@mulmoclaude/core 4.4.2 → 4.6.0

package/dist/{server-BvXO49Vj.js → server-DyYwfNB6.js}

@@ -1,9 +1,9 @@
 import { a as isErrorWithCode, c as isStringArray, l as isUnknownArray, s as isRecord, t as errorMessage } from "./dist-D8zokgGo.js";
-import { n as writeFileAtomic } from "./root-BMroU_mB.js";
+import { n as writeFileAtomic } from "./root-BcS4-Kge.js";
 import { n as toPosixRelPath } from "./relPath-DW8MC8VO.js";
-import { B as COMPUTED_TYPES, J as fieldTextOrNull, K as storageKindFor, U as embedTargetId, W as isFieldDrivenEvery, d as parseIsoDate, f as parseIsoDateTime, q as fieldText, x as isCanonicalServerTime } from "./itemId-BY2YPBkT.js";
-import { C as actionVisible, O as firstUnknownDefault, _ as uniqueRefTargets, b as projectBacklinkRow, c as selectDynamicRecord, f as itemIsDone, g as uniqueEmbedTargets, h as uniqueBacklinkSources, i as ownProp, k as schemaDefaults, n as deriveAll, o as firstDateField, s as resolveIcon, t as defangForPrompt, v as backlinkRows, x as rollupValue, y as coerceNumeric } from "./promptSafety-Bp780ezk.js";
-import { B as SCHEMA_FILE$1, C as CollectionQueryZ, J as isBackendUnavailable, K as safeSlugName, O as isRegularFile, S as compileJsonlQuery, U as resolveDataDir, V as isContainedInRoot, W as resolveTemplatePath, X as archiveDir, b as queryCsv, c as resolveMutateSet, d as storeFor, f as checkpointSqliteDatabase, ht as stagingSkillDir, i as resolvePrimaryField, it as isPresetSlug$1, j as resolveCreateItemId, m as cacheDir, n as discoverCollections, nt as getWorkspaceRoot, ot as log, r as loadCollection, s as CollectionSchemaZ, u as readOnlyRefusal, y as normalizeCsvValue } from "./discovery-P64fgtuD.js";
+import { K as embedTargetId, U as COMPUTED_TYPES, X as fieldText, Y as storageKindFor, Z as fieldTextOrNull, d as parseIsoDate, f as parseIsoDateTime, q as isFieldDrivenEvery, w as isCanonicalServerTime } from "./itemId-4P9S_ehz.js";
+import { C as actionVisible, O as firstUnknownDefault, _ as uniqueRefTargets, b as projectBacklinkRow, c as selectDynamicRecord, f as itemIsDone, g as uniqueEmbedTargets, h as uniqueBacklinkSources, i as ownProp, k as schemaDefaults, n as deriveAll, o as firstDateField, s as resolveIcon, t as defangForPrompt, v as backlinkRows, x as rollupValue, y as coerceNumeric } from "./promptSafety-Bte62OvU.js";
+import { B as SCHEMA_FILE$1, C as CollectionQueryZ, G as resolveTemplatePath, H as isUnderRealRoot, O as isRegularFile, S as compileJsonlQuery, V as isContainedInRoot, W as resolveDataDir, Y as isBackendUnavailable, Z as archiveDir, at as isPresetSlug$1, b as queryCsv, c as resolveMutateSet, d as storeFor, f as checkpointSqliteDatabase, gt as stagingSkillDir, i as resolvePrimaryField, j as resolveCreateItemId, m as cacheDir, n as discoverCollections, q as safeSlugName, r as loadCollection, rt as getWorkspaceRoot, s as CollectionSchemaZ, st as log, u as readOnlyRefusal, y as normalizeCsvValue } from "./discovery-BY-nMCuh.js";
 import { ingestStatePath } from "./feeds/paths.js";
 import { mirrorSkillWrite } from "./skill-bridge/index.js";
 import { constants } from "node:fs";
@@ -31,27 +31,78 @@ import { z } from "zod";
 async function readCustomViewHtml(collection, viewFile, opts = {}) {
 	return readSourceAwareFile(collection, viewFile, opts);
 }
-/** Internal helper: read a file using the same source-aware base fallback as
-*  `readCustomViewHtml`. Used by both `readCustomViewHtml` and
-*  `readCustomViewI18n` so the two stay in lockstep. */
-async function readSourceAwareFile(collection, relPath, opts) {
-	const safeSlug = safeSlugName(collection.slug);
-	if (safeSlug === null) return null;
-	const workspaceRoot = opts.workspaceRoot ?? getWorkspaceRoot();
-	const staging = collection.source === "project" ? stagingSkillDir(workspaceRoot, safeSlug) : null;
-	const bases = staging === null ? [collection.skillDir] : [staging, collection.skillDir];
+/** `<staging>/<slug>` when THAT slug is actually staged there, else null.
+*
+*  `stagingSkillDir` only says whether the ROOT has a staging tree, and then
+*  joins the slug — so on its own it claims every collection in a staged
+*  workspace is staged. That is wrong for the two layouts that coexist there:
+*  a collection IMPORTED via the discover panel, and one committed directly
+*  under `.claude/skills/`, neither of which has a staging copy. A stale
+*  `data/skills/<slug>/views/x.html` left beside them then SHADOWED the real
+*  view on every read (#3031).
+*
+*  The evidence is the slug's own `schema.json`, because that is what the
+*  authoring layout actually produces — `putSchema` writes it, and the delete
+*  path below has always keyed on it. It must be a REGULAR FILE — `lstat`, not
+*  `stat` — so a symlink standing in for the schema is not evidence.
+*
+*  Exported so the DELETE path uses this exact function rather than a second
+*  copy of the expression: "reads and deletes agree" is a claim `views.ts` has
+*  made in its comments since #1836, and sharing the predicate is what makes
+*  it structurally true instead of a convention two files have to remember. */
+async function stagedSkillDir(workspaceRoot, safeSlug) {
+	const staging = stagingSkillDir(workspaceRoot, safeSlug);
+	if (staging === null) return null;
+	return await isStagedSchema(path.join(staging, "schema.json")) ? staging : null;
+}
+/** Is the staged `schema.json` there, as a regular file?
+*
+*  NOT `isRegularFile` from `io.ts`, which answers `false` for every `lstat`
+*  failure. Here "no schema" and "the schema could not be inspected" must not
+*  collapse into one answer: the second would quietly downgrade a staged slug
+*  to unstaged and serve the OTHER base's copy — the same masking the read loop
+*  below refuses, and for the same reason (Sourcery review on #3032). Only the
+*  missing-here codes mean "not staged"; anything else propagates. */
+async function isStagedSchema(target) {
+	try {
+		return (await lstat(target)).isFile();
+	} catch (err) {
+		if (!isMissingHere(err)) throw err;
+		return false;
+	}
+}
+/** The two codes that mean "not at this path" rather than "this path failed".
+*  A permission denial / disk error must propagate — silently treating it as
+*  absent masks a real failure as a stale-from-another-base success or a
+*  misleading 404 (CodeRabbit review on #1836). */
+function isMissingHere(err) {
+	return isErrorWithCode(err) && (err.code === "ENOENT" || err.code === "ENOTDIR");
+}
+/** Read `relPath` from the first base that holds it, or null when none does.
+*  Bases are tried in order and each is containment-checked on its own, so the
+*  fallback never widens what a single base would have allowed. */
+async function readFromBases(bases, relPath) {
 	for (const base of bases) {
 		const resolved = resolveTemplatePath(base, relPath);
 		if (resolved === null) continue;
 		try {
 			return await readFile(resolved, "utf-8");
 		} catch (err) {
-			if (!isErrorWithCode(err)) throw err;
-			if (err.code !== "ENOENT" && err.code !== "ENOTDIR") throw err;
+			if (!isMissingHere(err)) throw err;
 		}
 	}
 	return null;
 }
+/** Internal helper: read a file using the same source-aware base fallback as
+*  `readCustomViewHtml`. Used by both `readCustomViewHtml` and
+*  `readCustomViewI18n` so the two stay in lockstep. */
+async function readSourceAwareFile(collection, relPath, opts) {
+	const safeSlug = safeSlugName(collection.slug);
+	if (safeSlug === null) return null;
+	const workspaceRoot = opts.workspaceRoot ?? getWorkspaceRoot();
+	const staging = collection.source === "project" ? await stagedSkillDir(workspaceRoot, safeSlug) : null;
+	return readFromBases(staging === null ? [collection.skillDir] : [staging, collection.skillDir], relPath);
+}
 var I18N_FALLBACK_LOCALE = "en";
 var EMPTY_I18N = {
 	locale: "",
@@ -1265,27 +1316,20 @@ async function deleteCollection(collection, opts = {}) {
 }
 //#endregion
 //#region src/collection/server/views.ts
-async function fileExists(target) {
-	try {
-		await stat(target);
-		return true;
-	} catch (err) {
-		if (!isErrorWithCode(err)) throw err;
-		if (err.code === "ENOENT" || err.code === "ENOTDIR") return false;
-		throw err;
-	}
-}
 /** The authoritative base dir for a collection's schema.json + view HTML.
 *  For a project collection, prefer the staging tree when its schema.json is
 *  present (authoring layout); otherwise fall back to the active skill dir
 *  (imported layout — staging never materialised). For feed / user, it's
-*  always the discovered skillDir. Matches `readCustomViewHtml` so reads and
-*  deletes agree on both layouts. */
+*  always the discovered skillDir.
+*
+*  Matches `readCustomViewHtml` so reads and deletes agree on both layouts —
+*  through the SAME function now (`stagedSkillDir`), not through two copies of
+*  one expression. The read side had drifted off it and was preferring staging
+*  per root rather than per slug (#3031), which is precisely the drift a shared
+*  predicate makes unrepresentable. */
 async function canonicalBase(collection, workspaceRoot, safeSlug) {
 	if (collection.source !== "project") return collection.skillDir;
-	const staging = stagingSkillDir(workspaceRoot, safeSlug);
-	if (staging !== null && await fileExists(path.join(staging, "schema.json"))) return staging;
-	return collection.skillDir;
+	return await stagedSkillDir(workspaceRoot, safeSlug) ?? collection.skillDir;
 }
 /** Every on-disk schema.json that must reflect the removal. The active
 *  `<skillDir>/schema.json` is the discovery anchor and is always present.
@@ -1295,9 +1339,9 @@ async function canonicalBase(collection, workspaceRoot, safeSlug) {
 async function schemaWriteTargets(collection, workspaceRoot, safeSlug) {
 	const active = path.join(collection.skillDir, SCHEMA_FILE$1);
 	if (collection.source !== "project") return [active];
-	const staging = stagingSkillDir(workspaceRoot, safeSlug);
+	const staging = await stagedSkillDir(workspaceRoot, safeSlug);
 	const targets = [];
-	if (staging !== null && await fileExists(path.join(staging, "schema.json"))) targets.push(path.join(staging, SCHEMA_FILE$1));
+	if (staging !== null) targets.push(path.join(staging, SCHEMA_FILE$1));
 	targets.push(active);
 	return targets;
 }
@@ -1876,24 +1920,53 @@ function openItemsFileRefusal(err, shown) {
 *  descriptor's inode is the one reachable at a contained path. A hardlink
 *  would satisfy it, but the agent cannot create one across the mount boundary
 *  — only the workspace is mounted, and a hardlink cannot cross filesystems. */
-async function verifyOpenedItemsFile(handle, hostPath, root, shown) {
-	const opened = await handle.stat();
+/** What the filesystem says about the path the descriptor was opened from:
+*  the link itself (is it a symlink?), the resolved target, the root resolved
+*  BY THE SAME API, and the target's stat.
+*
+*  Resolving the two sides with different apis is not a style question: on
+*  Windows `realpath` expands an 8.3 short name and `realpathSync` does not, so
+*  a root from `os.tmpdir()` compared against an async-resolved file inside it
+*  read as "outside the workspace" and refused every itemsFile (#2972). */
+async function resolveOpenedPaths(hostPath, root) {
+	const link = await lstat(hostPath);
+	const real = await realpath(hostPath);
+	return {
+		link,
+		real,
+		rootReal: await realpath(root),
+		atPath: await stat(real)
+	};
+}
+/** Judge the opened descriptor against the paths it claims to be. Returns the
+*  refusal text, or null when the descriptor is the contained file it should
+*  be. `opened` is the descriptor's own stat, so the identity check compares
+*  what was OPENED with what is reachable at the path. */
+function openedFileProblem(paths, opened, shown) {
+	if (paths.link.isSymbolicLink()) return symlinkRefusal(shown);
+	if (!isUnderRealRoot(paths.real, paths.rootReal)) return outsideWorkspaceRefusal(shown);
+	if (paths.atPath.ino !== opened.ino || paths.atPath.dev !== opened.dev) return `manageCollection: \`itemsFile\` '${shown}' changed while it was being opened. Nothing was read; write the file, then call putItems.`;
+	return null;
+}
+/** The descriptor's own shape: a regular file, within the byte cap. Returns the
+*  refusal text, or null. Checked before any path work — a fifo or an 8 MiB
+*  blob is refused without paying for a realpath. */
+function openedShapeProblem(opened, shown) {
 	if (!opened.isFile()) return `manageCollection: \`itemsFile\` '${shown}' is not a regular file. It must be a JSON file holding an array of record objects.`;
 	if (opened.size > 8388608) return `manageCollection: \`itemsFile\` '${shown}' is ${opened.size} bytes, over the limit of ${MAX_ITEMS_FILE_BYTES}. Nothing was read; split the rows across several files and call once per file.`;
-	let real;
-	let atPath;
-	let link;
+	return null;
+}
+async function verifyOpenedItemsFile(handle, hostPath, root, shown) {
+	const opened = await handle.stat();
+	const shapeProblem = openedShapeProblem(opened, shown);
+	if (shapeProblem !== null) return shapeProblem;
+	let paths;
 	try {
-		link = await lstat(hostPath);
-		real = await realpath(hostPath);
-		atPath = await stat(real);
+		paths = await resolveOpenedPaths(hostPath, root);
 	} catch (err) {
 		return openItemsFileRefusal(err, shown);
 	}
-	if (link.isSymbolicLink()) return symlinkRefusal(shown);
-	if (!isContainedInRoot(real, root)) return outsideWorkspaceRefusal(shown);
-	if (atPath.ino !== opened.ino || atPath.dev !== opened.dev) return `manageCollection: \`itemsFile\` '${shown}' changed while it was being opened. Nothing was read; write the file, then call putItems.`;
-	return { size: opened.size };
+	return openedFileProblem(paths, opened, shown) ?? { size: opened.size };
 }
 /** Open the file ONCE, then prove that descriptor is the contained file.
 *  `O_NOFOLLOW` refuses a symlink outright rather than resolving it, and
@@ -2333,7 +2406,7 @@ var MANAGE_COLLECTION_DEFINITION = {
 			},
 			schema: {
 				type: "object",
-				description: "putSchema: the full collection schema object (same shape as schema.json — title, icon, dataPath, primaryKey, fields, …). Call getSchema first for the current one, and schemaDocs for the field DSL."
+				description: "putSchema: the full collection schema object (same shape as schema.json — title, icon, dataPath, primaryKey, fields, …). `icon` is either a Material Symbols name (lowercase letters, digits and underscores only — `podcasts`, `rss_feed`, `3d_rotation`; capitals/spaces/hyphens never match) or a SINGLE emoji. Prefer an emoji when the collection would otherwise share a look-alike glyph with another one — it is in colour and tells them apart in the launcher. `color` is an OPTIONAL accent (violet | indigo | sky | teal | emerald | lime | fuchsia) drawn as a pale chip behind the launcher glyph — another way to separate collections that share a generic icon. Omit it rather than guessing; an unknown name simply draws no accent. Call getSchema first for the current one, and schemaDocs for the field DSL."
 			},
 			topic: {
 				type: "string",
@@ -2356,6 +2429,6 @@ function makeManageCollectionTool(deps = {}) {
 	};
 }
 //#endregion
-export { recordFieldProblem as A, applyMutateAction as C, validateCollectionRecords as D, STORE_UNREADABLE as E, buildCollectionActionSeedPrompt as F, promptPathsFor as I, readCustomViewHtml as L, enrichItems as M, runQueryOverRows as N, validateRecordObject as O, buildActionSeedPrompt as P, readCustomViewI18n as R, schemaRelations as S, MAX_RECORD_ISSUES as T, resolveEvery as _, MAX_UNSELECTIVE_ITEMS as a, computeCollectionIcon as b, deleteCollection as c, computeSuccessor as d, daysInMonth as f, parseCivil as g, maybeSpawnSuccessor as h, MAX_SCHEMA_ISSUES as i, runCollectionQuery as j, compileRecordZ as k, deleteCollectionRefusalMessage as l, isTriggerDue as m, MAX_PUT_ITEMS as n, makeManageCollectionTool as o, formatCivil as p, MAX_PUT_LINT as r, deleteCustomView as s, MAX_ITEMS_FILE_BYTES as t, advanceTriggerDate as u, successorId as v, firstMutateParamProblem as w, buildWorkspaceOntology as x, ONE_SECOND_MS as y, readSkillTemplate as z };
+export { recordFieldProblem as A, stagedSkillDir as B, applyMutateAction as C, validateCollectionRecords as D, STORE_UNREADABLE as E, buildCollectionActionSeedPrompt as F, promptPathsFor as I, readCustomViewHtml as L, enrichItems as M, runQueryOverRows as N, validateRecordObject as O, buildActionSeedPrompt as P, readCustomViewI18n as R, schemaRelations as S, MAX_RECORD_ISSUES as T, resolveEvery as _, MAX_UNSELECTIVE_ITEMS as a, computeCollectionIcon as b, deleteCollection as c, computeSuccessor as d, daysInMonth as f, parseCivil as g, maybeSpawnSuccessor as h, MAX_SCHEMA_ISSUES as i, runCollectionQuery as j, compileRecordZ as k, deleteCollectionRefusalMessage as l, isTriggerDue as m, MAX_PUT_ITEMS as n, makeManageCollectionTool as o, formatCivil as p, MAX_PUT_LINT as r, deleteCustomView as s, MAX_ITEMS_FILE_BYTES as t, advanceTriggerDate as u, successorId as v, firstMutateParamProblem as w, buildWorkspaceOntology as x, ONE_SECOND_MS as y, readSkillTemplate as z };
 
-//# sourceMappingURL=server-BvXO49Vj.js.map
+//# sourceMappingURL=server-DyYwfNB6.js.map