@lmzhen/dsh-tool-skill-manage 0.3.70 → 0.3.72

package/lib/index.js

@@ -1,7 +1,7 @@
 import { effectiveSessionPolicy } from "@lmzhen/dsh-evolution-approval";
 import z from "@deepseek-ai/schemastery";
 import { defineTool } from "@deepseek-ai/dsh-tools";
-import { DEFAULT_SKILL_LIMITS, DSH_AUTHORING_STANDARDS, SKILLS_GUIDANCE, SKILLS_GUIDANCE_SECTION_ORDER, SkillLibrary, authoringFeedback, clampedNumber, computeDedupGroups, contentHash, evolutionIoAdapter, parseFrontmatter, resolveOrigins, resolveSkillsRoot } from "@lmzhen/dsh-evolution-core";
+import { DEFAULT_SKILL_LIMITS, DSH_AUTHORING_STANDARDS, SKILLS_GUIDANCE, SKILLS_GUIDANCE_SECTION_ORDER, SKILL_ACTION_REQUIRED_FIELDS, SkillLibrary, authoringFeedback, clampedNumber, computeDedupGroups, contentHash, evolutionIoAdapter, parseFrontmatter, resolveOrigins, resolveSkillsRoot } from "@lmzhen/dsh-evolution-core";
 //#region lib/types/index.js
 /**
 * Model-facing skill_manage tool over ctx.evolutionIo + ctx.skillUsage.
@@ -35,7 +35,8 @@ const Config = z.object({
 	maxSkillContentChars: z.number().min(1).default(DEFAULT_SKILL_LIMITS.maxSkillContentChars),
 	maxSkillFileBytes: z.number().min(1).default(DEFAULT_SKILL_LIMITS.maxSkillFileBytes),
 	descriptionStrict: z.boolean().default(false),
-	threatExemptLabels: z.array(z.string()).default([])
+	threatExemptLabels: z.array(z.string()).default([]),
+	strictCrossSource: z.boolean().default(false)
 });
 /** v30 REV-02: read the protected-skill list off the (optional) policy
 * snapshot through an `unknown` boundary — the Context augmentation types the
@@ -67,6 +68,15 @@ function apply(ctx, rawConfig = {}) {
 		ctx.emit("evolution/skill-mutated", event);
 	}, void 0, [...rawConfig.threatExemptLabels ?? []]);
 	if (numericClamped.length > 0) ctx.logger.warn(`tool-skill-manage: ${numericClamped.join(", ")} provided an invalid value; falling back to the default`);
+	const catalogWinner = async (name) => {
+		const catalog = ctx.get("skills");
+		if (catalog === void 0) return void 0;
+		try {
+			return (await catalog.list()).find((summary) => summary.name === name);
+		} catch {
+			return;
+		}
+	};
 	async function executeCore(args, origin = "foreground") {
 		const action = args.action;
 		const name = args.name ?? "";
@@ -121,26 +131,7 @@ function apply(ctx, rawConfig = {}) {
 				skills: []
 			};
 		}
-		const REQUIRED_ARGS = {
-			create: ["name", "content"],
-			edit: ["name", "content"],
-			update: ["name", "content"],
-			patch: [
-				"name",
-				"old_string",
-				"new_string"
-			],
-			delete: ["name"],
-			write_file: [
-				"name",
-				"file_path",
-				"file_content"
-			],
-			remove_file: ["name", "file_path"],
-			restructure: ["name"],
-			pin: ["name"],
-			unpin: ["name"]
-		};
+		const REQUIRED_ARGS = SKILL_ACTION_REQUIRED_FIELDS;
 		const missing = (action === void 0 || typeof action !== "string" || !Object.hasOwn(REQUIRED_ARGS, action) ? [] : REQUIRED_ARGS[action] ?? []).filter((field) => scalarArgs[field] === void 0 || scalarArgs[field] === null);
 		if (missing.length > 0) return {
 			ok: false,
@@ -148,24 +139,7 @@ function apply(ctx, rawConfig = {}) {
 			skills: []
 		};
 		let feedbackLines = [];
-		if ((action === "edit" || action === "update") && typeof args.staged_from_sha256 === "string" && args.staged_from_sha256 !== "") {
-			const currentContent = await library.read(name).catch(() => null);
-			const actual = contentHash(currentContent ?? "");
-			if (currentContent === null || actual !== args.staged_from_sha256) return {
-				ok: false,
-				message: `Skill "${name}" changed after this write was staged (content ${currentContent === null ? "no longer exists" : "hash mismatch"}); refusing to replay the stale snapshot. Re-apply the edit to stage a fresh copy.`,
-				skills: []
-			};
-		}
-		if ((action === "write_file" || action === "remove_file") && typeof args.staged_from_sha256 === "string" && args.staged_from_sha256 !== "") {
-			const currentBytes = await library.readSupportFile(name, args.file_path ?? "").catch(() => void 0);
-			const actual = currentBytes === void 0 || currentBytes === null ? "absent" : contentHash(currentBytes);
-			if (currentBytes === void 0 || actual !== args.staged_from_sha256) return {
-				ok: false,
-				message: `Support file "${args.file_path ?? ""}" of "${name}" changed after this write was staged (or its state could not be verified); refusing to replay the stale snapshot. Re-stage the file operation.`,
-				skills: []
-			};
-		}
+		const stagedAnchor = typeof args.staged_from_sha256 === "string" && args.staged_from_sha256 !== "" ? args.staged_from_sha256 === "absent" ? { absent: true } : { sha256: args.staged_from_sha256 } : void 0;
 		if ((action === "create" || action === "edit" || action === "update") && args.content) {
 			const parsed = parseFrontmatter(args.content);
 			if (parsed) {
@@ -180,11 +154,11 @@ function apply(ctx, rawConfig = {}) {
 		}
 		let result;
 		if (action === "create") result = await library.create(name, args.content ?? "", origin);
-		else if (action === "edit" || action === "update") result = await library.update(name, args.content ?? "", origin);
+		else if (action === "edit" || action === "update") result = await library.update(name, args.content ?? "", origin, stagedAnchor);
 		else if (action === "patch") result = await library.patch(name, args.old_string ?? "", args.new_string ?? "", args.file_path ?? "", args.replace_all === true, origin);
 		else if (action === "delete") result = await library.archive(name, args.absorbed_into ? { absorbedInto: args.absorbed_into } : {});
-		else if (action === "write_file") result = await library.writeSupportFile(name, args.file_path ?? "", args.file_content ?? "", origin);
-		else if (action === "remove_file") result = await library.removeSupportFile(name, args.file_path ?? "", origin);
+		else if (action === "write_file") result = await library.writeSupportFile(name, args.file_path ?? "", args.file_content ?? "", origin, stagedAnchor);
+		else if (action === "remove_file") result = await library.removeSupportFile(name, args.file_path ?? "", origin, stagedAnchor);
 		else if (action === "restructure") {
 			const moves = Array.isArray(args.restructure) ? args.restructure : [];
 			if (moves.some((move) => {
@@ -204,6 +178,11 @@ function apply(ctx, rawConfig = {}) {
 			ok: false,
 			message: `Unknown action "${action}".`
 		};
+		if (result.stale === true) return {
+			ok: false,
+			message: action === "write_file" || action === "remove_file" ? `Support file "${args.file_path ?? ""}" of "${name}" changed after this write was staged (or its state could not be verified).` : `Skill "${name}" changed after this write was staged (content ${result.anchor === "missing" ? "no longer exists" : "hash mismatch"}).`,
+			skills: []
+		};
 		if (result.ok) {
 			if (result.normalizedFrontmatterFields && result.normalizedFrontmatterFields.length > 0) feedbackLines.push(`frontmatter auto-quoted (YAML compatibility): ${result.normalizedFrontmatterFields.join(", ")}`);
 			const mutating = action !== "list" && action !== "review" && action !== "pin" && action !== "unpin";
@@ -318,25 +297,44 @@ function apply(ctx, rawConfig = {}) {
 		},
 		isConcurrencySafe: () => false,
 		async execute(args, exec) {
+			let operation = args;
 			const origins = resolveOrigins(exec.agent?.session?.header.origin);
 			const reviewOrigin = origins.approval;
 			const libraryOrigin = origins.library;
 			const sessionPolicy = effectiveSessionPolicy(ctx, exec.agent?.session);
+			if (typeof args.name === "string" && args.name !== "" && args.action !== "list" && args.action !== "review" && args.action !== "pin" && args.action !== "unpin") {
+				const winner = await catalogWinner(args.name);
+				if (winner !== void 0 && winner.provider !== "dsh-evolution") {
+					const message = `skill "${args.name}" resolves to a higher-priority "${winner.source}" skill (provider "${winner.provider}"); this write lands on the family copy, which the catalog does NOT serve — edit the "${winner.source}" copy or rename.`;
+					if (rawConfig.strictCrossSource === true) return {
+						ok: false,
+						message: `Refused: ${message}`,
+						skills: []
+					};
+					ctx.logger.warn(`skill_manage: ${message}`);
+				}
+			}
 			const approval = ctx.get("evolutionApproval");
 			if (approval && args.action !== "list" && args.action !== "review" && args.action !== "pin" && args.action !== "unpin") {
 				if ((args.action === "update" || args.action === "edit") && typeof args.name === "string" && args.name !== "") {
 					const stageCurrent = await library.read(args.name).catch(() => null);
-					if (stageCurrent !== null) args.staged_from_sha256 = contentHash(stageCurrent);
+					if (stageCurrent !== null) operation = {
+						...args,
+						staged_from_sha256: contentHash(stageCurrent)
+					};
 				}
 				if ((args.action === "write_file" || args.action === "remove_file") && typeof args.name === "string" && args.name !== "" && typeof args.file_path === "string" && args.file_path !== "") {
 					const stageFile = await library.readSupportFile(args.name, args.file_path).catch(() => void 0);
-					if (stageFile !== void 0) args.staged_from_sha256 = stageFile === null ? "absent" : contentHash(stageFile);
+					if (stageFile !== void 0) operation = {
+						...args,
+						staged_from_sha256: stageFile === null ? "absent" : contentHash(stageFile)
+					};
 				}
 				const decision = await approval.request({
 					kind: "skill",
 					summary: `skill ${args.action ?? "?"} ${args.name ?? ""}`.trim(),
 					args: {
-						operation: args,
+						operation,
 						origin: reviewOrigin,
 						libraryOrigin
 					},
@@ -352,7 +350,7 @@ function apply(ctx, rawConfig = {}) {
 					...decision.pendingId !== void 0 ? { pending_id: decision.pendingId } : {}
 				};
 			}
-			return await executeCore(args, libraryOrigin);
+			return await executeCore(operation, libraryOrigin);
 		}
 	}));
 	ctx.inject(["evolutionApproval"], (approvalCtx) => {

package/lib/types/index.d.ts

@@ -32,6 +32,11 @@ export interface Config {
      * strict ANY-hit-blocks behavior is unchanged; deployments opt in per
      * label for known false-positive content. */
     threatExemptLabels?: string[];
+    /** OPT-19 (2026-09, plan D3): when true, a write whose name the platform
+     * catalog resolves to a NON-family source (project/custom sources outrank
+     * the family tree) is REFUSED instead of warned about. Default false —
+     * warn only, keeping the family tree an autonomous evolution zone. */
+    strictCrossSource?: boolean;
 }
 export declare const Config: z<Config>;
 export declare function apply(ctx: Context, rawConfig?: Config): void;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@lmzhen/dsh-tool-skill-manage",
   "description": "Model-facing skill_manage tool (community build)",
-  "version": "0.3.70",
+  "version": "0.3.72",
   "publishConfig": {
     "access": "public"
   },
@@ -31,24 +31,26 @@
   "license": "MIT",
   "dependencies": {
     "@deepseek-ai/schemastery": "^3.18.1",
-    "@lmzhen/dsh-evolution-approval": "^0.3.70",
-    "@lmzhen/dsh-evolution-core": "^0.3.70"
+    "@lmzhen/dsh-evolution-approval": "^0.3.72",
+    "@lmzhen/dsh-evolution-core": "^0.3.72"
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
     "@deepseek-ai/dsh-invariants": "^0.1.5-rc.2",
+    "@deepseek-ai/dsh-skill": "^0.1.5-rc.2",
     "@deepseek-ai/dsh-system-prompt": "^0.1.5-rc.2",
     "@deepseek-ai/dsh-tools": "^0.1.5-rc.2",
-    "@lmzhen/dsh-evolution-io": "^0.3.70",
-    "@lmzhen/dsh-skill-usage": "^0.3.70"
+    "@lmzhen/dsh-evolution-io": "^0.3.72",
+    "@lmzhen/dsh-skill-usage": "^0.3.72"
   },
   "devDependencies": {
     "@deepseek-ai/dsh-agent-loop-testkit": "^0.1.5-rc.2",
     "@deepseek-ai/dsh-invariants": "^0.1.5-rc.2",
+    "@deepseek-ai/dsh-skill": "^0.1.5-rc.2",
     "@deepseek-ai/dsh-system-prompt": "^0.1.5-rc.2",
     "@deepseek-ai/dsh-tools": "^0.1.5-rc.2",
-    "@lmzhen/dsh-evolution-core": "^0.3.70",
-    "@lmzhen/dsh-evolution-io": "^0.3.70",
-    "@lmzhen/dsh-skill-usage": "^0.3.70"
+    "@lmzhen/dsh-evolution-core": "^0.3.72",
+    "@lmzhen/dsh-evolution-io": "^0.3.72",
+    "@lmzhen/dsh-skill-usage": "^0.3.72"
   }
 }