@opengeni/core 2.9.4-canary.0 → 2.9.4-canary.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/core",
-  "version": "2.9.4-canary.0",
+  "version": "2.9.4-canary.2",
   "description": "OpenGeni framework-agnostic core: the domain, access, and billing layers (neutral access, off-HTTP V2 surface). Behavior-preserving extraction from apps/api — keeps Hono's HTTPException for error throwing (typed-errors cleanup deferred).",
   "license": "Apache-2.0",
   "repository": {
@@ -58,17 +58,17 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opengeni/capabilities": "^0.3.3-canary.8",
-    "@opengeni/codex": "^0.2.22-canary.8",
-    "@opengeni/config": "^1.1.2-canary.0",
-    "@opengeni/contracts": "^3.0.2-canary.0",
-    "@opengeni/db": "^4.3.3-canary.0",
-    "@opengeni/documents": "^0.8.27-canary.0",
-    "@opengeni/events": "^0.4.25-canary.0",
-    "@opengeni/network": "^0.3.1-canary.8",
-    "@opengeni/observability": "^0.8.26-canary.0",
-    "@opengeni/runtime": "^2.5.3-canary.0",
-    "@opengeni/storage": "^0.2.127-canary.0",
+    "@opengeni/capabilities": "^0.3.3-canary.10",
+    "@opengeni/codex": "^0.2.22-canary.10",
+    "@opengeni/config": "^1.1.2-canary.2",
+    "@opengeni/contracts": "^3.0.2-canary.2",
+    "@opengeni/db": "^4.3.3-canary.2",
+    "@opengeni/documents": "^0.8.27-canary.2",
+    "@opengeni/events": "^0.4.25-canary.2",
+    "@opengeni/network": "^0.3.1-canary.10",
+    "@opengeni/observability": "^0.8.26-canary.2",
+    "@opengeni/runtime": "^2.5.3-canary.2",
+    "@opengeni/storage": "^0.2.127-canary.2",
     "hono": "^4.12.18",
     "zod": "^4.2.1"
   },

package/src/domain/capabilities.ts

@@ -123,7 +123,7 @@ export async function buildCapabilityCatalog(input: {
     ...configuredMcpCatalogItems(input.settings),
     ...providerIntegrationCatalogItems(socialConnections),
     fikenCatalogItem(workspaceConnections.filter(isFikenConnection)),
-    ...curatedLibrarySkills,
+    ...curatedLibrarySkills.filter((item) => installedSkillById.has(item.id)),
     ...installedSkills
       .filter(
         (skill) =>
@@ -980,9 +980,6 @@ export async function discoverMcpRegistryCapabilities(input: {
       if (!item || seen.has(item.id)) {
         continue;
       }
-      if (query && !catalogSearchText(item).includes(query)) {
-        continue;
-      }
       seen.add(item.id);
       items.push(item);
       if (items.length >= limit) {
@@ -990,7 +987,9 @@ export async function discoverMcpRegistryCapabilities(input: {
       }
     }
     cursor = typeof page.metadata?.nextCursor === "string" ? page.metadata.nextCursor : undefined;
-    if (!cursor) {
+    // Return usable results promptly rather than fetching more pages merely
+    // to fill the requested limit. The registry already applies the search.
+    if (items.length > 0 || !cursor) {
       break;
     }
   }
@@ -1996,22 +1995,6 @@ function validUrl(value: string | undefined): string | null {
   }
 }
 
-function catalogSearchText(item: CapabilityCatalogItem): string {
-  return [
-    item.name,
-    item.description,
-    item.category,
-    ...item.tags,
-    item.endpointUrl,
-    item.homepageUrl,
-    item.installUrl,
-    JSON.stringify(item.metadata),
-  ]
-    .filter(Boolean)
-    .join(" ")
-    .toLowerCase();
-}
-
 function capabilityInstallationRuntimeReady(
   item: CapabilityCatalogItem,
   installation: CapabilityInstallation | undefined,

package/src/domain/github-skill-source.ts

@@ -1,6 +1,12 @@
 import type { Settings } from "@opengeni/config";
+import { HTTPException } from "hono/http-exception";
 import type { GitHubSkillSourceClient, GitHubSkillTreeEntry } from "./skill-imports";
 import { pinnedFetch, readResponseJsonBounded, readResponseTextBounded } from "@opengeni/network";
+import {
+  PORTABLE_SKILL_MAX_FILES,
+  PORTABLE_SKILL_MAX_TOTAL_BYTES,
+  type SkillLibraryFile,
+} from "@opengeni/runtime/skill-library";
 
 const githubApiBase = "https://api.github.com";
 const githubRequestTimeoutMs = 15_000;
@@ -14,7 +20,32 @@ export function createGitHubSkillSourceClient(
   requestJson: GitHubJsonRequest = (path, maxBytes, label) =>
     githubJson(settings, path, maxBytes, label),
 ): GitHubSkillSourceClient {
+  const readJson = requestJson;
+  const cache = new Map<string, { expires: number; payload: unknown }>();
+  const pending = new Map<string, Promise<unknown>>();
+  requestJson = async (path, maxBytes, label) => {
+    const cached = cache.get(path);
+    if (cached && cached.expires > Date.now()) return cached.payload;
+    const existing = pending.get(path);
+    if (existing) return existing;
+    const task = readJson(path, maxBytes, label).then((payload) => {
+      if (cache.size >= 128) cache.delete(cache.keys().next().value!);
+      cache.set(path, {
+        payload,
+        expires: Date.now() + (path.includes("/commits/") ? 60_000 : 3_600_000),
+      });
+      return payload;
+    });
+    pending.set(path, task);
+    try {
+      return await task;
+    } finally {
+      pending.delete(path);
+    }
+  };
   return {
+    downloadSnapshot: (owner, repository, slug) =>
+      downloadSkillSnapshot(settings, owner, repository, slug),
     resolveCommit: async (owner, repository, ref) => {
       const payload = recordValue(
         await requestJson(
@@ -91,6 +122,61 @@ export function createGitHubSkillSourceClient(
   };
 }
 
+async function downloadSkillSnapshot(
+  settings: Settings,
+  owner: string,
+  repository: string,
+  slug: string,
+): Promise<readonly SkillLibraryFile[]> {
+  const signal = AbortSignal.timeout(githubRequestTimeoutMs);
+  const response = await pinnedFetch(
+    `https://skills.sh/api/download/${[owner, repository, slug].map(encodeURIComponent).join("/")}`,
+    { headers: { accept: "application/json" }, credentials: "omit", redirect: "manual", signal },
+    settings,
+    { label: "Skill download", requireHttpsOutsideLocalTest: true },
+  );
+  if (!response.ok) {
+    await response.body?.cancel();
+    throw new HTTPException(response.status === 429 ? 429 : 422, {
+      message:
+        response.status === 429
+          ? "skills.sh is busy. Try again shortly."
+          : response.status === 404
+            ? "This skill has no downloadable snapshot. Import its GitHub folder URL instead."
+            : "Could not download this skill from skills.sh. Try again shortly.",
+    });
+  }
+  // JSON escaping may expand the text payload. Artifact validation below applies
+  // the stricter limits to decoded files, paths, and total content size.
+  const payload = recordValue(
+    await readResponseJsonBounded(
+      response,
+      PORTABLE_SKILL_MAX_TOTAL_BYTES * 6 + 128_000,
+      "Skill download",
+      { signal },
+    ),
+    "Skill download",
+  );
+  if (
+    !Array.isArray(payload.files) ||
+    payload.files.length === 0 ||
+    payload.files.length > PORTABLE_SKILL_MAX_FILES
+  ) {
+    throw new HTTPException(422, { message: "The downloaded skill has an invalid file list" });
+  }
+  return payload.files.map((file) => {
+    if (
+      !file ||
+      typeof file !== "object" ||
+      typeof file.path !== "string" ||
+      typeof file.contents !== "string"
+    ) {
+      throw new HTTPException(422, { message: "The downloaded skill contains an invalid file" });
+    }
+    return { path: file.path, content: file.contents };
+  });
+}
+
 async function githubJson(
   settings: Settings,
   path: string,
@@ -118,7 +204,10 @@ async function githubJson(
       await readResponseTextBounded(response, 8_192, `${label} error`).catch(() => undefined);
       if (response.status === 404) throw new Error(`${label} was not found or is not public`);
       if (response.status === 403 || response.status === 429) {
-        throw new Error(`${label} is temporarily unavailable because GitHub limited the request`);
+        throw new HTTPException(429, {
+          message:
+            "GitHub's public request limit has been reached. Skill search is still available; try previewing again after the limit resets.",
+        });
       }
       throw new Error(`${label} failed with HTTP ${response.status}`);
     }

package/src/domain/skill-imports.ts

@@ -19,6 +19,11 @@ export type GitHubSkillTreeEntry = Readonly<{
 }>;
 
 export type GitHubSkillSourceClient = Readonly<{
+  downloadSnapshot?(
+    owner: string,
+    repository: string,
+    slug: string,
+  ): Promise<readonly SkillLibraryFile[]>;
   resolveCommit(owner: string, repository: string, ref: string): Promise<string>;
   listTree(
     owner: string,
@@ -52,6 +57,10 @@ export async function resolveSkillImport(
   client: GitHubSkillSourceClient,
 ): Promise<ResolvedSkillImport> {
   const parsed = parseSkillSource(rawUrl);
+  if (parsed.source === "skills_sh" && client.downloadSnapshot) {
+    const files = await client.downloadSnapshot(parsed.owner, parsed.repository, parsed.skillSlug!);
+    return buildResolvedImport(parsed, files, parsed.skillSlug!, null);
+  }
   const sourceCommit = await client.resolveCommit(parsed.owner, parsed.repository, parsed.ref);
   if (!gitCommit.test(sourceCommit)) {
     throw new HTTPException(422, { message: "GitHub returned an invalid source commit" });
@@ -94,6 +103,15 @@ export async function resolveSkillImport(
     }
     return { path: relativeSkillPath(entry.path, sourcePath), content };
   });
+  return buildResolvedImport(parsed, files, sourcePath, sourceCommit);
+}
+
+function buildResolvedImport(
+  parsed: ParsedSkillSource,
+  files: readonly SkillLibraryFile[],
+  sourcePath: string,
+  commit: string | null,
+): ResolvedSkillImport {
   let artifact;
   try {
     artifact = buildPortableSkillArtifact(files);
@@ -103,8 +121,25 @@ export async function resolveSkillImport(
     });
   }
   const repositoryUrl = `https://github.com/${parsed.owner}/${parsed.repository}`;
-  const sourceUrl =
-    sourcePath === "."
+  // The existing revision field holds our content digest for registry snapshots;
+  // snapshots do not provide a Git commit or a repository-relative folder path.
+  const sourceCommit = commit ?? artifact.contentSha256;
+  if (
+    !commit &&
+    artifact.name
+      .toLowerCase()
+      .replace(/[\s_]+/g, "-")
+      .replace(/[^a-z0-9-]/g, "")
+      .replace(/-+/g, "-")
+      .replace(/^-|-$/g, "") !== parsed.skillSlug!.toLowerCase()
+  ) {
+    throw new HTTPException(422, {
+      message: "The downloaded skill does not match the requested name",
+    });
+  }
+  const sourceUrl = !commit
+    ? `https://skills.sh/${parsed.owner}/${parsed.repository}/${parsed.skillSlug}`
+    : sourcePath === "."
       ? `${repositoryUrl}/tree/${sourceCommit}`
       : `${repositoryUrl}/tree/${sourceCommit}/${encodeGitHubPath(sourcePath)}`;
   const warnings: string[] = [];
@@ -119,6 +154,7 @@ export async function resolveSkillImport(
   }
   return {
     preview: {
+      markdown: artifact.files.find((file) => file.path === "SKILL.md")?.content,
       source: parsed.source,
       sourceUrl,
       repositoryUrl,

package/src/domain/skill-search.ts

@@ -173,6 +173,9 @@ function normalizeResponse(
     if (!isRecord(skill) || typeof skill.id !== "string" || typeof skill.source !== "string")
       throw invalid();
     const parts = skill.id.split("/");
+    // Website-hosted skills cannot use our GitHub import flow. Their presence
+    // must not discard the supported results in the same response.
+    if (parts.length === 2 && skill.source === parts[0]) continue;
     if (
       parts.length !== 3 ||
       !ownerPattern.test(parts[0]!) ||