skillwiki 0.10.109 → 0.10.111

package/dist/{chunk-JCDAEZVD.js → chunk-5IBLXGLY.js}

@@ -1,12 +1,14 @@
 #!/usr/bin/env node
 import {
-  err,
   extractFrontmatter,
-  ok,
   readPage,
   scanSensitiveContent,
   splitFrontmatter
-} from "./chunk-GJC2CI3W.js";
+} from "./chunk-X5GL2FCU.js";
+import {
+  err,
+  ok
+} from "./chunk-UIEQIJXP.js";
 
 // src/utils/vault-path-safety.ts
 import { lstatSync, realpathSync } from "fs";

package/dist/chunk-6OQLBNKR.js

@@ -0,0 +1,250 @@
+#!/usr/bin/env node
+import {
+  parseDotenvFile,
+  resolveSkillwikiHome
+} from "./chunk-PYPPG7RF.js";
+import {
+  CLIP_OUTBOX_DEFAULTS,
+  isClipOutboxKey,
+  parseClipOutboxKeyValue
+} from "./chunk-UIEQIJXP.js";
+
+// src/clip-outbox/runtime.ts
+import { existsSync as existsSync2 } from "fs";
+import { lstat, readFile } from "fs/promises";
+import { join as join2 } from "path";
+import { execFileSync } from "child_process";
+import { z } from "zod";
+
+// src/utils/clip-outbox-config.ts
+import { realpathSync, statSync, existsSync, accessSync, constants } from "fs";
+import { homedir } from "os";
+import { isAbsolute, join, resolve, sep } from "path";
+var CLIP_NOT_CONFIGURED = "clip channel not configured";
+var PRODUCTION_WATCHER_LABEL = CLIP_OUTBOX_DEFAULTS.watcher_label;
+var RETIRED_WATCHER_LABELS = [
+  "com.karlchow.wiki-dev-outbox",
+  "com.karlchow.wiki-dev-sse",
+  "com.karlchow.wiki-dev-hourly",
+  "com.karlchow.skillwiki-note-outbox"
+];
+function expandUserPath(raw, home) {
+  if (raw === "~") return home;
+  if (raw.startsWith("~/")) return resolve(home, raw.slice(2));
+  return raw;
+}
+function canonicalPath(raw, home) {
+  const expanded = expandUserPath(raw.trim(), home);
+  if (expanded.includes("\0")) return { ok: false, message: "path contains NUL" };
+  if (expanded.includes("://") || expanded.includes("@")) {
+    return { ok: false, message: "path must not include URL credentials" };
+  }
+  if (!isAbsolute(expanded)) return { ok: false, message: "must be an absolute path" };
+  try {
+    const real = existsSync(expanded) ? realpathSync(expanded) : resolve(expanded);
+    if (real.split(sep).some((seg) => seg === "..")) {
+      return { ok: false, message: "path must not contain traversal" };
+    }
+    return { ok: true, path: real };
+  } catch (error) {
+    return { ok: false, message: error instanceof Error ? error.message : "invalid path" };
+  }
+}
+function nestedOrEqual(a, b) {
+  if (a === b) return true;
+  const prefixA = a.endsWith(sep) ? a : a + sep;
+  const prefixB = b.endsWith(sep) ? b : b + sep;
+  return prefixA.startsWith(prefixB) || prefixB.startsWith(prefixA);
+}
+function intField(value, fallback) {
+  return Number(value && value.length > 0 ? value : fallback);
+}
+function requireWritableDir(path, label) {
+  try {
+    const st = statSync(path);
+    if (!st.isDirectory()) return `${label} is not a directory`;
+    accessSync(path, constants.W_OK);
+    return void 0;
+  } catch {
+    return `${label} is missing or not writable`;
+  }
+}
+function resolveClipOutboxConfig(map, home) {
+  const present = Object.keys(map).filter(isClipOutboxKey);
+  for (const key of present) {
+    const parsed = parseClipOutboxKeyValue(key, map[key] ?? "");
+    if (!parsed.ok) return { ok: false, message: `${key}: ${parsed.message}` };
+  }
+  const enabled = (map["clip_outbox.enabled"] ?? CLIP_OUTBOX_DEFAULTS.enabled) === "true";
+  if (!enabled) {
+    return { ok: true, enabled: false };
+  }
+  const required = [
+    "clip_outbox.root",
+    "clip_outbox.state_root",
+    "clip_outbox.mirror_root",
+    "clip_outbox.ready_url",
+    "clip_outbox.s3_credential_ref",
+    "clip_outbox.ready_credential_ref"
+  ];
+  for (const key of required) {
+    if (!map[key]) return { ok: false, message: `${key} is required when clip_outbox.enabled=true` };
+  }
+  const d8Absent = map["clip_outbox.d8_note_absent"] === "true";
+  const d8RootRaw = map["clip_outbox.d8_note_root"];
+  if (d8Absent && d8RootRaw) {
+    return { ok: false, message: "clip_outbox.d8_note_root and clip_outbox.d8_note_absent cannot both be set" };
+  }
+  if (!d8Absent && !d8RootRaw) {
+    return { ok: false, message: "clip_outbox.d8_note_root or clip_outbox.d8_note_absent=true is required when enabled" };
+  }
+  const root = canonicalPath(map["clip_outbox.root"], home);
+  const stateRoot = canonicalPath(map["clip_outbox.state_root"], home);
+  const mirrorRoot = canonicalPath(map["clip_outbox.mirror_root"], home);
+  if (!root.ok) return { ok: false, message: `clip_outbox.root: ${root.message}` };
+  if (!stateRoot.ok) return { ok: false, message: `clip_outbox.state_root: ${stateRoot.message}` };
+  if (!mirrorRoot.ok) return { ok: false, message: `clip_outbox.mirror_root: ${mirrorRoot.message}` };
+  let d8NoteRoot = null;
+  if (d8RootRaw) {
+    const d8 = canonicalPath(d8RootRaw, home);
+    if (!d8.ok) return { ok: false, message: `clip_outbox.d8_note_root: ${d8.message}` };
+    d8NoteRoot = d8.path;
+  }
+  if (nestedOrEqual(root.path, mirrorRoot.path)) {
+    return { ok: false, message: "clip_outbox.root must be outside the frozen mirror" };
+  }
+  if (nestedOrEqual(root.path, stateRoot.path) || nestedOrEqual(stateRoot.path, mirrorRoot.path)) {
+    return { ok: false, message: "clip_outbox.state_root must be disjoint from outbox and mirror" };
+  }
+  if (d8NoteRoot && (nestedOrEqual(root.path, d8NoteRoot) || nestedOrEqual(stateRoot.path, d8NoteRoot))) {
+    return { ok: false, message: "clip outbox must not equal or nest the D8 note outbox" };
+  }
+  const rootErr = requireWritableDir(root.path, "clip_outbox.root");
+  if (rootErr) return { ok: false, message: rootErr };
+  const stateErr = requireWritableDir(stateRoot.path, "clip_outbox.state_root");
+  if (stateErr) {
+    if (existsSync(stateRoot.path)) return { ok: false, message: stateErr };
+    const parentErr = requireWritableDir(resolve(stateRoot.path, ".."), "clip_outbox.state_root parent");
+    if (parentErr) return { ok: false, message: stateErr };
+  }
+  if (!existsSync(mirrorRoot.path)) {
+    return { ok: false, message: "clip_outbox.mirror_root does not exist" };
+  }
+  const vaultId = map["clip_outbox.vault_id"] ?? CLIP_OUTBOX_DEFAULTS.vault_id;
+  if (vaultId !== "central") return { ok: false, message: "clip_outbox.vault_id must be central" };
+  const destination = map["clip_outbox.destination"] ?? CLIP_OUTBOX_DEFAULTS.destination;
+  if (destination !== CLIP_OUTBOX_DEFAULTS.destination) {
+    return { ok: false, message: "clip_outbox.destination must be seaweed-wiki:cloud/wiki" };
+  }
+  const mode = map["clip_outbox.mode"] ?? CLIP_OUTBOX_DEFAULTS.mode;
+  if (mode !== "event-watch") return { ok: false, message: "clip_outbox.mode must be event-watch" };
+  const watcherLabel = map["clip_outbox.watcher_label"] ?? CLIP_OUTBOX_DEFAULTS.watcher_label;
+  if (watcherLabel !== PRODUCTION_WATCHER_LABEL) {
+    return { ok: false, message: "clip_outbox.watcher_label must be the production clip watcher" };
+  }
+  const imageTypes = (map["clip_outbox.image_types"] ?? CLIP_OUTBOX_DEFAULTS.image_types).split(",").map((p) => p.trim()).filter(Boolean);
+  return {
+    ok: true,
+    enabled: true,
+    config: {
+      enabled: true,
+      root: root.path,
+      stateRoot: stateRoot.path,
+      mirrorRoot: mirrorRoot.path,
+      d8NoteRoot,
+      d8NoteAbsent: d8Absent,
+      vaultId: "central",
+      allowedPrefixes: ["raw/articles", "raw/assets"],
+      destination: "seaweed-wiki:cloud/wiki",
+      mode: "event-watch",
+      pollFallbackEnabled: (map["clip_outbox.poll_fallback_enabled"] ?? CLIP_OUTBOX_DEFAULTS.poll_fallback_enabled) === "true",
+      reconcileSeconds: intField(map["clip_outbox.reconcile_seconds"], CLIP_OUTBOX_DEFAULTS.reconcile_seconds),
+      debounceMs: intField(map["clip_outbox.debounce_ms"], CLIP_OUTBOX_DEFAULTS.debounce_ms),
+      stableHashMs: intField(map["clip_outbox.stable_hash_ms"], CLIP_OUTBOX_DEFAULTS.stable_hash_ms),
+      maxArticleBytes: intField(map["clip_outbox.max_article_bytes"], CLIP_OUTBOX_DEFAULTS.max_article_bytes),
+      maxImages: intField(map["clip_outbox.max_images"], CLIP_OUTBOX_DEFAULTS.max_images),
+      maxImageBytes: intField(map["clip_outbox.max_image_bytes"], CLIP_OUTBOX_DEFAULTS.max_image_bytes),
+      maxBundleBytes: intField(map["clip_outbox.max_bundle_bytes"], CLIP_OUTBOX_DEFAULTS.max_bundle_bytes),
+      maxPixels: intField(map["clip_outbox.max_pixels"], CLIP_OUTBOX_DEFAULTS.max_pixels),
+      downloadConcurrency: intField(map["clip_outbox.download_concurrency"], CLIP_OUTBOX_DEFAULTS.download_concurrency),
+      imageTypes,
+      maxRedirects: intField(map["clip_outbox.max_redirects"], CLIP_OUTBOX_DEFAULTS.max_redirects),
+      requestTimeoutMs: intField(map["clip_outbox.request_timeout_ms"], CLIP_OUTBOX_DEFAULTS.request_timeout_ms),
+      localizeTimeoutMs: intField(map["clip_outbox.localize_timeout_ms"], CLIP_OUTBOX_DEFAULTS.localize_timeout_ms),
+      readyUrl: map["clip_outbox.ready_url"],
+      s3CredentialRef: map["clip_outbox.s3_credential_ref"],
+      readyCredentialRef: map["clip_outbox.ready_credential_ref"],
+      watcherLabel: PRODUCTION_WATCHER_LABEL
+    }
+  };
+}
+function clipOutboxConfigPath(home) {
+  return join(resolveSkillwikiHome(home), ".skillwiki", ".env");
+}
+async function loadClipOutboxConfig(home) {
+  const map = await parseDotenvFile(clipOutboxConfigPath(home));
+  return resolveClipOutboxConfig(map, home || homedir());
+}
+
+// src/clip-outbox/runtime.ts
+var s3Schema = z.object({ endpoint: z.string().url(), region: z.string().default("us-east-1"), accessKeyId: z.string().min(1), secretAccessKey: z.string().min(1), sessionToken: z.string().optional() }).strict();
+async function loadClipCredentials(home, config, env = process.env) {
+  let providers = {};
+  const path = join2(home, ".skillwiki", "clip-outbox-credentials.json");
+  try {
+    const st = await lstat(path);
+    if (!st.isFile() || st.isSymbolicLink() || (st.mode & 63) !== 0 || st.uid !== process.getuid?.()) throw new Error("protected credential file required");
+    providers = JSON.parse(await readFile(path, "utf8"));
+  } catch (e) {
+    if (e.code !== "ENOENT") throw new Error("clip credential provider unreadable");
+  }
+  try {
+    const rawS3 = env[config.s3CredentialRef] ?? providers[config.s3CredentialRef];
+    const s3 = s3Schema.parse(typeof rawS3 === "string" ? JSON.parse(rawS3) : rawS3);
+    const endpoint = new URL(s3.endpoint);
+    if (endpoint.protocol !== "https:" || endpoint.username || endpoint.password || endpoint.search || endpoint.hash) throw new Error();
+    const hostConfig = await parseDotenvFile(join2(home, ".skillwiki", ".env"));
+    const readyToken = env[config.readyCredentialRef] ?? providers[config.readyCredentialRef];
+    if (typeof readyToken !== "string" || !readyToken || config.readyCredentialRef === "SKILLWIKI_MCP_TOKEN" || readyToken === env.SKILLWIKI_MCP_TOKEN || readyToken === hostConfig.SKILLWIKI_MCP_TOKEN || config.readyCredentialRef === config.s3CredentialRef) throw new Error();
+    return { s3, readyToken };
+  } catch {
+    throw new Error("clip credential references missing or invalid; use a separate file-ingress token");
+  }
+}
+var evidencePath = (config) => join2(config.stateRoot, "conditional-create.json");
+async function conditionalCreateProven(config, endpoint) {
+  try {
+    const proof = JSON.parse(await readFile(evidencePath(config), "utf8"));
+    return proof.verified === true && proof.destination === config.destination && proof.endpoint === endpoint && typeof proof.testedAt === "string" && Number.isFinite(Date.parse(proof.testedAt));
+  } catch {
+    return false;
+  }
+}
+async function validateRuntime(home, config, endpoint) {
+  const resolved = await loadClipOutboxConfig(home);
+  if (!resolved.ok || !resolved.enabled || JSON.stringify(resolved.config) !== JSON.stringify(config)) throw new Error("clip configuration changed; restart after attended review");
+  if (!existsSync2(join2(config.mirrorRoot, ".WIKI_GIT_FROZEN"))) throw new Error("frozen mirror marker missing");
+  const map = await parseDotenvFile(join2(home, ".skillwiki", ".env"));
+  if (map["vault_sync.push_enabled"] !== "false") throw new Error("wiki-push must remain disabled");
+  try {
+    execFileSync("launchctl", ["list", "com.karlchow.wiki-push"], { stdio: "ignore", timeout: 2e3 });
+    throw new Error("wiki-push is loaded");
+  } catch (e) {
+    if (!e.status) throw e;
+  }
+  if (!await conditionalCreateProven(config, endpoint)) throw new Error("conditional-create evidence missing for this endpoint and destination");
+}
+
+export {
+  CLIP_NOT_CONFIGURED,
+  PRODUCTION_WATCHER_LABEL,
+  RETIRED_WATCHER_LABELS,
+  expandUserPath,
+  nestedOrEqual,
+  resolveClipOutboxConfig,
+  loadClipOutboxConfig,
+  loadClipCredentials,
+  evidencePath,
+  conditionalCreateProven,
+  validateRuntime
+};

package/dist/chunk-GQWCTJTU.js

@@ -0,0 +1,55 @@
+#!/usr/bin/env node
+import {
+  err,
+  ok
+} from "./chunk-UIEQIJXP.js";
+
+// src/utils/atomic-write.ts
+import { randomBytes } from "crypto";
+import { open, readFile, rename, unlink } from "fs/promises";
+import { basename, dirname, join } from "path";
+async function readExisting(path) {
+  try {
+    return await readFile(path, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+async function atomicWriteText(path, text) {
+  let existing;
+  try {
+    existing = await readExisting(path);
+  } catch (error) {
+    return err("WRITE_FAILED", { path, phase: "read-existing", message: String(error) });
+  }
+  if (existing === text) return ok({ changed: false, existed: true });
+  const tmp = join(
+    dirname(path),
+    `.${basename(path)}.${process.pid}.${randomBytes(8).toString("hex")}.tmp`
+  );
+  try {
+    const handle = await open(tmp, "wx");
+    try {
+      await handle.writeFile(text, "utf8");
+      try {
+        await handle.sync();
+      } catch {
+      }
+    } finally {
+      await handle.close();
+    }
+    await rename(tmp, path);
+    return ok({ changed: true, existed: existing !== null });
+  } catch (error) {
+    try {
+      await unlink(tmp);
+    } catch {
+    }
+    return err("WRITE_FAILED", { path, phase: "atomic-write", message: String(error) });
+  }
+}
+
+export {
+  atomicWriteText
+};