skillwiki 0.10.97 → 0.10.100

package/dist/{chunk-EEO2YDPX.js → chunk-3QT3OFAL.js}

@@ -40,7 +40,7 @@ import {
   snapshotterAliasForLocalHost,
   toUndirectedWeighted,
   writeDotenv
-} from "./chunk-MRYWP5HY.js";
+} from "./chunk-B4QTKCEK.js";
 import {
   atomicWriteText,
   prepareTypedPage

package/dist/{chunk-MRYWP5HY.js → chunk-B4QTKCEK.js}

@@ -3439,7 +3439,7 @@ function buildCliSurface() {
   fleetCmd.command("context").option("--file <path>").option("--host-id <id>");
   fleetCmd.command("health").option("--file <path>").option("--host-id <id>").option("--json");
   const mcpAuth = program.commands.find((c) => c.name() === "mcp-auth");
-  mcpAuth.command("issue-host").requiredOption("--host-id <id>").option("--map <path>").option("--write");
+  mcpAuth.command("issue-host").requiredOption("--host-id <id>").option("--map <path>").option("--allowed-vaults <ids>").option("--write");
   const surface = /* @__PURE__ */ new Map();
   const rootFlags = new Set(program.options.map((o) => o.long ?? o.short).filter((f) => f != null));
   function walk(cmd, prefix, parentFlags) {

package/dist/cli.js

@@ -55,7 +55,7 @@ import {
   snapshotterHealthChecks,
   upsertIndexEntry,
   vectorIndexStatus
-} from "./chunk-EEO2YDPX.js";
+} from "./chunk-3QT3OFAL.js";
 import {
   normalizeDistTag,
   readCache,
@@ -160,7 +160,7 @@ import {
   supersedeStaleReviewRequiredJournals,
   taxonomyCommentForPage,
   writeDotenv
-} from "./chunk-MRYWP5HY.js";
+} from "./chunk-B4QTKCEK.js";
 import {
   assertTargetInsideVault,
   atomicWriteText,
@@ -10646,6 +10646,31 @@ import { readFileSync as readFileSync17, writeFileSync as writeFileSync8 } from
 import { createHash as createHash8, randomBytes } from "crypto";
 import yaml from "js-yaml";
 var HOST_ID_RE = /^[a-z][a-z0-9-]{1,62}$/;
+function writerIdFromValue(value) {
+  if (typeof value === "string" && value.length > 0) return value;
+  if (value && typeof value === "object" && !Array.isArray(value)) {
+    const rec = value;
+    if (typeof rec.writer_id === "string" && rec.writer_id.length > 0) return rec.writer_id;
+    if (typeof rec.host_id === "string" && rec.host_id.length > 0) return rec.host_id;
+  }
+  return void 0;
+}
+function parseAllowedVaultIds(raw) {
+  if (!raw || raw.length === 0) return { vaults: [] };
+  const vaults = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const item of raw) {
+    const id = item.trim();
+    if (!id) continue;
+    if (id.includes("*") || id.includes("/") || !HOST_ID_RE.test(id)) {
+      return { error: "INVALID_ALLOWED_VAULTS" };
+    }
+    if (seen.has(id)) continue;
+    seen.add(id);
+    vaults.push(id);
+  }
+  return { vaults };
+}
 function parseMcpTokenMap(yamlText) {
   const parsed = yaml.load(yamlText);
   const map = /* @__PURE__ */ new Map();
@@ -10655,12 +10680,13 @@ function parseMcpTokenMap(yamlText) {
   const records = parsed;
   const nested = records.tokens;
   const source = nested && typeof nested === "object" && !Array.isArray(nested) ? nested : records;
-  for (const [hash, hostId] of Object.entries(source)) {
+  for (const [hash, value] of Object.entries(source)) {
     if (hash === "tokens") continue;
-    if (typeof hostId !== "string" || hostId.length === 0) continue;
+    const writerId = writerIdFromValue(value);
+    if (!writerId) continue;
     const normalized = hash.trim().toLowerCase();
     if (!/^[0-9a-f]{64}$/.test(normalized)) continue;
-    map.set(normalized, hostId);
+    map.set(normalized, writerId);
   }
   return map;
 }
@@ -10670,10 +10696,22 @@ function generateHostBearer(rng) {
   const hashHex = createHash8("sha256").update(raw, "utf8").digest("hex");
   return { raw, hashHex };
 }
-function appendHostHash(yamlText, hashHex, hostId) {
+function formatHostRow(hashHex, hostId, allowedVaults) {
+  if (allowedVaults.length === 0) {
+    return `${hashHex}: ${hostId}
+`;
+  }
+  return `${hashHex}:
+  writer_id: ${hostId}
+  allowed_vaults: [${allowedVaults.join(", ")}]
+`;
+}
+function appendHostHash(yamlText, hashHex, hostId, allowedVaults) {
   if (!HOST_ID_RE.test(hostId)) {
     return { error: "INVALID_HOST_ID" };
   }
+  const granted = parseAllowedVaultIds(allowedVaults);
+  if ("error" in granted) return granted;
   const map = parseMcpTokenMap(yamlText);
   const normalizedHash = hashHex.trim().toLowerCase();
   if ([...map.values()].includes(hostId)) {
@@ -10683,8 +10721,7 @@ function appendHostHash(yamlText, hashHex, hostId) {
     return { error: "DUPLICATE_HASH" };
   }
   return { yaml: yamlText.replace(/\s*$/, "") + `
-${normalizedHash}: ${hostId}
-` };
+${formatHostRow(normalizedHash, hostId, granted.vaults)}` };
 }
 
 // src/commands/mcp-auth.ts
@@ -10706,6 +10743,8 @@ async function runMcpAuthIssueHost(input) {
   const hostId = input.hostId;
   if (!mapPath) return preflight("MAP_PATH_REQUIRED");
   if (!HOST_ID_RE.test(hostId)) return preflight("INVALID_HOST_ID");
+  const granted = parseAllowedVaultIds(input.allowedVaults);
+  if ("error" in granted) return preflight(granted.error);
   if (write && !isTty) return preflight("NO_TTY");
   let yamlText = "";
   try {
@@ -10722,12 +10761,13 @@ async function runMcpAuthIssueHost(input) {
         host_id: hostId,
         hash_prefix: "",
         map_path: mapPath,
-        wrote: false
+        wrote: false,
+        allowed_vaults: granted.vaults
       })
     };
   }
   const { raw, hashHex } = generateHostBearer(input.rng);
-  const appended = appendHostHash(yamlText, hashHex, hostId);
+  const appended = appendHostHash(yamlText, hashHex, hostId, granted.vaults);
   if ("error" in appended) return preflight(appended.error);
   try {
     writeFile10(mapPath, appended.yaml, { encoding: "utf8", mode: 416 });
@@ -10737,7 +10777,8 @@ async function runMcpAuthIssueHost(input) {
     }
     throw error;
   }
-  stderrWrite(`issued host_id=${hostId} copy once: ${raw}
+  const grantNote = granted.vaults.length > 0 ? ` allowed_vaults=${granted.vaults.join(",")}` : "";
+  stderrWrite(`issued host_id=${hostId}${grantNote} copy once: ${raw}
 `);
   return {
     exitCode: ExitCode.OK,
@@ -10745,7 +10786,8 @@ async function runMcpAuthIssueHost(input) {
       host_id: hostId,
       hash_prefix: hashHex.slice(0, 8),
       map_path: mapPath,
-      wrote: true
+      wrote: true,
+      allowed_vaults: granted.vaults
     })
   };
 }
@@ -10888,7 +10930,7 @@ async function emitManagedVaultWrite(vault, command, mutate, opts) {
   if (dirty) {
     return emit(dirty, void 0, { postCommit: false });
   }
-  const { runManagedWriteTransaction: runManagedWriteTransaction2 } = await import("./managed-write-preflight-THGIM2U7.js");
+  const { runManagedWriteTransaction: runManagedWriteTransaction2 } = await import("./managed-write-preflight-32523BPV.js");
   const run = await runManagedWriteTransaction2({
     vault,
     command,
@@ -12123,12 +12165,14 @@ program.command("mcp").description("start stdio Model Context Protocol server (r
   await runSkillwikiMcpStdio();
 });
 var mcpAuthCmd = program.command("mcp-auth").description("attended HTTP MCP host-id bearer issuance (metal)");
-mcpAuthCmd.command("issue-host").description("append a host-id hash to the metal map; print raw once on a TTY").requiredOption("--host-id <id>", "host identity to bind").option("--map <path>", "hash map file (defaults to SKILLWIKI_MCP_TOKEN_MAP)").option("--write", "append the hash (default is dry-run)", false).action(async (opts) => {
+mcpAuthCmd.command("issue-host").description("append a host-id hash to the metal map; print raw once on a TTY").requiredOption("--host-id <id>", "host identity to bind").option("--map <path>", "hash map file (defaults to SKILLWIKI_MCP_TOKEN_MAP)").option("--allowed-vaults <ids>", "comma-separated exact vault ids; omit for default vault only").option("--write", "append the hash (default is dry-run)", false).action(async (opts) => {
   const mapPath = opts.map || process.env.SKILLWIKI_MCP_TOKEN_MAP || "";
+  const allowedVaults = String(opts.allowedVaults ?? "").split(/[,\s]+/).map((id) => id.trim()).filter(Boolean);
   emit(await runMcpAuthIssueHost({
     hostId: String(opts.hostId),
     mapPath,
-    write: !!opts.write
+    write: !!opts.write,
+    allowedVaults
   }));
 });
 for (const w of getDeprecatedWarnings(process.env.HOME ?? "")) {

package/dist/{managed-write-preflight-THGIM2U7.js → managed-write-preflight-32523BPV.js}

@@ -6,7 +6,7 @@ import {
   runManagedWritePeerGate,
   runManagedWritePreflight,
   runManagedWriteTransaction
-} from "./chunk-MRYWP5HY.js";
+} from "./chunk-B4QTKCEK.js";
 import "./chunk-KDH352MC.js";
 import "./chunk-F5GFUYPF.js";
 import "./chunk-QM64LUEY.js";

package/dist/skillwiki-mcp.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import {
   runSkillwikiMcpStdio
-} from "./chunk-EEO2YDPX.js";
+} from "./chunk-3QT3OFAL.js";
 import "./chunk-7I2TPIV5.js";
 import "./chunk-XYXTV2YD.js";
-import "./chunk-MRYWP5HY.js";
+import "./chunk-B4QTKCEK.js";
 import "./chunk-KDH352MC.js";
 import "./chunk-H42EY6E7.js";
 import "./chunk-F5GFUYPF.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillwiki",
-  "version": "0.10.97",
+  "version": "0.10.100",
   "type": "module",
   "bin": {
     "skillwiki": "dist/cli.js",

package/skills/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "skillwiki",
-  "version": "0.10.97",
+  "version": "0.10.100",
   "skills": "./",
   "description": "Project-aware Karpathy-style knowledge base for Claude Code: 21 prompt-only skills (wiki-*, proj-*, using-skillwiki, skillwiki-mcp) backed by the deterministic `skillwiki` CLI.",
   "author": {

package/skills/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "skillwiki",
-  "version": "0.10.97",
+  "version": "0.10.100",
   "description": "Project-aware Karpathy-style knowledge base for Codex with 21 prompt-only skills backed by the deterministic skillwiki CLI.",
   "author": {
     "name": "karlorz",

package/skills/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "skillwiki",
-  "version": "0.10.97",
+  "version": "0.10.100",
   "description": "Project-aware Karpathy-style knowledge base: 21 prompt-only skills (wiki-*, proj-*, using-skillwiki, skillwiki-mcp) backed by HTTP MCP wiki_capture.",
   "author": {
     "name": "karlorz"
@@ -20,6 +20,11 @@
         "type": "string",
         "title": "SkillWiki HTTP MCP bearer",
         "description": "Bearer for https://wiki.karldigi.dev/mcp. Same SKILLWIKI_MCP_TOKEN used by Grok CLI. Never put the value in plugin files."
+      },
+      "SKILLWIKI_EXTRA_VAULTS": {
+        "type": "string",
+        "title": "SkillWiki extra vault ids",
+        "description": "Optional comma-separated extra vault ids (example: wiki-fin). Non-secret. Same connector URL https://wiki.karldigi.dev/mcp. Default central stays on. Server allowed_vaults is the security boundary; listing an extra here does not authorize it. Do not put a bearer in this field."
       }
     },
     "required": [

package/skills/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skillwiki/skills",
-  "version": "0.10.97",
+  "version": "0.10.100",
   "private": true,
   "files": [
     "wiki-*",

package/skills/skills/skillwiki-mcp/SKILL.md

@@ -14,7 +14,7 @@ SkillWiki captures are HTTP MCP only (`type: http`). Claude/Grok use `SKILLWIKI_
 ## First-run readiness
 
 - Resolve the installed plugin root from `GROK_PLUGIN_ROOT`, falling back to `CLAUDE_PLUGIN_ROOT`, and run `python3 "$PLUGIN_ROOT/scripts/check_readiness.py" --apply --json` before the first SkillWiki MCP call.
-- **Cursor / Grok Bot:** the Cursor-native plugin requires `SKILLWIKI_MCP_TOKEN` under **Plugins → Configure**. It pins `https://wiki.karldigi.dev/mcp`. Grok Bot does not inherit Mac process env or `~/.cursor/mcp.json`. `failed_to_load` with no token box means this package is missing; after this package is installed, Configure is the token field (same pattern as grok-search).
+- **Cursor / Grok Bot:** the Cursor-native plugin requires `SKILLWIKI_MCP_TOKEN` under **Plugins → Configure**. Optional non-secret `SKILLWIKI_EXTRA_VAULTS` (comma-separated vault ids such as `wiki-fin`) opts the client into extra vaults on the **same** connector URL. It is not a second connector, not a secret, and not written to `~/.cursor/mcp.json` or Grok `config.toml`. Server `allowed_vaults` remains the security boundary; an extra listed here but missing from the bearer still fails closed. Omit `vault=` on tools to use the handshake `default_vault` (central). Grok Bot does not inherit Mac process env or `~/.cursor/mcp.json`. `failed_to_load` with no token box means this package is missing; after this package is installed, Configure is the token field (same pattern as grok-search).
 - `missing_prereq` means `SKILLWIKI_MCP_TOKEN` is absent from process environment; stop and ask for a bearer. Do not invent a stdio MCP.
 - A new host (a machine that should write the wiki for the first time) needs an issued host-id bearer before handshake can pass. The operator runs `skillwiki mcp-auth issue-host --host-id <id> --write` on metal (TTY required). The client pastes the printed value into process env or host Configure. Do not auto-write `mcp.env`, `mcp.json`, or Grok `config.toml`. Do not invent a second admin skill. A local vault/FUSE mirror is optional.
 - First-run order: install plugin/CLI → operator issues on metal → paste into process env or Configure → **new session** → `skillwiki doctor --check-mcp` → one write (`wiki_capture`, work-item write, or page publish).
@@ -42,7 +42,7 @@ On leaf hosts, wiki captures go through MCP. Do **not** write `raw/transcripts/`
 
 ## Reads
 
-Local `~/wiki` (or `skillwiki path`) is fine for reads. MCP read tools are optional. Prefer ordinary file reads of the local mirror.
+Local `~/wiki` (or `skillwiki path`) is fine for reads. MCP read tools are optional. Prefer ordinary file reads of the local mirror. Frozen-leaf agents should use HTTP `wiki_sources_pending`, `wiki_lint_summary`, `wiki_stale`, `wiki_compile_status`, and `wiki_reviews` instead of local CLI commands when those tools are advertised.
 
 `wiki_query` is typed knowledge only unless `scope` is `work` or `all`. For queued work, doctor, plugin-drift, or MCP diagnose questions, call `wiki_context` first (active_work) or pass `scope: "work"` / `"all"`. Do not treat a top typed packet hit as the live work queue.
 

package/skills/skills/wiki-lint/SKILL.md

@@ -12,7 +12,7 @@ Standard four reads.
 0. Resolve vault: `skillwiki path` (record source for context).
 - **CRITICAL**: Verify the correct vault when the user has multiple wiki instances (e.g., ~/wiki vs ~/wiki-fin). User may explicitly specify which vault to target — confirm before destructive operations.
 1. For a whole-system health report, run `skillwiki health <vault> --out /tmp/skillwiki-health.json --no-fail`. Read the JSON envelope from stdout or the report file. Treat `skillwiki doctor` as setup/runtime diagnostics only, not a vault-content health report. HTTP MCP URL, pin lag, handshake, and frozen-leaf write-path belong to `skillwiki doctor` (pass `--check-mcp` for the live handshake). Do not use this skill for client/plugin fleet upgrades.
-2. For lint-only maintenance, run `skillwiki lint <vault> --summary`. This returns bounded bucket counts, capped examples, and `details_command` hints without full item arrays.
+2. For lint-only maintenance, run `skillwiki lint <vault> --summary`. This returns bounded bucket counts, capped examples, and `details_command` hints without full item arrays. On a frozen leaf, if live HTTP MCP advertises `wiki_lint_summary`, call that tool instead of local CLI lint.
 3. Drill into important buckets with `skillwiki lint <vault> --only <bucket>` when examples are insufficient for remediation.
 4. Reason over findings; present grouped by severity with concrete suggested actions per kind. If the CLI was recently updated with new lint checks, re-running lint on the full vault may flag pre-existing pages that predate the new rule — treat these as legitimate findings, not false positives.
 5. Treat `sensitive_content` as a security error. Drill down with `skillwiki lint <vault> --only sensitive_content --human`; never print the secret value. Raw findings are report/quarantine-only: `--fix` must not redact, rewrite, or recompute existing raw evidence. Maintained-page repairs may proceed only through their approved write workflow.

package/skills/skillwiki-mcp/SKILL.md

@@ -14,7 +14,7 @@ SkillWiki captures are HTTP MCP only (`type: http`). Claude/Grok use `SKILLWIKI_
 ## First-run readiness
 
 - Resolve the installed plugin root from `GROK_PLUGIN_ROOT`, falling back to `CLAUDE_PLUGIN_ROOT`, and run `python3 "$PLUGIN_ROOT/scripts/check_readiness.py" --apply --json` before the first SkillWiki MCP call.
-- **Cursor / Grok Bot:** the Cursor-native plugin requires `SKILLWIKI_MCP_TOKEN` under **Plugins → Configure**. It pins `https://wiki.karldigi.dev/mcp`. Grok Bot does not inherit Mac process env or `~/.cursor/mcp.json`. `failed_to_load` with no token box means this package is missing; after this package is installed, Configure is the token field (same pattern as grok-search).
+- **Cursor / Grok Bot:** the Cursor-native plugin requires `SKILLWIKI_MCP_TOKEN` under **Plugins → Configure**. Optional non-secret `SKILLWIKI_EXTRA_VAULTS` (comma-separated vault ids such as `wiki-fin`) opts the client into extra vaults on the **same** connector URL. It is not a second connector, not a secret, and not written to `~/.cursor/mcp.json` or Grok `config.toml`. Server `allowed_vaults` remains the security boundary; an extra listed here but missing from the bearer still fails closed. Omit `vault=` on tools to use the handshake `default_vault` (central). Grok Bot does not inherit Mac process env or `~/.cursor/mcp.json`. `failed_to_load` with no token box means this package is missing; after this package is installed, Configure is the token field (same pattern as grok-search).
 - `missing_prereq` means `SKILLWIKI_MCP_TOKEN` is absent from process environment; stop and ask for a bearer. Do not invent a stdio MCP.
 - A new host (a machine that should write the wiki for the first time) needs an issued host-id bearer before handshake can pass. The operator runs `skillwiki mcp-auth issue-host --host-id <id> --write` on metal (TTY required). The client pastes the printed value into process env or host Configure. Do not auto-write `mcp.env`, `mcp.json`, or Grok `config.toml`. Do not invent a second admin skill. A local vault/FUSE mirror is optional.
 - First-run order: install plugin/CLI → operator issues on metal → paste into process env or Configure → **new session** → `skillwiki doctor --check-mcp` → one write (`wiki_capture`, work-item write, or page publish).
@@ -42,7 +42,7 @@ On leaf hosts, wiki captures go through MCP. Do **not** write `raw/transcripts/`
 
 ## Reads
 
-Local `~/wiki` (or `skillwiki path`) is fine for reads. MCP read tools are optional. Prefer ordinary file reads of the local mirror.
+Local `~/wiki` (or `skillwiki path`) is fine for reads. MCP read tools are optional. Prefer ordinary file reads of the local mirror. Frozen-leaf agents should use HTTP `wiki_sources_pending`, `wiki_lint_summary`, `wiki_stale`, `wiki_compile_status`, and `wiki_reviews` instead of local CLI commands when those tools are advertised.
 
 `wiki_query` is typed knowledge only unless `scope` is `work` or `all`. For queued work, doctor, plugin-drift, or MCP diagnose questions, call `wiki_context` first (active_work) or pass `scope: "work"` / `"all"`. Do not treat a top typed packet hit as the live work queue.
 

package/skills/wiki-lint/SKILL.md

@@ -12,7 +12,7 @@ Standard four reads.
 0. Resolve vault: `skillwiki path` (record source for context).
 - **CRITICAL**: Verify the correct vault when the user has multiple wiki instances (e.g., ~/wiki vs ~/wiki-fin). User may explicitly specify which vault to target — confirm before destructive operations.
 1. For a whole-system health report, run `skillwiki health <vault> --out /tmp/skillwiki-health.json --no-fail`. Read the JSON envelope from stdout or the report file. Treat `skillwiki doctor` as setup/runtime diagnostics only, not a vault-content health report. HTTP MCP URL, pin lag, handshake, and frozen-leaf write-path belong to `skillwiki doctor` (pass `--check-mcp` for the live handshake). Do not use this skill for client/plugin fleet upgrades.
-2. For lint-only maintenance, run `skillwiki lint <vault> --summary`. This returns bounded bucket counts, capped examples, and `details_command` hints without full item arrays.
+2. For lint-only maintenance, run `skillwiki lint <vault> --summary`. This returns bounded bucket counts, capped examples, and `details_command` hints without full item arrays. On a frozen leaf, if live HTTP MCP advertises `wiki_lint_summary`, call that tool instead of local CLI lint.
 3. Drill into important buckets with `skillwiki lint <vault> --only <bucket>` when examples are insufficient for remediation.
 4. Reason over findings; present grouped by severity with concrete suggested actions per kind. If the CLI was recently updated with new lint checks, re-running lint on the full vault may flag pre-existing pages that predate the new rule — treat these as legitimate findings, not false positives.
 5. Treat `sensitive_content` as a security error. Drill down with `skillwiki lint <vault> --only sensitive_content --human`; never print the secret value. Raw findings are report/quarantine-only: `--fix` must not redact, rewrite, or recompute existing raw evidence. Maintained-page repairs may proceed only through their approved write workflow.