agentwheel 0.19.5 → 0.19.6

package/dist/index.js

@@ -6259,9 +6259,9 @@ function cachePathFor(packageName, cacheRoot) {
 
 // src/source/git.ts
 import { execFile as execFile4 } from "child_process";
-import { cp as cp2, mkdir as mkdir14, rename as rename3, rm as rm7 } from "fs/promises";
+import { mkdir as mkdir14, rename as rename3, rm as rm7, stat as stat5 } from "fs/promises";
 import { homedir as homedir3 } from "os";
-import { basename as basename11, dirname as dirname17, join as join24, resolve as resolve7 } from "path";
+import { basename as basename11, dirname as dirname17, join as join24, resolve as resolve7, sep } from "path";
 import { promisify as promisify4 } from "util";
 
 // src/source/auth.ts
@@ -6558,13 +6558,17 @@ var GitSourceDriver = class {
   async fetch(resolved) {
     return withFilesystemLock(`${resolved.resolvedPath}.lock`, resolved.cacheLockTimeoutMs ?? 3e4, async () => {
       const parsed = parseGitSource(resolved.source);
-      await mkdir14(resolve7(resolved.resolvedPath, ".."), { recursive: true });
+      const cacheRoot = dirname17(resolved.resolvedPath);
+      await mkdir14(cacheRoot, { recursive: true });
+      await assertOwnedByCurrentUser(cacheRoot);
+      if (await pathExists(resolved.resolvedPath)) await assertOwnedByCurrentUser(resolved.resolvedPath);
       if (!await pathExists(join24(resolved.resolvedPath, ".git"))) {
         if (resolved.frozenLock) {
           throw new Error(`Frozen lock requires cached git checkout at ${resolved.resolvedPath}`);
         }
         await rm7(resolved.resolvedPath, { recursive: true, force: true });
-        await git([...await gitAuthArguments(parsed.url), "clone", parsed.url, resolved.resolvedPath]);
+        await git([...await gitAuthArguments(parsed.url), "clone", "--no-checkout", parsed.url, resolved.resolvedPath]);
+        await assertOwnedByCurrentUser(resolved.resolvedPath);
       } else if (!resolved.frozenLock) {
         await git([
           ...await gitAuthArguments(parsed.url),
@@ -6577,27 +6581,12 @@ var GitSourceDriver = class {
         ]);
       }
       const ref = resolved.requestedRef ?? parsed.ref ?? "HEAD";
-      if (ref === "HEAD") {
-        await git(["-C", resolved.resolvedPath, "checkout", "--detach", "origin/HEAD"]);
-      } else if (/^[0-9a-f]{7,40}$/i.test(ref)) {
-        await git(["-C", resolved.resolvedPath, "checkout", "--detach", ref]);
-      } else {
-        try {
-          await git(["-C", resolved.resolvedPath, "checkout", ref]);
-          await git(["-C", resolved.resolvedPath, "reset", "--hard", `origin/${ref}`]);
-        } catch {
-          await git(["-C", resolved.resolvedPath, "checkout", "--detach", ref]);
-        }
-      }
-      await removeGeneratedEntries(resolved.resolvedPath, true);
-      const { stdout } = await git(["-C", resolved.resolvedPath, "rev-parse", "HEAD"]);
-      const resolvedCommit = stdout.trim();
-      const cacheRoot = dirname17(resolved.resolvedPath);
+      const resolvedCommit = await resolveCommit(resolved.resolvedPath, ref);
       const snapshot = await withGitCacheMaintenanceLock(
         cacheRoot,
         resolved.cacheLockTimeoutMs ?? 3e4,
         async () => {
-          const path = await snapshotCheckout(resolved.resolvedPath, resolvedCommit);
+          const path = await snapshotCommit(resolved.resolvedPath, resolvedCommit);
           const leasePath = await createGitSnapshotLease(path);
           await pruneGitCache(cacheRoot, {
             currentSnapshot: path,
@@ -6654,20 +6643,41 @@ function cachePathFor2(url, cacheRoot) {
   const slug2 = url.replace(/^[a-z]+:\/\//i, "").replace(/\.git$/i, "").replace(/[^a-z0-9._-]+/gi, "-").replace(/^-+|-+$/g, "");
   return join24(root, slug2 || basename11(url));
 }
-async function git(args) {
-  return execFileAsync4("git", args, { maxBuffer: 1024 * 1024 * 10 });
+async function git(args, env2) {
+  return execFileAsync4("git", args, { env: env2, maxBuffer: 1024 * 1024 * 10 });
 }
-async function snapshotCheckout(checkoutPath, commit) {
+async function resolveCommit(checkoutPath, ref) {
+  const candidates = ref === "HEAD" ? ["origin/HEAD"] : /^[0-9a-f]{7,40}$/i.test(ref) ? [ref] : [`origin/${ref}`, ref];
+  let lastError;
+  for (const candidate of candidates) {
+    try {
+      const { stdout } = await git(["-C", checkoutPath, "rev-parse", "--verify", `${candidate}^{commit}`]);
+      return stdout.trim();
+    } catch (error) {
+      lastError = error;
+    }
+  }
+  throw lastError;
+}
+async function snapshotCommit(checkoutPath, commit) {
   const snapshotPath = join24(dirname17(checkoutPath), `${basename11(checkoutPath)}-${commit.slice(0, 12)}`);
   if (await pathExists(snapshotPath)) return snapshotPath;
   const tempPath = join24(dirname17(checkoutPath), `${basename11(snapshotPath)}.tmp-${process.pid}-${Date.now()}`);
+  const tempIndexPath = `${tempPath}.index`;
   await rm7(tempPath, { recursive: true, force: true });
-  await cp2(checkoutPath, tempPath, {
-    recursive: true,
-    dereference: true,
-    filter: (path) => !isIgnoredGeneratedEntry(basename11(path))
-  });
-  await rm7(join24(tempPath, ".git"), { recursive: true, force: true });
+  await rm7(tempIndexPath, { force: true });
+  await mkdir14(tempPath, { recursive: true });
+  const env2 = { ...process.env, GIT_INDEX_FILE: tempIndexPath };
+  try {
+    await git(["-C", checkoutPath, "read-tree", commit], env2);
+    await git(["-C", checkoutPath, "checkout-index", "--all", `--prefix=${resolve7(tempPath)}${sep}`], env2);
+    await removeGeneratedEntries(tempPath, false);
+  } catch (error) {
+    await rm7(tempPath, { recursive: true, force: true });
+    throw error;
+  } finally {
+    await rm7(tempIndexPath, { force: true });
+  }
   try {
     await rename3(tempPath, snapshotPath);
   } catch (error) {
@@ -6677,6 +6687,16 @@ async function snapshotCheckout(checkoutPath, commit) {
   }
   return snapshotPath;
 }
+async function assertOwnedByCurrentUser(path) {
+  const currentUid = process.getuid?.();
+  if (currentUid === void 0) return;
+  const ownerUid = (await stat5(path)).uid;
+  if (ownerUid !== currentUid) {
+    throw new Error(
+      `Git cache path ${path} is owned by uid ${ownerUid}, but Agentwheel is running as uid ${currentUid}. Run Agentwheel as the cache owner or use a separate cache root.`
+    );
+  }
+}
 
 // src/source/mcp-registry.ts
 import { mkdir as mkdir15, writeFile as writeFile16 } from "fs/promises";
@@ -6817,14 +6837,14 @@ function cachePathFor3(serverName, cacheRoot) {
 // src/source/skillkit.ts
 import { createHash as createHash6, randomUUID as randomUUID2 } from "crypto";
 import { execFile as execFile5 } from "child_process";
-import { cp as cp3, mkdir as mkdir16, readFile as readFile20, rename as rename4, rm as rm8 } from "fs/promises";
+import { cp as cp2, mkdir as mkdir16, readFile as readFile20, rename as rename4, rm as rm8 } from "fs/promises";
 import { homedir as homedir4 } from "os";
 import { basename as basename14, dirname as dirname20, join as join27, resolve as resolve9 } from "path";
 import { promisify as promisify5 } from "util";
 import * as defaultSkillKit from "@skillkit/core";
 
 // src/source/skill-artifacts.ts
-import { readdir as readdir4, stat as stat5 } from "fs/promises";
+import { readdir as readdir4, stat as stat6 } from "fs/promises";
 import { basename as basename13, dirname as dirname19, extname as extname2, join as join26 } from "path";
 async function artifactsFromSkillPaths(paths, packageName) {
   const artifacts = [];
@@ -6845,7 +6865,7 @@ async function discoverSkillPaths(root) {
   return paths;
 }
 async function artifactFromSkillPath(item, packageName) {
-  const stats = await stat5(item.path);
+  const stats = await stat6(item.path);
   if (stats.isDirectory()) {
     const skillMd = join26(item.path, "SKILL.md");
     if (!await pathExists(skillMd)) return void 0;
@@ -7022,7 +7042,7 @@ var SkillKitSourceDriver = class {
           return { path: cachePath, commit: resolvedIdentity.commit, cacheIdentity: resolvedIdentity.cacheKey };
         }
         const publishCandidate = resolve9(result.path) === resolve9(candidatePath) ? candidatePath : publishPath;
-        if (publishCandidate === publishPath) await cp3(result.path, publishPath, { recursive: true, dereference: true });
+        if (publishCandidate === publishPath) await cp2(result.path, publishPath, { recursive: true, dereference: true });
         try {
           await rename4(publishCandidate, cachePath);
         } catch (error) {
@@ -7149,7 +7169,7 @@ async function checkoutCommit(root, commit) {
 }
 
 // src/source/vercel-skills.ts
-import { stat as stat6 } from "fs/promises";
+import { stat as stat7 } from "fs/promises";
 import { basename as basename15, join as join28, relative as relative5, resolve as resolve10 } from "path";
 var VercelSkillsSourceDriver = class {
   name = "vercel-skills";
@@ -7158,7 +7178,7 @@ var VercelSkillsSourceDriver = class {
     const parsed = parseVercelSource(source);
     if (parsed.kind === "local") {
       const resolvedPath = resolve10(parsed.path);
-      if (!await pathExists(resolvedPath) || !(await stat6(resolvedPath)).isDirectory()) {
+      if (!await pathExists(resolvedPath) || !(await stat7(resolvedPath)).isDirectory()) {
         throw new Error(`Vercel skills local source not found: ${resolvedPath}`);
       }
       return {
@@ -7283,14 +7303,14 @@ function getSourceDriver(name = "local") {
 }
 
 // src/staging/staging.ts
-import { chmod, cp as cp5, mkdir as mkdir19, mkdtemp as mkdtemp3, readdir as readdir7, stat as stat9 } from "fs/promises";
-import { basename as basename19, dirname as dirname24, join as join32, relative as relative7, resolve as resolve12, sep as sep2 } from "path";
+import { chmod, cp as cp4, mkdir as mkdir19, mkdtemp as mkdtemp3, readdir as readdir7, stat as stat10 } from "fs/promises";
+import { basename as basename19, dirname as dirname24, join as join32, relative as relative7, resolve as resolve12, sep as sep3 } from "path";
 import { tmpdir as tmpdir4 } from "os";
 
 // src/compose/markdown.ts
 import { createHash as createHash7 } from "crypto";
-import { readdir as readdir5, readFile as readFile21, stat as stat7, writeFile as writeFile17 } from "fs/promises";
-import { basename as basename16, dirname as dirname21, extname as extname3, join as join29, relative as relative6, resolve as resolve11, sep } from "path";
+import { readdir as readdir5, readFile as readFile21, stat as stat8, writeFile as writeFile17 } from "fs/promises";
+import { basename as basename16, dirname as dirname21, extname as extname3, join as join29, relative as relative6, resolve as resolve11, sep as sep2 } from "path";
 var includePattern = /<!--\s*openpack:include(\?)?\s+([^>]+?)\s*-->/g;
 var escapedIncludePattern = /<!--\s*openpack\\:include(\?)?\s+([^>]+?)\s*-->/g;
 var generatedPattern = /<!--\s*(?:BEGIN|END)\s+openpack:include\b/;
@@ -7427,7 +7447,7 @@ async function expandInclude(selector, packageRoot, artifactPaths, options) {
     if (options.optional) return void 0;
     throw new Error(`OpenPack include not found: ${displaySelector}`);
   }
-  const stats = await stat7(sourcePath);
+  const stats = await stat8(sourcePath);
   if (!stats.isFile()) {
     throw new Error(`OpenPack include is not a file: ${displaySelector}`);
   }
@@ -7491,14 +7511,14 @@ function extractOpenPackIncludeSelectors(content) {
 function resolvePackageSelector(packageRoot, selector) {
   const root = resolve11(packageRoot);
   const resolved = resolve11(root, selector);
-  if (resolved !== root && !resolved.startsWith(`${root}${sep}`)) {
+  if (resolved !== root && !resolved.startsWith(`${root}${sep2}`)) {
     throw new Error(`OpenPack include escapes package root: ${selector}`);
   }
   return resolved;
 }
 async function markdownFilesForArtifact(artifact) {
   const root = artifact.stagedPath ?? artifact.sourcePath;
-  const stats = await stat7(root);
+  const stats = await stat8(root);
   if (stats.isFile()) return extname3(root).toLowerCase() === ".md" ? [root] : [];
   if (!stats.isDirectory()) return [];
   return listMarkdownFiles(root);
@@ -7571,7 +7591,7 @@ function artifactPathMap(artifacts) {
 }
 
 // src/staging/customize.ts
-import { cp as cp4, mkdir as mkdir17, readdir as readdir6, readFile as readFile22, writeFile as writeFile18 } from "fs/promises";
+import { cp as cp3, mkdir as mkdir17, readdir as readdir6, readFile as readFile22, writeFile as writeFile18 } from "fs/promises";
 import { dirname as dirname22, join as join30 } from "path";
 async function applyCustomizations(artifacts, options) {
   let next = [...artifacts];
@@ -7670,7 +7690,7 @@ async function applyReplacements2(artifacts, options, channel, artifactTypes) {
         const existing = byKey.get(artifactMapKey);
         const stagedPath = join30(options.stageRoot, ".agentwheel-composed", channel, type, entry.name);
         await mkdir17(dirname22(stagedPath), { recursive: true });
-        await cp4(full, stagedPath, { recursive: artifactKind === "dir", dereference: true });
+        await cp3(full, stagedPath, { recursive: artifactKind === "dir", dereference: true });
         byKey.set(artifactMapKey, {
           ...existing,
           type,
@@ -7786,7 +7806,7 @@ async function stageResolvedArtifactsRaw(resolved, artifacts) {
   for (const artifact of artifacts) {
     const stagedPath = join32(root, artifact.relativePath);
     await mkdir19(dirname24(stagedPath), { recursive: true });
-    await cp5(artifact.sourcePath, stagedPath, {
+    await cp4(artifact.sourcePath, stagedPath, {
       recursive: artifact.kind === "dir",
       dereference: true,
       filter: (path) => !isIgnoredGeneratedEntry(basename19(path))
@@ -7878,7 +7898,7 @@ async function composeAssets(artifact, packageRoot, stagedPath) {
   }
 }
 async function copyAsset(asset, source, dest) {
-  const sourceStats = await stat9(source);
+  const sourceStats = await stat10(source);
   if (sourceStats.isFile()) {
     if (matchesAny(basename19(source), asset.include)) {
       await mkdir19(dest, { recursive: true });
@@ -7891,7 +7911,7 @@ async function copyAsset(asset, source, dest) {
   }
   if (!asset.include?.length) {
     await mkdir19(dirname24(dest), { recursive: true });
-    await cp5(source, dest, { recursive: true, dereference: true });
+    await cp4(source, dest, { recursive: true, dereference: true });
     if (asset.mode === "copy") await normalizeCopiedModes(dest);
     return;
   }
@@ -7903,13 +7923,13 @@ async function copyAsset(asset, source, dest) {
 }
 async function copyAssetFile(source, dest, asset) {
   await mkdir19(dirname24(dest), { recursive: true });
-  await cp5(source, dest, { dereference: true });
+  await cp4(source, dest, { dereference: true });
   if (asset.mode === "copy") await chmod(dest, 420);
 }
 function resolvePackagePath(packageRoot, path) {
   const resolved = resolve12(packageRoot, path);
   const root = resolve12(packageRoot);
-  if (resolved !== root && !resolved.startsWith(`${root}${sep2}`)) {
+  if (resolved !== root && !resolved.startsWith(`${root}${sep3}`)) {
     throw new Error(`Asset include escapes package root: ${path}`);
   }
   return resolved;
@@ -7930,7 +7950,7 @@ async function listFiles2(root) {
   return out;
 }
 async function normalizeCopiedModes(path) {
-  const stats = await stat9(path);
+  const stats = await stat10(path);
   if (stats.isFile()) {
     await chmod(path, 420);
     return;
@@ -8335,12 +8355,12 @@ function sortedUnique2(values) {
 }
 
 // src/lifecycle/customization.ts
-import { appendFile, cp as cp6, mkdir as mkdir20, rm as rm10 } from "fs/promises";
+import { appendFile, cp as cp5, mkdir as mkdir20, rm as rm10 } from "fs/promises";
 import { dirname as dirname27, join as join36 } from "path";
 
 // src/resolve/graph.ts
 import { createHash as createHash9 } from "crypto";
-import { mkdtemp as mkdtemp4, readdir as readdir8, readFile as readFile27, stat as stat11 } from "fs/promises";
+import { mkdtemp as mkdtemp4, readdir as readdir8, readFile as readFile27, stat as stat12 } from "fs/promises";
 import { tmpdir as tmpdir5 } from "os";
 import { basename as basename20, extname as extname4, join as join35 } from "path";
 
@@ -8467,7 +8487,7 @@ import { homedir as homedir7 } from "os";
 import { resolve as resolve15 } from "path";
 
 // src/registry/client.ts
-import { readFile as readFile26, rm as rm9, stat as stat10 } from "fs/promises";
+import { readFile as readFile26, rm as rm9, stat as stat11 } from "fs/promises";
 import { homedir as homedir6 } from "os";
 import { dirname as dirname26, join as join34, resolve as resolve14 } from "path";
 import { fileURLToPath } from "url";
@@ -8584,7 +8604,7 @@ var RegistryClient = class {
     const filePath = source.startsWith("file:") ? fileURLToPath(source) : source;
     if (await pathExists(filePath)) {
       const fullPath = resolve14(filePath);
-      const stats = await stat10(fullPath);
+      const stats = await stat11(fullPath);
       return readFile26(stats.isDirectory() ? join34(fullPath, "index.json") : fullPath, "utf8");
     }
     const resolved = await this.git.fetch(await this.git.resolve(source, { cacheRoot: join34(dirname26(this.cachePath), "registry-repos") }));
@@ -9346,7 +9366,7 @@ function requirementTargetsRuntime(runtimes, runtime, label, warn) {
 }
 async function markdownFilesForArtifact2(artifact) {
   const root = artifact.sourcePath;
-  const stats = await stat11(root);
+  const stats = await stat12(root);
   if (stats.isFile()) return extname4(root).toLowerCase() === ".md" ? [root] : [];
   if (!stats.isDirectory()) return [];
   return listMarkdownFiles2(root);
@@ -9639,7 +9659,7 @@ async function ejectArtifact(workspaceRoot, item) {
     const ejectedPath = join36(workspaceRoot, ".agentwheel", "ejected", ...ejectedIdentity.split("/"), parsed.type, parsed.name);
     await mkdir20(dirname27(ejectedPath), { recursive: true });
     await rm10(ejectedPath, { recursive: true, force: true });
-    await cp6(artifact.stagedPath ?? artifact.sourcePath, ejectedPath, { recursive: artifact.kind === "dir", dereference: true });
+    await cp5(artifact.stagedPath ?? artifact.sourcePath, ejectedPath, { recursive: artifact.kind === "dir", dereference: true });
     return {
       ...parsed,
       packageName: candidate.packageName,
@@ -11473,7 +11493,7 @@ function normalizeVersion(version) {
 }
 
 // src/model/package-validate.ts
-import { stat as stat12 } from "fs/promises";
+import { stat as stat13 } from "fs/promises";
 import { resolve as resolve19 } from "path";
 async function validatePackage(root) {
   const packageRoot = resolve19(root);
@@ -11582,7 +11602,7 @@ async function validateManifestComposeInclude(packageRoot, selector, optional, f
       findings.push({ level: "error", message: `Compose include escapes package root: ${selector}`, path: manifestPath });
       return;
     }
-    if (!optional) await stat12(full);
+    if (!optional) await stat13(full);
   } catch (error) {
     if (!optional) {
       findings.push({ level: "error", message: error instanceof Error ? error.message : String(error), path: manifestPath });
@@ -13262,7 +13282,7 @@ function ensureTrailingSlash(value) {
 
 // src/trial/skill.ts
 import { createHash as createHash14 } from "crypto";
-import { readFile as readFile35, stat as stat13 } from "fs/promises";
+import { readFile as readFile35, stat as stat14 } from "fs/promises";
 import { join as join49 } from "path";
 import { parse as parseYaml2 } from "yaml";
 var MAX_TRIAL_SKILL_BYTES = 512 * 1024;
@@ -13276,7 +13296,7 @@ async function createSkillTrial(driver, resolved, selectors) {
   }
   const artifact = skills[0];
   const path = artifact.kind === "dir" ? join49(artifact.sourcePath, "SKILL.md") : artifact.sourcePath;
-  const info = await stat13(path);
+  const info = await stat14(path);
   if (info.size > MAX_TRIAL_SKILL_BYTES) {
     throw new Error(`Skill trial exceeds the ${MAX_TRIAL_SKILL_BYTES / 1024} KiB content limit.`);
   }

package/openpack.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 2,
   "name": "NestDevLab/agentwheel",
-  "version": "0.19.5",
+  "version": "0.19.6",
   "provides": [
     { "type": "skills", "path": "skills" }
   ]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentwheel",
-  "version": "0.19.5",
+  "version": "0.19.6",
   "description": "Weave skills, rules, and instructions across every AI agent.",
   "type": "module",
   "license": "MIT",

package/skills/agentwheel/SKILL.md

@@ -5,7 +5,7 @@ allowed-tools: [Bash]
 license: MIT
 metadata:
   author: NestDevLab
-  version: "0.19.5"
+  version: "0.19.6"
 ---
 
 # agentwheel

package/skills/agentwheel-discovery/SKILL.md

@@ -5,7 +5,7 @@ allowed-tools: [Bash]
 license: MIT
 metadata:
   author: NestDevLab
-  version: "0.19.5"
+  version: "0.19.6"
 ---
 
 # Agentwheel Discovery