@okrlinkhub/agent-factory 2.0.3 → 3.0.0

package/dist/component/queue.js

@@ -138,7 +138,6 @@ const globalSkillManifestItemValidator = v.object({
     version: v.string(),
     moduleFormat: globalSkillModuleFormatValidator,
     entryPoint: v.string(),
-    sourceJs: v.string(),
     sha256: v.string(),
     skillDirName: v.string(),
     files: v.array(globalSkillManifestFileValidator),
@@ -587,7 +586,7 @@ export const deployGlobalSkill = mutation({
         displayName: v.optional(v.string()),
         description: v.optional(v.string()),
         version: v.string(),
-        sourceJs: v.string(),
+        files: v.array(globalSkillManifestFileValidator),
         entryPoint: v.optional(v.string()),
         moduleFormat: v.optional(globalSkillModuleFormatValidator),
         releaseChannel: v.optional(globalSkillReleaseChannelValidator),
@@ -611,23 +610,17 @@ export const deployGlobalSkill = mutation({
         const releaseChannel = args.releaseChannel ?? "stable";
         const moduleFormat = args.moduleFormat ?? "esm";
         const actor = args.actor?.trim() || "system";
-        const sourceJs = args.sourceJs.trim();
+        const files = await normalizeGlobalSkillBundleFiles(args.files, moduleFormat);
         if (!/^[a-z0-9][a-z0-9-_]{1,127}$/.test(slug)) {
             throw new Error("Invalid skill slug. Use lowercase letters, numbers, '-' and '_'.");
         }
         if (!/^\d+\.\d+\.\d+(?:[-+][A-Za-z0-9.-]+)?$/.test(version)) {
             throw new Error("Invalid skill version. Use semantic versioning format.");
         }
-        if (sourceJs.length < 16) {
-            throw new Error("Skill source is too short.");
-        }
-        if (sourceJs.length > 200_000) {
-            throw new Error("Skill source too large (max 200KB).");
-        }
         if (!entryPoint) {
             throw new Error("entryPoint is required.");
         }
-        const sha256 = await computeSha256Hex(sourceJs);
+        const sha256 = await computeGlobalSkillBundleSha256(files);
         const existingSkill = await ctx.db
             .query("globalSkills")
             .withIndex("by_slug", (q) => q.eq("slug", slug))
@@ -663,14 +656,16 @@ export const deployGlobalSkill = mutation({
                 version,
                 moduleFormat,
                 entryPoint,
-                sourceJs,
+                files,
                 sha256,
                 createdBy: actor,
                 createdAt: nowMs,
             });
         }
-        else if (existingVersion.sha256 !== sha256) {
-            throw new Error(`Skill ${slug}@${version} already exists with a different source.`);
+        else if (existingVersion.sha256 !== sha256 ||
+            existingVersion.moduleFormat !== moduleFormat ||
+            existingVersion.entryPoint !== entryPoint) {
+            throw new Error(`Skill ${slug}@${version} already exists with a different bundle.`);
         }
         const activeReleases = await ctx.db
             .query("globalSkillReleases")
@@ -805,7 +800,7 @@ export const getWorkerGlobalSkillsManifest = query({
                 version: version.version,
                 moduleFormat: version.moduleFormat,
                 entryPoint: version.entryPoint,
-                sourceJs: version.sourceJs,
+                files: version.files,
                 sha256: version.sha256,
             });
             manifestSkills.push({
@@ -813,7 +808,6 @@ export const getWorkerGlobalSkillsManifest = query({
                 version: version.version,
                 moduleFormat: version.moduleFormat,
                 entryPoint: version.entryPoint,
-                sourceJs: version.sourceJs,
                 sha256: version.sha256,
                 skillDirName: materializedSkill.skillDirName,
                 files: materializedSkill.files,
@@ -825,7 +819,11 @@ export const getWorkerGlobalSkillsManifest = query({
             return a.version.localeCompare(b.version);
         });
         const fingerprintSeed = manifestSkills
-            .map((row) => `${row.slug}@${row.version}:${row.sha256}`)
+            .map((row) => `${row.slug}@${row.version}:${row.sha256}:${row.files
+            .filter((file) => file.path !== ".af-global-skill.json")
+            .map((file) => `${file.path}:${file.sha256}`)
+            .sort()
+            .join(",")}`)
             .join("|");
         const manifestVersion = await computeSha256Hex(fingerprintSeed || "empty");
         return {
@@ -2632,26 +2630,11 @@ function inferMimeTypeFromFilePath(filePath) {
 }
 async function buildGlobalSkillMaterialization(skill) {
     const skillDirName = normalizeGlobalSkillDirName(skill.slug);
-    const scriptExt = skill.moduleFormat === "cjs" ? "cjs" : "mjs";
-    const scriptRelativePath = `scripts/index.${scriptExt}`;
-    const skillMd = [
-        "---",
-        `name: ${skill.slug}`,
-        `description: Global skill ${skill.slug}@${skill.version} provisioned by agent-factory.`,
-        "---",
-        "",
-        "# Global Skill",
-        "",
-        "This skill is generated automatically from agent-factory globalSkills.",
-        "",
-        `- slug: ${skill.slug}`,
-        `- version: ${skill.version}`,
-        `- entryPoint: ${skill.entryPoint}`,
-        `- moduleFormat: ${skill.moduleFormat}`,
-        "",
-        "Do not edit manually.",
-        "",
-    ].join("\n");
+    const bundleFiles = await normalizeGlobalSkillBundleFiles(skill.files, skill.moduleFormat);
+    const bundleSha256 = await computeGlobalSkillBundleSha256(bundleFiles);
+    if (bundleSha256 !== skill.sha256) {
+        throw new Error(`Global skill bundle checksum mismatch for ${skill.slug}@${skill.version}.`);
+    }
     const markerJson = `${JSON.stringify({
         slug: skill.slug,
         version: skill.version,
@@ -2659,19 +2642,9 @@ async function buildGlobalSkillMaterialization(skill) {
         managedBy: "agent-factory",
         entryPoint: skill.entryPoint,
         moduleFormat: skill.moduleFormat,
-        generatedAt: Date.now(),
     }, null, 2)}\n`;
     const files = [
-        {
-            path: "SKILL.md",
-            content: `${skillMd}\n`,
-            sha256: await computeSha256Hex(`${skillMd}\n`),
-        },
-        {
-            path: scriptRelativePath,
-            content: `${skill.sourceJs.trimEnd()}\n`,
-            sha256: await computeSha256Hex(`${skill.sourceJs.trimEnd()}\n`),
-        },
+        ...bundleFiles,
         {
             path: ".af-global-skill.json",
             content: markerJson,
@@ -2680,10 +2653,61 @@ async function buildGlobalSkillMaterialization(skill) {
     ];
     return { skillDirName, files };
 }
+async function normalizeGlobalSkillBundleFiles(rawFiles, moduleFormat) {
+    if (!Array.isArray(rawFiles) || rawFiles.length === 0) {
+        throw new Error("Global skill bundle must contain at least one file.");
+    }
+    const byPath = new Map();
+    let totalBytes = 0;
+    for (const rawFile of rawFiles) {
+        const path = normalizeRelativePath(rawFile.path);
+        if (path === ".af-global-skill.json") {
+            throw new Error("Bundle files must not include .af-global-skill.json.");
+        }
+        if (byPath.has(path)) {
+            throw new Error(`Duplicate bundle file path: ${path}`);
+        }
+        const content = typeof rawFile.content === "string" ? rawFile.content : "";
+        totalBytes += new TextEncoder().encode(content).length;
+        if (totalBytes > 200_000) {
+            throw new Error("Global skill bundle too large (max 200KB).");
+        }
+        const sha256 = typeof rawFile.sha256 === "string" ? rawFile.sha256.trim() : "";
+        if (!sha256) {
+            throw new Error(`Missing bundle checksum for ${path}.`);
+        }
+        const computedSha = await computeSha256Hex(content);
+        if (computedSha !== sha256) {
+            throw new Error(`Global skill checksum mismatch for ${path}.`);
+        }
+        byPath.set(path, { path, content, sha256 });
+    }
+    const entryScriptPath = `scripts/index.${moduleFormat === "cjs" ? "cjs" : "mjs"}`;
+    if (!byPath.has("SKILL.md")) {
+        throw new Error("Global skill bundle must include SKILL.md.");
+    }
+    if (!byPath.has(entryScriptPath)) {
+        throw new Error(`Global skill bundle must include ${entryScriptPath}.`);
+    }
+    return [...byPath.values()].sort((left, right) => left.path.localeCompare(right.path));
+}
+async function computeGlobalSkillBundleSha256(files) {
+    const fingerprint = files
+        .map((file) => `${file.path}\n${file.sha256}\n${file.content}`)
+        .join("\n---\n");
+    return await computeSha256Hex(fingerprint);
+}
 function normalizeGlobalSkillDirName(slug) {
     const normalized = slug.trim().toLowerCase().replace(/[^a-z0-9-_]/g, "-");
     return normalized.length > 0 ? normalized : "unnamed-skill";
 }
+function normalizeRelativePath(value) {
+    const normalized = String(value || "").replaceAll("\\", "/").replace(/^\/+/, "");
+    if (!normalized || normalized === "." || normalized.includes("../")) {
+        throw new Error(`invalid_relative_path:${value}`);
+    }
+    return normalized;
+}
 function getBridgeSecretRefsForProfile(agentKey, bridgeConfig) {
     if (!bridgeConfig?.enabled) {
         return [];