skillscript-runtime 0.19.7 → 0.19.9

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (16) hide show
  1. package/README.md +31 -27
  2. package/dist/connectors/config.d.ts.map +1 -1
  3. package/dist/connectors/config.js +17 -0
  4. package/dist/connectors/config.js.map +1 -1
  5. package/dist/connectors/mcp-remote.d.ts.map +1 -1
  6. package/dist/connectors/mcp-remote.js +10 -1
  7. package/dist/connectors/mcp-remote.js.map +1 -1
  8. package/dist/parser.d.ts.map +1 -1
  9. package/dist/parser.js +99 -57
  10. package/dist/parser.js.map +1 -1
  11. package/docs/adopter-playbook.md +17 -5
  12. package/docs/configuration.md +13 -2
  13. package/docs/language-reference.md +181 -159
  14. package/examples/skillscripts/hello-world.skill.provenance.json +1 -1
  15. package/package.json +1 -1
  16. package/scaffold/connectors.json +5 -1
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "skillscript-runtime",
3
- "version": "0.19.7",
3
+ "version": "0.19.9",
4
4
  "description": "Runtime, compiler, lint, CLI, and dashboard for Skillscript — a small declarative language for authoring agent workflows.",
5
5
  "license": "MIT",
6
6
  "author": "Scott Shwarts <scotts@pobox.com>",
package/scaffold/connectors.json CHANGED
@@ -49,13 +49,17 @@
49
49
 
50
50
  "_example_disabled_remote_mcp": {
51
51
  "comment": "Uncomment and adapt to wire any remote MCP server. The example shows the stdio-bridged shape used by `mcp-remote` and similar.",
52
+ "_comment_framing": "framing: 'newline' for mcp-remote and most MCP stdio servers (newline-delimited per the standard MCP stdio spec). Only use 'lsp' (the historical default — Content-Length-framed) if your specific MCP server explicitly uses LSP-style framing. With the wrong framing, the connector hangs to init_timeout with no clear 'wrong framing' signal — set this explicitly.",
53
+ "_comment_allowed_tools": "allowed_tools is a per-connector SECURITY policy and belongs at the ENTRY top-level (sibling to 'class' and 'config'). Placing it INSIDE 'config:' is now a hard parse error (refused to load) — pre-fix it silently allowed all tools, a security bypass on misplacement.",
52
54
  "class": "RemoteMcpConnector",
53
55
  "config": {
54
56
  "command": "npx",
55
57
  "args": ["mcp-remote", "https://example.com/mcp", "--header", "Authorization:${AUTH_HEADER}"],
58
+ "framing": "newline",
56
59
  "env": {
57
60
  "AUTH_HEADER": "Bearer ${YOUR_TOKEN_ENV_VAR}"
58
61
  }
59
- }
62
+ },
63
+ "allowed_tools": ["list_issues", "get_issue", "create_comment"]
60
64
  }
61
65
  }