booking-agent-cli 0.3.0__tar.gz → 0.4.0__tar.gz

{booking_agent_cli-0.3.0 → booking_agent_cli-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: booking-agent-cli
-Version: 0.3.0
+Version: 0.4.0
 Summary: The Booking Agent CLI: a stateful USP booking flow with hard gates, plus its USP protocol library.
 Project-URL: Homepage, https://github.com/wix/booking-agent
 Project-URL: Documentation, https://github.com/wix/booking-agent/blob/master/booking-agent/README.md
@@ -70,9 +70,25 @@ workflow. Check a downloaded wheel with
 `booking-agent update` installs only verified wheels, and the CLI checks its own installed
 files against the attested release before it books or pays.
 
-Agents use the CLI through the Booking Agent skill:
+Agents use the CLI through the Booking Agent skill, installed with
+`npx skills add wix/booking-agent --skill booking-agent`, or taken from the canonical raw URL:
 https://raw.githubusercontent.com/wix/booking-agent/master/booking-agent/skills/booking-agent/SKILL.md
 
+Each release also publishes that skill at an immutable `skill-v<version>` tag and signs it with
+the release workflow, so a harness can pin and verify the exact text it follows:
+
+```bash
+curl -fsSLO https://raw.githubusercontent.com/wix/booking-agent/skill-v0.50.0/booking-agent/skills/booking-agent/SKILL.md
+gh attestation verify SKILL.md --repo wix/booking-agent \
+  --signer-workflow wix/booking-agent/.github/workflows/release.yml
+```
+
+`flow init --skill-path <path>` then checks the file the agent actually loaded against the signed
+copy inside the wheel; a modified file claiming the same version fails `skill_unverified` and
+blocks booking and payment until `booking-agent skill print --output <path>` restores it. A copy
+written to evade the check can omit `--skill-path`, so the first read is what the attestation and
+the harness cover.
+
 The skill also needs `link-cli` for buyer identity and payment approval; see the
 skill for details.
 

{booking_agent_cli-0.3.0 → booking_agent_cli-0.4.0}/README.md

@@ -28,9 +28,25 @@ workflow. Check a downloaded wheel with
 `booking-agent update` installs only verified wheels, and the CLI checks its own installed
 files against the attested release before it books or pays.
 
-Agents use the CLI through the Booking Agent skill:
+Agents use the CLI through the Booking Agent skill, installed with
+`npx skills add wix/booking-agent --skill booking-agent`, or taken from the canonical raw URL:
 https://raw.githubusercontent.com/wix/booking-agent/master/booking-agent/skills/booking-agent/SKILL.md
 
+Each release also publishes that skill at an immutable `skill-v<version>` tag and signs it with
+the release workflow, so a harness can pin and verify the exact text it follows:
+
+```bash
+curl -fsSLO https://raw.githubusercontent.com/wix/booking-agent/skill-v0.50.0/booking-agent/skills/booking-agent/SKILL.md
+gh attestation verify SKILL.md --repo wix/booking-agent \
+  --signer-workflow wix/booking-agent/.github/workflows/release.yml
+```
+
+`flow init --skill-path <path>` then checks the file the agent actually loaded against the signed
+copy inside the wheel; a modified file claiming the same version fails `skill_unverified` and
+blocks booking and payment until `booking-agent skill print --output <path>` restores it. A copy
+written to evade the check can omit `--skill-path`, so the first read is what the attestation and
+the harness cover.
+
 The skill also needs `link-cli` for buyer identity and payment approval; see the
 skill for details.
 

{booking_agent_cli-0.3.0 → booking_agent_cli-0.4.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "booking-agent-cli"
-version = "0.3.0"
+version = "0.4.0"
 description = "The Booking Agent CLI: a stateful USP booking flow with hard gates, plus its USP protocol library."
 readme = "README.md"
 license = "Apache-2.0"

{booking_agent_cli-0.3.0 → booking_agent_cli-0.4.0}/src/booking_agent/__init__.py

@@ -3,4 +3,4 @@
 Ships in the booking-agent-cli wheel and never imports ``booking_agent_cli``.
 """
 
-__version__ = "0.3.0"
+__version__ = "0.4.0"

{booking_agent_cli-0.3.0 → booking_agent_cli-0.4.0}/src/booking_agent_cli/__init__.py

@@ -1,3 +1,3 @@
 """booking_agent_cli: typer-based stateful CLI for USP booking flows."""
 
-__version__ = "0.3.0"
+__version__ = "0.4.0"

booking_agent_cli-0.3.0/src/booking_agent_cli/SKILL.md → booking_agent_cli-0.4.0/src/booking_agent_cli/bundled_skill.md

@@ -1,5 +1,5 @@
 ---
-version: 0.49.0
+version: 0.50.0
 name: booking-agent
 description: |
   Books time-based services via USP from a Link wallet. Use when the user wants to book, schedule, reserve, or pay for a service from a business (haircut, lesson, repair, class, appointment, consult). The `booking-agent` CLI owns the booking state machine and refuses to proceed when human gates are skipped. Sign the user in to Link on your own, right after install and at the start of every booking (`booking-agent flow link-auth connect`, then start `booking-agent flow link-auth poll` in the background and post the sign-in URL in the same turn, exactly like `pay poll`); never wait for the user to ask to sign in or to say they approved. After `booking-agent flow business use`, follow `next_command` through `use-ucp-checkout-mode`; businesses without native checkout fail closed. Payment uses `booking-agent flow pay request` (default returns immediately with the approval URL), then start `booking-agent flow pay poll` in the background and post the approval URL to the user in the same turn; the poll finishes checkout once they approve. Confirm through `booking-agent flow book poll --wait`; never start an inbound webhook. Surface the approval URL exactly once. Personal identification (name, phone, email, address) must always come from the user's Link account via `link-cli`, never from chat or placeholders. Before any location-based search, the CLI proposes the Link shipping address and the user confirms it or gives another; online services skip this. Talk to the user in plain everyday language only; never expose CLI, UCP, auth, session, or other implementation details unless they explicitly ask.
@@ -19,7 +19,7 @@ metadata:
         - link-cli
     install:
       - kind: uv
-        package: "booking-agent-cli==0.3.0"
+        package: "booking-agent-cli==0.4.0"
         bins: [booking-agent]
 user-invocable: true
 ---
@@ -214,16 +214,16 @@ before installing:
 
 ```bash
 dir="$HOME/.booking-agent/verified-wheels"
-uvx pip download "booking-agent-cli==0.3.0" --no-deps --only-binary :all: -d "$dir"
+uvx pip download "booking-agent-cli==0.4.0" --no-deps --only-binary :all: -d "$dir"
 uvx pypi-attestations==0.0.30 verify pypi --repository https://github.com/wix/booking-agent \
-  "$dir/booking_agent_cli-0.3.0-py3-none-any.whl"
-uv tool install --force "$dir/booking_agent_cli-0.3.0-py3-none-any.whl"
+  "$dir/booking_agent_cli-0.4.0-py3-none-any.whl"
+uv tool install --force "$dir/booking_agent_cli-0.4.0-py3-none-any.whl"
 
 booking-agent --help
 ```
 
 Install only when the verify step passes. If `uvx` is not available, install the same pinned
-release with `uv tool install booking-agent-cli==0.3.0` or `pipx install booking-agent-cli==0.3.0`;
+release with `uv tool install booking-agent-cli==0.4.0` or `pipx install booking-agent-cli==0.4.0`;
 the CLI checks its own files against the signed release on the first `booking-agent flow init`
 and refuses to book or pay if they do not match.
 
@@ -257,11 +257,37 @@ for each extra cache folder the runtime asks you to keep (a relative persistent
 under the root). When the runtime keeps its files anyway, or offers no surviving folder, skip the
 command. Do not tell the user about it. If it fails, continue the booking without it.
 
+### This skill file
+
+Harnesses install this file with:
+
+```bash
+npx skills add wix/booking-agent --skill booking-agent
+```
+
+That always takes the latest skill. To take a fixed, published version instead, fetch it at the
+release tag the official workflow signs it under, and check the signature before you follow it:
+
+```bash
+curl -fsSLO https://raw.githubusercontent.com/wix/booking-agent/skill-v0.50.0/booking-agent/skills/booking-agent/SKILL.md
+gh attestation verify SKILL.md \
+  --repo wix/booking-agent \
+  --signer-workflow wix/booking-agent/.github/workflows/release.yml
+```
+
+Follow the file only when the verify step passes. Every release also attaches that same `SKILL.md`
+and its `SKILL.md.sigstore.json` bundle to the GitHub Release, so a runtime without `gh` can verify
+the bundle offline instead.
+
+Then pass the path you loaded this file from on every `flow init` (`--skill-path`, below). The CLI
+compares it with the signed copy inside the installed CLI and refuses to book or pay when a file
+claiming this same version does not match it.
+
 ### Updates (only with the user's yes)
 
 The CLI decides whether a newer version is worth mentioning; you never decide from version
 numbers or release pages. Pass this skill's version on every `flow init` (`--skill-version
-0.49.0`, from the frontmatter above), so the CLI can tell when these instructions and the
+0.50.0`, from the frontmatter above), so the CLI can tell when these instructions and the
 installed CLI no longer match.
 
 - When a command returns `awaiting_user: update_consent`, ask the question in `prompt` in plain
@@ -491,12 +517,17 @@ have it). Do not invent a lookup.
 **Step 1b — Create a new session:**
 
 ```bash
-booking-agent flow init --user-request "<user's exact request>" --skill-version 0.49.0
+booking-agent flow init --user-request "<user's exact request>" --skill-version 0.50.0 \
+  --skill-path "<absolute path of the SKILL.md you loaded>"
 ```
 
 Add `--capability <name>` once for each part of the request that clearly needs it: `calendar`
 (they mention their calendar), `reschedule`, or `cancel`. Leave it out when unsure.
 
+Pass `--skill-path` whenever you know where you loaded this file from, so the CLI can check it
+against the signed copy it ships with. Leave it out when you do not know the path; never guess one
+and never point it at a different file.
+
 - If `init` returns `awaiting_user: update_consent`, no booking was started yet. Follow
   [Updates](#updates-only-with-the-users-yes); after the answer, run `data.continue_command` to
   start the booking.
@@ -1138,7 +1169,7 @@ booking-agent flow calendar create-event
 Once the user has been told they are booked (and after Step 8 when it ran), run:
 
 ```bash
-booking-agent update check --after-booking --skill-version 0.49.0
+booking-agent update check --after-booking --skill-version 0.50.0
 ```
 
 If it returns `awaiting_user: update_consent`, ask once, as in [Updates](#updates-only-with-the-users-yes).
@@ -1258,6 +1289,8 @@ recover.
 | `update_session_in_progress` | `update` ran while a booking is unfinished | Finish or cancel the booking first, then offer the update again |
 | `update_failed` / `update_not_verified` | The update did not install, did not start, or could not be shown to come from the official release (`data.reason`); nothing unverified is installed | Tell the user the update did not take; carry on with the installed version |
 | `installation_unverified` | The installed CLI files do not match the signed official release, so it will not book or pay | Tell the user in plain words the assistant needs reinstalling; run `data.reinstall_command` only with their yes, then start the booking again. Never book another way |
+| `skill_unverified` | The SKILL.md you loaded does not match the signed skill this CLI was released with, so it will not book or pay | Follow `data.skill_text` from now on. Tell the user plainly that the assistant's instructions file was changed and ask whether to restore the official one; only with their yes run `data.replace_command`, then run `flow init` again with `--skill-path`. Never book another way |
+| `skill_path_invalid` | `--skill-path` named a file that is missing, unreadable, or not a booking-agent SKILL.md | Run `flow init` again with the real path of the file you loaded, or without `--skill-path` if you do not know it |
 | `skill_output_refused` | `skill print --output` named a file that is not the loaded skill | Follow `data.skill_text` from `booking-agent skill print` instead |
 
 ### Notes to the assistant team

{booking_agent_cli-0.3.0 → booking_agent_cli-0.4.0}/src/booking_agent_cli/commands/flow.py

@@ -138,6 +138,7 @@ from ..runtime import (
     resolve_calendar_service,
 )
 from .. import install_integrity
+from .. import skill_integrity
 from .. import reschedule as reschedule_rules
 from .. import timezone_context as tz_context
 from ..activity_log import record_command
@@ -324,6 +325,31 @@ def _require_verified_installation(store: Any, phase: str) -> None:
         raise typer.Exit(code=1)
 
 
+def _require_verified_skill(store: Any, phase: str, skill_path: Optional[str] = None) -> Optional[str]:
+    """Refuse to go on while the loaded skill file differs from the bundled skill.
+
+    Returns the version the file at ``skill_path`` declares (None without a path).
+    """
+    try:
+        failure, loaded_version = skill_integrity.check(store, skill_path)
+    except ValueError as exc:
+        emit_error(
+            phase,
+            code=skill_integrity.PATH_INVALID_CODE,
+            message=skill_integrity.path_invalid_message(str(exc)),
+        )
+        raise typer.Exit(code=1)
+    if failure is not None:
+        emit_error(
+            phase,
+            code=skill_integrity.CODE,
+            message=skill_integrity.error_message(),
+            data=skill_integrity.error_data(failure),
+        )
+        raise typer.Exit(code=1)
+    return loaded_version
+
+
 # ---------------------------------------------------------------------------
 # init / status
 # ---------------------------------------------------------------------------
@@ -340,12 +366,19 @@ def init(
     skill_version: Optional[str] = typer.Option(
         None, "--skill-version", help="The version in the loaded skill's frontmatter.",
     ),
+    skill_path: Optional[str] = typer.Option(
+        None, "--skill-path",
+        help="The SKILL.md file the skill was loaded from; checked against the signed skill.",
+    ),
     capability: Optional[List[str]] = typer.Option(
         None, "--capability", help="A capability the user's request needs; repeatable.",
     ),
 ) -> None:
     """Initialize a new booking session."""
     store = load_store()
+    # Before the session checks: a skill the agent points us at is checked whatever the
+    # flow state, so a changed file is never masked by session_active.
+    loaded_version = _require_verified_skill(store, "INIT", skill_path)
     active = get_active_session(store)
     if active is not None and active.flow_phase not in TERMINAL_PHASES and not force:
         emit_error(
@@ -362,7 +395,9 @@ def init(
 
     _require_verified_installation(store, "INIT")
 
-    gate = _update_gate(user_request, skill_version, capability or [], allow_duplicate)
+    gate = _update_gate(
+        user_request, loaded_version or skill_version, capability or [], allow_duplicate, skill_path,
+    )
     if gate is not None:
         emit(gate)
         return
@@ -439,7 +474,11 @@ def init(
 
 
 def _update_gate(
-    user_request: str, skill_version: Optional[str], capabilities: List[str], allow_duplicate: bool,
+    user_request: str,
+    skill_version: Optional[str],
+    capabilities: List[str],
+    allow_duplicate: bool,
+    skill_path: Optional[str] = None,
 ) -> Optional[AgentOutput]:
     """Ask about an update before a session exists, only for a mismatch or a ready release."""
     from . import update as update_cmd
@@ -459,6 +498,8 @@ def _update_gate(
     rerun = f"booking-agent flow init --user-request {shlex.quote(user_request)}"
     if skill_version:
         rerun += f" --skill-version {shlex.quote(skill_version)}"
+    if skill_path:
+        rerun += f" --skill-path {shlex.quote(skill_path)}"
     for c in capabilities:
         rerun += f" --capability {shlex.quote(c)}"
     if allow_duplicate:
@@ -4318,6 +4359,7 @@ def book(
         raise _handle_gate(session, e)
     if not dry_run:
         _require_verified_installation(load_store(), "BOOKED")
+        _require_verified_skill(load_store(), "BOOKED")
 
     backend = resolve_backend()
 
@@ -4555,6 +4597,7 @@ app.add_typer(pay_app, name="pay")
 @pay_app.callback()
 def _pay_requires_verified_installation() -> None:
     _require_verified_installation(load_store(), "PAYMENT_PENDING")
+    _require_verified_skill(load_store(), "PAYMENT_PENDING")
 
 _REBOOK_MSG = (
     "Run `booking-agent flow pay rebook --service-id <id>` to create a fresh checkout, "

{booking_agent_cli-0.3.0 → booking_agent_cli-0.4.0}/src/booking_agent_cli/commands/update.py

@@ -13,7 +13,7 @@ from typing import List, Optional, Tuple
 import typer
 
 from .. import __version__ as CLI_VERSION
-from .. import provenance, updates
+from .. import provenance, skill_integrity, updates
 from ..output import AgentOutput, emit, emit_error
 from ..session import (
     TERMINAL_PHASES,
@@ -84,6 +84,10 @@ def skill_print(
         output.chmod(0o644)
     except OSError:
         pass
+    try:
+        skill_integrity.clear(load_store())
+    except SessionStoreTooNew:
+        pass
     emit(AgentOutput(
         phase="UPDATE",
         prompt=(
@@ -99,7 +103,7 @@ def skill_print(
 def _skill_target_error(path: Path) -> Optional[str]:
     if path.name != "SKILL.md":
         return "--output must name a SKILL.md file."
-    if path.is_symlink():
+    if path.is_symlink() or skill_integrity.is_source_checkout(path):
         return (
             "That skill file is a link into a source checkout, which updates with the "
             "checkout; it is never overwritten."

{booking_agent_cli-0.3.0 → booking_agent_cli-0.4.0}/src/booking_agent_cli/session.py

@@ -285,6 +285,8 @@ class SessionStore:
     # Outcome of the installation provenance check for one install ({version, record_sha256, ...}).
     install_verified: Optional[Dict[str, Any]] = None
     install_integrity_failure: Optional[Dict[str, Any]] = None
+    # A loaded skill file that differs from the bundled skill ({skill_version, skill_path, ...}).
+    skill_integrity_failure: Optional[Dict[str, Any]] = None
     sessions: List[Session] = field(default_factory=list)
 
 
@@ -747,6 +749,8 @@ def _store_to_dict(store: SessionStore) -> Dict[str, Any]:
         d["install_verified"] = dict(store.install_verified)
     if store.install_integrity_failure is not None:
         d["install_integrity_failure"] = dict(store.install_integrity_failure)
+    if store.skill_integrity_failure is not None:
+        d["skill_integrity_failure"] = dict(store.skill_integrity_failure)
     return _restore_unknown(store, d)
 
 
@@ -772,6 +776,7 @@ def _store_from_dict(raw: Dict[str, Any]) -> SessionStore:
         update_prompts_answered=[a for a in answered if isinstance(a, str)] if isinstance(answered, list) else [],
         install_verified=_dict_or_none(raw.get("install_verified")),
         install_integrity_failure=_dict_or_none(raw.get("install_integrity_failure")),
+        skill_integrity_failure=_dict_or_none(raw.get("skill_integrity_failure")),
         sessions=[_session_from_dict(s) for s in (raw.get("sessions") or [])],
     )
     return _remember_unknown(store, raw, _STORE_KEYS)

{booking_agent_cli-0.3.0 → booking_agent_cli-0.4.0}/src/booking_agent_cli/skill_bundle.py

@@ -1,15 +1,17 @@
 """The booking-agent skill this CLI was built with.
 
-``SKILL.md`` next to this module is a copy of ``skills/booking-agent/SKILL.md``
+``bundled_skill.md`` next to this module is a copy of ``skills/booking-agent/SKILL.md``
 (``scripts/sync_skill_bundle.py`` writes it, and CI checks it), so the installed CLI can
-always print the instructions that match it, offline.
+always print the instructions that match it, offline. It must not be named ``SKILL.md``:
+skill installers treat any directory holding a ``SKILL.md`` as a skill and would install
+this whole package in place of ``skills/booking-agent/``.
 """
 from __future__ import annotations
 
 import re
 from pathlib import Path
 
-SKILL_FILE = Path(__file__).with_name("SKILL.md")
+SKILL_FILE = Path(__file__).with_name("bundled_skill.md")
 _VERSION_LINE = re.compile(r"^version:\s*(\S+)\s*$", re.MULTILINE)
 
 

booking_agent_cli-0.4.0/src/booking_agent_cli/skill_integrity.py

@@ -0,0 +1,162 @@
+"""Whether the skill file the agent loaded is the skill this CLI was built with.
+
+``flow init --skill-path`` hashes the loaded ``SKILL.md`` and compares it with the
+bundled copy (``skill_bundle``), which ships inside the attested wheel. The comparison
+runs only when the loaded file declares the bundled version: another version is a
+stale copy, which the update check offers to replace. A same-version mismatch is
+remembered, so ``flow book`` and every ``flow pay`` command refuse until the file is
+replaced (``skill print --output``) or a later ``flow init --skill-path`` matches.
+
+A skill file that resolves into a source checkout is not checked, so developers can
+edit the skill in place. The check cannot catch a copy written to evade it, which can
+omit ``--skill-path`` or point it at a genuine file; the first read is covered by the
+signed release (``gh attestation verify``) and by the harness.
+"""
+from __future__ import annotations
+
+import hashlib
+import re
+import shlex
+from pathlib import Path
+from typing import Any, Dict, Optional, Tuple
+
+from .skill_bundle import SKILL_VERSION, skill_text
+
+CODE = "skill_unverified"
+PATH_INVALID_CODE = "skill_path_invalid"
+REPLACE_COMMAND = "booking-agent skill print --output"
+
+_VERSION_LINE = re.compile(r"^version:\s*[\"']?([^\s\"']+)[\"']?\s*$", re.MULTILINE)
+_NAME_LINE = re.compile(r"^name:\s*booking-agent\s*$", re.MULTILINE)
+
+
+def normalized(text: str) -> bytes:
+    """``text`` with LF line endings and exactly one trailing newline, as UTF-8."""
+    return (text.replace("\r\n", "\n").replace("\r", "\n").rstrip("\n") + "\n").encode("utf-8")
+
+
+def skill_sha256(text: str) -> str:
+    return hashlib.sha256(normalized(text)).hexdigest()
+
+
+def _frontmatter(text: str) -> str:
+    text = text.replace("\r\n", "\n")
+    if not text.startswith("---\n"):
+        return ""
+    end = text.find("\n---", 4)
+    return text[4:end] if end != -1 else ""
+
+
+def frontmatter_version(text: str) -> Optional[str]:
+    match = _VERSION_LINE.search(_frontmatter(text))
+    return match.group(1) if match else None
+
+
+def is_booking_agent_skill(text: str) -> bool:
+    return _NAME_LINE.search(_frontmatter(text)) is not None
+
+
+def is_source_checkout(path: Path) -> bool:
+    """``path`` resolves to ``skills/booking-agent/SKILL.md`` of a booking-agent checkout.
+
+    Resolving follows a symlinked file and a symlinked skill directory alike, so the
+    ``scripts/install.sh`` link into a checkout counts, while a ``npx skills`` link into
+    its own copy under ``.agents/skills`` does not.
+    """
+    try:
+        resolved = path.expanduser().resolve()
+    except (OSError, RuntimeError):
+        return False
+    parents = resolved.parents
+    return (
+        resolved.name == "SKILL.md"
+        and len(parents) > 2
+        and parents[0].name == "booking-agent"
+        and parents[1].name == "skills"
+        and (parents[2] / "packages" / "cli" / "pyproject.toml").is_file()
+    )
+
+
+def _applies(failure: Any) -> bool:
+    return isinstance(failure, dict) and failure.get("skill_version") == SKILL_VERSION
+
+
+def recorded_failure(store: Any) -> Optional[Dict[str, Any]]:
+    """The remembered mismatch for this CLI's skill version, if any."""
+    failure = store.skill_integrity_failure
+    return failure if _applies(failure) else None
+
+
+def _set_failure(store: Any, failure: Optional[Dict[str, Any]]) -> None:
+    from .session import save_store
+
+    if store.skill_integrity_failure != failure:
+        store.skill_integrity_failure = failure
+        save_store(store)
+
+
+def clear(store: Any) -> None:
+    _set_failure(store, None)
+
+
+def check(store: Any, skill_path: Optional[str]) -> Tuple[Optional[Dict[str, Any]], Optional[str]]:
+    """``(failure, loaded_version)`` for the skill file at ``skill_path``.
+
+    ``failure`` is the remembered mismatch when there is one, and ``loaded_version`` is
+    the version the loaded file declares (None when no path was given). Raises
+    ``ValueError`` when ``skill_path`` is not a readable booking-agent skill file.
+    """
+    if skill_path is None:
+        return recorded_failure(store), None
+    path = Path(skill_path).expanduser()
+    try:
+        text = path.read_text(encoding="utf-8")
+    except (OSError, UnicodeDecodeError) as exc:
+        raise ValueError(f"cannot read {path}: {type(exc).__name__}") from exc
+    if not is_booking_agent_skill(text):
+        raise ValueError(f"{path} is not a booking-agent SKILL.md")
+    loaded_version = frontmatter_version(text)
+    if is_source_checkout(path) or (loaded_version is not None and loaded_version != SKILL_VERSION):
+        clear(store)
+        return None, loaded_version
+    actual = skill_sha256(text)
+    if actual == skill_sha256(skill_text()):
+        clear(store)
+        return None, loaded_version
+    _set_failure(store, {
+        "skill_version": SKILL_VERSION,
+        "skill_path": str(path),
+        "actual_sha256": actual,
+    })
+    return store.skill_integrity_failure, loaded_version
+
+
+def error_message() -> str:
+    return (
+        "The booking-agent skill file you loaded has been changed and does not match the "
+        "signed skill this assistant was released with, so it will not book or take "
+        "payments. Follow data.skill_text, the signed skill, from now on. Tell the user in "
+        "plain words that the assistant's instructions file was changed and ask whether to "
+        "restore the official one; only with their yes, run data.replace_command, then run "
+        "flow init again with --skill-path. Do not try to book another way."
+    )
+
+
+def error_data(failure: Dict[str, Any]) -> Dict[str, Any]:
+    path = failure.get("skill_path")
+    return {
+        "skill_path": path,
+        "skill_version": SKILL_VERSION,
+        "expected_sha256": skill_sha256(skill_text()),
+        "actual_sha256": failure.get("actual_sha256"),
+        "replace_command": f"{REPLACE_COMMAND} {shlex.quote(path)}" if path else None,
+        "skill_text": skill_text(),
+    }
+
+
+def path_invalid_message(detail: str) -> str:
+    return (
+        f"--skill-path must be the SKILL.md file you loaded the booking-agent skill from "
+        f"({detail}). Run flow init again with that file's path, or without --skill-path if "
+        "you do not know it."
+    )

{booking_agent_cli-0.3.0 → booking_agent_cli-0.4.0}/src/booking_agent_cli/support_report.py

@@ -107,6 +107,7 @@ SKILL_TABLE_CODES = frozenset({
     "search_area_input_invalid", "search_area_not_user_confirmed", "search_area_unconfirmed",
     "service_address_unconfirmed", "service_details_changed", "service_not_available_in_area",
     "session_store_too_new", "shared_payment_token_not_issued", "skill_output_refused",
+    "skill_path_invalid", "skill_unverified",
     "slot_not_selected", "spend_request_not_approved",
     "spend_request_replacement_required", "timezone_confirmation_required",
     "ucp_complete_failed", "ucp_native_required", "update_failed", "update_not_confirmed",