feat(pack): kind=skills content packs + depth-1 dependency resolution (GH #727) - #743
Merged
Conversation
… (GH #727) Phase 3 of the Unified Distribution (#724): kind=skills — verified content packs: - content.documents payload: per-file DocumentBlob (path, sha256 of plaintext, zstd+base64 body) with hard caps (64 files / 256 KiB file / 1 MiB total); kind coherence enforced both ways - pack create --kind skills --name @ns/name --from <dir>: deterministic, signed build from a directory (hidden/VCS files skipped, sorted walk) - install materializes blobs read-only under packages/skills/<name>/<ver> before the index is touched; a tampered blob aborts the whole install - pack remove cleans the materialized tree with the package - path safety: rejects absolute/.. paths, .ctxpkg store names, >6 depth; bodies pass the standard redaction pipeline at build time Depth-1 dependency resolution (deliberately non-transitive): - deps.rs: SemVer ranges via semver crate — highest non-yanked match; self-dependency and unscoped names refused; optional deps skipped - pack install <ns>/<name>: resolves declared deps after the root, everything lands in ctxpkg.lock (root + deps pinned) - offline-reproducible: locked + in-store deps skip the network; an unpinned re-install with a store hit never fetches (pack update does) - pack update <ns>/<name>: refreshes root + deps to newest matches - addon add <ns>/<name>: declared deps join the consent preview and install after wiring; addon update refreshes deps even when the addon binary itself is already current E2E-verified against a local registry: install-with-dep, lockfile pins, offline reinstall (server down), dep-only version bump via pack update, tamper refusal, read-only materialization. Co-authored-by: Cursor <cursoragent@cursor.com>
…LOC gate) pack_cmd.rs crossed the 1500-line CI gate after the depth-1 dependency resolution landed. The remote-install path (cmd_pack_install_remote, install_declared_dependencies, cmd_pack_update) is a cohesive unit — it moves to cli/pack_remote.rs unchanged; pack_cmd keeps the local store, create, import/export and A2A commands. Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #727 — Phase 3 of the Unified Distribution epic (#724).
kind=skills — verified content packs
content.documentspayload: per-fileDocumentBlob(path,sha256of plaintext,zstd+base64body) with hard caps (64 files / 256 KiB per file / 1 MiB total)kind=skillsrequiresdocuments, all other kinds must not carry itpack create --kind skills --name @ns/name --from <dir>— deterministic, signed build from a directory (hidden/VCS files skipped, sorted walk, redaction pipeline applied)packages/skills/<name>/<version>/before the index is touched — a tampered blob aborts the whole install, never leaving a half-registered packagepack removecleans the materialized tree with the package..,.ctxpkgnames and >6 depth are refusedDepth-1 dependency resolution (deliberately non-transitive)
deps.rs: SemVer ranges via thesemvercrate — highest non-yanked match wins; self-dependencies and unscoped names refused; optional deps skippedpack install <ns>/<name>resolves declared deps after the root; everything lands inctxpkg.lockpack update <ns>/<name>refreshes root + deps to the newest matching versionsaddon add <ns>/<name>: declared deps join the consent preview and install after wiring;addon updaterefreshes deps even when the addon binary is already currentVerification
--all-features -D warningsclean, doc + gen_docs + Windows cross-compile greenpack update; tamper → refused; materialized files read-onlyFollow-ups (deliberately out of scope)
kind=grammarpayloads (Phase 4, Unified Distribution Phase 4: one publisher identity — signing + commerce consolidation #728)Made with Cursor