npm - @xopcai/xopc - Versions diffs - 0.0.241 → 0.0.242 - Mend

@xopcai/xopc 0.0.241 → 0.0.242

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (116) hide show

package/dist/gateway/static/root/index.html CHANGED Viewed

@@ -11,7 +11,7 @@
     <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png?v=20260713-1" />
     <link rel="manifest" href="/site.webmanifest?v=20260713-1" />
     <title>XOPC — Keep what matters moving.</title>
-    <script type="module" crossorigin src="/assets/index-7i2P3312.js"></script>
+    <script type="module" crossorigin src="/assets/index-J3FsIvTs.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-aKtaBQYM.js">
     <link rel="modulepreload" crossorigin href="/assets/preload-helper-zJ_50EbN.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-react-BOUWij0V.js">
@@ -26,12 +26,12 @@
     <link rel="modulepreload" crossorigin href="/assets/plus-Q2yW6OE7.js">
     <link rel="modulepreload" crossorigin href="/assets/x-B_N4OPjy.js">
     <link rel="modulepreload" crossorigin href="/assets/messages-_tYhRAHD.js">
-    <link rel="modulepreload" crossorigin href="/assets/locale-store-C5wr3_pc.js">
+    <link rel="modulepreload" crossorigin href="/assets/locale-store-DVzTJSj2.js">
     <link rel="modulepreload" crossorigin href="/assets/cn-JdwAhgNB.js">
     <link rel="modulepreload" crossorigin href="/assets/schemas-zIBW3wiV.js">
     <link rel="modulepreload" crossorigin href="/assets/product-delivery-dUJgmBQZ.js">
     <link rel="modulepreload" crossorigin href="/assets/copy-to-clipboard-HOJ79TWv.js">
-    <link rel="modulepreload" crossorigin href="/assets/markdown-view-D6LxlDxr.js">
+    <link rel="modulepreload" crossorigin href="/assets/markdown-view-DR3yVwtV.js">
     <link rel="modulepreload" crossorigin href="/assets/dist-DqPZM2MH.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-swr-BIWyz7Rc.js">
     <link rel="modulepreload" crossorigin href="/assets/check-DUBLcKHA.js">
@@ -60,20 +60,20 @@
     <link rel="modulepreload" crossorigin href="/assets/tool-activity-R8V9l6nk.js">
     <link rel="modulepreload" crossorigin href="/assets/app-chrome-BeB4KgOf.js">
     <link rel="modulepreload" crossorigin href="/assets/button-CSEbl4zT.js">
-    <link rel="modulepreload" crossorigin href="/assets/gateway-startup-retry-DJG-I0wW.js">
-    <link rel="modulepreload" crossorigin href="/assets/registry-api-FXdFaoWM.js">
+    <link rel="modulepreload" crossorigin href="/assets/gateway-startup-retry-iBCtaAuT.js">
+    <link rel="modulepreload" crossorigin href="/assets/registry-api-DXsR8oGN.js">
     <link rel="modulepreload" crossorigin href="/assets/config-reload-event-Bjh2zoKp.js">
-    <link rel="modulepreload" crossorigin href="/assets/gateway-config-swr-Bxe_R-JH.js">
-    <link rel="modulepreload" crossorigin href="/assets/models-hub-cache-Y7GUjxHx.js">
+    <link rel="modulepreload" crossorigin href="/assets/gateway-config-swr-HT7sLeO9.js">
+    <link rel="modulepreload" crossorigin href="/assets/models-hub-cache-DiXjKuuY.js">
     <link rel="modulepreload" crossorigin href="/assets/electron-env-DH5wF8X8.js">
-    <link rel="modulepreload" crossorigin href="/assets/oauth-api-C5NVcsKE.js">
+    <link rel="modulepreload" crossorigin href="/assets/oauth-api-BB-VYJ5j.js">
     <link rel="modulepreload" crossorigin href="/assets/form-field-width-DJw_jULe.js">
     <link rel="modulepreload" crossorigin href="/assets/interaction-BmQogeqz.js">
     <link rel="modulepreload" crossorigin href="/assets/is-masked-secret-DOkL5b_X.js">
-    <link rel="modulepreload" crossorigin href="/assets/activity-store-CLnbVm9G.js">
-    <link rel="modulepreload" crossorigin href="/assets/theme-store-DUko1ZnE.js">
+    <link rel="modulepreload" crossorigin href="/assets/activity-store-MU5XrVv8.js">
+    <link rel="modulepreload" crossorigin href="/assets/theme-store-Cth-eChE.js">
     <link rel="stylesheet" crossorigin href="/assets/markdown-view-Y68dCxuc.css">
-    <link rel="stylesheet" crossorigin href="/assets/index-DTo3IcbW.css">
+    <link rel="stylesheet" crossorigin href="/assets/index-D499B1qS.css">
   </head>
   <body>
     <div id="root"></div>

package/dist/package.js CHANGED Viewed

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.0.241";
+var version = "0.0.242";
 //#endregion
 export { version };

package/dist/src/agent/agent-manager.js CHANGED Viewed

@@ -241,6 +241,7 @@ var AgentManager = class {
 			getConfig: () => this.mergedConfig(),
 			getPrimaryModel: () => this.resolveModelStringToModel(this.pickDefaultModelRef()),
 			getMemoryManager: () => this.getCurrentWorkspaceRuntime().memoryManager,
+			getSkillManager: () => this.getCurrentWorkspaceRuntime().skillManager,
 			getSessionStore: this.config.getSessionStore,
 			gatewayClarify: this.config.gatewayClarify,
 			getAutomationService: this.config.getAutomationService,

package/dist/src/agent/skills/installer.d.ts CHANGED Viewed

@@ -13,6 +13,7 @@ export interface InstallContext {
     installSpec: SkillInstallSpec;
     timeoutMs: number;
 }
+export declare function skillEnvironmentId(skill: Pick<SkillEntry['skill'], 'name' | 'filePath'>, installSpec: SkillInstallSpec): string;
 /**
  * Check if a binary exists
  */

package/dist/src/agent/skills/installer.js CHANGED Viewed

@@ -19,6 +19,13 @@ import { execFile } from "child_process";
 init_logger();
 const execFileAsync = promisify(execFile);
 const log = createLogger("SkillInstaller");
+function skillEnvironmentId(skill, installSpec) {
+	return createHash("sha256").update(JSON.stringify({
+		skill: skill.name,
+		path: skill.filePath,
+		installSpec
+	})).digest("hex").slice(0, 24);
+}
 /**
 * Check if a binary exists
 */
@@ -202,11 +209,7 @@ async function installSkill(ctx) {
 	if (installSpec.kind === "go") {
 		if (!hasBinary("go")) return createInstallFailure({ message: "go not installed — install it explicitly from https://go.dev/doc/install" });
 	}
-	const environmentId = createHash("sha256").update(JSON.stringify({
-		skill: ctx.skillEntry.skill.name,
-		path: ctx.skillEntry.skill.filePath,
-		installSpec
-	})).digest("hex").slice(0, 24);
+	const environmentId = skillEnvironmentId(ctx.skillEntry.skill, installSpec);
 	const environmentDir = join(ctx.stateDir, "tools", "environments", "skills", environmentId);
 	await mkdir(environmentDir, { recursive: true });
 	if ([
@@ -285,4 +288,4 @@ async function installSkill(ctx) {
 	});
 }
 //#endregion
-export { findInstallSpec, hasBinary, installSkill, resolveBrewExecutable };
+export { findInstallSpec, hasBinary, installSkill, resolveBrewExecutable, skillEnvironmentId };

package/dist/src/agent/tools/factory.d.ts CHANGED Viewed

@@ -44,6 +44,8 @@ export interface ToolFactoryDeps {
     getPrimaryModel?: () => Model<Api>;
     /** Memory orchestration (prefetch/sync + external tools). */
     getMemoryManager?: () => MemoryManager;
+    /** Skill runtime for the current workspace/session. */
+    getSkillManager?: () => SkillManager;
     /** Session store for `session_search`. */
     getSessionStore?: () => SessionStore;
     /** When set (gateway webchat), enables the `clarify` tool. */

package/dist/src/agent/tools/factory.js CHANGED Viewed

@@ -9,6 +9,7 @@ import { wrapToolsWithProtection } from "./executor.js";
 import { buildRuntimeEnvironment } from "../../runtime-tools/environment.js";
 import { createDefaultExternalToolGatewayTools } from "../external-tools/index.js";
 import { createReadFileTool } from "./read.js";
+import { skillEnvironmentId } from "../skills/installer.js";
 import { createWriteFileTool } from "./write.js";
 import { createListDirTool } from "./list-dir.js";
 import { createPublishArtifactsTool } from "./publish-artifacts.js";
@@ -81,10 +82,13 @@ var AgentToolsFactory = class {
 	prepareRuntimeEnv = async (baseEnv) => {
 		const config = this.deps.getConfig?.();
 		if (!config) return baseEnv;
+		const indexing = this.deps.getSkillIndexingContext?.();
+		const skillEnvironmentIds = this.deps.getSkillManager?.()?.getEnabledSkillsForAgentSession(indexing).flatMap((skill) => (skill.metadata.install ?? []).map((installSpec) => skillEnvironmentId(skill, installSpec)));
 		return (await buildRuntimeEnvironment({
 			stateDir: resolveStateDir(),
 			config: config.runtimeTools,
-			baseEnv
+			baseEnv,
+			skillEnvironmentIds
 		})).env;
 	};
 	browserReadinessKey() {

package/dist/src/config/schema.js CHANGED Viewed

@@ -8,6 +8,7 @@ import { init_public_url, validatePublicUrl } from "./public-url.js";
 import { TelegramAccountConfigSchema, TelegramConfigSchema, TelegramGroupConfigSchema, TelegramTopicConfigSchema, init_config_schema } from "../../extensions/telegram/src/config-schema.js";
 import { WeixinAccountConfigSchema, WeixinConfigSchema, init_config_schema as init_config_schema$1 } from "../../extensions/weixin/src/config-schema.js";
 import { z } from "zod";
+import semver from "semver";
 //#region src/config/schema.ts
 function getAgentDefaultModelRef(config) {
 	return config.agents.list.find((entry) => entry.enabled !== false && entry.id === config.agents.default)?.models?.chat?.primary ?? config.agents.defaults.models.chat.primary;
@@ -36,7 +37,7 @@ function parseModelRef(ref) {
 		model: trimmed.slice(idx + 1).trim()
 	};
 }
-var AgentModelRefSchema, AgentImageGenerationModelSchema, AgentModelsSchema, AgentsConfigSchema, BrowserCloudConfigSchema, BrowserExtensionConfigSchema, BrowserCloakConfigSchema, BrowserConfigSchema, BindingMatchSchema, BindingRuleSchema, BindingsConfigSchema, SessionDmScopeSchema, SessionStorageConfigSchema, SessionResetModeSchema, SessionResetConfigSchema, SessionResetByTypeSchema, SessionScopeSchema, SessionConfigSchema, ChannelsConfigSchema, SearchProviderEntrySchema, WebSearchConfigSchema, WebsiteBlocklistSchema, WebToolsConfigSchema, ToolsConfigSchema, RuntimePreferenceSchema, RuntimeProvisionSchema, LanguageRuntimeSchema, DEFAULT_RUNTIME_TOOLS_CONFIG, RuntimeToolsConfigSchema, GatewayAuthRateLimitSchema, GatewaySecuritySchema, GatewayTrustedProxySchema, GatewayAuthSchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayRemoteSchema, GatewayTlsSchema, GatewayModeSchema, HeartbeatConfigSchema, GatewayChannelConnectDeferModeSchema, TunnelConsentSchema, TunnelConfigSchema, WorkspaceImportConfigSchema, WorkspaceConfigSchema, GatewayBindModeSchema, GatewayWebchatConfigSchema, GatewayConfigSchema, ModelsDevConfigSchema, ModelCatalogConfigSchema, SttProviderConfigCatchallSchema, STTProviderConfigSchema, STTFallbackConfigSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, STTConfigSchema, TtsProviderConfigCatchallSchema, TTSProviderConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSEdgeConfigSchema, TTSSummarizationConfigSchema, TTSConfigSchema, VoiceRefinementConfigSchema, VoiceConfigSchema, MessagesConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, ProviderAzureConfigSchema, ProviderRequestOverridesSchema, ProviderAuthConfigSchema, ProvidersConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, UpdateAutoConfigSchema, UpdateConfigSchema, CommandsConfigSchema, TuiConfigSchema, McpHttpUrlSchema, ConnectorSecretReferenceSchema, McpConfigScalarSchema, McpOAuthConfigSchema, McpServerSchema, McpConfigSchema, ConnectorsConfigSchema, ExperimentalConfigSchema, ConfigSchema;
+var AgentModelRefSchema, AgentImageGenerationModelSchema, AgentModelsSchema, AgentsConfigSchema, BrowserCloudConfigSchema, BrowserExtensionConfigSchema, BrowserCloakConfigSchema, BrowserConfigSchema, BindingMatchSchema, BindingRuleSchema, BindingsConfigSchema, SessionDmScopeSchema, SessionStorageConfigSchema, SessionResetModeSchema, SessionResetConfigSchema, SessionResetByTypeSchema, SessionScopeSchema, SessionConfigSchema, ChannelsConfigSchema, SearchProviderEntrySchema, WebSearchConfigSchema, WebsiteBlocklistSchema, WebToolsConfigSchema, ToolsConfigSchema, RuntimePreferenceSchema, RuntimeProvisionSchema, RuntimeVersionRequestSchema, LanguageRuntimeSchema, DEFAULT_RUNTIME_TOOLS_CONFIG, RuntimeToolsConfigSchema, GatewayAuthRateLimitSchema, GatewaySecuritySchema, GatewayTrustedProxySchema, GatewayAuthSchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayRemoteSchema, GatewayTlsSchema, GatewayModeSchema, HeartbeatConfigSchema, GatewayChannelConnectDeferModeSchema, TunnelConsentSchema, TunnelConfigSchema, WorkspaceImportConfigSchema, WorkspaceConfigSchema, GatewayBindModeSchema, GatewayWebchatConfigSchema, GatewayConfigSchema, ModelsDevConfigSchema, ModelCatalogConfigSchema, SttProviderConfigCatchallSchema, STTProviderConfigSchema, STTFallbackConfigSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, STTConfigSchema, TtsProviderConfigCatchallSchema, TTSProviderConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSEdgeConfigSchema, TTSSummarizationConfigSchema, TTSConfigSchema, VoiceRefinementConfigSchema, VoiceConfigSchema, MessagesConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, ProviderAzureConfigSchema, ProviderRequestOverridesSchema, ProviderAuthConfigSchema, ProvidersConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, UpdateAutoConfigSchema, UpdateConfigSchema, CommandsConfigSchema, TuiConfigSchema, McpHttpUrlSchema, ConnectorSecretReferenceSchema, McpConfigScalarSchema, McpOAuthConfigSchema, McpServerSchema, McpConfigSchema, ConnectorsConfigSchema, ExperimentalConfigSchema, ConfigSchema;
 var init_schema = __esmMin((() => {
 	init_agent_config();
 	init_cache_dir_policy();
@@ -240,9 +241,10 @@ var init_schema = __esmMin((() => {
 		"on-demand",
 		"disabled"
 	]);
+	RuntimeVersionRequestSchema = z.string().trim().min(1).max(128).refine((value) => !value.includes("/") && !value.includes("\\") && !value.includes("\0"), "Runtime version must not contain path separators").refine((value) => semver.validRange(value) !== null, "Runtime version must be a valid SemVer version or range");
 	LanguageRuntimeSchema = z.object({
 		enabled: z.boolean().default(true),
-		version: z.string().min(1).optional(),
+		version: RuntimeVersionRequestSchema.optional(),
 		preference: RuntimePreferenceSchema.default("managed-first"),
 		provision: RuntimeProvisionSchema.default("on-demand")
 	});
@@ -280,7 +282,7 @@ var init_schema = __esmMin((() => {
 		}),
 		uv: z.object({
 			enabled: z.boolean().default(true),
-			version: z.string().min(1).optional()
+			version: RuntimeVersionRequestSchema.optional()
 		}).default({ enabled: true }),
 		download: z.object({
 			bundleDir: z.string().min(1).optional(),

package/dist/src/extensions/install.js CHANGED Viewed

@@ -8,8 +8,8 @@ import { collectExtensionPackageDependencyIssues } from "./package-contract.js";
 import { dirname, isAbsolute, join, resolve, sep } from "path";
 import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "fs";
 import { execFileSync } from "node:child_process";
-import AdmZip from "adm-zip";
 import semver from "semver";
+import AdmZip from "adm-zip";
 import { tmpdir } from "os";
 //#region src/extensions/install.ts
 /**

package/dist/src/gateway/hono/routes/runtime-tools.js CHANGED Viewed

@@ -1,5 +1,6 @@
 import { init_paths_state, resolveStateDir } from "../../../config/paths-state.js";
 import { RuntimeToolsConfigSchema, init_schema } from "../../../config/schema.js";
+import { normalizeRuntimeVersionRequest } from "../../../runtime-tools/probe.js";
 import { ManagedRuntimeManager } from "../../../runtime-tools/manager.js";
 import { createGatewayRouteLogger } from "../lib/route-logger.js";
 import { pruneRuntimeTools } from "../../../runtime-tools/prune.js";
@@ -82,6 +83,11 @@ function registerRuntimeToolsRoutes(authenticated, deps) {
 			}, 400);
 			const body = await readJson(c);
 			const version = typeof body.version === "string" && body.version.trim() ? body.version.trim() : void 0;
+			if (version && !normalizeRuntimeVersionRequest(version)) return c.json({
+				ok: false,
+				error: "invalid-version",
+				message: "Invalid runtime version"
+			}, 400);
 			return streamSSE(c, async (stream) => {
 				const manager = runtimeManager(service.currentConfig);
 				let writes = Promise.resolve();
@@ -97,7 +103,7 @@ function registerRuntimeToolsRoutes(authenticated, deps) {
 				};
 				manager.on("progress", onProgress);
 				try {
-					const resolved = action === "repair" ? await manager.repair(runtime) : await manager.install(runtime, version);
+					const resolved = action === "repair" ? await manager.repair(runtime, version) : await manager.install(runtime, version);
 					await writes;
 					await stream.writeSSE({
 						event: "result",

package/dist/src/gateway/hono/routes/voice.js CHANGED Viewed

@@ -14,8 +14,8 @@ import "../../../voice/stt/index.js";
 import { listSttProvidersForApi } from "../../../voice/stt/list-providers.js";
 import "../../../voice/tts/index.js";
 import { createGatewayRouteLogger } from "../lib/route-logger.js";
-import { listTtsProvidersForApi } from "../../../voice/tts/list-providers.js";
 import { listLocalVoiceModelStatuses, removeLocalVoiceModel, startLocalVoiceModelInstall } from "../../../voice/local/model-manager.js";
+import { listTtsProvidersForApi } from "../../../voice/tts/list-providers.js";
 //#region src/gateway/hono/routes/voice.ts
 init_providers();
 const log = createGatewayRouteLogger("Voice");

package/dist/src/runtime-tools/archive.js CHANGED Viewed

@@ -5,12 +5,15 @@ import { lstat, mkdir, readdir, readlink, rename, rm, stat } from "node:fs/promi
 import AdmZip from "adm-zip";
 //#region src/runtime-tools/archive.ts
 const MAX_ARCHIVE_ENTRIES = 5e4;
+const MAX_TAR_OUTPUT_BYTES = 16 * 1024 * 1024;
+const MAX_EXTRACTED_BYTES = 2 * 1024 * 1024 * 1024;
 function validateMemberPath(memberPath) {
 	const portablePath = memberPath.replaceAll("\\", "/");
 	const normalized = posix.normalize(portablePath);
 	if (!memberPath || isAbsolute(memberPath) || portablePath.startsWith("/") || normalized === ".." || normalized.startsWith("../")) throw new Error(`Unsafe archive member: ${memberPath}`);
 }
 async function validateExtractedTree(root, current = root) {
+	let totalBytes = 0;
 	for (const entry of await readdir(current)) {
 		const entryPath = join(current, entry);
 		const details = await lstat(entryPath);
@@ -19,8 +22,10 @@ async function validateExtractedTree(root, current = root) {
 			if (relativeTarget.split(/[\\/]/)[0] === ".." || isAbsolute(relativeTarget)) throw new Error(`Archive symlink escapes extraction root: ${entryPath}`);
 			continue;
 		}
-		if (details.isDirectory()) await validateExtractedTree(root, entryPath);
+		totalBytes += details.isDirectory() ? await validateExtractedTree(root, entryPath) : details.size;
+		if (totalBytes > MAX_EXTRACTED_BYTES) throw new Error("Extracted archive exceeds size limit");
 	}
+	return totalBytes;
 }
 async function runTar(args) {
 	return await new Promise((resolvePromise, reject) => {
@@ -30,11 +35,19 @@ async function runTar(args) {
 			shell: false,
 			windowsHide: true
 		});
+		const append = (current, chunk) => {
+			if (Buffer.byteLength(current) + chunk.byteLength > MAX_TAR_OUTPUT_BYTES) {
+				child.kill("SIGKILL");
+				reject(/* @__PURE__ */ new Error("tar output exceeds size limit"));
+				return current;
+			}
+			return current + chunk.toString();
+		};
 		child.stdout?.on("data", (chunk) => {
-			stdout += chunk.toString();
+			stdout = append(stdout, chunk);
 		});
 		child.stderr?.on("data", (chunk) => {
-			stderr += chunk.toString();
+			stderr = append(stderr, chunk);
 		});
 		child.once("error", reject);
 		child.once("close", (code) => {
@@ -47,6 +60,7 @@ async function extractZip(archivePath, destination) {
 	const zip = new AdmZip(archivePath);
 	const entries = zip.getEntries();
 	if (entries.length > MAX_ARCHIVE_ENTRIES) throw new Error("Archive contains too many entries");
+	if (entries.reduce((total, entry) => total + entry.header.size, 0) > MAX_EXTRACTED_BYTES) throw new Error("Extracted archive exceeds size limit");
 	for (const entry of entries) validateMemberPath(entry.entryName);
 	zip.extractAllTo(destination, true, false);
 }

package/dist/src/runtime-tools/command.d.ts CHANGED Viewed

@@ -5,6 +5,7 @@ export interface RuntimeCommandResult {
     exitCode: number | null;
     timedOut: boolean;
     aborted: boolean;
+    outputTruncated: boolean;
 }
 export declare function runRuntimeCommand(params: {
     command: string;

package/dist/src/runtime-tools/command.js CHANGED Viewed

@@ -1,6 +1,7 @@
 import { spawn } from "node:child_process";
 //#region src/runtime-tools/command.ts
 const DEFAULT_COMMAND_TIMEOUT_MS = 5e3;
+const MAX_COMMAND_OUTPUT_BYTES = 1024 * 1024;
 async function runRuntimeCommand(params) {
 	return await new Promise((resolve) => {
 		let stdout = "";
@@ -8,7 +9,10 @@ async function runRuntimeCommand(params) {
 		let settled = false;
 		let timedOut = false;
 		let aborted = false;
+		let outputTruncated = false;
+		let timeout;
 		const child = spawn(params.command, params.args, {
+			detached: process.platform !== "win32",
 			env: params.env,
 			shell: false,
 			windowsHide: process.platform === "win32",
@@ -18,36 +22,53 @@ async function runRuntimeCommand(params) {
 				"pipe"
 			]
 		});
+		const killChild = () => {
+			if (process.platform !== "win32" && child.pid) try {
+				process.kill(-child.pid, "SIGKILL");
+				return;
+			} catch {}
+			child.kill("SIGKILL");
+		};
 		const finish = (exitCode) => {
 			if (settled) return;
 			settled = true;
-			clearTimeout(timeout);
+			if (timeout) clearTimeout(timeout);
 			params.signal?.removeEventListener("abort", abort);
 			resolve({
-				ok: exitCode === 0 && !timedOut && !aborted,
+				ok: exitCode === 0 && !timedOut && !aborted && !outputTruncated,
 				stdout: stdout.trim(),
 				stderr: stderr.trim(),
 				exitCode,
 				timedOut,
-				aborted
+				aborted,
+				outputTruncated
 			});
 		};
 		const abort = () => {
 			aborted = true;
-			child.kill("SIGKILL");
+			killChild();
 			finish(null);
 		};
+		const appendOutput = (current, chunk) => {
+			const remaining = MAX_COMMAND_OUTPUT_BYTES - Buffer.byteLength(current);
+			if (remaining <= 0 || chunk.byteLength > remaining) {
+				outputTruncated = true;
+				killChild();
+				return remaining > 0 ? current + chunk.subarray(0, remaining).toString() : current;
+			}
+			return current + chunk.toString();
+		};
 		child.stdout?.on("data", (chunk) => {
-			stdout += chunk.toString();
+			stdout = appendOutput(stdout, chunk);
 		});
 		child.stderr?.on("data", (chunk) => {
-			stderr += chunk.toString();
+			stderr = appendOutput(stderr, chunk);
 		});
 		child.once("error", () => finish(null));
 		child.once("close", finish);
-		const timeout = setTimeout(() => {
+		timeout = setTimeout(() => {
 			timedOut = true;
-			child.kill("SIGKILL");
+			killChild();
 			finish(null);
 		}, params.timeoutMs ?? DEFAULT_COMMAND_TIMEOUT_MS);
 		timeout.unref();

package/dist/src/runtime-tools/environment.d.ts CHANGED Viewed

@@ -6,6 +6,7 @@ export interface RuntimeEnvironmentOptions {
     baseEnv: Record<string, string>;
     runtimes?: RuntimeKind[];
     extraBinDirs?: string[];
+    skillEnvironmentIds?: string[];
 }
 export interface RuntimeEnvironmentResult {
     env: Record<string, string>;

package/dist/src/runtime-tools/environment.js CHANGED Viewed

@@ -1,7 +1,7 @@
-import { applyPathPrepend } from "../infra/path-prepend.js";
+import { applyPathPrepend, findPathKey, normalizePathPrepend } from "../infra/path-prepend.js";
 import { ManagedRuntimeManager } from "./manager.js";
-import { dirname, join } from "node:path";
-import { access, readdir } from "node:fs/promises";
+import { delimiter, dirname, join } from "node:path";
+import { access } from "node:fs/promises";
 //#region src/runtime-tools/environment.ts
 const POLLUTING_ENV_KEYS = [
 	"NODE_OPTIONS",
@@ -19,14 +19,8 @@ const POLLUTING_ENV_KEYS = [
 	"UV_CACHE_DIR",
 	"UV_PYTHON_INSTALL_MIRROR"
 ];
-async function skillEnvironmentBinDirs(stateDir) {
+async function skillEnvironmentBinDirs(stateDir, environmentIds) {
 	const root = join(stateDir, "tools", "environments", "skills");
-	let environmentIds;
-	try {
-		environmentIds = await readdir(root);
-	} catch {
-		return [];
-	}
 	const candidates = environmentIds.flatMap((id) => [join(root, id, "bin"), join(root, id, "node_modules", ".bin")]);
 	return (await Promise.all(candidates.map(async (candidate) => {
 		try {
@@ -37,6 +31,10 @@ async function skillEnvironmentBinDirs(stateDir) {
 		}
 	}))).filter((candidate) => candidate !== null);
 }
+function appendPathEntries(env, entries) {
+	const pathKey = findPathKey(env);
+	env[pathKey] = normalizePathPrepend([...(env[pathKey] ?? "").split(delimiter).filter(Boolean), ...entries]).join(delimiter);
+}
 async function buildRuntimeEnvironment(options) {
 	const env = { ...options.baseEnv };
 	for (const key of POLLUTING_ENV_KEYS) delete env[key];
@@ -60,12 +58,9 @@ async function buildRuntimeEnvironment(options) {
 		}
 	}))).filter((item) => item !== null);
 	const managedBinDirs = resolved.filter((item) => item.source === "managed").map((item) => dirname(item.executable));
-	const skillBinDirs = await skillEnvironmentBinDirs(options.stateDir);
-	applyPathPrepend(env, [
-		...managedBinDirs,
-		...skillBinDirs,
-		...options.extraBinDirs ?? []
-	]);
+	const skillBinDirs = await skillEnvironmentBinDirs(options.stateDir, options.skillEnvironmentIds ?? []);
+	applyPathPrepend(env, [...managedBinDirs, ...options.extraBinDirs ?? []]);
+	appendPathEntries(env, skillBinDirs);
 	if (resolved.some((item) => item.runtime === "python")) {
 		env.PYTHONNOUSERSITE = "1";
 		env.PIP_REQUIRE_VIRTUALENV = "1";

package/dist/src/runtime-tools/install-lock.d.ts CHANGED Viewed

	@@ -1 +1 @@
1	- export declare function withInstallLock<T>(path: string, metadata: Record<string, unknown>, fn: () => Promise<T>): Promise<T>;
1	+ export declare function withInstallLock<T>(path: string, metadata: Record<string, unknown>, fn: () => Promise<T>, signal?: AbortSignal): Promise<T>;

package/dist/src/runtime-tools/install-lock.js CHANGED Viewed

@@ -7,38 +7,51 @@ function isProcessAlive(pid) {
 	try {
 		process.kill(pid, 0);
 		return true;
-	} catch {
-		return false;
+	} catch (error) {
+		return error.code === "EPERM";
 	}
 }
 async function staleLock(path) {
 	try {
 		const value = JSON.parse(await readFile(path, "utf8"));
-		const pid = typeof value.pid === "number" ? value.pid : 0;
-		const createdAt = typeof value.createdAt === "number" ? value.createdAt : 0;
-		return !isProcessAlive(pid) && Date.now() - createdAt > LOCK_STALE_MS;
+		return !isProcessAlive(typeof value.pid === "number" ? value.pid : 0);
 	} catch {
 		return true;
 	}
 }
-async function withInstallLock(path, metadata, fn) {
+async function withInstallLock(path, metadata, fn, signal) {
 	await mkdir(dirname(path), { recursive: true });
-	while (true) try {
-		const handle = await open(path, "wx", 384);
-		await handle.writeFile(JSON.stringify({
-			pid: process.pid,
-			createdAt: Date.now(),
-			...metadata
-		}));
-		await handle.close();
-		break;
-	} catch (error) {
-		if (error.code !== "EEXIST") throw error;
-		if (await staleLock(path)) {
-			await unlink(path).catch(() => void 0);
-			continue;
+	const waitStartedAt = Date.now();
+	while (true) {
+		if (signal?.aborted) throw signal.reason ?? /* @__PURE__ */ new Error("Runtime installation was aborted");
+		try {
+			const handle = await open(path, "wx", 384);
+			await handle.writeFile(JSON.stringify({
+				pid: process.pid,
+				createdAt: Date.now(),
+				...metadata
+			}));
+			await handle.close();
+			break;
+		} catch (error) {
+			if (error.code !== "EEXIST") throw error;
+			if (await staleLock(path)) {
+				await unlink(path).catch(() => void 0);
+				continue;
+			}
+			if (Date.now() - waitStartedAt > LOCK_STALE_MS) throw new Error(`Timed out waiting for runtime installation lock: ${path}`);
+			await new Promise((resolve, reject) => {
+				const timeout = setTimeout(() => {
+					signal?.removeEventListener("abort", abort);
+					resolve();
+				}, LOCK_WAIT_MS);
+				const abort = () => {
+					clearTimeout(timeout);
+					reject(signal?.reason ?? /* @__PURE__ */ new Error("Runtime installation was aborted"));
+				};
+				signal?.addEventListener("abort", abort, { once: true });
+			});
 		}
-		await new Promise((resolve) => setTimeout(resolve, LOCK_WAIT_MS));
 	}
 	try {
 		return await fn();

package/dist/src/runtime-tools/manager.d.ts CHANGED Viewed

@@ -15,6 +15,6 @@ export declare class ManagedRuntimeManager extends EventEmitter {
     private uvEnvironment;
     status(runtime: RuntimeKind): Promise<RuntimeStatus>;
     statusAll(): Promise<RuntimeStatus[]>;
-    repair(runtime: RuntimeKind): Promise<ResolvedRuntime>;
+    repair(runtime: RuntimeKind, requestedVersion?: string): Promise<ResolvedRuntime>;
     private progress;
 }