bopodev-agent-sdk 0.1.32 → 0.1.33

package/.turbo/turbo-build.log

@@ -1,5 +1,5 @@
 
 
-> bopodev-agent-sdk@0.1.32 build /Users/danielkrusenstrahle/Documents/Projects/Monorepo/bopohq/packages/agent-sdk
+> bopodev-agent-sdk@0.1.33 build /Users/danielkrusenstrahle/Documents/Projects/Monorepo/bopohq/packages/agent-sdk
 > tsc -p tsconfig.json --emitDeclarationOnly
 

package/.turbo/turbo-typecheck.log

@@ -1,4 +1,4 @@
 
-> bopodev-agent-sdk@0.1.30 typecheck /Users/danielkrusenstrahle/Documents/Projects/Monorepo/bopohq/packages/agent-sdk
+> bopodev-agent-sdk@0.1.32 typecheck /Users/danielkrusenstrahle/Documents/Projects/Monorepo/bopohq/packages/agent-sdk
 > tsc -p tsconfig.json --noEmit
 

package/dist/contracts/src/index.d.ts

@@ -619,6 +619,7 @@ export declare const TemplateManifestAgentSchema: z.ZodObject<{
             auto: "auto";
         }>>>;
         bootstrapPrompt: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+        enabledSkillIds: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>>;
         runtimeTimeoutSec: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
         interruptGraceSec: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
         runPolicy: z.ZodOptional<z.ZodDefault<z.ZodObject<{
@@ -748,6 +749,7 @@ export declare const TemplateManifestSchema: z.ZodObject<{
                 auto: "auto";
             }>>>;
             bootstrapPrompt: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+            enabledSkillIds: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>>;
             runtimeTimeoutSec: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
             interruptGraceSec: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
             runPolicy: z.ZodOptional<z.ZodDefault<z.ZodObject<{
@@ -910,6 +912,7 @@ export declare const TemplateSchema: z.ZodObject<{
                     auto: "auto";
                 }>>>;
                 bootstrapPrompt: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+                enabledSkillIds: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>>;
                 runtimeTimeoutSec: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
                 interruptGraceSec: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
                 runPolicy: z.ZodOptional<z.ZodDefault<z.ZodObject<{
@@ -1072,6 +1075,7 @@ export declare const TemplateCreateRequestSchema: z.ZodObject<{
                     auto: "auto";
                 }>>>;
                 bootstrapPrompt: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+                enabledSkillIds: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>>;
                 runtimeTimeoutSec: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
                 interruptGraceSec: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
                 runPolicy: z.ZodOptional<z.ZodDefault<z.ZodObject<{
@@ -1232,6 +1236,7 @@ export declare const TemplateUpdateRequestSchema: z.ZodObject<{
                     auto: "auto";
                 }>>>;
                 bootstrapPrompt: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+                enabledSkillIds: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>>;
                 runtimeTimeoutSec: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
                 interruptGraceSec: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
                 runPolicy: z.ZodOptional<z.ZodDefault<z.ZodObject<{
@@ -1443,6 +1448,7 @@ export declare const TemplateExportSchema: z.ZodObject<{
                         auto: "auto";
                     }>>>;
                     bootstrapPrompt: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+                    enabledSkillIds: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>>;
                     runtimeTimeoutSec: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
                     interruptGraceSec: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
                     runPolicy: z.ZodOptional<z.ZodDefault<z.ZodObject<{
@@ -1607,6 +1613,7 @@ export declare const TemplateImportRequestSchema: z.ZodObject<{
                             auto: "auto";
                         }>>>;
                         bootstrapPrompt: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+                        enabledSkillIds: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>>;
                         runtimeTimeoutSec: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
                         interruptGraceSec: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
                         runPolicy: z.ZodOptional<z.ZodDefault<z.ZodObject<{
@@ -1748,6 +1755,7 @@ export declare const TemplateVersionSchema: z.ZodObject<{
                     auto: "auto";
                 }>>>;
                 bootstrapPrompt: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+                enabledSkillIds: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>>;
                 runtimeTimeoutSec: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
                 interruptGraceSec: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
                 runPolicy: z.ZodOptional<z.ZodDefault<z.ZodObject<{
@@ -1892,6 +1900,8 @@ export declare const ControlPlaneRuntimeEnvSchema: z.ZodObject<{
     BOPODEV_COMPANY_WORKSPACE_ROOT: z.ZodOptional<z.ZodString>;
     BOPODEV_AGENT_HOME: z.ZodOptional<z.ZodString>;
     BOPODEV_AGENT_OPERATING_DIR: z.ZodOptional<z.ZodString>;
+    BOPODEV_MATERIALIZED_LINKED_SKILLS_ROOT: z.ZodOptional<z.ZodString>;
+    BOPODEV_ENABLED_SKILL_IDS: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type ControlPlaneRuntimeEnv = z.infer<typeof ControlPlaneRuntimeEnvSchema>;
 export declare const ExecutionOutcomeKindSchema: z.ZodEnum<{
@@ -2184,6 +2194,13 @@ export declare const RunPolicySchema: z.ZodObject<{
     allowWebSearch: z.ZodDefault<z.ZodBoolean>;
 }, z.core.$strip>;
 export type RunPolicy = z.infer<typeof RunPolicySchema>;
+/** Bundled Bopo skill folder names under `skills/`; always injected when using an explicit company allowlist. */
+export declare const BUILTIN_BOPO_SKILL_IDS: readonly string[];
+export declare function isBuiltinBopoSkillId(id: string): boolean;
+/** Removes bundled skill ids from a stored list (legacy rows may still include them). */
+export declare function companySkillAllowlistOnly(ids: string[]): string[];
+/** Builds the full injection allowlist: bundled skills plus company skill ids. `undefined` = caller should not set a filter (inject all). */
+export declare function mergeBuiltinSkillIdsForInjection(companySkillIds: string[] | undefined): string[] | undefined;
 export declare const AgentRuntimeConfigSchema: z.ZodObject<{
     runtimeCommand: z.ZodOptional<z.ZodString>;
     runtimeArgs: z.ZodDefault<z.ZodArray<z.ZodString>>;
@@ -2197,6 +2214,7 @@ export declare const AgentRuntimeConfigSchema: z.ZodObject<{
         auto: "auto";
     }>>;
     bootstrapPrompt: z.ZodOptional<z.ZodString>;
+    enabledSkillIds: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
     runtimeTimeoutSec: z.ZodDefault<z.ZodNumber>;
     interruptGraceSec: z.ZodDefault<z.ZodNumber>;
     runPolicy: z.ZodDefault<z.ZodObject<{
@@ -2434,6 +2452,7 @@ export declare const AgentCreateRequestSchema: z.ZodObject<{
             auto: "auto";
         }>>>;
         bootstrapPrompt: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+        enabledSkillIds: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>>;
         runtimeTimeoutSec: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
         interruptGraceSec: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
         runPolicy: z.ZodOptional<z.ZodDefault<z.ZodObject<{
@@ -2499,6 +2518,7 @@ export declare const AgentUpdateRequestSchema: z.ZodObject<{
             auto: "auto";
         }>>>;
         bootstrapPrompt: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+        enabledSkillIds: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>>;
         runtimeTimeoutSec: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
         interruptGraceSec: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
         runPolicy: z.ZodOptional<z.ZodDefault<z.ZodObject<{
@@ -2571,6 +2591,7 @@ export declare const AgentSchema: z.ZodObject<{
     runtimeTimeoutSec: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
     interruptGraceSec: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
     runPolicyJson: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    enabledSkillIds: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
     createdAt: z.ZodString;
     updatedAt: z.ZodString;
 }, z.core.$strip>;

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "bopodev-agent-sdk",
-  "version": "0.1.32",
+  "version": "0.1.33",
   "license": "MIT",
   "type": "module",
   "main": "src/index.ts",
   "types": "src/index.ts",
   "dependencies": {
-    "bopodev-contracts": "0.1.32"
+    "bopodev-contracts": "0.1.33"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json --emitDeclarationOnly",

package/src/runtime.ts

@@ -3,7 +3,11 @@ import { access, cp, lstat, mkdir, mkdtemp, readdir, rm, symlink } from "node:fs
 import { homedir, tmpdir } from "node:os";
 import { delimiter, dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { AgentFinalRunOutputSchema, type AgentFinalRunOutput } from "bopodev-contracts";
+import {
+  AgentFinalRunOutputSchema,
+  BUILTIN_BOPO_SKILL_IDS,
+  type AgentFinalRunOutput
+} from "bopodev-contracts";
 import type { AgentRuntimeConfig } from "./types";
 
 type LocalProvider = "claude_code" | "codex" | "cursor" | "opencode" | "gemini_cli";
@@ -750,6 +754,31 @@ type SkillInjectionContext = {
   cleanup: () => Promise<void>;
 };
 
+const BUILTIN_BOPO_SKILL_ID_SET = new Set<string>(BUILTIN_BOPO_SKILL_IDS);
+
+function resolveEnabledSkillIdFilter(env: NodeJS.ProcessEnv): Set<string> | null {
+  const key = "BOPODEV_ENABLED_SKILL_IDS";
+  // Missing key = legacy "all skills". Present + empty = explicit none (matches heartbeat env contract).
+  if (!Object.hasOwn(env, key)) {
+    return null;
+  }
+  const raw = String(env[key] ?? "").trim();
+  if (raw === "") {
+    return new Set<string>();
+  }
+  return new Set(raw.split(",").map((s) => s.trim()).filter(Boolean));
+}
+
+function shouldInjectSkill(skillDirName: string, filter: Set<string> | null): boolean {
+  if (filter === null) {
+    return true;
+  }
+  if (BUILTIN_BOPO_SKILL_ID_SET.has(skillDirName)) {
+    return true;
+  }
+  return filter.has(skillDirName);
+}
+
 async function prepareSkillInjection(
   provider: LocalProvider | undefined,
   env: NodeJS.ProcessEnv
@@ -758,17 +787,21 @@ async function prepareSkillInjection(
     return noSkillInjection();
   }
 
-  const skillsSource = await resolveSkillsSourceDir();
-  if (!skillsSource) {
+  const skillRoots = await resolveSkillInjectionSourceRoots(env);
+  if (skillRoots.length === 0) {
     return {
       ...noSkillInjection(),
       warning: "[bopodev] skills injection skipped: no skills directory found."
     };
   }
 
+  const skillFilter = resolveEnabledSkillIdFilter(env);
+
   if (provider === "codex") {
     try {
-      await ensureCodexSkillsInjected(skillsSource, env);
+      for (const dir of skillRoots) {
+        await ensureCodexSkillsInjected(dir, env, skillFilter);
+      }
       return noSkillInjection();
     } catch (error) {
       return {
@@ -780,7 +813,9 @@ async function prepareSkillInjection(
 
   if (provider === "cursor") {
     try {
-      await ensureSkillsInjectedAtHome(skillsSource, join(homedir(), ".cursor", "skills"));
+      for (const dir of skillRoots) {
+        await ensureSkillsInjectedAtHome(dir, join(homedir(), ".cursor", "skills"), skillFilter);
+      }
       return noSkillInjection();
     } catch (error) {
       return {
@@ -792,7 +827,9 @@ async function prepareSkillInjection(
 
   if (provider === "opencode") {
     try {
-      await ensureSkillsInjectedAtHome(skillsSource, join(homedir(), ".claude", "skills"));
+      for (const dir of skillRoots) {
+        await ensureSkillsInjectedAtHome(dir, join(homedir(), ".claude", "skills"), skillFilter);
+      }
       return noSkillInjection();
     } catch (error) {
       return {
@@ -808,7 +845,7 @@ async function prepareSkillInjection(
   }
 
   try {
-    const tempSkillsRoot = await buildClaudeSkillsAddDir(skillsSource);
+    const tempSkillsRoot = await buildClaudeSkillsAddDirFromRoots(skillRoots, skillFilter);
     return {
       additionalArgs: ["--add-dir", tempSkillsRoot],
       cleanup: async () => {
@@ -1462,7 +1499,32 @@ async function resolveSkillsSourceDir() {
   return null;
 }
 
-async function ensureCodexSkillsInjected(skillsSourceDir: string, env: NodeJS.ProcessEnv) {
+/** Company `skills/`, then per-run materialized linked skills (URL-only), then bundled — first wins per skill id. */
+async function resolveSkillInjectionSourceRoots(env: NodeJS.ProcessEnv): Promise<string[]> {
+  const roots: string[] = [];
+  const workspaceRoot = resolveControlPlaneEnvValue(env, "COMPANY_WORKSPACE_ROOT").trim();
+  if (workspaceRoot.length > 0) {
+    const companySkills = join(workspaceRoot, SKILLS_DIR_NAME);
+    if (await isDirectory(companySkills)) {
+      roots.push(companySkills);
+    }
+  }
+  const linkedRoot = resolveControlPlaneEnvValue(env, "MATERIALIZED_LINKED_SKILLS_ROOT").trim();
+  if (linkedRoot.length > 0 && (await isDirectory(linkedRoot))) {
+    roots.push(linkedRoot);
+  }
+  const bundled = await resolveSkillsSourceDir();
+  if (bundled) {
+    roots.push(bundled);
+  }
+  return roots;
+}
+
+async function ensureCodexSkillsInjected(
+  skillsSourceDir: string,
+  env: NodeJS.ProcessEnv,
+  skillFilter: Set<string> | null
+) {
   const codexHome = resolveCodexHome(env);
   const targetRoot = join(codexHome, SKILLS_DIR_NAME);
   await mkdir(targetRoot, { recursive: true });
@@ -1473,6 +1535,9 @@ async function ensureCodexSkillsInjected(skillsSourceDir: string, env: NodeJS.Pr
     if (!entry.isDirectory()) {
       continue;
     }
+    if (!shouldInjectSkill(entry.name, skillFilter)) {
+      continue;
+    }
     const source = join(skillsSourceDir, entry.name);
     if (!(await hasSkillManifest(source))) {
       continue;
@@ -1567,12 +1632,19 @@ async function withProviderRuntimeIsolation(
   };
 }
 
-async function ensureSkillsInjectedAtHome(skillsSourceDir: string, targetRoot: string) {
+async function ensureSkillsInjectedAtHome(
+  skillsSourceDir: string,
+  targetRoot: string,
+  skillFilter: Set<string> | null
+) {
   await mkdir(targetRoot, { recursive: true });
   await pruneBrokenSkillSymlinks(targetRoot);
   const entries = await readdir(skillsSourceDir, { withFileTypes: true });
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
+    if (!shouldInjectSkill(entry.name, skillFilter)) {
+      continue;
+    }
     const source = join(skillsSourceDir, entry.name);
     if (!(await hasSkillManifest(source))) continue;
     const target = join(targetRoot, entry.name);
@@ -1678,21 +1750,34 @@ function sanitizePathSegment(value: string | undefined) {
   return trimmed.replace(/[^a-zA-Z0-9._-]/g, "_");
 }
 
-async function buildClaudeSkillsAddDir(skillsSourceDir: string) {
+async function buildClaudeSkillsAddDirFromRoots(
+  skillsSourceRoots: string[],
+  skillFilter: Set<string> | null
+) {
   const tempRoot = await mkdtemp(join(tmpdir(), "bopodev-skills-"));
   const skillsTargetDir = join(tempRoot, CLAUDE_SKILLS_DIR);
   await mkdir(skillsTargetDir, { recursive: true });
 
-  const entries = await readdir(skillsSourceDir, { withFileTypes: true });
-  for (const entry of entries) {
-    if (!entry.isDirectory()) {
-      continue;
-    }
-    const source = join(skillsSourceDir, entry.name);
-    if (!(await hasSkillManifest(source))) {
-      continue;
+  for (const skillsSourceDir of skillsSourceRoots) {
+    const entries = await readdir(skillsSourceDir, { withFileTypes: true });
+    for (const entry of entries) {
+      if (!entry.isDirectory()) {
+        continue;
+      }
+      if (!shouldInjectSkill(entry.name, skillFilter)) {
+        continue;
+      }
+      const source = join(skillsSourceDir, entry.name);
+      if (!(await hasSkillManifest(source))) {
+        continue;
+      }
+      const target = join(skillsTargetDir, entry.name);
+      const existing = await lstat(target).catch(() => null);
+      if (existing) {
+        continue;
+      }
+      await symlink(source, target);
     }
-    await symlink(source, join(skillsTargetDir, entry.name));
   }
 
   return tempRoot;