@xopcai/xopc 0.0.106 → 0.0.107

package/dist/src/agent/mcp/bundle-mcp-runtime.js

@@ -1,6 +1,6 @@
+import { init_string_coerce, normalizeOptionalString } from "../../utils/string-coerce.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { init_string_coerce, normalizeOptionalString } from "../../utils/string-coerce.js";
 import { resolveGlobalSingleton } from "../../utils/global-singleton.js";
 import { sanitizeServerName } from "./bundle-mcp-names.js";
 import { redactSensitiveUrlLikeString } from "../../utils/redact-sensitive-url.js";

package/dist/src/agent/mcp/mcp-transport-config.js

@@ -1,6 +1,6 @@
+import { init_string_coerce, normalizeLowercaseStringOrEmpty } from "../../utils/string-coerce.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { init_string_coerce, normalizeLowercaseStringOrEmpty } from "../../utils/string-coerce.js";
 import { resolveXopcMcpTransportAlias } from "../../config/mcp-config-normalize.js";
 import { sanitizeForLog } from "../../utils/sanitize-log.js";
 import { describeHttpMcpServerLaunchConfig, resolveHttpMcpServerLaunchConfig } from "./mcp-http.js";

package/dist/src/agent/mcp/mcp-transport.js

@@ -1,6 +1,6 @@
+import { init_string_coerce, normalizeOptionalString } from "../../utils/string-coerce.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { init_string_coerce, normalizeOptionalString } from "../../utils/string-coerce.js";
 import { XopcStdioClientTransport } from "./mcp-stdio-transport.js";
 import { resolveMcpTransportConfig } from "./mcp-transport-config.js";
 import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";

package/dist/src/agent/memory/builtin-memory-store.js

@@ -1,6 +1,6 @@
+import { join } from "node:path";
 import { existsSync, mkdirSync, readFileSync } from "node:fs";
 import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
-import { join } from "node:path";
 import lockfile from "proper-lockfile";
 //#region src/agent/memory/builtin-memory-store.ts
 /**

package/dist/src/agent/memory/dreaming/deep-promotion.js

@@ -4,8 +4,8 @@ import { MEMORY_MD_FILENAME } from "./constants.js";
 import { clamp01, compareCandidatesByScore, computeCandidateScore, extractPromotionMarkers, isContaminatedSnippet, isExpiredEntry, isoDay, readFileLines, resolveDeepDefaults, sliceRange, snippetHash } from "./utils.js";
 import { loadDreamingStore, saveDreamingStore, withDreamingPromotionLock } from "./short-term-store.js";
 import { emptyDeepPhaseSkipped, writeDreamingDeepLastRun } from "./last-run.js";
-import fs from "node:fs/promises";
 import path from "node:path";
+import fs from "node:fs/promises";
 //#region src/agent/memory/dreaming/deep-promotion.ts
 init_logger();
 const log = createLogger("Dreaming:Deep");

package/dist/src/agent/memory/dreaming/events.js

@@ -1,6 +1,6 @@
 import { DREAMING_DIR_RELATIVE, DREAMING_EVENTS_LOG_RELATIVE } from "./constants.js";
-import fs from "node:fs/promises";
 import path from "node:path";
+import fs from "node:fs/promises";
 //#region src/agent/memory/dreaming/events.ts
 /**
 * Append a single event line to `memory/.dreams/events.jsonl`.

package/dist/src/agent/memory/dreaming/last-run.js

@@ -1,6 +1,6 @@
 import { DREAMING_LAST_RUN_RELATIVE } from "./constants.js";
-import fs from "node:fs/promises";
 import path from "node:path";
+import fs from "node:fs/promises";
 //#region src/agent/memory/dreaming/last-run.ts
 const DREAMING_LAST_RUN_FORMAT_VERSION = 2;
 function isRecord(v) {

package/dist/src/agent/memory/dreaming/light-sweep.js

@@ -4,8 +4,8 @@ import { DREAMING_DIR_RELATIVE } from "./constants.js";
 import { buildEntryKey, isoDay, normalizeMemoryPath, normalizeSnippetForHash, snippetHash } from "./utils.js";
 import { bumpEntryPhaseSignal, loadDreamingStore, saveDreamingStore } from "./short-term-store.js";
 import "./last-run.js";
-import fs from "node:fs/promises";
 import path from "node:path";
+import fs from "node:fs/promises";
 //#region src/agent/memory/dreaming/light-sweep.ts
 init_logger();
 const log = createLogger("Dreaming:Light");

package/dist/src/agent/memory/dreaming/preview.js

@@ -1,8 +1,8 @@
 import { MEMORY_MD_FILENAME } from "./constants.js";
 import { clamp01, compareCandidatesByScore, computeCandidateScore, extractPromotionMarkers, isContaminatedSnippet, isExpiredEntry, readFileLines, resolveDeepDefaults, sliceRange, snippetHash } from "./utils.js";
 import { loadDreamingStore } from "./short-term-store.js";
-import fs from "node:fs/promises";
 import path from "node:path";
+import fs from "node:fs/promises";
 //#region src/agent/memory/dreaming/preview.ts
 async function previewDreamingDeepPromotion(params) {
 	const cfg = resolveDeepDefaults(params.config);

package/dist/src/agent/memory/dreaming/rem-patterns.js

@@ -4,8 +4,8 @@ import { DREAMING_DIR_RELATIVE, DREAMS_MD_FILENAME, MS_PER_DAY } from "./constan
 import { isoDay } from "./utils.js";
 import { bumpEntryPhaseSignal, loadDreamingStore, saveDreamingStore } from "./short-term-store.js";
 import "./last-run.js";
-import fs from "node:fs/promises";
 import path from "node:path";
+import fs from "node:fs/promises";
 //#region src/agent/memory/dreaming/rem-patterns.ts
 init_logger();
 const log = createLogger("Dreaming:REM");

package/dist/src/agent/memory/dreaming/short-term-store.js

@@ -2,9 +2,9 @@ import { createLogger } from "../../../utils/logger/index.js";
 import { init_logger } from "../../../utils/logger.js";
 import { SHORT_TERM_PROMOTION_LOCK_RELATIVE, SHORT_TERM_RECALL_STORE_RELATIVE } from "./constants.js";
 import { buildEntryKey, clamp01, isoDay, normalizeMemoryPath } from "./utils.js";
+import path from "node:path";
 import { createHash, randomUUID } from "node:crypto";
 import fs from "node:fs/promises";
-import path from "node:path";
 //#region src/agent/memory/dreaming/short-term-store.ts
 init_logger();
 const log = createLogger("Dreaming:Store");

package/dist/src/agent/memory/dreaming/utils.js

@@ -1,7 +1,7 @@
 import { DEFAULT_DEEP_CRON, DIVERSITY_WEIGHT, MS_PER_DAY, REINFORCEMENT_WEIGHT } from "./constants.js";
+import path from "node:path";
 import { createHash } from "node:crypto";
 import fs from "node:fs/promises";
-import path from "node:path";
 //#region src/agent/memory/dreaming/utils.ts
 /** Normalize a workspace-relative memory path: forward slashes, no odd ../ escapes at start. */
 function normalizeMemoryPath(rel) {

package/dist/src/agent/memory/memory-flush.js

@@ -1,8 +1,8 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
+import { join } from "node:path";
 import { existsSync } from "node:fs";
 import { appendFile, mkdir, readFile, writeFile } from "node:fs/promises";
-import { join } from "node:path";
 //#region src/agent/memory/memory-flush.ts
 init_logger();
 const log = createLogger("MemoryFlush");

package/dist/src/agent/memory/plugin-discovery.js

@@ -1,5 +1,5 @@
-import { readdir, stat } from "node:fs/promises";
 import { dirname, join } from "node:path";
+import { readdir, stat } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 //#region src/agent/memory/plugin-discovery.ts
 async function discoverMemoryPlugins() {

package/dist/src/agent/models/manager.js

@@ -1,6 +1,6 @@
+import { getAgentDefaultModelRef, init_schema } from "../../config/schema.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { getAgentDefaultModelRef, init_schema } from "../../config/schema.js";
 import { getAllModels, getDefaultModelSync, init_providers, resolveModel } from "../../providers/index.js";
 import { resolveAgentTurnTimeoutMs, runAgentTurnWithTimeout } from "../orchestration/run-agent-turn-with-timeout.js";
 import { isAssistantTurnAborted, isAssistantTurnFailed, maybeRetryTurnAfterTransientLlmFailure } from "../orchestration/llm-turn-retry.js";

package/dist/src/agent/prompt/service-prompt-builder.js

@@ -1,6 +1,6 @@
+import { resolveStateDir } from "../../config/paths-state.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { resolveStateDir } from "../../config/paths-state.js";
 import { init_paths } from "../../config/paths.js";
 import { DEFAULT_USER_FILENAME } from "../context/workspace.js";
 import { resolveSystemPromptBuildParams } from "./system-prompt-params.js";
@@ -9,8 +9,8 @@ import { createSkillConfigManager } from "../skills/config.js";
 import { buildTtsSystemPromptHint } from "../../voice/tts/directives.js";
 import { mergeTtsConfigFromAppConfig } from "../../voice/tts/merge-config.js";
 import { selectSkillsVisibleInPrompt } from "../skills/format-skills-prompt.js";
-import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
+import { existsSync, readFileSync } from "node:fs";
 //#region src/agent/prompt/service-prompt-builder.ts
 /**
 * System Prompt Builder - Builds the complete system prompt

package/dist/src/agent/reply/post-compaction-context.js

@@ -1,7 +1,7 @@
 import { init_agent_scope, resolveAgentProfileDir } from "../agent-scope.js";
 import { resolveEffectiveAgentProfileForSession } from "../../config/agent-profile.js";
-import { readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
+import { readFileSync } from "node:fs";
 //#region src/agent/reply/post-compaction-context.ts
 init_agent_scope();
 const MAX_CONTEXT_CHARS = 1800;

package/dist/src/agent/reply/workspace-boundary-read.js

@@ -1,5 +1,5 @@
-import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
+import { readFileSync } from "node:fs";
 //#region src/agent/reply/workspace-boundary-read.ts
 /**
 * Read a file relative to workspace root with path traversal guard and byte cap.

package/dist/src/agent/sandbox/path-policy.js

@@ -1,6 +1,6 @@
-import { realpathSync } from "node:fs";
-import { isAbsolute, normalize, resolve, sep } from "node:path";
 import { homedir } from "node:os";
+import { isAbsolute, normalize, resolve, sep } from "node:path";
+import { realpathSync } from "node:fs";
 //#region src/agent/sandbox/path-policy.ts
 /**
 * Path safety validation for sandbox isolation.

package/dist/src/agent/service.js

@@ -1,9 +1,9 @@
-import { createLogger } from "../utils/logger/index.js";
-import { init_logger } from "../utils/logger.js";
-import { init_agent_scope, resolveAgentHomeDir, resolveAgentProfileDir, resolveDefaultAgentId } from "./agent-scope.js";
 import { getAgentDefaultModelRef, init_schema } from "../config/schema.js";
 import { applyConfigOverrides } from "../config/runtime-overrides.js";
+import { init_agent_scope, resolveAgentHomeDir, resolveAgentProfileDir, resolveDefaultAgentId } from "./agent-scope.js";
 import { extractProfileAgentId, resolveEffectiveAgentProfileForSession } from "../config/agent-profile.js";
+import { createLogger } from "../utils/logger/index.js";
+import { init_logger } from "../utils/logger.js";
 import { extractTextContent } from "./context/workspace.js";
 import { getWorkflowProgressBroker } from "./workflow/progress-broker.js";
 import { onSessionTranscriptUpdate } from "../session/transcript-events.js";
@@ -60,8 +60,8 @@ import { parseOutboundSessionKey } from "./service/parse-outbound-session-key.js
 import { cleanTrailingErrors } from "./memory/message-sanitizer.js";
 import { MemoryFlushService } from "./memory/memory-flush.js";
 import { tryApplySessionTranscriptHygiene } from "./transcript/transcript-hygiene.js";
-import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
+import { existsSync, readFileSync } from "node:fs";
 //#region src/agent/service.ts
 init_schema();
 init_logger();

package/dist/src/agent/session/session-inspector.js

@@ -1,6 +1,6 @@
+import { resolveEffectiveAgentProfileForSession } from "../../config/agent-profile.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { resolveEffectiveAgentProfileForSession } from "../../config/agent-profile.js";
 import { resolveVerboseLevel } from "../../session/config-store.js";
 import { resolveEffectiveReasoningLevel, resolveEffectiveThinkingLevel } from "../../session/thinking-resolve.js";
 import { effectiveWorkspacePathForSession } from "../../session/session-workspace.js";

package/dist/src/agent/skills/config.js

@@ -1,6 +1,6 @@
-import { init_write_file_atomic, writeTextAtomicSync } from "../../infra/write-file-atomic.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
+import { init_write_file_atomic, writeTextAtomicSync } from "../../infra/write-file-atomic.js";
 import { hasBinary } from "./installer.js";
 import { join } from "path";
 import { existsSync, readFileSync } from "fs";

package/dist/src/agent/skills/hub-hash.js

@@ -1,6 +1,6 @@
-import { createHash } from "node:crypto";
-import { createReadStream, existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { join, relative } from "node:path";
+import { createReadStream, existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { createHash } from "node:crypto";
 //#region src/agent/skills/hub-hash.ts
 /**
 * Deterministic content hash for a skill directory (for hub lock / drift detection).

package/dist/src/agent/skills/hub-lock.js

@@ -1,5 +1,5 @@
-import { init_write_file_atomic, writeTextAtomicSync } from "../../infra/write-file-atomic.js";
 import { init_paths, resolveSkillsLockPath } from "../../config/paths.js";
+import { init_write_file_atomic, writeTextAtomicSync } from "../../infra/write-file-atomic.js";
 import { existsSync, readFileSync } from "node:fs";
 //#region src/agent/skills/hub-lock.ts
 /**

package/dist/src/agent/skills/hub-pull.js

@@ -4,9 +4,9 @@ import { formatScanSummary, scanSkillDirectory } from "./scanner.js";
 import { getSkillsLockEntry, recordSkillsHubInstall } from "./hub-lock.js";
 import { installSkillFromZip, isValidSkillId } from "./managed-store.js";
 import { computeSkillTreeHashSync } from "./hub-hash.js";
-import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
-import { basename, join, normalize, resolve, sep } from "node:path";
 import { tmpdir } from "node:os";
+import { basename, join, normalize, resolve, sep } from "node:path";
+import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { execFileSync } from "node:child_process";
 import { fetch } from "undici";

package/dist/src/agent/skills/index.js

@@ -1,6 +1,6 @@
+import { resolveStateDir } from "../../config/paths-state.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { resolveStateDir } from "../../config/paths-state.js";
 import { init_paths } from "../../config/paths.js";
 import { parseFrontmatter } from "../../markdown/frontmatter.js";
 import { findInstallSpec, getDefaultInstallerPreferences, hasBinary, installSkill } from "./installer.js";

package/dist/src/agent/skills/managed-store.js

@@ -1,8 +1,8 @@
 import { init_paths, resolveSkillsDir } from "../../config/paths.js";
 import { parseFrontmatter } from "../../markdown/frontmatter.js";
 import { loadSkillsLock } from "./hub-lock.js";
-import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve, sep } from "node:path";
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import AdmZip from "adm-zip";
 //#region src/agent/skills/managed-store.ts
 /**

package/dist/src/agent/skills/marketplace/adapters/store/store-api-client.d.ts

@@ -101,11 +101,15 @@ export interface StorePublishedPackageHead {
     latestVersion: {
         version: string;
         downloadUrl: string;
+        checksum?: string;
+        integrity?: string;
+        sha256?: string;
     };
 }
 export declare function resolveExtensionZipDownloadUrl(storeBaseUrl: string, packageName: string, version?: string): Promise<{
     downloadUrl: string;
     version: string;
+    integrity?: string;
 }>;
 export declare function downloadExtensionStoreZipBuffer(storeBaseUrl: string, downloadUrl: string): Promise<Buffer>;
 export declare function skillIdForMarketplaceInstall(packageName: string): string | undefined;

package/dist/src/agent/skills/marketplace/adapters/store/store-api-client.js

@@ -135,7 +135,8 @@ async function resolveExtensionZipDownloadUrl(storeBaseUrl, packageName, version
 		assertDownloadUrlAllowed(detail.downloadUrl, base);
 		return {
 			downloadUrl: detail.downloadUrl,
-			version: detail.version
+			version: detail.version,
+			integrity: detail.integrity ?? detail.checksum ?? detail.sha256
 		};
 	}
 	const lv = meta.latestVersion;
@@ -143,7 +144,8 @@ async function resolveExtensionZipDownloadUrl(storeBaseUrl, packageName, version
 	assertDownloadUrlAllowed(lv.downloadUrl, base);
 	return {
 		downloadUrl: lv.downloadUrl,
-		version: lv.version
+		version: lv.version,
+		integrity: lv.integrity ?? lv.checksum ?? lv.sha256
 	};
 }
 async function downloadExtensionStoreZipBuffer(storeBaseUrl, downloadUrl) {

package/dist/src/agent/skills/marketplace/adapters/store/store-api-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"store-api-client.js","names":[],"sources":["../../../../../../../src/agent/skills/marketplace/adapters/store/store-api-client.ts"],"sourcesContent":["/**\n * HTTP client for the public xopc-store-compatible REST API (packages list, detail, zip download).\n * Used by the store marketplace adapter and SSRF-safe download helpers.\n *\n * Facade: {@link ../../../skills-marketplace.js}.\n */\n\nimport type { Config } from '../../../../../config/schema.js';\nimport { MAX_EXTENSION_STORE_ZIP_BYTES } from '../../../../../extensions/store-zip-limits.js';\nimport { isValidSkillId, MAX_SKILL_ZIP_BYTES } from '../../../managed-store.js';\nimport type { SkillMarkdownPreviewPayload } from '../../../types.js';\n\nconst DEFAULT_STORE_BASE = 'https://store.xopc.ai';\n\n/**\n * Marketplace provider identifier. Dynamic — extensions can register additional providers\n * via `api.registerMarketplaceAdapter()`. Built-in values: 'store', 'skillhub', 'clawhub'.\n */\nexport type SkillsMarketplaceProvider = string;\n\nexport interface SkillsStoreListParams {\n  q?: string;\n  page?: number;\n  pageSize?: number;\n  sort?: 'downloads' | 'newest';\n  /** Adapter-defined category id (exact match against package `categories`). */\n  category?: string;\n}\n\n/** Category option for marketplace filter chips (from adapter). */\nexport interface MarketplaceCategoryOption {\n  id: string;\n  label: string;\n}\n\n/** Mirrors xopc-store GET /api/v1/packages list response (subset used by UI). */\nexport interface SkillsStorePackageListItem {\n  id: string;\n  name: string;\n  type: string;\n  description: string;\n  downloads: number;\n  author: { username: string; avatarUrl: string | null };\n  latestVersion?: string;\n  updatedAt: string;\n  /** Taxonomy / tags from the marketplace (adapter-specific). */\n  categories?: string[];\n  tags?: string[];\n  stars?: number;\n  /** Short provenance label for the row (e.g. ClawHub). */\n  sourceLabel?: string;\n}\n\n/** Unified marketplace package list item (works for all adapters). */\nexport type MarketplacePackageListItem = SkillsStorePackageListItem;\n\nexport interface SkillsStoreListResponse {\n  items: SkillsStorePackageListItem[];\n  meta: { page: number; pageSize: number; total: number; totalPages: number };\n}\n\nexport function resolveSkillsStoreBaseUrl(config: Config): string {\n  const env = process.env.XOPC_SKILLS_STORE_URL?.trim();\n  if (env) {\n    try {\n      return normalizeBaseUrl(new URL(env).toString());\n    } catch {\n      // fall through\n    }\n  }\n  const fromConfig = config.gateway?.skillsStoreBaseUrl?.trim();\n  if (fromConfig) {\n    try {\n      return normalizeBaseUrl(new URL(fromConfig).toString());\n    } catch {\n      return DEFAULT_STORE_BASE;\n    }\n  }\n  return DEFAULT_STORE_BASE;\n}\n\nexport { MAX_EXTENSION_STORE_ZIP_BYTES };\n\n/**\n * Base URL for extension downloads (defaults to skills store host — usually store.xopc.ai).\n * Override with `XOPC_EXTENSIONS_STORE_URL`.\n */\nexport function resolveExtensionsStoreBaseUrl(config: Config): string {\n  const env = process.env.XOPC_EXTENSIONS_STORE_URL?.trim();\n  if (env) {\n    try {\n      return normalizeBaseUrl(new URL(env).toString());\n    } catch {\n      // fall through\n    }\n  }\n  return resolveSkillsStoreBaseUrl(config);\n}\n\nfunction normalizeBaseUrl(url: string): string {\n  return url.replace(/\\/$/, '');\n}\n\nexport function getStoreOrigin(baseUrl: string): string {\n  const u = new URL(baseUrl);\n  return `${u.protocol}//${u.host}`;\n}\n\n/**\n * Allow download URLs whose origin matches the configured store base (SSRF guard).\n * Production store is HTTPS-only; local dev (`http://localhost` / `127.0.0.1`) may use HTTP.\n */\nexport function assertDownloadUrlAllowed(downloadUrl: string, storeBaseUrl: string): URL {\n  let u: URL;\n  try {\n    u = new URL(downloadUrl);\n  } catch {\n    throw new Error('Invalid download URL from store');\n  }\n  const allowed = new URL(storeBaseUrl);\n  const localHttpDev =\n    allowed.protocol === 'http:' &&\n    (allowed.hostname === 'localhost' || allowed.hostname === '127.0.0.1');\n  if (localHttpDev) {\n    if (u.protocol !== 'http:' && u.protocol !== 'https:') {\n      throw new Error('Download URL must use HTTP or HTTPS');\n    }\n  } else if (u.protocol !== 'https:') {\n    throw new Error('Download URL must use HTTPS');\n  }\n  if (u.host !== allowed.host) {\n    throw new Error('Download URL host does not match configured store host');\n  }\n  return u;\n}\n\nasync function fetchJson<T>(url: string, init?: RequestInit): Promise<T> {\n  const res = await fetch(url, {\n    ...init,\n    headers: { Accept: 'application/json', ...init?.headers },\n  });\n  const text = await res.text();\n  if (!res.ok) {\n    let msg = `Store request failed (${res.status})`;\n    try {\n      const j = JSON.parse(text) as { error?: { message?: string } };\n      if (j.error?.message) msg = j.error.message;\n    } catch {\n      if (text) msg = text.slice(0, 200);\n    }\n    throw new Error(msg);\n  }\n  try {\n    return JSON.parse(text) as T;\n  } catch {\n    throw new Error('Store returned invalid JSON');\n  }\n}\n\nexport async function listSkillPackages(\n  storeBaseUrl: string,\n  params: SkillsStoreListParams,\n): Promise<SkillsStoreListResponse> {\n  const base = normalizeBaseUrl(storeBaseUrl);\n  const sp = new URLSearchParams();\n  sp.set('type', 'skill');\n  if (params.q?.trim()) sp.set('q', params.q.trim());\n  if (params.page != null) sp.set('page', String(params.page));\n  if (params.pageSize != null) sp.set('pageSize', String(params.pageSize));\n  if (params.sort) sp.set('sort', params.sort);\n  if (params.category?.trim()) sp.set('category', params.category.trim());\n\n  const url = `${base}/api/v1/packages?${sp.toString()}`;\n  return fetchJson<SkillsStoreListResponse>(url);\n}\n\n/** GET /api/v1/packages/:name — published skill package (public). */\nexport interface MarketplacePackageDetail {\n  id: string;\n  name: string;\n  type: string;\n  description: string;\n  readme: string | null;\n  downloads: number;\n  author: { username: string; avatarUrl: string | null };\n  latestVersion: {\n    version: string;\n    changelog: string | null;\n    publishedAt: string;\n  };\n}\n\nexport async function fetchMarketplacePackageDetail(\n  storeBaseUrl: string,\n  packageName: string,\n): Promise<MarketplacePackageDetail> {\n  const base = normalizeBaseUrl(storeBaseUrl);\n  const enc = encodeURIComponent(packageName.trim());\n  return fetchJson<MarketplacePackageDetail>(`${base}/api/v1/packages/${enc}`);\n}\n\nexport async function resolveSkillZipDownloadUrl(\n  storeBaseUrl: string,\n  packageName: string,\n  version?: string,\n): Promise<{ downloadUrl: string; version: string }> {\n  const base = normalizeBaseUrl(storeBaseUrl);\n  const enc = encodeURIComponent(packageName);\n  if (version?.trim()) {\n    const v = encodeURIComponent(version.trim());\n    const detail = await fetchJson<{\n      downloadUrl: string;\n      version: string;\n    }>(`${base}/api/v1/packages/${enc}/versions/${v}`);\n    if (!detail.downloadUrl) {\n      throw new Error('Store version has no download URL');\n    }\n    assertDownloadUrlAllowed(detail.downloadUrl, base);\n    return { downloadUrl: detail.downloadUrl, version: detail.version };\n  }\n\n  const pkg = await fetchJson<{\n    name: string;\n    latestVersion: { downloadUrl: string; version: string };\n  }>(`${base}/api/v1/packages/${enc}`);\n  if (!pkg.latestVersion?.downloadUrl) {\n    throw new Error('Package has no published version');\n  }\n  assertDownloadUrlAllowed(pkg.latestVersion.downloadUrl, base);\n  return {\n    downloadUrl: pkg.latestVersion.downloadUrl,\n    version: pkg.latestVersion.version,\n  };\n}\n\nexport async function downloadSkillZipBuffer(\n  storeBaseUrl: string,\n  downloadUrl: string,\n): Promise<Buffer> {\n  const base = normalizeBaseUrl(storeBaseUrl);\n  assertDownloadUrlAllowed(downloadUrl, base);\n\n  const res = await fetch(downloadUrl, { redirect: 'follow' });\n  if (!res.ok) {\n    throw new Error(`Failed to download skill archive (${res.status})`);\n  }\n  const len = res.headers.get('content-length');\n  if (len) {\n    const n = Number(len);\n    if (Number.isFinite(n) && n > MAX_SKILL_ZIP_BYTES) {\n      throw new Error(`Zip exceeds maximum size (${MAX_SKILL_ZIP_BYTES} bytes)`);\n    }\n  }\n  const ab = await res.arrayBuffer();\n  const buf = Buffer.from(ab);\n  if (buf.length > MAX_SKILL_ZIP_BYTES) {\n    throw new Error(`Zip exceeds maximum size (${MAX_SKILL_ZIP_BYTES} bytes)`);\n  }\n  return buf;\n}\n\n/** GET /api/v1/packages/:name — subset used for extension installs. */\nexport interface StorePublishedPackageHead {\n  name: string;\n  type: string;\n  latestVersion: {\n    version: string;\n    downloadUrl: string;\n  };\n}\n\nexport async function resolveExtensionZipDownloadUrl(\n  storeBaseUrl: string,\n  packageName: string,\n  version?: string,\n): Promise<{ downloadUrl: string; version: string }> {\n  const base = normalizeBaseUrl(storeBaseUrl);\n  const enc = encodeURIComponent(packageName.trim());\n  const meta = await fetchJson<StorePublishedPackageHead>(`${base}/api/v1/packages/${enc}`);\n  if (meta.type !== 'extension') {\n    throw new Error(\n      `Package \"${packageName}\" has type \"${meta.type}\" (expected extension). ` +\n        'Use `xopc skills install` for skills.',\n    );\n  }\n  if (version?.trim()) {\n    const v = encodeURIComponent(version.trim());\n    const detail = await fetchJson<{ downloadUrl: string; version: string }>(\n      `${base}/api/v1/packages/${enc}/versions/${v}`,\n    );\n    if (!detail.downloadUrl) {\n      throw new Error('Store version has no download URL');\n    }\n    assertDownloadUrlAllowed(detail.downloadUrl, base);\n    return { downloadUrl: detail.downloadUrl, version: detail.version };\n  }\n  const lv = meta.latestVersion;\n  if (!lv?.downloadUrl) {\n    throw new Error('Package has no published version');\n  }\n  assertDownloadUrlAllowed(lv.downloadUrl, base);\n  return { downloadUrl: lv.downloadUrl, version: lv.version };\n}\n\nexport async function downloadExtensionStoreZipBuffer(\n  storeBaseUrl: string,\n  downloadUrl: string,\n): Promise<Buffer> {\n  const base = normalizeBaseUrl(storeBaseUrl);\n  assertDownloadUrlAllowed(downloadUrl, base);\n  const res = await fetch(downloadUrl, { redirect: 'follow' });\n  if (!res.ok) {\n    throw new Error(`Failed to download extension archive (${res.status})`);\n  }\n  const len = res.headers.get('content-length');\n  if (len) {\n    const n = Number(len);\n    if (Number.isFinite(n) && n > MAX_EXTENSION_STORE_ZIP_BYTES) {\n      throw new Error(`Zip exceeds maximum size (${MAX_EXTENSION_STORE_ZIP_BYTES} bytes)`);\n    }\n  }\n  const ab = await res.arrayBuffer();\n  const buf = Buffer.from(ab);\n  if (buf.length > MAX_EXTENSION_STORE_ZIP_BYTES) {\n    throw new Error(`Zip exceeds maximum size (${MAX_EXTENSION_STORE_ZIP_BYTES} bytes)`);\n  }\n  return buf;\n}\n\nexport function skillIdForMarketplaceInstall(packageName: string): string | undefined {\n  const trimmed = packageName.trim();\n  if (!trimmed) return undefined;\n  return isValidSkillId(trimmed) ? trimmed : undefined;\n}\n\n/**\n * Unified marketplace list response (adapter fills `provider`).\n */\nexport interface UnifiedMarketplaceListResponse {\n  items: MarketplacePackageListItem[];\n  meta: { page: number; pageSize: number; total: number; totalPages: number };\n  provider: string;\n}\n\n/**\n * Unified marketplace package detail response.\n */\nexport interface UnifiedMarketplacePackageDetail extends MarketplacePackageDetail {\n  provider: string;\n  /** Gateway-normalized structured meta + body rendered by the console. */\n  skillDocPreview: SkillMarkdownPreviewPayload;\n  /** SkillHub-specific fields */\n  skillHubInfo?: {\n    category: string;\n    installs: number;\n    stars: number;\n    securityReports?: {\n      keen?: { status: string; statusText: string; reportUrl?: string };\n      sanbu?: { status: string; statusText: string; reportUrl?: string };\n    };\n  };\n}\n"],"mappings":";;;AAYA,MAAM,qBAAqB;AAiD3B,SAAgB,0BAA0B,QAAwB;CAChE,MAAM,MAAM,QAAQ,IAAI,uBAAuB,MAAM;AACrD,KAAI,IACF,KAAI;AACF,SAAO,iBAAiB,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC;SAC1C;CAIV,MAAM,aAAa,OAAO,SAAS,oBAAoB,MAAM;AAC7D,KAAI,WACF,KAAI;AACF,SAAO,iBAAiB,IAAI,IAAI,WAAW,CAAC,UAAU,CAAC;SACjD;AACN,SAAO;;AAGX,QAAO;;;;;;AAST,SAAgB,8BAA8B,QAAwB;CACpE,MAAM,MAAM,QAAQ,IAAI,2BAA2B,MAAM;AACzD,KAAI,IACF,KAAI;AACF,SAAO,iBAAiB,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC;SAC1C;AAIV,QAAO,0BAA0B,OAAO;;AAG1C,SAAS,iBAAiB,KAAqB;AAC7C,QAAO,IAAI,QAAQ,OAAO,GAAG;;AAG/B,SAAgB,eAAe,SAAyB;CACtD,MAAM,IAAI,IAAI,IAAI,QAAQ;AAC1B,QAAO,GAAG,EAAE,SAAS,IAAI,EAAE;;;;;;AAO7B,SAAgB,yBAAyB,aAAqB,cAA2B;CACvF,IAAI;AACJ,KAAI;AACF,MAAI,IAAI,IAAI,YAAY;SAClB;AACN,QAAM,IAAI,MAAM,kCAAkC;;CAEpD,MAAM,UAAU,IAAI,IAAI,aAAa;AAIrC,KAFE,QAAQ,aAAa,YACpB,QAAQ,aAAa,eAAe,QAAQ,aAAa;MAEtD,EAAE,aAAa,WAAW,EAAE,aAAa,SAC3C,OAAM,IAAI,MAAM,sCAAsC;YAE/C,EAAE,aAAa,SACxB,OAAM,IAAI,MAAM,8BAA8B;AAEhD,KAAI,EAAE,SAAS,QAAQ,KACrB,OAAM,IAAI,MAAM,yDAAyD;AAE3E,QAAO;;AAGT,eAAe,UAAa,KAAa,MAAgC;CACvE,MAAM,MAAM,MAAM,MAAM,KAAK;EAC3B,GAAG;EACH,SAAS;GAAE,QAAQ;GAAoB,GAAG,MAAM;GAAS;EAC1D,CAAC;CACF,MAAM,OAAO,MAAM,IAAI,MAAM;AAC7B,KAAI,CAAC,IAAI,IAAI;EACX,IAAI,MAAM,yBAAyB,IAAI,OAAO;AAC9C,MAAI;GACF,MAAM,IAAI,KAAK,MAAM,KAAK;AAC1B,OAAI,EAAE,OAAO,QAAS,OAAM,EAAE,MAAM;UAC9B;AACN,OAAI,KAAM,OAAM,KAAK,MAAM,GAAG,IAAI;;AAEpC,QAAM,IAAI,MAAM,IAAI;;AAEtB,KAAI;AACF,SAAO,KAAK,MAAM,KAAK;SACjB;AACN,QAAM,IAAI,MAAM,8BAA8B;;;AAIlD,eAAsB,kBACpB,cACA,QACkC;CAClC,MAAM,OAAO,iBAAiB,aAAa;CAC3C,MAAM,KAAK,IAAI,iBAAiB;AAChC,IAAG,IAAI,QAAQ,QAAQ;AACvB,KAAI,OAAO,GAAG,MAAM,CAAE,IAAG,IAAI,KAAK,OAAO,EAAE,MAAM,CAAC;AAClD,KAAI,OAAO,QAAQ,KAAM,IAAG,IAAI,QAAQ,OAAO,OAAO,KAAK,CAAC;AAC5D,KAAI,OAAO,YAAY,KAAM,IAAG,IAAI,YAAY,OAAO,OAAO,SAAS,CAAC;AACxE,KAAI,OAAO,KAAM,IAAG,IAAI,QAAQ,OAAO,KAAK;AAC5C,KAAI,OAAO,UAAU,MAAM,CAAE,IAAG,IAAI,YAAY,OAAO,SAAS,MAAM,CAAC;AAGvE,QAAO,UAAmC,GAD3B,KAAK,mBAAmB,GAAG,UAAU,GACN;;AAmBhD,eAAsB,8BACpB,cACA,aACmC;AAGnC,QAAO,UAAoC,GAF9B,iBAAiB,aAEoB,CAAC,mBADvC,mBAAmB,YAAY,MAAM,CACwB,GAAG;;AAG9E,eAAsB,2BACpB,cACA,aACA,SACmD;CACnD,MAAM,OAAO,iBAAiB,aAAa;CAC3C,MAAM,MAAM,mBAAmB,YAAY;AAC3C,KAAI,SAAS,MAAM,EAAE;EAEnB,MAAM,SAAS,MAAM,UAGlB,GAAG,KAAK,mBAAmB,IAAI,YAJxB,mBAAmB,QAAQ,MAAM,CAII,GAAG;AAClD,MAAI,CAAC,OAAO,YACV,OAAM,IAAI,MAAM,oCAAoC;AAEtD,2BAAyB,OAAO,aAAa,KAAK;AAClD,SAAO;GAAE,aAAa,OAAO;GAAa,SAAS,OAAO;GAAS;;CAGrE,MAAM,MAAM,MAAM,UAGf,GAAG,KAAK,mBAAmB,MAAM;AACpC,KAAI,CAAC,IAAI,eAAe,YACtB,OAAM,IAAI,MAAM,mCAAmC;AAErD,0BAAyB,IAAI,cAAc,aAAa,KAAK;AAC7D,QAAO;EACL,aAAa,IAAI,cAAc;EAC/B,SAAS,IAAI,cAAc;EAC5B;;AAGH,eAAsB,uBACpB,cACA,aACiB;AAEjB,0BAAyB,aADZ,iBAAiB,aACY,CAAC;CAE3C,MAAM,MAAM,MAAM,MAAM,aAAa,EAAE,UAAU,UAAU,CAAC;AAC5D,KAAI,CAAC,IAAI,GACP,OAAM,IAAI,MAAM,qCAAqC,IAAI,OAAO,GAAG;CAErE,MAAM,MAAM,IAAI,QAAQ,IAAI,iBAAiB;AAC7C,KAAI,KAAK;EACP,MAAM,IAAI,OAAO,IAAI;AACrB,MAAI,OAAO,SAAS,EAAE,IAAI,IAAA,SACxB,OAAM,IAAI,MAAM,6BAA6B,oBAAoB,SAAS;;CAG9E,MAAM,KAAK,MAAM,IAAI,aAAa;CAClC,MAAM,MAAM,OAAO,KAAK,GAAG;AAC3B,KAAI,IAAI,SAAA,SACN,OAAM,IAAI,MAAM,6BAA6B,oBAAoB,SAAS;AAE5E,QAAO;;AAaT,eAAsB,+BACpB,cACA,aACA,SACmD;CACnD,MAAM,OAAO,iBAAiB,aAAa;CAC3C,MAAM,MAAM,mBAAmB,YAAY,MAAM,CAAC;CAClD,MAAM,OAAO,MAAM,UAAqC,GAAG,KAAK,mBAAmB,MAAM;AACzF,KAAI,KAAK,SAAS,YAChB,OAAM,IAAI,MACR,YAAY,YAAY,cAAc,KAAK,KAAK,iEAEjD;AAEH,KAAI,SAAS,MAAM,EAAE;EAEnB,MAAM,SAAS,MAAM,UACnB,GAAG,KAAK,mBAAmB,IAAI,YAFvB,mBAAmB,QAAQ,MAAM,CAEG,GAC7C;AACD,MAAI,CAAC,OAAO,YACV,OAAM,IAAI,MAAM,oCAAoC;AAEtD,2BAAyB,OAAO,aAAa,KAAK;AAClD,SAAO;GAAE,aAAa,OAAO;GAAa,SAAS,OAAO;GAAS;;CAErE,MAAM,KAAK,KAAK;AAChB,KAAI,CAAC,IAAI,YACP,OAAM,IAAI,MAAM,mCAAmC;AAErD,0BAAyB,GAAG,aAAa,KAAK;AAC9C,QAAO;EAAE,aAAa,GAAG;EAAa,SAAS,GAAG;EAAS;;AAG7D,eAAsB,gCACpB,cACA,aACiB;AAEjB,0BAAyB,aADZ,iBAAiB,aACY,CAAC;CAC3C,MAAM,MAAM,MAAM,MAAM,aAAa,EAAE,UAAU,UAAU,CAAC;AAC5D,KAAI,CAAC,IAAI,GACP,OAAM,IAAI,MAAM,yCAAyC,IAAI,OAAO,GAAG;CAEzE,MAAM,MAAM,IAAI,QAAQ,IAAI,iBAAiB;AAC7C,KAAI,KAAK;EACP,MAAM,IAAI,OAAO,IAAI;AACrB,MAAI,OAAO,SAAS,EAAE,IAAI,IAAA,SACxB,OAAM,IAAI,MAAM,6BAA6B,8BAA8B,SAAS;;CAGxF,MAAM,KAAK,MAAM,IAAI,aAAa;CAClC,MAAM,MAAM,OAAO,KAAK,GAAG;AAC3B,KAAI,IAAI,SAAA,SACN,OAAM,IAAI,MAAM,6BAA6B,8BAA8B,SAAS;AAEtF,QAAO;;AAGT,SAAgB,6BAA6B,aAAyC;CACpF,MAAM,UAAU,YAAY,MAAM;AAClC,KAAI,CAAC,QAAS,QAAO,KAAA;AACrB,QAAO,eAAe,QAAQ,GAAG,UAAU,KAAA"}
+{"version":3,"file":"store-api-client.js","names":[],"sources":["../../../../../../../src/agent/skills/marketplace/adapters/store/store-api-client.ts"],"sourcesContent":["/**\n * HTTP client for the public xopc-store-compatible REST API (packages list, detail, zip download).\n * Used by the store marketplace adapter and SSRF-safe download helpers.\n *\n * Facade: {@link ../../../skills-marketplace.js}.\n */\n\nimport type { Config } from '../../../../../config/schema.js';\nimport { MAX_EXTENSION_STORE_ZIP_BYTES } from '../../../../../extensions/store-zip-limits.js';\nimport { isValidSkillId, MAX_SKILL_ZIP_BYTES } from '../../../managed-store.js';\nimport type { SkillMarkdownPreviewPayload } from '../../../types.js';\n\nconst DEFAULT_STORE_BASE = 'https://store.xopc.ai';\n\n/**\n * Marketplace provider identifier. Dynamic — extensions can register additional providers\n * via `api.registerMarketplaceAdapter()`. Built-in values: 'store', 'skillhub', 'clawhub'.\n */\nexport type SkillsMarketplaceProvider = string;\n\nexport interface SkillsStoreListParams {\n  q?: string;\n  page?: number;\n  pageSize?: number;\n  sort?: 'downloads' | 'newest';\n  /** Adapter-defined category id (exact match against package `categories`). */\n  category?: string;\n}\n\n/** Category option for marketplace filter chips (from adapter). */\nexport interface MarketplaceCategoryOption {\n  id: string;\n  label: string;\n}\n\n/** Mirrors xopc-store GET /api/v1/packages list response (subset used by UI). */\nexport interface SkillsStorePackageListItem {\n  id: string;\n  name: string;\n  type: string;\n  description: string;\n  downloads: number;\n  author: { username: string; avatarUrl: string | null };\n  latestVersion?: string;\n  updatedAt: string;\n  /** Taxonomy / tags from the marketplace (adapter-specific). */\n  categories?: string[];\n  tags?: string[];\n  stars?: number;\n  /** Short provenance label for the row (e.g. ClawHub). */\n  sourceLabel?: string;\n}\n\n/** Unified marketplace package list item (works for all adapters). */\nexport type MarketplacePackageListItem = SkillsStorePackageListItem;\n\nexport interface SkillsStoreListResponse {\n  items: SkillsStorePackageListItem[];\n  meta: { page: number; pageSize: number; total: number; totalPages: number };\n}\n\nexport function resolveSkillsStoreBaseUrl(config: Config): string {\n  const env = process.env.XOPC_SKILLS_STORE_URL?.trim();\n  if (env) {\n    try {\n      return normalizeBaseUrl(new URL(env).toString());\n    } catch {\n      // fall through\n    }\n  }\n  const fromConfig = config.gateway?.skillsStoreBaseUrl?.trim();\n  if (fromConfig) {\n    try {\n      return normalizeBaseUrl(new URL(fromConfig).toString());\n    } catch {\n      return DEFAULT_STORE_BASE;\n    }\n  }\n  return DEFAULT_STORE_BASE;\n}\n\nexport { MAX_EXTENSION_STORE_ZIP_BYTES };\n\n/**\n * Base URL for extension downloads (defaults to skills store host — usually store.xopc.ai).\n * Override with `XOPC_EXTENSIONS_STORE_URL`.\n */\nexport function resolveExtensionsStoreBaseUrl(config: Config): string {\n  const env = process.env.XOPC_EXTENSIONS_STORE_URL?.trim();\n  if (env) {\n    try {\n      return normalizeBaseUrl(new URL(env).toString());\n    } catch {\n      // fall through\n    }\n  }\n  return resolveSkillsStoreBaseUrl(config);\n}\n\nfunction normalizeBaseUrl(url: string): string {\n  return url.replace(/\\/$/, '');\n}\n\nexport function getStoreOrigin(baseUrl: string): string {\n  const u = new URL(baseUrl);\n  return `${u.protocol}//${u.host}`;\n}\n\n/**\n * Allow download URLs whose origin matches the configured store base (SSRF guard).\n * Production store is HTTPS-only; local dev (`http://localhost` / `127.0.0.1`) may use HTTP.\n */\nexport function assertDownloadUrlAllowed(downloadUrl: string, storeBaseUrl: string): URL {\n  let u: URL;\n  try {\n    u = new URL(downloadUrl);\n  } catch {\n    throw new Error('Invalid download URL from store');\n  }\n  const allowed = new URL(storeBaseUrl);\n  const localHttpDev =\n    allowed.protocol === 'http:' &&\n    (allowed.hostname === 'localhost' || allowed.hostname === '127.0.0.1');\n  if (localHttpDev) {\n    if (u.protocol !== 'http:' && u.protocol !== 'https:') {\n      throw new Error('Download URL must use HTTP or HTTPS');\n    }\n  } else if (u.protocol !== 'https:') {\n    throw new Error('Download URL must use HTTPS');\n  }\n  if (u.host !== allowed.host) {\n    throw new Error('Download URL host does not match configured store host');\n  }\n  return u;\n}\n\nasync function fetchJson<T>(url: string, init?: RequestInit): Promise<T> {\n  const res = await fetch(url, {\n    ...init,\n    headers: { Accept: 'application/json', ...init?.headers },\n  });\n  const text = await res.text();\n  if (!res.ok) {\n    let msg = `Store request failed (${res.status})`;\n    try {\n      const j = JSON.parse(text) as { error?: { message?: string } };\n      if (j.error?.message) msg = j.error.message;\n    } catch {\n      if (text) msg = text.slice(0, 200);\n    }\n    throw new Error(msg);\n  }\n  try {\n    return JSON.parse(text) as T;\n  } catch {\n    throw new Error('Store returned invalid JSON');\n  }\n}\n\nexport async function listSkillPackages(\n  storeBaseUrl: string,\n  params: SkillsStoreListParams,\n): Promise<SkillsStoreListResponse> {\n  const base = normalizeBaseUrl(storeBaseUrl);\n  const sp = new URLSearchParams();\n  sp.set('type', 'skill');\n  if (params.q?.trim()) sp.set('q', params.q.trim());\n  if (params.page != null) sp.set('page', String(params.page));\n  if (params.pageSize != null) sp.set('pageSize', String(params.pageSize));\n  if (params.sort) sp.set('sort', params.sort);\n  if (params.category?.trim()) sp.set('category', params.category.trim());\n\n  const url = `${base}/api/v1/packages?${sp.toString()}`;\n  return fetchJson<SkillsStoreListResponse>(url);\n}\n\n/** GET /api/v1/packages/:name — published skill package (public). */\nexport interface MarketplacePackageDetail {\n  id: string;\n  name: string;\n  type: string;\n  description: string;\n  readme: string | null;\n  downloads: number;\n  author: { username: string; avatarUrl: string | null };\n  latestVersion: {\n    version: string;\n    changelog: string | null;\n    publishedAt: string;\n  };\n}\n\nexport async function fetchMarketplacePackageDetail(\n  storeBaseUrl: string,\n  packageName: string,\n): Promise<MarketplacePackageDetail> {\n  const base = normalizeBaseUrl(storeBaseUrl);\n  const enc = encodeURIComponent(packageName.trim());\n  return fetchJson<MarketplacePackageDetail>(`${base}/api/v1/packages/${enc}`);\n}\n\nexport async function resolveSkillZipDownloadUrl(\n  storeBaseUrl: string,\n  packageName: string,\n  version?: string,\n): Promise<{ downloadUrl: string; version: string }> {\n  const base = normalizeBaseUrl(storeBaseUrl);\n  const enc = encodeURIComponent(packageName);\n  if (version?.trim()) {\n    const v = encodeURIComponent(version.trim());\n    const detail = await fetchJson<{\n      downloadUrl: string;\n      version: string;\n    }>(`${base}/api/v1/packages/${enc}/versions/${v}`);\n    if (!detail.downloadUrl) {\n      throw new Error('Store version has no download URL');\n    }\n    assertDownloadUrlAllowed(detail.downloadUrl, base);\n    return { downloadUrl: detail.downloadUrl, version: detail.version };\n  }\n\n  const pkg = await fetchJson<{\n    name: string;\n    latestVersion: { downloadUrl: string; version: string };\n  }>(`${base}/api/v1/packages/${enc}`);\n  if (!pkg.latestVersion?.downloadUrl) {\n    throw new Error('Package has no published version');\n  }\n  assertDownloadUrlAllowed(pkg.latestVersion.downloadUrl, base);\n  return {\n    downloadUrl: pkg.latestVersion.downloadUrl,\n    version: pkg.latestVersion.version,\n  };\n}\n\nexport async function downloadSkillZipBuffer(\n  storeBaseUrl: string,\n  downloadUrl: string,\n): Promise<Buffer> {\n  const base = normalizeBaseUrl(storeBaseUrl);\n  assertDownloadUrlAllowed(downloadUrl, base);\n\n  const res = await fetch(downloadUrl, { redirect: 'follow' });\n  if (!res.ok) {\n    throw new Error(`Failed to download skill archive (${res.status})`);\n  }\n  const len = res.headers.get('content-length');\n  if (len) {\n    const n = Number(len);\n    if (Number.isFinite(n) && n > MAX_SKILL_ZIP_BYTES) {\n      throw new Error(`Zip exceeds maximum size (${MAX_SKILL_ZIP_BYTES} bytes)`);\n    }\n  }\n  const ab = await res.arrayBuffer();\n  const buf = Buffer.from(ab);\n  if (buf.length > MAX_SKILL_ZIP_BYTES) {\n    throw new Error(`Zip exceeds maximum size (${MAX_SKILL_ZIP_BYTES} bytes)`);\n  }\n  return buf;\n}\n\n/** GET /api/v1/packages/:name — subset used for extension installs. */\nexport interface StorePublishedPackageHead {\n  name: string;\n  type: string;\n  latestVersion: {\n    version: string;\n    downloadUrl: string;\n    checksum?: string;\n    integrity?: string;\n    sha256?: string;\n  };\n}\n\nexport async function resolveExtensionZipDownloadUrl(\n  storeBaseUrl: string,\n  packageName: string,\n  version?: string,\n): Promise<{ downloadUrl: string; version: string; integrity?: string }> {\n  const base = normalizeBaseUrl(storeBaseUrl);\n  const enc = encodeURIComponent(packageName.trim());\n  const meta = await fetchJson<StorePublishedPackageHead>(`${base}/api/v1/packages/${enc}`);\n  if (meta.type !== 'extension') {\n    throw new Error(\n      `Package \"${packageName}\" has type \"${meta.type}\" (expected extension). ` +\n        'Use `xopc skills install` for skills.',\n    );\n  }\n  if (version?.trim()) {\n    const v = encodeURIComponent(version.trim());\n    const detail = await fetchJson<{\n      downloadUrl: string;\n      version: string;\n      checksum?: string;\n      integrity?: string;\n      sha256?: string;\n    }>(`${base}/api/v1/packages/${enc}/versions/${v}`);\n    if (!detail.downloadUrl) {\n      throw new Error('Store version has no download URL');\n    }\n    assertDownloadUrlAllowed(detail.downloadUrl, base);\n    return {\n      downloadUrl: detail.downloadUrl,\n      version: detail.version,\n      integrity: detail.integrity ?? detail.checksum ?? detail.sha256,\n    };\n  }\n  const lv = meta.latestVersion;\n  if (!lv?.downloadUrl) {\n    throw new Error('Package has no published version');\n  }\n  assertDownloadUrlAllowed(lv.downloadUrl, base);\n  return {\n    downloadUrl: lv.downloadUrl,\n    version: lv.version,\n    integrity: lv.integrity ?? lv.checksum ?? lv.sha256,\n  };\n}\n\nexport async function downloadExtensionStoreZipBuffer(\n  storeBaseUrl: string,\n  downloadUrl: string,\n): Promise<Buffer> {\n  const base = normalizeBaseUrl(storeBaseUrl);\n  assertDownloadUrlAllowed(downloadUrl, base);\n  const res = await fetch(downloadUrl, { redirect: 'follow' });\n  if (!res.ok) {\n    throw new Error(`Failed to download extension archive (${res.status})`);\n  }\n  const len = res.headers.get('content-length');\n  if (len) {\n    const n = Number(len);\n    if (Number.isFinite(n) && n > MAX_EXTENSION_STORE_ZIP_BYTES) {\n      throw new Error(`Zip exceeds maximum size (${MAX_EXTENSION_STORE_ZIP_BYTES} bytes)`);\n    }\n  }\n  const ab = await res.arrayBuffer();\n  const buf = Buffer.from(ab);\n  if (buf.length > MAX_EXTENSION_STORE_ZIP_BYTES) {\n    throw new Error(`Zip exceeds maximum size (${MAX_EXTENSION_STORE_ZIP_BYTES} bytes)`);\n  }\n  return buf;\n}\n\nexport function skillIdForMarketplaceInstall(packageName: string): string | undefined {\n  const trimmed = packageName.trim();\n  if (!trimmed) return undefined;\n  return isValidSkillId(trimmed) ? trimmed : undefined;\n}\n\n/**\n * Unified marketplace list response (adapter fills `provider`).\n */\nexport interface UnifiedMarketplaceListResponse {\n  items: MarketplacePackageListItem[];\n  meta: { page: number; pageSize: number; total: number; totalPages: number };\n  provider: string;\n}\n\n/**\n * Unified marketplace package detail response.\n */\nexport interface UnifiedMarketplacePackageDetail extends MarketplacePackageDetail {\n  provider: string;\n  /** Gateway-normalized structured meta + body rendered by the console. */\n  skillDocPreview: SkillMarkdownPreviewPayload;\n  /** SkillHub-specific fields */\n  skillHubInfo?: {\n    category: string;\n    installs: number;\n    stars: number;\n    securityReports?: {\n      keen?: { status: string; statusText: string; reportUrl?: string };\n      sanbu?: { status: string; statusText: string; reportUrl?: string };\n    };\n  };\n}\n"],"mappings":";;;AAYA,MAAM,qBAAqB;AAiD3B,SAAgB,0BAA0B,QAAwB;CAChE,MAAM,MAAM,QAAQ,IAAI,uBAAuB,MAAM;AACrD,KAAI,IACF,KAAI;AACF,SAAO,iBAAiB,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC;SAC1C;CAIV,MAAM,aAAa,OAAO,SAAS,oBAAoB,MAAM;AAC7D,KAAI,WACF,KAAI;AACF,SAAO,iBAAiB,IAAI,IAAI,WAAW,CAAC,UAAU,CAAC;SACjD;AACN,SAAO;;AAGX,QAAO;;;;;;AAST,SAAgB,8BAA8B,QAAwB;CACpE,MAAM,MAAM,QAAQ,IAAI,2BAA2B,MAAM;AACzD,KAAI,IACF,KAAI;AACF,SAAO,iBAAiB,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC;SAC1C;AAIV,QAAO,0BAA0B,OAAO;;AAG1C,SAAS,iBAAiB,KAAqB;AAC7C,QAAO,IAAI,QAAQ,OAAO,GAAG;;AAG/B,SAAgB,eAAe,SAAyB;CACtD,MAAM,IAAI,IAAI,IAAI,QAAQ;AAC1B,QAAO,GAAG,EAAE,SAAS,IAAI,EAAE;;;;;;AAO7B,SAAgB,yBAAyB,aAAqB,cAA2B;CACvF,IAAI;AACJ,KAAI;AACF,MAAI,IAAI,IAAI,YAAY;SAClB;AACN,QAAM,IAAI,MAAM,kCAAkC;;CAEpD,MAAM,UAAU,IAAI,IAAI,aAAa;AAIrC,KAFE,QAAQ,aAAa,YACpB,QAAQ,aAAa,eAAe,QAAQ,aAAa;MAEtD,EAAE,aAAa,WAAW,EAAE,aAAa,SAC3C,OAAM,IAAI,MAAM,sCAAsC;YAE/C,EAAE,aAAa,SACxB,OAAM,IAAI,MAAM,8BAA8B;AAEhD,KAAI,EAAE,SAAS,QAAQ,KACrB,OAAM,IAAI,MAAM,yDAAyD;AAE3E,QAAO;;AAGT,eAAe,UAAa,KAAa,MAAgC;CACvE,MAAM,MAAM,MAAM,MAAM,KAAK;EAC3B,GAAG;EACH,SAAS;GAAE,QAAQ;GAAoB,GAAG,MAAM;GAAS;EAC1D,CAAC;CACF,MAAM,OAAO,MAAM,IAAI,MAAM;AAC7B,KAAI,CAAC,IAAI,IAAI;EACX,IAAI,MAAM,yBAAyB,IAAI,OAAO;AAC9C,MAAI;GACF,MAAM,IAAI,KAAK,MAAM,KAAK;AAC1B,OAAI,EAAE,OAAO,QAAS,OAAM,EAAE,MAAM;UAC9B;AACN,OAAI,KAAM,OAAM,KAAK,MAAM,GAAG,IAAI;;AAEpC,QAAM,IAAI,MAAM,IAAI;;AAEtB,KAAI;AACF,SAAO,KAAK,MAAM,KAAK;SACjB;AACN,QAAM,IAAI,MAAM,8BAA8B;;;AAIlD,eAAsB,kBACpB,cACA,QACkC;CAClC,MAAM,OAAO,iBAAiB,aAAa;CAC3C,MAAM,KAAK,IAAI,iBAAiB;AAChC,IAAG,IAAI,QAAQ,QAAQ;AACvB,KAAI,OAAO,GAAG,MAAM,CAAE,IAAG,IAAI,KAAK,OAAO,EAAE,MAAM,CAAC;AAClD,KAAI,OAAO,QAAQ,KAAM,IAAG,IAAI,QAAQ,OAAO,OAAO,KAAK,CAAC;AAC5D,KAAI,OAAO,YAAY,KAAM,IAAG,IAAI,YAAY,OAAO,OAAO,SAAS,CAAC;AACxE,KAAI,OAAO,KAAM,IAAG,IAAI,QAAQ,OAAO,KAAK;AAC5C,KAAI,OAAO,UAAU,MAAM,CAAE,IAAG,IAAI,YAAY,OAAO,SAAS,MAAM,CAAC;AAGvE,QAAO,UAAmC,GAD3B,KAAK,mBAAmB,GAAG,UAAU,GACN;;AAmBhD,eAAsB,8BACpB,cACA,aACmC;AAGnC,QAAO,UAAoC,GAF9B,iBAAiB,aAEoB,CAAC,mBADvC,mBAAmB,YAAY,MAAM,CACwB,GAAG;;AAG9E,eAAsB,2BACpB,cACA,aACA,SACmD;CACnD,MAAM,OAAO,iBAAiB,aAAa;CAC3C,MAAM,MAAM,mBAAmB,YAAY;AAC3C,KAAI,SAAS,MAAM,EAAE;EAEnB,MAAM,SAAS,MAAM,UAGlB,GAAG,KAAK,mBAAmB,IAAI,YAJxB,mBAAmB,QAAQ,MAAM,CAII,GAAG;AAClD,MAAI,CAAC,OAAO,YACV,OAAM,IAAI,MAAM,oCAAoC;AAEtD,2BAAyB,OAAO,aAAa,KAAK;AAClD,SAAO;GAAE,aAAa,OAAO;GAAa,SAAS,OAAO;GAAS;;CAGrE,MAAM,MAAM,MAAM,UAGf,GAAG,KAAK,mBAAmB,MAAM;AACpC,KAAI,CAAC,IAAI,eAAe,YACtB,OAAM,IAAI,MAAM,mCAAmC;AAErD,0BAAyB,IAAI,cAAc,aAAa,KAAK;AAC7D,QAAO;EACL,aAAa,IAAI,cAAc;EAC/B,SAAS,IAAI,cAAc;EAC5B;;AAGH,eAAsB,uBACpB,cACA,aACiB;AAEjB,0BAAyB,aADZ,iBAAiB,aACY,CAAC;CAE3C,MAAM,MAAM,MAAM,MAAM,aAAa,EAAE,UAAU,UAAU,CAAC;AAC5D,KAAI,CAAC,IAAI,GACP,OAAM,IAAI,MAAM,qCAAqC,IAAI,OAAO,GAAG;CAErE,MAAM,MAAM,IAAI,QAAQ,IAAI,iBAAiB;AAC7C,KAAI,KAAK;EACP,MAAM,IAAI,OAAO,IAAI;AACrB,MAAI,OAAO,SAAS,EAAE,IAAI,IAAA,SACxB,OAAM,IAAI,MAAM,6BAA6B,oBAAoB,SAAS;;CAG9E,MAAM,KAAK,MAAM,IAAI,aAAa;CAClC,MAAM,MAAM,OAAO,KAAK,GAAG;AAC3B,KAAI,IAAI,SAAA,SACN,OAAM,IAAI,MAAM,6BAA6B,oBAAoB,SAAS;AAE5E,QAAO;;AAgBT,eAAsB,+BACpB,cACA,aACA,SACuE;CACvE,MAAM,OAAO,iBAAiB,aAAa;CAC3C,MAAM,MAAM,mBAAmB,YAAY,MAAM,CAAC;CAClD,MAAM,OAAO,MAAM,UAAqC,GAAG,KAAK,mBAAmB,MAAM;AACzF,KAAI,KAAK,SAAS,YAChB,OAAM,IAAI,MACR,YAAY,YAAY,cAAc,KAAK,KAAK,iEAEjD;AAEH,KAAI,SAAS,MAAM,EAAE;EAEnB,MAAM,SAAS,MAAM,UAMlB,GAAG,KAAK,mBAAmB,IAAI,YAPxB,mBAAmB,QAAQ,MAAM,CAOI,GAAG;AAClD,MAAI,CAAC,OAAO,YACV,OAAM,IAAI,MAAM,oCAAoC;AAEtD,2BAAyB,OAAO,aAAa,KAAK;AAClD,SAAO;GACL,aAAa,OAAO;GACpB,SAAS,OAAO;GAChB,WAAW,OAAO,aAAa,OAAO,YAAY,OAAO;GAC1D;;CAEH,MAAM,KAAK,KAAK;AAChB,KAAI,CAAC,IAAI,YACP,OAAM,IAAI,MAAM,mCAAmC;AAErD,0BAAyB,GAAG,aAAa,KAAK;AAC9C,QAAO;EACL,aAAa,GAAG;EAChB,SAAS,GAAG;EACZ,WAAW,GAAG,aAAa,GAAG,YAAY,GAAG;EAC9C;;AAGH,eAAsB,gCACpB,cACA,aACiB;AAEjB,0BAAyB,aADZ,iBAAiB,aACY,CAAC;CAC3C,MAAM,MAAM,MAAM,MAAM,aAAa,EAAE,UAAU,UAAU,CAAC;AAC5D,KAAI,CAAC,IAAI,GACP,OAAM,IAAI,MAAM,yCAAyC,IAAI,OAAO,GAAG;CAEzE,MAAM,MAAM,IAAI,QAAQ,IAAI,iBAAiB;AAC7C,KAAI,KAAK;EACP,MAAM,IAAI,OAAO,IAAI;AACrB,MAAI,OAAO,SAAS,EAAE,IAAI,IAAA,SACxB,OAAM,IAAI,MAAM,6BAA6B,8BAA8B,SAAS;;CAGxF,MAAM,KAAK,MAAM,IAAI,aAAa;CAClC,MAAM,MAAM,OAAO,KAAK,GAAG;AAC3B,KAAI,IAAI,SAAA,SACN,OAAM,IAAI,MAAM,6BAA6B,8BAA8B,SAAS;AAEtF,QAAO;;AAGT,SAAgB,6BAA6B,aAAyC;CACpF,MAAM,UAAU,YAAY,MAAM;AAClC,KAAI,CAAC,QAAS,QAAO,KAAA;AACrB,QAAO,eAAe,QAAQ,GAAG,UAAU,KAAA"}

package/dist/src/agent/skills/scanner.js

@@ -1,7 +1,7 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { readFile, readdir } from "fs/promises";
 import { join } from "path";
+import { readFile, readdir } from "fs/promises";
 //#region src/agent/skills/scanner.ts
 /**
 * Skill security scanner — scans skill directories for potentially dangerous code patterns.

package/dist/src/agent/skills/skill-manage-ops.js

@@ -2,9 +2,9 @@ import { init_paths, resolveSkillsDir } from "../../config/paths.js";
 import { parseFrontmatter } from "../../markdown/frontmatter.js";
 import { fuzzyFindText, normalizeForFuzzyMatch, normalizeToLF, restoreLineEndings } from "../tools/edit-diff.js";
 import { formatScanSummary, scanSkillDirectory } from "./scanner.js";
-import { mkdir, writeFile } from "fs/promises";
 import { join, resolve, sep } from "path";
 import { existsSync, realpathSync } from "fs";
+import { mkdir, writeFile } from "fs/promises";
 //#region src/agent/skills/skill-manage-ops.ts
 /**
 * Shared logic for the skill_manage agent tool (create / edit / patch / delete / write_file / remove_file).

package/dist/src/agent/skills/skill-manager.js

@@ -1,6 +1,6 @@
+import { resolveStateDir } from "../../config/paths-state.js";
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { resolveStateDir } from "../../config/paths-state.js";
 import { init_paths, resolveBundledSkillsDir } from "../../config/paths.js";
 import { createSkillConfigManager, isSkillEnabled } from "./config.js";
 import { formatSkillsForPrompt, selectSkillsVisibleInPrompt } from "./format-skills-prompt.js";

package/dist/src/agent/starter-agents.d.ts

@@ -0,0 +1,19 @@
+import type { Config } from '../config/schema.js';
+export declare const STARTER_AGENTS_INITIALIZED_VERSION = 1;
+type StarterAgent = {
+    id: string;
+    displayName: string;
+    description: string;
+    emoji: string;
+    tools?: {
+        disable?: string[];
+    };
+    profileFiles: Record<string, string>;
+};
+export declare const STARTER_AGENTS: readonly StarterAgent[];
+export declare function materializeStarterAgentFiles(cfg: Config): void;
+export declare function ensureStarterAgentsInitialized(cfg: Config): {
+    config: Config;
+    changed: boolean;
+};
+export {};