@prismer/runtime 2.0.0 → 2.0.1

package/dist/index.cjs

@@ -465,7 +465,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@prismer/runtime",
-      version: "2.0.0",
+      version: "2.0.1",
       description: "Prismer Cloud daemon runtime \u2014 TS-only adapter host for hosted IM agents",
       type: "module",
       main: "dist/index.js",
@@ -502,6 +502,7 @@ var require_package = __commonJS({
         "better-sqlite3": "^11.8.0",
         commander: "^12.1.0",
         qrcode: "^1.5.4",
+        undici: "^7.24.0",
         ws: "^8.19.0",
         yaml: "^2.8.2",
         zod: "^3.23.8"
@@ -738,6 +739,7 @@ __export(src_exports, {
   currentSchemaVersion: () => currentSchemaVersion,
   deriveWsUrl: () => deriveWsUrl,
   envelope: () => envelope,
+  extractHttpUrls: () => extractHttpUrls,
   getRoleTemplate: () => getRoleTemplate,
   handleAgentMessageDispatch: () => handleAgentMessageDispatch,
   handleDispatch: () => handleDispatch,
@@ -2946,8 +2948,11 @@ function envelope(type, payload, requestId) {
 
 // src/asset-cache.ts
 var import_node_crypto2 = require("crypto");
+var import_node_dns = require("dns");
 var import_node_fs5 = require("fs");
+var import_node_net = require("net");
 var import_node_path6 = require("path");
+var import_undici = require("undici");
 function rowToCached(row) {
   return {
     contentHash: row.content_hash,
@@ -3068,6 +3073,73 @@ var AssetCache = class {
       pin: false
     };
   }
+  /**
+   * Fetch a public http(s) URL, content-hash dedup, cache locally.
+   *
+   * Mirrors `getOrFetch` (cache key = sha256 of body bytes), but the input
+   * is a URL whose hash we don't know up front. The fetcher applies:
+   *
+   *   - SSRF guard (resolve hostname, reject loopback / RFC1918 / link-local
+   *     / cloud-metadata / IPv6 ULA + link-local). Cross-host redirects
+   *     re-validate the new host before each hop.
+   *   - manual redirect handling (max 3 hops).
+   *   - hard timeout (default 15 s, override via env
+   *     `PRISMER_URL_FETCH_TIMEOUT_MS`).
+   *   - streaming body read with abort-at-limit (default 5 MiB, override
+   *     via env `PRISMER_URL_FETCH_MAX_BYTES`). Truncated bodies are NOT
+   *     cached.
+   *   - non-2xx → throws (caller should leave the URL in place and emit
+   *     an `error` observation).
+   *
+   * On success returns { cached, finalUrl, durationMs }; the caller can
+   * pin / unpin the hash like any other asset.
+   */
+  async getOrFetchUrl(url, opts) {
+    const started = Date.now();
+    const maxBytes = opts?.maxBytes ?? defaultMaxBytes();
+    const timeoutMs = opts?.timeoutMs ?? defaultTimeoutMs();
+    const maxRedirects = opts?.maxRedirects ?? 3;
+    const userAgent = opts?.userAgent ?? "prismer-daemon";
+    const { body, finalUrl, mime } = await fetchUrlWithGuards(url, {
+      signal: opts?.signal,
+      maxBytes,
+      timeoutMs,
+      maxRedirects,
+      userAgent
+    });
+    const hash = sha256(body);
+    const existing = this.get(hash);
+    if (existing) {
+      return { cached: existing, finalUrl, durationMs: Date.now() - started };
+    }
+    const localPath = this.pathFor(hash);
+    if (!(0, import_node_fs5.existsSync)((0, import_node_path6.dirname)(localPath))) {
+      (0, import_node_fs5.mkdirSync)((0, import_node_path6.dirname)(localPath), { recursive: true });
+    }
+    const tmpPath = `${localPath}.${process.pid}.${Date.now()}.tmp`;
+    (0, import_node_fs5.writeFileSync)(tmpPath, body);
+    (0, import_node_fs5.renameSync)(tmpPath, localPath);
+    const now = Date.now();
+    this.db.prepare(
+      `INSERT OR REPLACE INTO cached_assets
+         (content_hash, size_bytes, mime, local_path, fetched_at, last_used_at, pin)
+         VALUES (?, ?, ?, ?, ?, ?, 0)`
+    ).run(hash, body.length, mime, localPath, now, now);
+    this.evictIfOver();
+    return {
+      cached: {
+        contentHash: hash,
+        sizeBytes: body.length,
+        mime,
+        localPath,
+        fetchedAt: now,
+        lastUsedAt: now,
+        pin: false
+      },
+      finalUrl,
+      durationMs: now - started
+    };
+  }
   /** Insert an already-on-disk asset into the cache (e.g., asset just produced by adapter). */
   registerLocal(hash, localPath, mime) {
     const actualHash = sha256(readFileBuffer(localPath));
@@ -3119,6 +3191,184 @@ function sha256(buf) {
 function readFileBuffer(path9) {
   return (0, import_node_fs5.readFileSync)(path9);
 }
+var DEFAULT_URL_FETCH_MAX_BYTES = 5 * 1024 * 1024;
+var DEFAULT_URL_FETCH_TIMEOUT_MS = 15e3;
+function defaultMaxBytes() {
+  const v = Number(process.env.PRISMER_URL_FETCH_MAX_BYTES);
+  return Number.isFinite(v) && v > 0 ? v : DEFAULT_URL_FETCH_MAX_BYTES;
+}
+function defaultTimeoutMs() {
+  const v = Number(process.env.PRISMER_URL_FETCH_TIMEOUT_MS);
+  return Number.isFinite(v) && v > 0 ? v : DEFAULT_URL_FETCH_TIMEOUT_MS;
+}
+var urlFetchDeps = {};
+function activeFetch() {
+  return urlFetchDeps.fetch ?? globalThis.fetch;
+}
+async function activeResolveHostname(host) {
+  if (urlFetchDeps.resolveHostname) return urlFetchDeps.resolveHostname(host);
+  if ((0, import_node_net.isIP)(host)) return [host];
+  const res = await import_node_dns.promises.lookup(host, { all: true, verbatim: true });
+  return res.map((r) => r.address);
+}
+function isForbiddenIp(ip) {
+  if ((0, import_node_net.isIPv4)(ip)) {
+    const parts = ip.split(".").map((n) => Number(n));
+    if (parts.length !== 4 || parts.some((p) => !Number.isFinite(p) || p < 0 || p > 255)) {
+      return true;
+    }
+    const [a = 0, b = 0] = parts;
+    if (a === 127) return true;
+    if (a === 10) return true;
+    if (a === 172 && b >= 16 && b <= 31) return true;
+    if (a === 192 && b === 168) return true;
+    if (a === 169 && b === 254) return true;
+    if (a === 0) return true;
+    return false;
+  }
+  if ((0, import_node_net.isIPv6)(ip)) {
+    const lower = ip.toLowerCase();
+    if (lower === "::1" || lower === "0:0:0:0:0:0:0:1") return true;
+    if (lower === "::" || lower === "0:0:0:0:0:0:0:0") return true;
+    if (/^fe[89ab][0-9a-f]?:/.test(lower)) return true;
+    if (/^f[cd][0-9a-f]{2}:/.test(lower)) return true;
+    const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/i.exec(lower);
+    if (mapped) return isForbiddenIp(mapped[1]);
+    return false;
+  }
+  return true;
+}
+async function assertHostAllowed(hostname5) {
+  let ips;
+  try {
+    ips = await activeResolveHostname(hostname5);
+  } catch (err) {
+    throw new Error(`hostname resolution failed for ${hostname5}: ${err.message}`);
+  }
+  if (ips.length === 0) {
+    throw new Error(`no IPs resolved for ${hostname5}`);
+  }
+  for (const ip of ips) {
+    if (isForbiddenIp(ip)) {
+      throw new Error(`SSRF guard: ${hostname5} \u2192 ${ip} is in a forbidden range`);
+    }
+  }
+  return ips[0];
+}
+async function fetchUrlWithGuards(rawUrl, opts) {
+  let currentUrl;
+  try {
+    currentUrl = new URL(rawUrl);
+  } catch {
+    throw new Error(`invalid URL: ${rawUrl}`);
+  }
+  for (let hop = 0; hop <= opts.maxRedirects; hop += 1) {
+    if (currentUrl.protocol !== "http:" && currentUrl.protocol !== "https:") {
+      throw new Error(`unsupported scheme: ${currentUrl.protocol}`);
+    }
+    const pinnedIp = await assertHostAllowed(currentUrl.hostname);
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(new Error("timeout")), opts.timeoutMs);
+    if (opts.signal) {
+      if (opts.signal.aborted) controller.abort(opts.signal.reason);
+      else opts.signal.addEventListener("abort", () => controller.abort(opts.signal.reason), { once: true });
+    }
+    const usingMockedFetch = urlFetchDeps.fetch !== void 0;
+    const dispatcher = usingMockedFetch ? void 0 : new import_undici.Agent({
+      connect: {
+        lookup: (_hostname, _options, cb) => {
+          cb(null, pinnedIp, (0, import_node_net.isIPv6)(pinnedIp) ? 6 : 4);
+        }
+      }
+    });
+    try {
+      let res;
+      try {
+        res = await activeFetch()(currentUrl, {
+          method: "GET",
+          redirect: "manual",
+          headers: { "User-Agent": opts.userAgent, Accept: "*/*" },
+          signal: controller.signal,
+          // `dispatcher` is undici-specific; Node's built-in fetch (which
+          // IS undici under the hood) accepts it via this option.
+          ...dispatcher ? { dispatcher } : {}
+        });
+      } catch (err) {
+        clearTimeout(timer);
+        throw new Error(`fetch failed: ${err.message}`);
+      }
+      if (res.status >= 300 && res.status < 400) {
+        clearTimeout(timer);
+        const loc = res.headers.get("location");
+        if (!loc) throw new Error(`redirect ${res.status} with no Location header`);
+        try {
+          currentUrl = new URL(loc, currentUrl);
+        } catch {
+          throw new Error(`invalid redirect Location: ${loc}`);
+        }
+        try {
+          await res.arrayBuffer();
+        } catch {
+        }
+        if (hop === opts.maxRedirects) {
+          throw new Error(`too many redirects (>${opts.maxRedirects})`);
+        }
+        continue;
+      }
+      if (!res.ok) {
+        clearTimeout(timer);
+        throw new Error(`HTTP ${res.status}`);
+      }
+      const contentLength = Number(res.headers.get("content-length"));
+      if (Number.isFinite(contentLength) && contentLength > opts.maxBytes) {
+        clearTimeout(timer);
+        controller.abort(new Error("content-length exceeds limit"));
+        throw new Error(`body too large: content-length=${contentLength} > ${opts.maxBytes}`);
+      }
+      const chunks = [];
+      let total = 0;
+      const reader = res.body?.getReader();
+      try {
+        if (reader) {
+          for (; ; ) {
+            const { done, value } = await reader.read();
+            if (done) break;
+            if (value) {
+              total += value.byteLength;
+              if (total > opts.maxBytes) {
+                controller.abort(new Error("body exceeds limit"));
+                try {
+                  await reader.cancel();
+                } catch {
+                }
+                throw new Error(`body too large: read ${total} > ${opts.maxBytes}`);
+              }
+              chunks.push(value);
+            }
+          }
+        } else {
+          const ab = await res.arrayBuffer();
+          if (ab.byteLength > opts.maxBytes) {
+            throw new Error(`body too large: ${ab.byteLength} > ${opts.maxBytes}`);
+          }
+          chunks.push(new Uint8Array(ab));
+          total = ab.byteLength;
+        }
+      } finally {
+        clearTimeout(timer);
+      }
+      const body = Buffer.concat(chunks.map((c) => Buffer.from(c.buffer, c.byteOffset, c.byteLength)), total);
+      return {
+        body,
+        finalUrl: currentUrl.toString(),
+        mime: res.headers.get("content-type")
+      };
+    } finally {
+      await dispatcher?.close().catch(() => void 0);
+    }
+  }
+  throw new Error(`too many redirects (>${opts.maxRedirects})`);
+}
 
 // src/daemon/asset/mirror.ts
 var import_node_fs6 = require("fs");
@@ -3371,6 +3621,8 @@ var ParseClaimController = class {
 // src/uri-resolver.ts
 var URI_REGEX_WORKSPACE = /prismer:\/\/workspace\/([^/\s]+)\/(asset|file)\/([^\s)\]]+)/g;
 var URI_REGEX_LEGACY = /prismer:\/\/(?!workspace\/)([^/\s]+)\/(asset|file)\/([^\s)\]]+)/g;
+var HTTP_URL_REGEX = /https?:\/\/[^\s<>"'`]+/g;
+var URL_TRAILING_PUNCT_RE = /[,.;:!?)\]}'"]+$/;
 function parseUris(text) {
   if (!text) return [];
   const out = [];
@@ -3433,12 +3685,20 @@ var UriResolver = class {
     return cached.localPath;
   }
   /**
-   * Walk a string, replace every `prismer://(asset|file)/...` with `file://<localPath>`.
-   * Unrecognized URIs pass through. Returns rewritten text + the list of pinned hashes.
+   * Walk a string, replace every `prismer://(asset|file)/...` and
+   * `https://…` / `http://…` URL with `file://<localPath>`.
+   *
+   * Unrecognized URIs pass through unchanged. Returns rewritten text, the
+   * list of pinned hashes, and one observation per http(s) URL the resolver
+   * attempted (success + error both surface) so the dispatch can include
+   * them in `reply.assetObservability`.
+   *
+   * `urlCache` lets the caller dedupe URL fetches across multiple rewrite
+   * calls within a single dispatch (e.g. prompt + each context entry).
+   * Pass the same Map instance to every rewrite() / rewriteAll() call.
    */
   async rewrite(text, opts) {
     const uris = parseUris(text);
-    if (uris.length === 0) return { text, resolvedHashes: [] };
     const replacements = /* @__PURE__ */ new Map();
     const resolvedHashes = [];
     for (const u of uris) {
@@ -3461,6 +3721,46 @@ var UriResolver = class {
         console.warn(`[uri-resolver] failed to resolve ${u.raw}: ${err.message}`);
       }
     }
+    if (opts?.fetchUrls !== false) {
+      const urlCache = opts?.urlCache;
+      const urls = extractHttpUrls(text);
+      for (const original of urls) {
+        try {
+          let resolution = urlCache?.get(original);
+          if (!resolution) {
+            const { cached, finalUrl, durationMs } = await this.assetCache.getOrFetchUrl(original, {
+              signal: opts?.signal
+            });
+            resolution = { hash: cached.contentHash, localPath: cached.localPath, sizeBytes: cached.sizeBytes, mime: cached.mime, finalUrl, durationMs };
+            urlCache?.set(original, resolution);
+            opts?.urlObservations?.push({
+              contentHash: cached.contentHash,
+              mime: cached.mime,
+              sizeBytes: cached.sizeBytes,
+              strategy: "fetched-https",
+              originalUrl: original,
+              finalUrl,
+              durationMs
+            });
+          }
+          replacements.set(original, `file://${resolution.localPath}`);
+          resolvedHashes.push(resolution.hash);
+          if (opts?.pin) this.assetCache.pin(resolution.hash);
+        } catch (err) {
+          const message = err.message;
+          console.warn(`[uri-resolver] failed to fetch ${original}: ${message}`);
+          opts?.urlObservations?.push({
+            contentHash: "",
+            mime: null,
+            sizeBytes: null,
+            strategy: "error",
+            originalUrl: original,
+            error: message
+          });
+        }
+      }
+    }
+    if (replacements.size === 0) return { text, resolvedHashes };
     let rewritten = text;
     for (const [raw, sub] of replacements) {
       rewritten = rewritten.split(raw).join(sub);
@@ -3498,6 +3798,27 @@ var UriResolver = class {
 function dedupe(xs) {
   return Array.from(new Set(xs));
 }
+function extractHttpUrls(text) {
+  if (!text) return [];
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const m of text.matchAll(HTTP_URL_REGEX)) {
+    let url = m[0];
+    const punct = URL_TRAILING_PUNCT_RE.exec(url);
+    if (punct) url = url.slice(0, -punct[0].length);
+    if (!url) continue;
+    try {
+      const parsed = new URL(url);
+      if (parsed.protocol !== "http:" && parsed.protocol !== "https:") continue;
+    } catch {
+      continue;
+    }
+    if (seen.has(url)) continue;
+    seen.add(url);
+    out.push(url);
+  }
+  return out;
+}
 
 // src/daemon/dispatch.ts
 var import_node_fs8 = require("fs");
@@ -3522,29 +3843,141 @@ async function syncInstalledSkillsForDispatch(profile, agentImUserId, cloud, sig
   for (const entry of entries) {
     const slug = sanitizeSlug(trimmedStringFrom(entry.skill?.slug) ?? trimmedStringFrom(entry.slug));
     const skillId = trimmedStringFrom(entry.skill?.id);
-    const content = contentStringFrom(entry.skill?.content) ?? contentStringFrom(entry.content);
-    if (!slug || !content) {
+    if (!slug) {
       skipped++;
-      if (slug && !content) {
-        process.stderr.write(`[daemon] skill sync skipped ${slug}: missing content
-`);
-        await ackSkillSync(cloud, agentImUserId, { slug, error: "missing content" }, signal);
+      continue;
+    }
+    let files = null;
+    const manifestRaw = entry.skill?.contentManifest;
+    if (typeof manifestRaw === "string" && manifestRaw.trim()) {
+      files = parseManifest(manifestRaw, slug);
+    }
+    if (!files) {
+      const legacyContent = contentStringFrom(entry.skill?.content) ?? contentStringFrom(entry.content);
+      if (legacyContent) {
+        const buf = Buffer.from(legacyContent, "utf8");
+        files = [
+          {
+            path: "SKILL.md",
+            size: buf.byteLength,
+            sha256: sha256Buffer(buf),
+            inline: true,
+            content: buf.toString("base64")
+          }
+        ];
       }
+    }
+    if (!files || files.length === 0) {
+      skipped++;
+      process.stderr.write(`[daemon] skill sync skipped ${slug}: no manifest or content
+`);
+      await ackSkillSync(cloud, agentImUserId, { skillId, slug, error: "missing content" }, signal);
       continue;
     }
-    const revision = sha2562(content);
     const skillDir = (0, import_node_path8.join)(skillsRoot, slug);
     await import_node_fs7.promises.mkdir(skillDir, { recursive: true });
-    const target = (0, import_node_path8.join)(skillDir, "SKILL.md");
-    const existing = await import_node_fs7.promises.readFile(target, "utf8").catch(() => null);
-    if (existing != null && sha2562(existing) === revision) {
-      unchanged++;
-      await ackSkillSync(cloud, agentImUserId, { skillId, slug, revision }, signal);
+    const localFiles = await walkLocalDir(skillDir);
+    let dirty = false;
+    let perFileFailures = 0;
+    for (const file of files) {
+      if (!isSafeRelativePath(file.path)) {
+        process.stderr.write(`[daemon] skill sync ${slug}: skipping suspicious path "${file.path}"
+`);
+        perFileFailures++;
+        continue;
+      }
+      const targetPath = (0, import_node_path8.join)(skillDir, file.path);
+      const normalizedTarget = targetPath + (targetPath.endsWith(import_node_path8.sep) ? "" : "");
+      if (normalizedTarget !== skillDir && !normalizedTarget.startsWith(skillDir + import_node_path8.sep)) {
+        process.stderr.write(`[daemon] skill sync ${slug}: path escapes skillDir "${file.path}"
+`);
+        perFileFailures++;
+        continue;
+      }
+      const existingHash = localFiles.get(file.path);
+      if (existingHash === file.sha256) {
+        localFiles.delete(file.path);
+        continue;
+      }
+      let bytes = null;
+      try {
+        if (file.inline !== false && typeof file.content === "string") {
+          bytes = Buffer.from(file.content, "base64");
+        } else if (typeof file.url === "string" && file.url) {
+          bytes = await downloadUrl(file.url, signal);
+        } else {
+          process.stderr.write(
+            `[daemon] skill sync ${slug}: file ${file.path} has neither inline content nor url
+`
+          );
+          perFileFailures++;
+          continue;
+        }
+      } catch (err) {
+        process.stderr.write(
+          `[daemon] skill sync ${slug}: failed to fetch ${file.path}: ${err.message}
+`
+        );
+        perFileFailures++;
+        continue;
+      }
+      const downloadedHash = sha256Buffer(bytes);
+      if (downloadedHash !== file.sha256) {
+        process.stderr.write(
+          `[daemon] skill sync ${slug}: hash mismatch for ${file.path} (expected ${file.sha256}, got ${downloadedHash})
+`
+        );
+        perFileFailures++;
+        continue;
+      }
+      await import_node_fs7.promises.mkdir((0, import_node_path8.dirname)(targetPath), { recursive: true });
+      await import_node_fs7.promises.writeFile(targetPath, bytes);
+      localFiles.delete(file.path);
+      dirty = true;
+    }
+    for (const orphan of localFiles.keys()) {
+      try {
+        await import_node_fs7.promises.unlink((0, import_node_path8.join)(skillDir, orphan));
+        dirty = true;
+      } catch (err) {
+        if (err.code !== "ENOENT") {
+          process.stderr.write(
+            `[daemon] skill sync ${slug}: failed to remove orphan ${orphan}: ${err.message}
+`
+          );
+        }
+      }
+    }
+    if (perFileFailures > 0) {
+      skipped++;
+      await ackSkillSync(
+        cloud,
+        agentImUserId,
+        { skillId, slug, error: `${perFileFailures} file(s) failed` },
+        signal
+      );
       continue;
     }
-    await import_node_fs7.promises.writeFile(target, content, "utf8");
-    synced++;
-    await ackSkillSync(cloud, agentImUserId, { skillId, slug, revision }, signal);
+    const localMerkle = computeMerkle(files);
+    const declaredRevision = trimmedStringFrom(entry.skill?.contentManifestRevision);
+    const revision = declaredRevision ?? localMerkle;
+    if (declaredRevision && declaredRevision !== localMerkle) {
+      process.stderr.write(
+        `[daemon] skill sync ${slug}: declared revision ${declaredRevision} != computed ${localMerkle}; using computed
+`
+      );
+    }
+    if (dirty) {
+      synced++;
+    } else {
+      unchanged++;
+    }
+    await ackSkillSync(
+      cloud,
+      agentImUserId,
+      { skillId, slug, revision: declaredRevision === localMerkle ? declaredRevision : localMerkle },
+      signal
+    );
   }
   return { synced, skipped, unchanged };
 }
@@ -3562,9 +3995,96 @@ function resolveSkillsRoot(profile) {
   }
   return null;
 }
-function sha2562(value) {
+function sha256Buffer(value) {
   return (0, import_node_crypto3.createHash)("sha256").update(value).digest("hex");
 }
+function computeMerkle(files) {
+  const sorted = [...files].sort((a, b) => a.path.localeCompare(b.path));
+  const lines = sorted.map((f) => `${f.path}:${f.sha256}`).join("\n");
+  return (0, import_node_crypto3.createHash)("sha256").update(lines).digest("hex");
+}
+function parseManifest(raw, slug) {
+  try {
+    const parsed = JSON.parse(raw);
+    const arr = Array.isArray(parsed) ? parsed : parsed && typeof parsed === "object" && Array.isArray(parsed.files) ? parsed.files : null;
+    if (!Array.isArray(arr)) {
+      process.stderr.write(`[daemon] skill sync ${slug}: contentManifest is not an array
+`);
+      return null;
+    }
+    const files = [];
+    for (const item of arr) {
+      if (!item || typeof item !== "object") continue;
+      const rec = item;
+      const path9 = typeof rec.path === "string" ? rec.path : null;
+      const sha2563 = typeof rec.sha256 === "string" ? rec.sha256 : null;
+      const size = typeof rec.size === "number" && Number.isFinite(rec.size) && rec.size >= 0 ? Math.floor(rec.size) : null;
+      if (!path9 || !sha2563 || size === null) continue;
+      const content = typeof rec.content === "string" ? rec.content : void 0;
+      const url = typeof rec.url === "string" ? rec.url : void 0;
+      const inline = typeof rec.inline === "boolean" ? rec.inline : content !== void 0 ? true : void 0;
+      files.push({ path: path9, size, sha256: sha2563, inline, content, url });
+    }
+    return files;
+  } catch (err) {
+    process.stderr.write(
+      `[daemon] skill sync ${slug}: invalid contentManifest JSON: ${err.message}
+`
+    );
+    return null;
+  }
+}
+function isSafeRelativePath(p) {
+  if (typeof p !== "string" || !p) return false;
+  if (p.length > 512) return false;
+  if (p.includes("\0")) return false;
+  if (p.startsWith("/") || p.startsWith("\\")) return false;
+  if (/^[A-Za-z]:[\\/]/.test(p)) return false;
+  const segs = p.replace(/\\/g, "/").split("/");
+  for (const seg of segs) {
+    if (seg === "" || seg === "." || seg === "..") return false;
+  }
+  return true;
+}
+async function walkLocalDir(root) {
+  const out = /* @__PURE__ */ new Map();
+  async function walk2(dir) {
+    let entries;
+    try {
+      entries = await import_node_fs7.promises.readdir(dir, { withFileTypes: true });
+    } catch (err) {
+      if (err.code === "ENOENT") return;
+      throw err;
+    }
+    for (const ent of entries) {
+      const full = (0, import_node_path8.join)(dir, ent.name);
+      if (ent.isDirectory()) {
+        await walk2(full);
+      } else if (ent.isFile()) {
+        try {
+          const buf = await import_node_fs7.promises.readFile(full);
+          const rel = (0, import_node_path8.relative)(root, full).split(import_node_path8.sep).join("/");
+          out.set(rel, sha256Buffer(buf));
+        } catch {
+        }
+      }
+    }
+  }
+  await walk2(root);
+  return out;
+}
+async function downloadUrl(url, signal) {
+  const lower = url.toLowerCase();
+  if (!lower.startsWith("http://") && !lower.startsWith("https://")) {
+    throw new Error(`unsupported url scheme: ${url.slice(0, 32)}`);
+  }
+  const res = await fetch(url, { signal });
+  if (!res.ok) {
+    throw new Error(`fetch ${url} failed: HTTP ${res.status}`);
+  }
+  const ab = await res.arrayBuffer();
+  return Buffer.from(ab);
+}
 function normalizeInstalledSkills(data) {
   if (Array.isArray(data)) return data.filter(isInstalledSkillEntry);
   if (!data || typeof data !== "object" || Array.isArray(data)) return [];
@@ -3684,12 +4204,22 @@ async function handleDispatch(payload, requestId, deps) {
         payload.prompt = hashRefResult.text;
       }
     }
-    const rewrittenPrompt = await deps.uriResolver.rewrite(payload.prompt, { pin: true });
+    const urlCache = /* @__PURE__ */ new Map();
+    const urlObservations = [];
+    const rewrittenPrompt = await deps.uriResolver.rewrite(payload.prompt, {
+      pin: true,
+      urlCache,
+      urlObservations
+    });
     resolvedHashes.push(...rewrittenPrompt.resolvedHashes);
     let rewrittenContext = [];
     if (payload.context && payload.context.length > 0) {
       const contents = payload.context.map((e) => e.content);
-      const r = await deps.uriResolver.rewriteAll(contents, { pin: true });
+      const r = await deps.uriResolver.rewriteAll(contents, {
+        pin: true,
+        urlCache,
+        urlObservations
+      });
       resolvedHashes.push(...r.resolvedHashes);
       rewrittenContext = payload.context.map((e, i) => ({ ...e, content: r.texts[i] }));
     }
@@ -3809,7 +4339,7 @@ async function handleDispatch(payload, requestId, deps) {
       } : result.error,
       ...collectedAssetIds.length > 0 ? { assetIds: collectedAssetIds } : {},
       metrics: result.metrics,
-      ...assetResolution.observability.length > 0 ? { assetObservability: assetResolution.observability } : {}
+      ...assetResolution.observability.length > 0 || urlObservations.length > 0 ? { assetObservability: [...assetResolution.observability, ...urlObservations] } : {}
     };
     await writeBridgeMetadata(payload.taskId, deps.cloud, result.metadata, deps.signal);
     await writeObservabilityMetadata(
@@ -5020,10 +5550,10 @@ async function walkAndDigest(root, current) {
     }
     if (!st.isFile()) continue;
     const buf = await import_node_fs9.promises.readFile(full);
-    const sha2564 = (0, import_node_crypto4.createHash)("sha256").update(buf).digest("hex");
+    const sha2563 = (0, import_node_crypto4.createHash)("sha256").update(buf).digest("hex");
     out.push({
       path: rel,
-      sha256: sha2564,
+      sha256: sha2563,
       sizeBytes: st.size,
       mtime: Math.floor(st.mtimeMs)
     });
@@ -5788,7 +6318,7 @@ var MemoryStore = class {
     }
     const db = this.requireDb();
     const now = Date.now();
-    const contentHash = sha2563(input.content);
+    const contentHash = sha2562(input.content);
     const payload = sealPlaintext(input.content);
     if (payload.kind !== "inline") {
       throw new Error("MemoryStore.write: non-inline payload not yet supported in phase-0");
@@ -5982,7 +6512,7 @@ var MemoryStore = class {
     };
   }
 };
-function sha2563(s) {
+function sha2562(s) {
   return (0, import_node_crypto5.createHash)("sha256").update(s, "utf8").digest("hex");
 }
 
@@ -11246,11 +11776,11 @@ function buildAssetCommand() {
     }
     printAssetDetail("Asset", assetId, body);
   }, { code: "asset_get_failed" }));
-  cmd.command("by-hash <sha256>").description("Fetch asset metadata by content hash").option("--workspace-id <id>", "Workspace id (required by the cloud API)").option("--json", "Output machine-readable JSON").action(runAction(async (sha2564, opts) => {
+  cmd.command("by-hash <sha256>").description("Fetch asset metadata by content hash").option("--workspace-id <id>", "Workspace id (required by the cloud API)").option("--json", "Output machine-readable JSON").action(runAction(async (sha2563, opts) => {
     const cloud = mkCloud();
     const query = new URLSearchParams();
     if (opts.workspaceId) query.set("wsId", opts.workspaceId);
-    const path9 = `/api/im/assets/by-hash/${encodeURIComponent(sha2564)}${query.toString() ? `?${query.toString()}` : ""}`;
+    const path9 = `/api/im/assets/by-hash/${encodeURIComponent(sha2563)}${query.toString() ? `?${query.toString()}` : ""}`;
     const res = await cloud.request("GET", path9);
     if (!res.ok) exitWithError(`asset by-hash failed (${res.status}): ${res.error?.message ?? "request failed"}`, { code: res.error?.code ?? "asset_by_hash_failed" });
     const body = res.data;
@@ -11261,7 +11791,7 @@ function buildAssetCommand() {
       printJson(body ?? null);
       return;
     }
-    printAssetDetail("Asset hash", sha2564, body);
+    printAssetDetail("Asset hash", sha2563, body);
   }, { code: "asset_by_hash_failed" }));
   return cmd;
 }
@@ -14350,7 +14880,7 @@ async function readResponseError(res) {
 
 // src/cli/index.ts
 init_ui();
-var VERSION = "2.0.0";
+var VERSION = "2.0.1";
 function buildProgram() {
   const program = new import_commander20.Command("prismer").description("Prismer Cloud daemon CLI (TS-only).").version(VERSION);
   program.addCommand(buildBannerCommand());
@@ -14409,6 +14939,7 @@ async function runCli(argv = process.argv) {
   currentSchemaVersion,
   deriveWsUrl,
   envelope,
+  extractHttpUrls,
   getRoleTemplate,
   handleAgentMessageDispatch,
   handleDispatch,