antpath 0.4.1 → 0.4.2

package/dist/_shared/blueprint.js

@@ -291,6 +291,13 @@ export function parseMcpServerRef(input, path) {
         if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
             throw new Error(`${path}.url must use http or https (got ${parsed.protocol})`);
         }
+        // Auth belongs in `secrets.mcpServers[i].headers`, never in the URL
+        // itself. A `https://user:pass@host` style URL would be persisted in
+        // the non-secret run snapshot and hashed into the idempotency key —
+        // both unacceptable for credential material.
+        if (parsed.username !== "" || parsed.password !== "") {
+            throw new Error(`${path}.url must not contain userinfo (username/password); use secrets.mcpServers[].headers for auth`);
+        }
     }
     catch (cause) {
         if (cause instanceof Error && cause.message.startsWith(path)) {

package/dist/_shared/submission.js

@@ -793,7 +793,25 @@ function parseFlatSkills(input) {
     if (!Array.isArray(input)) {
         throw new Error("submission.skills must be an array of SkillRef objects");
     }
-    return input.map((item, index) => parseSkillRef(item, `submission.skills[${index}]`));
+    const seenWorkspace = new Set();
+    const seenProvider = new Set();
+    return input.map((item, index) => {
+        const ref = parseSkillRef(item, `submission.skills[${index}]`);
+        if (ref.kind === "workspace") {
+            if (seenWorkspace.has(ref.id)) {
+                throw new Error(`submission.skills duplicate workspace skill id: ${ref.id}`);
+            }
+            seenWorkspace.add(ref.id);
+        }
+        else {
+            const key = `${ref.vendor}:${ref.skillId}:${ref.version ?? ""}`;
+            if (seenProvider.has(key)) {
+                throw new Error(`submission.skills duplicate provider skill: ${ref.vendor}:${ref.skillId}${ref.version ? `:${ref.version}` : ""}`);
+            }
+            seenProvider.add(key);
+        }
+        return ref;
+    });
 }
 function parseFlatMcpServers(input) {
     if (input === undefined) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "antpath",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "TypeScript SDK for running autonomous Claude Managed Agents sessions.",
   "repository": {
     "type": "git",