@sellable/install 0.1.751 → 0.1.752

package/lib/sellable-agent/default-profile-bundle.mjs

@@ -30,6 +30,21 @@ const MAX_FILE_BYTES = 64 * 1024;
 const MAX_FRAGMENT_BYTES = 192 * 1024;
 const MAX_TOTAL_BYTES = 1024 * 1024;
 
+function readNativeSkillName(content) {
+  const lines = content.split("\n");
+  if (lines[0] !== "---") reject("skill_frontmatter_rejected");
+  const end = lines.indexOf("---", 1);
+  if (end < 2) reject("skill_frontmatter_rejected");
+  const names = lines
+    .slice(1, end)
+    .map((line) => /^name:\s*([a-z0-9][a-z0-9-]{0,63})\s*$/.exec(line)?.[1])
+    .filter(Boolean);
+  if (names.length !== 1 || !ID.test(names[0])) {
+    reject("skill_frontmatter_rejected");
+  }
+  return names[0];
+}
+
 function sha256(value) {
   return createHash("sha256").update(value).digest("hex");
 }
@@ -200,7 +215,9 @@ function normalizeFile(value, fragmentKind) {
     kind: fragmentKind,
     path: value.path,
     mode: value.mode,
-    ...(value.type === "cron" ? { name: value.name } : {}),
+    ...(value.type === "cron"
+      ? { name: value.name }
+      : { nativeName: readNativeSkillName(value.content) }),
     content: value.content,
     sha256: sha256(bytes),
   });
@@ -282,6 +299,11 @@ export function buildDefaultProfileBundle({
     new Set(files.map((file) => file.path)).size !== files.length ||
     new Set(files.filter((file) => file.type === "skill").map((file) => file.id))
       .size !== files.filter((file) => file.type === "skill").length ||
+    new Set(
+      files
+        .filter((file) => file.type === "skill")
+        .map((file) => file.nativeName)
+    ).size !== files.filter((file) => file.type === "skill").length ||
     new Set(files.filter((file) => file.type === "cron").map((file) => file.name))
       .size !== files.filter((file) => file.type === "cron").length
   ) {

package/lib/sellable-agent/default-profile-reconciler.mjs

@@ -359,6 +359,7 @@ function readBundle(bundleRoot) {
       entry.mode !== "0444" ||
       entry.path !== expectedPath ||
       !SHA256.test(entry.sha256 ?? "") ||
+      (entry.type === "skill" && !MANAGED_ID.test(entry.nativeName ?? "")) ||
       (entry.type === "cron" &&
         (!MANAGED_ID.test(entry.name ?? "") ||
           !entry.name.startsWith("sellable-default-")))
@@ -588,7 +589,12 @@ export async function reconcileDefaultProfileBundle({
               if (sha256(readRegular(plan.path, 64 * 1024)) !== entry.sha256)
                 throw new Error("default_profile_skill_readback_rejected");
             }
-            actions.push({ type: "skill", id: entry.id, status: plan.status });
+            actions.push({
+              type: "skill",
+              id: entry.id,
+              nativeName: entry.nativeName,
+              status: plan.status,
+            });
             receiptEntries.push({
               type: "skill",
               id: entry.id,

package/lib/sellable-agent/fly-admin-image/Dockerfile

@@ -43,7 +43,7 @@ ARG STRIPE_CLI_PACKAGE=@stripe/cli-linux-x64@1.45.0
 ARG STRIPE_CLI_INTEGRITY=sha512-1ZhoPpoweYfynqsvhCLlTjZ7lPz5IKtxqAMT5MBy6zrwLRTP9x0T6r8h/jLYL8lRH1c7zC/6X6/XUu2V+r9Bog==
 ARG DEFAULT_PROFILE_BUNDLE_FIXTURE_VERSION=1
 ARG DEFAULT_PROFILE_BUNDLE_VERSION=3
-ARG DEFAULT_PROFILE_BUNDLE_DIGEST=8030143cc1a10928564511f24d44643bd697d573332324c5d9a7a32d4fdbaf85
+ARG DEFAULT_PROFILE_BUNDLE_DIGEST=197fb4ed5a60cd1a3a06a46aa1fc53a04bb1e6c1f872e96a0ce2cc28bf2856de
 
 COPY --from=slack-pp-cli-builder --chmod=0555 /out/slack-pp-cli /usr/local/bin/slack-pp-cli
 

package/lib/sellable-agent/fly-customer-image/Dockerfile

@@ -21,7 +21,7 @@ ARG PLAYWRIGHT_BROWSER_REVISION=1234
 ARG TIRITH_ARCHIVE_SHA256=6cdbe35e8f9ccf42e70ad95b501c93cd218ac18201c3df958d54f6ba0d995ce2
 ARG DEFAULT_PROFILE_BUNDLE_FIXTURE_VERSION=1
 ARG DEFAULT_PROFILE_BUNDLE_VERSION=3
-ARG DEFAULT_PROFILE_BUNDLE_DIGEST=7e8e6ff740f11aaaa3d6da2e9f067a66866d259ac4233036ff691dae973ce5f3
+ARG DEFAULT_PROFILE_BUNDLE_DIGEST=301ed49582dbfb29453ff2c2fa26579da6771d19f58e12218c5400db2e14318d
 
 RUN --mount=type=secret,id=mcp_trust_root,required=true \
     test -s /run/secrets/mcp_trust_root \

package/lib/sellable-agent/fly-skills-bridge.mjs

@@ -1041,7 +1041,7 @@ export function executeExternalSkillsBridgeOperation(
 
 /**
  * @param {{
- *   actions?: Array<{type: string, id: string}>,
+ *   actions?: Array<{type: string, id: string, nativeName?: string}>,
  *   profileId?: string,
  *   dataRoot?: string,
  *   bridge?: typeof executeExternalSkillsBridgeOperation,
@@ -1062,17 +1062,27 @@ export function proveDefaultProfileNativeSkills({
     callerProfileId: profileId,
     ...(nativeCallTimeoutMs === undefined ? {} : { nativeCallTimeoutMs }),
   };
+  for (const action of managed) {
+    if (!SAFE_NAME.test(action.nativeName ?? ""))
+      fail("default_profile_native_skill_name_missing");
+  }
   const inventory = bridge({ operation: "list" }, options);
   const proofs = managed.map((action) => {
-    const skill = inventory.skills.find((entry) => entry.name === action.id);
+    const skill = inventory.skills.find(
+      (entry) => entry.name === action.nativeName
+    );
     if (!skill) fail("default_profile_native_skill_missing");
     const viewed = bridge(
       { operation: "read", skillId: skill.skillId },
       options
     );
-    if (!viewed.ok || viewed.skill?.name !== action.id)
+    if (!viewed.ok || viewed.skill?.name !== action.nativeName)
       fail("default_profile_native_skill_readback_rejected");
-    return { id: action.id, fileSha256: viewed.fileSha256 };
+    return {
+      id: action.id,
+      nativeName: action.nativeName,
+      fileSha256: viewed.fileSha256,
+    };
   });
   return { status: "PROVEN", digest: sha256(stableJson(proofs)) };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sellable/install",
-  "version": "0.1.751",
+  "version": "0.1.752",
   "type": "module",
   "description": "One-command installer for Sellable MCP in Claude Code, Codex, and Hermes",
   "bin": {