Function writeSkillAndComputeIntegrity

src/lib/sources.ts:341–375

* Write skill files to disk, compute integrity, and check against the lockfile. * Returns the computed LockedSkill entry.

(params: {
  skillName: string;
  files: Array<{ relativePath: string; content: string }>;
  curatedDir: string;
  locked: LockedSource | undefined;
  resolvedSha: string;
  sourceKey: string;
  logger: Logger;
})

 * Returns the computed LockedSkill entry.
 */
async function writeSkillAndComputeIntegrity(params: {
  skillName: string;
  files: Array<{ relativePath: string; content: string }>;
  curatedDir: string;
  locked: LockedSource | undefined;
  resolvedSha: string;
  sourceKey: string;
  logger: Logger;
}): Promise<LockedSkill> {
  const { skillName, files, curatedDir, locked, resolvedSha, sourceKey, logger } = params;
  const written: Array<{ path: string; content: string }> = [];

  for (const file of files) {
    checkPathTraversal({
      relativePath: file.relativePath,
      intendedRootDir: join(curatedDir, skillName),
    });
    await writeFileContent(join(curatedDir, skillName, file.relativePath), file.content);
    written.push({ path: file.relativePath, content: file.content });
  }

  const integrity = computeSkillIntegrity(written);
  const lockedSkillEntry = locked?.skills[skillName];
  if (
    lockedSkillEntry?.integrity &&
    lockedSkillEntry.integrity !== integrity &&
    resolvedSha === locked?.resolvedRef
  ) {
    logger.warn(
      `Integrity mismatch for skill "${skillName}" from ${sourceKey}: expected "${lockedSkillEntry.integrity}", got "${integrity}". Content may have been tampered with.`,
    );
  }

  return { integrity };
}

/**
 * Merge newly fetched skills with existing locked skills and update the lockfile.