@rubytech/taskmaster 1.19.8 → 1.20.0

package/dist/agents/skills/workspace.js

@@ -7,6 +7,7 @@ import { resolveBundledSkillsDir } from "./bundled-dir.js";
 import { shouldIncludeSkill } from "./config.js";
 import { parseFrontmatter, resolveTaskmasterMetadata, resolveSkillInvocationPolicy, } from "./frontmatter.js";
 import { resolvePluginSkillDirs } from "./plugin-skills.js";
+import { hasMarker } from "../../license/skill-pack.js";
 import { serializeByKey } from "./serialize.js";
 const fsp = fs.promises;
 const skillsLogger = createSubsystemLogger("skills");
@@ -333,6 +334,9 @@ export async function syncBundledSkillsToWorkspace(workspaceDir, opts) {
     for (const name of entries) {
         const dest = path.join(targetSkillsDir, name);
         const exists = fs.existsSync(dest);
+        // Never overwrite marketplace-installed skills with bundled versions
+        if (exists && hasMarker(dest))
+            continue;
         if (exists && !FORCE_RESYNC_SKILLS.has(name))
             continue;
         try {

package/dist/agents/skills-status.js

@@ -1,6 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { CONFIG_DIR } from "../utils.js";
+import { hasMarker } from "../license/skill-pack.js";
 import { hasBinary, isBundledSkillAllowed, isConfigPathTruthy, loadWorkspaceSkillEntries, resolveBundledAllowlist, resolveBundledSkillsDir, resolveConfigPath, resolveSkillConfig, resolveSkillsInstallPreferences, } from "./skills.js";
 function resolveSkillKey(entry) {
     return entry.taskmaster?.skillKey ?? entry.skill.name;
@@ -148,6 +149,18 @@ function buildSkillStatus(entry, config, prefs, eligibility, bundledSkillNames)
                 missing.config.length === 0 &&
                 missing.os.length === 0));
     const preloaded = bundledSkillNames ? bundledSkillNames.has(entry.skill.name) : false;
+    const isMarketplace = hasMarker(entry.skill.baseDir);
+    let marketplaceVersion;
+    if (isMarketplace) {
+        try {
+            const markerContent = fs.readFileSync(path.join(entry.skill.baseDir, ".skillpack"), "utf-8");
+            const marker = JSON.parse(markerContent);
+            marketplaceVersion = typeof marker.version === "string" ? marker.version : undefined;
+        }
+        catch {
+            // Marker exists but unreadable
+        }
+    }
     return {
         name: entry.skill.name,
         description: entry.skill.description,
@@ -164,6 +177,8 @@ function buildSkillStatus(entry, config, prefs, eligibility, bundledSkillNames)
         blockedByAllowlist,
         eligible,
         preloaded,
+        marketplace: isMarketplace,
+        marketplaceVersion,
         requirements: {
             bins: requiredBins,
             anyBins: requiredAnyBins,

package/dist/agents/taskmaster-tools.js

@@ -24,6 +24,8 @@ import { createCurrentTimeTool } from "./tools/current-time.js";
 import { createAuthorizeAdminTool, createListAdminsTool, createRevokeAdminTool, } from "./tools/authorize-admin-tool.js";
 import { createBootstrapCompleteTool } from "./tools/bootstrap-tool.js";
 import { createLicenseGenerateTool } from "./tools/license-tool.js";
+import { createSkillPackSignTool } from "./tools/skill-pack-sign-tool.js";
+import { createSkillPackInstallTool } from "./tools/skill-pack-install-tool.js";
 import { createContactCreateTool } from "./tools/contact-create-tool.js";
 import { createContactDeleteTool } from "./tools/contact-delete-tool.js";
 import { createFileDeleteTool } from "./tools/file-delete-tool.js";
@@ -158,6 +160,8 @@ export function createTaskmasterTools(options) {
         createListAdminsTool({ agentAccountId: options?.agentAccountId }),
         createBootstrapCompleteTool({ agentSessionKey: options?.agentSessionKey }),
         createLicenseGenerateTool(),
+        createSkillPackSignTool({ workspaceDir: options?.workspaceDir ?? "" }),
+        createSkillPackInstallTool({ workspaceDir: options?.workspaceDir ?? "" }),
         createContactCreateTool({ agentAccountId: options?.agentAccountId }),
         createContactDeleteTool({ agentAccountId: options?.agentAccountId }),
         createContactLookupTool({ agentAccountId: options?.agentAccountId }),

package/dist/agents/tool-policy.js

@@ -34,7 +34,7 @@ export const TOOL_GROUPS = {
     // Nodes + device tools
     "group:nodes": ["nodes"],
     // Skill management
-    "group:skills": ["skill_read", "skill_draft_save"],
+    "group:skills": ["skill_read", "skill_draft_save", "skill_pack_install"],
     // Contact record management
     "group:contacts": [
         "contact_create",
@@ -104,6 +104,7 @@ export const TOOL_GROUPS = {
         "logs_read",
         "network_settings",
         "wifi_settings",
+        "skill_pack_install",
     ],
 };
 // Tools that are never granted by profiles — must be explicitly added to the

package/dist/agents/tools/skill-pack-install-tool.js

@@ -0,0 +1,90 @@
+import fsp from "node:fs/promises";
+import path from "node:path";
+import { Type } from "@sinclair/typebox";
+import { jsonResult, readStringParam } from "./common.js";
+import { verifySkillPack, hasMarker, readMarker, writeMarker, } from "../../license/skill-pack.js";
+import { getDeviceId } from "../../license/device-id.js";
+import { callGatewayTool } from "./gateway.js";
+const SkillPackInstallSchema = Type.Object({
+    filePath: Type.String({
+        description: "Absolute path to the .skillpack.json file received as an attachment.",
+    }),
+});
+export function createSkillPackInstallTool(opts) {
+    return {
+        label: "Skill Pack Install",
+        name: "skill_pack_install",
+        description: "Install a signed skill pack (.skillpack.json) onto this device. " +
+            "Verifies the cryptographic signature and device binding before installing. " +
+            "Use this when a customer forwards a skill pack file to you.",
+        parameters: SkillPackInstallSchema,
+        execute: async (_toolCallId, args) => {
+            const params = args;
+            const filePath = readStringParam(params, "filePath", { required: true });
+            // Read and parse the pack file
+            let raw;
+            try {
+                const fileContent = await fsp.readFile(filePath, "utf-8");
+                raw = JSON.parse(fileContent);
+            }
+            catch {
+                throw new Error("Could not read or parse the skill pack file. " +
+                    "Make sure the file path is correct and the file is valid JSON.");
+            }
+            // Verify signature and structure
+            const result = verifySkillPack(raw);
+            if (!result.valid) {
+                throw new Error(result.message);
+            }
+            const { payload } = result;
+            // Check device binding
+            const localDeviceId = getDeviceId();
+            if (payload.device.did !== "*" && payload.device.did !== localDeviceId) {
+                throw new Error("This skill pack is licensed for a different device. " +
+                    "It cannot be installed on this device.");
+            }
+            // Check for existing marketplace skill
+            const skillDir = path.join(opts.workspaceDir, "skills", payload.pack.id);
+            if (hasMarker(skillDir)) {
+                const existing = await readMarker(skillDir);
+                if (existing && existing.version === payload.pack.version) {
+                    return jsonResult({
+                        ok: true,
+                        alreadyInstalled: true,
+                        packId: payload.pack.id,
+                        version: payload.pack.version,
+                        message: `${payload.pack.name} v${payload.pack.version} is already installed.`,
+                    });
+                }
+            }
+            // Install via skills.create gateway RPC
+            const references = payload.content.references.map((r) => ({
+                name: r.name,
+                content: r.content,
+            }));
+            await callGatewayTool("skills.create", {}, {
+                name: payload.pack.id,
+                skillContent: payload.content.skill,
+                ...(references.length > 0 ? { references } : {}),
+            });
+            // Write marker file
+            const marker = {
+                packId: payload.pack.id,
+                version: payload.pack.version,
+                author: payload.pack.author,
+                installedAt: new Date().toISOString(),
+                deviceId: payload.device.did,
+                customerId: payload.device.cid,
+            };
+            await writeMarker(skillDir, marker);
+            return jsonResult({
+                ok: true,
+                packId: payload.pack.id,
+                version: payload.pack.version,
+                name: payload.pack.name,
+                message: `Successfully installed ${payload.pack.name} v${payload.pack.version}. ` +
+                    `This skill is now available for use.`,
+            });
+        },
+    };
+}

package/dist/agents/tools/skill-pack-sign-tool.js

@@ -0,0 +1,91 @@
+import fsp from "node:fs/promises";
+import path from "node:path";
+import { Type } from "@sinclair/typebox";
+import { jsonResult, readStringParam } from "./common.js";
+import { signSkillPack } from "../../license/skill-pack.js";
+import { parseFrontmatter } from "../skills/frontmatter.js";
+const SkillPackSignSchema = Type.Object({
+    packId: Type.String({
+        description: "Skill pack ID — must match a directory name in the skill-packs/ folder of this workspace.",
+    }),
+    deviceId: Type.String({
+        description: "Target device ID (tm_dev_...) from the customer's contact record.",
+    }),
+    customerId: Type.String({
+        description: "Customer identifier from the contact record.",
+    }),
+    version: Type.Optional(Type.String({ description: 'Skill pack version (e.g. "1.0.0"). Defaults to "1.0.0".' })),
+});
+export function createSkillPackSignTool(opts) {
+    return {
+        label: "Skill Pack Sign",
+        name: "skill_pack_sign",
+        description: "Sign a skill pack for a specific customer device. Reads the skill template from " +
+            "skill-packs/<packId>/, signs it with the customer's device ID embedded, and writes " +
+            "the signed .skillpack.json file. Send the resulting file to the customer.",
+        parameters: SkillPackSignSchema,
+        execute: async (_toolCallId, args) => {
+            const params = args;
+            const packId = readStringParam(params, "packId", { required: true });
+            const deviceId = readStringParam(params, "deviceId", { required: true });
+            const customerId = readStringParam(params, "customerId", { required: true });
+            const version = readStringParam(params, "version") ?? "1.0.0";
+            if (!deviceId.startsWith("tm_dev_")) {
+                throw new Error(`Invalid device ID format: "${deviceId}". Device IDs start with "tm_dev_".`);
+            }
+            // Read skill template
+            const packDir = path.join(opts.workspaceDir, "skill-packs", packId);
+            const skillPath = path.join(packDir, "SKILL.md");
+            let skillContent;
+            try {
+                skillContent = await fsp.readFile(skillPath, "utf-8");
+            }
+            catch {
+                throw new Error(`Skill pack template not found: ${packId}. Expected SKILL.md at ${skillPath}`);
+            }
+            // Read references
+            const refsDir = path.join(packDir, "references");
+            const references = [];
+            try {
+                const refFiles = await fsp.readdir(refsDir);
+                for (const file of refFiles.sort()) {
+                    const content = await fsp.readFile(path.join(refsDir, file), "utf-8");
+                    references.push({ name: file, content });
+                }
+            }
+            catch {
+                // No references directory — that's fine
+            }
+            // Parse frontmatter for metadata
+            const frontmatter = parseFrontmatter(skillContent);
+            const name = frontmatter?.name ?? packId;
+            const description = frontmatter?.description ?? "";
+            // Build and sign payload
+            const payload = {
+                format: "skillpack-v1",
+                pack: { id: packId, version, name, description, author: "Rubytech LLC" },
+                device: { did: deviceId, cid: customerId },
+                content: { skill: skillContent, references },
+                signedAt: new Date().toISOString(),
+            };
+            const signed = signSkillPack(payload);
+            // Write signed file
+            const shortDid = deviceId.slice(0, 20);
+            const signedDir = path.join(opts.workspaceDir, "skill-packs", "signed");
+            await fsp.mkdir(signedDir, { recursive: true });
+            const outputPath = path.join(signedDir, `${packId}-${shortDid}.skillpack.json`);
+            await fsp.writeFile(outputPath, JSON.stringify(signed, null, 2), "utf-8");
+            return jsonResult({
+                ok: true,
+                filePath: outputPath,
+                packId,
+                version,
+                deviceId,
+                customerId,
+                message: `Signed skill pack "${name}" v${version} for device ${deviceId}. ` +
+                    `File saved to ${outputPath}. Send this file to the customer with instructions ` +
+                    `to forward it to their admin agent and ask it to install.`,
+            });
+        },
+    };
+}

package/dist/build-info.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.19.8",
-  "commit": "2776d5020a5836fa4ff5de337d0a4ba51e239d95",
-  "builtAt": "2026-03-06T16:01:44.873Z"
+  "version": "1.20.0",
+  "commit": "2e49941c12d70d4e6618e5d40e5291beb58c0420",
+  "builtAt": "2026-03-06T19:10:34.821Z"
 }