@wrongstack/core 0.313.0 → 0.316.1

package/dist/chunk-XEBHSJLT.js

@@ -0,0 +1,103 @@
+// src/skills/limits.ts
+var SKILL_LIMITS = {
+  /**
+   * Per-skill body cap when injecting a full skill body into the system prompt
+   * (eager mode), and when returning a skill body from the `skill` tool.
+   * ~4k tokens. Oversized bodies are truncated at a paragraph boundary.
+   *
+   * Consumers: `system-prompt-builder.capSkillBody`, `skill` tool body return.
+   */
+  MAX_SKILL_BODY_CHARS: 16e3,
+  /**
+   * Per-resource cap when the `skill` tool loads a bundled file
+   * (`scripts/`, `references/`, `assets/`). ~8k tokens.
+   *
+   * Consumer: `skill` tool `loadResource`.
+   */
+  MAX_RESOURCE_CHARS: 32e3,
+  /**
+   * Maximum number of bundled resource paths the `skill` tool lists in one
+   * response. Caps a pathological skill (huge `assets/` tree) from blowing up
+   * the tool result.
+   *
+   * Consumer: `skill` tool resource listing.
+   */
+  MAX_LISTED_RESOURCES: 100,
+  /**
+   * Max size of a single installed skill file (SKILL.md or a bundled resource).
+   * Guards against a malicious registry skill shipping a multi-MB blob that
+   * then flows into the prompt. 100KB.
+   *
+   * Consumer: `SkillInstaller.install` / `importFromDir`.
+   */
+  MAX_SKILL_FILE_SIZE: 100 * 1024,
+  /**
+   * Max size of a GitHub tarball downloaded by the skill installer. Guards
+   * against a repo accidentally (or maliciously) shipping a giant tarball that
+   * would be extracted into a temp dir. 50MB.
+   *
+   * Consumer: `downloadGitHubTarball`.
+   */
+  MAX_TARBALL_SIZE: 50 * 1024 * 1024,
+  /**
+   * Maximum size of a GitHub skill tarball after gzip decompression. The
+   * compressed download limit alone does not protect against highly
+   * compressible archives expanding until the process runs out of memory.
+   *
+   * Consumer: `downloadGitHubTarball`.
+   */
+  MAX_UNCOMPRESSED_TARBALL_SIZE: 64 * 1024 * 1024,
+  /**
+   * Default total char budget for skill bodies injected in eager mode when
+   * `config.skills.eagerMaxChars` is unset. ~6k tokens. Skills are injected
+   * highest-priority first; once the budget is exhausted the remaining skills
+   * are listed as a manifest the agent loads via the `skill` tool. Set very
+   * high to effectively disable budgeting.
+   *
+   * Consumer: `DefaultSystemPromptBuilder.buildMemoryAndSkills` (default for
+   * `skillEagerMaxChars`).
+   */
+  EAGER_DEFAULT_MAX_CHARS: 24e3,
+  /**
+   * Default total char budget for compact (token-saving) skill bodies injected
+   * by `buildCompactSkillBodiesText`. Mirrors the eager ceiling so compact mode
+   * can never inject more total skill text than eager mode. Before this bound
+   * existed, compact mode injected EVERY skill's compact body with no cap, so
+   * the section grew linearly with the number of installed skills. Skills past
+   * the budget overflow to a name list the agent loads via the `skill` tool.
+   *
+   * Consumer: `buildCompactSkillBodiesText` (default for its `budget` param).
+   */
+  COMPACT_DEFAULT_MAX_CHARS: 24e3,
+  /**
+   * Auto-compact body limits (the token-saving fallback used when a skill has
+   * no hand-crafted `SKILL.save.md`). The Overview and Rules sections are
+   * extracted and trimmed to these char budgets, then the total is capped.
+   *
+   * Consumer: `DefaultSkillLoader.compactSkillBody`.
+   */
+  COMPACT_OVERVIEW_MAX: 200,
+  COMPACT_RULES_MAX: 350,
+  COMPACT_TOTAL_MAX: 450,
+  /**
+   * Max length of a skill name (agentskills.io spec). Enforced by the
+   * frontmatter validator's format regex plus this length bound.
+   *
+   * Consumer: `isValidSkillNameFormat`.
+   */
+  SKILL_NAME_MAX_LEN: 64,
+  /**
+   * Soft line limit for a SKILL.md body, per the bundled `skill-creator` rule.
+   * Not enforced in code (a skill can exceed it) — surfaced by `/skill-gen
+   * validate` and the `skill-creator` skill as guidance to move deep material
+   * into `references/`.
+   *
+   * Consumer: `skill-creator` skill, `/skill-gen validate` advisory.
+   */
+  SKILL_BODY_LINE_LIMIT: 500
+};
+
+export {
+  SKILL_LIMITS
+};
+//# sourceMappingURL=chunk-XEBHSJLT.js.map

package/dist/chunk-XF4VUMKW.js

@@ -0,0 +1,231 @@
+import {
+  DefaultPromptStore,
+  migratePromptEntry
+} from "./chunk-PGRVXIMY.js";
+import {
+  PROMPT_CATEGORY_LABELS,
+  isBuiltinCategory
+} from "./chunk-KDQJCT2J.js";
+
+// src/execution/prompt-loader.ts
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+var DefaultPromptLoader = class {
+  projectStore;
+  userStore;
+  builtinDir;
+  cache;
+  builtinCache;
+  constructor(opts) {
+    this.projectStore = typeof opts.paths.inProjectPrompts === "string" ? new DefaultPromptStore(opts.paths.inProjectPrompts) : void 0;
+    this.userStore = typeof opts.paths.globalPrompts === "string" ? new DefaultPromptStore(opts.paths.globalPrompts) : void 0;
+    this.builtinDir = opts.bundledDir ? path.join(opts.bundledDir, "prompts") : void 0;
+  }
+  async list() {
+    if (this.cache) return this.cache;
+    const seen = /* @__PURE__ */ new Set();
+    const out = [];
+    const layers = [
+      (await (this.projectStore?.list() ?? Promise.resolve([]))).map((e) => ({
+        ...e,
+        source: "project"
+      })),
+      await (this.userStore?.list() ?? Promise.resolve([])),
+      // keeps stored source ('user' or 'synced')
+      await this.readBuiltin()
+    ];
+    for (const layer of layers) {
+      for (const e of layer) {
+        if (seen.has(e.slug)) continue;
+        seen.add(e.slug);
+        out.push(e);
+      }
+    }
+    this.cache = out;
+    return out;
+  }
+  async find(slugOrId) {
+    const all = await this.list();
+    return all.find((e) => e.slug === slugOrId) ?? all.find((e) => e.id === slugOrId);
+  }
+  async search(query, opts = {}) {
+    let pool = await this.list();
+    if (opts.category) pool = pool.filter((e) => e.category === opts.category);
+    const q = query.trim().toLowerCase();
+    let results;
+    if (!q) {
+      results = pool;
+    } else {
+      const tokens = q.split(/\s+/).filter(Boolean);
+      results = pool.map((e) => ({ e, score: scorePrompt(e, tokens) })).filter((r) => r.score > 0).sort((a, b) => b.score - a.score).map((r) => r.e);
+    }
+    return typeof opts.limit === "number" ? results.slice(0, opts.limit) : results;
+  }
+  async categories() {
+    const all = await this.list();
+    const counts = /* @__PURE__ */ new Map();
+    for (const e of all) counts.set(e.category, (counts.get(e.category) ?? 0) + 1);
+    return [...counts.entries()].map(([id, count]) => ({
+      id,
+      label: isBuiltinCategory(id) ? PROMPT_CATEGORY_LABELS[id] : id,
+      count
+    })).sort((a, b) => b.count - a.count || a.label.localeCompare(b.label));
+  }
+  async save(entry, opts = {}) {
+    const store = opts.scope === "project" ? this.projectStore : this.userStore;
+    if (!store)
+      throw new Error(`Prompt ${opts.scope ?? "user"} layer is not writable (no directory).`);
+    const normalized = entry.source === "builtin" ? {
+      ...entry,
+      source: opts.scope === "project" ? "project" : "user",
+      forkedFrom: entry.forkedFrom ?? entry.slug
+    } : entry;
+    await store.save(normalized);
+    this.invalidateCache();
+  }
+  async delete(slugOrId) {
+    const entry = await this.find(slugOrId);
+    if (!entry) return false;
+    if (entry.source === "builtin") return false;
+    const store = entry.source === "project" ? this.projectStore : this.userStore;
+    if (!store) return false;
+    const ok = await store.delete(entry.id);
+    if (ok) this.invalidateCache();
+    return ok;
+  }
+  async setFavorite(slugOrId, favorite) {
+    const entry = await this.find(slugOrId);
+    if (!entry) return void 0;
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    if (entry.source === "builtin") {
+      if (!this.userStore) return void 0;
+      const copy = {
+        ...entry,
+        favorite,
+        source: "user",
+        forkedFrom: entry.slug,
+        updatedAt: now
+      };
+      await this.userStore.save(copy);
+      this.invalidateCache();
+      return copy;
+    }
+    const updated = { ...entry, favorite, updatedAt: now };
+    const store = entry.source === "project" ? this.projectStore : this.userStore;
+    if (!store) return void 0;
+    await store.save(updated);
+    this.invalidateCache();
+    return updated;
+  }
+  invalidateCache() {
+    this.cache = void 0;
+    this.builtinCache = void 0;
+  }
+  async readBuiltin() {
+    if (this.builtinCache) return this.builtinCache;
+    const dir = this.builtinDir;
+    if (!dir) {
+      this.builtinCache = [];
+      return [];
+    }
+    const out = [];
+    const files = await walkJson(dir);
+    for (const file of files) {
+      try {
+        const parsed = JSON.parse(await fs.readFile(file, "utf8"));
+        const migrated = migratePromptEntry(parsed);
+        if (migrated) out.push({ ...migrated, source: "builtin" });
+      } catch {
+      }
+    }
+    this.builtinCache = out;
+    return out;
+  }
+};
+async function walkJson(dir) {
+  const out = [];
+  let entries;
+  try {
+    entries = await fs.readdir(dir, { withFileTypes: true });
+  } catch {
+    return out;
+  }
+  for (const e of entries) {
+    const full = path.join(dir, e.name);
+    if (e.isDirectory()) {
+      out.push(...await walkJson(full));
+    } else if (e.name.endsWith(".json") && e.name !== "index.json" && e.name !== "schema.json") {
+      out.push(full);
+    }
+  }
+  return out;
+}
+function scorePrompt(e, tokens) {
+  const title = e.title.toLowerCase();
+  const slug = e.slug.toLowerCase();
+  const desc = e.description.toLowerCase();
+  const cat = e.category.toLowerCase();
+  const tags = e.tags.map((t) => t.toLowerCase());
+  const content = e.content.toLowerCase();
+  let score = 0;
+  for (const tok of tokens) {
+    let hit = 0;
+    if (title.includes(tok)) hit += 5;
+    if (slug.includes(tok)) hit += 4;
+    if (tags.some((t) => t.includes(tok))) hit += 3;
+    if (desc.includes(tok)) hit += 2;
+    if (cat.includes(tok)) hit += 2;
+    if (content.includes(tok)) hit += 1;
+    if (hit === 0 && tok.length >= 3) {
+      if (isSubsequence(tok, title)) hit += 2;
+      else if (isSubsequence(tok, slug)) hit += 2;
+      else if (tags.some((t) => isSubsequence(tok, t))) hit += 1;
+    }
+    if (hit === 0) return 0;
+    score += hit;
+  }
+  if (e.favorite) score += 1;
+  return score;
+}
+function isSubsequence(needle, hay) {
+  let i = 0;
+  for (let j = 0; j < hay.length && i < needle.length; j++) {
+    if (hay[j] === needle[i]) i++;
+  }
+  return i === needle.length;
+}
+function renderPrompt(entry, values = {}) {
+  const declared = new Map((entry.variables ?? []).map((v) => [v.name, v]));
+  const missing = [];
+  const invalid = [];
+  const text = entry.content.replace(/\{\{\s*([\w.-]+)\s*\}\}/g, (whole, rawName) => {
+    const name = rawName.trim();
+    if (Object.hasOwn(values, name) && values[name] !== void 0) {
+      return values[name];
+    }
+    const decl = declared.get(name);
+    if (decl?.default !== void 0) return decl.default;
+    if (decl?.required) missing.push(name);
+    return whole;
+  });
+  for (const v of entry.variables ?? []) {
+    if (v.required && !(v.name in values) && v.default === void 0 && !missing.includes(v.name)) {
+      if (new RegExp(`\\{\\{\\s*${escapeRegExp(v.name)}\\s*\\}\\}`).test(entry.content)) {
+        missing.push(v.name);
+      }
+    }
+    if (v.enum && v.enum.length > 0 && Object.hasOwn(values, v.name) && values[v.name] !== void 0 && values[v.name] !== "" && !v.enum.includes(values[v.name])) {
+      invalid.push(v.name);
+    }
+  }
+  return { text, missing, invalid };
+}
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+export {
+  DefaultPromptLoader,
+  renderPrompt
+};
+//# sourceMappingURL=chunk-XF4VUMKW.js.map

package/dist/chunk-XQ2ECNK3.js

@@ -0,0 +1 @@
+//# sourceMappingURL=chunk-XQ2ECNK3.js.map

package/dist/chunk-Y5YXDM7D.js

@@ -0,0 +1,74 @@
+import {
+  DefaultSecretScrubber
+} from "./chunk-QSTSJOCK.js";
+
+// src/security/error-sanitize.ts
+import { homedir } from "node:os";
+var scrubber = new DefaultSecretScrubber();
+var ERROR_DETAIL_MAX = 500;
+function messageOf(err) {
+  if (err instanceof Error) return err.message;
+  if (typeof err === "string") return err;
+  try {
+    return String(err);
+  } catch {
+    return "unknown error";
+  }
+}
+function sanitizeApiError(err) {
+  const lower = messageOf(err).toLowerCase();
+  if (lower.includes("enoent") || lower.includes("no such file")) {
+    return "resource not found";
+  }
+  if (lower.includes("eacces") || lower.includes("permission")) {
+    return "permission denied";
+  }
+  if (lower.includes("json") && (lower.includes("parse") || lower.includes("unexpected"))) {
+    return "malformed data";
+  }
+  return "internal error";
+}
+function scrubErrorDetail(err) {
+  const out = scrubErrorText(messageOf(err));
+  return out.length > ERROR_DETAIL_MAX ? `${out.slice(0, ERROR_DETAIL_MAX - 1)}\u2026` : out;
+}
+function scrubErrorText(text) {
+  if (!text) return text;
+  let out = scrubber.scrub(text);
+  const home = safeHomedir();
+  if (home && home.length > 2) {
+    out = replaceAllCaseInsensitive(out, home, "~");
+    const alt = home.includes("\\") ? home.replace(/\\/g, "/") : home.replace(/\//g, "\\");
+    if (alt !== home) out = replaceAllCaseInsensitive(out, alt, "~");
+  }
+  return out;
+}
+function safeHomedir() {
+  try {
+    return homedir();
+  } catch {
+    return "";
+  }
+}
+function replaceAllCaseInsensitive(haystack, needle, replacement) {
+  const lowerHay = haystack.toLowerCase();
+  const lowerNeedle = needle.toLowerCase();
+  let idx = lowerHay.indexOf(lowerNeedle);
+  if (idx === -1) return haystack;
+  let out = "";
+  let from = 0;
+  while (idx !== -1) {
+    out += haystack.slice(from, idx) + replacement;
+    from = idx + needle.length;
+    idx = lowerHay.indexOf(lowerNeedle, from);
+  }
+  return out + haystack.slice(from);
+}
+
+export {
+  ERROR_DETAIL_MAX,
+  sanitizeApiError,
+  scrubErrorDetail,
+  scrubErrorText
+};
+//# sourceMappingURL=chunk-Y5YXDM7D.js.map