if (stageCurrent !== null) args.staged_from_sha256 = contentHash(stageCurrent);
 				}
+				if ((args.action === "write_file" || args.action === "remove_file") && typeof args.name === "string" && args.name !== "" && typeof args.file_path === "string" && args.file_path !== "") {
+					const stageFile = await library.readSupportFile(args.name, args.file_path).catch(() => void 0);
+					if (stageFile !== void 0) args.staged_from_sha256 = stageFile === null ? "absent" : contentHash(stageFile);
+				}
 				const decision = await approval.request({
 					kind: "skill",
 					summary: `skill ${args.action ?? "?"} ${args.name ?? ""}`.trim(),

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@lmzhen/dsh-tool-skill-manage",
   "description": "Model-facing skill_manage tool (community build)",
-  "version": "0.3.68",
+  "version": "0.3.69",
   "publishConfig": {
     "access": "public"
   },
@@ -31,24 +31,24 @@
   "license": "MIT",
   "dependencies": {
     "@deepseek-ai/schemastery": "^3.18.1",
-    "@lmzhen/dsh-evolution-approval": "^0.3.68",
-    "@lmzhen/dsh-evolution-core": "^0.3.68"
+    "@lmzhen/dsh-evolution-approval": "^0.3.69",
+    "@lmzhen/dsh-evolution-core": "^0.3.69"
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
     "@deepseek-ai/dsh-invariants": "^0.1.1-rc.2",
     "@deepseek-ai/dsh-system-prompt": "^0.1.1-rc.2",
     "@deepseek-ai/dsh-tools": "^0.1.1-rc.2",
-    "@lmzhen/dsh-evolution-io": "^0.3.68",
-    "@lmzhen/dsh-skill-usage": "^0.3.68"
+    "@lmzhen/dsh-evolution-io": "^0.3.69",
+    "@lmzhen/dsh-skill-usage": "^0.3.69"
   },
   "devDependencies": {
     "@deepseek-ai/dsh-agent-loop-testkit": "^0.1.1-rc.2",
     "@deepseek-ai/dsh-invariants": "^0.1.1-rc.2",
     "@deepseek-ai/dsh-system-prompt": "^0.1.1-rc.2",
     "@deepseek-ai/dsh-tools": "^0.1.1-rc.2",
-    "@lmzhen/dsh-evolution-core": "^0.3.68",
-    "@lmzhen/dsh-evolution-io": "^0.3.68",
-    "@lmzhen/dsh-skill-usage": "^0.3.68"
+    "@lmzhen/dsh-evolution-core": "^0.3.69",
+    "@lmzhen/dsh-evolution-io": "^0.3.69",
+    "@lmzhen/dsh-skill-usage": "^0.3.69"
   }
 }