@rubytech/taskmaster 1.19.1 → 1.20.0

package/dist/agents/skills/frontmatter.js

@@ -120,3 +120,82 @@ export function resolveSkillInvocationPolicy(frontmatter) {
 export function resolveSkillKey(skill, entry) {
     return entry?.taskmaster?.skillKey ?? skill.name;
 }
+/**
+ * Extract whether `embed: true` is set in the taskmaster metadata of a SKILL.md content string.
+ */
+export function extractEmbedFlag(content) {
+    const frontmatter = parseFrontmatter(content);
+    const meta = resolveTaskmasterMetadata(frontmatter);
+    return meta?.embed === true;
+}
+/**
+ * Set or remove the `embed` flag in a SKILL.md content string's frontmatter metadata.
+ * Preserves other metadata fields. Handles the case where no metadata block exists yet.
+ */
+export function applyEmbedFlag(content, embed) {
+    const normalized = content.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
+    // Parse existing metadata to preserve other fields.
+    const frontmatter = parseFrontmatter(normalized);
+    const rawMeta = frontmatter.metadata;
+    let metaObj = {};
+    if (rawMeta) {
+        try {
+            metaObj = JSON5.parse(rawMeta);
+        }
+        catch {
+            // If metadata is unparseable, start fresh.
+        }
+    }
+    // Update the taskmaster.embed field.
+    const taskmaster = metaObj.taskmaster && typeof metaObj.taskmaster === "object"
+        ? { ...metaObj.taskmaster }
+        : {};
+    if (embed) {
+        taskmaster.embed = true;
+    }
+    else {
+        delete taskmaster.embed;
+    }
+    // Clean up: if taskmaster object is empty, remove it; if metaObj is empty, remove metadata line.
+    const hasTaskmasterKeys = Object.keys(taskmaster).length > 0;
+    if (hasTaskmasterKeys) {
+        metaObj.taskmaster = taskmaster;
+    }
+    else {
+        delete metaObj.taskmaster;
+    }
+    const hasMetaKeys = Object.keys(metaObj).length > 0;
+    const newMetaValue = hasMetaKeys ? JSON.stringify(metaObj) : "";
+    // Now splice the metadata line into the frontmatter block.
+    if (!normalized.startsWith("---")) {
+        // No frontmatter at all — add one if we need metadata.
+        if (!newMetaValue)
+            return content;
+        return `---\nmetadata: ${newMetaValue}\n---\n${normalized}`;
+    }
+    const endIndex = normalized.indexOf("\n---", 3);
+    if (endIndex === -1)
+        return content; // Malformed frontmatter — don't touch.
+    const block = normalized.slice(4, endIndex);
+    const after = normalized.slice(endIndex + 4); // After closing ---
+    // Replace or add the metadata line within the frontmatter block.
+    const lines = block.split("\n");
+    let replaced = false;
+    const newLines = [];
+    for (const line of lines) {
+        if (/^metadata:\s/.test(line)) {
+            replaced = true;
+            if (newMetaValue) {
+                newLines.push(`metadata: ${newMetaValue}`);
+            }
+            // else: drop the line entirely (no metadata needed)
+        }
+        else {
+            newLines.push(line);
+        }
+    }
+    if (!replaced && newMetaValue) {
+        newLines.push(`metadata: ${newMetaValue}`);
+    }
+    return `---\n${newLines.join("\n")}\n---${after}`;
+}

package/dist/agents/skills/workspace.js

@@ -7,6 +7,7 @@ import { resolveBundledSkillsDir } from "./bundled-dir.js";
 import { shouldIncludeSkill } from "./config.js";
 import { parseFrontmatter, resolveTaskmasterMetadata, resolveSkillInvocationPolicy, } from "./frontmatter.js";
 import { resolvePluginSkillDirs } from "./plugin-skills.js";
+import { hasMarker } from "../../license/skill-pack.js";
 import { serializeByKey } from "./serialize.js";
 const fsp = fs.promises;
 const skillsLogger = createSubsystemLogger("skills");
@@ -333,6 +334,9 @@ export async function syncBundledSkillsToWorkspace(workspaceDir, opts) {
     for (const name of entries) {
         const dest = path.join(targetSkillsDir, name);
         const exists = fs.existsSync(dest);
+        // Never overwrite marketplace-installed skills with bundled versions
+        if (exists && hasMarker(dest))
+            continue;
         if (exists && !FORCE_RESYNC_SKILLS.has(name))
             continue;
         try {

package/dist/agents/skills-status.js

@@ -1,6 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { CONFIG_DIR } from "../utils.js";
+import { hasMarker } from "../license/skill-pack.js";
 import { hasBinary, isBundledSkillAllowed, isConfigPathTruthy, loadWorkspaceSkillEntries, resolveBundledAllowlist, resolveBundledSkillsDir, resolveConfigPath, resolveSkillConfig, resolveSkillsInstallPreferences, } from "./skills.js";
 function resolveSkillKey(entry) {
     return entry.taskmaster?.skillKey ?? entry.skill.name;
@@ -84,6 +85,7 @@ function buildSkillStatus(entry, config, prefs, eligibility, bundledSkillNames)
     const allowBundled = resolveBundledAllowlist(config);
     const blockedByAllowlist = !isBundledSkillAllowed(entry, allowBundled);
     const always = entry.taskmaster?.always === true;
+    const alwaysActive = entry.taskmaster?.embed === true;
     const emoji = entry.taskmaster?.emoji ?? entry.frontmatter.emoji;
     const homepageRaw = entry.taskmaster?.homepage ??
         entry.frontmatter.homepage ??
@@ -146,9 +148,19 @@ function buildSkillStatus(entry, config, prefs, eligibility, bundledSkillNames)
                 missing.env.length === 0 &&
                 missing.config.length === 0 &&
                 missing.os.length === 0));
-    const preloaded = bundledSkillNames
-        ? bundledSkillNames.has(entry.skill.name)
-        : false;
+    const preloaded = bundledSkillNames ? bundledSkillNames.has(entry.skill.name) : false;
+    const isMarketplace = hasMarker(entry.skill.baseDir);
+    let marketplaceVersion;
+    if (isMarketplace) {
+        try {
+            const markerContent = fs.readFileSync(path.join(entry.skill.baseDir, ".skillpack"), "utf-8");
+            const marker = JSON.parse(markerContent);
+            marketplaceVersion = typeof marker.version === "string" ? marker.version : undefined;
+        }
+        catch {
+            // Marker exists but unreadable
+        }
+    }
     return {
         name: entry.skill.name,
         description: entry.skill.description,
@@ -160,10 +172,13 @@ function buildSkillStatus(entry, config, prefs, eligibility, bundledSkillNames)
         emoji,
         homepage,
         always,
+        alwaysActive,
         disabled,
         blockedByAllowlist,
         eligible,
         preloaded,
+        marketplace: isMarketplace,
+        marketplaceVersion,
         requirements: {
             bins: requiredBins,
             anyBins: requiredAnyBins,

package/dist/agents/system-prompt.js

@@ -8,11 +8,12 @@ function buildSkillsSection(params) {
         return [];
     return [
         "## Skills (mandatory)",
-        "Before taking any action (including tool calls): scan <available_skills> <description> entries.",
-        `- If exactly one skill clearly applies: read its SKILL.md at <location> with \`${params.readToolName}\`, then follow it.`,
+        "Before taking any action (including tool calls): scan ALL <available_skills> <description> entries for relevance.",
+        `- If one or more skills could apply (even partially): read the best match SKILL.md at <location> with \`${params.readToolName}\`, then follow it.`,
         "- If multiple could apply: choose the most specific one, then read/follow it.",
-        "- If none clearly apply: do not read any SKILL.md.",
-        "Skills encode expertise that improves output quality. Skipping them produces worse results even when the task seems simple.",
+        "- Only skip skills when the question is clearly unrelated to every skill description.",
+        "- When in doubt, read the skill — the cost of reading is low; the cost of missing relevant knowledge is high.",
+        "Skills encode expertise and knowledge sources that you do not have in your training data. Skipping them produces worse results even when the task seems simple.",
         "Constraints: never read more than one skill up front; only read after selecting.",
         trimmed,
         "",
@@ -28,6 +29,7 @@ function buildMemorySection(params) {
         "## Memory Recall",
         "Memory is your knowledge base — customer profiles, business data, preferences, prior interactions, lessons, and instructions all live there. Proactively use memory_search whenever a topic might have stored context: who a person is, what was discussed before, business rules, pricing, product details, or anything that could have been recorded. Do not rely on conversation history alone — it only covers the current session. Use memory_get to pull specific lines when you know the file. If a search returns no results, say you checked.",
         "Paths for memory_get and memory_write accept either form: `memory/public/data.md` or `public/data.md` — the `memory/` prefix is added automatically when missing. Never use read or skill_read for memory content.",
+        "If memory_search returns no useful results for a technical or platform question, check your skills — a skill may provide an alternative knowledge source (e.g. live documentation) before you give up.",
         "",
     ];
 }

package/dist/agents/taskmaster-tools.js

@@ -24,6 +24,8 @@ import { createCurrentTimeTool } from "./tools/current-time.js";
 import { createAuthorizeAdminTool, createListAdminsTool, createRevokeAdminTool, } from "./tools/authorize-admin-tool.js";
 import { createBootstrapCompleteTool } from "./tools/bootstrap-tool.js";
 import { createLicenseGenerateTool } from "./tools/license-tool.js";
+import { createSkillPackSignTool } from "./tools/skill-pack-sign-tool.js";
+import { createSkillPackInstallTool } from "./tools/skill-pack-install-tool.js";
 import { createContactCreateTool } from "./tools/contact-create-tool.js";
 import { createContactDeleteTool } from "./tools/contact-delete-tool.js";
 import { createFileDeleteTool } from "./tools/file-delete-tool.js";
@@ -158,6 +160,8 @@ export function createTaskmasterTools(options) {
         createListAdminsTool({ agentAccountId: options?.agentAccountId }),
         createBootstrapCompleteTool({ agentSessionKey: options?.agentSessionKey }),
         createLicenseGenerateTool(),
+        createSkillPackSignTool({ workspaceDir: options?.workspaceDir ?? "" }),
+        createSkillPackInstallTool({ workspaceDir: options?.workspaceDir ?? "" }),
         createContactCreateTool({ agentAccountId: options?.agentAccountId }),
         createContactDeleteTool({ agentAccountId: options?.agentAccountId }),
         createContactLookupTool({ agentAccountId: options?.agentAccountId }),

package/dist/agents/tool-policy.js

@@ -34,7 +34,7 @@ export const TOOL_GROUPS = {
     // Nodes + device tools
     "group:nodes": ["nodes"],
     // Skill management
-    "group:skills": ["skill_read", "skill_draft_save"],
+    "group:skills": ["skill_read", "skill_draft_save", "skill_pack_install"],
     // Contact record management
     "group:contacts": [
         "contact_create",
@@ -104,6 +104,7 @@ export const TOOL_GROUPS = {
         "logs_read",
         "network_settings",
         "wifi_settings",
+        "skill_pack_install",
     ],
 };
 // Tools that are never granted by profiles — must be explicitly added to the

package/dist/agents/tools/skill-pack-install-tool.js

@@ -0,0 +1,90 @@
+import fsp from "node:fs/promises";
+import path from "node:path";
+import { Type } from "@sinclair/typebox";
+import { jsonResult, readStringParam } from "./common.js";
+import { verifySkillPack, hasMarker, readMarker, writeMarker, } from "../../license/skill-pack.js";
+import { getDeviceId } from "../../license/device-id.js";
+import { callGatewayTool } from "./gateway.js";
+const SkillPackInstallSchema = Type.Object({
+    filePath: Type.String({
+        description: "Absolute path to the .skillpack.json file received as an attachment.",
+    }),
+});
+export function createSkillPackInstallTool(opts) {
+    return {
+        label: "Skill Pack Install",
+        name: "skill_pack_install",
+        description: "Install a signed skill pack (.skillpack.json) onto this device. " +
+            "Verifies the cryptographic signature and device binding before installing. " +
+            "Use this when a customer forwards a skill pack file to you.",
+        parameters: SkillPackInstallSchema,
+        execute: async (_toolCallId, args) => {
+            const params = args;
+            const filePath = readStringParam(params, "filePath", { required: true });
+            // Read and parse the pack file
+            let raw;
+            try {
+                const fileContent = await fsp.readFile(filePath, "utf-8");
+                raw = JSON.parse(fileContent);
+            }
+            catch {
+                throw new Error("Could not read or parse the skill pack file. " +
+                    "Make sure the file path is correct and the file is valid JSON.");
+            }
+            // Verify signature and structure
+            const result = verifySkillPack(raw);
+            if (!result.valid) {
+                throw new Error(result.message);
+            }
+            const { payload } = result;
+            // Check device binding
+            const localDeviceId = getDeviceId();
+            if (payload.device.did !== "*" && payload.device.did !== localDeviceId) {
+                throw new Error("This skill pack is licensed for a different device. " +
+                    "It cannot be installed on this device.");
+            }
+            // Check for existing marketplace skill
+            const skillDir = path.join(opts.workspaceDir, "skills", payload.pack.id);
+            if (hasMarker(skillDir)) {
+                const existing = await readMarker(skillDir);
+                if (existing && existing.version === payload.pack.version) {
+                    return jsonResult({
+                        ok: true,
+                        alreadyInstalled: true,
+                        packId: payload.pack.id,
+                        version: payload.pack.version,
+                        message: `${payload.pack.name} v${payload.pack.version} is already installed.`,
+                    });
+                }
+            }
+            // Install via skills.create gateway RPC
+            const references = payload.content.references.map((r) => ({
+                name: r.name,
+                content: r.content,
+            }));
+            await callGatewayTool("skills.create", {}, {
+                name: payload.pack.id,
+                skillContent: payload.content.skill,
+                ...(references.length > 0 ? { references } : {}),
+            });
+            // Write marker file
+            const marker = {
+                packId: payload.pack.id,
+                version: payload.pack.version,
+                author: payload.pack.author,
+                installedAt: new Date().toISOString(),
+                deviceId: payload.device.did,
+                customerId: payload.device.cid,
+            };
+            await writeMarker(skillDir, marker);
+            return jsonResult({
+                ok: true,
+                packId: payload.pack.id,
+                version: payload.pack.version,
+                name: payload.pack.name,
+                message: `Successfully installed ${payload.pack.name} v${payload.pack.version}. ` +
+                    `This skill is now available for use.`,
+            });
+        },
+    };
+}

package/dist/agents/tools/skill-pack-sign-tool.js

@@ -0,0 +1,91 @@
+import fsp from "node:fs/promises";
+import path from "node:path";
+import { Type } from "@sinclair/typebox";
+import { jsonResult, readStringParam } from "./common.js";
+import { signSkillPack } from "../../license/skill-pack.js";
+import { parseFrontmatter } from "../skills/frontmatter.js";
+const SkillPackSignSchema = Type.Object({
+    packId: Type.String({
+        description: "Skill pack ID — must match a directory name in the skill-packs/ folder of this workspace.",
+    }),
+    deviceId: Type.String({
+        description: "Target device ID (tm_dev_...) from the customer's contact record.",
+    }),
+    customerId: Type.String({
+        description: "Customer identifier from the contact record.",
+    }),
+    version: Type.Optional(Type.String({ description: 'Skill pack version (e.g. "1.0.0"). Defaults to "1.0.0".' })),
+});
+export function createSkillPackSignTool(opts) {
+    return {
+        label: "Skill Pack Sign",
+        name: "skill_pack_sign",
+        description: "Sign a skill pack for a specific customer device. Reads the skill template from " +
+            "skill-packs/<packId>/, signs it with the customer's device ID embedded, and writes " +
+            "the signed .skillpack.json file. Send the resulting file to the customer.",
+        parameters: SkillPackSignSchema,
+        execute: async (_toolCallId, args) => {
+            const params = args;
+            const packId = readStringParam(params, "packId", { required: true });
+            const deviceId = readStringParam(params, "deviceId", { required: true });
+            const customerId = readStringParam(params, "customerId", { required: true });
+            const version = readStringParam(params, "version") ?? "1.0.0";
+            if (!deviceId.startsWith("tm_dev_")) {
+                throw new Error(`Invalid device ID format: "${deviceId}". Device IDs start with "tm_dev_".`);
+            }
+            // Read skill template
+            const packDir = path.join(opts.workspaceDir, "skill-packs", packId);
+            const skillPath = path.join(packDir, "SKILL.md");
+            let skillContent;
+            try {
+                skillContent = await fsp.readFile(skillPath, "utf-8");
+            }
+            catch {
+                throw new Error(`Skill pack template not found: ${packId}. Expected SKILL.md at ${skillPath}`);
+            }
+            // Read references
+            const refsDir = path.join(packDir, "references");
+            const references = [];
+            try {
+                const refFiles = await fsp.readdir(refsDir);
+                for (const file of refFiles.sort()) {
+                    const content = await fsp.readFile(path.join(refsDir, file), "utf-8");
+                    references.push({ name: file, content });
+                }
+            }
+            catch {
+                // No references directory — that's fine
+            }
+            // Parse frontmatter for metadata
+            const frontmatter = parseFrontmatter(skillContent);
+            const name = frontmatter?.name ?? packId;
+            const description = frontmatter?.description ?? "";
+            // Build and sign payload
+            const payload = {
+                format: "skillpack-v1",
+                pack: { id: packId, version, name, description, author: "Rubytech LLC" },
+                device: { did: deviceId, cid: customerId },
+                content: { skill: skillContent, references },
+                signedAt: new Date().toISOString(),
+            };
+            const signed = signSkillPack(payload);
+            // Write signed file
+            const shortDid = deviceId.slice(0, 20);
+            const signedDir = path.join(opts.workspaceDir, "skill-packs", "signed");
+            await fsp.mkdir(signedDir, { recursive: true });
+            const outputPath = path.join(signedDir, `${packId}-${shortDid}.skillpack.json`);
+            await fsp.writeFile(outputPath, JSON.stringify(signed, null, 2), "utf-8");
+            return jsonResult({
+                ok: true,
+                filePath: outputPath,
+                packId,
+                version,
+                deviceId,
+                customerId,
+                message: `Signed skill pack "${name}" v${version} for device ${deviceId}. ` +
+                    `File saved to ${outputPath}. Send this file to the customer with instructions ` +
+                    `to forward it to their admin agent and ask it to install.`,
+            });
+        },
+    };
+}

package/dist/build-info.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.19.1",
-  "commit": "30511004b7e6a6d7a2e6bc573cacd5eedf07620c",
-  "builtAt": "2026-03-06T14:26:40.923Z"
+  "version": "1.20.0",
+  "commit": "2e49941c12d70d4e6618e5d40e5291beb58c0420",
+  "builtAt": "2026-03-06T19:10:34.821Z"
 }