@lythos/skill-deck 0.1.7 → 0.1.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lythos/skill-deck",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "description": "Declarative skill deck governance — cold pool, working set, deny-by-default",
   "license": "MIT",
   "type": "module",

package/src/link.ts

@@ -17,6 +17,7 @@ import { resolve, dirname, join } from "path";
 import { homedir } from "os";
 import {
   SkillDeckLockSchema,
+  SkillDeckTomlSchema,
   type SkillDeckLock, type LinkedSkill, type ConstraintReport,
 } from "./schema.js";
 
@@ -160,11 +161,38 @@ if (!existsSync(DECK_PATH)) {
 const PROJECT_DIR = cliWorkdir ? resolve(cliWorkdir) : dirname(DECK_PATH);
 const deckRaw = readFileSync(DECK_PATH, "utf-8");
 const deckHash = hashContent(deckRaw);
-const deck = parseToml(deckRaw) as any;
+const parsedToml = parseToml(deckRaw) as any;
+
+// 预处理：TOML 解析器可能在空表上生成 Symbol 键，先清理
+function stripSymbols(obj: any): any {
+  if (obj == null) return obj;
+  if (Array.isArray(obj)) return obj.map(stripSymbols);
+  if (typeof obj === 'object') {
+    const clean: Record<string, any> = {};
+    for (const key of Object.keys(obj)) {
+      clean[key] = stripSymbols(obj[key]);
+    }
+    return clean;
+  }
+  return obj;
+}
+const cleanToml = stripSymbols(parsedToml);
+
+// Schema 校验：防止模板与运行时解析漂移
+const schemaResult = SkillDeckTomlSchema.safeParse(cleanToml);
+if (!schemaResult.success) {
+  console.error("❌ skill-deck.toml 格式错误:");
+  for (const issue of schemaResult.error.issues) {
+    const path = issue.path.map(String).filter(p => p !== "undefined").join(".") || "<root>";
+    console.error(`   ${path}: ${issue.message}`);
+  }
+  process.exit(1);
+}
+const deck = schemaResult.data;
 
-const WORKING_SET = expandHome(deck.deck?.working_set || ".claude/skills", PROJECT_DIR);
-const COLD_POOL = expandHome(deck.deck?.cold_pool || "~/.agents/skill-repos", PROJECT_DIR);
-const MAX_CARDS = Number(deck.deck?.max_cards || 10);
+const WORKING_SET = expandHome(deck.deck.working_set, PROJECT_DIR);
+const COLD_POOL = expandHome(deck.deck.cold_pool, PROJECT_DIR);
+const MAX_CARDS = deck.deck.max_cards;
 
 // ── 收集声明 ────────────────────────────────────────────────
 

package/src/schema.ts

@@ -1,5 +1,30 @@
 import { z } from "zod";
 
+// ── skill-deck.toml 声明文件 Schema ─────────────────────────
+// 防止模板与运行时解析漂移（template drift）
+
+export const SkillDeckTomlSchema = z.object({
+  deck: z.object({
+    working_set: z.string().default(".claude/skills"),
+    cold_pool: z.string().default("~/.agents/skill-repos"),
+    max_cards: z.number().int().min(1).default(10),
+  }),
+  innate: z.object({
+    skills: z.array(z.string()).default([]),
+  }).optional(),
+  tool: z.object({
+    skills: z.array(z.string()).default([]),
+  }).optional(),
+  combo: z.object({
+    skills: z.array(z.string()).default([]),
+  }).optional(),
+  // transient: 动态子表，key 是 skill 名，value 是任意配置
+  // 用 z.any() 避免空 [transient] 导致 record key 验证失败
+  transient: z.record(z.string(), z.any()).optional(),
+});
+
+export type SkillDeckToml = z.infer<typeof SkillDeckTomlSchema>;
+
 // ── 单个已链接 Skill ────────────────────────────────────────
 export const LinkedSkillSchema = z.object({
   name: z.string(),