@standardagents/spec 0.38.0 → 0.38.2

package/dist/index.d.ts

@@ -833,6 +833,10 @@ interface UserHandle extends ThreadUser {
      * scope's serialization guarantee. The runtime MUST NOT require network
      * self-addressing to fulfill this call. Rejects for user-less threads.
      *
+     * The endpoint is always relative to the packaged user-endpoint namespace.
+     * Runtimes reject dot-segment traversal (including encoded/backslash forms)
+     * rather than allowing URL normalization to address another hub route.
+     *
      * @param endpoint - The user endpoint path (e.g. `"standardcode/lease_acquire"`)
      * @param payload - JSON-serializable request body (POSTed to the handler)
      */
@@ -952,16 +956,17 @@ declare function isUserEndpoint(value: unknown): value is MarkedUserEndpoint;
 declare function defineUserEndpoint(handler: UserEndpointHandler): MarkedUserEndpoint;
 
 /**
- * Agent Skills — instance-global skill store types.
+ * Agent Skills — principal-scoped skill store types.
  *
  * Skills follow the Agent Skills standard (https://agentskills.io): a folder
  * whose root SKILL.md opens with YAML frontmatter carrying a required `name`
  * (lowercase kebab, ≤64 chars) and `description` (≤1024 chars), optionally
  * accompanied by scripts, references, and assets.
  *
- * Runtimes store skills server-side as a GLOBAL, instance-wide library:
- * installed once, visible to every thread, nothing persisted on a client
- * machine. Progressive disclosure is the contract — agents see only each
+ * Runtimes store skills server-side and scope visibility to the calling
+ * principal. A runtime may additionally expose administrator-reviewed shared
+ * skills. One principal's private skill MUST NOT be visible to another.
+ * Progressive disclosure is the contract — agents see only each
  * skill's name + description until a skill is judged applicable, at which
  * point they load its SKILL.md body (and, when needed, read or execute its
  * bundled files).
@@ -987,9 +992,9 @@ interface SkillFileInput {
     content: string;
 }
 /**
- * ThreadState surface for the global skill library. All operations hit the
- * instance-wide store — there is no per-thread skill state beyond what a
- * thread chooses to keep in its own key-value store.
+ * ThreadState surface for the calling thread owner's skill library plus any
+ * explicitly shared runtime skills. Owner-scoped names take precedence over a
+ * shared skill with the same name.
  */
 interface SkillsNamespace {
     /** Installed skills (enabled only, unless includeDisabled). */
@@ -1007,11 +1012,16 @@ interface SkillsNamespace {
      * Install (or replace) a skill from its file set. The file set must include
      * a root SKILL.md with valid frontmatter; the skill's identity comes from
      * that frontmatter, never from a caller-supplied name.
+     *
+     * Runtimes MUST authorize mutation and confine it to the calling principal's
+     * scope. Multi-tenant runtimes MUST NOT permit ordinary tenant agent code to
+     * mutate shared skills; an administrative or equivalently trusted principal
+     * is required for shared-library changes.
      */
     install(files: SkillFileInput[]): Promise<SkillMetadata>;
-    /** Enable/disable an installed skill. Returns false when not installed. */
+    /** Enable/disable an installed skill. Requires mutation authorization. */
     setEnabled(name: string, enabled: boolean): Promise<boolean>;
-    /** Uninstall a skill entirely. Returns false when not installed. */
+    /** Uninstall a skill entirely. Requires mutation authorization. */
     remove(name: string): Promise<boolean>;
 }
 
@@ -1961,6 +1971,21 @@ interface ThreadState {
      * @throws If the variable is not defined in any source
      */
     env(propertyName: string): Promise<string>;
+    /**
+     * Resolve an environment value exclusively from the runtime instance.
+     *
+     * Unlike `env()`, this method never considers thread, agent, prompt, or user
+     * values. Use it for security-sensitive instance configuration such as
+     * trusted service endpoints and the credentials sent to those endpoints.
+     *
+     * This capability is optional for backward compatibility with runtimes that
+     * predate instance-scoped environment access. Consumers that require an
+     * instance trust boundary MUST fail closed when the method is unavailable.
+     *
+     * @returns The instance value, or `undefined` when the key is not configured
+     * @throws If the runtime cannot read the instance environment
+     */
+    instanceEnv?(propertyName: string): Promise<string | undefined>;
     /**
      * Resolve the display/redaction type for an environment value.
      *
@@ -2226,7 +2251,8 @@ interface ThreadState {
      *
      * Resolves a {@link UserHandle}: the identity fields (never credentials)
      * plus user-scope capabilities — `call()` into packaged user endpoints
-     * under the user scope's serialization guarantee, durable user values,
+     * under the user scope's serialization guarantee (with endpoint paths
+     * confined to that namespace), durable user values,
      * `emit()` on the user event stream, and privileged `fetch()` through
      * credential grants.
      *
@@ -2240,10 +2266,12 @@ interface ThreadState {
      */
     user(): Promise<UserHandle | null>;
     /**
-     * The instance-global Agent Skills library (https://agentskills.io format).
+     * The thread owner's Agent Skills library plus explicitly shared skills
+     * (https://agentskills.io format).
      *
-     * Skills are installed once and visible to every thread; their files live
-     * server-side (never on a client machine). Agents should follow progressive
+     * Private skills are visible only to the owning principal; administrator-
+     * reviewed shared skills may also be visible. Their files live server-side
+     * (never on a client machine). Agents should follow progressive
      * disclosure: browse metadata via `skills.list()`, and load a skill's
      * SKILL.md body with `skills.get()` only when it is applicable to the task.
      *