@vibe-agent-toolkit/agent-skills 0.1.39-rc.8 → 0.1.39

package/dist/skill-source/git-clone.js

@@ -1,6 +1,31 @@
 import { spawnSync } from 'node:child_process';
 import { existsSync, readdirSync } from 'node:fs';
 import { safePath } from '@vibe-agent-toolkit/utils';
+/** Hard wall-clock cap on any single git invocation (clone or rev-parse). */
+const GIT_TIMEOUT_MS = 60_000;
+/** Generous stdout/stderr cap (64 MiB) so large clones don't trip the default 1 MiB limit. */
+const GIT_MAX_BUFFER = 64 * 1024 * 1024;
+/**
+ * Run git with a wall-clock timeout and a generous output buffer. On timeout,
+ * spawnSync sets `.error` (code `ETIMEDOUT`) and kills the process — surface a
+ * clear error instead of letting a generic non-zero-status message swallow it.
+ */
+function runGit(args, cwd) {
+    // eslint-disable-next-line sonarjs/no-os-command-from-path -- git is a standard system command
+    const result = spawnSync('git', args, {
+        ...(cwd === undefined ? {} : { cwd }),
+        encoding: 'utf-8',
+        stdio: ['pipe', 'pipe', 'pipe'],
+        timeout: GIT_TIMEOUT_MS,
+        maxBuffer: GIT_MAX_BUFFER,
+    });
+    const err = result.error;
+    if (err?.code === 'ETIMEDOUT') {
+        throw new Error(`git ${args[0] ?? ''} timed out after ${(GIT_TIMEOUT_MS / 1000).toString()}s ` +
+            `(possible unreachable remote or hang).`);
+    }
+    return result;
+}
 /**
  * Shallow-clone `parsed` into the caller-provided `targetTempdir`, validate any
  * subpath, and return the resolved ref/commit/targetDir.
@@ -36,9 +61,11 @@ function cloneShallow(parsed, tempdir) {
     const args = ['clone', '--depth', '1', '--single-branch'];
     if (parsed.ref !== undefined)
         args.push('--branch', parsed.ref);
-    args.push(parsed.cloneUrl, tempdir);
-    // eslint-disable-next-line sonarjs/no-os-command-from-path -- git is a standard system command
-    const result = spawnSync('git', args, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
+    // `--` ends option parsing so a cloneUrl/tempdir that begins with `-` can never
+    // be read as a git option (defense in depth — parseGitUrl already rejects such
+    // URLs, but the separator makes the guarantee local to the spawn).
+    args.push('--', parsed.cloneUrl, tempdir);
+    const result = runGit(args);
     const status = result.status ?? 1;
     if (status !== 0) {
         const stderr = (result.stderr ?? '').trim();
@@ -51,16 +78,12 @@ function cloneShallow(parsed, tempdir) {
     return parsed.ref ?? 'HEAD';
 }
 function revParseHead(tempdir) {
-    // eslint-disable-next-line sonarjs/no-os-command-from-path -- git is a standard system command
-    const result = spawnSync('git', ['rev-parse', 'HEAD'], {
-        cwd: tempdir,
-        encoding: 'utf-8',
-        stdio: ['pipe', 'pipe', 'pipe'],
-    });
+    const result = runGit(['rev-parse', 'HEAD'], tempdir);
     const status = result.status ?? 1;
     if (status !== 0) {
         throw new Error(`Failed to resolve HEAD commit in cloned repo: ${(result.stderr ?? '').trim()}`);
     }
-    return (result.stdout ?? '').trim().slice(0, 8);
+    // Full 40-char SHA: the commit is the git cache key, so truncation risks cross-repo collisions.
+    return (result.stdout ?? '').trim();
 }
 //# sourceMappingURL=git-clone.js.map

package/dist/skill-source/git-clone.js.map

@@ -1 +1 @@
-{"version":3,"file":"git-clone.js","sourceRoot":"","sources":["../../src/skill-source/git-clone.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAElD,OAAO,EAAE,QAAQ,EAAqB,MAAM,2BAA2B,CAAC;AAYxE;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,MAAoB,EAAE,aAAqB;IACxE,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;IAC3C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IAC3B,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;IAElF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACnD,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACrD,MAAM,MAAM,GACV,cAAc,KAAK,YAAY,IAAI,cAAc,CAAC,UAAU,CAAC,GAAG,YAAY,GAAG,CAAC,CAAC;QACnF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,0CAA0C,OAAO,IAAI;gBACnD,wEAAwE,CAC3E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,kHAAkH;IAClH,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,sFAAsF;QACtF,MAAM,QAAQ,GAAG,WAAW,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,IAAI,KAAK,CACb,qCAAqC,OAAO,IAAI,QAAQ,yBAAyB,QAAQ,GAAG,CAC7F,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,YAAY,CAAC,MAAoB,EAAE,OAAe;IACzD,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAChE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAEpC,+FAA+F;IAC/F,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9F,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IAClC,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CACb,0BAA0B,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,GAAG,IAAI;gBAC1D,8FAA8F,CACjG,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC;AAC9B,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,+FAA+F;IAC/F,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE;QACrD,GAAG,EAAE,OAAO;QACZ,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;KAChC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IAClC,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAClD,CAAC"}
+{"version":3,"file":"git-clone.js","sourceRoot":"","sources":["../../src/skill-source/git-clone.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAyB,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAElD,OAAO,EAAE,QAAQ,EAAqB,MAAM,2BAA2B,CAAC;AAExE,6EAA6E;AAC7E,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,8FAA8F;AAC9F,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAYxC;;;;GAIG;AACH,SAAS,MAAM,CAAC,IAAc,EAAE,GAAY;IAC1C,+FAA+F;IAC/F,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;QACpC,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;QACrC,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;QAC/B,OAAO,EAAE,cAAc;QACvB,SAAS,EAAE,cAAc;KAC1B,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,MAAM,CAAC,KAA0C,CAAC;IAC9D,IAAI,GAAG,EAAE,IAAI,KAAK,WAAW,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,oBAAoB,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,IAAI;YAC5E,wCAAwC,CAC3C,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,MAAoB,EAAE,aAAqB;IACxE,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;IAC3C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IAC3B,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;IAElF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACnD,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACrD,MAAM,MAAM,GACV,cAAc,KAAK,YAAY,IAAI,cAAc,CAAC,UAAU,CAAC,GAAG,YAAY,GAAG,CAAC,CAAC;QACnF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,0CAA0C,OAAO,IAAI;gBACnD,wEAAwE,CAC3E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,kHAAkH;IAClH,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,sFAAsF;QACtF,MAAM,QAAQ,GAAG,WAAW,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,IAAI,KAAK,CACb,qCAAqC,OAAO,IAAI,QAAQ,yBAAyB,QAAQ,GAAG,CAC7F,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,YAAY,CAAC,MAAoB,EAAE,OAAe;IACzD,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAChE,gFAAgF;IAChF,+EAA+E;IAC/E,mEAAmE;IACnE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAE1C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IAClC,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CACb,0BAA0B,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,GAAG,IAAI;gBAC1D,8FAA8F,CACjG,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC;AAC9B,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IAClC,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACnG,CAAC;IACD,gGAAgG;IAChG,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AACtC,CAAC"}

package/dist/skill-source/sources/url-source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"url-source.d.ts","sourceRoot":"","sources":["../../../src/skill-source/sources/url-source.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAElF;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,GAAG,EAAE,yBAAyB,GAC7B,OAAO,CAAC,mBAAmB,CAAC,CAQ9B;AAkGD,+EAA+E;AAC/E,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE9C"}
+{"version":3,"file":"url-source.d.ts","sourceRoot":"","sources":["../../../src/skill-source/sources/url-source.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAKlF;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,GAAG,EAAE,yBAAyB,GAC7B,OAAO,CAAC,mBAAmB,CAAC,CAQ9B;AAiHD,+EAA+E;AAC/E,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE9C"}

package/dist/skill-source/sources/url-source.js

@@ -1,11 +1,12 @@
 import { createHash } from 'node:crypto';
 import { mkdtempSync, readFileSync } from 'node:fs';
 import { rm } from 'node:fs/promises';
-import { basename } from 'node:path';
 import { isGitUrl, normalizedTmpdir, parseGitUrl, safePath } from '@vibe-agent-toolkit/utils';
 import { withCachedFetch } from '../fetch-cache.js';
 import { cloneGitSource } from '../git-clone.js';
 import { stageDirInto } from '../stage.js';
+/** Wall-clock cap on a single network fetch of zip bytes. */
+const FETCH_TIMEOUT_MS = 30_000;
 /**
  * Resolve a `{ url, sha256? }` skill source.
  *
@@ -42,7 +43,7 @@ async function resolveGitUrl(url, ctx) {
         const cached = await withCachedFetch({
             cacheDir: ctx.fetchCacheDir,
             digest: commit,
-            key: sanitizeKey(parsed.cloneUrl),
+            key: keyForUrl(parsed.cloneUrl),
             ...(ctx.refresh === undefined ? {} : { refresh: ctx.refresh }),
             fetchInto: async (dir) => {
                 await stageDirInto(targetDir, { ...ctx, stagingRoot: dir }, '.');
@@ -66,11 +67,11 @@ async function resolveZipUrl(url, sha256, ctx) {
     const cached = await withCachedFetch({
         cacheDir: ctx.fetchCacheDir,
         digest: sha256,
-        key: sanitizeKey(url),
+        key: keyForUrl(url),
         ...(ctx.refresh === undefined ? {} : { refresh: ctx.refresh }),
         fetchInto: async (dir) => {
             const bytes = await fetchBytes(url);
-            const actual = createHash('sha256').update(bytes).digest('hex');
+            const actual = sha256Of(bytes);
             if (actual !== sha256) {
                 throw new Error(`sha256 mismatch for ${url}: expected ${sha256}, got ${actual} (integrity check failed).`);
             }
@@ -90,7 +91,16 @@ async function fetchBytes(url) {
         // eslint-disable-next-line security/detect-non-literal-fs-filename -- file:// URL provided by config
         return readFileSync(fileURLToPath(url));
     }
-    const res = await fetch(url);
+    let res;
+    try {
+        res = await fetch(url, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
+    }
+    catch (err) {
+        if (err instanceof Error && err.name === 'TimeoutError') {
+            throw new Error(`Timed out fetching ${url} after ${(FETCH_TIMEOUT_MS / 1000).toString()}s.`);
+        }
+        throw err;
+    }
     if (!res.ok) {
         throw new Error(`Failed to fetch ${url}: HTTP ${res.status.toString()}.`);
     }
@@ -102,9 +112,14 @@ async function extractZipBytes(bytes, dir) {
     const zip = new AdmZip(bytes);
     zip.extractAllTo(dir, /* overwrite */ true);
 }
-/** Reduce a URL to a filesystem-safe key segment. */
-function sanitizeKey(url) {
-    return basename(url).replaceAll(/[^A-Za-z0-9._-]/g, '_') || 'url';
+/**
+ * Derive a filesystem-safe, collision-resistant cache key from the FULL url
+ * (host + path), not its basename. `github.com/a/skill.git` and
+ * `gitlab.com/b/skill.git` share the basename `skill.git`; hashing the whole url
+ * keeps their cache entries distinct so a hit never serves the wrong tree.
+ */
+function keyForUrl(url) {
+    return sha256Of(Buffer.from(url, 'utf-8'));
 }
 /** Re-export so unit tests / callers can compute a zip digest the same way. */
 export function sha256Of(bytes) {

package/dist/skill-source/sources/url-source.js.map

@@ -1 +1 @@
-{"version":3,"file":"url-source.js","sourceRoot":"","sources":["../../../src/skill-source/sources/url-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAE9F,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAW,EACX,MAA0B,EAC1B,GAA8B;IAE9B,uEAAuE;IACvE,0EAA0E;IAC1E,wCAAwC;IACxC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,OAAO,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;AACzC,CAAC;AAED,4EAA4E;AAC5E,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,eAAe,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;IACjD,OAAO,eAAe,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,GAAW,EACX,GAA8B;IAE9B,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAChC,iFAAiF;IACjF,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;IAC7E,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC5D,4EAA4E;QAC5E,2CAA2C;QAC3C,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,OAAO,GAAG,IAAI,MAAM,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;YACnC,QAAQ,EAAE,GAAG,CAAC,aAAa;YAC3B,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC;YACjC,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;YAC9D,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBACvB,MAAM,YAAY,CAAC,SAAS,EAAE,EAAE,GAAG,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;YACnE,CAAC;YACD,MAAM,EAAE,KAAK,IAAI,EAAE;gBACjB,sEAAsE;YACxE,CAAC;SACF,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,MAAM,EAAE,CAAC,CAAC;QACvE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IACjC,CAAC;YAAS,CAAC;QACT,8EAA8E;QAC9E,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,GAAW,EACX,MAA0B,EAC1B,GAA8B;IAE9B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,qDAAqD,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;QACnC,QAAQ,EAAE,GAAG,CAAC,aAAa;QAC3B,MAAM,EAAE,MAAM;QACd,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC;QACrB,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;QAC9D,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACvB,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAChE,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CACb,uBAAuB,GAAG,cAAc,MAAM,SAAS,MAAM,4BAA4B,CAC1F,CAAC;YACJ,CAAC;YACD,MAAM,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACrB,uFAAuF;QACzF,CAAC;KACF,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,MAAM,EAAE,CAAC,CAAC;IACvE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,GAAG,IAAI,MAAM,EAAE,EAAE,CAAC;AACzD,CAAC;AAED,sFAAsF;AACtF,KAAK,UAAU,UAAU,CAAC,GAAW;IACnC,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QACnD,qGAAqG;QACrG,OAAO,YAAY,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,UAAU,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED,6EAA6E;AAC7E,KAAK,UAAU,eAAe,CAAC,KAAa,EAAE,GAAW;IACvD,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;IACjD,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9B,GAAG,CAAC,YAAY,CAAC,GAAG,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED,qDAAqD;AACrD,SAAS,WAAW,CAAC,GAAW;IAC9B,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,kBAAkB,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC;AACpE,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC"}
+{"version":3,"file":"url-source.js","sourceRoot":"","sources":["../../../src/skill-source/sources/url-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAEtC,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAE9F,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,6DAA6D;AAC7D,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAW,EACX,MAA0B,EAC1B,GAA8B;IAE9B,uEAAuE;IACvE,0EAA0E;IAC1E,wCAAwC;IACxC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,OAAO,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;AACzC,CAAC;AAED,4EAA4E;AAC5E,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,eAAe,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;IACjD,OAAO,eAAe,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,GAAW,EACX,GAA8B;IAE9B,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAChC,iFAAiF;IACjF,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;IAC7E,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC5D,4EAA4E;QAC5E,2CAA2C;QAC3C,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,OAAO,GAAG,IAAI,MAAM,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;YACnC,QAAQ,EAAE,GAAG,CAAC,aAAa;YAC3B,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC/B,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;YAC9D,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBACvB,MAAM,YAAY,CAAC,SAAS,EAAE,EAAE,GAAG,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;YACnE,CAAC;YACD,MAAM,EAAE,KAAK,IAAI,EAAE;gBACjB,sEAAsE;YACxE,CAAC;SACF,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,MAAM,EAAE,CAAC,CAAC;QACvE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IACjC,CAAC;YAAS,CAAC;QACT,8EAA8E;QAC9E,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,GAAW,EACX,MAA0B,EAC1B,GAA8B;IAE9B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,qDAAqD,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;QACnC,QAAQ,EAAE,GAAG,CAAC,aAAa;QAC3B,MAAM,EAAE,MAAM;QACd,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC;QACnB,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;QAC9D,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACvB,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;YACpC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CACb,uBAAuB,GAAG,cAAc,MAAM,SAAS,MAAM,4BAA4B,CAC1F,CAAC;YACJ,CAAC;YACD,MAAM,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACrB,uFAAuF;QACzF,CAAC;KACF,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,MAAM,EAAE,CAAC,CAAC;IACvE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,GAAG,IAAI,MAAM,EAAE,EAAE,CAAC;AACzD,CAAC;AAED,sFAAsF;AACtF,KAAK,UAAU,UAAU,CAAC,GAAW;IACnC,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QACnD,qGAAqG;QACrG,OAAO,YAAY,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CACb,sBAAsB,GAAG,UAAU,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,IAAI,CAC5E,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,UAAU,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED,6EAA6E;AAC7E,KAAK,UAAU,eAAe,CAAC,KAAa,EAAE,GAAW;IACvD,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;IACjD,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9B,GAAG,CAAC,YAAY,CAAC,GAAG,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC"}

package/dist/skill-source/sources/workspace-source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-source.d.ts","sourceRoot":"","sources":["../../../src/skill-source/sources/workspace-source.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAElF,MAAM,WAAW,uBAAuB;IACtC,kFAAkF;IAClF,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,yBAAyB,EAC9B,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CAY9B"}
+{"version":3,"file":"workspace-source.d.ts","sourceRoot":"","sources":["../../../src/skill-source/sources/workspace-source.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAElF,MAAM,WAAW,uBAAuB;IACtC,kFAAkF;IAClF,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,yBAAyB,EAC9B,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,mBAAmB,CAAC,CAkB9B"}

package/dist/skill-source/sources/workspace-source.js

@@ -1,4 +1,5 @@
 import { mkdtempSync } from 'node:fs';
+import { rm } from 'node:fs/promises';
 import { normalizedTmpdir, safePath, toForwardSlash } from '@vibe-agent-toolkit/utils';
 import { packageSkill } from '../../skill-packager.js';
 import { hashDirectory } from '../content-hash.js';
@@ -15,13 +16,20 @@ import { stageDirInto } from '../stage.js';
  */
 export async function resolveWorkspaceSource(skillName, ctx, opts) {
     const buildOut = toForwardSlash(mkdtempSync(safePath.join(normalizedTmpdir(), 'vat-ws-build-')));
-    const result = await packageSkill(opts.skillPath, {
-        outputPath: safePath.join(buildOut, skillName),
-        formats: ['directory'],
-    });
-    const builtDir = result.outputPath;
-    const hash = await hashDirectory(builtDir);
-    const stagedDir = await stageDirInto(builtDir, ctx, `workspace-${skillName}-${hash}`);
-    return { stagedDir, identity: `workspace:${skillName}:${hash}` };
+    try {
+        const result = await packageSkill(opts.skillPath, {
+            outputPath: safePath.join(buildOut, skillName),
+            formats: ['directory'],
+        });
+        const builtDir = result.outputPath;
+        const hash = await hashDirectory(builtDir);
+        // stageDirInto copies the built bundle OUT into the staging root before we
+        // return, so the build temp dir is safe to remove in the finally below.
+        const stagedDir = await stageDirInto(builtDir, ctx, `workspace-${skillName}-${hash}`);
+        return { stagedDir, identity: `workspace:${skillName}:${hash}` };
+    }
+    finally {
+        await rm(buildOut, { recursive: true, force: true });
+    }
 }
 //# sourceMappingURL=workspace-source.js.map

package/dist/skill-source/sources/workspace-source.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-source.js","sourceRoot":"","sources":["../../../src/skill-source/sources/workspace-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAEtC,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAEvF,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAQ3C;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,SAAiB,EACjB,GAA8B,EAC9B,IAA6B;IAE7B,MAAM,QAAQ,GAAG,cAAc,CAC7B,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,eAAe,CAAC,CAAC,CAChE,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE;QAChD,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC;QAC9C,OAAO,EAAE,CAAC,WAAW,CAAC;KACvB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC;IACnC,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,GAAG,EAAE,aAAa,SAAS,IAAI,IAAI,EAAE,CAAC,CAAC;IACtF,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,SAAS,IAAI,IAAI,EAAE,EAAE,CAAC;AACnE,CAAC"}
+{"version":3,"file":"workspace-source.js","sourceRoot":"","sources":["../../../src/skill-source/sources/workspace-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAEtC,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAEvF,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAQ3C;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,SAAiB,EACjB,GAA8B,EAC9B,IAA6B;IAE7B,MAAM,QAAQ,GAAG,cAAc,CAC7B,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,eAAe,CAAC,CAAC,CAChE,CAAC;IACF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE;YAChD,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC;YAC9C,OAAO,EAAE,CAAC,WAAW,CAAC;SACvB,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC3C,2EAA2E;QAC3E,wEAAwE;QACxE,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,GAAG,EAAE,aAAa,SAAS,IAAI,IAAI,EAAE,CAAC,CAAC;QACtF,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,SAAS,IAAI,IAAI,EAAE,EAAE,CAAC;IACnE,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;AACH,CAAC"}

package/dist/skill-source/stage.js

@@ -39,8 +39,12 @@ function assertOwnedIfExists(dir, currentUid) {
         // eslint-disable-next-line security/detect-non-literal-fs-filename -- ownership probe on our own staging path
         st = statSync(dir);
     }
-    catch {
-        return; // does not exist yet — fine
+    catch (err) {
+        // Only an absent path is safe to ignore. A different error (e.g. EACCES on
+        // an unreadable path) must NOT be silently treated as "absent/safe".
+        if (err.code === 'ENOENT')
+            return;
+        throw err;
     }
     if (currentUid >= 0 && st.uid !== currentUid) {
         throw new Error(`Refusing to stage into '${dir}': directory ownership (uid ${st.uid}) ` +

package/dist/skill-source/stage.js.map

@@ -1 +1 @@
-{"version":3,"file":"stage.js","sourceRoot":"","sources":["../../src/skill-source/stage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAUpF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAc,EACd,GAA8B,EAC9B,GAAW,EACX,OAAqB,EAAE;IAEvB,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAClE,kBAAkB,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IAEhD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IACjD,mBAAmB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAEtC,uGAAuG;IACvG,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,MAAM,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACvC,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,4FAA4F;AAC5F,SAAS,kBAAkB,CAAC,GAAW,EAAE,UAAkB;IACzD,aAAa,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,mBAAmB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACrC,2EAA2E;IAC3E,iFAAiF;IACjF,iHAAiH;IACjH,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAW,EAAE,UAAkB;IAC1D,IAAI,EAAE,CAAC;IACP,IAAI,CAAC;QACH,8GAA8G;QAC9G,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,4BAA4B;IACtC,CAAC;IACD,IAAI,UAAU,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,2BAA2B,GAAG,+BAA+B,EAAE,CAAC,GAAG,IAAI;YACrE,wCAAwC,UAAU,gCAAgC,CACrF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,KAAK,UAAU,kBAAkB,CAAC,GAAW,EAAE,IAAY;IACzD,mGAAmG;IACnG,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACjD,6DAA6D;QAC7D,wGAAwG;QACxG,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAI,EAAE,CAAC,cAAc,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,8BAA8B,OAAO,uDAAuD,CAC7F,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;YACrB,2GAA2G;YAC3G,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3C,MAAM,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC9C,CAAC;aAAM,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;YACvB,MAAM,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"stage.js","sourceRoot":"","sources":["../../src/skill-source/stage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAUpF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAc,EACd,GAA8B,EAC9B,GAAW,EACX,OAAqB,EAAE;IAEvB,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAClE,kBAAkB,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IAEhD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IACjD,mBAAmB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAEtC,uGAAuG;IACvG,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,MAAM,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACvC,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,4FAA4F;AAC5F,SAAS,kBAAkB,CAAC,GAAW,EAAE,UAAkB;IACzD,aAAa,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,mBAAmB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACrC,2EAA2E;IAC3E,iFAAiF;IACjF,iHAAiH;IACjH,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAW,EAAE,UAAkB;IAC1D,IAAI,EAAE,CAAC;IACP,IAAI,CAAC;QACH,8GAA8G;QAC9G,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,2EAA2E;QAC3E,qEAAqE;QACrE,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO;QAC7D,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,UAAU,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,2BAA2B,GAAG,+BAA+B,EAAE,CAAC,GAAG,IAAI;YACrE,wCAAwC,UAAU,gCAAgC,CACrF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,KAAK,UAAU,kBAAkB,CAAC,GAAW,EAAE,IAAY;IACzD,mGAAmG;IACnG,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACjD,6DAA6D;QAC7D,wGAAwG;QACxG,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAI,EAAE,CAAC,cAAc,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,8BAA8B,OAAO,uDAAuD,CAC7F,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;YACrB,2GAA2G;YAC3G,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3C,MAAM,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC9C,CAAC;aAAM,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;YACvB,MAAM,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/skill-test/build-hook.d.ts

@@ -0,0 +1,58 @@
+/**
+ * build-hook.ts — optional pre-stage build step for `vat skill test run`.
+ *
+ * When the test config includes a `build:` field, this module runs that shell
+ * command ONCE before staging so that generated artifacts (e.g. bundled scripts
+ * not committed to source) are present in the source tree for staging to copy.
+ *
+ * The command runs with cwd = the CONFIG ROOT (the directory containing
+ * vibe-agent-toolkit.config.yaml), because real build commands are root-level
+ * package scripts (e.g. `pnpm bundle:report`).
+ *
+ * Security note: the `build:` field is a developer-authored value from the
+ * project's own vibe-agent-toolkit.config.yaml — a trusted source under the
+ * adopter's source control. The command is passed directly to the OS shell
+ * (shell: true) intentionally, because build commands frequently include shell
+ * syntax (npm script chaining, env vars, etc.). This is equivalent to running
+ * `npm run build` or `pnpm bundle:report` from the terminal; it is NOT arbitrary
+ * user input. The adopter is already executing skill code via this command
+ * (`vat skill test run` requires --i-understand-this-runs-skill-code).
+ */
+/**
+ * Options for the pre-stage build hook.
+ *
+ * `spawnFn` is injectable for unit testing — production code uses the default
+ * (node:child_process spawnSync). Tests inject a vi.fn() mock.
+ */
+export interface BuildHookOptions {
+    /** Shell command to run (from `test.build` in vibe-agent-toolkit.config.yaml). */
+    buildCommand: string | undefined;
+    /** Absolute path to the config root (cwd for the build command). */
+    configRoot: string;
+    /**
+     * Injectable spawn function for unit testing.
+     * Defaults to node:child_process spawnSync when not provided.
+     */
+    spawnFn?: (cmd: string, opts: {
+        shell: boolean;
+        cwd: string;
+        stdio: 'inherit';
+    }) => {
+        status: number | null;
+    };
+}
+/** Thrown when the pre-stage build command exits with a non-zero code. Maps to preflight (exit 2). */
+export declare class BuildHookError extends Error {
+    readonly buildExitCode: number;
+    readonly exitCode: 2;
+    constructor(message: string, buildExitCode: number);
+}
+/**
+ * Run the pre-stage build hook if configured.
+ *
+ * Runs `buildCommand` in a shell with `cwd = configRoot`. On non-zero exit,
+ * throws `BuildHookError` with a clear message naming the command and exit code.
+ * When `buildCommand` is undefined, this is a no-op (behavior unchanged).
+ */
+export declare function runPreStageBuild(opts: BuildHookOptions): void;
+//# sourceMappingURL=build-hook.d.ts.map

package/dist/skill-test/build-hook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-hook.d.ts","sourceRoot":"","sources":["../../src/skill-test/build-hook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kFAAkF;IAClF,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,SAAS,CAAA;KAAE,KAAK;QAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CAC/G;AAED,sGAAsG;AACtG,qBAAa,cAAe,SAAQ,KAAK;aAEM,aAAa,EAAE,MAAM;IADlE,QAAQ,CAAC,QAAQ,EAAG,CAAC,CAAU;gBACnB,OAAO,EAAE,MAAM,EAAkB,aAAa,EAAE,MAAM;CAInE;AAeD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAe7D"}

package/dist/skill-test/build-hook.js

@@ -0,0 +1,63 @@
+/**
+ * build-hook.ts — optional pre-stage build step for `vat skill test run`.
+ *
+ * When the test config includes a `build:` field, this module runs that shell
+ * command ONCE before staging so that generated artifacts (e.g. bundled scripts
+ * not committed to source) are present in the source tree for staging to copy.
+ *
+ * The command runs with cwd = the CONFIG ROOT (the directory containing
+ * vibe-agent-toolkit.config.yaml), because real build commands are root-level
+ * package scripts (e.g. `pnpm bundle:report`).
+ *
+ * Security note: the `build:` field is a developer-authored value from the
+ * project's own vibe-agent-toolkit.config.yaml — a trusted source under the
+ * adopter's source control. The command is passed directly to the OS shell
+ * (shell: true) intentionally, because build commands frequently include shell
+ * syntax (npm script chaining, env vars, etc.). This is equivalent to running
+ * `npm run build` or `pnpm bundle:report` from the terminal; it is NOT arbitrary
+ * user input. The adopter is already executing skill code via this command
+ * (`vat skill test run` requires --i-understand-this-runs-skill-code).
+ */
+import { spawnSync } from 'node:child_process';
+/** Thrown when the pre-stage build command exits with a non-zero code. Maps to preflight (exit 2). */
+export class BuildHookError extends Error {
+    buildExitCode;
+    exitCode = 2;
+    constructor(message, buildExitCode) {
+        super(message);
+        this.buildExitCode = buildExitCode;
+        this.name = 'BuildHookError';
+    }
+}
+/**
+ * Default spawn implementation: runs the command in a shell with stdio inherited.
+ *
+ * `build:` is a developer-authored shell command from the adopter's own config
+ * (vibe-agent-toolkit.config.yaml), equivalent to running `pnpm bundle:report` at the
+ * terminal. It is NOT arbitrary user input. The adopter already acknowledges running
+ * skill code via --i-understand-this-runs-skill-code.
+ */
+function defaultSpawn(cmd, opts) {
+    // eslint-disable-next-line sonarjs/os-command -- developer-authored build command from trusted project config; equivalent to running pnpm/npm build manually
+    return spawnSync(cmd, { ...opts, shell: true });
+}
+/**
+ * Run the pre-stage build hook if configured.
+ *
+ * Runs `buildCommand` in a shell with `cwd = configRoot`. On non-zero exit,
+ * throws `BuildHookError` with a clear message naming the command and exit code.
+ * When `buildCommand` is undefined, this is a no-op (behavior unchanged).
+ */
+export function runPreStageBuild(opts) {
+    const { buildCommand, configRoot } = opts;
+    if (buildCommand === undefined)
+        return;
+    const spawn = opts.spawnFn ?? defaultSpawn;
+    const result = spawn(buildCommand, { shell: true, cwd: configRoot, stdio: 'inherit' });
+    const status = result.status ?? -1;
+    if (status !== 0) {
+        throw new BuildHookError(`Pre-stage build hook failed: command "${buildCommand}" exited with code ${status}. ` +
+            `Resolve the build error before running vat skill test run.`, status);
+    }
+}
+//# sourceMappingURL=build-hook.js.map

package/dist/skill-test/build-hook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-hook.js","sourceRoot":"","sources":["../../src/skill-test/build-hook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAoB/C,sGAAsG;AACtG,MAAM,OAAO,cAAe,SAAQ,KAAK;IAEM;IADpC,QAAQ,GAAG,CAAU,CAAC;IAC/B,YAAY,OAAe,EAAkB,aAAqB;QAChE,KAAK,CAAC,OAAO,CAAC,CAAC;QAD4B,kBAAa,GAAb,aAAa,CAAQ;QAEhE,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,GAAW,EAAE,IAAuD;IACxF,6JAA6J;IAC7J,OAAO,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAsB;IACrD,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IAC1C,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO;IAEvC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,IAAI,YAAY,CAAC;IAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;IAEnC,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QACjB,MAAM,IAAI,cAAc,CACtB,yCAAyC,YAAY,sBAAsB,MAAM,IAAI;YACnF,4DAA4D,EAC9D,MAAM,CACP,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/skill-test/configure-writer.d.ts

@@ -1,14 +1,17 @@
 /**
- * configure-writer — comment-preserving YAML upsert for `skills.config.<skill>.test`
+ * configure-writer — byte-surgical YAML upsert for `skills.config.<skill>.test`
  *
- * Pure function: string → string. Uses the yaml Document API (same pattern as
- * frontmatter-editor.ts in packages/resources) so surrounding comments and key
- * ordering are preserved on surgical updates.
+ * Pure function: string → string. Uses `updateYamlIn` from
+ * `@vibe-agent-toolkit/utils` to change the **minimum bytes possible** so
+ * the adopter's hand-authored formatting (inline comments, flow sequences,
+ * long strings, quote styles) is never disturbed outside the touched node.
  *
  * Init case (no existing `test` node): creates `skills.config.<skill>.test` and
- * any intermediate map nodes, writing the supplied knobs.
- * Surgical case (existing `test` node): only updates the supplied knobs, leaving
- * all other knob values and comments intact.
+ * any intermediate map nodes, splicing only the new fragment — every line
+ * outside the inserted block remains byte-identical to the input.
+ * Surgical case (existing `test` node): only the supplied knobs are updated;
+ * sibling knobs, their values, and inline comments are byte-identical to the
+ * input.
  *
  * The output MUST satisfy TestConfigSchema.parse (round-trip invariant) — callers
  * can and should validate before writing.
@@ -18,14 +21,19 @@ import type { TestConfig } from '@vibe-agent-toolkit/resources';
  * Upsert `skills.config.<skillName>.test` in `yamlText` with the supplied knobs.
  *
  * - If `skills.config.<skillName>.test` does not yet exist, creates it (and any
- *   intermediate map nodes) via `setIn`, which preserves surrounding comments.
+ *   intermediate map nodes) by splicing the minimum fragment into the document —
+ *   every line outside the insertion site is byte-identical to the input.
  * - If it already exists, only the knobs present in `knobs` are updated —
- *   unspecified knobs and their values are left intact.
+ *   unspecified knobs and their inline comments are byte-identical to the input.
+ *
+ * Only scalar-valued knobs (string, number, boolean) are supported by this
+ * function. Complex fields (arrays, records) must be written by direct YAML
+ * editing if needed.
  *
  * @param yamlText  - Current content of vibe-agent-toolkit.config.yaml
  * @param skillName - The skill key under `skills.config`
- * @param knobs     - Partial TestConfig to write (only defined keys are touched)
- * @returns Updated YAML text (same EOL style as input)
+ * @param knobs     - Partial TestConfig to write (only defined scalar keys are touched)
+ * @returns Updated YAML text (same EOL style as input, minimum bytes changed)
  */
 export declare function upsertTestConfig(yamlText: string, skillName: string, knobs: Partial<TestConfig>): string;
 //# sourceMappingURL=configure-writer.d.ts.map

package/dist/skill-test/configure-writer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"configure-writer.d.ts","sourceRoot":"","sources":["../../src/skill-test/configure-writer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAGhE;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,GACzB,MAAM,CASR"}
+{"version":3,"file":"configure-writer.d.ts","sourceRoot":"","sources":["../../src/skill-test/configure-writer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAGhE;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,GACzB,MAAM,CAOR"}

package/dist/skill-test/configure-writer.js

@@ -1,39 +1,47 @@
 /**
- * configure-writer — comment-preserving YAML upsert for `skills.config.<skill>.test`
+ * configure-writer — byte-surgical YAML upsert for `skills.config.<skill>.test`
  *
- * Pure function: string → string. Uses the yaml Document API (same pattern as
- * frontmatter-editor.ts in packages/resources) so surrounding comments and key
- * ordering are preserved on surgical updates.
+ * Pure function: string → string. Uses `updateYamlIn` from
+ * `@vibe-agent-toolkit/utils` to change the **minimum bytes possible** so
+ * the adopter's hand-authored formatting (inline comments, flow sequences,
+ * long strings, quote styles) is never disturbed outside the touched node.
  *
  * Init case (no existing `test` node): creates `skills.config.<skill>.test` and
- * any intermediate map nodes, writing the supplied knobs.
- * Surgical case (existing `test` node): only updates the supplied knobs, leaving
- * all other knob values and comments intact.
+ * any intermediate map nodes, splicing only the new fragment — every line
+ * outside the inserted block remains byte-identical to the input.
+ * Surgical case (existing `test` node): only the supplied knobs are updated;
+ * sibling knobs, their values, and inline comments are byte-identical to the
+ * input.
  *
  * The output MUST satisfy TestConfigSchema.parse (round-trip invariant) — callers
  * can and should validate before writing.
  */
-import { parseDocument } from 'yaml';
+import { updateYamlIn } from '@vibe-agent-toolkit/utils';
 /**
  * Upsert `skills.config.<skillName>.test` in `yamlText` with the supplied knobs.
  *
  * - If `skills.config.<skillName>.test` does not yet exist, creates it (and any
- *   intermediate map nodes) via `setIn`, which preserves surrounding comments.
+ *   intermediate map nodes) by splicing the minimum fragment into the document —
+ *   every line outside the insertion site is byte-identical to the input.
  * - If it already exists, only the knobs present in `knobs` are updated —
- *   unspecified knobs and their values are left intact.
+ *   unspecified knobs and their inline comments are byte-identical to the input.
+ *
+ * Only scalar-valued knobs (string, number, boolean) are supported by this
+ * function. Complex fields (arrays, records) must be written by direct YAML
+ * editing if needed.
  *
  * @param yamlText  - Current content of vibe-agent-toolkit.config.yaml
  * @param skillName - The skill key under `skills.config`
- * @param knobs     - Partial TestConfig to write (only defined keys are touched)
- * @returns Updated YAML text (same EOL style as input)
+ * @param knobs     - Partial TestConfig to write (only defined scalar keys are touched)
+ * @returns Updated YAML text (same EOL style as input, minimum bytes changed)
  */
 export function upsertTestConfig(yamlText, skillName, knobs) {
-    const doc = parseDocument(yamlText, { prettyErrors: true });
+    let text = yamlText;
     for (const [key, value] of Object.entries(knobs)) {
         if (value === undefined)
             continue;
-        doc.setIn(['skills', 'config', skillName, 'test', key], value);
+        text = updateYamlIn(text, ['skills', 'config', skillName, 'test', key], value);
     }
-    return doc.toString();
+    return text;
 }
 //# sourceMappingURL=configure-writer.js.map

package/dist/skill-test/configure-writer.js.map

@@ -1 +1 @@
-{"version":3,"file":"configure-writer.js","sourceRoot":"","sources":["../../src/skill-test/configure-writer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;AAErC;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAgB,EAChB,SAAiB,EACjB,KAA0B;IAE1B,MAAM,GAAG,GAAG,aAAa,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC"}
+{"version":3,"file":"configure-writer.js","sourceRoot":"","sources":["../../src/skill-test/configure-writer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,EAAE,YAAY,EAAwB,MAAM,2BAA2B,CAAC;AAE/E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAgB,EAChB,SAAiB,EACjB,KAA0B;IAE1B,IAAI,IAAI,GAAG,QAAQ,CAAC;IACpB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,KAAwB,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/skill-test/declared-env.d.ts

@@ -0,0 +1,72 @@
+/**
+ * declared-env.ts — resolve and assemble the declared test environment
+ * (Features A + B) for the experimenter spawn.
+ *
+ * Feature A (passEnv): forward named host env vars if present.
+ * Feature B (env): inject explicit key→value pairs whose values support
+ * stage-time interpolation tokens. An unknown token is a hard preflight error.
+ *
+ * The security-critical union (protected-key collisions, redaction) lives in
+ * `applyDeclaredEnv`/`formatForwardedEnvLine` (utils); this module owns the
+ * agent-skills-specific concerns: token computation, interpolation, and gluing
+ * the result onto the plugin-root env.
+ */
+/** Resolved stage-time interpolation tokens (all absolute, forward-slash). */
+export interface EnvInterpolationTokens {
+    fixturesDir: string;
+    stagedSkillDir: string;
+    harnessRoot: string;
+    resultsDir: string;
+}
+/**
+ * A declared `env` value referenced an unknown `${token}`. Exit 2 (preflight):
+ * fail loud naming the offending token rather than forwarding a literal `${x}`.
+ */
+export declare class UnknownEnvTokenError extends Error {
+    readonly token: string;
+    readonly key: string;
+    readonly exitCode: 2;
+    constructor(token: string, key: string);
+}
+export interface EnvTokenInputs {
+    subjectStagedDir: string;
+    harnessRoot: string;
+    resultsDir: string;
+    /** Evals subpath (e.g. `evals/evals.json`); fixtures live in its dir's `fixtures/`. */
+    evalsSubpath: string;
+}
+/**
+ * Compute the interpolation tokens from the known staged dirs. `fixturesDir`
+ * tracks the eval suite's directory (`<evalsDir>/fixtures`), so the default
+ * `evals/evals.json` yields `<staged>/evals/fixtures`.
+ */
+export declare function computeEnvTokens(inputs: EnvTokenInputs): EnvInterpolationTokens;
+/** Interpolate every `${token}` in `value`. Throws UnknownEnvTokenError on an unknown token. */
+export declare function interpolateEnvValue(value: string, key: string, tokens: EnvInterpolationTokens): string;
+/** Resolve every value in a declared `env` map. undefined in → undefined out. */
+export declare function resolveInjectEnv(injectEnv: Record<string, string> | undefined, tokens: EnvInterpolationTokens): Record<string, string> | undefined;
+export interface AssembleChildEnvInput {
+    /** The scrubbed, auth-resolved forwarded env (the deny-all base). */
+    base: NodeJS.ProcessEnv;
+    /** Parent env to read Feature-A pass-through values from. */
+    source: NodeJS.ProcessEnv;
+    /** Feature A names. */
+    passEnv?: readonly string[];
+    /** Feature B values, already interpolated. */
+    injectEnv?: Record<string, string>;
+    /** Subject's staged plugin root (null = standalone). */
+    subjectPluginRoot: string | null;
+}
+export interface AssembledChildEnv {
+    env: NodeJS.ProcessEnv;
+    warnings: string[];
+    /** Single-line stderr transparency summary (no trailing newline). */
+    line: string;
+}
+/**
+ * Union the declared test env onto `base`, add the plugin-root var, and render
+ * the transparency line. Protected-key collisions surface as warnings; secrets
+ * and pass-through values are redacted in the line.
+ */
+export declare function assembleChildEnv(input: AssembleChildEnvInput): AssembledChildEnv;
+//# sourceMappingURL=declared-env.d.ts.map

package/dist/skill-test/declared-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"declared-env.d.ts","sourceRoot":"","sources":["../../src/skill-test/declared-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAQH,8EAA8E;AAC9E,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;aAEjB,KAAK,EAAE,MAAM;aAAkB,GAAG,EAAE,MAAM;IADtE,QAAQ,CAAC,QAAQ,EAAG,CAAC,CAAU;gBACH,KAAK,EAAE,MAAM,EAAkB,GAAG,EAAE,MAAM;CAOvE;AAED,MAAM,WAAW,cAAc;IAC7B,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,uFAAuF;IACvF,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,cAAc,GAAG,sBAAsB,CAQ/E;AAYD,gGAAgG;AAChG,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB,GAAG,MAAM,CAEtG;AAED,iFAAiF;AACjF,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EAC7C,MAAM,EAAE,sBAAsB,GAC7B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAOpC;AAED,MAAM,WAAW,qBAAqB;IACpC,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC;IAC1B,uBAAuB;IACvB,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,wDAAwD;IACxD,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,iBAAiB,CAShF"}