skybridge 1.2.7 → 1.3.1

package/dist/server/skills-integration.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills-integration.test.js","sourceRoot":"","sources":["../../src/server/skills-integration.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EACL,mBAAmB,EACnB,SAAS,GAEV,MAAM,YAAY,CAAC;AAEpB,MAAM,QAAQ,GAAmB;IAC/B;QACE,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE;QAC1D,MAAM,EAAE,iBAAiB;QACzB,KAAK,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE;KAChC;CACF,CAAC;AAEF,SAAS,YAAY,CAAC,MAAiB;IACrC,OACE,MAAM,CAAC,MAGR,CAAC,aAAa,EAAE,UAAU,CAAC;AAC9B,CAAC;AAED,SAAS,uBAAuB,CAAC,MAAiB;IAChD,MAAM,UAAU,GACd,MAID,CAAC,oBAAoB,CAAC;IACvB,OAAO,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACnD,CAAC;AAED,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,0FAA0F,EAAE,GAAG,EAAE;QAClG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,EAC/B,EAAE,YAAY,EAAE,EAAE,EAAE,EACpB,EAAE,MAAM,EAAE,IAAI,EAAE,CACjB,CAAC;QAEF,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,gCAAgC,CAAC,CAAC,CAAC,OAAO,CAAC;YACvE,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;QACH,sEAAsE;QACtE,mEAAmE;QACnE,MAAM,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAC7C,MAAM,CAAC,eAAe,CAAC,CAAC,uBAAuB,EAAE,oBAAoB,CAAC,CAAC,CACxE,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAElE,MAAM,CACJ,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,gCAAgC,CAAC,CACzD,CAAC,aAAa,EAAE,CAAC;QAClB,MAAM,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,EAC/B,EAAE,EACF,EAAE,MAAM,EAAE,IAAI,EAAE,CACjB,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3D,MAAM,CAAC,eAAe,EAAE,eAAe,CAAC,GACtC,iBAAiB,CAAC,gBAAgB,EAAE,CAAC;QACvC,wEAAwE;QACxE,sEAAsE;QACtE,kDAAkD;QAClD,MAAM,MAAM,CAAC,yBAAyB,CAAC,eAAe,CAAC,CAAC;QACxD,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAEtC,MAAM,CACJ,MAAM,CAAC,qBAAqB,EAAE,EAAE,UAAU,EAAE,CAC1C,gCAAgC,CACjC,CACF,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAEnC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACvE,MAAM,CAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAuB,CAAC,IAAI,CAAC,CAAC,SAAS,CAC7D,uBAAuB,CACxB,CAAC;QAEF,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC1E,MAAM,CAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAuB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAErE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,mBAAmB,CAAC,EAAE,CAAC,CAAC;QACxB,MAAM,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACpE,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,MAAM,CAAC,IAAI,CAAC,CAAC,oBAAoB,CAC/B,MAAM,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,CAChD,CAAC;QACF,IAAI,CAAC,WAAW,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["import { Client } from \"@modelcontextprotocol/sdk/client/index.js\";\nimport { InMemoryTransport } from \"@modelcontextprotocol/sdk/inMemory.js\";\nimport { describe, expect, it, vi } from \"vitest\";\nimport {\n  __setSkillsManifest,\n  McpServer,\n  type SkillsManifest,\n} from \"./index.js\";\n\nconst MANIFEST: SkillsManifest = [\n  {\n    name: \"demo\",\n    frontmatter: { name: \"demo\", description: \"A demo skill\" },\n    digest: \"sha256:deadbeef\",\n    files: { \"SKILL.md\": \"# Demo\" },\n  },\n];\n\nfunction extensionsOf(server: McpServer): Record<string, unknown> | undefined {\n  return (\n    server.server as unknown as {\n      _capabilities?: { extensions?: Record<string, unknown> };\n    }\n  )._capabilities?.extensions;\n}\n\nfunction registeredResourceNames(server: McpServer): string[] {\n  const registered = (\n    server as unknown as {\n      _registeredResources?: Record<string, unknown>;\n      _registeredResourceTemplates?: Record<string, unknown>;\n    }\n  )._registeredResources;\n  return registered ? Object.keys(registered) : [];\n}\n\ndescribe(\"skills server option\", () => {\n  it(\"declares the extension capability and registers skill resources from the primed manifest\", () => {\n    __setSkillsManifest(MANIFEST);\n    const server = new McpServer(\n      { name: \"t\", version: \"0.0.1\" },\n      { capabilities: {} },\n      { skills: true },\n    );\n\n    expect(extensionsOf(server)?.[\"io.modelcontextprotocol/skills\"]).toEqual({\n      directoryRead: true,\n    });\n    // Resources are keyed by URI: the skill's SKILL.md plus the discovery\n    // index. Locks that the primed manifest was consumed and wired up.\n    expect(registeredResourceNames(server)).toEqual(\n      expect.arrayContaining([\"skill://demo/SKILL.md\", \"skill://index.json\"]),\n    );\n  });\n\n  it(\"does nothing when the skills option is absent\", () => {\n    __setSkillsManifest(MANIFEST);\n    const server = new McpServer({ name: \"t\", version: \"0.0.1\" }, {});\n\n    expect(\n      extensionsOf(server)?.[\"io.modelcontextprotocol/skills\"],\n    ).toBeUndefined();\n    expect(registeredResourceNames(server)).not.toContain(\"skill://index.json\");\n  });\n\n  it(\"serves skills through the stateless transport (capability + reads)\", async () => {\n    __setSkillsManifest(MANIFEST);\n    const server = new McpServer(\n      { name: \"t\", version: \"0.0.1\" },\n      {},\n      { skills: true },\n    );\n    const client = new Client({ name: \"c\", version: \"0.0.1\" });\n    const [clientTransport, serverTransport] =\n      InMemoryTransport.createLinkedPair();\n    // The production HTTP path builds a fresh per-request server and copies\n    // handler maps by reference; exercise it directly to lock that skills\n    // (capability + resource reads) survive that hop.\n    await server.connectStatelessTransport(serverTransport);\n    await client.connect(clientTransport);\n\n    expect(\n      client.getServerCapabilities()?.extensions?.[\n        \"io.modelcontextprotocol/skills\"\n      ],\n    ).toEqual({ directoryRead: true });\n\n    const index = await client.readResource({ uri: \"skill://index.json\" });\n    expect((index.contents[0] as { text?: string }).text).toContain(\n      \"skill://demo/SKILL.md\",\n    );\n\n    const skill = await client.readResource({ uri: \"skill://demo/SKILL.md\" });\n    expect((skill.contents[0] as { text?: string }).text).toBe(\"# Demo\");\n\n    await client.close();\n    await server.close();\n  });\n\n  it(\"warns when skills are enabled but none are found\", () => {\n    __setSkillsManifest([]);\n    const warn = vi.spyOn(console, \"warn\").mockImplementation(() => {});\n    new McpServer({ name: \"t\", version: \"0.0.1\" }, {}, { skills: true });\n    expect(warn).toHaveBeenCalledWith(\n      expect.stringContaining(\"no skills were found\"),\n    );\n    warn.mockRestore();\n  });\n});\n"]}

package/dist/server/skills.d.ts

@@ -0,0 +1,23 @@
+import type { ReadResourceCallback, ReadResourceTemplateCallback, ResourceMetadata, McpServer as SdkMcpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
+export declare const SKILLS_EXTENSION_KEY = "io.modelcontextprotocol/skills";
+export declare const SKILL_INDEX_URI = "skill://index.json";
+export interface Skill {
+    name: string;
+    frontmatter: Record<string, unknown>;
+    digest: string;
+    files: Record<string, string>;
+}
+export type SkillsManifest = Skill[];
+export declare function discoverSkills(dir: string): SkillsManifest;
+export declare function skillUriToRelPath(uri: string): {
+    name: string;
+    relPath: string;
+};
+interface SkillRegistrar {
+    registerResource(name: string, uri: string, config: ResourceMetadata, readCallback: ReadResourceCallback): unknown;
+    registerResource(name: string, template: ResourceTemplate, config: ResourceMetadata, readCallback: ReadResourceTemplateCallback): unknown;
+    readonly server: SdkMcpServer["server"];
+}
+export declare function registerSkills(server: SkillRegistrar, manifest: SkillsManifest): void;
+export {};

package/dist/server/skills.js

@@ -0,0 +1,178 @@
+import { createHash } from "node:crypto";
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { extname, join } from "node:path";
+import { ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { ErrorCode, McpError } from "@modelcontextprotocol/sdk/types.js";
+import { parse as parseYaml } from "yaml";
+import { z } from "zod";
+export const SKILLS_EXTENSION_KEY = "io.modelcontextprotocol/skills";
+export const SKILL_INDEX_URI = "skill://index.json";
+const SKILL_NAME_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+const SkillFrontmatterSchema = z
+    .object({
+    name: z
+        .string()
+        .min(1)
+        .max(64)
+        .regex(SKILL_NAME_RE, "must be lowercase alphanumeric words separated by single hyphens"),
+    description: z.string().min(1).max(1024),
+})
+    .loose();
+const sha256 = (content) => `sha256:${createHash("sha256").update(content, "utf8").digest("hex")}`;
+const FRONTMATTER_RE = /^?\s*---[ \t]*\r?\n([\s\S]*?)\r?\n---[ \t]*(?:\r?\n|$)/;
+function parseFrontmatter(content, source) {
+    const match = FRONTMATTER_RE.exec(content);
+    if (!match) {
+        throw new Error(`Skill ${source} is missing YAML frontmatter`);
+    }
+    try {
+        return parseYaml(match[1] ?? "");
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        throw new Error(`Cannot parse frontmatter of ${source}: ${detail}`);
+    }
+}
+const readSkillDir = (root, rel = "") => {
+    const files = {};
+    for (const entry of readdirSync(join(root, rel), { withFileTypes: true })) {
+        const childRel = rel ? `${rel}/${entry.name}` : entry.name;
+        if (entry.isSymbolicLink()) {
+            continue;
+        }
+        if (entry.isDirectory()) {
+            Object.assign(files, readSkillDir(root, childRel));
+        }
+        else if (entry.isFile() && extname(entry.name) === ".md") {
+            files[childRel] = readFileSync(join(root, childRel), "utf8");
+        }
+    }
+    return files;
+};
+export function discoverSkills(dir) {
+    if (!existsSync(dir)) {
+        return [];
+    }
+    const skills = [];
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+        if (!entry.isDirectory()) {
+            continue;
+        }
+        const skillRoot = join(dir, entry.name);
+        const files = readSkillDir(skillRoot);
+        const skillMd = files["SKILL.md"];
+        if (skillMd === undefined) {
+            continue;
+        }
+        const source = `${entry.name}/SKILL.md`;
+        const parsed = SkillFrontmatterSchema.safeParse(parseFrontmatter(skillMd, source));
+        if (!parsed.success) {
+            throw new Error(`Invalid skill frontmatter in ${source}: ${z.prettifyError(parsed.error)}`);
+        }
+        if (parsed.data.name !== entry.name) {
+            throw new Error(`Skill name "${parsed.data.name}" in ${source} must match its directory name "${entry.name}"`);
+        }
+        skills.push({
+            name: entry.name,
+            frontmatter: parsed.data,
+            digest: sha256(skillMd),
+            files,
+        });
+    }
+    return skills;
+}
+export function skillUriToRelPath(uri) {
+    const match = /^skill:\/\/([^/]+)(?:\/(.*))?$/.exec(uri.replace(/\/+$/, ""));
+    if (!match) {
+        throw new McpError(ErrorCode.InvalidParams, `Invalid skill uri: ${uri}`);
+    }
+    const [, name = "", relPath = ""] = match;
+    const segments = relPath.split("/").filter(Boolean);
+    if (name === "" || segments.includes("..") || segments.includes(".")) {
+        throw new McpError(ErrorCode.InvalidParams, `Invalid skill uri: ${uri}`);
+    }
+    return { name, relPath: segments.join("/") };
+}
+function listDir(skill, relPath) {
+    const prefix = relPath === "" ? "" : `${relPath}/`;
+    const children = new Map();
+    let matched = relPath === "";
+    for (const filePath of Object.keys(skill.files)) {
+        if (!filePath.startsWith(prefix)) {
+            continue;
+        }
+        matched = true;
+        const rest = filePath.slice(prefix.length);
+        const slash = rest.indexOf("/");
+        if (slash === -1) {
+            children.set(rest, "text/markdown");
+        }
+        else {
+            children.set(rest.slice(0, slash), "inode/directory");
+        }
+    }
+    if (!matched) {
+        return null;
+    }
+    return [...children].map(([name, mimeType]) => ({ name, mimeType }));
+}
+const DirectoryReadRequestSchema = z.object({
+    method: z.literal("resources/directory/read"),
+    params: z.object({ uri: z.string(), cursor: z.string().optional() }),
+});
+export function registerSkills(server, manifest) {
+    const byName = new Map(manifest.map((s) => [s.name, s]));
+    const serveFile = (name, relPath, href) => {
+        const text = byName.get(name)?.files[relPath];
+        if (text === undefined) {
+            throw new McpError(ErrorCode.InvalidParams, `Not found: ${href}`);
+        }
+        return {
+            contents: [{ uri: href, text, mimeType: "text/markdown" }],
+        };
+    };
+    for (const skill of manifest) {
+        server.registerResource(skill.name, `skill://${skill.name}/SKILL.md`, {
+            description: String(skill.frontmatter.description),
+            mimeType: "text/markdown",
+        }, (readUri) => serveFile(skill.name, "SKILL.md", readUri.href));
+    }
+    server.registerResource("skill-files", new ResourceTemplate("skill://{skillName}/{+filePath}", {
+        list: undefined,
+    }), {}, (readUri) => {
+        const { name, relPath } = skillUriToRelPath(readUri.href);
+        return serveFile(name, relPath, readUri.href);
+    });
+    server.registerResource("skill-index", SKILL_INDEX_URI, { mimeType: "application/json" }, () => ({
+        contents: [
+            {
+                uri: SKILL_INDEX_URI,
+                mimeType: "application/json",
+                text: JSON.stringify({
+                    skills: manifest.map((skill) => ({
+                        url: `skill://${skill.name}/SKILL.md`,
+                        digest: skill.digest,
+                        frontmatter: skill.frontmatter,
+                    })),
+                }),
+            },
+        ],
+    }));
+    server.server.setRequestHandler(DirectoryReadRequestSchema, ({ params }) => {
+        const { name, relPath } = skillUriToRelPath(params.uri);
+        const skill = byName.get(name);
+        const entries = skill ? listDir(skill, relPath) : null;
+        if (!entries) {
+            throw new McpError(ErrorCode.InvalidParams, `Not a directory: ${params.uri}`);
+        }
+        const base = params.uri.replace(/\/+$/, "");
+        return {
+            resources: entries.map((entry) => ({
+                uri: `${base}/${entry.name}`,
+                name: entry.name,
+                mimeType: entry.mimeType,
+            })),
+        };
+    });
+}
+//# sourceMappingURL=skills.js.map

package/dist/server/skills.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills.js","sourceRoot":"","sources":["../../src/server/skills.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAO1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,oBAAoB,GAAG,gCAAgC,CAAC;AACrE,MAAM,CAAC,MAAM,eAAe,GAAG,oBAAoB,CAAC;AAEpD,MAAM,aAAa,GAAG,0BAA0B,CAAC;AAEjD,MAAM,sBAAsB,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;SACP,KAAK,CACJ,aAAa,EACb,kEAAkE,CACnE;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;CACzC,CAAC;KACD,KAAK,EAAE,CAAC;AAWX,MAAM,MAAM,GAAG,CAAC,OAAe,EAAU,EAAE,CACzC,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAEzE,MAAM,cAAc,GAAG,yDAAyD,CAAC;AAEjF,SAAS,gBAAgB,CAAC,OAAe,EAAE,MAAc;IACvD,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,SAAS,MAAM,8BAA8B,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,+BAA+B,MAAM,KAAK,MAAM,EAAE,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,GAAG,GAAG,EAAE,EAA0B,EAAE;IACtE,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC1E,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QAC3D,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QACrD,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC;YAC3D,KAAK,CAAC,QAAQ,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9D,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACzB,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;QAClC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,WAAW,CAAC;QAExC,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAC7C,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,CAClC,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,gCAAgC,MAAM,KAAK,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC3E,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,eAAe,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,MAAM,mCAAmC,KAAK,CAAC,IAAI,GAAG,CAC9F,CAAC;QACJ,CAAC;QAED,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,WAAW,EAAE,MAAM,CAAC,IAAI;YACxB,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC;YACvB,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAI3C,MAAM,KAAK,GAAG,gCAAgC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;IAC7E,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,aAAa,EAAE,sBAAsB,GAAG,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,CAAC,EAAE,IAAI,GAAG,EAAE,EAAE,OAAO,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC;IAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,IAAI,KAAK,EAAE,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,aAAa,EAAE,sBAAsB,GAAG,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,OAAO,CACd,KAAY,EACZ,OAAe;IAEf,MAAM,MAAM,GAAG,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,GAAG,CAAC;IACnD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,IAAI,OAAO,GAAG,OAAO,KAAK,EAAE,CAAC;IAC7B,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACjC,SAAS;QACX,CAAC;QACD,OAAO,GAAG,IAAI,CAAC;QACf,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QACtC,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,iBAAiB,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;AACvE,CAAC;AAkBD,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC;IAC7C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;CACrE,CAAC,CAAC;AAEH,MAAM,UAAU,cAAc,CAC5B,MAAsB,EACtB,QAAwB;IAExB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,IAAY,EAAE,EAAE;QAChE,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,aAAa,EAAE,cAAc,IAAI,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;SAC3D,CAAC;IACJ,CAAC,CAAC;IAEF,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,MAAM,CAAC,gBAAgB,CACrB,KAAK,CAAC,IAAI,EACV,WAAW,KAAK,CAAC,IAAI,WAAW,EAChC;YACE,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC;YAClD,QAAQ,EAAE,eAAe;SAC1B,EACD,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,CAC7D,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,gBAAgB,CACrB,aAAa,EACb,IAAI,gBAAgB,CAAC,iCAAiC,EAAE;QACtD,IAAI,EAAE,SAAS;KAChB,CAAC,EACF,EAAE,EACF,CAAC,OAAO,EAAE,EAAE;QACV,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1D,OAAO,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,gBAAgB,CACrB,aAAa,EACb,eAAe,EACf,EAAE,QAAQ,EAAE,kBAAkB,EAAE,EAChC,GAAG,EAAE,CAAC,CAAC;QACL,QAAQ,EAAE;YACR;gBACE,GAAG,EAAE,eAAe;gBACpB,QAAQ,EAAE,kBAAkB;gBAC5B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;wBAC/B,GAAG,EAAE,WAAW,KAAK,CAAC,IAAI,WAAW;wBACrC,MAAM,EAAE,KAAK,CAAC,MAAM;wBACpB,WAAW,EAAE,KAAK,CAAC,WAAW;qBAC/B,CAAC,CAAC;iBACJ,CAAC;aACH;SACF;KACF,CAAC,CACH,CAAC;IAEF,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,0BAA0B,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE;QACzE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACvD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,QAAQ,CAChB,SAAS,CAAC,aAAa,EACvB,oBAAoB,MAAM,CAAC,GAAG,EAAE,CACjC,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC5C,OAAO;YACL,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACjC,GAAG,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE;gBAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { createHash } from \"node:crypto\";\nimport { existsSync, readdirSync, readFileSync } from \"node:fs\";\nimport { extname, join } from \"node:path\";\nimport type {\n  ReadResourceCallback,\n  ReadResourceTemplateCallback,\n  ResourceMetadata,\n  McpServer as SdkMcpServer,\n} from \"@modelcontextprotocol/sdk/server/mcp.js\";\nimport { ResourceTemplate } from \"@modelcontextprotocol/sdk/server/mcp.js\";\nimport { ErrorCode, McpError } from \"@modelcontextprotocol/sdk/types.js\";\nimport { parse as parseYaml } from \"yaml\";\nimport { z } from \"zod\";\n\nexport const SKILLS_EXTENSION_KEY = \"io.modelcontextprotocol/skills\";\nexport const SKILL_INDEX_URI = \"skill://index.json\";\n\nconst SKILL_NAME_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/;\n\nconst SkillFrontmatterSchema = z\n  .object({\n    name: z\n      .string()\n      .min(1)\n      .max(64)\n      .regex(\n        SKILL_NAME_RE,\n        \"must be lowercase alphanumeric words separated by single hyphens\",\n      ),\n    description: z.string().min(1).max(1024),\n  })\n  .loose();\n\nexport interface Skill {\n  name: string;\n  frontmatter: Record<string, unknown>;\n  digest: string;\n  files: Record<string, string>;\n}\n\nexport type SkillsManifest = Skill[];\n\nconst sha256 = (content: string): string =>\n  `sha256:${createHash(\"sha256\").update(content, \"utf8\").digest(\"hex\")}`;\n\nconst FRONTMATTER_RE = /^?\\s*---[ \\t]*\\r?\\n([\\s\\S]*?)\\r?\\n---[ \\t]*(?:\\r?\\n|$)/;\n\nfunction parseFrontmatter(content: string, source: string): unknown {\n  const match = FRONTMATTER_RE.exec(content);\n  if (!match) {\n    throw new Error(`Skill ${source} is missing YAML frontmatter`);\n  }\n  try {\n    return parseYaml(match[1] ?? \"\");\n  } catch (error) {\n    const detail = error instanceof Error ? error.message : String(error);\n    throw new Error(`Cannot parse frontmatter of ${source}: ${detail}`);\n  }\n}\n\nconst readSkillDir = (root: string, rel = \"\"): Record<string, string> => {\n  const files: Record<string, string> = {};\n  for (const entry of readdirSync(join(root, rel), { withFileTypes: true })) {\n    const childRel = rel ? `${rel}/${entry.name}` : entry.name;\n    if (entry.isSymbolicLink()) {\n      continue;\n    }\n    if (entry.isDirectory()) {\n      Object.assign(files, readSkillDir(root, childRel));\n    } else if (entry.isFile() && extname(entry.name) === \".md\") {\n      files[childRel] = readFileSync(join(root, childRel), \"utf8\");\n    }\n  }\n  return files;\n};\n\nexport function discoverSkills(dir: string): SkillsManifest {\n  if (!existsSync(dir)) {\n    return [];\n  }\n\n  const skills: SkillsManifest = [];\n  for (const entry of readdirSync(dir, { withFileTypes: true })) {\n    if (!entry.isDirectory()) {\n      continue;\n    }\n\n    const skillRoot = join(dir, entry.name);\n    const files = readSkillDir(skillRoot);\n    const skillMd = files[\"SKILL.md\"];\n    if (skillMd === undefined) {\n      continue;\n    }\n\n    const source = `${entry.name}/SKILL.md`;\n\n    const parsed = SkillFrontmatterSchema.safeParse(\n      parseFrontmatter(skillMd, source),\n    );\n    if (!parsed.success) {\n      throw new Error(\n        `Invalid skill frontmatter in ${source}: ${z.prettifyError(parsed.error)}`,\n      );\n    }\n    if (parsed.data.name !== entry.name) {\n      throw new Error(\n        `Skill name \"${parsed.data.name}\" in ${source} must match its directory name \"${entry.name}\"`,\n      );\n    }\n\n    skills.push({\n      name: entry.name,\n      frontmatter: parsed.data,\n      digest: sha256(skillMd),\n      files,\n    });\n  }\n  return skills;\n}\n\nexport function skillUriToRelPath(uri: string): {\n  name: string;\n  relPath: string;\n} {\n  const match = /^skill:\\/\\/([^/]+)(?:\\/(.*))?$/.exec(uri.replace(/\\/+$/, \"\"));\n  if (!match) {\n    throw new McpError(ErrorCode.InvalidParams, `Invalid skill uri: ${uri}`);\n  }\n  const [, name = \"\", relPath = \"\"] = match;\n  const segments = relPath.split(\"/\").filter(Boolean);\n  if (name === \"\" || segments.includes(\"..\") || segments.includes(\".\")) {\n    throw new McpError(ErrorCode.InvalidParams, `Invalid skill uri: ${uri}`);\n  }\n  return { name, relPath: segments.join(\"/\") };\n}\n\nfunction listDir(\n  skill: Skill,\n  relPath: string,\n): { name: string; mimeType: string }[] | null {\n  const prefix = relPath === \"\" ? \"\" : `${relPath}/`;\n  const children = new Map<string, string>();\n  let matched = relPath === \"\";\n  for (const filePath of Object.keys(skill.files)) {\n    if (!filePath.startsWith(prefix)) {\n      continue;\n    }\n    matched = true;\n    const rest = filePath.slice(prefix.length);\n    const slash = rest.indexOf(\"/\");\n    if (slash === -1) {\n      children.set(rest, \"text/markdown\");\n    } else {\n      children.set(rest.slice(0, slash), \"inode/directory\");\n    }\n  }\n  if (!matched) {\n    return null;\n  }\n  return [...children].map(([name, mimeType]) => ({ name, mimeType }));\n}\n\ninterface SkillRegistrar {\n  registerResource(\n    name: string,\n    uri: string,\n    config: ResourceMetadata,\n    readCallback: ReadResourceCallback,\n  ): unknown;\n  registerResource(\n    name: string,\n    template: ResourceTemplate,\n    config: ResourceMetadata,\n    readCallback: ReadResourceTemplateCallback,\n  ): unknown;\n  readonly server: SdkMcpServer[\"server\"];\n}\n\nconst DirectoryReadRequestSchema = z.object({\n  method: z.literal(\"resources/directory/read\"),\n  params: z.object({ uri: z.string(), cursor: z.string().optional() }),\n});\n\nexport function registerSkills(\n  server: SkillRegistrar,\n  manifest: SkillsManifest,\n): void {\n  const byName = new Map(manifest.map((s) => [s.name, s]));\n  const serveFile = (name: string, relPath: string, href: string) => {\n    const text = byName.get(name)?.files[relPath];\n    if (text === undefined) {\n      throw new McpError(ErrorCode.InvalidParams, `Not found: ${href}`);\n    }\n    return {\n      contents: [{ uri: href, text, mimeType: \"text/markdown\" }],\n    };\n  };\n\n  for (const skill of manifest) {\n    server.registerResource(\n      skill.name,\n      `skill://${skill.name}/SKILL.md`,\n      {\n        description: String(skill.frontmatter.description),\n        mimeType: \"text/markdown\",\n      },\n      (readUri) => serveFile(skill.name, \"SKILL.md\", readUri.href),\n    );\n  }\n\n  server.registerResource(\n    \"skill-files\",\n    new ResourceTemplate(\"skill://{skillName}/{+filePath}\", {\n      list: undefined,\n    }),\n    {},\n    (readUri) => {\n      const { name, relPath } = skillUriToRelPath(readUri.href);\n      return serveFile(name, relPath, readUri.href);\n    },\n  );\n\n  server.registerResource(\n    \"skill-index\",\n    SKILL_INDEX_URI,\n    { mimeType: \"application/json\" },\n    () => ({\n      contents: [\n        {\n          uri: SKILL_INDEX_URI,\n          mimeType: \"application/json\",\n          text: JSON.stringify({\n            skills: manifest.map((skill) => ({\n              url: `skill://${skill.name}/SKILL.md`,\n              digest: skill.digest,\n              frontmatter: skill.frontmatter,\n            })),\n          }),\n        },\n      ],\n    }),\n  );\n\n  server.server.setRequestHandler(DirectoryReadRequestSchema, ({ params }) => {\n    const { name, relPath } = skillUriToRelPath(params.uri);\n    const skill = byName.get(name);\n    const entries = skill ? listDir(skill, relPath) : null;\n    if (!entries) {\n      throw new McpError(\n        ErrorCode.InvalidParams,\n        `Not a directory: ${params.uri}`,\n      );\n    }\n    const base = params.uri.replace(/\\/+$/, \"\");\n    return {\n      resources: entries.map((entry) => ({\n        uri: `${base}/${entry.name}`,\n        name: entry.name,\n        mimeType: entry.mimeType,\n      })),\n    };\n  });\n}\n"]}

package/dist/server/skills.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/skills.test.js

@@ -0,0 +1,210 @@
+// @vitest-environment node
+import { mkdirSync, mkdtempSync, symlinkSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { describe, expect, it, vi } from "vitest";
+import { discoverSkills, registerSkills, SKILL_INDEX_URI, skillUriToRelPath, } from "./skills.js";
+function mkSkillDir(files) {
+    const root = mkdtempSync(join(tmpdir(), "skybridge-skills-"));
+    for (const [rel, content] of Object.entries(files)) {
+        const full = join(root, rel);
+        mkdirSync(join(full, ".."), { recursive: true });
+        writeFileSync(full, content);
+    }
+    return root;
+}
+const FM = (name, description) => `---\nname: ${name}\ndescription: ${description}\n---\n`;
+describe("discoverSkills", () => {
+    it("discovers a skill with frontmatter, digest, and supporting files", () => {
+        const dir = mkSkillDir({
+            "git-workflow/SKILL.md": `${FM("git-workflow", "Team git conventions")}Body`,
+            "git-workflow/references/GUIDE.md": "# Guide",
+        });
+        const [skill, ...rest] = discoverSkills(dir);
+        expect(rest).toHaveLength(0);
+        expect(skill?.name).toBe("git-workflow");
+        expect(skill?.frontmatter).toMatchObject({
+            name: "git-workflow",
+            description: "Team git conventions",
+        });
+        expect(skill?.digest).toMatch(/^sha256:[a-f0-9]{64}$/);
+        expect(Object.keys(skill?.files ?? {}).sort()).toEqual([
+            "SKILL.md",
+            "references/GUIDE.md",
+        ]);
+    });
+    it("returns [] for a missing directory and skips dirs without SKILL.md", () => {
+        expect(discoverSkills(join(tmpdir(), "does-not-exist-xyz"))).toEqual([]);
+        const dir = mkSkillDir({ "not-a-skill/README.md": "hi" });
+        expect(discoverSkills(dir)).toEqual([]);
+    });
+    it("parses a nested metadata map in frontmatter", () => {
+        const dir = mkSkillDir({
+            "s/SKILL.md": `---\nname: s\ndescription: d\nmetadata:\n  version: "1.2"\n  team: core\n---\n`,
+        });
+        expect(discoverSkills(dir)[0]?.frontmatter.metadata).toEqual({
+            version: "1.2",
+            team: "core",
+        });
+    });
+    it("throws on missing frontmatter", () => {
+        const dir = mkSkillDir({ "s/SKILL.md": "no frontmatter here" });
+        expect(() => discoverSkills(dir)).toThrow(/missing YAML frontmatter/);
+    });
+    it("throws when required fields are absent", () => {
+        const dir = mkSkillDir({ "s/SKILL.md": "---\nname: s\n---\n" });
+        expect(() => discoverSkills(dir)).toThrow(/Invalid skill frontmatter/);
+    });
+    it("throws when the frontmatter name does not match the directory", () => {
+        const dir = mkSkillDir({ "s/SKILL.md": FM("other", "d") });
+        expect(() => discoverSkills(dir)).toThrow(/must match its directory name/);
+    });
+    it("preserves arbitrary YAML frontmatter (arrays, nesting) verbatim", () => {
+        const dir = mkSkillDir({
+            "s/SKILL.md": "---\nname: s\ndescription: d\nallowed-tools:\n  - get-order\n  - refund\n---\n",
+        });
+        expect(discoverSkills(dir)[0]?.frontmatter["allowed-tools"]).toEqual([
+            "get-order",
+            "refund",
+        ]);
+    });
+    it("throws on malformed YAML frontmatter", () => {
+        const dir = mkSkillDir({
+            "s/SKILL.md": "---\nname: 's\ndescription: [unclosed\n---\n",
+        });
+        expect(() => discoverSkills(dir)).toThrow(/Cannot parse frontmatter/);
+    });
+});
+describe("skillUriToRelPath", () => {
+    it("splits name and relative path", () => {
+        expect(skillUriToRelPath("skill://refunds/SKILL.md")).toEqual({
+            name: "refunds",
+            relPath: "SKILL.md",
+        });
+        expect(skillUriToRelPath("skill://refunds")).toEqual({
+            name: "refunds",
+            relPath: "",
+        });
+    });
+    it("rejects path traversal and malformed URIs", () => {
+        expect(() => skillUriToRelPath("skill://s/../../etc/passwd")).toThrow();
+        expect(() => skillUriToRelPath("skill://s/./x")).toThrow();
+        expect(() => skillUriToRelPath("https://example.com")).toThrow();
+    });
+});
+describe("registerSkills", () => {
+    const manifest = [
+        {
+            name: "refunds",
+            frontmatter: { name: "refunds", description: "Process refunds" },
+            digest: "sha256:abc",
+            files: {
+                "SKILL.md": "# Refunds",
+                "templates/email.md": "Hi",
+            },
+        },
+    ];
+    function fakeRegistrar() {
+        const resources = new Map();
+        let dirHandler;
+        const server = {
+            registerResource: vi.fn((name, uri, _cfg, cb) => {
+                resources.set(name, {
+                    uri,
+                    cb: cb,
+                });
+            }),
+            server: {
+                setRequestHandler: vi.fn((_schema, handler) => {
+                    dirHandler = handler;
+                }),
+            },
+        };
+        return { server, resources, getDirHandler: () => dirHandler };
+    }
+    it("builds an index.json with url, digest, and verbatim frontmatter", () => {
+        const { server, resources } = fakeRegistrar();
+        // biome-ignore lint/suspicious/noExplicitAny: structural test double
+        registerSkills(server, manifest);
+        const index = resources.get("skill-index");
+        const result = index?.cb(new URL(SKILL_INDEX_URI));
+        expect(JSON.parse(result.contents[0]?.text ?? "")).toEqual({
+            skills: [
+                {
+                    url: "skill://refunds/SKILL.md",
+                    digest: "sha256:abc",
+                    frontmatter: { name: "refunds", description: "Process refunds" },
+                },
+            ],
+        });
+    });
+    it("serves supporting files through the template resource", () => {
+        const { server, resources } = fakeRegistrar();
+        // biome-ignore lint/suspicious/noExplicitAny: structural test double
+        registerSkills(server, manifest);
+        const tpl = resources.get("skill-files");
+        expect(tpl?.uri).toBeInstanceOf(ResourceTemplate);
+        const url = new URL("skill://refunds/templates/email.md");
+        const result = tpl?.cb(url, {}, {});
+        expect(result.contents[0]?.text).toBe("Hi");
+    });
+    it("lists a subdirectory through the directory-read handler", () => {
+        const on = fakeRegistrar();
+        // biome-ignore lint/suspicious/noExplicitAny: structural test double
+        registerSkills(on.server, manifest);
+        const result = on.getDirHandler()?.({
+            params: { uri: "skill://refunds/templates" },
+        });
+        expect(result.resources).toEqual([
+            {
+                uri: "skill://refunds/templates/email.md",
+                name: "email.md",
+                mimeType: "text/markdown",
+            },
+        ]);
+    });
+    it("lists a skill root and marks subdirectories as inode/directory", () => {
+        const { server, getDirHandler } = fakeRegistrar();
+        // biome-ignore lint/suspicious/noExplicitAny: structural test double
+        registerSkills(server, manifest);
+        const result = getDirHandler()?.({
+            params: { uri: "skill://refunds" },
+        });
+        expect(result.resources).toContainEqual({
+            uri: "skill://refunds/templates",
+            name: "templates",
+            mimeType: "inode/directory",
+        });
+        expect(result.resources).toContainEqual({
+            uri: "skill://refunds/SKILL.md",
+            name: "SKILL.md",
+            mimeType: "text/markdown",
+        });
+    });
+});
+describe("discoverSkills symlink safety", () => {
+    it("excludes symlinked files and directories from the manifest", () => {
+        const outside = mkdtempSync(join(tmpdir(), "skybridge-outside-"));
+        writeFileSync(join(outside, "secret.md"), "TOP SECRET");
+        const dir = mkSkillDir({
+            "demo/SKILL.md": FM("demo", "d"),
+            "demo/real.md": "ok",
+        });
+        symlinkSync(join(outside, "secret.md"), join(dir, "demo", "leak.md"));
+        symlinkSync(outside, join(dir, "demo", "escape"));
+        const files = discoverSkills(dir)[0]?.files ?? {};
+        expect(Object.keys(files).sort()).toEqual(["SKILL.md", "real.md"]);
+    });
+    it("ignores non-markdown supporting files", () => {
+        const dir = mkSkillDir({
+            "demo/SKILL.md": FM("demo", "d"),
+            "demo/notes.md": "kept",
+            "demo/data.json": "{}",
+            "demo/scripts/run.py": "print(1)",
+        });
+        const files = discoverSkills(dir)[0]?.files ?? {};
+        expect(Object.keys(files).sort()).toEqual(["SKILL.md", "notes.md"]);
+    });
+});
+//# sourceMappingURL=skills.test.js.map

package/dist/server/skills.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills.test.js","sourceRoot":"","sources":["../../src/server/skills.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EACL,cAAc,EACd,cAAc,EACd,eAAe,EAEf,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAErB,SAAS,UAAU,CAAC,KAA6B;IAC/C,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAC9D,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC7B,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,EAAE,GAAG,CAAC,IAAY,EAAE,WAAmB,EAAE,EAAE,CAC/C,cAAc,IAAI,kBAAkB,WAAW,SAAS,CAAC;AAE3D,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,GAAG,GAAG,UAAU,CAAC;YACrB,uBAAuB,EAAE,GAAG,EAAE,CAAC,cAAc,EAAE,sBAAsB,CAAC,MAAM;YAC5E,kCAAkC,EAAE,SAAS;SAC9C,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,aAAa,CAAC;YACvC,IAAI,EAAE,cAAc;YACpB,WAAW,EAAE,sBAAsB;SACpC,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;QACvD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC;YACrD,UAAU;YACV,qBAAqB;SACtB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzE,MAAM,GAAG,GAAG,UAAU,CAAC,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,GAAG,GAAG,UAAU,CAAC;YACrB,YAAY,EAAE,gFAAgF;SAC/F,CAAC,CAAC;QACH,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;YAC3D,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,MAAM;SACb,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,GAAG,GAAG,UAAU,CAAC,EAAE,YAAY,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAChE,MAAM,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,GAAG,GAAG,UAAU,CAAC,EAAE,YAAY,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAChE,MAAM,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,GAAG,GAAG,UAAU,CAAC,EAAE,YAAY,EAAE,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3D,MAAM,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,GAAG,GAAG,UAAU,CAAC;YACrB,YAAY,EACV,gFAAgF;SACnF,CAAC,CAAC;QACH,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC;YACnE,WAAW;YACX,QAAQ;SACT,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,GAAG,GAAG,UAAU,CAAC;YACrB,YAAY,EAAE,8CAA8C;SAC7D,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,iBAAiB,CAAC,0BAA0B,CAAC,CAAC,CAAC,OAAO,CAAC;YAC5D,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,UAAU;SACpB,CAAC,CAAC;QACH,MAAM,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC;YACnD,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,EAAE;SACZ,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,4BAA4B,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QACxE,MAAM,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAC3D,MAAM,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IACnE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,MAAM,QAAQ,GAAY;QACxB;YACE,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,iBAAiB,EAAE;YAChE,MAAM,EAAE,YAAY;YACpB,KAAK,EAAE;gBACL,UAAU,EAAE,WAAW;gBACvB,oBAAoB,EAAE,IAAI;aAC3B;SACF;KACF,CAAC;IAEF,SAAS,aAAa;QACpB,MAAM,SAAS,GAAG,IAAI,GAAG,EAGtB,CAAC;QACJ,IAAI,UAAmD,CAAC;QACxD,MAAM,MAAM,GAAG;YACb,gBAAgB,EAAE,EAAE,CAAC,EAAE,CACrB,CAAC,IAAY,EAAE,GAAY,EAAE,IAAa,EAAE,EAAW,EAAE,EAAE;gBACzD,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE;oBAClB,GAAG;oBACH,EAAE,EAAE,EAAqC;iBAC1C,CAAC,CAAC;YACL,CAAC,CACF;YACD,MAAM,EAAE;gBACN,iBAAiB,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,OAAgB,EAAE,OAAgB,EAAE,EAAE;oBAC9D,UAAU,GAAG,OAAoC,CAAC;gBACpD,CAAC,CAAC;aACH;SACF,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC;IAChE,CAAC;IAED,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,aAAa,EAAE,CAAC;QAC9C,qEAAqE;QACrE,cAAc,CAAC,MAAa,EAAE,QAAQ,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,eAAe,CAAC,CAEhD,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YACzD,MAAM,EAAE;gBACN;oBACE,GAAG,EAAE,0BAA0B;oBAC/B,MAAM,EAAE,YAAY;oBACpB,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,iBAAiB,EAAE;iBACjE;aACF;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,aAAa,EAAE,CAAC;QAC9C,qEAAqE;QACrE,cAAc,CAAC,MAAa,EAAE,QAAQ,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC;QAClD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,oCAAoC,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,CAAqC,CAAC;QACxE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,EAAE,GAAG,aAAa,EAAE,CAAC;QAC3B,qEAAqE;QACrE,cAAc,CAAC,EAAE,CAAC,MAAa,EAAE,QAAQ,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,EAAE,CAAC,aAAa,EAAE,EAAE,CAAC;YAClC,MAAM,EAAE,EAAE,GAAG,EAAE,2BAA2B,EAAE;SAC7C,CAAqE,CAAC;QACvE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC;YAC/B;gBACE,GAAG,EAAE,oCAAoC;gBACzC,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE,eAAe;aAC1B;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,aAAa,EAAE,CAAC;QAClD,qEAAqE;QACrE,cAAc,CAAC,MAAa,EAAE,QAAQ,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,aAAa,EAAE,EAAE,CAAC;YAC/B,MAAM,EAAE,EAAE,GAAG,EAAE,iBAAiB,EAAE;SACnC,CAAwD,CAAC;QAC1D,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,cAAc,CAAC;YACtC,GAAG,EAAE,2BAA2B;YAChC,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,iBAAiB;SAC5B,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,cAAc,CAAC;YACtC,GAAG,EAAE,0BAA0B;YAC/B,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE,eAAe;SAC1B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;QAClE,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,YAAY,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,UAAU,CAAC;YACrB,eAAe,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC;YAChC,cAAc,EAAE,IAAI;SACrB,CAAC,CAAC;QACH,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;QACtE,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QAElD,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,GAAG,GAAG,UAAU,CAAC;YACrB,eAAe,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC;YAChC,eAAe,EAAE,MAAM;YACvB,gBAAgB,EAAE,IAAI;YACtB,qBAAqB,EAAE,UAAU;SAClC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport { mkdirSync, mkdtempSync, symlinkSync, writeFileSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { ResourceTemplate } from \"@modelcontextprotocol/sdk/server/mcp.js\";\nimport { describe, expect, it, vi } from \"vitest\";\nimport {\n  discoverSkills,\n  registerSkills,\n  SKILL_INDEX_URI,\n  type Skill,\n  skillUriToRelPath,\n} from \"./skills.js\";\n\nfunction mkSkillDir(files: Record<string, string>): string {\n  const root = mkdtempSync(join(tmpdir(), \"skybridge-skills-\"));\n  for (const [rel, content] of Object.entries(files)) {\n    const full = join(root, rel);\n    mkdirSync(join(full, \"..\"), { recursive: true });\n    writeFileSync(full, content);\n  }\n  return root;\n}\n\nconst FM = (name: string, description: string) =>\n  `---\\nname: ${name}\\ndescription: ${description}\\n---\\n`;\n\ndescribe(\"discoverSkills\", () => {\n  it(\"discovers a skill with frontmatter, digest, and supporting files\", () => {\n    const dir = mkSkillDir({\n      \"git-workflow/SKILL.md\": `${FM(\"git-workflow\", \"Team git conventions\")}Body`,\n      \"git-workflow/references/GUIDE.md\": \"# Guide\",\n    });\n    const [skill, ...rest] = discoverSkills(dir);\n    expect(rest).toHaveLength(0);\n    expect(skill?.name).toBe(\"git-workflow\");\n    expect(skill?.frontmatter).toMatchObject({\n      name: \"git-workflow\",\n      description: \"Team git conventions\",\n    });\n    expect(skill?.digest).toMatch(/^sha256:[a-f0-9]{64}$/);\n    expect(Object.keys(skill?.files ?? {}).sort()).toEqual([\n      \"SKILL.md\",\n      \"references/GUIDE.md\",\n    ]);\n  });\n\n  it(\"returns [] for a missing directory and skips dirs without SKILL.md\", () => {\n    expect(discoverSkills(join(tmpdir(), \"does-not-exist-xyz\"))).toEqual([]);\n    const dir = mkSkillDir({ \"not-a-skill/README.md\": \"hi\" });\n    expect(discoverSkills(dir)).toEqual([]);\n  });\n\n  it(\"parses a nested metadata map in frontmatter\", () => {\n    const dir = mkSkillDir({\n      \"s/SKILL.md\": `---\\nname: s\\ndescription: d\\nmetadata:\\n  version: \"1.2\"\\n  team: core\\n---\\n`,\n    });\n    expect(discoverSkills(dir)[0]?.frontmatter.metadata).toEqual({\n      version: \"1.2\",\n      team: \"core\",\n    });\n  });\n\n  it(\"throws on missing frontmatter\", () => {\n    const dir = mkSkillDir({ \"s/SKILL.md\": \"no frontmatter here\" });\n    expect(() => discoverSkills(dir)).toThrow(/missing YAML frontmatter/);\n  });\n\n  it(\"throws when required fields are absent\", () => {\n    const dir = mkSkillDir({ \"s/SKILL.md\": \"---\\nname: s\\n---\\n\" });\n    expect(() => discoverSkills(dir)).toThrow(/Invalid skill frontmatter/);\n  });\n\n  it(\"throws when the frontmatter name does not match the directory\", () => {\n    const dir = mkSkillDir({ \"s/SKILL.md\": FM(\"other\", \"d\") });\n    expect(() => discoverSkills(dir)).toThrow(/must match its directory name/);\n  });\n\n  it(\"preserves arbitrary YAML frontmatter (arrays, nesting) verbatim\", () => {\n    const dir = mkSkillDir({\n      \"s/SKILL.md\":\n        \"---\\nname: s\\ndescription: d\\nallowed-tools:\\n  - get-order\\n  - refund\\n---\\n\",\n    });\n    expect(discoverSkills(dir)[0]?.frontmatter[\"allowed-tools\"]).toEqual([\n      \"get-order\",\n      \"refund\",\n    ]);\n  });\n\n  it(\"throws on malformed YAML frontmatter\", () => {\n    const dir = mkSkillDir({\n      \"s/SKILL.md\": \"---\\nname: 's\\ndescription: [unclosed\\n---\\n\",\n    });\n    expect(() => discoverSkills(dir)).toThrow(/Cannot parse frontmatter/);\n  });\n});\n\ndescribe(\"skillUriToRelPath\", () => {\n  it(\"splits name and relative path\", () => {\n    expect(skillUriToRelPath(\"skill://refunds/SKILL.md\")).toEqual({\n      name: \"refunds\",\n      relPath: \"SKILL.md\",\n    });\n    expect(skillUriToRelPath(\"skill://refunds\")).toEqual({\n      name: \"refunds\",\n      relPath: \"\",\n    });\n  });\n\n  it(\"rejects path traversal and malformed URIs\", () => {\n    expect(() => skillUriToRelPath(\"skill://s/../../etc/passwd\")).toThrow();\n    expect(() => skillUriToRelPath(\"skill://s/./x\")).toThrow();\n    expect(() => skillUriToRelPath(\"https://example.com\")).toThrow();\n  });\n});\n\ndescribe(\"registerSkills\", () => {\n  const manifest: Skill[] = [\n    {\n      name: \"refunds\",\n      frontmatter: { name: \"refunds\", description: \"Process refunds\" },\n      digest: \"sha256:abc\",\n      files: {\n        \"SKILL.md\": \"# Refunds\",\n        \"templates/email.md\": \"Hi\",\n      },\n    },\n  ];\n\n  function fakeRegistrar() {\n    const resources = new Map<\n      string,\n      { uri: unknown; cb: (...args: unknown[]) => unknown }\n    >();\n    let dirHandler: ((req: unknown) => unknown) | undefined;\n    const server = {\n      registerResource: vi.fn(\n        (name: string, uri: unknown, _cfg: unknown, cb: unknown) => {\n          resources.set(name, {\n            uri,\n            cb: cb as (...args: unknown[]) => unknown,\n          });\n        },\n      ),\n      server: {\n        setRequestHandler: vi.fn((_schema: unknown, handler: unknown) => {\n          dirHandler = handler as (req: unknown) => unknown;\n        }),\n      },\n    };\n    return { server, resources, getDirHandler: () => dirHandler };\n  }\n\n  it(\"builds an index.json with url, digest, and verbatim frontmatter\", () => {\n    const { server, resources } = fakeRegistrar();\n    // biome-ignore lint/suspicious/noExplicitAny: structural test double\n    registerSkills(server as any, manifest);\n    const index = resources.get(\"skill-index\");\n    const result = index?.cb(new URL(SKILL_INDEX_URI)) as {\n      contents: { text: string }[];\n    };\n    expect(JSON.parse(result.contents[0]?.text ?? \"\")).toEqual({\n      skills: [\n        {\n          url: \"skill://refunds/SKILL.md\",\n          digest: \"sha256:abc\",\n          frontmatter: { name: \"refunds\", description: \"Process refunds\" },\n        },\n      ],\n    });\n  });\n\n  it(\"serves supporting files through the template resource\", () => {\n    const { server, resources } = fakeRegistrar();\n    // biome-ignore lint/suspicious/noExplicitAny: structural test double\n    registerSkills(server as any, manifest);\n    const tpl = resources.get(\"skill-files\");\n    expect(tpl?.uri).toBeInstanceOf(ResourceTemplate);\n    const url = new URL(\"skill://refunds/templates/email.md\");\n    const result = tpl?.cb(url, {}, {}) as { contents: { text: string }[] };\n    expect(result.contents[0]?.text).toBe(\"Hi\");\n  });\n\n  it(\"lists a subdirectory through the directory-read handler\", () => {\n    const on = fakeRegistrar();\n    // biome-ignore lint/suspicious/noExplicitAny: structural test double\n    registerSkills(on.server as any, manifest);\n    const result = on.getDirHandler()?.({\n      params: { uri: \"skill://refunds/templates\" },\n    }) as { resources: { uri: string; name: string; mimeType: string }[] };\n    expect(result.resources).toEqual([\n      {\n        uri: \"skill://refunds/templates/email.md\",\n        name: \"email.md\",\n        mimeType: \"text/markdown\",\n      },\n    ]);\n  });\n\n  it(\"lists a skill root and marks subdirectories as inode/directory\", () => {\n    const { server, getDirHandler } = fakeRegistrar();\n    // biome-ignore lint/suspicious/noExplicitAny: structural test double\n    registerSkills(server as any, manifest);\n    const result = getDirHandler()?.({\n      params: { uri: \"skill://refunds\" },\n    }) as { resources: { name: string; mimeType: string }[] };\n    expect(result.resources).toContainEqual({\n      uri: \"skill://refunds/templates\",\n      name: \"templates\",\n      mimeType: \"inode/directory\",\n    });\n    expect(result.resources).toContainEqual({\n      uri: \"skill://refunds/SKILL.md\",\n      name: \"SKILL.md\",\n      mimeType: \"text/markdown\",\n    });\n  });\n});\n\ndescribe(\"discoverSkills symlink safety\", () => {\n  it(\"excludes symlinked files and directories from the manifest\", () => {\n    const outside = mkdtempSync(join(tmpdir(), \"skybridge-outside-\"));\n    writeFileSync(join(outside, \"secret.md\"), \"TOP SECRET\");\n    const dir = mkSkillDir({\n      \"demo/SKILL.md\": FM(\"demo\", \"d\"),\n      \"demo/real.md\": \"ok\",\n    });\n    symlinkSync(join(outside, \"secret.md\"), join(dir, \"demo\", \"leak.md\"));\n    symlinkSync(outside, join(dir, \"demo\", \"escape\"));\n\n    const files = discoverSkills(dir)[0]?.files ?? {};\n    expect(Object.keys(files).sort()).toEqual([\"SKILL.md\", \"real.md\"]);\n  });\n\n  it(\"ignores non-markdown supporting files\", () => {\n    const dir = mkSkillDir({\n      \"demo/SKILL.md\": FM(\"demo\", \"d\"),\n      \"demo/notes.md\": \"kept\",\n      \"demo/data.json\": \"{}\",\n      \"demo/scripts/run.py\": \"print(1)\",\n    });\n    const files = discoverSkills(dir)[0]?.files ?? {};\n    expect(Object.keys(files).sort()).toEqual([\"SKILL.md\", \"notes.md\"]);\n  });\n});\n"]}

package/dist/server/viewsDevServer.js

@@ -19,7 +19,7 @@ export const viewsDevServer = async (httpServer) => {
     const root = process.cwd();
     const configFile = path.join(root, "vite.config.ts");
     const configResult = await loadConfigFromFile({ command: "serve", mode: "development" }, configFile, root);
-    const { build, preview, plugins: userPlugins = [], ...devConfig } = configResult?.config || {};
+    const { build, preview, plugins: userPlugins = [], server: userServer, ...devConfig } = configResult?.config || {};
     const vite = await createServer({
         ...devConfig,
         // Pass `false` so Vite skips re-resolving a config file — we already
@@ -27,6 +27,9 @@ export const viewsDevServer = async (httpServer) => {
         configFile: false,
         appType: "custom",
         server: {
+            // Keep the user's server options (e.g. forwardConsole) but force the
+            // three settings skybridge's Express integration requires.
+            ...userServer,
             allowedHosts: true,
             middlewareMode: true,
             hmr: {

package/dist/server/viewsDevServer.js.map

@@ -1 +1 @@
-{"version":3,"file":"viewsDevServer.js","sourceRoot":"","sources":["../../src/server/viewsDevServer.ts"],"names":[],"mappings":"AACA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,OAAO,EAAE,EAAe,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAEnF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EACjC,UAAuB,EACN,EAAE;IACnB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,EAAE,YAAY,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;IAElE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAErD,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAC3C,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,EACzC,UAAU,EACV,IAAI,CACL,CAAC;IAEF,MAAM,EACJ,KAAK,EACL,OAAO,EACP,OAAO,EAAE,WAAW,GAAG,EAAE,EACzB,GAAG,SAAS,EACb,GAAG,YAAY,EAAE,MAAM,IAAI,EAAE,CAAC;IAE/B,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC;QAC9B,GAAG,SAAS;QACZ,qEAAqE;QACrE,6CAA6C;QAC7C,UAAU,EAAE,KAAK;QACjB,OAAO,EAAE,QAAQ;QACjB,MAAM,EAAE;YACN,YAAY,EAAE,IAAI;YAClB,cAAc,EAAE,IAAI;YACpB,GAAG,EAAE;gBACH,MAAM,EAAE,UAAU;aACnB;SACF;QACD,IAAI;QACJ,uEAAuE;QACvE,kDAAkD;QAClD,OAAO,EAAE,CAAC,GAAG,WAAW,EAAE,2BAA2B,EAAE,CAAC;KACzD,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACnB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAElC,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC","sourcesContent":["import type http from \"node:http\";\nimport path from \"node:path\";\nimport cors from \"cors\";\nimport express, { type Router } from \"express\";\nimport { assetBaseUrlTransformPlugin } from \"./asset-base-url-transform-plugin.js\";\n\n/**\n * Vite dev-server middleware for view assets.\n *\n * MUST be mounted at the Express app root so Vite can intercept\n * `/@vite/client`, `/@react-refresh`, and `/_skybridge/view/...` imports:\n *\n *   const app = express();\n *   if (env.NODE_ENV !== \"production\") {\n *     app.use(await viewsDevServer(httpServer));\n *   }\n */\nexport const viewsDevServer = async (\n  httpServer: http.Server,\n): Promise<Router> => {\n  const router = express.Router();\n\n  const { createServer, loadConfigFromFile } = await import(\"vite\");\n\n  const root = process.cwd();\n  const configFile = path.join(root, \"vite.config.ts\");\n\n  const configResult = await loadConfigFromFile(\n    { command: \"serve\", mode: \"development\" },\n    configFile,\n    root,\n  );\n\n  const {\n    build,\n    preview,\n    plugins: userPlugins = [],\n    ...devConfig\n  } = configResult?.config || {};\n\n  const vite = await createServer({\n    ...devConfig,\n    // Pass `false` so Vite skips re-resolving a config file — we already\n    // loaded and spread the user's config above.\n    configFile: false,\n    appType: \"custom\",\n    server: {\n      allowedHosts: true,\n      middlewareMode: true,\n      hmr: {\n        server: httpServer,\n      },\n    },\n    root,\n    // optimizeDeps is set by the skybridge Vite plugin (entries + include)\n    // so it can derive the view glob from `viewsDir`.\n    plugins: [...userPlugins, assetBaseUrlTransformPlugin()],\n  });\n\n  router.use(cors());\n  router.use(\"/\", vite.middlewares);\n\n  return router;\n};\n"]}
+{"version":3,"file":"viewsDevServer.js","sourceRoot":"","sources":["../../src/server/viewsDevServer.ts"],"names":[],"mappings":"AACA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,OAAO,EAAE,EAAe,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAEnF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EACjC,UAAuB,EACN,EAAE;IACnB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,EAAE,YAAY,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;IAElE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAErD,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAC3C,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,EACzC,UAAU,EACV,IAAI,CACL,CAAC;IAEF,MAAM,EACJ,KAAK,EACL,OAAO,EACP,OAAO,EAAE,WAAW,GAAG,EAAE,EACzB,MAAM,EAAE,UAAU,EAClB,GAAG,SAAS,EACb,GAAG,YAAY,EAAE,MAAM,IAAI,EAAE,CAAC;IAE/B,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC;QAC9B,GAAG,SAAS;QACZ,qEAAqE;QACrE,6CAA6C;QAC7C,UAAU,EAAE,KAAK;QACjB,OAAO,EAAE,QAAQ;QACjB,MAAM,EAAE;YACN,qEAAqE;YACrE,2DAA2D;YAC3D,GAAG,UAAU;YACb,YAAY,EAAE,IAAI;YAClB,cAAc,EAAE,IAAI;YACpB,GAAG,EAAE;gBACH,MAAM,EAAE,UAAU;aACnB;SACF;QACD,IAAI;QACJ,uEAAuE;QACvE,kDAAkD;QAClD,OAAO,EAAE,CAAC,GAAG,WAAW,EAAE,2BAA2B,EAAE,CAAC;KACzD,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACnB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAElC,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC","sourcesContent":["import type http from \"node:http\";\nimport path from \"node:path\";\nimport cors from \"cors\";\nimport express, { type Router } from \"express\";\nimport { assetBaseUrlTransformPlugin } from \"./asset-base-url-transform-plugin.js\";\n\n/**\n * Vite dev-server middleware for view assets.\n *\n * MUST be mounted at the Express app root so Vite can intercept\n * `/@vite/client`, `/@react-refresh`, and `/_skybridge/view/...` imports:\n *\n *   const app = express();\n *   if (env.NODE_ENV !== \"production\") {\n *     app.use(await viewsDevServer(httpServer));\n *   }\n */\nexport const viewsDevServer = async (\n  httpServer: http.Server,\n): Promise<Router> => {\n  const router = express.Router();\n\n  const { createServer, loadConfigFromFile } = await import(\"vite\");\n\n  const root = process.cwd();\n  const configFile = path.join(root, \"vite.config.ts\");\n\n  const configResult = await loadConfigFromFile(\n    { command: \"serve\", mode: \"development\" },\n    configFile,\n    root,\n  );\n\n  const {\n    build,\n    preview,\n    plugins: userPlugins = [],\n    server: userServer,\n    ...devConfig\n  } = configResult?.config || {};\n\n  const vite = await createServer({\n    ...devConfig,\n    // Pass `false` so Vite skips re-resolving a config file — we already\n    // loaded and spread the user's config above.\n    configFile: false,\n    appType: \"custom\",\n    server: {\n      // Keep the user's server options (e.g. forwardConsole) but force the\n      // three settings skybridge's Express integration requires.\n      ...userServer,\n      allowedHosts: true,\n      middlewareMode: true,\n      hmr: {\n        server: httpServer,\n      },\n    },\n    root,\n    // optimizeDeps is set by the skybridge Vite plugin (entries + include)\n    // so it can derive the view glob from `viewsDir`.\n    plugins: [...userPlugins, assetBaseUrlTransformPlugin()],\n  });\n\n  router.use(cors());\n  router.use(\"/\", vite.middlewares);\n\n  return router;\n};\n"]}

package/dist/test/view.test.js

@@ -287,8 +287,8 @@ describe("McpServer.registerTool (unified API)", () => {
             description: "Second tool",
             view: { component: "folder-view" },
         }, vi.fn());
-        const myviewTemplate = (mockRegisterTool.mock.calls[0]?.[1])._meta?.ui?.resourceUri;
-        const folderviewTemplate = (mockRegisterTool.mock.calls[1]?.[1])._meta?.ui?.resourceUri;
+        const myviewTemplate = mockRegisterTool.mock.calls[0][1]._meta?.ui?.resourceUri;
+        const folderviewTemplate = mockRegisterTool.mock.calls[1][1]._meta?.ui?.resourceUri;
         expect(myviewTemplate).not.toEqual(folderviewTemplate);
         expect(myviewTemplate).toMatch(/\?v=[0-9a-f]{8}$/);
         expect(folderviewTemplate).toMatch(/\?v=[0-9a-f]{8}$/);
@@ -521,7 +521,7 @@ describe("resources/list view _meta injection", () => {
         const extApps = resources.find((r) => r.uri.includes("ext-apps"));
         expect(appsSdk).toBeUndefined();
         expect(extApps?._meta).toBeDefined();
-        const extUi = (extApps?._meta).ui;
+        const extUi = extApps._meta?.ui;
         expect(extUi?.csp?.connectDomains?.length).toBeGreaterThan(0);
         expect(extUi?.csp?.resourceDomains).toContain("https://fonts.googleapis.com");
         expect(extUi?.domain).toBe("skybridge.tech");