@skaile/workspaces 0.32.0 → 0.34.0

package/CHANGELOG.md

@@ -1,5 +1,108 @@
 # Changelog
 
+## 0.34.0
+
+### Minor Changes
+
+- [#134](https://github.com/skaile-ai/workspaces/pull/134) [`4dc5050`](https://github.com/skaile-ai/workspaces/commit/4dc5050eeafa3ea0e28c857a732df57d6a7bad2d) Thanks [@peteralbert](https://github.com/peteralbert)! - Add a health-aware read-only gate for fleet-managed mounts (B-180). A fleet
+  mount is bound live by the host fleet rclone and so is excluded from the
+  boot-time no-phantom-workspace barrier; that exclusion is only safe while the
+  fleet rclone is healthy. When it wedges (`EIO`, or a silently-empty-but-writable
+  degradation), `FleetHealthGate` now dynamically establishes the same
+  `MountPlaceholderBarrier` over the live target until the mount recovers,
+  closing the window where a wedged fleet mount would let the agent write a
+  divergent phantom workspace.
+
+  Two detectors feed one debounced, fail-closed gate: a self-contained local
+  `stat`/`readdir` probe (catches EIO / dead-bind) and a platform health signal
+  consumed from `<workspace>/.skaile/fleet-health/<id>` via the new
+  `ConnectorManager.reportFleetHealth(id, verdict)` (catches silent degradation).
+  Healthy fleet mounts stay writable exactly as before. Poll interval is
+  `SKAILE_FLEET_HEALTH_POLL_MS` (default 5000; 0 disables the local probe). See
+  `MIGRATION.md` for the optional platform emit-side contract.
+
+- [#135](https://github.com/skaile-ai/workspaces/pull/135) [`6cc1a07`](https://github.com/skaile-ai/workspaces/commit/6cc1a073f73a56ae0ed5128ecc294f95b312bd6d) Thanks [@peteralbert](https://github.com/peteralbert)! - Runner-managed remote MCP servers now recover from a mid-session 401. When a
+  tool call (or the initial connect) on an `auth: backend` http/sse MCP server is
+  rejected with a 401, `ExternalMcpManager` re-mints the bearer through the
+  platform mediator (`host.refresh_credential { kind: 'mcp-server', reason:
+'retry-401' }`), rewrites the provisioned `MCP__<id>__AUTH` secret, rebuilds the
+  transport, and reconnects the client in place — then retries the call once.
+  Concurrent 401s for the same server share one re-mint round-trip (per-server
+  in-flight gate), and capability registrations stay stable across the swap.
+
+  `McpServerDeclaration` gains two optional fields — `auth` and `providerLinkId` —
+  modelling the remote-server credential metadata the platform already writes into
+  `mcp_servers` entries (additive; existing declarations are unaffected).
+
+  Pairs with the platform's real remote-MCP OAuth token-endpoint refresh.
+
+## 0.33.0
+
+### Minor Changes
+
+- [#133](https://github.com/skaile-ai/workspaces/pull/133) [`c8cae51`](https://github.com/skaile-ai/workspaces/commit/c8cae51e909f1d1bc98cc8eab646083a5d29e9c5) Thanks [@peteralbert](https://github.com/peteralbert)! - Retire the `SKAILE_STRICT_YAML` flag — strict asset loading is now the only
+  behavior. The runner activates ONLY `skaile.yaml`-declared assets;
+  materialized-but-undeclared on-disk MCP servers and skills ("ghosts") are never
+  picked up. Previously this was opt-in (default off) but production agent
+  containers always set the flag, so production behavior is unchanged — this just
+  makes the canonical-contract invariant hold unconditionally and removes the last
+  Sprint-1 loose end.
+
+  - `loadMcpServerDeclarations` no longer reads `process.env.SKAILE_STRICT_YAML`;
+    `upsertMaterializedMcpDecls` always filters by the declared set.
+  - `stageMaterializedSkills`'s `opts.strict` boolean is dropped — filtering is now
+    driven by the presence of `opts.declared` (when omitted, the scan stages all,
+    for non-runner utility callers). The runner (`serve.ts`) always passes the
+    declared skill set.
+
+  See `MIGRATION.md`. No action for the platform (it already writes the full
+  effective set and set the flag).
+
+- [#133](https://github.com/skaile-ai/workspaces/pull/133) [`c8cae51`](https://github.com/skaile-ai/workspaces/commit/c8cae51e909f1d1bc98cc8eab646083a5d29e9c5) Thanks [@peteralbert](https://github.com/peteralbert)! - Align the `runner.lifecycle` capability with the platform's wire shape and wire
+  its handler to real operations. The cap previously declared
+  `{ action: 'hibernate' | 'close' | 'shutdown' }` but the platform invokes it with
+  `{ phase: 'compact' | 'hibernate' | 'close' }` — so every lifecycle invoke
+  Zod-rejected (key `action`≠`phase`, value `compact` ∉ enum) and, even had it
+  parsed, the handler was an unimplemented stub. Hibernate/compact signaling to
+  connectors therefore never fired (silently, since the platform sites are
+  non-fatal).
+
+  The canonical contract is now `{ phase: 'hibernate' | 'close' | 'compact' }`
+  (`shutdown` was never sent and is dropped). The handler is wired via the new
+  `buildLifecycleHandler` factory: `compact` runs the compaction orchestrator
+  (`trigger: 'manual'`), `hibernate` runs `ConnectorManager.hibernateAll()`
+  (`onHibernate` persistence), `close` runs `ConnectorManager.closeAll()`
+  (`onSessionClose` finalization). A runner-side contract test pins the schema to
+  the platform payloads so the two halves can't re-drift.
+
+  No consumer action: the platform already sends the `{ phase }` shape, so shipping
+  this runner build simply makes lifecycle signaling work instead of failing
+  silently.
+
+### Patch Changes
+
+- [#130](https://github.com/skaile-ai/workspaces/pull/130) [`3fb8f8e`](https://github.com/skaile-ai/workspaces/commit/3fb8f8ea7fd7bc6b68d36bf11764f6786e178f7a) Thanks [@peteralbert](https://github.com/peteralbert)! - Fix: claude-sdk driver now authenticates API-key provider configs.
+
+  The `claude-sdk` bridge driver passed a resolved Anthropic API key to the Claude
+  Agent SDK as the top-level `query({ apiKey })` argument, which the SDK ignores —
+  it authenticates only via the `ANTHROPIC_API_KEY` environment variable or an
+  OAuth credentials file. As a result, any cloud session backed by an `ApiToken`
+  AI-provider config silently fell back to OAuth login mode and failed with
+  "Not logged in" (no creds file) or "401 Invalid authentication credentials"
+  (stale creds file) — the provisioned key was never used.
+
+  `startQuery()` now injects the resolved key into the SDK child-process env
+  (`options.env.ANTHROPIC_API_KEY`, spread over the current env so PATH/HOME are
+  preserved) whenever an API key is configured. The OAuth path is unchanged: when
+  no key is resolved, no env key is set and the SDK uses `~/.claude/.credentials.json`
+  via `settingSources: ["user"]`.
+
+- [#128](https://github.com/skaile-ai/workspaces/pull/128) [`ea2c155`](https://github.com/skaile-ai/workspaces/commit/ea2c15590a22c15ace392b5e06d1ec133a3d49ab) Thanks [@peteralbert](https://github.com/peteralbert)! - Proactive + reactive OAuth token refresh for rclone-backed mounts (sharepoint / onedrive / webdav).
+
+  rclone-backed mount drivers baked a single access token into the rclone INI at `connect()` and never refreshed it. For Skaile-managed Entra links the backend strips the `client_secret` so rclone cannot self-refresh, so the access token expired ~1h after spawn and every read/write failed with `EIO` (`invalid_client`). Git mounts and AI credentials already had a refresh mechanism; this brings rclone mounts to parity.
+
+  `@skaile/workspaces/connectors` gains `createRcloneTokenRefresh` — a per-mount controller that arms a proactive timer firing `marginMs` (5 min) before token expiry, re-mints through the backend `TokenMediator`, re-renders the INI, and recycles the rclone process via the new `RcloneProcessManager.reconfigure(handle, config)`. A reactive `onAuthError()` hook — fed by rclone's own auth-failure log lines (`invalid_client` / `couldn't fetch token` / `InvalidAuthenticationToken`), detected in `_routeRcloneLogLine` via the new `RcloneSpawnConfig.onAuthError` — is the safety net, guarded by an in-flight lock + cooldown. New `resolveMountCredential(declaration, secrets, tokenMediator, reason)` returns `{ token, expiresAt }`; `resolveMountCredentialString` now delegates to it. Standalone `env:`/inline auth (no mediator, no expiry) stays static — no refresh armed.
+
 ## 0.32.0
 
 ### Minor Changes

package/dist/{asset-feeds-2LQIGNUF.js → asset-feeds-6R2C2NHB.js}

@@ -1,6 +1,6 @@
-import './chunk-7WHBI3I6.js';
-import './chunk-SN2RWSB3.js';
-import { scanRepo } from './chunk-DTJNHYFE.js';
+import './chunk-DVIIYYD5.js';
+import './chunk-2VM62DX7.js';
+import { scanRepo } from './chunk-E5VRPYUX.js';
 import './chunk-H5YXL4KI.js';
 import './chunk-4AGIEU7V.js';
 import './chunk-LFDZYCEO.js';
@@ -17,7 +17,7 @@ async function libraryAssets() {
   const notes = [];
   try {
     const [{ openLibraryManager }, { skaileHomeDir }] = await Promise.all([
-      import('./open-library-XZZXXVBP.js'),
+      import('./open-library-GPZUB7N3.js'),
       import('./library/index.js')
     ]);
     const { manager, close } = await openLibraryManager();
@@ -46,7 +46,7 @@ async function libraryAssets() {
 async function storeAssets(projectDir) {
   const notes = [];
   try {
-    const { resolveCatalogSource } = await import('./open-library-XZZXXVBP.js');
+    const { resolveCatalogSource } = await import('./open-library-GPZUB7N3.js');
     const { source, close } = await resolveCatalogSource({ projectDir });
     try {
       const assets = await source.listAssets();
@@ -94,5 +94,5 @@ async function gatherAssetFeeds(am, projectDir) {
 }
 
 export { gatherAssetFeeds };
-//# sourceMappingURL=asset-feeds-2LQIGNUF.js.map
-//# sourceMappingURL=asset-feeds-2LQIGNUF.js.map
+//# sourceMappingURL=asset-feeds-6R2C2NHB.js.map
+//# sourceMappingURL=asset-feeds-6R2C2NHB.js.map

package/dist/{asset-feeds-2LQIGNUF.js.map → asset-feeds-6R2C2NHB.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../cli/src/asset-feeds.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAmDA,eAAe,aAAA,GAAyE;AACtF,EAAA,MAAM,QAAoB,EAAC;AAC3B,EAAA,IAAI;AACF,IAAA,MAAM,CAAC,EAAE,kBAAA,EAAmB,EAAG,EAAE,eAAe,CAAA,GAAI,MAAM,OAAA,CAAQ,GAAA,CAAI;AAAA,MACpE,OAAO,4BAAmB,CAAA;AAAA,MAC1B,OAAO,oBAA4B;AAAA,KACpC,CAAA;AACD,IAAA,MAAM,EAAE,OAAA,EAAS,KAAA,EAAM,GAAI,MAAM,kBAAA,EAAmB;AACpD,IAAA,IAAI;AACF,MAAA,MAAM,UAAA,GAAkB,IAAA,CAAA,IAAA,CAAK,aAAA,EAAc,EAAG,SAAS,CAAA;AACvD,MAAA,MAAM,IAAA,GAAA,CAAQ,MAAM,OAAA,CAAQ,aAAA,EAAc,EAAG,MAAA,CAAO,CAAC,CAAA,KAAM,CAAC,CAAA,CAAE,IAAA,CAAK,UAAA,CAAW,UAAU,CAAC,CAAA;AACzF,MAAA,MAAM,UAA0B,EAAC;AACjC,MAAA,KAAA,MAAW,OAAO,IAAA,EAAM;AACtB,QAAA,IAAI,CAAC,UAAA,CAAW,GAAA,CAAI,IAAI,CAAA,EAAG;AAC3B,QAAA,KAAA,MAAW,CAAA,IAAK,SAAS,GAAA,CAAI,IAAA,EAAM,WAAW,GAAA,CAAI,IAAI,EAAE,CAAA,EAAG;AACzD,UAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,QAChB;AAAA,MACF;AACA,MAAA,OAAO,EAAE,SAAS,KAAA,EAAM;AAAA,IAC1B,CAAA,SAAE;AACA,MAAA,KAAA,EAAM;AAAA,IACR;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,KAAA,CAAM,IAAA,CAAK;AAAA,MACT,IAAA,EAAM,WAAA;AAAA,MACN,SAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG;AAAA,KACzD,CAAA;AACD,IAAA,OAAO,EAAE,OAAA,EAAS,EAAC,EAAG,KAAA,EAAM;AAAA,EAC9B;AACF;AAYA,eAAe,YAAY,UAAA,EAGxB;AACD,EAAA,MAAM,QAAoB,EAAC;AAC3B,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,oBAAA,EAAqB,GAAI,MAAM,OAAO,4BAAmB,CAAA;AACjE,IAAA,MAAM,EAAE,QAAQ,KAAA,EAAM,GAAI,MAAM,oBAAA,CAAqB,EAAE,YAAY,CAAA;AACnE,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,UAAA,EAAW;AACvC,MAAA,MAAM,OAAA,GAA0B,MAAA,CAAO,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,QACjD,MAAM,CAAA,CAAE,IAAA;AAAA,QACR,IAAA,EAAO,EAAE,IAAA,IAAsB,OAAA;AAAA,QAC/B,WAAA,EAAa,EAAE,WAAA,IAAe,EAAA;AAAA,QAC9B,MAAA,EAAQ,CAAA,QAAA,EAAW,CAAA,CAAE,EAAE,CAAA,CAAA;AAAA,QACvB,WAAW,CAAA,CAAE,SAAA;AAAA,QACb,MAAM,CAAA,CAAE,IAAA;AAAA,QACR,YAAY,CAAA,CAAE,UAAA;AAAA,QACd,UAAU,CAAA,CAAE,QAAA;AAAA,QACZ,SAAS,CAAA,CAAE,OAAA;AAAA,QACX,UAAU,EAAC;AAAA,QACX,cAAc;AAAC,OACjB,CAAE,CAAA;AACF,MAAA,OAAO,EAAE,SAAS,KAAA,EAAM;AAAA,IAC1B,CAAA,SAAE;AACA,MAAA,KAAA,EAAM;AAAA,IACR;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,MAAM,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAG3D,IAAA,IAAI,CAAC,QAAA,CAAS,IAAA,CAAK,GAAG,CAAA,EAAG;AACvB,MAAA,KAAA,CAAM,KAAK,EAAE,IAAA,EAAM,OAAA,EAAS,OAAA,EAAS,KAAK,CAAA;AAAA,IAC5C;AACA,IAAA,OAAO,EAAE,OAAA,EAAS,EAAC,EAAG,KAAA,EAAM;AAAA,EAC9B;AACF;AAQA,SAAS,aAAa,EAAA,EAAsD;AAC1E,EAAA,OAAO,GAAG,MAAA,EAAO;AACnB;AAGA,SAAS,GAAA,CAAI,QAAqB,OAAA,EAAwC;AACxE,EAAA,OAAO,QAAQ,GAAA,CAAI,CAAC,WAAW,EAAE,MAAA,EAAQ,OAAM,CAAE,CAAA;AACnD;AAQA,eAAsB,gBAAA,CACpB,IACA,UAAA,EAC0B;AAC1B,EAAA,MAAM,CAAC,IAAA,EAAM,KAAK,CAAA,GAAI,MAAM,OAAA,CAAQ,GAAA,CAAI,CAAC,aAAA,EAAc,EAAG,WAAA,CAAY,UAAU,CAAC,CAAC,CAAA;AAClF,EAAA,OAAO;AAAA,IACL,OAAA,EAAS;AAAA,MACP,GAAG,GAAA,CAAI,QAAA,EAAU,YAAA,CAAa,EAAE,CAAC,CAAA;AAAA,MACjC,GAAG,GAAA,CAAI,SAAA,EAAW,IAAA,CAAK,OAAO,CAAA;AAAA,MAC9B,GAAG,GAAA,CAAI,OAAA,EAAS,KAAA,CAAM,OAAO;AAAA,KAC/B;AAAA,IACA,OAAO,CAAC,GAAG,KAAK,KAAA,EAAO,GAAG,MAAM,KAAK;AAAA,GACvC;AACF","file":"asset-feeds-2LQIGNUF.js","sourcesContent":["/**\n * asset-feeds.ts — gather installable assets from every feed the manage TUI\n * surfaces.\n *\n * Three feeds, normalized into `CatalogEntry`:\n * - **Project sources** — `skaile.yaml` `sources:` entries (scanned via\n *   `AssetManager.search()`; the new `sources:` field is merged into the\n *   legacy repositories map in `AssetManager.loadConfig`).\n * - **Local libraries** — user authoring places from `LocalIndex` (filesystem\n *   scan of each library's `path`).\n * - **Remote store** — the configured catalog source when `catalog.url` is\n *   not `local`. Failures are non-fatal — they surface as notes.\n */\n\nimport { existsSync } from \"node:fs\";\nimport * as path from \"node:path\";\nimport { type AssetKind, type CatalogEntry, scanRepo } from \"@skaile/workspaces/core\";\n\n/** One non-fatal note returned to the caller for surfacing in the UI. */\nexport interface FeedNote {\n  feed: \"sources\" | \"libraries\" | \"store\";\n  message: string;\n}\n\n/**\n * Which feed an asset came from. This is the top-level grouping axis in the\n * manage TUI (\"where is this skill coming from?\") and is intentionally distinct\n * from `publisher` (asset-intrinsic identity): the same publisher can legitimately\n * appear under more than one origin (e.g. a github repo you added as a `source`\n * that is also listed in the remote `store`).\n */\nexport type AssetOrigin = \"source\" | \"library\" | \"store\";\n\n/** A catalog entry tagged with the feed it was gathered from. */\nexport interface OriginEntry {\n  origin: AssetOrigin;\n  entry: CatalogEntry;\n}\n\nexport interface AssetFeedResult {\n  entries: OriginEntry[];\n  notes: FeedNote[];\n}\n\n/**\n * Pull assets from local libraries (the authoring places under\n * `~/.skaile/libraries/<name>/`, not the `~/.skaile/sources/` cache). Each\n * library's `path` is scanned with `scanRepo` and tagged with\n * `repository = \"library:<name>\"` so the manage TUI groups them into their\n * own headers.\n */\nasync function libraryAssets(): Promise<{ entries: CatalogEntry[]; notes: FeedNote[] }> {\n  const notes: FeedNote[] = [];\n  try {\n    const [{ openLibraryManager }, { skaileHomeDir }] = await Promise.all([\n      import(\"./open-library.ts\"),\n      import(\"@skaile/workspaces/library\"),\n    ]);\n    const { manager, close } = await openLibraryManager();\n    try {\n      const sourcesDir = path.join(skaileHomeDir(), \"sources\");\n      const libs = (await manager.listLibraries()).filter((l) => !l.path.startsWith(sourcesDir));\n      const entries: CatalogEntry[] = [];\n      for (const lib of libs) {\n        if (!existsSync(lib.path)) continue;\n        for (const e of scanRepo(lib.path, `library:${lib.name}`)) {\n          entries.push(e);\n        }\n      }\n      return { entries, notes };\n    } finally {\n      close();\n    }\n  } catch (err) {\n    notes.push({\n      feed: \"libraries\",\n      message: err instanceof Error ? err.message : String(err),\n    });\n    return { entries: [], notes };\n  }\n}\n\n/**\n * Pull a (best-effort) snapshot of the connected remote store catalog.\n *\n * - Returns no entries when the resolved catalog is local-only or the host\n *   is unreachable (the failure becomes a note, not an exception).\n * - Maps `CatalogAsset` → `CatalogEntry`, carrying `publisher`, `repo`, and\n *   `category` straight through and using `source = \"store://<id>\"`; per-file\n *   `source` paths are not available for remote assets so the canonical ref is\n *   a stable placeholder.\n */\nasync function storeAssets(projectDir: string): Promise<{\n  entries: CatalogEntry[];\n  notes: FeedNote[];\n}> {\n  const notes: FeedNote[] = [];\n  try {\n    const { resolveCatalogSource } = await import(\"./open-library.ts\");\n    const { source, close } = await resolveCatalogSource({ projectDir });\n    try {\n      const assets = await source.listAssets();\n      const entries: CatalogEntry[] = assets.map((a) => ({\n        name: a.name,\n        kind: (a.kind as AssetKind) ?? \"skill\",\n        description: a.description ?? \"\",\n        source: `store://${a.id}`,\n        publisher: a.publisher,\n        repo: a.repo,\n        domainSlug: a.domainSlug,\n        category: a.category,\n        version: a.version,\n        requires: [],\n        dependencies: [],\n      }));\n      return { entries, notes };\n    } finally {\n      close();\n    }\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    // Local-only catalog throws a recognizable message — silence it; absence\n    // is the user's choice, not an error.\n    if (!/local/i.test(msg)) {\n      notes.push({ feed: \"store\", message: msg });\n    }\n    return { entries: [], notes };\n  }\n}\n\n/**\n * Project-source feed: leans on `AssetManager.search()`, which now merges\n * `skaile.yaml`'s `sources:` field into the repositories map. Provided as a\n * function rather than an inline call so the caller can supply a fresh\n * `AssetManager` instance.\n */\nfunction sourceAssets(am: { search: () => CatalogEntry[] }): CatalogEntry[] {\n  return am.search();\n}\n\n/** Tag a flat entry list with a single origin. */\nfunction tag(origin: AssetOrigin, entries: CatalogEntry[]): OriginEntry[] {\n  return entries.map((entry) => ({ origin, entry }));\n}\n\n/**\n * Run all three feeds and return a single normalized result.\n *\n * Feeds run in parallel where possible — the store fetch is the slow one\n * (one HTTP call) and is fired alongside the local library walk.\n */\nexport async function gatherAssetFeeds(\n  am: { search: () => CatalogEntry[] },\n  projectDir: string,\n): Promise<AssetFeedResult> {\n  const [libs, store] = await Promise.all([libraryAssets(), storeAssets(projectDir)]);\n  return {\n    entries: [\n      ...tag(\"source\", sourceAssets(am)),\n      ...tag(\"library\", libs.entries),\n      ...tag(\"store\", store.entries),\n    ],\n    notes: [...libs.notes, ...store.notes],\n  };\n}\n"]}
+{"version":3,"sources":["../cli/src/asset-feeds.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAmDA,eAAe,aAAA,GAAyE;AACtF,EAAA,MAAM,QAAoB,EAAC;AAC3B,EAAA,IAAI;AACF,IAAA,MAAM,CAAC,EAAE,kBAAA,EAAmB,EAAG,EAAE,eAAe,CAAA,GAAI,MAAM,OAAA,CAAQ,GAAA,CAAI;AAAA,MACpE,OAAO,4BAAmB,CAAA;AAAA,MAC1B,OAAO,oBAA4B;AAAA,KACpC,CAAA;AACD,IAAA,MAAM,EAAE,OAAA,EAAS,KAAA,EAAM,GAAI,MAAM,kBAAA,EAAmB;AACpD,IAAA,IAAI;AACF,MAAA,MAAM,UAAA,GAAkB,IAAA,CAAA,IAAA,CAAK,aAAA,EAAc,EAAG,SAAS,CAAA;AACvD,MAAA,MAAM,IAAA,GAAA,CAAQ,MAAM,OAAA,CAAQ,aAAA,EAAc,EAAG,MAAA,CAAO,CAAC,CAAA,KAAM,CAAC,CAAA,CAAE,IAAA,CAAK,UAAA,CAAW,UAAU,CAAC,CAAA;AACzF,MAAA,MAAM,UAA0B,EAAC;AACjC,MAAA,KAAA,MAAW,OAAO,IAAA,EAAM;AACtB,QAAA,IAAI,CAAC,UAAA,CAAW,GAAA,CAAI,IAAI,CAAA,EAAG;AAC3B,QAAA,KAAA,MAAW,CAAA,IAAK,SAAS,GAAA,CAAI,IAAA,EAAM,WAAW,GAAA,CAAI,IAAI,EAAE,CAAA,EAAG;AACzD,UAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,QAChB;AAAA,MACF;AACA,MAAA,OAAO,EAAE,SAAS,KAAA,EAAM;AAAA,IAC1B,CAAA,SAAE;AACA,MAAA,KAAA,EAAM;AAAA,IACR;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,KAAA,CAAM,IAAA,CAAK;AAAA,MACT,IAAA,EAAM,WAAA;AAAA,MACN,SAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG;AAAA,KACzD,CAAA;AACD,IAAA,OAAO,EAAE,OAAA,EAAS,EAAC,EAAG,KAAA,EAAM;AAAA,EAC9B;AACF;AAYA,eAAe,YAAY,UAAA,EAGxB;AACD,EAAA,MAAM,QAAoB,EAAC;AAC3B,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,oBAAA,EAAqB,GAAI,MAAM,OAAO,4BAAmB,CAAA;AACjE,IAAA,MAAM,EAAE,QAAQ,KAAA,EAAM,GAAI,MAAM,oBAAA,CAAqB,EAAE,YAAY,CAAA;AACnE,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,UAAA,EAAW;AACvC,MAAA,MAAM,OAAA,GAA0B,MAAA,CAAO,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,QACjD,MAAM,CAAA,CAAE,IAAA;AAAA,QACR,IAAA,EAAO,EAAE,IAAA,IAAsB,OAAA;AAAA,QAC/B,WAAA,EAAa,EAAE,WAAA,IAAe,EAAA;AAAA,QAC9B,MAAA,EAAQ,CAAA,QAAA,EAAW,CAAA,CAAE,EAAE,CAAA,CAAA;AAAA,QACvB,WAAW,CAAA,CAAE,SAAA;AAAA,QACb,MAAM,CAAA,CAAE,IAAA;AAAA,QACR,YAAY,CAAA,CAAE,UAAA;AAAA,QACd,UAAU,CAAA,CAAE,QAAA;AAAA,QACZ,SAAS,CAAA,CAAE,OAAA;AAAA,QACX,UAAU,EAAC;AAAA,QACX,cAAc;AAAC,OACjB,CAAE,CAAA;AACF,MAAA,OAAO,EAAE,SAAS,KAAA,EAAM;AAAA,IAC1B,CAAA,SAAE;AACA,MAAA,KAAA,EAAM;AAAA,IACR;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,MAAM,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAG3D,IAAA,IAAI,CAAC,QAAA,CAAS,IAAA,CAAK,GAAG,CAAA,EAAG;AACvB,MAAA,KAAA,CAAM,KAAK,EAAE,IAAA,EAAM,OAAA,EAAS,OAAA,EAAS,KAAK,CAAA;AAAA,IAC5C;AACA,IAAA,OAAO,EAAE,OAAA,EAAS,EAAC,EAAG,KAAA,EAAM;AAAA,EAC9B;AACF;AAQA,SAAS,aAAa,EAAA,EAAsD;AAC1E,EAAA,OAAO,GAAG,MAAA,EAAO;AACnB;AAGA,SAAS,GAAA,CAAI,QAAqB,OAAA,EAAwC;AACxE,EAAA,OAAO,QAAQ,GAAA,CAAI,CAAC,WAAW,EAAE,MAAA,EAAQ,OAAM,CAAE,CAAA;AACnD;AAQA,eAAsB,gBAAA,CACpB,IACA,UAAA,EAC0B;AAC1B,EAAA,MAAM,CAAC,IAAA,EAAM,KAAK,CAAA,GAAI,MAAM,OAAA,CAAQ,GAAA,CAAI,CAAC,aAAA,EAAc,EAAG,WAAA,CAAY,UAAU,CAAC,CAAC,CAAA;AAClF,EAAA,OAAO;AAAA,IACL,OAAA,EAAS;AAAA,MACP,GAAG,GAAA,CAAI,QAAA,EAAU,YAAA,CAAa,EAAE,CAAC,CAAA;AAAA,MACjC,GAAG,GAAA,CAAI,SAAA,EAAW,IAAA,CAAK,OAAO,CAAA;AAAA,MAC9B,GAAG,GAAA,CAAI,OAAA,EAAS,KAAA,CAAM,OAAO;AAAA,KAC/B;AAAA,IACA,OAAO,CAAC,GAAG,KAAK,KAAA,EAAO,GAAG,MAAM,KAAK;AAAA,GACvC;AACF","file":"asset-feeds-6R2C2NHB.js","sourcesContent":["/**\n * asset-feeds.ts — gather installable assets from every feed the manage TUI\n * surfaces.\n *\n * Three feeds, normalized into `CatalogEntry`:\n * - **Project sources** — `skaile.yaml` `sources:` entries (scanned via\n *   `AssetManager.search()`; the new `sources:` field is merged into the\n *   legacy repositories map in `AssetManager.loadConfig`).\n * - **Local libraries** — user authoring places from `LocalIndex` (filesystem\n *   scan of each library's `path`).\n * - **Remote store** — the configured catalog source when `catalog.url` is\n *   not `local`. Failures are non-fatal — they surface as notes.\n */\n\nimport { existsSync } from \"node:fs\";\nimport * as path from \"node:path\";\nimport { type AssetKind, type CatalogEntry, scanRepo } from \"@skaile/workspaces/core\";\n\n/** One non-fatal note returned to the caller for surfacing in the UI. */\nexport interface FeedNote {\n  feed: \"sources\" | \"libraries\" | \"store\";\n  message: string;\n}\n\n/**\n * Which feed an asset came from. This is the top-level grouping axis in the\n * manage TUI (\"where is this skill coming from?\") and is intentionally distinct\n * from `publisher` (asset-intrinsic identity): the same publisher can legitimately\n * appear under more than one origin (e.g. a github repo you added as a `source`\n * that is also listed in the remote `store`).\n */\nexport type AssetOrigin = \"source\" | \"library\" | \"store\";\n\n/** A catalog entry tagged with the feed it was gathered from. */\nexport interface OriginEntry {\n  origin: AssetOrigin;\n  entry: CatalogEntry;\n}\n\nexport interface AssetFeedResult {\n  entries: OriginEntry[];\n  notes: FeedNote[];\n}\n\n/**\n * Pull assets from local libraries (the authoring places under\n * `~/.skaile/libraries/<name>/`, not the `~/.skaile/sources/` cache). Each\n * library's `path` is scanned with `scanRepo` and tagged with\n * `repository = \"library:<name>\"` so the manage TUI groups them into their\n * own headers.\n */\nasync function libraryAssets(): Promise<{ entries: CatalogEntry[]; notes: FeedNote[] }> {\n  const notes: FeedNote[] = [];\n  try {\n    const [{ openLibraryManager }, { skaileHomeDir }] = await Promise.all([\n      import(\"./open-library.ts\"),\n      import(\"@skaile/workspaces/library\"),\n    ]);\n    const { manager, close } = await openLibraryManager();\n    try {\n      const sourcesDir = path.join(skaileHomeDir(), \"sources\");\n      const libs = (await manager.listLibraries()).filter((l) => !l.path.startsWith(sourcesDir));\n      const entries: CatalogEntry[] = [];\n      for (const lib of libs) {\n        if (!existsSync(lib.path)) continue;\n        for (const e of scanRepo(lib.path, `library:${lib.name}`)) {\n          entries.push(e);\n        }\n      }\n      return { entries, notes };\n    } finally {\n      close();\n    }\n  } catch (err) {\n    notes.push({\n      feed: \"libraries\",\n      message: err instanceof Error ? err.message : String(err),\n    });\n    return { entries: [], notes };\n  }\n}\n\n/**\n * Pull a (best-effort) snapshot of the connected remote store catalog.\n *\n * - Returns no entries when the resolved catalog is local-only or the host\n *   is unreachable (the failure becomes a note, not an exception).\n * - Maps `CatalogAsset` → `CatalogEntry`, carrying `publisher`, `repo`, and\n *   `category` straight through and using `source = \"store://<id>\"`; per-file\n *   `source` paths are not available for remote assets so the canonical ref is\n *   a stable placeholder.\n */\nasync function storeAssets(projectDir: string): Promise<{\n  entries: CatalogEntry[];\n  notes: FeedNote[];\n}> {\n  const notes: FeedNote[] = [];\n  try {\n    const { resolveCatalogSource } = await import(\"./open-library.ts\");\n    const { source, close } = await resolveCatalogSource({ projectDir });\n    try {\n      const assets = await source.listAssets();\n      const entries: CatalogEntry[] = assets.map((a) => ({\n        name: a.name,\n        kind: (a.kind as AssetKind) ?? \"skill\",\n        description: a.description ?? \"\",\n        source: `store://${a.id}`,\n        publisher: a.publisher,\n        repo: a.repo,\n        domainSlug: a.domainSlug,\n        category: a.category,\n        version: a.version,\n        requires: [],\n        dependencies: [],\n      }));\n      return { entries, notes };\n    } finally {\n      close();\n    }\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    // Local-only catalog throws a recognizable message — silence it; absence\n    // is the user's choice, not an error.\n    if (!/local/i.test(msg)) {\n      notes.push({ feed: \"store\", message: msg });\n    }\n    return { entries: [], notes };\n  }\n}\n\n/**\n * Project-source feed: leans on `AssetManager.search()`, which now merges\n * `skaile.yaml`'s `sources:` field into the repositories map. Provided as a\n * function rather than an inline call so the caller can supply a fresh\n * `AssetManager` instance.\n */\nfunction sourceAssets(am: { search: () => CatalogEntry[] }): CatalogEntry[] {\n  return am.search();\n}\n\n/** Tag a flat entry list with a single origin. */\nfunction tag(origin: AssetOrigin, entries: CatalogEntry[]): OriginEntry[] {\n  return entries.map((entry) => ({ origin, entry }));\n}\n\n/**\n * Run all three feeds and return a single normalized result.\n *\n * Feeds run in parallel where possible — the store fetch is the slow one\n * (one HTTP call) and is fired alongside the local library walk.\n */\nexport async function gatherAssetFeeds(\n  am: { search: () => CatalogEntry[] },\n  projectDir: string,\n): Promise<AssetFeedResult> {\n  const [libs, store] = await Promise.all([libraryAssets(), storeAssets(projectDir)]);\n  return {\n    entries: [\n      ...tag(\"source\", sourceAssets(am)),\n      ...tag(\"library\", libs.entries),\n      ...tag(\"store\", store.entries),\n    ],\n    notes: [...libs.notes, ...store.notes],\n  };\n}\n"]}

package/dist/asset-manager/index.js

@@ -1,8 +1,8 @@
-export { AssetManager, parseCanonicalLockKey } from '../chunk-CPYXJJOD.js';
-export { createScaffold, deployAll, installAgent, removeAsset } from '../chunk-LO7QEIHT.js';
-import '../chunk-7WHBI3I6.js';
-import '../chunk-SN2RWSB3.js';
-import '../chunk-DTJNHYFE.js';
+export { AssetManager, parseCanonicalLockKey } from '../chunk-BKE2E5AC.js';
+export { createScaffold, deployAll, installAgent, removeAsset } from '../chunk-DHN6VW4B.js';
+import '../chunk-DVIIYYD5.js';
+import '../chunk-2VM62DX7.js';
+import '../chunk-E5VRPYUX.js';
 import '../chunk-H5YXL4KI.js';
 import '../chunk-4AGIEU7V.js';
 import '../chunk-LFDZYCEO.js';

package/dist/asset-manager/installer.js

@@ -1,7 +1,7 @@
-export { createScaffold, deployAll, deployAsset, removeAsset } from '../chunk-LO7QEIHT.js';
-import '../chunk-7WHBI3I6.js';
-import '../chunk-SN2RWSB3.js';
-import '../chunk-DTJNHYFE.js';
+export { createScaffold, deployAll, deployAsset, removeAsset } from '../chunk-DHN6VW4B.js';
+import '../chunk-DVIIYYD5.js';
+import '../chunk-2VM62DX7.js';
+import '../chunk-E5VRPYUX.js';
 import '../chunk-H5YXL4KI.js';
 import '../chunk-4AGIEU7V.js';
 import '../chunk-LFDZYCEO.js';

package/dist/bridge/drivers/claude-sdk.js

@@ -1,7 +1,7 @@
 import { dispatchCapability } from '../../chunk-RRVQAE5D.js';
 import { fetchProviderModels } from '../../chunk-BMQKMOQY.js';
 import { AuthError, classifyClaudeSdkError } from '../../chunk-NGJ6E344.js';
-import { BUILTIN_DRIVER_CATALOG, AgentDriver, getBridgeLogger } from '../../chunk-OEXA7BBK.js';
+import { BUILTIN_DRIVER_CATALOG, AgentDriver, getBridgeLogger } from '../../chunk-CIFTUSBV.js';
 import '../../chunk-6E6PKKAD.js';
 import '../../chunk-JB35MVBN.js';
 import '../../chunk-NSBPE2FW.js';
@@ -636,6 +636,13 @@ var ClaudeSdkDriver = class extends AgentDriver {
       model: this.config.model || "default",
       session: this.config.resumeSessionId || this.sessionId || this.config.sessionId || "new"
     });
+    if (apiKey) {
+      const baseEnv = {};
+      for (const [k, v] of Object.entries(process.env)) {
+        if (v !== void 0) baseEnv[k] = v;
+      }
+      options.env = { ...baseEnv, ...this.config.env ?? {}, ANTHROPIC_API_KEY: apiKey };
+    }
     const { query } = this.sdk;
     const queryArgs = {
       prompt: message,