skillscript-runtime 0.18.7 → 0.18.9

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (42) hide show
  1. package/README.md +2 -2
  2. package/dist/bootstrap.d.ts +7 -0
  3. package/dist/bootstrap.d.ts.map +1 -1
  4. package/dist/bootstrap.js +30 -0
  5. package/dist/bootstrap.js.map +1 -1
  6. package/dist/cli.js +120 -0
  7. package/dist/cli.js.map +1 -1
  8. package/dist/dashboard/spa/app.js +219 -2
  9. package/dist/dashboard/spa/index.html +1 -0
  10. package/dist/dashboard/spa/styles.css +39 -0
  11. package/dist/errors.d.ts +14 -0
  12. package/dist/errors.d.ts.map +1 -1
  13. package/dist/errors.js +33 -0
  14. package/dist/errors.js.map +1 -1
  15. package/dist/lint.d.ts +25 -0
  16. package/dist/lint.d.ts.map +1 -1
  17. package/dist/lint.js +81 -0
  18. package/dist/lint.js.map +1 -1
  19. package/dist/mcp-server.d.ts +6 -0
  20. package/dist/mcp-server.d.ts.map +1 -1
  21. package/dist/mcp-server.js +57 -0
  22. package/dist/mcp-server.js.map +1 -1
  23. package/dist/runtime-config.d.ts +25 -0
  24. package/dist/runtime-config.d.ts.map +1 -1
  25. package/dist/runtime-config.js +8 -0
  26. package/dist/runtime-config.js.map +1 -1
  27. package/dist/runtime.d.ts +17 -0
  28. package/dist/runtime.d.ts.map +1 -1
  29. package/dist/runtime.js +41 -1
  30. package/dist/runtime.js.map +1 -1
  31. package/dist/scheduler.d.ts +7 -0
  32. package/dist/scheduler.d.ts.map +1 -1
  33. package/dist/scheduler.js +3 -0
  34. package/dist/scheduler.js.map +1 -1
  35. package/dist/trace.d.ts +9 -0
  36. package/dist/trace.d.ts.map +1 -1
  37. package/dist/trace.js.map +1 -1
  38. package/docs/adopter-playbook.md +140 -0
  39. package/docs/configuration.md +2 -1
  40. package/examples/skillscripts/hello-world.skill.provenance.json +1 -1
  41. package/package.json +1 -1
  42. package/scaffold/.env.example +27 -0
package/docs/configuration.md CHANGED
@@ -49,7 +49,8 @@ The CLI auto-loads `$SKILLSCRIPT_HOME/.env` at startup and populates `process.en
49
49
  |---|---|---|
50
50
  | `SKILLSCRIPT_HOME` | Config root (default `~/.skillscript`) | shell-set only — read before `.env` loads |
51
51
  | `SKILLSCRIPT_FORCE_ALWAYS_DRAFT=true` | Force outside-MCP `skill_write` to Draft; closes the agent-self-approval path | env > config > default `false` |
52
- | `SKILLSCRIPT_ENABLE_UNSAFE_SHELL=true` | Permit `shell(unsafe=true)` ops | env > config > default `false` |
52
+ | `SKILLSCRIPT_ENABLE_UNSAFE_SHELL=true` | Permit `shell(unsafe=true)` ops (syntax-scope axis) | env > config > default `false` |
53
+ | `SKILLSCRIPT_SHELL_ALLOWLIST=curl,git,jq` | Comma-separated list of binaries reachable via `shell(...)` ops (binary-scope axis). **Default-deny** when unset — BREAKING from v0.18.7. Run `skillfile shell-audit` pre-upgrade to discover your corpus's set. v0.18.9 — honored on both CLI and programmatic-`bootstrap()` paths; explicit `bootstrap({ shellAllowlist: [...] })` (including `[]` deny-all) wins over env. See [adopter-playbook](adopter-playbook.md) § "Programmatic bootstrap path" for the precedence table. | `bootstrap()` opt > env > config > default-deny |
53
54
  | `SKILLSCRIPT_PORT=8080` | Dashboard / serve HTTP port | `--port` flag > env > config > default `7878` |
54
55
  | `SKILLSCRIPT_HOST=0.0.0.0` | Bind address | `--host` flag > env > config > default `127.0.0.1` |
55
56
  | `SKILLSCRIPT_MCP_CALLER_IDENTITY_HEADER=X-Agent-Id` | Inbound caller-identity header name (multi-agent MCP hosts only — see [adopter playbook](adopter-playbook.md)) | env > config > default unset |
package/examples/skillscripts/hello-world.skill.provenance.json CHANGED
@@ -2,7 +2,7 @@
2
2
  "provenance_version": "1.0",
3
3
  "language_version": "1.0",
4
4
  "compiler_version": "0.1.0-dev",
5
- "compiled_at": "2026-06-06T11:36:08.475Z",
5
+ "compiled_at": "2026-06-07T11:45:30.911Z",
6
6
  "source_skill": {
7
7
  "name": "hello-world"
8
8
  },
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "skillscript-runtime",
3
- "version": "0.18.7",
3
+ "version": "0.18.9",
4
4
  "description": "Runtime, compiler, lint, CLI, and dashboard for Skillscript — a small declarative language for authoring agent workflows.",
5
5
  "license": "MIT",
6
6
  "author": "Scott Shwarts <scotts@pobox.com>",
package/scaffold/.env.example CHANGED
@@ -29,6 +29,33 @@
29
29
  # on every appearance regardless.
30
30
  # SKILLSCRIPT_ENABLE_UNSAFE_SHELL=true
31
31
 
32
+ # Operator-controlled allowlist of binaries reachable via `shell(...)` ops.
33
+ # Default-deny (v0.18.8+): when this var is unset, NO `shell()` op will run.
34
+ # Set to a comma-separated list of binary names; the first token of each
35
+ # `shell(command="X ...")` body must appear in the list.
36
+ #
37
+ # Two independent axes — separate from SKILLSCRIPT_ENABLE_UNSAFE_SHELL:
38
+ # - this var controls WHICH binaries (binary scope)
39
+ # - enable_unsafe_shell controls WHETHER bash interpretation is permitted
40
+ # (syntax scope)
41
+ # Both must allow for a `shell(..., unsafe=true)` op to dispatch:
42
+ # on-list + safe syntax → runs
43
+ # on-list + pipeline/unsafe → runs iff ENABLE_UNSAFE_SHELL=true
44
+ # off-list → refused, period (no author keyword escapes this)
45
+ #
46
+ # For unsafe ops the runtime invokes `bash -c <body>` — the literal first
47
+ # token is `bash`. So permitting any unsafe shell at all requires `bash`
48
+ # on the allowlist in addition to ENABLE_UNSAFE_SHELL=true. Per-binary
49
+ # scope on unsafe-mode bodies is NOT supported at runtime (parse-based
50
+ # enumeration is unsound; OS-level execve/seccomp/restricted-PATH is the
51
+ # proper layer — see docs/adopter-playbook.md).
52
+ #
53
+ # Pre-upgrade discovery: run `skillfile shell-audit` to scan your skill
54
+ # corpus and emit the current set of binaries used. Paste the suggested
55
+ # value here. THIS IS A BREAKING CHANGE from v0.18.7 — skills using
56
+ # shell() will refuse to run until this is configured.
57
+ # SKILLSCRIPT_SHELL_ALLOWLIST=curl,git,jq,grep
58
+
32
59
 
33
60
  # ─── Network / bind config ─────────────────────────────────────────────
34
61