@polka-codes/core 0.10.13 → 0.10.17

package/dist/skills/__tests__/validation.test.js

@@ -0,0 +1,221 @@
+// generated by polka.codes
+import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
+import { mkdirSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { SkillDiscoveryService } from '../discovery';
+import { SkillValidationError } from '../types';
+import { validateSkillMetadata, validateSkillReferences, validateSkillSecurity } from '../validation';
+describe('Skill Validation', () => {
+    const testDir = join(process.cwd(), 'test-skills-validation');
+    const skillsDir = join(testDir, 'skills');
+    beforeEach(() => {
+        mkdirSync(skillsDir, { recursive: true });
+    });
+    afterEach(() => {
+        rmSync(testDir, { recursive: true, force: true });
+    });
+    function createTestSkill(name, content) {
+        const skillDir = join(skillsDir, name);
+        mkdirSync(skillDir, { recursive: true });
+        writeFileSync(join(skillDir, 'SKILL.md'), content);
+        return skillDir;
+    }
+    describe('validateSkillSecurity', () => {
+        it('should accept valid skills within size limits', async () => {
+            const content = `---
+name: test-skill
+description: A test skill
+---
+
+${'x'.repeat(1000)}
+`;
+            createTestSkill('test', content);
+            const service = new SkillDiscoveryService({ cwd: testDir });
+            const skill = await service.loadSkill(join(skillsDir, 'test'), 'project');
+            expect(() => validateSkillSecurity(skill)).not.toThrow();
+        });
+        it('should reject skills with oversized main content', async () => {
+            const content = `---
+name: test-skill
+description: A test skill
+---
+
+${'x'.repeat(2 * 1024 * 1024)} // 2MB
+`;
+            createTestSkill('test', content);
+            const service = new SkillDiscoveryService({ cwd: testDir });
+            const skill = await service.loadSkill(join(skillsDir, 'test'), 'project');
+            expect(() => validateSkillSecurity(skill)).toThrow(SkillValidationError);
+            expect(() => validateSkillSecurity(skill)).toThrow(/exceeds size limit/);
+        });
+        it('should reject skills with oversized supporting files', async () => {
+            const skillDir = createTestSkill('test', `---
+name: test-skill
+description: A test skill
+---
+`);
+            writeFileSync(join(skillDir, 'large.txt'), 'x'.repeat(2 * 1024 * 1024));
+            const service = new SkillDiscoveryService({ cwd: testDir });
+            // File size is now checked during loadSkill, not during validation
+            await expect(service.loadSkill(join(skillsDir, 'test'), 'project')).rejects.toThrow('File size exceeds limit');
+        });
+        it('should reject skills with oversized total size', async () => {
+            const skillDir = createTestSkill('test', `---
+name: test-skill
+description: A test skill
+---
+
+${'x'.repeat(500 * 1024)}
+`);
+            // Add multiple 900KB files to exceed 10MB total (but each file is under 1MB limit)
+            for (let i = 0; i < 11; i++) {
+                const fileName = `large${i}.txt`;
+                writeFileSync(join(skillDir, fileName), 'y'.repeat(900 * 1024));
+            }
+            const service = new SkillDiscoveryService({ cwd: testDir });
+            const skill = await service.loadSkill(join(skillsDir, 'test'), 'project');
+            expect(() => validateSkillSecurity(skill)).toThrow(SkillValidationError);
+            expect(() => validateSkillSecurity(skill)).toThrow(/total size exceeds limit/);
+        });
+        it('should detect suspicious script tags', async () => {
+            const content = `---
+name: test-skill
+description: A test skill
+---
+
+<script>alert('xss')</script>
+`;
+            createTestSkill('test', content);
+            const service = new SkillDiscoveryService({ cwd: testDir });
+            const skill = await service.loadSkill(join(skillsDir, 'test'), 'project');
+            // First verify the skill has the script tag
+            expect(skill.content).toContain('<script>');
+            // Now check that validation throws
+            expect(() => validateSkillSecurity(skill)).toThrow(SkillValidationError);
+        });
+        it('should detect javascript: URLs', async () => {
+            const content = `---
+name: test-skill
+description: A test skill
+---
+
+Click [here](javascript:alert('xss'))
+`;
+            createTestSkill('test', content);
+            const service = new SkillDiscoveryService({ cwd: testDir });
+            const skill = await service.loadSkill(join(skillsDir, 'test'), 'project');
+            expect(() => validateSkillSecurity(skill)).toThrow(SkillValidationError);
+        });
+        it('should detect event handlers', async () => {
+            const content = `---
+name: test-skill
+description: A test skill
+---
+
+<div onclick="malicious()">
+`;
+            createTestSkill('test', content);
+            const service = new SkillDiscoveryService({ cwd: testDir });
+            const skill = await service.loadSkill(join(skillsDir, 'test'), 'project');
+            expect(() => validateSkillSecurity(skill)).toThrow(SkillValidationError);
+        });
+    });
+    describe('validateSkillReferences', () => {
+        it('should warn about external references without disclosure', async () => {
+            const content = `---
+name: test-skill
+description: A test skill
+---
+
+See https://example.com for more info.
+`;
+            createTestSkill('test', content);
+            const service = new SkillDiscoveryService({ cwd: testDir });
+            const skill = await service.loadSkill(join(skillsDir, 'test'), 'project');
+            const warnings = validateSkillReferences(skill);
+            expect(warnings.length).toBeGreaterThan(0);
+            expect(warnings.some((w) => w.includes('external references'))).toBe(true);
+        });
+        it('should not warn about external references if disclosed', async () => {
+            const content = `---
+name: test-skill
+description: A test skill with external documentation and network resources
+---
+
+See https://example.com for more info.
+`;
+            createTestSkill('test', content);
+            const service = new SkillDiscoveryService({ cwd: testDir });
+            const skill = await service.loadSkill(join(skillsDir, 'test'), 'project');
+            const warnings = validateSkillReferences(skill);
+            expect(warnings.some((w) => w.includes('external references'))).toBe(false);
+        });
+        it('should warn about missing referenced files', async () => {
+            const content = `---
+name: test-skill
+description: A test skill
+---
+
+See [reference](reference.md) for details.
+`;
+            createTestSkill('test', content);
+            const service = new SkillDiscoveryService({ cwd: testDir });
+            const skill = await service.loadSkill(join(skillsDir, 'test'), 'project');
+            const warnings = validateSkillReferences(skill);
+            expect(warnings).toContain('Referenced file not found: reference.md');
+        });
+        it('should not warn about existing referenced files', async () => {
+            const skillDir = createTestSkill('test', `---
+name: test-skill
+description: A test skill
+---
+
+See [reference](reference.md) for details.
+`);
+            writeFileSync(join(skillDir, 'reference.md'), '# Reference');
+            const service = new SkillDiscoveryService({ cwd: testDir });
+            const skill = await service.loadSkill(join(skillsDir, 'test'), 'project');
+            const warnings = validateSkillReferences(skill);
+            expect(warnings.some((w) => w.includes('reference.md'))).toBe(false);
+        });
+    });
+    describe('validateSkillMetadata', () => {
+        it('should accept valid metadata', async () => {
+            const content = `---
+name: test-skill
+description: A meaningful description for testing
+---
+`;
+            createTestSkill('test', content);
+            const service = new SkillDiscoveryService({ cwd: testDir });
+            const skill = await service.loadSkill(join(skillsDir, 'test'), 'project');
+            const errors = validateSkillMetadata(skill);
+            expect(errors).toHaveLength(0);
+        });
+        it('should reject descriptions that are too short', async () => {
+            const content = `---
+name: test-skill
+description: Too short
+---
+`;
+            createTestSkill('test', content);
+            const service = new SkillDiscoveryService({ cwd: testDir });
+            const skill = await service.loadSkill(join(skillsDir, 'test'), 'project');
+            const errors = validateSkillMetadata(skill);
+            expect(errors.some((e) => e.includes('too short'))).toBe(true);
+        });
+        it('should accept descriptions that are exactly 20 characters', async () => {
+            const content = `---
+name: test-skill
+description: Exactly 20 chars long!
+---
+`;
+            createTestSkill('test', content);
+            const service = new SkillDiscoveryService({ cwd: testDir });
+            const skill = await service.loadSkill(join(skillsDir, 'test'), 'project');
+            const errors = validateSkillMetadata(skill);
+            expect(errors.some((e) => e.includes('too short'))).toBe(false);
+        });
+    });
+});
+//# sourceMappingURL=validation.test.js.map

package/dist/skills/__tests__/validation.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.test.js","sourceRoot":"","sources":["../../../src/skills/__tests__/validation.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,UAAU,CAAA;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AAC/C,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAA;AAErG,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,wBAAwB,CAAC,CAAA;IAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;IAEzC,UAAU,CAAC,GAAG,EAAE;QACd,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC3C,CAAC,CAAC,CAAA;IAEF,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACnD,CAAC,CAAC,CAAA;IAEF,SAAS,eAAe,CAAC,IAAY,EAAE,OAAe;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;QACtC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACxC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,OAAO,CAAC,CAAA;QAClD,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;QACrC,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;YAC7D,MAAM,OAAO,GAAG;;;;;EAKpB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;CACjB,CAAA;YAEK,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;YAEhC,MAAM,OAAO,GAAG,IAAI,qBAAqB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;YAC3D,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,SAAS,CAAC,CAAA;YAEzE,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;QAC1D,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;YAChE,MAAM,OAAO,GAAG;;;;;EAKpB,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;CAC5B,CAAA;YAEK,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;YAEhC,MAAM,OAAO,GAAG,IAAI,qBAAqB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;YAC3D,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,SAAS,CAAC,CAAA;YAEzE,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAA;YACxE,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAA;QAC1E,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;YACpE,MAAM,QAAQ,GAAG,eAAe,CAC9B,MAAM,EACN;;;;CAIP,CACM,CAAA;YAED,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,CAAA;YAEvE,MAAM,OAAO,GAAG,IAAI,qBAAqB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;YAE3D,mEAAmE;YACnE,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAA;QAChH,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;YAC9D,MAAM,QAAQ,GAAG,eAAe,CAC9B,MAAM,EACN;;;;;EAKN,GAAG,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC;CACvB,CACM,CAAA;YAED,mFAAmF;YACnF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC5B,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAA;gBAChC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAA;YACjE,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,qBAAqB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;YAC3D,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,SAAS,CAAC,CAAA;YAEzE,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAA;YACxE,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAA;QAChF,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;YACpD,MAAM,OAAO,GAAG;;;;;;CAMrB,CAAA;YAEK,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;YAEhC,MAAM,OAAO,GAAG,IAAI,qBAAqB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;YAC3D,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,SAAS,CAAC,CAAA;YAEzE,4CAA4C;YAC5C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;YAE3C,mCAAmC;YACnC,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAA;QAC1E,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;YAC9C,MAAM,OAAO,GAAG;;;;;;CAMrB,CAAA;YAEK,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;YAEhC,MAAM,OAAO,GAAG,IAAI,qBAAqB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;YAC3D,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,SAAS,CAAC,CAAA;YAEzE,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAA;QAC1E,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;YAC5C,MAAM,OAAO,GAAG;;;;;;CAMrB,CAAA;YAEK,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;YAEhC,MAAM,OAAO,GAAG,IAAI,qBAAqB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;YAC3D,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,SAAS,CAAC,CAAA;YAEzE,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAA;QAC1E,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACvC,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;YACxE,MAAM,OAAO,GAAG;;;;;;CAMrB,CAAA;YAEK,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;YAEhC,MAAM,OAAO,GAAG,IAAI,qBAAqB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;YAC3D,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,SAAS,CAAC,CAAA;YAEzE,MAAM,QAAQ,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAA;YAE/C,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;YAC1C,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC5E,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;YACtE,MAAM,OAAO,GAAG;;;;;;CAMrB,CAAA;YAEK,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;YAEhC,MAAM,OAAO,GAAG,IAAI,qBAAqB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;YAC3D,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,SAAS,CAAC,CAAA;YAEzE,MAAM,QAAQ,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAA;YAE/C,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC7E,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;YAC1D,MAAM,OAAO,GAAG;;;;;;CAMrB,CAAA;YAEK,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;YAEhC,MAAM,OAAO,GAAG,IAAI,qBAAqB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;YAC3D,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,SAAS,CAAC,CAAA;YAEzE,MAAM,QAAQ,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAA;YAE/C,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,yCAAyC,CAAC,CAAA;QACvE,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;YAC/D,MAAM,QAAQ,GAAG,eAAe,CAC9B,MAAM,EACN;;;;;;CAMP,CACM,CAAA;YAED,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,aAAa,CAAC,CAAA;YAE5D,MAAM,OAAO,GAAG,IAAI,qBAAqB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;YAC3D,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,SAAS,CAAC,CAAA;YAEzE,MAAM,QAAQ,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAA;YAE/C,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACtE,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;QACrC,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;YAC5C,MAAM,OAAO,GAAG;;;;CAIrB,CAAA;YAEK,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;YAEhC,MAAM,OAAO,GAAG,IAAI,qBAAqB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;YAC3D,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,SAAS,CAAC,CAAA;YAEzE,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;YAE3C,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QAChC,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;YAC7D,MAAM,OAAO,GAAG;;;;CAIrB,CAAA;YAEK,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;YAEhC,MAAM,OAAO,GAAG,IAAI,qBAAqB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;YAC3D,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,SAAS,CAAC,CAAA;YAEzE,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;YAE3C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAChE,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;YACzE,MAAM,OAAO,GAAG;;;;CAIrB,CAAA;YAEK,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;YAEhC,MAAM,OAAO,GAAG,IAAI,qBAAqB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;YAC3D,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,SAAS,CAAC,CAAA;YAEzE,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;YAE3C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACjE,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/skills/constants.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Constants for Agent Skills system
+ */
+export declare const SKILL_LIMITS: {
+    readonly MAX_FILE_SIZE: number;
+    readonly MAX_SKILL_SIZE: number;
+    readonly MAX_DEPTH: 10;
+    readonly MAX_FILES: 500;
+    readonly MIN_DESCRIPTION_LENGTH: 20;
+    readonly MAX_DESCRIPTION_LENGTH: 1024;
+    readonly MAX_NAME_LENGTH: 64;
+};
+export declare const IGNORED_DIRECTORIES: readonly [".git", "node_modules", ".next", ".turbo", "dist", "build", "coverage", ".cache", ".vscode", ".idea", "tmp", "temp", ".DS_Store"];
+/**
+ * Security validation patterns to detect suspicious content
+ *
+ * Note: Patterns use case-insensitive flag (/i) but NOT global (/g) to avoid
+ * stateful lastIndex issues when RegExp.test() is called multiple times.
+ */
+export declare const SUSPICIOUS_PATTERNS: readonly [RegExp, RegExp, RegExp];
+export declare const SKILL_ERROR_MESSAGES: {
+    readonly MISSING_FRONTMATTER: "SKILL.md must begin with YAML frontmatter enclosed in ---";
+    readonly FRONTMATTER_INVALID: "Invalid frontmatter: {message}";
+    readonly SKILL_NOT_FOUND: "Skill not found";
+    readonly CONTEXT_NOT_INITIALIZED: "Skill context not initialized";
+};
+export declare const SOURCE_ICONS: {
+    readonly project: "📁";
+    readonly personal: "🏠";
+    readonly plugin: "🔌";
+};
+export type SkillSource = keyof typeof SOURCE_ICONS;

package/dist/skills/constants.js

@@ -0,0 +1,50 @@
+/**
+ * Constants for Agent Skills system
+ */
+export const SKILL_LIMITS = {
+    MAX_FILE_SIZE: 1024 * 1024, // 1MB per file
+    MAX_SKILL_SIZE: 10 * 1024 * 1024, // 10MB total
+    MAX_DEPTH: 10, // Maximum directory recursion depth
+    MAX_FILES: 500, // Maximum files to load per skill
+    MIN_DESCRIPTION_LENGTH: 20, // Minimum description length
+    MAX_DESCRIPTION_LENGTH: 1024, // Maximum description length
+    MAX_NAME_LENGTH: 64, // Maximum skill name length
+};
+export const IGNORED_DIRECTORIES = [
+    '.git',
+    'node_modules',
+    '.next',
+    '.turbo',
+    'dist',
+    'build',
+    'coverage',
+    '.cache',
+    '.vscode',
+    '.idea',
+    'tmp',
+    'temp',
+    '.DS_Store',
+];
+/**
+ * Security validation patterns to detect suspicious content
+ *
+ * Note: Patterns use case-insensitive flag (/i) but NOT global (/g) to avoid
+ * stateful lastIndex issues when RegExp.test() is called multiple times.
+ */
+export const SUSPICIOUS_PATTERNS = [
+    /<script[^>]*>[\s\S]*?<\/script>/i, // Script tags (with dotAll for multiline)
+    /javascript:/i, // JavaScript URLs
+    /on\w+\s*=/i, // Event handlers (onclick, onload, etc.)
+];
+export const SKILL_ERROR_MESSAGES = {
+    MISSING_FRONTMATTER: 'SKILL.md must begin with YAML frontmatter enclosed in ---',
+    FRONTMATTER_INVALID: 'Invalid frontmatter: {message}',
+    SKILL_NOT_FOUND: 'Skill not found',
+    CONTEXT_NOT_INITIALIZED: 'Skill context not initialized',
+};
+export const SOURCE_ICONS = {
+    project: '📁',
+    personal: '🏠',
+    plugin: '🔌',
+};
+//# sourceMappingURL=constants.js.map

package/dist/skills/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/skills/constants.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,aAAa,EAAE,IAAI,GAAG,IAAI,EAAE,eAAe;IAC3C,cAAc,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,aAAa;IAC/C,SAAS,EAAE,EAAE,EAAE,oCAAoC;IACnD,SAAS,EAAE,GAAG,EAAE,kCAAkC;IAClD,sBAAsB,EAAE,EAAE,EAAE,6BAA6B;IACzD,sBAAsB,EAAE,IAAI,EAAE,6BAA6B;IAC3D,eAAe,EAAE,EAAE,EAAE,4BAA4B;CACzC,CAAA;AAEV,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,MAAM;IACN,cAAc;IACd,OAAO;IACP,QAAQ;IACR,MAAM;IACN,OAAO;IACP,UAAU;IACV,QAAQ;IACR,SAAS;IACT,OAAO;IACP,KAAK;IACL,MAAM;IACN,WAAW;CACH,CAAA;AAEV;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,kCAAkC,EAAE,0CAA0C;IAC9E,cAAc,EAAE,kBAAkB;IAClC,YAAY,EAAE,yCAAyC;CAC/C,CAAA;AAEV,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,mBAAmB,EAAE,2DAA2D;IAChF,mBAAmB,EAAE,gCAAgC;IACrD,eAAe,EAAE,iBAAiB;IAClC,uBAAuB,EAAE,+BAA+B;CAChD,CAAA;AAEV,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,OAAO,EAAE,IAAI;IACb,QAAQ,EAAE,IAAI;IACd,MAAM,EAAE,IAAI;CACJ,CAAA"}

package/dist/skills/discovery.d.ts

@@ -0,0 +1,56 @@
+import type { FileSystemProvider } from '../fs';
+import type { Skill, SkillContext, SkillReference } from './types';
+/**
+ * Service for discovering and loading Agent Skills from filesystem
+ *
+ * Skills are discovered from three sources with priority:
+ * 1. Project skills at .claude/skills/ (highest priority)
+ * 2. Personal skills at ~/.claude/skills/
+ * 3. Plugin skills at node_modules (lowest priority)
+ */
+export declare class SkillDiscoveryService {
+    private fs;
+    private personalSkillsDir;
+    private projectSkillsDir;
+    private pluginSkillsDirs;
+    constructor(options: {
+        cwd: string;
+        personalSkillsDir?: string;
+        pluginSkillsDirs?: string[];
+        fs?: FileSystemProvider;
+    });
+    /**
+     * Discover all available skills from all sources
+     * Removes duplicates (project skills take priority over personal/plugin)
+     */
+    discoverAll(): Promise<SkillReference[]>;
+    /**
+     * Discover skills in a specific directory
+     */
+    discoverInDirectory(dir: string, source: 'personal' | 'project' | 'plugin'): Promise<SkillReference[]>;
+    /**
+     * Discover skills from plugin directories (node_modules)
+     */
+    discoverPlugins(): Promise<SkillReference[]>;
+    /**
+     * Load a single skill from its directory
+     */
+    loadSkill(skillPath: string, source: 'personal' | 'project' | 'plugin'): Promise<Skill>;
+    /**
+     * Parse SKILL.md content and extract frontmatter
+     */
+    private parseSkillMd;
+    /**
+     * Parse and validate YAML frontmatter
+     */
+    private parseMetadata;
+    /**
+     * Recursively load files from a directory into the files map
+     * @returns The total size of all files loaded (in bytes)
+     */
+    private loadDirectoryFiles;
+    /**
+     * Create an initial skill context object
+     */
+    createContext(): Promise<SkillContext>;
+}