@skaile/workspaces 5.14.0 → 5.15.1

package/dist/{chunk-CAPKENNF.js → chunk-J76LDUDS.js}

@@ -1,13 +1,13 @@
 import { globalCacheRoot, globalSkaileDir, mergeLegacyEntriesInto, mergeLegacyEntriesKeyed } from './chunk-L5VSIPQD.js';
 import { SUPPORTED_DRIVER_TARGETS, globalHarnessRoot } from './chunk-IG5LZ3WU.js';
-import { decodeSkaileManifest, compositeSha256, listAssetFiles, SKAILE_MANIFEST_FILENAME, sha256Hex } from './chunk-IY5E7Y5W.js';
+import { decodeSkaileManifest, compositeSha256, listAssetFiles, SKAILE_MANIFEST_FILENAME, sha256Hex } from './chunk-ANSZULXH.js';
 import { readPluginGroupings } from './chunk-RVRB27AN.js';
-import { scanDirectory, parseFrontmatter, parseRequires, dedupeRequirementRefs, fromMcpServerMdContent, withFsDeadline, tryWithFsDeadline, fsDeadlineMs, assetDepRefs, agentYamlRequires } from './chunk-M3P4BYRK.js';
-import { isValidAssetName, slugifyAssetName, depToStr, parseAssetRef, assetRefToStr } from './chunk-J4OYIYFQ.js';
+import { scanDirectory, parseFrontmatter, parseRequires, dedupeRequirementRefs, fromMcpServerMdContent, withFsDeadline, tryWithFsDeadline, fsDeadlineMs, assetDepRefs, agentYamlRequires } from './chunk-SP5NGNBV.js';
+import { isValidAssetName, slugifyAssetName, depToStr, parseAssetRef, assetRefToStr } from './chunk-VY6NTFE7.js';
 import { isRetentionValue } from './chunk-C3CAXQMA.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, lstatSync, symlinkSync, rmSync, readdirSync, constants, statSync } from 'fs';
 import { readdir, stat, cp, rm, open, readFile } from 'fs/promises';
-import { join, posix, relative, resolve, dirname, sep, parse as parse$1, basename } from 'path';
+import { join, posix, relative, resolve, dirname, sep, parse as parse$1, isAbsolute, basename } from 'path';
 import { parse, stringify } from 'yaml';
 import { spawnSync } from 'child_process';
 import { createHash } from 'crypto';
@@ -497,7 +497,7 @@ async function walkFilenameConvention(clone, index, knownKinds, repoLevel = {})
       `${clone.sourceUrl}: publisher must be declared in skaile.manifest.yaml (non-GitHub source URL) or recorded with \`skaile source add --publisher\`.`
     );
   }
-  const version = repoLevel.version ?? (clone.tag ? clone.tag.replace(/^v/, "") : void 0) ?? syntheticVersion(clone.commit);
+  const repoVersion = repoLevel.version ?? (clone.tag ? clone.tag.replace(/^v/, "") : void 0) ?? syntheticVersion(clone.commit);
   for (const e of await scanDirectory(clone.localPath, publisher, { knownKinds })) {
     const manifestAbs = e.source;
     const manifestRel = relative(clone.localPath, manifestAbs).replace(/\\/g, "/");
@@ -506,7 +506,10 @@ async function walkFilenameConvention(clone, index, knownKinds, repoLevel = {})
       publisher,
       kind: e.kind,
       name: e.name,
-      version,
+      // The asset file is the source of truth for its version, as `search`/`info` list it and
+      // as `walkWithManifest` reads it (p793, p855): an untagged repo is keyed by the commit
+      // only for an asset that declares none.
+      version: semver2.valid(e.version) ? e.version : repoVersion,
       sourceUrl: clone.sourceUrl,
       commit: clone.commit,
       files,
@@ -1211,7 +1214,8 @@ async function gatherStoreCandidates(ref, publisher, sourceCandidates, opts) {
           commit: m.commit,
           files: m.files,
           sha256: m.sha256,
-          deps: m.deps
+          deps: m.deps,
+          ...m.deps?.length ? { storeRequires: m.deps } : {}
         });
       }
     }
@@ -1504,7 +1508,10 @@ function resolveSkWorkspaceConfig(projectDir, opts) {
   };
   const userConfig = loadConfigFile(globalSkaileDir(), name, true, true);
   assertNoLegacyKey(userConfig);
-  if (userConfig) configs.push(userConfig.config);
+  if (userConfig) {
+    const { dependencies: _globalOnly, ...rest } = userConfig.config;
+    configs.push(rest);
+  }
   if (opts?.appDir) {
     const appConfig = loadConfigFile(opts.appDir, name, true, true);
     assertNoLegacyKey(appConfig);
@@ -2032,6 +2039,15 @@ function decodeSkaileYaml(text) {
 function encodeSkaileYaml(config) {
   return stringify(toCanonicalObject(config), { lineWidth: 120 });
 }
+function localConnectorMountDir(c, projectDir) {
+  const raw = c.mountPath ?? c.params?.mountPath;
+  if (typeof raw !== "string" || raw.trim() === "") return void 0;
+  return resolve(projectDir, raw.trim().replaceAll("${project}", projectDir));
+}
+function isInsideProject(dir, projectDir) {
+  const rel = relative(resolve(projectDir), resolve(dir));
+  return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+}
 function validateConfigValues(config, diagnostics) {
   for (const [profile, p] of Object.entries(config.agent_config ?? {})) {
     if (p?.driver && !KNOWN_DRIVERS.includes(p.driver)) {
@@ -2053,15 +2069,42 @@ function validateConfigValues(config, diagnostics) {
       });
     }
   };
-  for (const c of config.connectors ?? []) {
-    checkAccess(c.access, `connectors.${c.id}.access`);
+  const seenConnectorIds = /* @__PURE__ */ new Set();
+  for (const [index, c] of (config.connectors ?? []).entries()) {
+    const hasId = typeof c.id === "string" && c.id !== "";
+    if (!hasId) {
+      diagnostics.push({
+        code: "connector_missing_id",
+        severity: "error",
+        message: `Connector #${index + 1} has no \`id\`; the runner would mount it at .mounts/undefined. Add \`id: <name>\`.`,
+        path: `connectors[${index}].id`
+      });
+    } else if (seenConnectorIds.has(c.id)) {
+      diagnostics.push({
+        code: "connector_duplicate_id",
+        severity: "error",
+        message: `Connector id "${c.id}" is declared twice; the runner keeps the first and drops the other. Give each connector its own \`id\`.`,
+        path: `connectors.${c.id}.id`
+      });
+    } else {
+      seenConnectorIds.add(c.id);
+    }
+    const label = hasId ? `"${c.id}"` : `#${index + 1}`;
+    if (c.access && !KNOWN_ACCESS.includes(c.access)) {
+      diagnostics.push({
+        code: "connector_invalid_access",
+        severity: "error",
+        message: `Connector ${label} has access "${c.access}"; expected "read-only" or "read-write".`,
+        path: `connectors.${hasId ? c.id : index}.access`
+      });
+    }
     if (typeof c.driver !== "string" || c.driver === "") {
       const legacy = c.adapter;
       diagnostics.push({
         code: "connector_missing_driver",
         severity: "error",
-        message: legacy !== void 0 ? `Connector "${c.id}" sets \`adapter: ${String(legacy)}\`; the key is \`driver\`. Rename \`adapter\` to \`driver\`.` : `Connector "${c.id}" has no \`driver\`; the runner cannot mount it. Add \`driver: <name>\`.`,
-        path: `connectors.${c.id}.driver`
+        message: legacy !== void 0 ? `Connector ${label} sets \`adapter: ${String(legacy)}\`; the key is \`driver\`. Rename \`adapter\` to \`driver\`.` : `Connector ${label} has no \`driver\`; the runner cannot mount it. Add \`driver: <name>\`.`,
+        path: `connectors.${hasId ? c.id : index}.driver`
       });
     }
     checkUnavailable(c, diagnostics);
@@ -2220,6 +2263,16 @@ function mcpDeclFromCatalogEntry(entry) {
     decl.headers = m.headers;
   }
   if (entry.description) decl.description = entry.description;
+  if (m.payload !== void 0) {
+    const payload = parseCatalogPayload(m.payload);
+    if (!payload) {
+      console.warn(
+        `[workspace-config] mcpDeclFromCatalogEntry: entry "${entry.name}" has a malformed payload (needs an https url, a 64-hex sha256 and a plain dest file name) \u2014 ignoring the server.`
+      );
+      return null;
+    }
+    decl.payload = payload;
+  }
   if (m.recipe && typeof m.recipe === "object" && !Array.isArray(m.recipe)) {
     const recipe = parseCatalogRecipe(m.recipe, entry.name);
     if (recipe) decl.recipe = recipe;
@@ -2227,6 +2280,20 @@ function mcpDeclFromCatalogEntry(entry) {
   if (!decl.command && !decl.url) return null;
   return decl;
 }
+function parseCatalogPayload(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return void 0;
+  const r = raw;
+  if (typeof r.url !== "string" || !r.url.startsWith("https://")) return void 0;
+  if (typeof r.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(r.sha256)) return void 0;
+  if (r.dest !== void 0 && (typeof r.dest !== "string" || !/^[^/\\]+$/.test(r.dest) || r.dest === "." || r.dest === "..")) {
+    return void 0;
+  }
+  return {
+    url: r.url,
+    sha256: r.sha256,
+    ...r.dest !== void 0 ? { dest: r.dest } : {}
+  };
+}
 function parseCatalogRecipe(r, entryName) {
   const hasFlake = typeof r.flake === "string";
   const rawAttr = typeof r.attr === "string" ? r.attr : void 0;
@@ -2263,7 +2330,8 @@ function mergeMcpDeclarations(base, overlay) {
     recipe: overlay.recipe ?? base.recipe,
     // Sticky: once either side carried folded `.instance.json` secrets, the
     // merged `env` does too — the flag must not be lost by an overlay.
-    instanceSecretsFolded: overlay.instanceSecretsFolded ?? base.instanceSecretsFolded
+    instanceSecretsFolded: overlay.instanceSecretsFolded ?? base.instanceSecretsFolded,
+    payload: overlay.payload ?? base.payload
   };
 }
 var unscopedTail = (x) => x.includes("/") ? x.split("/").pop() : x;
@@ -2805,6 +2873,6 @@ function resolveAgentDefinitionDir(projectDir, definition) {
   return resolve(projectDir, definition);
 }
 
-export { AGENT_INSTANCE_ID_PATTERN, AGENT_INSTANCE_LIFECYCLES, AGENT_INSTANCE_MEMORY_SCOPES, AGENT_INSTANCE_TRIGGER_KINDS, AgentRefResolutionError, COMPACTION_DEFAULTS, CanonicalRefConflictError, DEFAULT_AGENT_INSTANCE_ID, DEFAULT_RECIPE_ATTR, MAX_PRESET_DEPTH, PresetDepthError, SKAILE_YAML_DEFAULT, SKAILE_YAML_SUFFIX, SKILL_ALLOWLIST_FILE, SKILL_ALLOWLIST_VERSION, SK_WORKSPACE_DEFAULT_NAME, SK_WORKSPACE_SUFFIX, STAGED_SKILL_MARKER, SourceEntryError, UnknownAssetKindError, agentBlockKeyDiagnostics, agentInstanceDiagnostics, agentSourceCacheDir, attachToBranch, buildProvenanceIndex, checkRepoStatus, checkoutPin, cloneRepo, coerceVersion, decodeSkaileYaml, deriveSingleMaterializedMcpDeclaration, effectiveAgentInstances, encodeSkaileYaml, ensureRepo, findWorkspaceRoot, getGlobalCacheDir, getRepoCommit, isCommitOnRemote, isStagedSkillMarkerFor, isWorkspaceConfigFilename, legacySourceCacheKey, linkRepo, listSkWorkspaceConfigs, loadMcpServerDeclarations, loadSkWorkspaceConfig, matchPin, mergeAgentInstances, mergeAgentPermissions, mergeSkWorkspaceConfigs, normalizeAgentInstances, normalizeConfig, parseSourceEntries, pullRepo, pullRepoResult, readLinks, readSkillAllowList, resolveAgentDefinitionDir, resolveAgentDir, resolveAll, resolveAsset, resolveCompactionThresholdPercent, resolveGlobalHarnesses, resolveGlobalSkWorkspaceConfig, resolveSkWorkspaceConfig, resolveSourcePublisher, saveSkWorkspaceConfig, scanRepo, sourceCacheKey, sourceShortName, stageMaterializedSkills, stagedSkillMarkerState, storeManifestSlug, unlinkRepo, unstageSkill, validateAssetRecipeAttr, validateAssetRecipeFlake, workspaceConfigFilename, workspaceNameFromFilename, writeLinks };
-//# sourceMappingURL=chunk-CAPKENNF.js.map
-//# sourceMappingURL=chunk-CAPKENNF.js.map
+export { AGENT_INSTANCE_ID_PATTERN, AGENT_INSTANCE_LIFECYCLES, AGENT_INSTANCE_MEMORY_SCOPES, AGENT_INSTANCE_TRIGGER_KINDS, AgentRefResolutionError, COMPACTION_DEFAULTS, CanonicalRefConflictError, DEFAULT_AGENT_INSTANCE_ID, DEFAULT_RECIPE_ATTR, MAX_PRESET_DEPTH, PresetDepthError, SKAILE_YAML_DEFAULT, SKAILE_YAML_SUFFIX, SKILL_ALLOWLIST_FILE, SKILL_ALLOWLIST_VERSION, SK_WORKSPACE_DEFAULT_NAME, SK_WORKSPACE_SUFFIX, STAGED_SKILL_MARKER, SourceEntryError, UnknownAssetKindError, agentBlockKeyDiagnostics, agentInstanceDiagnostics, agentSourceCacheDir, attachToBranch, buildProvenanceIndex, checkRepoStatus, checkoutPin, cloneRepo, coerceVersion, decodeSkaileYaml, deriveSingleMaterializedMcpDeclaration, effectiveAgentInstances, encodeSkaileYaml, ensureRepo, findWorkspaceRoot, getGlobalCacheDir, getRepoCommit, isCommitOnRemote, isInsideProject, isStagedSkillMarkerFor, isWorkspaceConfigFilename, legacySourceCacheKey, linkRepo, listSkWorkspaceConfigs, loadMcpServerDeclarations, loadSkWorkspaceConfig, localConnectorMountDir, matchPin, mergeAgentInstances, mergeAgentPermissions, mergeSkWorkspaceConfigs, normalizeAgentInstances, normalizeConfig, parseSourceEntries, pullRepo, pullRepoResult, readLinks, readSkillAllowList, resolveAgentDefinitionDir, resolveAgentDir, resolveAll, resolveAsset, resolveCompactionThresholdPercent, resolveGlobalHarnesses, resolveGlobalSkWorkspaceConfig, resolveSkWorkspaceConfig, resolveSourcePublisher, saveSkWorkspaceConfig, scanRepo, sourceCacheKey, sourceShortName, stageMaterializedSkills, stagedSkillMarkerState, storeManifestSlug, unlinkRepo, unstageSkill, validateAssetRecipeAttr, validateAssetRecipeFlake, workspaceConfigFilename, workspaceNameFromFilename, writeLinks };
+//# sourceMappingURL=chunk-J76LDUDS.js.map
+//# sourceMappingURL=chunk-J76LDUDS.js.map