skillwiki 0.9.63 → 0.10.1

package/dist/index-projection-ERFX76U5.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+import {
+  renderRootIndex,
+  writeRootIndexProjection
+} from "./chunk-IZABIE44.js";
+import "./chunk-C5OLZRRM.js";
+export {
+  renderRootIndex,
+  writeRootIndexProjection
+};

package/dist/managed-write-preflight-PW4OOOMV.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+import {
+  runManagedWritePreflight,
+  runManagedWriteTransaction
+} from "./chunk-SCGC7YNM.js";
+import "./chunk-R6BKJWVC.js";
+import "./chunk-C5OLZRRM.js";
+export {
+  runManagedWritePreflight,
+  runManagedWriteTransaction
+};

package/dist/skillwiki-mcp.js

@@ -1,8 +1,11 @@
 #!/usr/bin/env node
 import {
   runSkillwikiMcpStdio
-} from "./chunk-TUFQZ5K4.js";
+} from "./chunk-XSTXPA34.js";
 import "./chunk-7I2TPIV5.js";
+import "./chunk-IZABIE44.js";
+import "./chunk-R6BKJWVC.js";
+import "./chunk-C5OLZRRM.js";
 
 // src/mcp-entry.ts
 runSkillwikiMcpStdio().catch((error) => {

package/dist/vault-sync/scripts/lib/conflict-markers.sh

@@ -0,0 +1,69 @@
+#!/bin/sh
+# conflict-markers.sh — Detect complete Git conflict-marker blocks in Markdown.
+#
+# Scans *.md under a vault root, ignoring fenced code blocks. Writes findings
+# as path:line: conflict marker block starts here. No ripgrep dependency.
+
+vault_sync_scan_conflict_markers() {
+    local root="$1"
+    local out_file="$2"
+    local rel file
+
+    : >"$out_file" || return 1
+    (
+        cd "$root" || exit 2
+        find . \
+            -path './.git' -prune -o \
+            -path './.obsidian' -prune -o \
+            -path './.skillwiki' -prune -o \
+            -path './.claude' -prune -o \
+            -path './.antigravitycli' -prune -o \
+            -path './.playwright-cli' -prune -o \
+            -type f -name '*.md' -print
+    ) | while IFS= read -r file; do
+        rel="${file#./}"
+        awk -v path="$rel" '
+          BEGIN {
+            in_fence = 0
+            open_line = 0
+            sep_line = 0
+          }
+          /^```/ || /^~~~/ {
+            in_fence = !in_fence
+            next
+          }
+          in_fence {
+            next
+          }
+          /^<<<<<<< / {
+            open_line = NR
+            sep_line = 0
+            next
+          }
+          /^=======$/ {
+            if (open_line > 0) {
+              sep_line = NR
+            }
+            next
+          }
+          /^>>>>>>> / {
+            if (open_line > 0 && sep_line > 0) {
+              printf "%s:%d: conflict marker block starts here\n", path, open_line
+            }
+            open_line = 0
+            sep_line = 0
+            next
+          }
+        ' "$root/$rel" >>"$out_file"
+    done
+
+    [ ! -s "$out_file" ]
+}
+
+vault_sync_log_conflict_marker_findings() {
+    local findings_file="$1"
+    local log_file="$2"
+    if [ -s "$findings_file" ]; then
+        cat "$findings_file" >>"$log_file"
+    fi
+}

package/dist/vault-sync/scripts/lib/delete-intent.sh

@@ -0,0 +1,74 @@
+#!/bin/bash
+# delete-intent.sh — helpers for vault-delete-intent/v1 tombstones under
+# meta/delete-intents/. Used by wiki-push (S3 prune) and wiki-snapshot
+# (no-resurrect). Prefer reading from a vault worktree directory.
+
+# Print active delete-intent paths (one per line) from VAULT/meta/delete-intents.
+# Requires python3 for JSON. Silent empty on missing dir.
+delete_intent_list_active_paths() {
+    local vault="${1:-}"
+    local dir
+    [ -n "$vault" ] || return 0
+    dir="$vault/meta/delete-intents"
+    [ -d "$dir" ] || return 0
+
+    python3 - "$dir" <<'PY'
+import json, os, sys
+from datetime import datetime, timezone
+
+d = sys.argv[1]
+now = datetime.now(timezone.utc)
+paths = []
+for name in sorted(os.listdir(d)):
+    if not name.endswith(".json"):
+        continue
+    path = os.path.join(d, name)
+    try:
+        with open(path, "r", encoding="utf-8") as f:
+            data = json.load(f)
+    except Exception:
+        continue
+    if data.get("schema") != "vault-delete-intent/v1":
+        continue
+    p = data.get("path")
+    if not p or not data.get("action"):
+        continue
+    exp = data.get("expires")
+    if exp not in (None, ""):
+        try:
+            # support Z suffix
+            exp_s = str(exp).replace("Z", "+00:00")
+            exp_dt = datetime.fromisoformat(exp_s)
+            if exp_dt.tzinfo is None:
+                exp_dt = exp_dt.replace(tzinfo=timezone.utc)
+            if exp_dt <= now:
+                continue
+        except Exception:
+            continue
+    paths.append(p)
+for p in sorted(set(paths)):
+    print(p)
+PY
+}
+
+# List active paths by reading JSON blobs from git ref (default origin/main).
+# WORKTREE must be a git checkout; REF defaults to origin/main.
+delete_intent_list_active_paths_from_git() {
+    local worktree="${1:-}"
+    local ref="${2:-origin/main}"
+    [ -n "$worktree" ] || return 0
+    [ -d "$worktree/.git" ] || [ -f "$worktree/.git" ] || return 0
+
+    local tmp
+    tmp="$(mktemp -d)" || return 0
+    (
+        cd "$worktree" || exit 0
+        git ls-tree -r --name-only "$ref" -- meta/delete-intents/ 2>/dev/null | while IFS= read -r rel; do
+            [ -z "$rel" ] && continue
+            mkdir -p "$tmp/$(dirname "$rel")"
+            git show "$ref:$rel" > "$tmp/$rel" 2>/dev/null || true
+        done
+    )
+    delete_intent_list_active_paths "$tmp"
+    rm -rf "$tmp"
+}

package/dist/vault-sync/scripts/lib/fleet.sh

@@ -0,0 +1,103 @@
+#!/bin/sh
+# fleet.sh — Fleet manifest parsing for vault-sync.
+#
+# Reads fleet.yaml from the vault and provides role enforcement.
+# Uses yq if available, awk fallback for the limited schema.
+
+# Populate VS_FLEET_* env from YAML.
+# Uses yq if available, awk fallback otherwise.
+fleet_load() {
+  _fleet_file=""
+  if command -v skillwiki >/dev/null 2>&1; then
+    _vault_path=$(skillwiki path 2>/dev/null | python3 -c "import json,sys; print(json.load(sys.stdin)['data']['path'])" 2>/dev/null) || true
+    if [ -n "${_vault_path:-}" ]; then
+      _fleet_file="$_vault_path/projects/llm-wiki/architecture/fleet.yaml"
+    fi
+  fi
+
+  # Fallback: guess from WIKI_DIR
+  if [ -z "${_fleet_file:-}" ] || [ ! -f "$_fleet_file" ]; then
+    _wiki_dir="${WIKI_DIR:-$HOME/wiki}"
+    _fleet_file="$_wiki_dir/projects/llm-wiki/architecture/fleet.yaml"
+  fi
+
+  if [ ! -f "$_fleet_file" ]; then
+    VS_FLEET_LOADED=false
+    export VS_FLEET_LOADED
+    return 0
+  fi
+
+  VS_FLEET_FILE="$_fleet_file"
+  VS_FLEET_LOADED=true
+  export VS_FLEET_FILE VS_FLEET_LOADED
+}
+
+# Echo: hostname of current snapshotter, or "" if none.
+fleet_get_snapshotter() {
+  if [ "${VS_FLEET_LOADED:-false}" != "true" ]; then
+    fleet_load
+  fi
+  if [ "${VS_FLEET_LOADED:-false}" != "true" ]; then
+    echo ""
+    return 0
+  fi
+
+  if command -v yq >/dev/null 2>&1; then
+    yq '.hosts | to_entries[] | select(.value.role == "snapshotter") | .key' "$VS_FLEET_FILE" 2>/dev/null
+  else
+    # awk fallback: find the host with role: snapshotter
+    awk '/^  [a-z0-9_-]+:/{host=$1; gsub(/:/,"",host)} /role: snapshotter/{print host; exit}' "$VS_FLEET_FILE" 2>/dev/null
+  fi
+}
+
+# Exit 0 if host is marked protected: true, 1 otherwise.
+fleet_is_protected() {
+  _host="$1"
+  if [ "${VS_FLEET_LOADED:-false}" != "true" ]; then
+    fleet_load
+  fi
+  if [ "${VS_FLEET_LOADED:-false}" != "true" ]; then
+    return 1
+  fi
+
+  if command -v yq >/dev/null 2>&1; then
+    _prot=$(yq ".hosts.$_host.protected // false" "$VS_FLEET_FILE" 2>/dev/null)
+    [ "$_prot" = "true" ]
+  else
+    # awk fallback: find protected: true under the host key
+    awk -v h="$_host" '
+      $0 ~ "^  " h ":" { in_host=1; next }
+      /^  [a-z]/ { in_host=0 }
+      in_host && /protected: true/ { found=1; exit }
+      END { exit (found ? 0 : 1) }
+    ' "$VS_FLEET_FILE" 2>/dev/null
+  fi
+}
+
+# Exit 0 if install is safe, non-zero with reason if not.
+fleet_validate_install() {
+  _host="$1"
+  _role="$2"
+  _override="${3:-false}"
+
+  if [ "${VS_FLEET_LOADED:-false}" != "true" ]; then
+    fleet_load
+  fi
+
+  # If role is not snapshotter, install is always safe
+  if [ "$_role" != "snapshotter" ]; then
+    return 0
+  fi
+
+  # Check if a snapshotter already exists
+  _current=$(fleet_get_snapshotter)
+  if [ -n "$_current" ] && [ "$_current" != "$_host" ]; then
+    if [ "$_override" != "true" ]; then
+      echo "FATAL: host '$_current' is already the snapshotter. Use --override-snapshotter to force." >&2
+      return 1
+    fi
+    echo "WARNING: overriding snapshotter from '$_current' to '$_host'" >&2
+  fi
+
+  return 0
+}

package/dist/vault-sync/scripts/lib/git-case.sh

@@ -0,0 +1,71 @@
+#!/bin/sh
+# git-case.sh — Detect case-only path collisions before unattended git writes.
+#
+# Case-insensitive filesystems cannot represent two paths that differ only by
+# letter case. If Linux commits such a tree, macOS checkouts can become
+# permanently dirty and unable to rebase. These helpers return nonzero and print
+# conflicting pairs when a repo contains such paths.
+
+git_case_index_conflicts() {
+  git ls-files 2>/dev/null | awk '
+    {
+      key = tolower($0)
+      if (seen[key] && seen[key] != $0) {
+        print seen[key] " <-> " $0
+        bad = 1
+      } else if (!seen[key]) {
+        seen[key] = $0
+      }
+    }
+    END { exit bad ? 1 : 0 }
+  '
+}
+
+git_case_worktree_conflicts() {
+  find . -type f \
+    ! -path './.git/*' \
+    ! -path './.snapshots/*' \
+    -print 2>/dev/null |
+    sed 's#^\./##' |
+    awk '
+      {
+        key = tolower($0)
+        if (seen[key] && seen[key] != $0) {
+          print seen[key] " <-> " $0
+          bad = 1
+        } else if (!seen[key]) {
+          seen[key] = $0
+        }
+      }
+      END { exit bad ? 1 : 0 }
+    '
+}
+
+git_case_conflicts() {
+  _git_case_tmp="${TMPDIR:-/tmp}/vault-sync-case-conflicts.$$"
+  : >"$_git_case_tmp"
+
+  git_case_index_conflicts >>"$_git_case_tmp" || true
+  git_case_worktree_conflicts >>"$_git_case_tmp" || true
+
+  if [ -s "$_git_case_tmp" ]; then
+    sort -u "$_git_case_tmp"
+    rm -f "$_git_case_tmp"
+    return 1
+  fi
+
+  rm -f "$_git_case_tmp"
+  return 0
+}
+
+git_case_assert_clean() {
+  _git_case_label="${1:-repository}"
+  _git_case_conflicts="$(git_case_conflicts)"
+  _git_case_rc=$?
+  if [ "$_git_case_rc" -ne 0 ]; then
+    printf 'FATAL: case-only path collision in %s\n' "$_git_case_label" >&2
+    printf '%s\n' "$_git_case_conflicts" >&2
+    return 1
+  fi
+  return 0
+}

package/dist/vault-sync/scripts/lib/git-materialization.sh

@@ -0,0 +1,264 @@
+#!/bin/bash
+# git-materialization.sh — prove a local commit's content is already present on a target ref.
+#
+# Bash 3.2 compatible. Source from vault-sync scripts.
+#
+# vault_sync_commit_materialized <commit> <target-ref> [repo]
+#   Exit 0 only when every changed path is proven present in the target tree:
+#   - ordinary add/modify: target blob == commit blob
+#   - delete: target path absent
+#   - log.md / */log.md: every added ## section body occurs byte-for-byte in target log
+#   Fail closed (exit 1) on rename, binary mismatch, missing target, unsupported status,
+#   partial log section match, or any unprovable change.
+
+vault_sync_is_log_path() {
+    case "$1" in
+        log.md|*/log.md) return 0 ;;
+        *) return 1 ;;
+    esac
+}
+
+# Return 0 if file contains at least one NUL byte (binary). Do NOT use
+# `grep -q $'\0'` — on macOS BSD grep that matches every non-empty file.
+vault_sync_file_has_nul() {
+    local f="$1"
+    [ -f "$f" ] || return 1
+    # Compare original to a NUL-stripped copy; differ ⇒ had NUL.
+    if ! tr -d '\0' <"$f" | cmp -s - "$f"; then
+        return 0
+    fi
+    return 1
+}
+
+# Extract Markdown sections starting at ^##  from stdin; print each section
+# separated by a form-feed so callers can compare complete bodies.
+vault_sync_extract_h2_sections() {
+    awk '
+        BEGIN { sec = ""; insec = 0 }
+        /^## / {
+            if (insec && sec != "") {
+                printf "%s\f", sec
+            }
+            sec = $0 "\n"
+            insec = 1
+            next
+        }
+        insec {
+            sec = sec $0 "\n"
+        }
+        END {
+            if (insec && sec != "") {
+                printf "%s\f", sec
+            }
+        }
+    '
+}
+
+# Return 0 if every added ## section in new_file appears byte-for-byte in target_file.
+vault_sync_log_sections_materialized() {
+    local new_file="$1"
+    local target_file="$2"
+    local old_file="${3:-}"
+    local new_secs target_text sec old_secs sec_file rc
+
+    if [ ! -f "$new_file" ] || [ ! -f "$target_file" ]; then
+        return 1
+    fi
+
+    new_secs="$(vault_sync_extract_h2_sections < "$new_file")"
+    target_text="$(cat "$target_file")"
+    old_secs=""
+    if [ -n "$old_file" ] && [ -f "$old_file" ]; then
+        old_secs="$(vault_sync_extract_h2_sections < "$old_file")"
+    fi
+
+    # Write sections to a temp file and iterate without a pipeline subshell
+    # so a missing section can fail the function itself (Bash 3.2-safe).
+    sec_file="$(mktemp)" || return 1
+    printf '%s' "$new_secs" > "$sec_file"
+    rc=0
+    while IFS= read -r -d $'\f' sec || [ -n "${sec:-}" ]; do
+        [ -n "${sec:-}" ] || continue
+        if [ -n "$old_secs" ]; then
+            case "$old_secs" in
+                *"$sec"*) continue ;;
+            esac
+        fi
+        case "$target_text" in
+            *"$sec"*) ;;
+            *) rc=1; break ;;
+        esac
+    done < "$sec_file"
+    rm -f "$sec_file"
+    return $rc
+}
+
+# Prove commit is fully materialized on target-ref.
+vault_sync_commit_materialized() {
+    local commit="$1"
+    local target_ref="$2"
+    local repo="${3:-.}"
+    local parent status path tmpdir old_blob new_blob target_blob
+    local commit_sha target_sha
+    local changed=0
+
+    if [ -z "$commit" ] || [ -z "$target_ref" ]; then
+        return 1
+    fi
+    if ! git -C "$repo" rev-parse -q --verify "$commit^{commit}" >/dev/null 2>&1; then
+        return 1
+    fi
+    if ! git -C "$repo" rev-parse -q --verify "$target_ref^{commit}" >/dev/null 2>&1; then
+        return 1
+    fi
+
+    parent="$(git -C "$repo" rev-parse "${commit}^" 2>/dev/null || true)"
+    if [ -z "$parent" ]; then
+        return 1
+    fi
+
+    while IFS= read -r line; do
+        [ -n "$line" ] || continue
+        changed=1
+        status="${line%%	*}"
+        path="${line#*	}"
+        case "$status" in
+            R*|C*)
+                return 1
+                ;;
+            A|M|D|T)
+                ;;
+            *)
+                return 1
+                ;;
+        esac
+
+        case "$path" in
+            *$'\t'*) return 1 ;;
+        esac
+
+        if vault_sync_is_log_path "$path"; then
+            if [ "$status" = "D" ]; then
+                if git -C "$repo" cat-file -e "$target_ref:$path" 2>/dev/null; then
+                    return 1
+                fi
+                continue
+            fi
+            tmpdir="$(mktemp -d)" || return 1
+            old_blob="$tmpdir/old"
+            new_blob="$tmpdir/new"
+            target_blob="$tmpdir/target"
+            if [ "$status" = "A" ]; then
+                : > "$old_blob"
+            else
+                if ! git -C "$repo" show "$parent:$path" >"$old_blob" 2>/dev/null; then
+                    rm -rf "$tmpdir"
+                    return 1
+                fi
+            fi
+            if ! git -C "$repo" show "$commit:$path" >"$new_blob" 2>/dev/null; then
+                rm -rf "$tmpdir"
+                return 1
+            fi
+            if ! git -C "$repo" show "$target_ref:$path" >"$target_blob" 2>/dev/null; then
+                rm -rf "$tmpdir"
+                return 1
+            fi
+            # Real binary/NUL check (not BSD-grep $'\0', which false-positives on text).
+            if vault_sync_file_has_nul "$new_blob" || vault_sync_file_has_nul "$target_blob"; then
+                rm -rf "$tmpdir"
+                return 1
+            fi
+            if ! vault_sync_log_sections_materialized "$new_blob" "$target_blob" "$old_blob"; then
+                rm -rf "$tmpdir"
+                return 1
+            fi
+            rm -rf "$tmpdir"
+            continue
+        fi
+
+        case "$status" in
+            D)
+                if git -C "$repo" cat-file -e "$target_ref:$path" 2>/dev/null; then
+                    return 1
+                fi
+                ;;
+            A|M|T)
+                if ! git -C "$repo" cat-file -e "$commit:$path" 2>/dev/null; then
+                    return 1
+                fi
+                if ! git -C "$repo" cat-file -e "$target_ref:$path" 2>/dev/null; then
+                    return 1
+                fi
+                commit_sha="$(git -C "$repo" rev-parse "$commit:$path" 2>/dev/null)" || return 1
+                target_sha="$(git -C "$repo" rev-parse "$target_ref:$path" 2>/dev/null)" || return 1
+                if [ "$commit_sha" != "$target_sha" ]; then
+                    return 1
+                fi
+                ;;
+        esac
+    done < <(git -C "$repo" diff-tree --no-commit-id --name-status -r "$parent" "$commit" 2>/dev/null)
+
+    # Empty commit (no path changes): nothing to replay, treat as materialized.
+    return 0
+}
+
+vault_sync_list_materialized_commits() {
+    local base_ref="$1"
+    local target_ref="$2"
+    local out_file="$3"
+    local repo="${4:-.}"
+    local sha
+
+    : > "$out_file"
+    while IFS= read -r sha; do
+        [ -n "$sha" ] || continue
+        if vault_sync_commit_materialized "$sha" "$target_ref" "$repo"; then
+            # Store full SHA for robust matching in the sequence editor.
+            git -C "$repo" rev-parse "$sha" >> "$out_file" 2>/dev/null || printf '%s\n' "$sha" >> "$out_file"
+        fi
+    done < <(git -C "$repo" rev-list --reverse "${base_ref}..HEAD" 2>/dev/null)
+    return 0
+}
+
+# Drop matching pick lines entirely (portable; avoids relying on `drop` verb).
+# Usage: vault_sync_sequence_editor_drop <drop-list-file> <todo-file>
+vault_sync_sequence_editor_drop() {
+    local drop_list="$1"
+    local todo_file="$2"
+    local tmp line rest sha full
+
+    tmp="$(mktemp)" || return 1
+    while IFS= read -r line || [ -n "$line" ]; do
+        case "$line" in
+            "pick "*|"p "*)
+                rest="${line#* }"
+                sha="${rest%% *}"
+                full=""
+                # Match if any full SHA in drop list starts with the todo short/long sha,
+                # or the todo sha starts with a drop-list entry.
+                if [ -s "$drop_list" ]; then
+                    while IFS= read -r full || [ -n "$full" ]; do
+                        [ -n "$full" ] || continue
+                        case "$full" in
+                            "$sha"*)
+                                # omit this pick line (drop)
+                                continue 2
+                                ;;
+                        esac
+                        case "$sha" in
+                            "$full"*)
+                                continue 2
+                                ;;
+                        esac
+                    done < "$drop_list"
+                fi
+                printf '%s\n' "$line" >> "$tmp"
+                ;;
+            *)
+                printf '%s\n' "$line" >> "$tmp"
+                ;;
+        esac
+    done < "$todo_file"
+    mv "$tmp" "$todo_file"
+}