@skillsmith/core 0.12.1 → 0.12.3

package/CHANGELOG.md

@@ -4,6 +4,169 @@ All notable changes to `@skillsmith/core` are documented here.
 
 ## [Unreleased]
 
+## v0.12.3
+
+- **Add**: `SecurityScanner.weak-passwords.ts` — a generated, versioned list of common weak passwords (vendored from SecLists, hash-pinned, capped to the top 5,000 by frequency rank), built by the new `scripts/gen-weak-password-lexicon.mjs` generator and mirrored byte-identically into the Node and Deno/Supabase edge scanner twins. This wave ships the data pipeline only — no scanner behavior changes; the `sensitive_path` detection change that consumes this data is a separate, follow-on change (SMI-6441 Wave 1)
+- **Added**: SMI-6472 -- new `./utils/skill-name` subpath export (`VALID_SKILL_NAME_RE`, `validateSkillName`), matching the existing narrow-subpath convention (`./services/skill-installation-io`, etc.) rather than requiring consumers to import the full package barrel for a small, dependency-free utility.
+- **Fix**: `scripts/skill-scanner/index.ts` no longer runs its CLI `main()` unconditionally at module-load time — the invocation is guarded by the standard `import.meta.url === \`file://${process.argv[1]}\`` check, so importing the barrel for its exports (types, categorizer, trust-scorer, file-scanner, logger, reporter, scanner) no longer hijacks `process.argv`, runs a scan, or exits the importing process. `main` is now exported, and the `scripts/scan-imported-skills.ts` backwards-compat shim (the `weekly-security-scan.yml` entry point) invokes it explicitly under its own identical guard — direct `npx tsx` execution of either file is unchanged (SMI-6464)
+- **Fix**: `sensitive_path` scanner findings now require nearby action evidence (a verb, shell operator, or imperative framing) before scoring HIGH — a bare mention of a sensitive path in prose or a defensive/documentation context downgrades to MEDIUM instead of triggering the weekly security scan's allowlist-triage cycle (SMI-5207). Adds `SecurityScanner.action-context.ts` (the action-context gate) and `SecurityScanner.value-gate.ts`/`SecurityScanner.prose-lexicon.ts` (per-assignment-segmented value classification), with `patterns.sensitive-path.ts` split out of `patterns.ts` for the pattern family itself. `scanSensitivePaths()`'s severity-message construction now embeds up to 60 chars of the matched content — see `skill-scanner/allowlist.ts`'s updated design-invariant note if authoring a new allowlist entry against a `sensitive_path` message.
+- **Fix**: `multilineTruncated` (set when a scan hits its per-pattern iteration ceiling, so `riskScore` is a known under-count) was computed but never consumed at the quarantine decision — `trust-scorer.ts`'s `shouldQuarantine()` could clear or never apply a quarantine hold based on an incomplete scan. A truncated scan now forces `quarantine: true` before allowlist filtering runs, so an allowlist can no longer clear a scan-integrity hold (SMI-5879, SMI-6020)
+
+## v0.12.2
+
+- **Feature**: SMI-6343 Wave 4 -- apply_manifest_reconcile tool (#2715)
+- **Other**: SMI-6362: Wire Team/Enterprise analytics tools to cloud-aggregated MCP tool-call data (#2698)
+- **Feature**: SMI-6343 Wave 3 -- tamper-check classification (#2710)
+- **Added**: `SkillManifestEntry` (`services/skill-installation.types.ts`) gains two optional
+  fields per ADR-145 (manifest provenance as a second trust axis, orthogonal to `source`):
+  `provenance?: 'local' | 'registry'` (who asserts this entry's identity — absent means a legacy
+  entry with no assertion ever recorded, never defaulting to `'registry'`) and
+  `verifiedAt?: string` (ISO-8601 UTC timestamp of the last successful re-verification of the
+  entry's on-disk content hash against the registry's current content hash for the claimed `id`).
+  Written by `@skillsmith/mcp-server`'s new `apply_manifest_reconcile` tool (SMI-6343 Wave 4); read
+  by SMI-6345 Wave 2's E1 identity-evidence gate. `AGENT_TOOL_PROFILE_NAMES`
+  (`services/agent-tool-profile.ts`) gains `apply_manifest_reconcile` (17 entries).
+- **Added**: `emitToolCallEvent()` and a pluggable `TelemetryIdentityProvider` in
+  `audit/remote-audit.ts` — posts a `tool_call` telemetry event carrying the
+  server-verified `team_id`/actor identity (never a client-supplied credential,
+  per SMI-6362 D-2a/D-2b) to the `events` edge function, with
+  `getTelemetryEmitStats()`/`_resetTelemetryEmitStatsForTests()` for test
+  observability. `telemetry/wrap.ts` gained `runWithToolNameContext()` so the
+  tool name is available to the emitter without threading it through every
+  call site. `AgentMarker` (`telemetry/agent-marker.ts`) now carries an
+  optional `sessionId`, sourced from the marker file's `session_id` only (no
+  Tier-1 harness injects it via `_meta` yet), so a `tool_call` row can be
+  grouped by harness session (SMI-6362 §1). Wires Team/Enterprise usage
+  analytics to cloud-aggregated MCP tool-call data (SMI-6362 Wave 1).
+- **Added**: `skill-identity-classification.ts` — a shared tamper-check classification module
+  consumed by both `@skillsmith/mcp-server` (`skill_outdated`) and `@skillsmith/cli`
+  (`skillsmith update`), so the two packages cannot drift into two independently-maintained
+  implementations of the same logic (SMI-6343 Wave 3). Runs three contradiction signals
+  against a manifest entry already known to differ from the registry — owner-mismatch
+  (`id` vs `source`), path-unresolved (`installPath` outside the claimed client's root), and
+  front-matter-contradiction (on-disk `author`/`name` vs the registry's record, fail-closed
+  to `unknown` per ADR-144/145 when the registry lookup can't complete) — plus a fourth
+  local-edit check (`hasRecordedLocalEdit()`) that distinguishes a benign local edit
+  (`local-drift`) from a genuine version bump (`outdated`). Exports the full five-state
+  `OutdatedClassificationState` (`current`/`outdated`/`local-drift`/`identity-mismatch`/
+  `unknown`) from `@skillsmith/core`.
+- **Fix**: `skill_versions.content_hash` (`SyncEngine.upsertSkills()`) now records the
+  registry's real SKILL.md content hash instead of a hash of a JSON metadata proxy
+  (`{id, name, description, updated_at}`) — the proxy meant every reader comparing against
+  this column (`skill_outdated`, `skill_updates`, the CLI's `skills-directory.ts`) was
+  structurally unable to detect a real content change (SMI-6343 Wave 2). New migration v18
+  purges pre-fix rows rather than leaving the two incompatible hash spaces mixed in the same
+  table, which would otherwise make every skill with prior history report a universal false
+  "update available". Adds a shared `compareSkillContentHashes()` comparator
+  (`@skillsmith/core`) so the three readers cannot drift apart on this comparison again.
+- **Fix**: `ManifestManager` (`@skillsmith/core/services/skill-manifest`) now refuses to lock
+  or write a manifest located inside the real user home while running under vitest
+  (SMI-6343 Wave 1). This closes a class of leak evidenced by fixture rows found in a real
+  user's `~/.skillsmith/manifest.json`, one of them claiming an unrelated live registry skill
+  id — traced to two mcp-server integration tests whose manifest path defaulted to
+  `os.homedir()/.skillsmith/manifest.json` before ADR-139 (SMI-6274 Wave 4) gave them an
+  override two days before this fix. The primary fix is a per-run `$HOME` sandbox installed
+  by `vitest.setup.ts` and inherited by every vitest config through `vitest.preset.ts`; the
+  new `assertNotRealUserHome()` guard (now exported as `assertNotRealUserHome`) is the
+  defense-in-depth backstop for a manifest path that reaches the real home anyway. It is
+  gated on `process.env.VITEST` and compares against the pre-sandbox home captured in
+  `SKILLSMITH_TEST_REAL_HOME`, falling back to `os.userInfo()` (which ignores `$HOME`) when
+  that is absent. No production code path is affected.
+
+  Adversarial review found three sibling manifest-write implementations with the identical
+  homedir-derived, no-override-parameter shape, each now wired to the same guard:
+  `packages/mcp-server/src/tools/install.helpers.manifest.ts` (`saveManifest`,
+  `acquireManifestLock`), `packages/cli/src/utils/manifest.ts` (`saveManifest`), and
+  `packages/core/src/install/fan-out.ts` (`saveManifest`, writing
+  `~/.skillsmith/links/manifest.json`). Also fixed: a `vitest.setup.ts` idempotency gap under
+  `vitest run --no-isolate` (empirically demonstrated) that could silently disable the guard's
+  ground truth after the first test file in a reused worker; `scripts/audit-standards.mjs`
+  Check 65's `manifestPath` override-evidence pattern tightened from a bare word-boundary
+  match (which a stray comment could satisfy) to require assignment/property context; and its
+  `SKILLSMITH_HOME` override credit removed since no writer honors that variable.
+
+- **Feature**: companion subagent files (`generateSubagent`/`generateMinimalSubagent`,
+  `@skillsmith/core/services/SubagentGenerator`, SMI-6276 Wave 6 Step 1) now generate
+  client-specific frontmatter instead of Claude-shaped tool names/model tiers for every
+  client. New `SubagentGenerator.client-profiles.ts` defines an exhaustive per-client
+  generation profile (frontmatter fields, tool-vocabulary policy, model policy). AntiGravity
+  gets its own mapped tool vocabulary as a YAML array (its own docs warn an unmapped tool
+  name can hang the subagent process) and no Claude model field (a different vendor/model
+  family); Cursor mirrors Claude Code's shape exactly (documented compatibility surface);
+  Copilot/OpenCode/Windsurf/others omit `tools:`/`model:` per each client's own confirmed
+  reasoning. `TransformationService`'s cache key now includes the target client (a
+  same-skill-different-client request could otherwise be served a stale other-client's
+  cached result); `generateSubagentContent()`'s `description:` frontmatter field is now
+  JSON.stringify()-quoted as a valid YAML double-quoted scalar (previously broke on a
+  description containing `: ` or ` #`). `installFromContent()` now correctly forwards its
+  resolved client into `applyOptimization()` instead of silently defaulting to claude-code.
+
+- **Feature**: `sklx agent install` now supports AntiGravity as a harness (`@skillsmith/core/install`,
+  SMI-6275 Wave 5, closing the last unshipped ask of GH#2166). `HarnessId` gains `'antigravity'`,
+  but — unlike every other MCP-capable harness — it is deliberately excluded from `McpHarnessId`
+  and has no entry in `AGENT_MCP_TARGETS`: AntiGravity's MCP config is WORKSPACE-anchored
+  (`.agents/mcp_config.json`, verified live against antigravity.google/docs/ide/mcp/ and
+  antigravity.google/docs/cli/mcp/ — same standard `mcpServers`-keyed JSON shape as
+  claude-code/copilot/windsurf, registered under the package-scoped key `@skillsmith/mcp-server`
+  to match AntiGravity's own docs snippet, the same key-alignment fix SMI-6279 made for Cursor),
+  not home-anchored like the shared `Record`'s other entries. New
+  `agent-pack-installer.antigravity-mcp.ts` (mirroring the Cursor split) owns its path resolution
+  + entry-value shape entirely; only the entry-value builder is genuinely new code, reusing
+  `mergeJsonMcpEntry()` for the actual write. `installAgentPack` now resolves AntiGravity's scope
+  on every run (not just `--scope workspace`) — a bare `agent install` auto-detects an
+  already-existing `.agents/` marker (ADR-139 point 2 rank 4) and configures it, while
+  `--scope workspace` remains the only path that can CREATE one (ADR-139 point 5); AntiGravity now
+  always gets a report row (`detected: false` with an explanatory note when its workspace scope
+  doesn't resolve), matching every other harness's reporting shape instead of Wave 4's
+  row-omission. Support tier 3 (MCP config only) — no hooks (no documented AntiGravity hook
+  system found) and no named-agent shim this wave, both stated decisions. `agent-manifest-path-guard.ts`
+  gains a second, WORKSPACE-relative allowlist (alongside the existing home-relative one) so
+  `uninstallAgentPack` can actually remove AntiGravity's two workspace-scoped artifacts instead of
+  silently rejecting them as outside every known install target — closes a latent gap in Wave 4's
+  own skill-pack-only implementation, caught while extending the same guard for the MCP config file.
+
+- **Feature**: ADR-139 global-vs-workspace install scope resolution (`@skillsmith/core/install`,
+  SMI-6274 Wave 4). New `resolveSkillScope()`/`resolveScopedSkillsDir()` resolve whether an
+  install/list/update/remove targets a client's global directory (`CLIENT_NATIVE_PATHS`) or a
+  workspace-local one (`<workspace-root>/<client's CLIENT_WORKSPACE_SEGMENTS>`, a new sibling
+  table to `CLIENT_NATIVE_PATHS`), by a five-rank precedence: explicit scope > `SKILLSMITH_SCOPE`
+  env var > per-client `~/.skillsmith/config.json` default (new `defaultScope` field) >
+  auto-detection of an EXISTING workspace marker > global. The workspace-root boundary is
+  marker-first, then nearest-ancestor `.git` (file OR directory, so worktrees and submodules
+  each resolve to their own root) via a new `findWorkspaceRoot()` — deliberately not a reuse of
+  `findMainRepoRoot()` (`doc-retrieval-mcp`), whose opposite `.git`-must-be-a-directory predicate
+  exists for a different purpose. Workspace-scoped installs record in a workspace-local
+  `<root>/.skillsmith/manifest.json`, leaving the global manifest and `manifestKeyFor()`
+  completely untouched. `installAgentPack({ scope: 'workspace' })` can now bootstrap AntiGravity
+  as a target in a fresh repo by creating `.agents/skills` — the only path permitted to create a
+  workspace directory implicitly. `performUninstall()` now adopts an untracked skill (present on
+  disk, no manifest entry) by reconstructing a manifest entry from disk state instead of requiring
+  `force=true`. `ManifestManager` gained a public `path` getter. `buildAdoptedManifestEntry()` —
+  the reconstruction builder `performUninstall()` uses — is now exported at the package root
+  (`@skillsmith/core`) alongside `manifestKeyFor`/`hashContent` so `@skillsmith/cli`'s `update`
+  path reuses the identical adoption logic instead of a second, driftable copy (PR review
+  follow-up: `update` previously never adopted an untracked skill at all, only `remove` did, and
+  could dead-end at `'unresolvable'` with zero side effects even when a skill's source genuinely
+  couldn't be recovered).
+
+- **Fix**: `agent install` no longer writes a broken Cursor MCP registration. Two independent
+  bugs, both from before Cursor's MCP snippet was fixed in SMI-5893: the installer still wrote
+  the `npx`-form command that reliably fails inside Cursor's bundled Node, without the
+  `SKILLSMITH_CLIENT` variable, so even the documented fix-it command (`agent install`) rewrote
+  the same broken config; and the installer's entry lived under a different JSON key than the
+  one users are told to paste from the website, so following both instructions left two
+  unreconciled server entries in the same file instead of one. Re-running `agent install` now
+  also cleans up a pre-fix install's stale entry (GH#2368, SMI-6279)
+
+- **Breaking**: `SyncEngine` now fetches via a new `registry-sync` Edge Function instead of
+  abusing the public `skills-search` endpoint with 8 hardcoded broad queries — this transport
+  is Team+ tier only server-side (see `@skillsmith/cli`'s changelog and ADR-136), so `SyncEngine.
+  sync()` will fail for a Community/Individual-tier API client. Also fixes a real completeness
+  gap in the old mechanism: any skill whose name/tags never matched one of the 8 hardcoded terms
+  was silently never synced. `since` is now forwarded server-side for differential syncs instead
+  of filtering client-side after downloading the entire registry. New `SkillsmithApiClient`
+  methods `syncRegistry()`/`getStats()` back this change (SMI-6236)
+
 ## v0.12.1
 
 - **Fix**: logout/whoami now detect JWT device-code sessions (#2578)
@@ -225,6 +388,7 @@ All notable changes to `@skillsmith/core` are documented here.
 ## v0.11.6
 
 - **Fix**: Harden manifest concurrency (uninstall lock, temp-file races) (#2331)
+- **Fix**: `scanPatternsWithMultilineSupport` (`security/scanner/SecurityScanner.helpers.ts`) tested each `content`/`both`-scope pattern with a non-global regex `.match()`, returning only the *first* match in the whole document — a real jailbreak/prompt-injection attack repeated later in a long skill could undercount and slip past the quarantine threshold. Rewritten as a per-pattern global-exec loop bounded by `MAX_MULTILINE_LINES_PER_PATTERN` (64, score-neutral) and `MAX_MULTILINE_ITERATIONS_PER_PATTERN` (10,000, wall-clock liveness only, sets `ScanReport.multilineTruncated`); also fixes an off-by-one where a match capturing a leading `(?:^|\n)` anchor reported `.index` at the *previous* line's newline instead of the matched line's own start. `MAX_CONTENT_LENGTH_FOR_REGEX` (pass-1 full-content cap) raised from 10,000 to 1,000,000 chars, closing a truncation blind spot on real-sized SKILL.md files (re-benchmarked: ~56ms worst case at 1MB, linear to 4MB). `multilineTruncated` is now enforced at every quarantine write path (Node + Deno indexer runtimes, and this package's own `trust-scorer.ts`) — a truncated scan can only raise a verdict, never lower one (SMI-5879, SMI-6020)
 - **Fix**: code-review follow-up on the Antigravity `directory-package` companion-agent path (two BLOCKING findings). (1) `resolveCompanionAgentPath()` gains an explicit 3rd `baseDir` param (default `process.cwd()`) instead of letting Antigravity's relative `dir` resolve implicitly against whatever `process.cwd()` happens to be at the exact `fs` call that consumes the path — wrong for the long-running MCP server, whose cwd is fixed at launch and does not track the calling editor/agent's real project. `writeInstallFiles()` gains a matching optional `companionBaseDir` param, threaded through both its callers (`SkillInstallationService.install()` via a new `companionBaseDir` constructor param, and `installFromContent()`); the MCP `install_skill` tool gains an optional `cwd` input field passed through as `companionBaseDir` so a caller can supply its real project root. (2) `resolveCompanionAgentPath()`'s `directory-package` branch now rejects an unsafe `skillName` (`''`, `'.'`, `'..'`, or containing `/`/`\`) before building the path — `skillName` becomes its own path segment in this mode, so `'..'` would otherwise `path.join`-normalize outside the intended companion-agent directory. Not exploitable through either current caller (both already sanitize `skillName` upstream), but the function is exported/reusable with no validation of its own, so it now enforces the same "last line of defense" standard already applied to `skillNameFromSkillId()` (SMI-5982)
 - **Feature**: `antigravity` is now a real `ClientId` (`install/paths.ts`) — `CLIENT_NATIVE_PATHS['antigravity'] = ~/.gemini/config/skills`, un-deferred from `compatibility/slugs.ts`'s `BROWSE_ONLY_SLUGS` (which now only contains `gemini`), and given its own `CLIENT_TO_COMPATIBILITY_SLUG` entry. `CompanionAgentTarget.fileMode` gains a second value, `'directory-package'` (Antigravity only today) — a per-skill subdirectory `<dir>/<skillName>/agent.md`, instead of every other client's flat `<dir>/<name>-suffix.md`; `resolveCompanionAgentPath()` is now mode-aware. Antigravity's companion-agent output is project-scoped (`.agents/agents/<name>/agent.md`, relative to the invocation directory) — this CLI has no existing global-vs-project install-mode distinction to hook into, confirmed by grep, so global scope (`~/.gemini/config/agents/`) is a fast-follow, not implemented here (SMI-5982)
 - **Fix**: `writeInstallFiles()`'s rollback path could leave behind an orphaned, empty per-skill companion-agent directory when a new `directory-package`-mode install (Antigravity) failed partway through — every other client's agents dir is shared and pre-existing, so this hazard never applied to them. Cleanup uses a non-recursive `rmdir`, a safe no-op when the directory was never created or holds unexpected surviving content (SMI-5982)

package/README.md

@@ -6,13 +6,13 @@ Part of Skillsmith: a registry for sharing, scanning, and tracking agent skills
 
 ## Contents
 
-- [What's New](#whats-new-in-v0121)
+- [What's New](#whats-new-in-v0123)
 - [Installation](#installation)
 - [Quick Start](#quick-start)
 - [Features](#features)
 - [Exports](#exports)
 
-## What's New in v0.12.1
+## What's New in v0.12.3
 
 - **New `resolveSessionTier` client** (`sync/license-status-client.ts`): authenticates a stored `skillsmith login` session against `/license-status` so the MCP server can resolve a real subscription tier without a separately-configured `SKILLSMITH_API_KEY`, instead of silently falling back to `community`.
 - **Scanner: bundled-file scan expanded to operational code** (Gap 8 of the ClawHavoc remediation): the indexer now reads `scripts/`, `src/`, and `bin/` alongside `SKILL.md`, closing a blind spot where a backdoor buried mid-function in working operational code was structurally invisible.