@modootoday/pmcp 0.9.2 → 0.11.0

package/dist/project/hook-adapter.d.ts

@@ -0,0 +1,11 @@
+import { S as ShellHookSpec, H as HookTool } from '../hook-spec-PRSnYGLV.js';
+
+type Decision = {
+    readonly decision: "allow" | "deny";
+    readonly reason?: string;
+};
+declare function guardPath(root: string, command: readonly string[]): string;
+declare function evaluateShellHook(root: string, policy: ShellHookSpec, tool: HookTool, payload: unknown): Decision;
+declare function nativeHookDecision(tool: HookTool, decision: Decision): object;
+
+export { evaluateShellHook, guardPath, nativeHookDecision };

package/dist/project/hook-adapter.js

@@ -0,0 +1,191 @@
+// src/project/hook-adapter.ts
+import { spawnSync } from "child_process";
+import { createHash } from "crypto";
+import { existsSync, readFileSync, realpathSync, statSync } from "fs";
+import { dirname, isAbsolute, relative, resolve } from "path";
+var denied = () => ({
+  decision: "deny",
+  reason: "Shell guard failed validation or execution"
+});
+function guardPath(root, command) {
+  const script = command[0]?.startsWith(".agents/guards/") ? command[0] : command[1];
+  if (!script?.startsWith(".agents/guards/")) {
+    throw new Error("Hook command must execute a script under .agents/guards/");
+  }
+  const absolute = resolve(root, script);
+  const base = resolve(root, ".agents/guards");
+  const inside = relative(base, absolute);
+  if (isAbsolute(inside) || inside === ".." || inside.startsWith("../") || inside.startsWith("..\\")) {
+    throw new Error("Hook guard must stay under .agents/guards/");
+  }
+  if (!existsSync(absolute) || !statSync(absolute).isFile()) {
+    throw new Error("Hook guard script must exist");
+  }
+  const actual = relative(base, realpathSync(absolute));
+  if (isAbsolute(actual) || actual === ".." || actual.startsWith("../") || actual.startsWith("..\\")) {
+    throw new Error("Hook guard cannot resolve outside .agents/guards/");
+  }
+  return absolute;
+}
+function object(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return {};
+  }
+  return value;
+}
+function scalar(value) {
+  if (typeof value !== "string") {
+    return void 0;
+  }
+  if (value.startsWith('"')) {
+    try {
+      const parsed = JSON.parse(value);
+      if (typeof parsed === "string") {
+        return parsed;
+      }
+    } catch {
+      return value;
+    }
+  }
+  return value;
+}
+function evaluateShellHook(root, policy, tool, payload) {
+  try {
+    const value = object(payload);
+    const call = object(value["toolCall"]);
+    const input = tool === "antigravity" ? object(call["args"]) : object(value["tool_input"]);
+    const name = tool === "antigravity" ? call["name"] : value["tool_name"];
+    const shellNames = {
+      codex: ["Bash", "exec_command", "shell", "shell_command"],
+      gemini: ["run_shell_command"],
+      antigravity: ["run_command"]
+    };
+    if (typeof name !== "string") {
+      return denied();
+    }
+    if (!shellNames[tool].includes(name)) {
+      return { decision: "allow" };
+    }
+    const command = scalar(
+      input[tool === "antigravity" ? "CommandLine" : "command"]
+    );
+    if (command === void 0 || command.length > 65536) {
+      return denied();
+    }
+    const cwd = scalar(input["Cwd"]) ?? scalar(value["cwd"]) ?? root;
+    const args = [...policy.command];
+    const script = guardPath(root, args);
+    if (args[0]?.startsWith(".agents/guards/")) {
+      args[0] = script;
+    } else {
+      args[1] = script;
+    }
+    const executable = args.shift();
+    if (!executable) {
+      return denied();
+    }
+    const result = spawnSync(executable, args, {
+      cwd: root,
+      env: { PATH: process.env["PATH"], LANG: "C.UTF-8" },
+      input: JSON.stringify({
+        runtime: tool,
+        event: "before_shell",
+        command,
+        cwd
+      }),
+      encoding: "utf8",
+      timeout: policy.timeoutMs,
+      killSignal: "SIGKILL",
+      maxBuffer: 65536
+    });
+    if (result.status !== 0 || result.error) {
+      return denied();
+    }
+    const response = object(JSON.parse(result.stdout));
+    if (Object.keys(response).some(
+      (key) => !["decision", "reason"].includes(key)
+    ) || !["allow", "deny"].includes(String(response["decision"])) || response["reason"] !== void 0 && typeof response["reason"] !== "string") {
+      return denied();
+    }
+    return {
+      decision: response["decision"],
+      ...typeof response["reason"] === "string" ? { reason: response["reason"].slice(0, 2e3) } : {}
+    };
+  } catch {
+    return denied();
+  }
+}
+function nativeHookDecision(tool, decision) {
+  if (tool === "codex") {
+    return {
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: decision.decision,
+        ...decision.reason ? { permissionDecisionReason: decision.reason } : {}
+      }
+    };
+  }
+  return decision;
+}
+async function main() {
+  const [, , , tool, file, integrity] = process.argv;
+  const supported = tool === "codex" || tool === "gemini" || tool === "antigravity";
+  if (!supported) {
+    process.exitCode = 2;
+    return;
+  }
+  let decision = denied();
+  try {
+    if (!file) {
+      throw new Error("Missing hook policy");
+    }
+    const bytes = readFileSync(file);
+    const adapter = readFileSync(process.argv[1]);
+    const actual = createHash("sha256").update(adapter).update(bytes).digest("hex");
+    if (actual !== integrity) {
+      throw new Error("Hook integrity mismatch");
+    }
+    const policy = JSON.parse(bytes.toString("utf8"));
+    if (!policy.targets.includes(tool)) {
+      throw new Error("Hook target mismatch");
+    }
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of process.stdin) {
+      const bytes2 = Buffer.from(chunk);
+      size += bytes2.length;
+      if (size > 131072) {
+        throw new Error("Hook input too large");
+      }
+      chunks.push(bytes2);
+    }
+    const root = resolve(dirname(file), "../..");
+    const guardSha256 = createHash("sha256").update(readFileSync(guardPath(root, policy.command))).digest("hex");
+    if (policy.contractVersion !== 1 || guardSha256 !== policy.guardSha256) {
+      throw new Error(
+        "Hook guard source changed; reproject and review native trust"
+      );
+    }
+    decision = evaluateShellHook(
+      root,
+      policy,
+      tool,
+      JSON.parse(Buffer.concat(chunks).toString("utf8"))
+    );
+  } catch {
+    decision = denied();
+  }
+  process.stdout.write(
+    `${JSON.stringify(nativeHookDecision(tool, decision))}
+`
+  );
+}
+if (process.argv[2] === "--pmcp-shell-hook") {
+  await main();
+}
+export {
+  evaluateShellHook,
+  guardPath,
+  nativeHookDecision
+};
+//# sourceMappingURL=hook-adapter.js.map

package/dist/{server-C9eO6LMI.d.ts → server-CwWcRjqz.d.ts}

@@ -1,6 +1,125 @@
-import { S as SkillEntry, M as MetadataValue, C as CatalogOptions, A as AssetKind } from './catalog-BU5VLLyd.js';
 import { z } from 'zod';
 
+/**
+ * SKILL.md frontmatter, read as YAML the way a host reads it, and checked against
+ * the Agent Skills specification (https://agentskills.io/specification).
+ */
+type MetadataLeaf = string | readonly string[];
+/** A metadata value: a leaf, or a map of leaves one level below the metadata key. */
+type MetadataValue = MetadataLeaf | {
+    readonly [key: string]: MetadataLeaf;
+};
+/**
+ * Parsed frontmatter. A value with an unquoted ": " is a common authoring slip
+ * the client guide says to recover from by quoting it, so that is retried once.
+ */
+declare function frontmatterObject(source: string): Record<string, unknown> | null;
+declare const NAME_MAX = 64;
+declare const DESCRIPTION_MAX = 1024;
+declare const COMPATIBILITY_MAX = 500;
+/**
+ * What the specification requires of one SKILL.md, as messages; empty when valid.
+ * directory is the name of the folder holding it.
+ */
+declare function specProblems(front: Record<string, unknown> | null, directory: string): string[];
+
+/**
+ * The skills the installed packages brought with them.
+ *
+ * Derived from `node_modules` at read time rather than from a list somebody
+ * maintains: installing a package is how its skill arrives and uninstalling it
+ * is how the skill leaves, so the catalog is always true of the project.
+ */
+
+interface SkillEntry {
+    /** `<package>/<slug>`. Unique, and stable while the package is installed. */
+    readonly name: string;
+    readonly package: string;
+    readonly slug: string;
+    /** Frontmatter description. The only text `find` ranks against. */
+    readonly description: string;
+    /** Absolute path to the SKILL.md. `call` reads the body from here. */
+    readonly path: string;
+    /** open, free or paid. Set for marketplace skills, absent for packages. */
+    readonly tier?: string;
+    /** The frontmatter `metadata:` block; maps such as `requires` are kept one level down. */
+    readonly metadata?: Readonly<Record<string, MetadataValue>>;
+    /** Extra search terms. Ranked with the description, never used as triggers. */
+    readonly keywords?: readonly string[];
+    /** What the entry is. Absent means a skill. */
+    readonly kind?: AssetKind;
+    /**
+     * What describe and read may open: a directory, or one file for an asset
+     * that is a single file. Absent means the directory holding `path`.
+     */
+    readonly root?: string;
+}
+/** Everything the catalog serves. Commands are skills; workflows have no kind of their own. */
+declare const ASSET_KINDS: readonly ["skill", "agent", "hook", "mcp"];
+type AssetKind = (typeof ASSET_KINDS)[number];
+declare const kindOf: (entry: Pick<SkillEntry, "kind">) => AssetKind;
+interface CatalogOptions {
+    /** Directories to walk. Each is a `node_modules` root, not a package root. */
+    readonly roots: readonly string[];
+    /** Package name prefixes to consider. Empty means every package. */
+    readonly scopes?: readonly string[];
+    /** Marketplace directories, each holding .claude-plugin/marketplace.json. */
+    readonly marketplaces?: readonly string[];
+    /** Package directories read directly, for a package no node_modules links. */
+    readonly packages?: readonly string[];
+    /** Workspace roots: the root and every member its workspaces globs name. */
+    readonly workspaces?: readonly string[];
+    /** Told about every marketplace skill left out, and why. */
+    readonly onReject?: (rejection: {
+        path: string;
+        reason: string;
+    }) => void;
+    /**
+     * Told about a skill that is served but breaks the Agent Skills specification,
+     * or that lost a name collision. Loading stays lenient, as the client guide asks.
+     */
+    readonly onWarning?: (warning: {
+        path: string;
+        reason: string;
+    }) => void;
+}
+/**
+ * Directories a walk does not enter. Kept as short as the evidence allows: a
+ * name here is a package whose skill will never be found, and the cost of one
+ * extra readdir is far below the cost of missing a skill. Measured 20260906 --
+ * `lib` was on this list and hid playwright's `lib/skill/SKILL.md`, which is
+ * the most widely installed skill in the real world.
+ */
+declare const SKIPPED_DIRS: ReadonlySet<string>;
+/**
+ * How deep below a package root a SKILL.md is looked for. Three reaches every
+ * convention in use (skills, .agent/skills, .claude/skills, .gemini/skills,
+ * .codex/skills); four was measured to find nothing more.
+ */
+declare const MAX_SKILL_DEPTH = 3;
+/**
+ * Top-level scalar fields of a SKILL.md frontmatter, parsed as YAML, so a folded
+ * `description: >-` arrives as its text rather than as the indicator.
+ */
+declare function readFrontmatter(source: string): Record<string, string>;
+/** The body after the frontmatter, or the whole file when there is none. */
+declare function readBody(source: string): string;
+/**
+ * Every skill reachable from the given roots, sorted by name.
+ *
+ * A package with no skills directory contributes nothing and costs one
+ * `existsSync` per convention. A skill with no description is skipped rather
+ * than listed:
+ * `find` ranks descriptions, so one without a description can only ever be
+ * found by already knowing its name, and listing it would spend a session's
+ * tokens on an entry that cannot answer.
+ */
+declare function readCatalog(options: CatalogOptions): SkillEntry[];
+/** A catalog entry without its body, which is what `catalog` returns. */
+declare function withoutBody({ path, ...rest }: SkillEntry): Omit<SkillEntry, "path">;
+/** Path relative to a root, for a message a reader can act on. */
+declare function displayPath(root: string, entry: SkillEntry): string;
+
 /**
  * The intent key and the cache contract.
  *
@@ -56,6 +175,7 @@ interface FindResult {
  */
 interface Embedder {
     readonly modelId: string;
+    readonly indexKey?: string;
     readonly dims: number;
     /** Encodes an intent, the query side. */
     embed(text: string): Promise<Float32Array>;
@@ -421,4 +541,4 @@ declare function createSkillTools(options: SkillServerOptions): {
 };
 type SkillTools = ReturnType<typeof createSkillTools>;
 
-export { detectRuntime as A, type BundleFile as B, CATALOG_PAGE_MAX as C, DEFAULT_FIND_LIMIT as D, type Embedder as E, type FileKind as F, find as G, findResultSchema as H, type IntentCache as I, isUtf8Text as J, type KindFilter as K, lexicalScore as L, type Match as M, listSkillFiles as N, mimeOf as O, normaliseIntent as P, readSkillFile as Q, READ_BUDGET_BYTES as R, type SkillServerOptions as S, runtimeOfClient as T, verifiedRuntimesOf as U, type SkillTools as a, CATALOG_PAGE_SIZE as b, type CallResponse as c, type CatalogItem as d, type CatalogResponse as e, type Classified as f, DESCRIBE_FILE_LIMIT as g, type FindOptions as h, type FindResult as i, type IntentCacheStats as j, RUNTIMES as k, type Ranking as l, type ReadResult as m, type Runtime as n, type SkillBundle as o, type SkillFile as p, type SkillFileContent as q, type SkillFileListing as r, type SkillFilters as s, bundleResponseSchema as t, bundleSkill as u, catalogResponseSchema as v, classify as w, cosine as x, createSkillTools as y, describeResponseSchema as z };
+export { lexicalScore as $, ASSET_KINDS as A, type BundleFile as B, type CatalogOptions as C, DEFAULT_FIND_LIMIT as D, type Embedder as E, type FileKind as F, type SkillFileListing as G, type SkillFilters as H, type IntentCache as I, bundleResponseSchema as J, type KindFilter as K, bundleSkill as L, type MetadataValue as M, NAME_MAX as N, catalogResponseSchema as O, classify as P, cosine as Q, type Ranking as R, type SkillServerOptions as S, createSkillTools as T, describeResponseSchema as U, detectRuntime as V, displayPath as W, find as X, findResultSchema as Y, isUtf8Text as Z, kindOf as _, type SkillEntry as a, listSkillFiles as a0, mimeOf as a1, normaliseIntent as a2, frontmatterObject as a3, readBody as a4, readCatalog as a5, readFrontmatter as a6, readSkillFile as a7, runtimeOfClient as a8, specProblems as a9, verifiedRuntimesOf as aa, withoutBody as ab, type SkillTools as b, type AssetKind as c, CATALOG_PAGE_MAX as d, CATALOG_PAGE_SIZE as e, COMPATIBILITY_MAX as f, type CallResponse as g, type CatalogItem as h, type CatalogResponse as i, type Classified as j, DESCRIBE_FILE_LIMIT as k, DESCRIPTION_MAX as l, type FindOptions as m, type FindResult as n, type IntentCacheStats as o, MAX_SKILL_DEPTH as p, type Match as q, type MetadataLeaf as r, READ_BUDGET_BYTES as s, RUNTIMES as t, type ReadResult as u, type Runtime as v, SKIPPED_DIRS as w, type SkillBundle as x, type SkillFile as y, type SkillFileContent as z };

package/dist/service-qpCsOXkQ.d.ts

@@ -0,0 +1,116 @@
+import { z } from 'zod';
+
+declare const operationSchema: z.ZodEnum<{
+    read: "read";
+    send: "send";
+    inbox: "inbox";
+    ack: "ack";
+    sessions: "sessions";
+}>;
+type MailboxOperation = z.output<typeof operationSchema>;
+declare const sessionsSchema: z.ZodObject<{}, z.core.$strict>;
+declare const sendSchema: z.ZodObject<{
+    recipients: z.ZodArray<z.ZodObject<{
+        actorId: z.ZodString;
+        sessionId: z.ZodOptional<z.ZodUUID>;
+    }, z.core.$strict>>;
+    body: z.ZodString;
+    idempotencyKey: z.ZodString;
+    replyToId: z.ZodOptional<z.ZodUUID>;
+}, z.core.$strict>;
+declare const inboxSchema: z.ZodObject<{
+    limit: z.ZodDefault<z.ZodNumber>;
+    state: z.ZodDefault<z.ZodEnum<{
+        all: "all";
+        unread: "unread";
+        unacknowledged: "unacknowledged";
+    }>>;
+    threadId: z.ZodOptional<z.ZodUUID>;
+    cursor: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+declare const messageSchema: z.ZodObject<{
+    messageId: z.ZodUUID;
+}, z.core.$strict>;
+
+type SqlValue = string | number | null;
+type Row = Record<string, unknown>;
+interface Database {
+    exec(sql: string): void;
+    get(sql: string, ...values: SqlValue[]): Row | undefined;
+    all(sql: string, ...values: SqlValue[]): Row[];
+    run(sql: string, ...values: SqlValue[]): void;
+    close(): void;
+}
+interface ActorCredential {
+    projectId: string;
+    actorId: string;
+    secret: string;
+}
+interface Binding {
+    projectId: string;
+    actorId: string;
+    sessionId: string;
+    generation: number;
+    secret: string;
+}
+interface MailboxConfig {
+    projectId: string;
+    databasePath: string;
+    enabled: boolean;
+}
+type Result<T> = {
+    ok: true;
+    data: T;
+} | {
+    ok: false;
+    error: {
+        code: string;
+        message: string;
+        retryable: boolean;
+    };
+};
+declare class MailboxError extends Error {
+    readonly code: string;
+    readonly retryable: boolean;
+    constructor(code: string, message: string, retryable?: boolean);
+}
+declare function failure(error: unknown): Result<never>;
+
+declare const PRESENCE_TTL_MS = 120000;
+declare const HEARTBEAT_INTERVAL_MS = 30000;
+declare class MailboxStore {
+    private pending;
+    private closed;
+    readonly config: MailboxConfig;
+    readonly database: Database;
+    readonly now: () => number;
+    private constructor();
+    static open(config: MailboxConfig, now?: () => number): Promise<MailboxStore>;
+    checkSchema(): void;
+    run<T>(operation: () => T, write?: boolean): Promise<T>;
+    registerActor(actorId: string, parentActorId?: string, persist?: (credential: ActorCredential) => void, authorityTtlMs?: number, parentBinding?: Binding): Promise<ActorCredential>;
+    registerChild(parent: Binding, actorId: string, ttlMs?: number): Promise<ActorCredential>;
+    attach(credential: ActorCredential, runtime: string, replaceSessionId?: string, nativeSessionId?: string): Promise<Binding>;
+    assertBinding(binding: Binding): Row;
+    rotateActor(actorId: string, persist?: (credential: ActorCredential) => void): Promise<ActorCredential>;
+    heartbeat(binding: Binding): Promise<void>;
+    detach(binding: Binding): Promise<void>;
+    exportRecords(actorId?: string): Promise<object[]>;
+    backup(destination: string): Promise<void>;
+    close(): Promise<void>;
+}
+declare function restoreBackup(source: string, config: MailboxConfig): Promise<void>;
+
+declare class MailboxService {
+    readonly store: MailboxStore;
+    readonly binding: Binding;
+    constructor(store: MailboxStore, binding: Binding);
+    call(operation: MailboxOperation, input: unknown): Promise<Result<object>>;
+    private send;
+    private visibleMessage;
+    private inbox;
+    private receipt;
+    private sessions;
+}
+
+export { type ActorCredential as A, type Binding as B, HEARTBEAT_INTERVAL_MS as H, MailboxService as M, PRESENCE_TTL_MS as P, type Row as R, type MailboxConfig as a, MailboxStore as b, MailboxError as c, type MailboxOperation as d, type Result as e, failure as f, sessionsSchema as g, inboxSchema as i, messageSchema as m, operationSchema as o, restoreBackup as r, sendSchema as s };

package/dist/stdio.d.ts

@@ -1,5 +1,9 @@
 #!/usr/bin/env node
-import { C as CatalogOptions } from './catalog-BU5VLLyd.js';
+import { serveStdio } from '@modelcontextprotocol/server/stdio';
+import { S as SkillServerOptions, C as CatalogOptions } from './server-CwWcRjqz.js';
+import { M as MailboxService } from './service-qpCsOXkQ.js';
+import { M as MailboxAttachmentOptions } from './attachment-tU5FZrgZ.js';
+import 'zod';
 
 /**
  * The stdio entry a host launches.
@@ -11,11 +15,13 @@ import { C as CatalogOptions } from './catalog-BU5VLLyd.js';
 
 /** `node_modules` roots to walk, from argv or from the working directory. */
 declare function resolveRoots(argv: readonly string[], cwd: string): string[];
-interface ServeOptions {
+interface ServeOptions extends Pick<SkillServerOptions, "embedder" | "vectors" | "loadCatalog"> {
+    readonly mailbox?: MailboxService;
     /** One prompt per skill, for hosts that offer prompts as commands. */
     readonly prompts?: boolean;
 }
-declare function serve(catalog: CatalogOptions, serving?: ServeOptions): void;
+declare function serve(catalog: CatalogOptions, serving?: ServeOptions): ReturnType<typeof serveStdio>;
+declare function serveWithMailbox(catalog: CatalogOptions, mailbox: MailboxAttachmentOptions, serving?: ServeOptions): Promise<() => Promise<void>>;
 declare function main(argv?: readonly string[]): void;
 
-export { type ServeOptions, main, resolveRoots, serve };
+export { type ServeOptions, main, resolveRoots, serve, serveWithMailbox };