vskill 1.2.0 → 1.2.1

package/dist/eval-server/api-routes.js

@@ -12,6 +12,8 @@ import { classifyError } from "./error-classifier.js";
 import { readLockfile, writeLockfile } from "../lockfile/lockfile.js";
 import { resolveSkillApiName as resolveSkillApiNameImpl } from "./skill-name-resolver.js";
 import { resolveSkillOrigin } from "./origin-resolver.js";
+import { isPrivateOrUnknownRepo } from "../lib/private-source.js";
+import { isPrivateStudioSkill, isPrivateStudioSkillAt, readStudioLocks } from "./studio-privacy.js";
 import { runBenchmarkSSE, runSingleCaseSSE } from "./benchmark-runner.js";
 import { getSkillSemaphore } from "./concurrency.js";
 import { resolveSkillDir, resolveAllowedSkillDir } from "./skill-resolver.js";
@@ -1561,6 +1563,10 @@ export function registerRoutes(router, rootArg, projectName) {
         // overwrites currentVersion. Stamping it server-side from the lockfile
         // collapses the race so badges render their final source on first paint.
         const lockForCurrentVersion = readLockfile(root);
+        // Skills from a private repo (or one GitHub does not confirm is public)
+        // are flagged so the Studio never sends them to the platform; see
+        // studio-privacy.ts for how installed, plugin and authored skills map.
+        const studioLocks = readStudioLocks(root);
         const enriched = await Promise.all(skills.map(async (s) => {
             let evalCount = 0;
             let assertionCount = 0;
@@ -1583,9 +1589,11 @@ export function registerRoutes(router, rootArg, projectName) {
             // currentVersion=null — the resolver then falls through to frontmatter,
             // preserving non-italic styling for author-declared versions.
             const currentVersion = lockForCurrentVersion?.skills?.[s.skill]?.version ?? null;
+            const sourcePrivate = await isPrivateStudioSkill({ ...s, origin }, studioLocks);
             return {
                 ...s,
                 origin,
+                ...(sourcePrivate ? { sourcePrivate: true } : {}),
                 scope: s.scope ?? (origin === "installed" ? "installed" : "own"),
                 isSymlink: s.isSymlink ?? false,
                 symlinkTarget: s.symlinkTarget ?? null,
@@ -1740,6 +1748,12 @@ export function registerRoutes(router, rootArg, projectName) {
     // `/versions/diff` as needed.
     async function buildSkillApiPath(skill, plugin) {
         const origin = await resolveSkillOrigin(skill, plugin, getRoot());
+        // Private (or unconfirmed) skills never reach the platform: lockfile
+        // entries (incl. plugin installs), authored skills in private checkouts,
+        // and installed skills nobody recorded.
+        if (origin.private || (await isPrivateStudioSkillAt(skill, plugin, getRoot()))) {
+            return { apiPathRoot: null, origin };
+        }
         if (origin.owner && origin.repo) {
             return {
                 apiPathRoot: `/api/v1/skills/${encodeURIComponent(origin.owner)}/${encodeURIComponent(origin.repo)}/${encodeURIComponent(skill)}`,
@@ -1750,6 +1764,9 @@ export function registerRoutes(router, rootArg, projectName) {
         // whose origin comes from a git remote, not a lockfile.
         const fullName = await resolveSkillApiName(skill, plugin);
         const parts = fullName.split("/");
+        if (parts.length === 3 && (await isPrivateOrUnknownRepo(parts[0], parts[1]))) {
+            return { apiPathRoot: null, origin };
+        }
         const apiPathRoot = parts.length === 3
             ? `/api/v1/skills/${parts.map(encodeURIComponent).join("/")}`
             : `/api/v1/skills/${encodeURIComponent(fullName)}`;
@@ -1759,7 +1776,6 @@ export function registerRoutes(router, rootArg, projectName) {
         const root = getRoot();
         // 0823: comprehensive origin resolver via shared buildSkillApiPath.
         const { apiPathRoot, origin } = await buildSkillApiPath(params.skill, params.plugin);
-        const apiPath = `${apiPathRoot}/versions`;
         const emptyEnvelope = () => {
             res.setHeader("X-Skill-VCS", "unavailable");
             sendJson(res, {
@@ -1770,6 +1786,13 @@ export function registerRoutes(router, rootArg, projectName) {
                 trackedForUpdates: false,
             }, 200, req);
         };
+        // A skill from a private (or unconfirmed) repo has no platform history,
+        // and its name and repo must not be sent there.
+        if (apiPathRoot === null) {
+            emptyEnvelope();
+            return;
+        }
+        const apiPath = `${apiPathRoot}/versions`;
         let fetchResp;
         try {
             fetchResp = await fetch(`${PLATFORM_BASE}${apiPath}`, {
@@ -1859,6 +1882,10 @@ export function registerRoutes(router, rootArg, projectName) {
         // so Anthropic-shipped skills (slack-messaging, pptx, etc.) get the
         // matching upstream URL for diff requests, not the legacy bare-name path.
         const { apiPathRoot } = await buildSkillApiPath(params.skill, params.plugin);
+        if (apiPathRoot === null) {
+            sendJson(res, { error: "This skill comes from a private repository; version diffs are not available from verified-skill.com." }, 404, req);
+            return;
+        }
         const basePath = `${apiPathRoot}/versions/diff`;
         try {
             const resp = await fetch(`${PLATFORM_BASE}${basePath}?from=${encodeURIComponent(from)}&to=${encodeURIComponent(to)}`, { signal: AbortSignal.timeout(10_000) });
@@ -1964,7 +1991,11 @@ export function registerRoutes(router, rootArg, projectName) {
         let versions = [];
         try {
             const origin = await resolveSkillOrigin(skill, plugin, root);
-            if (origin.owner && origin.repo) {
+            // Private (or unconfirmed) skills never reach the platform.
+            if (!origin.private &&
+                origin.owner &&
+                origin.repo &&
+                !(await isPrivateStudioSkillAt(skill, plugin, root))) {
                 const apiPath = `/api/v1/skills/${encodeURIComponent(origin.owner)}/${encodeURIComponent(origin.repo)}/${encodeURIComponent(skill)}/versions`;
                 try {
                     const fetchResp = await fetch(`${PLATFORM_BASE}${apiPath}`, {