Update Skills-over-MCP host to current SEP-2640 schema + directory read - #825
Merged
evalstate merged 5 commits intoJun 19, 2026
Merged
Conversation
Bring fast-agent's SEP-2640 host support up to two Working Group decisions that landed after the initial registry implementation (PR evalstate#815). Index schema (ADR 2026-06-05): parse the verbatim `frontmatter` object and a per-skill `archives[]` array (`{url, mimeType, digest}`) instead of the old flat `type`/`name`/`description` entries. An entry must supply a usable `url`, a non-empty `archives`, or both; old `type`-based entries are no longer parsed. Install prefers an archive when offered, else the direct SKILL.md; archive extraction routes by media type with a URL-suffix fallback. resources/directory/read (ADR 2026-06-09): add `directoryRead` capability detection, a `read_directory()` client-session method + aggregator routing, and use it at install time to materialize a direct-entry skill's supporting files (best-effort, with the existing path-traversal/size-bomb guards). Split the install client protocol (`McpSkillInstallClient`) from the narrow scan client. Tests rewritten to the new schema with added coverage for frontmatter/archives parsing, skip rules, capability detection, and the directory walk. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Cap the SEP-2640 resources/directory/read walk so a buggy or hostile server cannot hang an install: limit total pages (the never-terminating nextCursor case), total entries, and nesting depth via a shared _WalkLimits counter and an explicit depth parameter. Limit breaches raise and are swallowed by the existing best-effort handler, leaving the valid single-file skill in place. Document that walked supporting files carry no per-file digests and are written on the server's word alone, unlike the digest-verified SKILL.md and archive artifacts. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Self-review fixes for the SEP-2640 directory-read install path: - Reject Windows path separators and drive anchors in _validate_archive_name. A PurePosixPath-only check let server-supplied names like "..\..\evil.md" escape install_dir on Windows (AnyUrl preserves backslashes while it collapses forward-slash "../"). - Skip the verified SKILL.md case-insensitively so an unverified sibling named "skill.md"/"SKILL.MD" cannot clobber the digest-checked file on case-insensitive filesystems. - Log dropped resources (outside the skill root, or a file-branch resource with no bytes from an untagged directory) so an incomplete install is diagnosable instead of silent. - Materialize supporting files into a staging dir and merge into install_dir only on full success, so a mid-walk failure leaves the valid single-file skill intact rather than a half-written tree. - Extract _validate_url_and_digest shared by direct entries and archives, removing the duplicated non-empty / non-file:// / sha256 checks. Adds tests for backslash/drive rejection, no-clobber of SKILL.md, and partial-write rollback. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Self-review fixes for the directory-walk / install path: - Cap each supporting file at MAX_SUPPORTING_FILE_BYTES so a single oversized resource cannot be decoded into memory before the cumulative budget rejects it. - Promote the "resource returned no content" drop from debug to warning so an untagged directory silently omitting its children is diagnosable. - Normalize the skill root URI through AnyUrl (matching how child resource URIs arrive) so a dot-segment/encoding difference no longer silently drops children. - Match the "/SKILL.md" suffix case-insensitively so a "/skill.md" url still triggers supporting-file materialization. - read_directory now requires an explicit server_name instead of fanning out across servers (which could read a same-named URI off the wrong server and mask real errors). - Dedup _get_resource_from_server / _read_directory_from_server behind a shared _execute_resource_read helper; directory reads now emit the READING_RESOURCE progress event they previously lacked. - Make the validated archive mimeType authoritative in _archive_strategy and drop the legacy .zip URL-suffix guess. Adds regression tests for the per-resource cap and the case-insensitive root. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Condense multi-paragraph docstrings and inline comments across the registry, aggregator, and client session to the essential rationale. Also correct the MAX_SUPPORTING_FILE_BYTES comment, which overstated memory protection; it bounds per-file size under the cumulative budget. Comments only -- no behavior change. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Owner
|
Thank you! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates the SEP-2640 Skills-over-MCP host to the current spec.
What
archives[]schema (drops the oldtype/flat fields). An entry needs a usableurlor non-emptyarchives; archive is preferred over the directSKILL.mdwhen both are present.resources/directory/read(directoryReadcapability) to materialize a direct-entry skill's supporting files. The walk is bounded (pages/entries/depth/per-file/total bytes), stages all-or-nothing so a mid-walk failure leaves the digest-verifiedSKILL.mdintact, and guards Windows path traversal.read_directoryrequires an explicitserver_name(no fan-out).Testing
uv run scripts/lint.pyclean;uv run scripts/typecheck.pyshows only pre-existing diagnostics in unrelated files.🤖 Generated with Claude Code - edited