promptdock 1.1.0 → 1.2.0

package/README.md

@@ -128,7 +128,27 @@ path is re-validated before any write; a failed check aborts **all-or-nothing**
 | 6 | network |
 | 130 | interrupted (`Ctrl-C` during an interactive prompt; `Esc` — a deliberate in-UI cancel — exits 1) |
 
-Every named error links `https://promptdock.ai/docs/cli/errors#<code>`.
+Every named error links `https://promptdock.ai/docs/cli/errors#<code>`. That page
+lists every code with what happened, why, and what to do.
+
+## Package compatibility
+
+This CLI carries its own **install-safety limits** — how many files it will write and how
+much it will download for one skill. They exist so a compromised server cannot fill your
+disk or write outside the target directory, and they are deliberately far above anything
+the platform accepts, so a normal skill never comes near them.
+
+Occasionally a skill is published that is larger than the version of the CLI you have.
+When that happens you get, for **that skill only**:
+
+```
+"Big Skill" needs promptdock CLI 1.2.0 or newer — you are on 1.0.1.
+  Update: npx promptdock@latest install …
+```
+
+It exits `3` (denied), not `4` (integrity) — the package is fine, your CLI is just older
+than it. Your login, your other installs and `promptdock update` are unaffected;
+`promptdock update` skips that one skill and continues with the rest.
 
 ## Notes
 

package/dist/commands/install.js

@@ -27,7 +27,7 @@ export async function runInstall(ctx, positionals, flags) {
     const c = colors(ctx.env, ctx.io.isTTY);
     const { api } = await ensureAuth(ctx);
     const resolve = await api.request("GET", `/api/v1/cli/skills/resolve?ref=${encodeURIComponent(refString)}`);
-    assertInstallable(resolve, refString);
+    assertInstallable(resolve, refString, ctx.version);
     if (typeof resolve.version_id !== "string" || typeof resolve.skill_id !== "string") {
         throw new CliError("malformed resolve response — update the CLI and retry", EXIT.DENIED, {
             footer: "verdict",

package/dist/commands/lifecycle.js

@@ -138,6 +138,17 @@ function removeReceiptOwned(dir, receipt) {
     }
 }
 /* ── update ─────────────────────────────────────────────────────────────────── */
+/**
+ * Errors no later item can recover from either — these still abort the batch.
+ *
+ * USAGE means the invocation itself is wrong (a confirmation needed in a non-interactive
+ * session), so every subsequent item would fail identically. AUTH means the token is gone.
+ * Everything else — an integrity refusal, an over-fuse package, a network blip on one
+ * download — is this item's problem and the next item deserves its turn.
+ */
+function isFatalForBatch(err) {
+    return err instanceof CliError && (err.exitCode === EXIT.USAGE || err.exitCode === EXIT.AUTH);
+}
 export async function runUpdate(ctx, positionals, flags) {
     const c = colors(ctx.env, ctx.io.isTTY);
     const checkOnly = flags.check === true;
@@ -159,7 +170,7 @@ export async function runUpdate(ctx, positionals, flags) {
         let resolved;
         try {
             resolved = await api.request("GET", `/api/v1/cli/skills/resolve?ref=${encodeURIComponent(receipt.ref)}`);
-            assertInstallable(resolved, receipt.ref);
+            assertInstallable(resolved, receipt.ref, ctx.version);
         }
         catch (err) {
             const reason = err instanceof CliError ? err.message : String(err);
@@ -201,18 +212,43 @@ export async function runUpdate(ctx, positionals, flags) {
         }
         if (typeof resolved.skill_id !== "string" || typeof resolved.version_id !== "string")
             continue;
-        const respRaw = await api.request("POST", `/api/v1/cli/skills/${resolved.skill_id}/install`, { version_id: resolved.version_id });
-        const resp = checkInstallResponse(respRaw);
-        await performInstall(ctx, api, {
-            resp,
-            targetDir: item.dir,
-            targetId: item.targetId,
-            refString: receipt.ref,
-            prior: receipt,
-        });
-        report.push({ ref: receipt.ref, dir: item.dir, from: receipt.version, to: resp.skill.version, status: "updated" });
-        if (!json)
-            ctx.io.out(`${c.green("✓")} ${receipt.ref}: v${receipt.version} → v${resp.skill.version}`);
+        /**
+         * ⚠️ THE INSTALL MUST BE INSIDE THE PER-ITEM CATCH TOO, or "one bad package skips and
+         * the rest continue" is false for the population that matters.
+         *
+         * The catch above wraps only resolve + `assertInstallable` — and `assertInstallable`
+         * is exactly what OLDER CLIs do not have. On those, the only thing that refuses an
+         * over-fuse package is `assertSafeManifest`, deep inside `performInstall`, i.e. out
+         * here beyond the guard. So the CliError propagated out of the loop and killed the
+         * whole run: one oversized skill in a directory of twenty aborted the other nineteen.
+         * That is the population the package-scoped `min_cli_version` design exists to serve,
+         * so the guarantee was false precisely where it was load-bearing.
+         *
+         * Genuinely fatal classes still propagate — a usage error or a newer-schema receipt
+         * is not something the next item can recover from either.
+         */
+        try {
+            const respRaw = await api.request("POST", `/api/v1/cli/skills/${resolved.skill_id}/install`, { version_id: resolved.version_id });
+            const resp = checkInstallResponse(respRaw);
+            await performInstall(ctx, api, {
+                resp,
+                targetDir: item.dir,
+                targetId: item.targetId,
+                refString: receipt.ref,
+                prior: receipt,
+            });
+            report.push({ ref: receipt.ref, dir: item.dir, from: receipt.version, to: resp.skill.version, status: "updated" });
+            if (!json)
+                ctx.io.out(`${c.green("✓")} ${receipt.ref}: v${receipt.version} → v${resp.skill.version}`);
+        }
+        catch (err) {
+            if (isFatalForBatch(err))
+                throw err;
+            const reason = err instanceof CliError ? err.message : String(err);
+            report.push({ ref: receipt.ref, dir: item.dir, from: receipt.version, to: toVersion, status: "skipped", reason });
+            if (!json)
+                ctx.io.out(`${c.yellow("!")} ${receipt.ref}: ${reason}`);
+        }
     }
     if (json)
         ctx.io.out(JSON.stringify({ results: report }));

package/dist/contract.d.ts

@@ -31,6 +31,13 @@ export type ResolveResponse = {
     is_free?: boolean;
     file_count?: number;
     total_bytes?: number;
+    /**
+     * The oldest CLI generation whose install-safety fuses admit this package, or
+     * null/absent when every published CLI can install it. Lets an old client refuse
+     * ONE oversized package with an upgrade prompt instead of the server bumping a
+     * global version floor that would 426 every request from every old client.
+     */
+    min_cli_version?: string | null;
     description?: string;
     license?: string;
     /** insufficient_tier */

package/dist/generated/constants.d.ts

@@ -1,9 +1,19 @@
 export declare const MAX_SKILL_FILES = 25;
 export declare const MAX_SKILL_TOTAL_BYTES = 5242880;
 export declare const MAX_SKILL_FILE_BYTES = 1048576;
+export declare const CLI_DOS_MAX_SKILL_FILES = 200;
+export declare const CLI_DOS_MAX_SKILL_TOTAL_BYTES = 52428800;
+export declare const CLI_DOS_MAX_SKILL_FILE_BYTES = 5242880;
+export declare const CLI_FUSE_HISTORY: {
+    cli_version: string;
+    max_files: number;
+    max_file_bytes: number;
+    max_total_bytes: number;
+}[];
 export declare const MAX_SKILL_IMAGES = 5;
 export declare const SKILL_REVEAL_DAILY_CAP = 15;
 export declare const CLI_MIN_VERSION = "1.0.1";
+export declare const PUBLISHED_CLI_VERSION = "1.1.0";
 export declare const SKILL_SLUG_RE_SOURCE = "^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$";
 export declare const SKILL_HANDLE_RE_SOURCE = "^[a-z0-9][a-z0-9_-]{0,62}$";
 export declare const CANONICAL_INSTALL_COMMAND = "npx promptdock@latest install";

package/dist/generated/constants.js

@@ -3,9 +3,14 @@
 export const MAX_SKILL_FILES = 25;
 export const MAX_SKILL_TOTAL_BYTES = 5242880;
 export const MAX_SKILL_FILE_BYTES = 1048576;
+export const CLI_DOS_MAX_SKILL_FILES = 200;
+export const CLI_DOS_MAX_SKILL_TOTAL_BYTES = 52428800;
+export const CLI_DOS_MAX_SKILL_FILE_BYTES = 5242880;
+export const CLI_FUSE_HISTORY = [{ "cli_version": "0.0.0", "max_files": 25, "max_file_bytes": 1048576, "max_total_bytes": 5242880 }, { "cli_version": "1.2.0", "max_files": 200, "max_file_bytes": 5242880, "max_total_bytes": 52428800 }];
 export const MAX_SKILL_IMAGES = 5;
 export const SKILL_REVEAL_DAILY_CAP = 15;
 export const CLI_MIN_VERSION = "1.0.1";
+export const PUBLISHED_CLI_VERSION = "1.1.0";
 export const SKILL_SLUG_RE_SOURCE = "^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$";
 export const SKILL_HANDLE_RE_SOURCE = "^[a-z0-9][a-z0-9_-]{0,62}$";
 export const CANONICAL_INSTALL_COMMAND = "npx promptdock@latest install";

package/dist/installer.d.ts

@@ -5,8 +5,18 @@ import { type Receipt } from "./receipts.js";
 /** Narrow the untrusted install response; throws INTEGRITY on a bad shape. */
 export declare function checkInstallResponse(resp: unknown): InstallResponse;
 /**
- * E8 client-side re-validation + the shared D7 bounds. A server compromise must
- * not become an arbitrary file write OR a disk-filling download.
+ * E8 client-side re-validation against this CLI's own INSTALL-SAFETY FUSES.
+ *
+ * ⚠️ These bounds are SELF-PROTECTION, not a mirror of the platform's policy: "a
+ * server compromise must not become an arbitrary file write OR a disk-filling
+ * download." They are sized from memory/disk/runtime budgets and are deliberately far
+ * above any policy the platform would set, so a legitimate policy raise never needs a
+ * CLI release. Reaching one of them means the server sent something this CLI considers
+ * impossible — hence EXIT.INTEGRITY.
+ *
+ * The FRIENDLY, package-scoped refusal ("this skill needs a newer CLI") lives in
+ * verdicts.ts::assertInstallable and fires BEFORE the metered install POST. This
+ * function is the untrusted-server backstop behind it and must never be removed.
  */
 export declare function assertSafeManifest(manifest: ManifestEntry[]): void;
 export type StagedInstall = {

package/dist/installer.js

@@ -9,7 +9,7 @@ import { randomBytes } from "node:crypto";
 import { existsSync, mkdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { CliError, EXIT, mapFsError, networkError } from "./errors.js";
-import { MAX_SKILL_FILES, MAX_SKILL_FILE_BYTES, MAX_SKILL_TOTAL_BYTES, } from "./generated/constants.js";
+import { CLI_DOS_MAX_SKILL_FILES as MAX_SKILL_FILES, CLI_DOS_MAX_SKILL_FILE_BYTES as MAX_SKILL_FILE_BYTES, CLI_DOS_MAX_SKILL_TOTAL_BYTES as MAX_SKILL_TOTAL_BYTES, } from "./generated/constants.js";
 import { sha256Hex, sha256Matches } from "./integrity.js";
 import { validateSkillPaths } from "./paths.js";
 import { writeReceipt, RECEIPT_SCHEMA } from "./receipts.js";
@@ -37,8 +37,62 @@ export function checkInstallResponse(resp) {
     return r;
 }
 /**
- * E8 client-side re-validation + the shared D7 bounds. A server compromise must
- * not become an arbitrary file write OR a disk-filling download.
+ * Read a response body, aborting the moment it exceeds `limit`.
+ *
+ * `res.arrayBuffer()` has no ceiling: it reads whatever the server sends. Streaming and
+ * cancelling means a hostile or broken server cannot make this process hold more than
+ * one file's worth of bytes, which is the property the install-safety fuse is claiming.
+ *
+ * Falls back to `arrayBuffer()` only when the runtime gives us no readable stream (older
+ * Node fetch shims) — with the post-hoc size check still applied, so the bound holds
+ * either way.
+ */
+async function readBounded(res, limit, path) {
+    const tooBig = () => new CliError(`${INTEGRITY_ABORT} ("${path}" oversized)`, EXIT.INTEGRITY, { footer: "integrity" });
+    const body = res.body;
+    if (!body || typeof body.getReader !== "function") {
+        const buf = Buffer.from(await res.arrayBuffer());
+        if (buf.byteLength > limit)
+            throw tooBig();
+        return buf;
+    }
+    const reader = body.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            if (!value)
+                continue;
+            total += value.byteLength;
+            if (total > limit) {
+                // Stop pulling bytes immediately — this is the whole point.
+                await reader.cancel().catch(() => { });
+                throw tooBig();
+            }
+            chunks.push(value);
+        }
+    }
+    finally {
+        reader.releaseLock?.();
+    }
+    return Buffer.concat(chunks.map((c) => Buffer.from(c)), total);
+}
+/**
+ * E8 client-side re-validation against this CLI's own INSTALL-SAFETY FUSES.
+ *
+ * ⚠️ These bounds are SELF-PROTECTION, not a mirror of the platform's policy: "a
+ * server compromise must not become an arbitrary file write OR a disk-filling
+ * download." They are sized from memory/disk/runtime budgets and are deliberately far
+ * above any policy the platform would set, so a legitimate policy raise never needs a
+ * CLI release. Reaching one of them means the server sent something this CLI considers
+ * impossible — hence EXIT.INTEGRITY.
+ *
+ * The FRIENDLY, package-scoped refusal ("this skill needs a newer CLI") lives in
+ * verdicts.ts::assertInstallable and fires BEFORE the metered install POST. This
+ * function is the untrusted-server backstop behind it and must never be removed.
  */
 export function assertSafeManifest(manifest) {
     const issues = validateSkillPaths(manifest.map((e) => e.path));
@@ -79,6 +133,18 @@ export async function downloadAndStage(ctx, api, resp, targetDir) {
     }
     const tempDir = join(parent, `.promptdock-staging-${randomBytes(6).toString("hex")}`);
     const files = [];
+    /**
+     * Bytes actually RECEIVED, not bytes the server said it would send.
+     *
+     * ⚠️ `assertSafeManifest` enforces the aggregate fuse against `entry.bytes` — a field
+     * the untrusted server supplies and that the response check does not even require. So
+     * before this counter the only bound the wire really carried was PER FILE, and a
+     * hostile server could declare 1 KB per entry and stream the per-file maximum for every
+     * one of them: at the raised fuses that is 200 × 5 MB ≈ 1 GB written to disk, which is
+     * precisely the "disk-filling download" this module's own docstring says it prevents.
+     * The manifest check is a fast pre-flight; THIS is the enforcement.
+     */
+    let received = 0;
     try {
         mkdirSync(tempDir, { recursive: true });
         for (const entry of resp.manifest) {
@@ -99,11 +165,25 @@ export async function downloadAndStage(ctx, api, resp, targetDir) {
                 // A lapsed signed URL is a free re-request (audit row 13) — say so.
                 throw new CliError(`download failed for "${entry.path}" (HTTP ${res.status}) — re-run the install (the download link may have expired; retrying is free)`, EXIT.NETWORK, { footer: "download" });
             }
-            const buf = Buffer.from(await res.arrayBuffer());
-            if (buf.byteLength > MAX_SKILL_FILE_BYTES) {
-                throw new CliError(`${INTEGRITY_ABORT} ("${entry.path}" oversized)`, EXIT.INTEGRITY, {
-                    footer: "integrity",
-                });
+            // ⚠️ CHECK BEFORE BUFFERING, then check again after.
+            //
+            // The fuse exists so a compromised server cannot fill your disk, and
+            // `await res.arrayBuffer()` reads the ENTIRE body into memory first — so a check
+            // that only runs afterwards has already let the download happen. A hostile server
+            // could stream gigabytes and the guard would fire, too late, on a machine that had
+            // already paid for it.
+            //
+            // So: refuse on a declared `content-length` over the fuse without reading a byte,
+            // and refuse again on the real length (content-length is server-supplied and may
+            // be absent or lie, which is exactly why the second check stays).
+            const declared = Number(res.headers.get("content-length"));
+            if (Number.isFinite(declared) && declared > MAX_SKILL_FILE_BYTES) {
+                throw new CliError(`${INTEGRITY_ABORT} ("${entry.path}" declares ${declared} bytes, over the limit)`, EXIT.INTEGRITY, { footer: "integrity" });
+            }
+            const buf = await readBounded(res, MAX_SKILL_FILE_BYTES, entry.path);
+            received += buf.byteLength;
+            if (received > MAX_SKILL_TOTAL_BYTES) {
+                throw new CliError(`${INTEGRITY_ABORT} (the package sent more than the ${MAX_SKILL_TOTAL_BYTES}-byte install limit)`, EXIT.INTEGRITY, { footer: "integrity" });
             }
             if (!sha256Matches(buf, entry.sha256)) {
                 throw new CliError(`${INTEGRITY_ABORT} (sha256 mismatch on "${entry.path}")`, EXIT.INTEGRITY, {

package/dist/verdicts.d.ts

@@ -1,4 +1,4 @@
 import type { ResolveResponse } from "./contract.js";
 export declare const UPGRADE_URL = "https://promptdock.ai/pricing";
 /** Throws the DX3-copy CliError for a deny verdict; returns for ok/already_entitled. */
-export declare function assertInstallable(resolve: ResolveResponse, refString: string): void;
+export declare function assertInstallable(resolve: ResolveResponse, refString: string, cliVersion: string): void;

package/dist/verdicts.js

@@ -1,11 +1,53 @@
 import { CliError, EXIT } from "./errors.js";
 import { retryHours } from "./ui.js";
+import { CANONICAL_INSTALL_COMMAND, CLI_DOS_MAX_SKILL_FILES, CLI_DOS_MAX_SKILL_TOTAL_BYTES, } from "./generated/constants.js";
 export const UPGRADE_URL = "https://promptdock.ai/pricing";
+/** Numeric semver compare; mirrors compareCliVersions in lib/validation/skills.ts. */
+function cmpVersion(a, b) {
+    const pa = a.split(".").map((n) => Number(n) || 0);
+    const pb = b.split(".").map((n) => Number(n) || 0);
+    return (pa[0] - pb[0]) || (pa[1] - pb[1]) || (pa[2] - pb[2]);
+}
+/**
+ * PACKAGE-SCOPED compatibility, checked BEFORE the metered install POST.
+ *
+ * Two reasons this lives here and not only in `assertSafeManifest`:
+ *  1. `POST /cli/skills/{id}/install` mints an entitlement ticket under the shared
+ *     15/day premium cap. Failing after it burns one of the user's daily slots on a
+ *     provably-doomed install.
+ *  2. A package this CLI is too old to install is a POLICY refusal (EXIT.DENIED — the
+ *     code whose own doc string reads "tier, cap, denial, rate limit, version floor"),
+ *     not a supply-chain signal. `assertSafeManifest` throws EXIT.INTEGRITY because
+ *     there it means the server sent something impossible; here it means "update me".
+ *
+ * `assertSafeManifest` stays as the untrusted-server backstop — this check makes it
+ * unreachable in practice, never redundant.
+ */
+function assertPackageCompatible(resolve, cliVersion) {
+    const upgrade = `Update: ${CANONICAL_INSTALL_COMMAND} …  (or: npm i -g promptdock@latest)`;
+    const title = resolve.title ? `"${resolve.title}"` : "This skill";
+    const min = resolve.min_cli_version;
+    if (typeof min === "string" && min.length > 0 && cmpVersion(cliVersion, min) < 0) {
+        throw new CliError(`${title} needs promptdock CLI ${min} or newer — you are on ${cliVersion}.`, EXIT.DENIED, { footer: "upgrade_required", hint: upgrade });
+    }
+    // Belt and braces for a server too old to send min_cli_version: compare the shape
+    // the resolve response already reports against this CLI's own fuses.
+    const files = Number(resolve.file_count);
+    if (Number.isFinite(files) && files > CLI_DOS_MAX_SKILL_FILES) {
+        throw new CliError(`${title} has ${files} files — this CLI installs at most ${CLI_DOS_MAX_SKILL_FILES}.`, EXIT.DENIED, { footer: "upgrade_required", hint: upgrade });
+    }
+    const total = Number(resolve.total_bytes);
+    if (Number.isFinite(total) && total > CLI_DOS_MAX_SKILL_TOTAL_BYTES) {
+        const mb = (n) => `${(n / (1024 * 1024)).toFixed(1)}MB`;
+        throw new CliError(`${title} is ${mb(total)} — this CLI installs at most ${mb(CLI_DOS_MAX_SKILL_TOTAL_BYTES)}.`, EXIT.DENIED, { footer: "upgrade_required", hint: upgrade });
+    }
+}
 /** Throws the DX3-copy CliError for a deny verdict; returns for ok/already_entitled. */
-export function assertInstallable(resolve, refString) {
+export function assertInstallable(resolve, refString, cliVersion) {
     switch (resolve.verdict) {
         case "ok":
         case "already_entitled":
+            assertPackageCompatible(resolve, cliVersion);
             return;
         case "not_found":
             throw new CliError(`skill not found: ${refString} — check the ref (the format is handle/slug; a pasted promptdock.ai skill URL also works)`, EXIT.DENIED, { footer: "not_found" });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "promptdock",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "Install AI agent skills from PromptDock — npx promptdock@latest install <handle>/<slug>",
   "keywords": [
     "promptdock",
@@ -42,5 +42,5 @@
     "typescript": "^5",
     "vitest": "^4.1.8"
   },
-  "gitHead": "a2f9bd83dfba6c7f73a116687fede2e7b2f3c8cb"
+  "gitHead": "53545d74fc0baeec63684c96b49134e93625d63a"
 }