@skilder-ai/runtime 0.9.10 → 0.9.12

package/dist/index.js

@@ -87799,6 +87799,9 @@ function loadEnv(projectRoot2, packagePath2, quiet = false) {
 var fs = __toESM(require("fs"), 1);
 var path = __toESM(require("path"), 1);
 var crypto2 = __toESM(require("crypto"), 1);
+function getAssetCacheDir(config2) {
+  return config2.assetCacheDir ?? path.join(config2.workingDir, "assets");
+}
 var SKILDER_FILE_PREFIX = "@skilder-file:/";
 var SKILDER_ASSET_PREFIX = "@skilder-asset:/";
 function isSkilderAssetPath(filePath) {
@@ -87835,7 +87838,7 @@ function parseAssetPath(assetPath) {
 }
 function resolveAssetCachePath(assetPath, config2) {
   const { resourceId, extension } = parseAssetPath(assetPath);
-  return path.join(config2.workingDir, "assets", `${resourceId}${extension}`);
+  return path.join(getAssetCacheDir(config2), `${resourceId}${extension}`);
 }
 async function writeAssetCache(assetPath, buffer, config2) {
   const cachePath = resolveAssetCachePath(assetPath, config2);
@@ -87867,7 +87870,14 @@ function resolveFilePath(filePath, config2) {
     return resolveAssetCachePath(filePath, config2);
   }
   if (filePath.startsWith(SKILDER_FILE_PREFIX)) {
-    const filename = filePath.slice(SKILDER_FILE_PREFIX.length);
+    const rest = filePath.slice(SKILDER_FILE_PREFIX.length);
+    if (rest.split("/").some((seg) => seg === "..")) {
+      throw new Error(`Path traversal detected: ${filePath}`);
+    }
+    const filename = path.basename(rest);
+    if (!filename || filename === ".") {
+      throw new Error(`Invalid skilder file path: ${filePath}`);
+    }
     const resolved = path.normalize(path.join(config2.workingDir, filename));
     if (!resolved.startsWith(workingDirPrefix) && resolved !== config2.workingDir) {
       throw new Error(`Path traversal detected: ${filePath}`);
@@ -87881,6 +87891,11 @@ function resolveFilePath(filePath, config2) {
   if (normalized === config2.workingDir || normalized.startsWith(workingDirPrefix)) {
     return normalized;
   }
+  const assetCacheDir = getAssetCacheDir(config2);
+  const assetCachePrefix = assetCacheDir.endsWith(path.sep) ? assetCacheDir : assetCacheDir + path.sep;
+  if (normalized === assetCacheDir || normalized.startsWith(assetCachePrefix)) {
+    return normalized;
+  }
   for (const allowed of config2.allowedPaths) {
     const allowedPrefix = allowed.endsWith(path.sep) ? allowed : allowed + path.sep;
     if (normalized === allowed || normalized.startsWith(allowedPrefix)) {
@@ -87888,7 +87903,7 @@ function resolveFilePath(filePath, config2) {
     }
   }
   throw new Error(
-    `File path not in allowed locations: ${filePath}. Allowed: ${[config2.workingDir, ...config2.allowedPaths].join(", ")}`
+    `File path not in allowed locations: ${filePath}. Allowed: ${[config2.workingDir, assetCacheDir, ...config2.allowedPaths].join(", ")}`
   );
 }
 function generateSkilderPath(extension) {
@@ -110508,12 +110523,13 @@ var DefaultMCPClient = class {
 
 // ../common/src/node-helpers/mcp-client.ts
 async function createSkilderMCPClient(options) {
-  const { url: url2, userKey, delegateDepth } = options;
+  const { url: url2, userKey, delegateDepth, name: name21 = "skilder-studio" } = options;
   const headers = { user_key: userKey };
   if (delegateDepth != null) {
     headers["x-delegate-depth"] = String(delegateDepth);
   }
   return createMCPClient({
+    name: name21,
     transport: {
       type: "http",
       url: url2,
@@ -110745,6 +110761,10 @@ function buildStreamTransport(transport) {
   };
 }
 
+// ../common/src/connection-options.ts
+var CONNECTED_WINDOW_HOURS = 24;
+var CONNECTED_WINDOW_MS = CONNECTED_WINDOW_HOURS * 60 * 60 * 1e3;
+
 // ../common/src/services/logger.service.ts
 var import_pino = __toESM(require_pino(), 1);
 var import_pino_pretty = __toESM(require_pino_pretty(), 1);
@@ -137449,13 +137469,17 @@ var AIProviderService = class AIProviderService2 {
   /**
    * Chat with a specific model (sync).
    * Accepts config directly - caller is responsible for providing decrypted config.
+   *
+   * @param abortSignal Optional AbortSignal; when aborted, the underlying
+   *   provider request is cancelled (no cost / connection leak on timeout).
    */
-  async chat(config2, provider, modelName, message, slug) {
+  async chat(config2, provider, modelName, message, slug, abortSignal) {
     const model = this.getProviderModel(provider, modelName, config2, slug);
     try {
       const result = await generateText({
         model,
-        messages: [{ role: "user", content: message }]
+        messages: [{ role: "user", content: message }],
+        abortSignal
       });
       return result.text;
     } catch (error48) {
@@ -137776,7 +137800,8 @@ var CACHE_BUCKETS = {
   RATE_LIMIT_KEY: "rate-limit-key",
   RATE_LIMIT_IP: "rate-limit-ip",
   FASTIFY_RATE_LIMIT: "fastify-rate-limit",
-  GITHUB_RATE_LIMIT: "github-rate-limit"
+  GITHUB_RATE_LIMIT: "github-rate-limit",
+  COMMUNITY_SKILLS_RATE_LIMIT: "community-skills-rate-limit"
 };
 var CACHE_BUCKET_TTLS = {
   HEARTBEAT: 30 * 1e3,
@@ -137797,8 +137822,10 @@ var CACHE_BUCKET_TTLS = {
   // 1 hour
   FASTIFY_RATE_LIMIT: 60 * 1e3,
   // 1 minute
-  GITHUB_RATE_LIMIT: 2 * 60 * 1e3
+  GITHUB_RATE_LIMIT: 2 * 60 * 1e3,
   // 2 minutes (window is 1 min, extra margin ensures NATS TTL doesn't evict before resetAt check)
+  COMMUNITY_SKILLS_RATE_LIMIT: 2 * 60 * 1e3
+  // 2 minutes (window is 1 min, see GITHUB_RATE_LIMIT for rationale)
 };
 var CACHE_SERVICE = "cache.service";
 var CACHE_SERVICE_CONFIG = "cache.service.config";
@@ -137838,6 +137865,10 @@ function createCacheServiceConfig() {
       {
         name: CACHE_BUCKETS.GITHUB_RATE_LIMIT,
         ttlMs: parseTTL("GITHUB_RATE_LIMIT_CACHE_TTL", CACHE_BUCKET_TTLS.GITHUB_RATE_LIMIT)
+      },
+      {
+        name: CACHE_BUCKETS.COMMUNITY_SKILLS_RATE_LIMIT,
+        ttlMs: parseTTL("COMMUNITY_SKILLS_RATE_LIMIT_CACHE_TTL", CACHE_BUCKET_TTLS.COMMUNITY_SKILLS_RATE_LIMIT)
       }
     ]
   };
@@ -138782,6 +138813,7 @@ var dgraph_resolvers_types_exports = {};
 __export(dgraph_resolvers_types_exports, {
   ActiveStatus: () => ActiveStatus,
   AiProviderType: () => AiProviderType,
+  ConversationMode: () => ConversationMode,
   HatColor: () => HatColor,
   InvitationStatus: () => InvitationStatus,
   McpServerStatus: () => McpServerStatus,
@@ -138813,6 +138845,11 @@ var ActiveStatus = /* @__PURE__ */ ((ActiveStatus2) => {
   ActiveStatus2["Inactive"] = "INACTIVE";
   return ActiveStatus2;
 })(ActiveStatus || {});
+var ConversationMode = /* @__PURE__ */ ((ConversationMode2) => {
+  ConversationMode2["Manage"] = "MANAGE";
+  ConversationMode2["Run"] = "RUN";
+  return ConversationMode2;
+})(ConversationMode || {});
 var HatColor = /* @__PURE__ */ ((HatColor2) => {
   HatColor2["Blue"] = "BLUE";
   HatColor2["Gray"] = "GRAY";
@@ -144319,6 +144356,7 @@ var FileService = class FileService2 extends LifecycleService {
   getFileConfig() {
     return {
       workingDir: this.workingDir,
+      assetCacheDir: this.getAssetCacheDir(),
       allowedPaths: this.allowedPaths,
       maxFileSizeMB: this.maxFileSizeMB
     };
@@ -144541,7 +144579,8 @@ var DelegateService = class DelegateService2 {
           createSkilderMCPClient({
             url: runtimeUrl,
             userKey,
-            delegateDepth: currentDepth + 1
+            delegateDepth: currentDepth + 1,
+            name: "skilder-runtime-delegate"
           }),
           new Promise((_3, reject) => {
             connectionTimer = setTimeout(() => reject(new Error("MCP client connection timeout")), DELEGATE_MCP_CLIENT_TIMEOUT_MS);
@@ -145382,6 +145421,17 @@ function handleGetHat(hatName, ctx) {
   }
   const hat = ctx.catalog.hats.find((h2) => h2.name === hatName);
   if (!hat) {
+    const hidden = ctx.catalog.hiddenHats?.find((h2) => h2.name === hatName);
+    if (hidden?.reason === "no-skills") {
+      return errorResult(
+        `The hat "${hatName}" exists but has no skills yet, so it can't be worn. Add at least one skill to it (add-skill-to-hat), then learn it. Do not create it again.`
+      );
+    }
+    if (hidden?.reason === "disabled") {
+      return errorResult(
+        `The hat "${hatName}" exists but is disabled, so it can't be worn. Enable it first, then learn it. Do not create it again.`
+      );
+    }
     const availableHats = ctx.catalog.hats.map((h2) => h2.name).join(", ") || "none";
     return errorResult(`Error: Hat "${hatName}" not found. Available hats: ${availableHats}`);
   }
@@ -154147,24 +154197,43 @@ function rewriteWorkspacePathsInResult(result, workspaceId, workspaceDir, runtim
     return result;
   const esc2 = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   const workingRootName = import_path3.default.basename(import_path3.default.dirname(workspaceDir));
-  const patterns = [new RegExp(esc2(workspaceDir), "g")];
+  const absPatterns = [new RegExp(esc2(workspaceDir), "g")];
   if (workingRootName) {
-    patterns.push(new RegExp(`(?<![\\w/.-])${esc2(workingRootName)}/${esc2(workspaceId)}`, "g"));
+    absPatterns.push(new RegExp(`(?<![\\w/.-])${esc2(workingRootName)}/${esc2(workspaceId)}`, "g"));
   }
   const replacement = `@skilder-file:/${runtimeId}`;
+  const bareSkilderPattern = /@skilder-file:\/([^/"'\s]+)(?=["'\s]|$)/g;
+  const rewriteText = (input) => {
+    let text2 = input;
+    for (const p2 of absPatterns)
+      text2 = text2.replace(p2, replacement);
+    text2 = text2.replace(bareSkilderPattern, `@skilder-file:/${runtimeId}/$1`);
+    return text2;
+  };
+  const rewriteValue = (val) => {
+    if (typeof val === "string")
+      return rewriteText(val);
+    if (Array.isArray(val))
+      return val.map(rewriteValue);
+    if (val && typeof val === "object") {
+      return Object.fromEntries(Object.entries(val).map(([k3, v2]) => [k3, rewriteValue(v2)]));
+    }
+    return val;
+  };
   const rewritten = result.content.map((block) => {
     if (block && block.type === "text" && typeof block.text === "string") {
-      let text2 = block.text;
-      const before = text2;
-      for (const p2 of patterns)
-        text2 = text2.replace(p2, replacement);
-      if (text2 === before)
+      const text2 = rewriteText(block.text);
+      if (text2 === block.text)
         return block;
       return { ...block, text: text2 };
     }
     return block;
   });
-  return { ...result, content: rewritten };
+  const out = { ...result, content: rewritten };
+  if (result.structuredContent && typeof result.structuredContent === "object") {
+    out.structuredContent = rewriteValue(result.structuredContent);
+  }
+  return out;
 }
 function formatScriptError(stderr, exitCode) {
   const lines = stderr.split("\n");