@yanlinglabs/winter-agent-runtime 0.0.41 → 0.0.44

package/dist/web/preapproved-hosts.d.ts

@@ -1,15 +1,6 @@
-/**
- * The 92 literals exactly as they appear in `c7t`'s source order (duplicate `learn.microsoft.com`
- * included) -- kept verbatim so a future re-extraction diffs cleanly against this array.
- */
+/** The 92 entries, duplicate `learn.microsoft.com` included. */
 export declare const PREAPPROVED_HOST_ENTRIES: readonly string[];
-/**
- * `wX(hostname, pathname)`, verbatim: an EXACT hostname match (no subdomains) against the
- * hostname-only half, OR a hostname with a registered path prefix whose pathname is that prefix or a
- * `/`-bounded child of it -- rejected outright when the raw pathname contains an encoded slash,
- * backslash or dot (`%2f`, `%5c`, `%2e`, doubly-encoded or not), which is exactly the traversal class
- * that would otherwise let `/docs%2f..%2fadmin` read as a legitimate child of `/docs`.
- */
+/** Whether `hostname` + `pathname` (raw strings) fall under a preapproved entry. */
 export declare function isPreapprovedHost(hostname: string, pathname: string): boolean;
 /** `isPreapprovedHost`, taking the URL directly. A URL that fails to parse is never preapproved. */
 export declare function isPreapprovedUrl(url: URL): boolean;
@@ -24,29 +15,16 @@ export interface PreapprovedMatch {
     pathPrefix?: string;
 }
 /**
- * Security review round 2, minor: this was EXACT-hostname-only, while `staysWithinScope` (below)
- * already applied the three-way `[host, stripped, "www."+stripped]` match -- half of one fix. The
- * gap is not cosmetic: a redirect chain `claude.com/docs/a` -> `www.claude.com/docs/a` (eligible,
- * `staysWithinScope` says so) -> `www.claude.com/other` recomputes THIS function fresh at the top of
- * the SECOND hop, on hostname `www.claude.com` -- which `PATH_PREFIXES` only ever keys by
- * `claude.com`, so the old exact match returned `undefined` for it. An `undefined` scope makes
- * `isEligibleAutoFollow`'s own `scope !== undefined && ...` check SHORT-CIRCUIT to "no restriction
- * at all," so the THIRD hop (genuinely outside `/docs`) was auto-followed, not refused -- and because
- * `claude.com/docs/a` (the ORIGINAL input URL) is still preapproved, that off-scope content got
- * permissive guidelines and was eligible for the verbatim markdown passthrough. Matching hosts the
- * same three-way way `staysWithinScope` does closes it: hop 2 now still resolves a scope (matched via
- * the `claude.com` entry), and `staysWithinScope` correctly refuses hop 3's `/other` path.
+ * The preapproved scope `url` falls under, matching its host, that host without a leading `www.`,
+ * and that stripped form with `www.` re-added (security review round 2: an exact-host-only match let
+ * a redirect chain `claude.com/docs/a` -> `www.claude.com/docs/a` -> `www.claude.com/other` lose its
+ * scope at the second hop, so the third, off-scope hop was auto-followed).
  */
 export declare function preapprovedScopeOf(url: URL): PreapprovedMatch | undefined;
 /**
  * Whether `url` still falls under the SAME preapproved scope `from` matched -- used by the redirect
- * walk's "not leaving a preapproved path scope" gate.
- *
- * HOST comparison is the same three-way test claude's own code runs (security review corrections
- * §4.8, measured): `[host, stripped, "www."+stripped]`, i.e. the scope's own host, that host with a
- * leading `www.` stripped, and that stripped form with `www.` re-added -- so a scope matched on
- * `claude.com/docs` still covers a redirect to `www.claude.com/docs/x`, and one matched on
- * `www.example.com/docs` still covers a redirect to `example.com/docs/x`. An EXACT match only (this
- * lane's earlier version) refused a same-site www-variant redirect claude itself follows.
+ * walk's "not leaving a preapproved path scope" gate. The host may be the scope's own host, that host
+ * without a leading `www.`, or that with `www.` re-added (claude follows a same-site www-variant
+ * redirect -- security review corrections §4.8).
  */
 export declare function staysWithinScope(from: PreapprovedMatch, url: URL): boolean;

package/dist/workflows/store.d.ts

@@ -86,42 +86,37 @@ export interface WorkflowListingEntry {
     source: "project" | "user" | "plugin";
     /** The script's real filesystem path -- carried through so a caller building a `SkillMeta`-shaped synthetic entry (production-wiring.ts) never has to invent one. */
     path: string;
-    /** Fix round 4 (I-E): carried through for a synthetic skill/command prompt's own structure -- claude's own `m()` includes both alongside name/description. */
+    /** Fix round 4 (I-E): carried through for a synthetic skill/command prompt's own structure -- claude's workflow command carries both alongside name/description. */
     whenToUse?: string;
     phases?: WorkflowMetaPhase[];
 }
 /**
- * SV-5 (batch-2, second round, extended in fix round 3) -- the router same-view test: the pinned
- * binary lists EVERY discovered workflow (user + project + plugin; built-in excluded, the pinned
- * binary's own `d()`/`Ru()` gate that separately and Winter ships none -- see `BUILTIN_WORKFLOWS`)
- * in the init `skills`/`slash_commands` fields and the model-facing Skill listing, named
- * `<plugin>:<meta.name>` for a plugin workflow or bare `<meta.name>` for a user/project one --
- * `getWorkflowCommands` in the pinned binary's own workflow-discovery module maps its FULL discovery
- * result through a `{type:"prompt", name: o.name, description: o.description, ...}` projection,
- * `o.name` already being the qualified/bare identity discovery assigned. `production-wiring.ts` is
- * the one caller, folding this into all three listing surfaces.
+ * SV-5 (batch-2, second round, extended in fix round 3) -- the router same-view test: claude lists
+ * EVERY discovered workflow (user + project + plugin; built-ins are handled separately, and Winter
+ * ships none -- see `BUILTIN_WORKFLOWS`) in the init `skills`/`slash_commands` fields and the
+ * model-facing Skill listing, as a prompt-type command named `<plugin>:<meta.name>` for a plugin
+ * workflow or bare `<meta.name>` for a user/project one, with the workflow's description.
+ * `production-wiring.ts` is the one caller, folding this into all three listing surfaces.
  *
- * ORDER matches claude's own final merge in `j()`/`QX()`: plugin entries first (builtins would lead,
- * but Winter has none to list), then user+project merged and name-sorted -- a project entry
- * overriding a user entry of the same name the same way resolution above does, so listing and
- * resolution can never disagree about which tier's copy is "the" workflow of that name.
+ * ORDER matches claude's listing: plugin entries first (builtins would lead, but Winter has none to
+ * list), then user+project merged and name-sorted -- a project entry overriding a user entry of the
+ * same name the same way resolution above does, so listing and resolution can never disagree about
+ * which tier's copy is "the" workflow of that name.
  */
 export declare function listWorkflowsForListing(opts: WorkflowDiscoveryOptions): WorkflowListingEntry[];
 /**
- * Fix round 4 (I-E, the router same-view test): claude's own `m()` (dump-confirmed) turns every
- * discovered workflow into a `{type:"prompt", kind:"workflow", ...}` command whose PROMPT runs the
- * named workflow and carries the description, `whenToUse` and phases, ending with an instruction to
- * invoke the Workflow tool by name. `SkillMeta` has no dedicated "workflow" shape, so this builds the
+ * Fix round 4 (I-E, the router same-view test): claude offers every discovered workflow as a
+ * prompt-type command whose PROMPT runs the named workflow and carries the description, `whenToUse`
+ * and phases, ending with an instruction to invoke the Workflow tool by name. `SkillMeta` has no dedicated "workflow" shape, so this builds the
  * BODY TEXT `SkillIndex`'s own synthetic-entry seam (`SkillIndexOptions.syntheticSkills`) stores for
  * `Skill("<name>")` to return -- the WS-11 §2.3 contract ("invocation inserts the resolved skill
  * instructions into the main conversation") applied to a workflow instead of a SKILL.md body.
  *
  * THE PROMPT TEXT IS WINTER-AUTHORED, per the user's own ruling that prompts stay Winter's own
  * wording while INTERFACE strings (a field name, a listing label, an error message) may ship
- * verbatim from the pinned binary -- this is prompt content the model reads and acts on, not an
- * interface string, so it is worded fresh here rather than reproduced from the dump. The
- * STRUCTURE claude's own `m()` carries (name, description, `whenToUse`, phases, then the invoke
- * instruction) is preserved; the wording is not claude's.
+ * verbatim -- this is prompt content the model reads and acts on, not an interface string, so it is
+ * worded fresh here. The prompt carries name, description, `whenToUse`, phases, then the invoke
+ * instruction; the wording is Winter's own.
  *
  * Fix round 5 (promoted minor, the re-review of 57e7fef..20b623e): `/plugin:name some args` must
  * carry `some args` into the invoke line as `Workflow({ name, args })`, matching claude. This
@@ -136,15 +131,12 @@ export declare function listWorkflowsForListing(opts: WorkflowDiscoveryOptions):
  * a bare `/name` with nothing after it, where the tokens substitute to `""`/`'""'`) recognises it
  * does not apply and falls back to the first, unconditional line instead.
  *
- * Fix round 6 (a promoted minor, the re-review against the pinned 2.1.250 dump): the args value must
- * be ESCAPED the way claude's own `S(e)` does, matching `createWorkflowCommand`'s
- * `getPromptForCommand` (dump-confirmed: `a=e?\`{ name: ${i}, args: ${S(e)} }\`:...\`, i=S(o.name)`
- * -- inferred to be JSON-string-quoting from the call-site shape: applied to a plain, always-defined
- * string, used with no additional quotes around it). Using the RAW `$ARGUMENTS` token inside
- * hand-written quotes (round 5's own shape) would let a literal `"` or `\` in the typed args break
- * out of the quoted literal. `$ARGUMENTS_JSON` (`commands/resolver.ts`'s new second token) substitutes
- * with `JSON.stringify(args)` instead -- already quoted and escaped -- so this line writes NO quotes
- * of its own around it.
+ * Fix round 6 (a promoted minor): the args value must arrive as a JSON string literal (quoted,
+ * with `"` and `\` escaped), as claude passes a workflow command's args. Using the RAW `$ARGUMENTS`
+ * token inside hand-written quotes (round 5's own shape) would let a literal `"` or `\` in the typed
+ * args break out of the quoted literal. `$ARGUMENTS_JSON` (`commands/resolver.ts`'s new second
+ * token) substitutes with `JSON.stringify(args)` instead -- already quoted and escaped -- so this
+ * line writes NO quotes of its own around it.
  */
 export declare function buildWorkflowSkillPrompt(entry: WorkflowListingEntry): string;
 export interface SessionScriptLocation {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yanlinglabs/winter-agent-runtime",
-  "version": "0.0.41",
+  "version": "0.0.44",
   "license": "MIT",
   "type": "module",
   "engines": {
@@ -73,9 +73,9 @@
     "@modelcontextprotocol/client": "^2.1.0",
     "ajv": "^8.20.0",
     "ignore": "7.0.5",
-    "@yanlinglabs/winter-agent-sdk": "0.0.41",
-    "@yanlinglabs/winter-provider-catalog": "0.0.41",
-    "@yanlinglabs/winter-provider-runtime": "0.0.41"
+    "@yanlinglabs/winter-agent-sdk": "0.0.44",
+    "@yanlinglabs/winter-provider-catalog": "0.0.44",
+    "@yanlinglabs/winter-provider-runtime": "0.0.44"
   },
   "devDependencies": {
     "@modelcontextprotocol/server": "^2.1.0"