@prismer/runtime 2.2.55 → 2.2.63

package/built-in-skills/research-arxiv/scripts/search_arxiv.py

@@ -0,0 +1,111 @@
+#!/usr/bin/env python3
+"""Bounded, version-preserving arXiv Atom search (stdlib only)."""
+import argparse
+import json
+import re
+import sys
+import time
+import urllib.error
+import urllib.parse
+import urllib.request
+import xml.etree.ElementTree as ET
+
+NS = {"a": "http://www.w3.org/2005/Atom"}
+ID = re.compile(r"(?:\d{4}\.\d{4,5}|[a-z-]+(?:\.[A-Z]{2})?/\d{7})(?:v[1-9]\d*)?\Z")
+SORTS = {"relevance": "relevance", "date": "submittedDate", "updated": "lastUpdatedDate"}
+
+
+def parse_feed(data):
+    root = ET.fromstring(data)
+    if root.tag != "{" + NS["a"] + "}feed":
+        raise ValueError("response is not an Atom feed")
+    papers = []
+    for entry in root.findall("a:entry", NS):
+        def field(name, default="unknown"):
+            return " ".join((entry.findtext("a:" + name, default, NS) or default).split())
+        raw_id = field("id", "")
+        if "/api/errors" in raw_id:
+            raise ValueError("arXiv API error: " + field("summary"))
+        parsed = urllib.parse.urlsplit(raw_id)
+        if parsed.hostname not in {"arxiv.org", "www.arxiv.org", "export.arxiv.org"} or not parsed.path.startswith("/abs/"):
+            raise ValueError("entry has an invalid arXiv identifier")
+        paper_id = parsed.path.removeprefix("/abs/")
+        if not ID.fullmatch(paper_id):
+            raise ValueError("entry has an invalid arXiv identifier")
+        papers.append({
+            "id": paper_id, "title": field("title"),
+            "published": field("published"), "updated": field("updated"),
+            "authors": [a.findtext("a:name", "unknown", NS) for a in entry.findall("a:author", NS)],
+            "categories": [c.get("term", "") for c in entry.findall("a:category", NS)],
+            "abstract": field("summary", ""),
+            "abs_url": "https://arxiv.org/abs/" + paper_id,
+            "pdf_url": "https://arxiv.org/pdf/" + paper_id,
+        })
+    return papers
+
+
+def search(query=None, author=None, category=None, ids=None, max_results=5, sort="relevance", start=0, as_json=False):
+    if not isinstance(max_results, int) or not 1 <= max_results <= 100:
+        raise ValueError("max_results must be between 1 and 100")
+    if not isinstance(start, int) or start < 0 or sort not in SORTS:
+        raise ValueError("invalid start or sort")
+    params = {"max_results": max_results, "start": start, "sortBy": SORTS[sort], "sortOrder": "descending"}
+    if ids:
+        values = [value.strip() for value in ids.split(",")]
+        if len(values) > 100 or not all(ID.fullmatch(value) for value in values):
+            raise ValueError("invalid arXiv id list")
+        params["id_list"] = ",".join(values)
+    else:
+        parts = [prefix + ":" + value for prefix, value in [("all", query), ("au", author), ("cat", category)] if value]
+        if not parts:
+            raise ValueError("provide a query, --author, --category, or --id")
+        params["search_query"] = " AND ".join(parts)
+    url = "https://export.arxiv.org/api/query?" + urllib.parse.urlencode(params)
+    request = urllib.request.Request(url, headers={"User-Agent": "PrismerResearch/1.0"})
+    for attempt in range(3):
+        try:
+            with urllib.request.urlopen(request, timeout=20) as response:
+                data = response.read(8 * 1024 * 1024 + 1)
+            if len(data) > 8 * 1024 * 1024:
+                raise ValueError("arXiv response exceeds 8 MiB")
+            break
+        except urllib.error.HTTPError as exc:
+            if attempt == 2 or exc.code not in {429, 500, 502, 503, 504}:
+                raise
+            time.sleep(3 * (attempt + 1))
+    papers = parse_feed(data)
+    if as_json:
+        print(json.dumps({"papers": papers, "start": start, "count": len(papers)}, ensure_ascii=False))
+    elif not papers:
+        print("No results found.")
+    else:
+        for index, paper in enumerate(papers, start=1):
+            print(f"{index}. {paper['title']}\n   ID: {paper['id']} | Published: {paper['published']} | Updated: {paper['updated']}")
+            print("   Authors: " + ", ".join(paper["authors"]))
+            print("   Categories: " + ", ".join(paper["categories"]))
+            print("   Abstract: " + paper["abstract"])
+            print(f"   Links: {paper['abs_url']} | {paper['pdf_url']}\n")
+    return papers
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("query", nargs="?")
+    parser.add_argument("--author")
+    parser.add_argument("--category")
+    parser.add_argument("--id", dest="ids")
+    parser.add_argument("--max", type=int, default=5, dest="max_results")
+    parser.add_argument("--start", type=int, default=0)
+    parser.add_argument("--sort", choices=SORTS, default="relevance")
+    parser.add_argument("--json", action="store_true", dest="as_json")
+    args = parser.parse_args()
+    try:
+        search(**vars(args))
+    except (ValueError, ET.ParseError, OSError) as exc:
+        print(f"arxiv search failed: {exc}", file=sys.stderr)
+        return 1
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/built-in-skills/role-builder/SKILL.md

@@ -134,7 +134,7 @@ cloud role create ./<role-slug> --mine --json
 cloud role show <returned-slug-or-id> --json
 ```
 
-For a zero-dependency ingest client after the files are authored and validated:
+For the retained legacy entrypoint (requires the current Cloud CLI; no raw HTTP fallback):
 
 ```bash
 node scripts/ingest-role.mjs ./<role-slug> --mine
@@ -142,6 +142,12 @@ node scripts/ingest-role.mjs ./<role-slug> --mine
 
 It reads `PRISMER_API_KEY` and `PRISMER_CLOUD_BASE` from the already-injected
 environment. Do not write literal secrets in the command, bundle, or ledger.
+The adapter delegates validation and Skill preflight to Cloud before creation.
+Ledger-based workflows require an injected API key even if Cloud has saved
+credentials: the target origin and that executing key's hash bind every receipt.
+Changing either requires a separate ledger. Completed receipts are read back,
+not blindly trusted. A lock is never stolen on timeout; after a crash, verify
+the old process has stopped and reconcile remote writes before explicit recovery.
 
 ## C. Change an existing agent's role
 

package/built-in-skills/role-builder/scripts/author-role.mjs

@@ -2,7 +2,7 @@
 
 import { spawnSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
-import { existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync, openSync, closeSync, unlinkSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
 
 export class RoleAuthoringError extends Error {
@@ -95,7 +95,7 @@ export function loadRoleAuthoringConfig(argv, env = process.env) {
     baseUrl.username ||
     baseUrl.password ||
     baseUrl.search ||
-    baseUrl.hash
+    baseUrl.hash || baseUrl.pathname !== '/'
   ) {
     throw new RoleAuthoringError(
       'local_validation',
@@ -116,6 +116,7 @@ export function loadRoleAuthoringConfig(argv, env = process.env) {
 
   const revision = roleRevision(rolePath);
   return {
+    credential: env.PRISMER_API_KEY?.trim() || '',
     rolePath,
     revision,
     cloudBin: env.PRISMER_CLOUD_BIN?.trim() || 'cloud',
@@ -133,7 +134,8 @@ export function loadRoleAuthoringConfig(argv, env = process.env) {
 function defaultRunCloud(config, args) {
   const result = spawnSync(config.cloudBin, args, {
     encoding: 'utf8',
-    env: { ...process.env, PRISMER_CLOUD_BASE: config.baseUrl },
+    env: { ...process.env, PRISMER_CLOUD_BASE: config.baseUrl, PRISMER_API_KEY: config.credential },
+    timeout: 120_000,
     shell: false,
   });
   if (result.error) {
@@ -180,7 +182,7 @@ function cliError(result) {
 
 function writeLedger(path, ledger) {
   mkdirSync(dirname(path), { recursive: true });
-  const temporary = `${path}.tmp`;
+  const temporary = `${path}.${process.pid}.tmp`;
   writeFileSync(temporary, `${JSON.stringify(ledger, null, 2)}\n`, { mode: 0o600 });
   renameSync(temporary, path);
 }
@@ -201,10 +203,24 @@ function readLedger(path) {
 }
 
 export async function runRoleAuthoring(config, runCloud = defaultRunCloud) {
+  mkdirSync(dirname(config.ledgerPath), { recursive: true });
+  const lockPath = `${config.ledgerPath}.lock`;
+  const lock = openSync(lockPath, 'wx', 0o600);
+  try {
+    return await runRoleAuthoringLocked(config, runCloud);
+  } finally {
+    closeSync(lock);
+    unlinkSync(lockPath);
+  }
+}
+
+async function runRoleAuthoringLocked(config, runCloud) {
+  if (!config.credential) throw new RoleAuthoringError('local_validation', 'IDENTITY_REQUIRED', 'PRISMER_API_KEY is required to bind the ledger to the executing credential', 2);
+  const targetBinding = createHash('sha256').update(JSON.stringify([config.baseUrl, config.credential])).digest('hex');
   const previous = readLedger(config.ledgerPath);
   if (
     previous &&
-    (previous.rolePath !== config.rolePath ||
+    (previous.targetBinding !== targetBinding || previous.rolePath !== config.rolePath ||
       previous.revision !== config.revision ||
       Boolean(previous.publish) !== config.publish)
   ) {
@@ -215,8 +231,7 @@ export async function runRoleAuthoring(config, runCloud = defaultRunCloud) {
       2,
     );
   }
-  if (previous?.stage === 'completed') return previous;
-  if (previous?.stage === 'created' && previous.slug) {
+  if (['created', 'completed'].includes(previous?.stage) && previous.slug) {
     // The server push completed and its canonical slug was durably recorded;
     // resume from readback instead of pushing again (which intentionally bumps
     // a role version even when its content is identical).
@@ -256,6 +271,7 @@ export async function runRoleAuthoring(config, runCloud = defaultRunCloud) {
   }
 
   const ledger = {
+    targetBinding,
     schemaVersion: 1,
     rolePath: config.rolePath,
     revision: config.revision,

package/built-in-skills/role-builder/scripts/ingest-role.mjs

@@ -25,8 +25,7 @@
 //     EXPLICIT act, never the default (16 §2.3).
 //   • APPLY is admin OR the target agent's workspace owner.
 
-import { readFileSync, statSync } from 'node:fs';
-import { join } from 'node:path';
+import { spawnSync } from 'node:child_process';
 
 function die(msg, code = 1) {
   console.error(`[role-builder] ✗ ${msg}`);
@@ -95,7 +94,7 @@ if (
   target.username ||
   target.password ||
   target.search ||
-  target.hash
+  target.hash || target.pathname !== '/'
 ) {
   die('PRISMER_CLOUD_BASE must be a plain http(s) origin without credentials, query, or hash', 2);
 }
@@ -105,119 +104,18 @@ if (!isLocalTarget && !allowRemote) {
   die('remote mutation is blocked; set PRISMER_ALLOW_REMOTE_WRITE=1 after confirming the target environment', 2);
 }
 
-// Read a role authoring unit — file OR directory (mirrors `cloud role create` /
-// runtime bundle.readRoleBundle). A dir folds SOUL.md → operatingPrinciples.
-function readRoleBundle(p) {
-  let st;
-  try {
-    st = statSync(p);
-  } catch {
-    die(`role path not found: ${p}`);
+// Preserve the legacy CLI surface while delegating parsing/preflight to Cloud.
+const command = ['role', 'create', rolePath];
+if (wantPublish) command.push('--publish');
+if (wantApply) command.push('--apply');
+if (agentId) command.push('--agent', agentId);
+if (workspaceId) command.push('--workspace-id', workspaceId);
+if (asJson) command.push('--json');
+const cloud = process.env.PRISMER_CLOUD_BIN || 'cloud';
+for (const args of [['role', 'validate', rolePath, '--json'], ['role', 'test', rolePath, '--json'], command]) {
+  const result = spawnSync(cloud, args, { stdio: 'inherit', shell: false, timeout: 120_000,
+    env: { ...process.env, PRISMER_CLOUD_BASE: BASE } });
+  if (result.error || result.status !== 0) {
+    die('Cloud CLI failed or timed out; inspect remote state before retrying', result.status || 5);
   }
-  if (!st.isDirectory()) {
-    try {
-      return JSON.parse(readFileSync(p, 'utf8'));
-    } catch (err) {
-      die(`could not read/parse ${p}: ${err?.message || err}`);
-    }
-  }
-  // Directory bundle: role.json (required) + SOUL.md (optional persona).
-  let r;
-  try {
-    r = JSON.parse(readFileSync(join(p, 'role.json'), 'utf8'));
-  } catch (err) {
-    if (err?.code === 'ENOENT') die(`role bundle dir is missing role.json: ${join(p, 'role.json')}`);
-    die(`could not read/parse ${join(p, 'role.json')}: ${err?.message || err}`);
-  }
-  try {
-    const soul = readFileSync(join(p, 'SOUL.md'), 'utf8');
-    // SOUL.md is the persona source-of-truth → operatingPrinciples (markdown).
-    if (soul.trim() !== '') r.operatingPrinciples = soul;
-  } catch (err) {
-    if (err?.code !== 'ENOENT') die(`could not read SOUL.md: ${err?.message || err}`);
-    // SOUL.md absent is allowed.
-  }
-  return r;
-}
-
-const role = readRoleBundle(rolePath);
-
-const slug = role.slug || role.templateName;
-if (!slug && !role.name && !role.displayName) die('role.json must have slug or name/displayName');
-
-if (role.requiredSkills && !Array.isArray(role.requiredSkills)) {
-  die('requiredSkills must be an array of { skillSlug, required }');
 }
-for (const rs of role.requiredSkills || []) {
-  if (!rs || typeof rs.skillSlug !== 'string') {
-    die(`each requiredSkills entry needs a string skillSlug — got ${JSON.stringify(rs)}`);
-  }
-}
-
-async function api(method, path, body) {
-  const res = await fetch(`${BASE}${path}`, {
-    method,
-    headers: { 'content-type': 'application/json', authorization: `Bearer ${API_KEY}` },
-    ...(body ? { body: JSON.stringify(body) } : {}),
-  });
-  let json = null;
-  try {
-    json = await res.json();
-  } catch {
-    /* non-JSON */
-  }
-  return { status: res.status, json };
-}
-
-(async () => {
-  // product204/16 §2.3 — DEFAULT is the owner-scoped create path (private role
-  // owned by the caller, lands in Studio `/mine`); `--publish`/`--admin-catalog`
-  // is the EXPLICIT admin catalog path (publishes straight to the Marketplace).
-  const createPath = wantMine ? '/api/im/role-templates/mine' : '/api/im/role-templates';
-  const created = await api('POST', createPath, role);
-  if (created.status === 403) {
-    die(
-      wantMine
-        ? 'create returned 403 — the API key does not resolve to a workspace user (auth failed).'
-        : 'create returned 403 — the API key does not map to an admin email (role create is admin-only). Use --mine for an owner-scoped private role.',
-      3,
-    );
-  }
-  if (created.status === 409) die(`role slug already exists (409). Use update or a new slug.`, 2);
-  if (created.status !== 201 || !created.json?.ok) {
-    die(`create failed (HTTP ${created.status}): ${created.json?.error || 'unknown error'}`);
-  }
-  const tpl = created.json.data;
-  const result = {
-    slug: tpl.slug,
-    agentType: tpl.agentType,
-    taskAuthority: tpl.taskAuthority,
-    requiredSkills: Array.isArray(role.requiredSkills) ? role.requiredSkills.length : 0,
-    applied: false,
-  };
-
-  if (wantApply) {
-    const apply = await api('POST', `/api/im/role-templates/${encodeURIComponent(tpl.slug)}/apply`, {
-      agentId,
-      ...(workspaceId ? { workspaceId } : {}),
-    });
-    if (apply.status >= 200 && apply.status < 300 && apply.json?.ok !== false) {
-      result.applied = agentId;
-    } else if (apply.status === 403) {
-      result.applyError = '403 — need admin or the target agent workspace owner';
-    } else {
-      result.applyError = `HTTP ${apply.status}: ${apply.json?.error || 'apply failed'}`;
-    }
-  }
-
-  if (asJson) {
-    console.log(JSON.stringify(result, null, 2));
-  } else {
-    console.log(`[role-builder] ✓ ingested role ${result.slug}`);
-    console.log(`  type:     ${result.agentType} / authority=${result.taskAuthority}`);
-    console.log(`  skills:   ${result.requiredSkills}`);
-    console.log(`  applied:  ${result.applied}${result.applyError ? ` (${result.applyError})` : ''}`);
-    console.log(`  verify:   GET /api/im/role-templates/${result.slug}`);
-  }
-  if (result.applyError) process.exitCode = 5;
-})().catch((err) => die(err?.message || String(err)));

package/built-in-skills/role-builder/scripts/instantiate-and-run.mjs

@@ -1,5 +1,7 @@
 #!/usr/bin/env node
 
+import { mkdirSync, openSync, closeSync, unlinkSync } from 'node:fs';
+import { dirname } from 'node:path';
 import {
   HarnessError,
   invocationHash,
@@ -143,6 +145,18 @@ async function waitForTask(config, task, ledger) {
 }
 
 export async function runRoleWorkflow(config) {
+  mkdirSync(dirname(config.ledgerPath), { recursive: true });
+  const lockPath = `${config.ledgerPath}.lock`;
+  const lock = openSync(lockPath, 'wx', 0o600);
+  try {
+    return await runRoleWorkflowLocked(config);
+  } finally {
+    closeSync(lock);
+    unlinkSync(lockPath);
+  }
+}
+
+async function runRoleWorkflowLocked(config) {
   const acceptedHash = invocationHash(config);
   const previous = readLedger(config.ledgerPath);
   if (
@@ -150,7 +164,7 @@ export async function runRoleWorkflow(config) {
     (previous.requestId !== config.requestId ||
       previous.role !== config.role ||
       previous.workspaceId !== config.workspaceId ||
-      (previous.invocationHash && previous.invocationHash !== acceptedHash))
+      previous.invocationHash !== acceptedHash)
   ) {
     throw new HarnessError(
       'local_validation',

package/built-in-skills/role-builder/scripts/operation-harness.mjs

@@ -123,7 +123,7 @@ export function loadHarnessConfig(argv, env = process.env) {
     baseUrl.username ||
     baseUrl.password ||
     baseUrl.search ||
-    baseUrl.hash
+    baseUrl.hash || baseUrl.pathname !== '/'
   ) {
     throw new HarnessError(
       'local_validation',
@@ -151,8 +151,8 @@ export function loadHarnessConfig(argv, env = process.env) {
   const requestId =
     envOrArg(parsed, '--request-id', 'PRISMER_REQUEST_ID', env)?.trim() ||
     `role-run-${randomUUID()}`;
-  if (requestId.length > 191) {
-    throw new HarnessError('local_validation', 'INVALID_REQUEST_ID', 'request id exceeds 191 characters', 2);
+  if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,190}$/.test(requestId)) {
+    throw new HarnessError('local_validation', 'INVALID_REQUEST_ID', 'request id must be a safe path component of at most 191 characters', 2);
   }
 
   const config = {
@@ -185,7 +185,7 @@ export function loadHarnessConfig(argv, env = process.env) {
 
 export function writeLedger(path, value) {
   mkdirSync(dirname(path), { recursive: true });
-  const temporary = `${path}.tmp`;
+  const temporary = `${path}.${process.pid}.tmp`;
   writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
   renameSync(temporary, path);
 }
@@ -209,6 +209,8 @@ export function invocationHash(config) {
   return createHash('sha256')
     .update(
       JSON.stringify({
+        baseUrl: config.baseUrl,
+        credentialHash: createHash('sha256').update(config.apiKey).digest('hex'),
         requestId: config.requestId,
         role: config.role,
         workspaceId: config.workspaceId,

package/built-in-skills/skill-creator/LICENSE.prismer

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Prismer
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/built-in-skills/skill-creator/NOTICE.md

@@ -0,0 +1,18 @@
+# Resource License Boundaries
+
+- Imported Anthropic authoring/evaluation resources retain Apache-2.0 in
+  `LICENSE.txt`, including its original copyright notice. Local fixes do not
+  replace that license.
+- Prismer-specific workflow, `scripts/import-library.mjs`, and legacy
+  `references/skill-authoring/` / `references/skill-builder/` retain MIT from
+  `sdk/cloud/LICENSE`, reproduced as `LICENSE.prismer` (Copyright 2026 Prismer).
+- `references/hermes-agent-skill-authoring/GUIDE.md` contains the full upstream
+  `skills/software-development/hermes-agent-skill-authoring/SKILL.md` at Hermes
+  revision `1a1f4a59e252e1dc0137e7b2e7bcc8b0381d19c4`, adapted for scope/path
+  safety and explicit authorization of git operations. Its MIT license,
+  Copyright 2025 Nous Research, is retained beside the guide as `LICENSE`.
+  The upstream skill has no additional resource files. No source upstream was
+  modified. Its skill identity is recorded in `metadata.nativeReplaces`.
+
+Distribute these notices and nested license files with the corresponding
+resources. The mixed-license frontmatter is not a relicensing of any source.

package/built-in-skills/skill-creator/SKILL.md

@@ -3,7 +3,7 @@ name: skill-creator
 scope: common
 category: authoring
 description: Create, import, edit, validate, test, or publish a Prismer SS-01 Skill. Use whenever a user asks to turn a repeatable capability or external Skill repository into platform Skills, improve an existing Skill, or make Skills available in Studio, a workspace, or Marketplace. Follow the fixed author-to-readback workflow and use bundled scripts for deterministic repeated work; do not explore raw endpoints or compose ad-hoc CLI chains.
-license: MIT
+license: Apache-2.0 AND MIT; see NOTICE.md
 compatibility:
   - prismer-sdk
   - hermes
@@ -12,6 +12,8 @@ compatibility:
   - openclaw
 metadata:
   category: authoring
+  aliases: [skill-builder, skill-authoring]
+  nativeReplaces: [hermes-agent-skill-authoring]
 allowed-tools:
   - Read
   - Write
@@ -21,6 +23,14 @@ allowed-tools:
 
 # Skill Creator
 
+Historical skill-builder and skill-authoring installs resolve to this entry.
+For low-level legacy formats only, see references/skill-builder/GUIDE.md and
+references/skill-authoring/GUIDE.md. The current workflow below is authoritative.
+For Hermes in-repository conventions, read
+`references/hermes-agent-skill-authoring/GUIDE.md` only when targeting a verified
+Hermes checkout. It is a full MIT-licensed reference, not a second entrypoint.
+The bundled Anthropic authoring resources retain Apache-2.0 in LICENSE.txt.
+
 Choose one route and execute it directly. Do not inspect `cloud --help`, create
 probe catalog objects, or call raw Skill endpoints first.
 
@@ -33,6 +43,15 @@ probe catalog objects, or call raw Skill endpoints first.
 
 ## Ownership boundary
 
+Optional paid trigger/description evaluations require explicit budget approval
+and `PRISMER_ALLOW_PAID_EVAL=1`. Trigger probes use isolated temporary skill
+directories, Read/Skill only, 0.25 USD per query and a 300-call batch ceiling.
+Use a current Claude CLI supporting `--bare` and budget flags; unsupported CLI,
+timeout, auth failure, or missing terminal result is an error, not a negative
+trigger. Do not bypass nested-session or authentication guards. Viewer HTML
+is local; spreadsheet preview additionally uses its declared external SheetJS
+script and is not guaranteed offline. Static feedback is downloaded explicitly.
+
 Keep each concern in its proper layer:
 
 - Product resource operations belong in the service/SDK/CLI.

package/built-in-skills/skill-creator/eval-viewer/generate_review.py

@@ -16,12 +16,8 @@ import argparse
 import base64
 import json
 import mimetypes
-import os
 import re
-import signal
-import subprocess
 import sys
-import time
 import webbrowser
 from functools import partial
 from http.server import HTTPServer, BaseHTTPRequestHandler
@@ -276,7 +272,8 @@ def generate_html(
     if benchmark:
         embedded["benchmark"] = benchmark
 
-    data_json = json.dumps(embedded)
+    # HTML parses closing script tags before JavaScript parses string literals.
+    data_json = json.dumps(embedded).replace('<', '\\u003c').replace('>', '\\u003e').replace('&', '\\u0026')
 
     return template.replace("/*__EMBEDDED_DATA__*/", f"const EMBEDDED_DATA = {data_json};")
 
@@ -285,26 +282,6 @@ def generate_html(
 # HTTP server (stdlib only, zero dependencies)
 # ---------------------------------------------------------------------------
 
-def _kill_port(port: int) -> None:
-    """Kill any process listening on the given port."""
-    try:
-        result = subprocess.run(
-            ["lsof", "-ti", f":{port}"],
-            capture_output=True, text=True, timeout=5,
-        )
-        for pid_str in result.stdout.strip().split("\n"):
-            if pid_str.strip():
-                try:
-                    os.kill(int(pid_str.strip()), signal.SIGTERM)
-                except (ProcessLookupError, ValueError):
-                    pass
-        if result.stdout.strip():
-            time.sleep(0.5)
-    except subprocess.TimeoutExpired:
-        pass
-    except FileNotFoundError:
-        print("Note: lsof not found, cannot check if port is in use", file=sys.stderr)
-
 class ReviewHandler(BaseHTTPRequestHandler):
     """Serves the review HTML and handles feedback saves.
 
@@ -360,12 +337,26 @@ class ReviewHandler(BaseHTTPRequestHandler):
 
     def do_POST(self) -> None:
         if self.path == "/api/feedback":
-            length = int(self.headers.get("Content-Length", 0))
+            origin = self.headers.get('Origin')
+            if origin and origin not in (f'http://localhost:{self.server.server_port}', f'http://127.0.0.1:{self.server.server_port}'):
+                self.send_error(403)
+                return
+            try:
+                length = int(self.headers.get('Content-Length', 0))
+            except ValueError:
+                self.send_error(400)
+                return
+            if not 0 < length <= 1024 * 1024:
+                self.send_error(413)
+                return
             body = self.rfile.read(length)
             try:
                 data = json.loads(body)
-                if not isinstance(data, dict) or "reviews" not in data:
-                    raise ValueError("Expected JSON object with 'reviews' key")
+                if (not isinstance(data, dict) or not isinstance(data.get('reviews'), list)
+                        or data.get('status') not in ('in_progress', 'complete')
+                        or any(not isinstance(r, dict) or not isinstance(r.get('run_id'), str)
+                               or not isinstance(r.get('feedback'), str) for r in data['reviews'])):
+                    raise ValueError('Invalid review payload')
                 self.feedback_path.write_text(json.dumps(data, indent=2) + "\n")
                 resp = b'{"ok":true}'
                 self.send_response(200)
@@ -435,14 +426,12 @@ def main() -> None:
         print(f"\n  Static viewer written to: {args.static}\n")
         sys.exit(0)
 
-    # Kill any existing process on the target port
     port = args.port
-    _kill_port(port)
     handler = partial(ReviewHandler, workspace, skill_name, feedback_path, previous, benchmark_path)
     try:
         server = HTTPServer(("127.0.0.1", port), handler)
     except OSError:
-        # Port still in use after kill attempt — find a free one
+        # Never signal an unrelated listener; let the OS select a free port.
         server = HTTPServer(("127.0.0.1", 0), handler)
         port = server.server_address[1]