skillscript-runtime 0.20.1 → 0.21.0

package/scaffold/.env.example

@@ -15,12 +15,55 @@
 # Values can be quoted ("..." or '...') if they contain spaces.
 
 
+# ─── Approval boundary (secured mode) ──────────────────────────────────
+
+# Enforce the approval boundary: in secured mode, only a key-SIGNED skill
+# may perform effectful ops ($ / shell / file_* / notify). An unapproved or
+# tampered skill cannot execute a single effect, however it's dispatched
+# (CLI, cron, /event, MCP, composition). Default OFF — the unkeyed
+# convenience posture, where a bare `# Status: Approved` runs. Turn ON for
+# any multi-author or networked deployment.
+# SKILLSCRIPT_SECURED_MODE=true
+
+# Operator's Ed25519 approval keypair. First run in secured mode
+# auto-provisions one if the PUBLIC key is absent (private written 0600).
+# Defaults live OUTSIDE SKILLSCRIPT_HOME so a co-resident agent can't read
+# the forging key. HARDENED POSTURE: provision the keypair yourself, give
+# the deployment ONLY the public key (set the pub path, leave the private
+# off-box), and sign operator-side — the runtime verifies with the public
+# key and never needs the private one.
+# SKILLSCRIPT_APPROVAL_KEY_FILE=~/.config/skillscript/approval.key
+# SKILLSCRIPT_APPROVAL_PUBLIC_KEY_FILE=~/.config/skillscript/approval.pub
+
+# Filesystem path allowlist for file_read / file_write (the third operator
+# allowlist; mirrors SKILLSCRIPT_SHELL_ALLOWLIST). Default-deny: unset = every
+# file op refused. Comma-separated roots, canonicalized so `..`/symlink can't
+# escape. KEEP YOUR APPROVAL-KEY DIRECTORY OUT OF IT.
+# SKILLSCRIPT_FS_ALLOWLIST=/srv/skillscript/workspace,/var/skillscript/events
+
+# Optional shared-secret gate for the dashboard (SPA + /rpc) — network/casual
+# hygiene when binding beyond localhost. Present via `?token=` (browser sets a
+# cookie), the `skillscript_dash` cookie, or `Authorization: Bearer`. Default
+# unset = open (localhost bind is the only gate). NOT an agent-forgery boundary
+# (the dashboard holds no signing key) — that remains key custody.
+# SKILLSCRIPT_DASHBOARD_AUTH_TOKEN=change-me-to-random-hex
+
+# In-browser approval. When set (+ secured mode + a readable key),
+# the dashboard offers click-to-Approve: the approver enters this passcode once
+# per browser session to unlock signing (15-min idle TTL), then signs skills
+# with the operator's key. Default unset = dashboard stays review-only (copy
+# the `skillfile approve` command, sign at a terminal). SECURITY: enabling this
+# gives the dashboard process key access — run it operator-side, isolated from
+# the agent (no network path to it; agent can't read this passcode).
+# SKILLSCRIPT_APPROVAL_PASSCODE=change-me
+
+
 # ─── Posture / security switches ───────────────────────────────────────
 
 # Force every outside-MCP `skill_write` to land Draft regardless of what
 # the body declares. Closes the agent-self-approval path — adopters
 # wanting a human approval gate before any skill executes set this true.
-# Default false (preserves v0.9.1 self-approval-via-body-declaration).
+# Default false.
 # SKILLSCRIPT_FORCE_ALWAYS_DRAFT=true
 
 # Permit `shell(unsafe=true)` ops (full bash interpretation: pipes, $VAR,
@@ -30,7 +73,7 @@
 # SKILLSCRIPT_ENABLE_UNSAFE_SHELL=true
 
 # Operator-controlled allowlist of binaries reachable via `shell(...)` ops.
-# Default-deny (v0.18.8+): when this var is unset, NO `shell()` op will run.
+# Default-deny: when this var is unset, NO `shell()` op will run.
 # Set to a comma-separated list of binary names; the first token of each
 # `shell(command="X ...")` body must appear in the list.
 #
@@ -50,10 +93,9 @@
 # enumeration is unsound; OS-level execve/seccomp/restricted-PATH is the
 # proper layer — see docs/adopter-playbook.md).
 #
-# Pre-upgrade discovery: run `skillfile shell-audit` to scan your skill
-# corpus and emit the current set of binaries used. Paste the suggested
-# value here. THIS IS A BREAKING CHANGE from v0.18.7 — skills using
-# shell() will refuse to run until this is configured.
+# Discovery: run `skillfile shell-audit` to scan your skill corpus and emit
+# the current set of binaries used. Paste the suggested value here. Skills
+# using shell() will refuse to run until this is configured.
 # SKILLSCRIPT_SHELL_ALLOWLIST=curl,git,jq,grep
 
 
@@ -65,12 +107,12 @@
 # SKILLSCRIPT_HOST=0.0.0.0
 
 # Dashboard / serve HTTP port. Default 7878. Used for the SPA, JSON-RPC
-# at /rpc, AND the v0.19.0 event-trigger ingress at /event (they share
+# at /rpc, AND the event-trigger ingress at /event (they share
 # one HTTP server — no separate event port).
 # SKILLSCRIPT_PORT=8080
 
 
-# ─── Event-trigger HTTP ingress (v0.19.0) ──────────────────────────────
+# ─── Event-trigger HTTP ingress ──────────────────────────────
 
 # Enable POST /event for external HTTP-triggered skills. Default false —
 # the route returns 404 when not enabled. Once enabled, external services