@aion0/forge 0.8.4 → 0.8.5

package/RELEASE_NOTES.md

@@ -1,12 +1,8 @@
-# Forge v0.8.4
+# Forge v0.8.5
 
 Released: 2026-05-20
 
-## Changes since v0.8.3
+## Changes since v0.8.4
 
-### Other
-- fix(http-protocol): apply manifest parameter defaults before template expansion
-- fix(http-protocol): drop unsubstituted {args.*} query params
 
-
-**Full Changelog**: https://github.com/aiwatching/forge/compare/v0.8.3...v0.8.4
+**Full Changelog**: https://github.com/aiwatching/forge/compare/v0.8.4...v0.8.5

package/app/api/skills/install-local/route.ts

@@ -30,6 +30,19 @@ import { homedir } from 'node:os';
 import { getDb } from '@/src/core/db/database';
 import { getDbPath } from '@/src/config';
 
+/**
+ * Refuse to clobber an existing skill (registry-synced or previously
+ * uploaded). The wrapper-dir / frontmatter inside a zip can easily
+ * collide with an existing name without the user noticing — better to
+ * fail loudly than silently overwrite. To re-install, the user must
+ * uninstall the existing one first.
+ */
+function nameConflict(name: string): { conflict: true; source: 'registry' | 'local' } | { conflict: false } {
+  const row = db().prepare('SELECT source FROM skills WHERE name = ?').get(name) as any;
+  if (!row) return { conflict: false };
+  return { conflict: true, source: row.source === 'local' ? 'local' : 'registry' };
+}
+
 const MAX_BYTES = 5 * 1024 * 1024;          // 5 MB
 const MAX_FILE_BYTES = 1 * 1024 * 1024;     // 1 MB per file
 const MAX_FILES = 50;
@@ -153,11 +166,30 @@ function writeSkillToDisk(payload: InstallPayload, projectPath?: string): { targ
     ensureDir(dirname(target));
     writeFileSync(target, f.data, { mode: 0o600 });
   }
+  // Synthesize info.json if the upload didn't include one. The sync /
+  // refresh layer reads version + description from here; without it,
+  // a hand-uploaded skill shows up with blank metadata. `source: "local"`
+  // (plus uploaded_at) marks it as a manual upload — distinguishable
+  // from anything pulled from the remote registry.
+  const hasInfoJson = payload.files.some((f) => f.path === 'info.json');
+  if (!hasInfoJson) {
+    const info = {
+      name: payload.name,
+      version: payload.version || '0.1.0',
+      description: payload.description || '',
+      tags: [],
+      score: 0,
+      rating: 0,
+      source: 'local',
+      uploaded_at: new Date().toISOString(),
+    };
+    writeFileSync(join(root, 'info.json'), JSON.stringify(info, null, 2), { mode: 0o600 });
+  }
   return { targetDir: root };
 }
 
 function upsertSkillRow(payload: InstallPayload, projectPath?: string): void {
-  const existing = db().prepare('SELECT installed_global, installed_projects FROM skills WHERE name = ?')
+  const existing = db().prepare('SELECT installed_global, installed_projects, source FROM skills WHERE name = ?')
     .get(payload.name) as any;
   const installedProjects: string[] = existing
     ? (() => { try { return JSON.parse(existing.installed_projects || '[]'); } catch { return []; } })()
@@ -208,6 +240,13 @@ export async function POST(req: Request) {
         nameRaw || undefined,
       );
       if (!built.ok) return NextResponse.json({ ok: false, error: built.error }, { status: 400 });
+      {
+        const c = nameConflict(built.payload.name);
+        if (c.conflict) {
+          const which = c.source === 'registry' ? 'synced from the marketplace registry' : 'already uploaded';
+          return NextResponse.json({ ok: false, error: `A skill named "${built.payload.name}" is ${which}. Uninstall it first, or rename your upload (or the SKILL.md frontmatter \`name:\`) before re-uploading.` }, { status: 409 });
+        }
+      }
       writeSkillToDisk(built.payload, body.project_path || undefined);
       upsertSkillRow(built.payload, body.project_path || undefined);
       return NextResponse.json({ ok: true, name: built.payload.name, version: built.payload.version || '0.1.0' });
@@ -219,6 +258,13 @@ export async function POST(req: Request) {
         nameRaw || undefined,
       );
       if (!built.ok) return NextResponse.json({ ok: false, error: built.error }, { status: 400 });
+      {
+        const c = nameConflict(built.payload.name);
+        if (c.conflict) {
+          const which = c.source === 'registry' ? 'synced from the marketplace registry' : 'already uploaded';
+          return NextResponse.json({ ok: false, error: `A skill named "${built.payload.name}" is ${which}. Uninstall it first, or rename your upload (or the SKILL.md frontmatter \`name:\`) before re-uploading.` }, { status: 409 });
+        }
+      }
       writeSkillToDisk(built.payload, body.project_path || undefined);
       upsertSkillRow(built.payload, body.project_path || undefined);
       return NextResponse.json({ ok: true, name: built.payload.name, version: built.payload.version || '0.1.0' });
@@ -267,6 +313,13 @@ export async function POST(req: Request) {
 
     const built = buildPayload(files, nameOverride);
     if (!built.ok) return NextResponse.json({ ok: false, error: built.error }, { status: 400 });
+    {
+      const c = nameConflict(built.payload.name);
+      if (c.conflict) {
+        const which = c.source === 'registry' ? 'synced from the marketplace registry' : 'already uploaded';
+        return NextResponse.json({ ok: false, error: `A skill named "${built.payload.name}" is ${which}. Uninstall it first, or rename your upload (or the SKILL.md frontmatter \`name:\`) before re-uploading.` }, { status: 409 });
+      }
+    }
     const { targetDir } = writeSkillToDisk(built.payload, projectPath);
     upsertSkillRow(built.payload, projectPath);
     return NextResponse.json({

package/components/SkillsPanel.tsx

@@ -174,8 +174,15 @@ export default function SkillsPanel({ projectFilter }: { projectFilter?: string
       setSkills(data.skills || []);
       setProjects(data.projects || []);
       const localData = await localRes.json();
-      // Filter out items already in registry
-      const registryNames = new Set((data.skills || []).map((s: any) => s.name));
+      // Hide filesystem items that match a *synced* registry row (those
+      // belong to the registry list). Uploaded items (source='local')
+      // are intentionally not in this set so they appear under "Local"
+      // — that's where users expect to find what they just uploaded.
+      const registryNames = new Set(
+        (data.skills || [])
+          .filter((s: any) => s.source !== 'local')
+          .map((s: any) => s.name)
+      );
       setLocalItems((localData.items || []).filter((i: any) => !registryNames.has(i.name)));
     } catch {}
     setLoading(false);
@@ -247,6 +254,17 @@ export default function SkillsPanel({ projectFilter }: { projectFilter?: string
     try {
       const fd = new FormData();
       fd.append('file', file);
+      // Use the upload filename as the default install name. Without
+      // this, the server falls back to frontmatter / wrapper-dir name,
+      // which can silently clobber an unrelated skill (e.g. uploading
+      // prelude-nac.zip whose wrapper dir is `prelude/` would overwrite
+      // the registry-synced `prelude`).
+      const baseName = file.name
+        .replace(/\.(md|zip)$/i, '')
+        .toLowerCase()
+        .replace(/[^a-z0-9_-]/g, '-')
+        .replace(/^-+|-+$/g, '');
+      if (/^[a-z0-9][a-z0-9_-]*$/.test(baseName)) fd.append('name', baseName);
       const r = await fetch('/api/skills/install-local', { method: 'POST', body: fd });
       const j = await r.json();
       if (!r.ok || j.ok === false) {
@@ -254,6 +272,7 @@ export default function SkillsPanel({ projectFilter }: { projectFilter?: string
         return;
       }
       await fetchSkills();
+      alert(`Uploaded as "${j.name}" → ${j.target}`);
     } catch (e) {
       alert(`Upload failed: ${e instanceof Error ? e.message : String(e)}`);
     } finally { setUploading(false); }
@@ -352,6 +371,7 @@ export default function SkillsPanel({ projectFilter }: { projectFilter?: string
   // Filter by project, type, and search
   const q = searchQuery.toLowerCase();
   const filtered = (typeFilter === 'local' ? [] : skills
+    .filter(s => s.source !== 'local') // local-uploaded skills render under the Local section instead
     .filter(s => projectFilter ? (s.installedGlobal || s.installedProjects.includes(projectFilter)) : true)
     .filter(s => typeFilter === 'all' ? true : s.type === typeFilter)
     .filter(s => !q || s.name.toLowerCase().includes(q) || s.displayName.toLowerCase().includes(q) || s.description.toLowerCase().includes(q)
@@ -426,7 +446,7 @@ export default function SkillsPanel({ projectFilter }: { projectFilter?: string
           type="button"
           onClick={() => skillUploadRef.current?.click()}
           disabled={uploading}
-          title="Upload a local skill — SKILL.md or a .zip bundle. Falls outside the forge-skills registry."
+          title="Upload your own skill — SKILL.md or a .zip bundle. Stored locally, not synced from the marketplace."
           className="text-[9px] text-[var(--text-secondary)] hover:text-[var(--text-primary)] disabled:opacity-50"
         >
           {uploading ? 'Uploading…' : '+ Upload'}
@@ -501,8 +521,10 @@ export default function SkillsPanel({ projectFilter }: { projectFilter?: string
                 </div>
               );
             })}
-            {/* Local items — collapsible by scope group */}
-            {(typeFilter === 'all' || typeFilter === 'local') && filteredLocal.length > 0 && (
+            {/* Local items — collapsible by scope group. Visible on
+                All/Local AND on Skills/Commands so uploaded items show
+                up under their own type tab too. */}
+            {(typeFilter === 'all' || typeFilter === 'local' || typeFilter === 'skill' || typeFilter === 'command') && filteredLocal.length > 0 && (
               <>
                 {/* Local section header — collapsible */}
                 {typeFilter !== 'local' && (

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aion0/forge",
-  "version": "0.8.4",
+  "version": "0.8.5",
   "description": "Unified AI workflow platform — multi-model task orchestration, persistent sessions, web terminal, remote access",
   "type": "module",
   "scripts": {