skillwiki 0.10.110 → 0.10.112

package/dist/{chunk-5MV5SSRM.js → chunk-CKQPUHM2.js}

@@ -1,12 +1,14 @@
 #!/usr/bin/env node
 import {
-  err,
   extractFrontmatter,
-  ok,
   readPage,
   scanSensitiveContent,
   splitFrontmatter
-} from "./chunk-R2DJ7IJ5.js";
+} from "./chunk-TKX6PSWZ.js";
+import {
+  err,
+  ok
+} from "./chunk-7POLZOFY.js";
 
 // src/utils/vault-path-safety.ts
 import { lstatSync, realpathSync } from "fs";

package/dist/chunk-DOHWNPAZ.js

@@ -0,0 +1,60 @@
+#!/usr/bin/env node
+import {
+  parseDotenvFile,
+  resolveSkillwikiHome
+} from "./chunk-SKOLE6US.js";
+
+// src/utils/mcp-auth-env.ts
+import { join } from "path";
+var MCP_URL_ENV = "SKILLWIKI_MCP_URL";
+var MCP_TOKEN_ENV = "SKILLWIKI_MCP_TOKEN";
+var MCP_HOST_ID_ENV = "SKILLWIKI_HOST_ID";
+function nonEmptyEnvValue(value) {
+  if (typeof value !== "string") return void 0;
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+}
+function mcpAuthFromEnv(env) {
+  return {
+    url: nonEmptyEnvValue(env[MCP_URL_ENV]),
+    token: nonEmptyEnvValue(env[MCP_TOKEN_ENV]),
+    hostId: nonEmptyEnvValue(env[MCP_HOST_ID_ENV])
+  };
+}
+async function resolveMcpAuthEnv(input) {
+  const processAuth = mcpAuthFromEnv(input.env ?? process.env);
+  const dotenv = await parseDotenvFile(join(resolveSkillwikiHome(input.home, input.env), ".skillwiki", ".env"));
+  const fileAuth = mcpAuthFromEnv(dotenv);
+  return {
+    url: processAuth.url ?? fileAuth.url,
+    token: processAuth.token ?? fileAuth.token,
+    hostId: processAuth.hostId ?? fileAuth.hostId
+  };
+}
+async function mergeMcpAuthIntoEnv(home, env) {
+  const auth = await resolveMcpAuthEnv({ home, env });
+  const merged = { ...env };
+  if (auth.url && !nonEmptyEnvValue(env[MCP_URL_ENV])) merged[MCP_URL_ENV] = auth.url;
+  if (auth.token && !nonEmptyEnvValue(env[MCP_TOKEN_ENV])) merged[MCP_TOKEN_ENV] = auth.token;
+  if (auth.hostId && !nonEmptyEnvValue(env[MCP_HOST_ID_ENV])) merged[MCP_HOST_ID_ENV] = auth.hostId;
+  return merged;
+}
+function redactMcpSecret(text, secret) {
+  if (!secret || secret.length === 0 || !text.includes(secret)) return text;
+  return text.split(secret).join("[REDACTED]");
+}
+function isMcpOnlyLeaf(input) {
+  return !input.resolvedPath && Boolean(input.token) && !input.vaultSyncInstalled;
+}
+
+export {
+  MCP_URL_ENV,
+  MCP_TOKEN_ENV,
+  MCP_HOST_ID_ENV,
+  nonEmptyEnvValue,
+  mcpAuthFromEnv,
+  resolveMcpAuthEnv,
+  mergeMcpAuthIntoEnv,
+  redactMcpSecret,
+  isMcpOnlyLeaf
+};

package/dist/chunk-EE7W3GLA.js

@@ -0,0 +1,55 @@
+#!/usr/bin/env node
+import {
+  err,
+  ok
+} from "./chunk-7POLZOFY.js";
+
+// src/utils/atomic-write.ts
+import { randomBytes } from "crypto";
+import { open, readFile, rename, unlink } from "fs/promises";
+import { basename, dirname, join } from "path";
+async function readExisting(path) {
+  try {
+    return await readFile(path, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+}
+async function atomicWriteText(path, text) {
+  let existing;
+  try {
+    existing = await readExisting(path);
+  } catch (error) {
+    return err("WRITE_FAILED", { path, phase: "read-existing", message: String(error) });
+  }
+  if (existing === text) return ok({ changed: false, existed: true });
+  const tmp = join(
+    dirname(path),
+    `.${basename(path)}.${process.pid}.${randomBytes(8).toString("hex")}.tmp`
+  );
+  try {
+    const handle = await open(tmp, "wx");
+    try {
+      await handle.writeFile(text, "utf8");
+      try {
+        await handle.sync();
+      } catch {
+      }
+    } finally {
+      await handle.close();
+    }
+    await rename(tmp, path);
+    return ok({ changed: true, existed: existing !== null });
+  } catch (error) {
+    try {
+      await unlink(tmp);
+    } catch {
+    }
+    return err("WRITE_FAILED", { path, phase: "atomic-write", message: String(error) });
+  }
+}
+
+export {
+  atomicWriteText
+};

package/dist/chunk-FCA3RRNF.js

@@ -0,0 +1,60 @@
+#!/usr/bin/env node
+import {
+  atomicWriteText
+} from "./chunk-EE7W3GLA.js";
+
+// src/clip-outbox/journal.ts
+import { mkdir, readFile, open } from "fs/promises";
+import { dirname, join } from "path";
+import { z } from "zod";
+async function readJournal(stateRoot) {
+  let raw;
+  try {
+    raw = await readFile(join(stateRoot, "journal.json"), "utf8");
+  } catch (e) {
+    if (e.code === "ENOENT") return [];
+    throw e;
+  }
+  const key = z.string().regex(/^raw\/(articles|assets)\/[A-Za-z0-9._/-]+$/).refine((s) => s.split("/").every((p) => p && p !== "." && p !== ".."));
+  const schema = z.object({
+    captureId: z.string().regex(/^[a-f0-9]{16,32}$/),
+    snapshotId: z.string().regex(/^[a-f0-9]{16}$/).optional(),
+    source: z.string().optional(),
+    sourceSha256: z.string().regex(/^[a-f0-9]{64}$/).optional(),
+    articleKey: key.refine((s) => s.startsWith("raw/articles/")),
+    assetKeys: z.array(key.refine((s) => s.startsWith("raw/assets/"))),
+    sha256: z.record(z.string().regex(/^[a-f0-9]{64}$/)),
+    sizes: z.record(z.number().int().nonnegative()).optional(),
+    receipts: z.record(z.enum(["created", "idempotent"])).optional(),
+    state: z.enum(["discovered", "preparing", "sealed", "assets-verified", "article-verified", "notify-pending", "central-visible", "mirrored", "conflict", "held"]),
+    reason: z.string().optional(),
+    attempts: z.number().int().nonnegative().optional(),
+    updatedAt: z.string().optional(),
+    retryAt: z.number().finite().optional()
+  }).refine((e) => !e.sourceSha256 || e.snapshotId && [e.articleKey, ...e.assetKeys].every((k) => e.sha256[k] && e.sizes?.[k] !== void 0));
+  const result = z.array(schema).safeParse(JSON.parse(raw));
+  if (!result.success) throw new Error("invalid clip journal; retain and inspect it before restarting");
+  return result.data;
+}
+async function writeJournal(stateRoot, entries) {
+  await mkdir(stateRoot, { recursive: true, mode: 448 });
+  const result = await atomicWriteText(join(stateRoot, "journal.json"), JSON.stringify(entries, null, 2));
+  if (!result.ok) throw new Error("journal write failed");
+  for (const path of [stateRoot, dirname(stateRoot)]) {
+    const dir = await open(path, "r");
+    try {
+      await dir.sync();
+    } finally {
+      await dir.close();
+    }
+  }
+}
+function upsertJournal(entries, next) {
+  return [...entries.filter((e) => e.captureId !== next.captureId), next];
+}
+
+export {
+  readJournal,
+  writeJournal,
+  upsertJournal
+};

package/dist/{chunk-KX5Y3GSX.js → chunk-IR2DI4Y5.js}

@@ -1,13 +1,15 @@
 #!/usr/bin/env node
 import {
   ROOT_INDEX_SECTION_ORDER,
-  atomicWriteText,
   buildRootIndexUniverse
-} from "./chunk-WPJHDRTP.js";
+} from "./chunk-KJG2CSYD.js";
+import {
+  atomicWriteText
+} from "./chunk-EE7W3GLA.js";
 import {
   err,
   ok
-} from "./chunk-R2DJ7IJ5.js";
+} from "./chunk-7POLZOFY.js";
 
 // src/utils/index-projection.ts
 import { readFile } from "fs/promises";

package/dist/chunk-K3M6OSUW.js

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+
+// src/clip-outbox/files.ts
+import { constants } from "fs";
+import { lstat, mkdir, open, realpath } from "fs/promises";
+import { dirname, isAbsolute, relative, resolve, sep } from "path";
+async function readRegular(root, path, maxBytes) {
+  const rel = relative(root, path);
+  if (!rel || rel.startsWith(`..${sep}`) || rel === ".." || isAbsolute(rel)) throw new Error("unsafe input path");
+  let current = resolve(root);
+  for (const part of ["", ...rel.split(sep)]) {
+    current = resolve(current, part);
+    const st = await lstat(current);
+    if (st.isSymbolicLink()) throw new Error("symlink input refused");
+    if (current !== path && !st.isDirectory()) throw new Error("invalid input parent");
+  }
+  const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+  try {
+    const before = await handle.stat();
+    if (!before.isFile() || before.size > maxBytes) throw new Error("input type or size refused");
+    const bytes = Buffer.alloc(before.size + 1);
+    let bytesRead = 0;
+    while (bytesRead < bytes.length) {
+      const chunk = await handle.read(bytes, bytesRead, bytes.length - bytesRead, bytesRead);
+      if (chunk.bytesRead === 0) break;
+      bytesRead += chunk.bytesRead;
+    }
+    const after = await handle.stat();
+    if (await realpath(path) !== path) throw new Error("input path changed during read");
+    const leaf = await lstat(path);
+    if (leaf.ino !== before.ino || leaf.dev !== before.dev) throw new Error("input identity changed during read");
+    if (bytesRead !== before.size || after.size !== before.size || after.mtimeMs !== before.mtimeMs) throw new Error("input changed during read");
+    return bytes.subarray(0, bytesRead);
+  } finally {
+    await handle.close();
+  }
+}
+async function writeRegularExclusive(root, rel, body) {
+  const dest = resolve(root, ...rel.split("/"));
+  const checked = relative(root, dest);
+  if (!checked || checked.startsWith(`..${sep}`) || checked === ".." || isAbsolute(checked)) throw new Error("unsafe dest path");
+  let current = resolve(root);
+  const parts = checked.split(sep);
+  for (let i = 0; i < parts.length - 1; i++) {
+    current = resolve(current, parts[i]);
+    try {
+      const st = await lstat(current);
+      if (st.isSymbolicLink()) throw new Error("symlink dest refused");
+      if (!st.isDirectory()) throw new Error("invalid dest parent");
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+      await mkdir(current);
+    }
+  }
+  const leaf = resolve(current, parts[parts.length - 1]);
+  if (dirname(leaf) !== current) throw new Error("unsafe dest path");
+  try {
+    const handle = await open(leaf, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 420);
+    try {
+      await handle.writeFile(body);
+    } finally {
+      await handle.close();
+    }
+    return "created";
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+    const st = await lstat(leaf);
+    if (st.isSymbolicLink() || !st.isFile() || st.size !== body.length) return "conflict";
+    const existing = await readRegular(root, leaf, body.length);
+    return existing.equals(body) ? "idempotent" : "conflict";
+  }
+}
+
+export {
+  readRegular,
+  writeRegularExclusive
+};

package/dist/{chunk-WPJHDRTP.js → chunk-KJG2CSYD.js}

@@ -1,67 +1,23 @@
 #!/usr/bin/env node
+import {
+  extractFrontmatter,
+  scanSensitiveContent,
+  scanVault
+} from "./chunk-TKX6PSWZ.js";
 import {
   MetaSchema,
   TypedKnowledgeSchema,
   detectSchema,
   err,
-  extractFrontmatter,
-  ok,
-  scanSensitiveContent,
-  scanVault
-} from "./chunk-R2DJ7IJ5.js";
-
-// src/utils/atomic-write.ts
-import { randomBytes } from "crypto";
-import { open, readFile, rename, unlink } from "fs/promises";
-import { basename, dirname, join } from "path";
-async function readExisting(path) {
-  try {
-    return await readFile(path, "utf8");
-  } catch (error) {
-    if (error.code === "ENOENT") return null;
-    throw error;
-  }
-}
-async function atomicWriteText(path, text) {
-  let existing;
-  try {
-    existing = await readExisting(path);
-  } catch (error) {
-    return err("WRITE_FAILED", { path, phase: "read-existing", message: String(error) });
-  }
-  if (existing === text) return ok({ changed: false, existed: true });
-  const tmp = join(
-    dirname(path),
-    `.${basename(path)}.${process.pid}.${randomBytes(8).toString("hex")}.tmp`
-  );
-  try {
-    const handle = await open(tmp, "wx");
-    try {
-      await handle.writeFile(text, "utf8");
-      try {
-        await handle.sync();
-      } catch {
-      }
-    } finally {
-      await handle.close();
-    }
-    await rename(tmp, path);
-    return ok({ changed: true, existed: existing !== null });
-  } catch (error) {
-    try {
-      await unlink(tmp);
-    } catch {
-    }
-    return err("WRITE_FAILED", { path, phase: "atomic-write", message: String(error) });
-  }
-}
+  ok
+} from "./chunk-7POLZOFY.js";
 
 // src/utils/index-universe.ts
-import { readFile as readFile2 } from "fs/promises";
+import { readFile } from "fs/promises";
 
 // src/utils/typed-page.ts
 import { lstatSync, realpathSync } from "fs";
-import { dirname as dirname2, posix, relative, resolve, sep } from "path";
+import { dirname, posix, relative, resolve, sep } from "path";
 var TYPE_DIRECTORY = {
   entity: "entities",
   concept: "concepts",
@@ -86,7 +42,7 @@ function assertTargetInsideVault(vault, target) {
     return err("VAULT_PATH_INVALID", { target, message: "vault realpath failed" });
   }
   const absolutePath = resolve(vaultReal, target);
-  const parent = dirname2(absolutePath);
+  const parent = dirname(absolutePath);
   let parentReal;
   try {
     parentReal = realpathSync(parent);
@@ -201,7 +157,7 @@ async function buildRootIndexUniverse(input) {
   for (const page of typedPages) {
     let text;
     try {
-      text = await readFile2(page.absPath, "utf8");
+      text = await readFile(page.absPath, "utf8");
     } catch {
       continue;
     }
@@ -247,7 +203,7 @@ async function buildRootIndexUniverse(input) {
   for (const readme of projectReadmes) {
     let text;
     try {
-      text = await readFile2(readme.absPath, "utf8");
+      text = await readFile(readme.absPath, "utf8");
     } catch {
       continue;
     }
@@ -286,7 +242,6 @@ async function buildRootIndexUniverse(input) {
 }
 
 export {
-  atomicWriteText,
   assertTargetInsideVault,
   prepareTypedPage,
   ROOT_INDEX_SECTION_ORDER,

package/dist/chunk-LOVLZNLX.js

@@ -0,0 +1,111 @@
+#!/usr/bin/env node
+import {
+  ExitCode,
+  err,
+  ipv4InCidr,
+  isBlockedHost,
+  ok
+} from "./chunk-7POLZOFY.js";
+
+// src/commands/fetch-guard.ts
+var REDACT_PARAMS = /* @__PURE__ */ new Set(["api_key", "token", "key", "auth", "password", "secret", "access_token"]);
+var PATH_TOKEN_RE = /[A-Fa-f0-9]{32,}|[A-Za-z0-9_\-]{40,}/g;
+function runFetchGuard(input) {
+  return Promise.resolve(runFetchGuardSync(input));
+}
+function runFetchGuardSync(input) {
+  let u;
+  try {
+    u = new URL(input.url);
+  } catch {
+    return { exitCode: ExitCode.MALFORMED_URL, result: err("MALFORMED_URL", { url: input.url }) };
+  }
+  const sanitized = sanitizeUrl(u);
+  if (u.protocol !== "https:") {
+    return {
+      exitCode: ExitCode.SCHEME_REJECTED,
+      result: err("SCHEME_REJECTED", { sanitized_url: sanitized, scheme: u.protocol })
+    };
+  }
+  if (isBlockedHost(u.hostname)) {
+    return {
+      exitCode: ExitCode.HOST_BLOCKED,
+      result: err("HOST_BLOCKED", { sanitized_url: sanitized, host: u.hostname })
+    };
+  }
+  return { exitCode: ExitCode.OK, result: ok({ allowed: true, sanitized_url: sanitized, humanHint: `ALLOWED: ${sanitized}` }) };
+}
+function sanitizeUrl(u) {
+  const clone = new URL(u.toString());
+  if (clone.username || clone.password) {
+    clone.username = "";
+    clone.password = "";
+  }
+  for (const k of Array.from(clone.searchParams.keys())) {
+    if (REDACT_PARAMS.has(k.toLowerCase())) clone.searchParams.set(k, "REDACTED");
+  }
+  let s = clone.toString();
+  s = s.replace(PATH_TOKEN_RE, "REDACTED");
+  return s;
+}
+
+// src/clip-outbox/ssrf.ts
+import { isIP } from "net";
+import { lookup as dnsLookup } from "dns/promises";
+var extraBlockedV4 = [
+  ["0.0.0.0", 8],
+  ["100.64.0.0", 10],
+  ["192.0.2.0", 24],
+  ["198.18.0.0", 15],
+  ["198.51.100.0", 24],
+  ["203.0.113.0", 24],
+  ["224.0.0.0", 4],
+  ["240.0.0.0", 4]
+];
+function isBlockedAddress(address) {
+  if (isBlockedHost(address)) return true;
+  const version = isIP(address);
+  if (version === 4) {
+    return extraBlockedV4.some(([base, prefix]) => ipv4InCidr(address, base, prefix));
+  }
+  if (version === 6) {
+    const lower = address.toLowerCase();
+    return lower === "::" || lower === "::1" || lower.startsWith("fc") || lower.startsWith("fd") || lower.startsWith("fe80:");
+  }
+  return false;
+}
+async function assertPublicHttpsUrl(url, lookup = defaultLookup) {
+  const guard = runFetchGuardSync({ url });
+  if (!guard.result.ok) {
+    return { ok: false, reason: guard.result.error };
+  }
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return { ok: false, reason: "MALFORMED_URL" };
+  }
+  if (isBlockedAddress(parsed.hostname)) {
+    return { ok: false, reason: "HOST_BLOCKED" };
+  }
+  try {
+    const addresses = await lookup(parsed.hostname);
+    if (addresses.length === 0) return { ok: false, reason: "DNS_EMPTY" };
+    if (addresses.some(isBlockedAddress)) return { ok: false, reason: "HOST_BLOCKED" };
+  } catch {
+    return { ok: false, reason: "DNS_FAILED" };
+  }
+  return { ok: true, href: parsed.href };
+}
+async function defaultLookup(hostname) {
+  if (isIP(hostname)) return [hostname];
+  const v4 = await dnsLookup(hostname, { all: true, verbatim: true });
+  return v4.map((row) => row.address);
+}
+
+export {
+  runFetchGuard,
+  runFetchGuardSync,
+  assertPublicHttpsUrl,
+  defaultLookup
+};

package/dist/chunk-OSL4J7GF.js

@@ -0,0 +1,32 @@
+#!/usr/bin/env node
+
+// src/clip-outbox/ready.ts
+function buildReadyHint(vaultId, files) {
+  const assets = files.filter((f) => f.path.startsWith("raw/assets/"));
+  const articles = files.filter((f) => f.path.startsWith("raw/articles/"));
+  return { vault_id: vaultId, files: [...assets, ...articles] };
+}
+async function postReadyHint(opts) {
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const body = JSON.stringify(opts.hint);
+  if (Buffer.byteLength(body) > 32768) return { ok: false, status: 413 };
+  const res = await fetchImpl(opts.url, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${opts.token}`,
+      "Content-Type": "application/json"
+    },
+    body,
+    signal: AbortSignal.timeout(1e4),
+    redirect: "error"
+  });
+  if (!res.ok) return { ok: false, status: res.status };
+  const result = await res.json();
+  const paths = result.paths;
+  return result.ok === true && Array.isArray(paths) && opts.hint.files.every((f) => paths.includes(f.path)) ? { ok: true } : { ok: false, status: 503 };
+}
+
+export {
+  buildReadyHint,
+  postReadyHint
+};