@baique/pi-web-sky 0.1.35 → 0.1.37

package/lib/skill-updates.ts

@@ -0,0 +1,263 @@
+import { execFile } from "child_process";
+import { mkdtemp, rm } from "fs/promises";
+import { tmpdir } from "os";
+import { join } from "path";
+import { promisify } from "util";
+import type {
+  SkillInstallInfo,
+  SkillUpdateResult,
+} from "@/lib/api-types";
+
+const CHECK_TIMEOUT_MS = 15_000;
+const GIT_CHECK_TIMEOUT_MS = 30_000;
+const DEFAULT_SKILLS_API_BASE = process.env.SKILLS_API_URL || "https://skills.sh";
+const execFileAsync = promisify(execFile);
+
+type Fetcher = (input: string, init?: RequestInit) => Promise<Response>;
+type GitTreeResolver = (install: SkillInstallInfo) => Promise<string>;
+
+interface CheckOptions {
+  fetcher?: Fetcher;
+  skillsApiBase?: string;
+  githubToken?: string;
+  resolveGitTreeHash?: GitTreeResolver;
+}
+
+interface GitHubTreeEntry {
+  path?: unknown;
+  type?: unknown;
+  sha?: unknown;
+}
+
+interface GitHubTreeResponse {
+  sha?: unknown;
+  tree?: unknown;
+}
+
+interface SnapshotResponse {
+  hash?: unknown;
+}
+
+class HttpError extends Error {
+  constructor(readonly status: number) {
+    super(`HTTP ${status}`);
+  }
+}
+
+export function skillUpdateKey(install: Pick<SkillInstallInfo, "scope" | "package">): string {
+  return `${install.scope}\0${install.package}`;
+}
+
+export function buildSkillUpdateArgs(install: SkillInstallInfo): string[] {
+  const folder = skillFolder(install.skillPath ?? "");
+  const source = folder ? `${install.source}/${folder}` : install.source;
+  const ref = install.ref ? `#${encodeURIComponent(install.ref)}` : "";
+  const args = [
+    "skills",
+    "add",
+    `${source}${ref}`,
+    "--skill",
+    skillNameFromPackage(install.package),
+    "-y",
+    "--agent",
+    "pi",
+  ];
+  if (install.scope === "global") args.push("-g");
+  return args;
+}
+
+function skillSlug(name: string): string {
+  return name
+    .toLowerCase()
+    .replace(/[\s_]+/g, "-")
+    .replace(/[^a-z0-9-]/g, "")
+    .replace(/-+/g, "-")
+    .replace(/^-|-$/g, "");
+}
+
+function skillNameFromPackage(pkg: string): string {
+  const at = pkg.lastIndexOf("@");
+  return at >= 0 ? pkg.slice(at + 1) : pkg;
+}
+
+function skillFolder(skillPath: string): string {
+  let folder = skillPath.replace(/\\/g, "/");
+  if (folder.toLowerCase().endsWith("/skill.md")) folder = folder.slice(0, -9);
+  else if (folder.toLowerCase().endsWith("skill.md")) folder = folder.slice(0, -8);
+  return folder.replace(/\/$/, "");
+}
+
+function result(
+  install: SkillInstallInfo,
+  state: SkillUpdateResult["state"],
+  latestVersion?: string,
+  message?: string,
+): SkillUpdateResult {
+  return {
+    package: install.package,
+    scope: install.scope,
+    state,
+    currentVersion: install.versionHash,
+    latestVersion,
+    message,
+  };
+}
+
+async function fetchJson(
+  url: string,
+  fetcher: Fetcher,
+  headers?: HeadersInit,
+): Promise<unknown> {
+  const response = await fetcher(url, {
+    cache: "no-store",
+    headers,
+    signal: AbortSignal.timeout(CHECK_TIMEOUT_MS),
+  });
+  if (!response.ok) throw new HttpError(response.status);
+  return response.json();
+}
+
+async function resolveGitTreeHash(install: SkillInstallInfo): Promise<string> {
+  const repository = `https://github.com/${install.source}.git`;
+  const ref = install.ref || "HEAD";
+  const folder = skillFolder(install.skillPath!);
+  const gitDir = await mkdtemp(join(tmpdir(), "pi-web-skill-check-"));
+
+  try {
+    await execFileAsync("git", ["init", "--bare", gitDir], {
+      timeout: GIT_CHECK_TIMEOUT_MS,
+    });
+    await execFileAsync("git", [
+      `--git-dir=${gitDir}`,
+      "fetch",
+      "--depth=1",
+      "--filter=blob:none",
+      "--no-tags",
+      repository,
+      ref,
+    ], { timeout: GIT_CHECK_TIMEOUT_MS });
+    const revision = folder ? `FETCH_HEAD:${folder}` : "FETCH_HEAD^{tree}";
+    const { stdout } = await execFileAsync(
+      "git",
+      [`--git-dir=${gitDir}`, "rev-parse", revision],
+      { timeout: GIT_CHECK_TIMEOUT_MS },
+    );
+    const hash = stdout.trim();
+    if (!/^[0-9a-f]{40}$/i.test(hash)) throw new Error("Invalid Git tree hash");
+    return hash;
+  } finally {
+    await rm(gitDir, { recursive: true, force: true });
+  }
+}
+
+async function checkGlobalSkill(
+  install: SkillInstallInfo,
+  options: Required<Pick<CheckOptions, "fetcher" | "resolveGitTreeHash">> & CheckOptions,
+): Promise<SkillUpdateResult> {
+  const ref = install.ref || "HEAD";
+  const url = `https://api.github.com/repos/${install.source}/git/trees/${encodeURIComponent(ref)}?recursive=1`;
+  const headers: Record<string, string> = {
+    Accept: "application/vnd.github.v3+json",
+    "User-Agent": "pi-web",
+  };
+  if (options.githubToken) headers.Authorization = `Bearer ${options.githubToken}`;
+  const folder = skillFolder(install.skillPath!);
+  let latestVersion: string | undefined;
+
+  try {
+    const raw = (await fetchJson(url, options.fetcher, headers)) as GitHubTreeResponse;
+    latestVersion = typeof raw.sha === "string" && !folder ? raw.sha : undefined;
+
+    if (folder && Array.isArray(raw.tree)) {
+      const entry = (raw.tree as GitHubTreeEntry[]).find(
+        (item) => item.type === "tree" && item.path === folder,
+      );
+      if (entry && typeof entry.sha === "string") latestVersion = entry.sha;
+    }
+  } catch (error) {
+    if (!(error instanceof HttpError) || ![401, 403, 429].includes(error.status)) {
+      throw error;
+    }
+    latestVersion = await options.resolveGitTreeHash(install);
+  }
+
+  if (!latestVersion) {
+    return result(install, "error", undefined, "Remote skill path was not found.");
+  }
+  return result(
+    install,
+    latestVersion === install.versionHash ? "up-to-date" : "update-available",
+    latestVersion,
+  );
+}
+
+async function checkProjectSkill(
+  install: SkillInstallInfo,
+  options: Required<Pick<CheckOptions, "fetcher" | "skillsApiBase">> & CheckOptions,
+): Promise<SkillUpdateResult> {
+  const [owner, repo] = install.source.split("/");
+  const name = skillSlug(skillNameFromPackage(install.package));
+  const url = `${options.skillsApiBase}/api/download/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/${encodeURIComponent(name)}`;
+  const raw = (await fetchJson(url, options.fetcher)) as SnapshotResponse;
+  const latestVersion = typeof raw.hash === "string" ? raw.hash : undefined;
+  if (!latestVersion) {
+    return result(install, "error", undefined, "skills.sh did not return a version hash.");
+  }
+  return result(
+    install,
+    latestVersion === install.versionHash ? "up-to-date" : "update-available",
+    latestVersion,
+  );
+}
+
+export async function checkSkillUpdate(
+  install: SkillInstallInfo,
+  options: CheckOptions = {},
+): Promise<SkillUpdateResult> {
+  if (!install.canCheckForUpdates || !install.versionHash || !install.skillPath) {
+    return result(install, "unsupported", undefined, "This lock entry cannot be checked automatically.");
+  }
+
+  const resolvedOptions = {
+    ...options,
+    fetcher: options.fetcher ?? fetch,
+    skillsApiBase: options.skillsApiBase ?? DEFAULT_SKILLS_API_BASE,
+    resolveGitTreeHash: options.resolveGitTreeHash ?? resolveGitTreeHash,
+  };
+
+  try {
+    return install.scope === "global"
+      ? await checkGlobalSkill(install, resolvedOptions)
+      : await checkProjectSkill(install, resolvedOptions);
+  } catch (error) {
+    return result(
+      install,
+      "error",
+      undefined,
+      error instanceof Error ? error.message : String(error),
+    );
+  }
+}
+
+export async function checkSkillUpdates(
+  installs: SkillInstallInfo[],
+  options: CheckOptions = {},
+): Promise<SkillUpdateResult[]> {
+  const fetcher = options.fetcher ?? fetch;
+  const requests = new Map<string, Promise<Response>>();
+  const cachedFetcher: Fetcher = async (input, init) => {
+    let request = requests.get(input);
+    if (!request) {
+      request = fetcher(input, init);
+      requests.set(input, request);
+    }
+    return (await request).clone();
+  };
+
+  return Promise.all(
+    installs.map((install) => checkSkillUpdate(install, {
+      ...options,
+      fetcher: cachedFetcher,
+    })),
+  );
+}

package/lib/skills-service.ts

@@ -0,0 +1,16 @@
+import { DefaultResourceLoader, getAgentDir } from "@earendil-works/pi-coding-agent";
+import type { SkillInfo, SkillsResponse } from "@/lib/api-types";
+import { annotateSkillsWithInstallInfo } from "@/lib/skill-lock";
+import { getProjectTrustStatus, projectTrustReloadOptions } from "@/lib/project-trust";
+
+export async function loadSkillsWithInstallInfo(cwd: string): Promise<SkillsResponse> {
+  const agentDir = getAgentDir();
+  const loader = new DefaultResourceLoader({ cwd, agentDir });
+  await loader.reload(projectTrustReloadOptions(cwd, agentDir));
+  const { skills, diagnostics } = loader.getSkills();
+  return {
+    skills: annotateSkillsWithInstallInfo(skills as SkillInfo[], { cwd, agentDir }),
+    diagnostics,
+    projectResourcesLoaded: getProjectTrustStatus(cwd, agentDir).trusted,
+  };
+}

package/lib/slash-display.test.mjs

@@ -0,0 +1,122 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+const { skillExpansionToCommand } = await import("./slash-display.ts");
+
+function skillExpansion({
+  name = "review",
+  location = "/path/to/review/SKILL.md",
+  baseDir = "/path/to/review",
+  body = "Review the supplied files.",
+  args,
+} = {}) {
+  return `<skill name="${name}" location="${location}">\nReferences are relative to ${baseDir}.\n\n${body}\n</skill>${args === undefined ? "" : `\n\n${args}`}`;
+}
+
+test("restores a complete SDK skill expansion with arguments", () => {
+  const result = skillExpansionToCommand(skillExpansion({ args: "src/main.ts" }));
+  assert.equal(result?.command, "/skill:review src/main.ts");
+});
+
+test("restores a complete SDK skill expansion without arguments", () => {
+  const result = skillExpansionToCommand(skillExpansion());
+  assert.equal(result?.command, "/skill:review");
+});
+
+test("restores multiline arguments", () => {
+  const result = skillExpansionToCommand(
+    skillExpansion({ args: "first line\nsecond line" }),
+  );
+  assert.equal(
+    result?.command,
+    "/skill:review first line\nsecond line",
+  );
+});
+
+test("uses the final closing tag when the skill body contains an example", () => {
+  const result = skillExpansionToCommand(
+    skillExpansion({
+      body: "Example:\n</skill>\nContinue.",
+      args: "src",
+    }),
+  );
+  assert.equal(result?.command, "/skill:review src");
+});
+
+test("does not collapse incomplete or lookalike user text", () => {
+  assert.equal(
+    skillExpansionToCommand(
+      '<skill name="review" location="/path/to/review/SKILL.md">\nordinary user text',
+    ),
+    null,
+  );
+  assert.equal(
+    skillExpansionToCommand(
+      '<skill name="review" location="/path/to/review/SKILL.md">\nReferences are elsewhere.\n\nbody\n</skill>',
+    ),
+    null,
+  );
+  assert.equal(skillExpansionToCommand("ordinary user text"), null);
+});
+
+test("collapse keeps session auto-naming free of skill XML", () => {
+  const firstMessage = skillExpansion({ name: "agent-md", args: "写计划" });
+  const result = skillExpansionToCommand(firstMessage);
+  const collapsed = result?.command ?? firstMessage;
+  assert.equal(collapsed, "/skill:agent-md 写计划");
+  // The sidebar slices the display form to 50 chars for the fallback title.
+  assert.ok(collapsed.length <= 50);
+  assert.ok(!collapsed.includes("<skill"));
+});
+
+test("plain first messages pass through unchanged for naming", () => {
+  assert.equal(
+    skillExpansionToCommand("hello world")?.command ?? "hello world",
+    "hello world",
+  );
+  assert.equal(
+    skillExpansionToCommand("")?.command ?? "",
+    "",
+  );
+});
+
+test("extracts the skill body (document) for expanded view", () => {
+  const result = skillExpansionToCommand(
+    skillExpansion({ body: "## 使用说明\n\n这是技能文档内容。" }),
+  );
+  assert.equal(result?.command, "/skill:review");
+  assert.equal(result?.skillBody, "## 使用说明\n\n这是技能文档内容。");
+});
+
+test("extracts a multiline skill body without leaking the envelope", () => {
+  const input = `<skill name="analyze" location="/path/SKILL.md">\nReferences are relative to /path.\n\n第一步：调研\n第二步：建模\n</skill>\n\n请分析一下项目结构`;
+  const result = skillExpansionToCommand(input);
+  assert.equal(result?.command, "/skill:analyze 请分析一下项目结构");
+  // skillBody must be exactly the skill document, not the whole envelope.
+  assert.equal(result?.skillBody, "第一步：调研\n第二步：建模");
+  assert.ok(!result?.skillBody.includes("<skill"));
+  assert.ok(!result?.skillBody.includes("</skill>"));
+});
+
+test("extracts user message after closing skill tag", () => {
+  const input = `<skill name="review" location="/path/SKILL.md">\nReferences are relative to /path.\n\nbody text\n</skill>\n\nThis is the user's actual message.`;
+  const result = skillExpansionToCommand(input);
+  // Group 4 captures the text after </skill>\n\n which doubles as args
+  // AND the user's prompt.
+  assert.equal(result?.command, "/skill:review This is the user's actual message.");
+  assert.equal(result?.userMessage, "This is the user's actual message.");
+});
+
+test("userMessage is undefined when skill has no trailing message", () => {
+  const input = `<skill name="review" location="/path/SKILL.md">\nReferences are relative to /path.\n\nbody text\n</skill>`;
+  const result = skillExpansionToCommand(input);
+  assert.equal(result?.command, "/skill:review");
+  assert.equal(result?.userMessage, undefined);
+});
+
+test("userMessage includes args when args are after skill tag", () => {
+  const input = `<skill name="review" location="/path/SKILL.md">\nReferences are relative to /path.\n\nbody\n</skill>\n\n--arg1 value1`;
+  const result = skillExpansionToCommand(input);
+  assert.equal(result?.command, "/skill:review --arg1 value1");
+  assert.equal(result?.userMessage, "--arg1 value1");
+});

package/lib/slash-display.ts

@@ -0,0 +1,30 @@
+/**
+ * Display-only restoration for the exact envelope emitted by pi's
+ * `_expandSkillCommand`. The expanded text remains the stored session input.
+ */
+const SKILL_EXPANSION_RE = /^<skill name="([^"\n]+)" location="([^"\n]+)">\nReferences are relative to [^\n]+\.\n\n([\s\S]*)\n<\/skill>(?:\n\n([\s\S]+))?$/;
+
+/**
+ * Restore a complete SDK skill expansion to its compact command form.
+ *
+ * The expression intentionally requires the opening envelope, matching
+ * base-directory reference, final closing tag, and an optional two-newline args
+ * suffix. This avoids collapsing ordinary text that merely starts with a
+ * skill-looking tag. The greedy body capture makes the final closing tag win
+ * when a skill body contains an example `</skill>` tag.
+ *
+ * Returns `{ command, skillBody, userMessage }` — skillBody is the skill
+ * document between the opening tag and `</skill>` (shown when expanded),
+ * userMessage is the text after the closing tag (the user's actual prompt,
+ * kept as-is), or undefined if there is no separate user message.
+ */
+export function skillExpansionToCommand(
+  text: string,
+): { command: string; skillBody: string; userMessage?: string } | null {
+  const match = text.match(SKILL_EXPANSION_RE);
+  if (!match) return null;
+
+  const [, name, , body, args] = match;
+  const command = args ? `/skill:${name} ${args}` : `/skill:${name}`;
+  return { command, skillBody: body, userMessage: match[4] };
+}

package/lib/sqlite-db.test.mjs

@@ -0,0 +1,140 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { DatabaseSync } from "node:sqlite";
+import { createJiti } from "jiti";
+
+const jiti = createJiti(import.meta.url, { interopDefault: true, moduleCache: false });
+const { initSchema, SCHEMA_VERSION } = await jiti.import("./sqlite-db.ts");
+
+function memoryDb() {
+  const db = new DatabaseSync(":memory:");
+  initSchema(db);
+  return db;
+}
+
+test("initSchema creates all four tables (idempotent)", () => {
+  const db = memoryDb();
+  db.exec("PRAGMA journal_mode = WAL;"); // ensure no-op doesn't throw
+  const names = db
+    .prepare("SELECT name FROM sqlite_master WHERE name NOT LIKE 'sqlite_%'")
+    .all()
+    .map((r) => r.name);
+  for (const t of ["tasks", "session_meta", "search_state", "session_search"]) {
+    assert.ok(names.includes(t), `missing table ${t}`);
+  }
+  // Second init must not throw (idempotent).
+  initSchema(db);
+  assert.ok(true);
+});
+
+test("migrations upgrade an old v0 database (adds pinned + sort_order)", () => {
+  const db = new DatabaseSync(":memory:");
+  // 模拟无版本管理时代的老库：基础表，无 pinned/sort_order 列，user_version=0。
+  db.exec(`
+    CREATE TABLE tasks (
+      id TEXT PRIMARY KEY,
+      project_key TEXT NOT NULL,
+      name TEXT NOT NULL,
+      created INTEGER NOT NULL,
+      updated INTEGER NOT NULL
+    );
+    CREATE TABLE session_meta (
+      session_id TEXT PRIMARY KEY,
+      task_id TEXT,
+      updated INTEGER NOT NULL
+    );
+    INSERT INTO tasks (id, project_key, name, created, updated) VALUES ('t1', 'p', 'A', 1, 1);
+  `);
+  db.exec("PRAGMA user_version = 0");
+
+  initSchema(db);
+
+  const v = db.prepare("PRAGMA user_version").get().user_version;
+  assert.equal(v, SCHEMA_VERSION);
+  const taskCols = db.prepare("SELECT name FROM pragma_table_info('tasks')").all().map((r) => r.name);
+  assert.ok(taskCols.includes("pinned"), "tasks.pinned added by v1");
+  assert.ok(taskCols.includes("sort_order"), "tasks.sort_order added by v2");
+  const metaCols = db.prepare("SELECT name FROM pragma_table_info('session_meta')").all().map((r) => r.name);
+  assert.ok(metaCols.includes("pinned"), "session_meta.pinned added by v1");
+  // 老数据保留，新列默认值可用。
+  const row = db.prepare("SELECT name, pinned, sort_order FROM tasks WHERE id = 't1'").get();
+  assert.equal(row.name, "A");
+  assert.equal(row.pinned, 0);
+  assert.equal(row.sort_order, 0);
+});
+
+test("migrations are idempotent and skip already-applied versions", () => {
+  const db = new DatabaseSync(":memory:");
+  initSchema(db); // fresh -> SCHEMA_VERSION
+  const v1 = db.prepare("PRAGMA user_version").get().user_version;
+  initSchema(db); // second run must be a no-op
+  const v2 = db.prepare("PRAGMA user_version").get().user_version;
+  assert.equal(v1, v2);
+  assert.equal(v1, SCHEMA_VERSION);
+});
+
+test("v1 database (pinned present, no sort_order) upgrades to v2 only", () => {
+  const db = new DatabaseSync(":memory:");
+  db.exec(`
+    CREATE TABLE tasks (
+      id TEXT PRIMARY KEY,
+      project_key TEXT NOT NULL,
+      name TEXT NOT NULL,
+      created INTEGER NOT NULL,
+      updated INTEGER NOT NULL,
+      pinned INTEGER NOT NULL DEFAULT 0
+    );
+    CREATE TABLE session_meta (
+      session_id TEXT PRIMARY KEY,
+      task_id TEXT,
+      updated INTEGER NOT NULL,
+      pinned INTEGER NOT NULL DEFAULT 0
+    );
+  `);
+  db.exec("PRAGMA user_version = 1");
+
+  initSchema(db);
+
+  assert.equal(db.prepare("PRAGMA user_version").get().user_version, SCHEMA_VERSION);
+  const cols = db.prepare("SELECT name FROM pragma_table_info('tasks')").all().map((r) => r.name);
+  assert.ok(cols.includes("sort_order"));
+  assert.equal(cols.filter((c) => c === "pinned").length, 1, "pinned not duplicated");
+});
+
+test("FTS5 trigram indexes Chinese substrings", () => {
+  const db = memoryDb();
+  db.prepare("INSERT INTO session_search(session_id, title, body) VALUES (?, ?, ?)")
+    .run("s1", "修复登录接口", "hello world 你好");
+  // 4-char query matches mid-token (unicode61 would fail this).
+  const byMatch = db.prepare("SELECT session_id FROM session_search WHERE session_search MATCH ?")
+    .all('"登录接口"');
+  assert.deepEqual(byMatch.map((r) => r.session_id), ["s1"]);
+});
+
+test("FTS5 trigram short-query falls back to LIKE", () => {
+  const db = memoryDb();
+  db.prepare("INSERT INTO session_search(session_id, title, body) VALUES (?, ?, ?)")
+    .run("s1", "修复登录接口", "做个登录页 hello world");
+  // 2-char trigram MATCH misses entirely (needs >= 3 chars).
+  const byMatch = db.prepare("SELECT session_id FROM session_search WHERE session_search MATCH ?")
+    .all('"登录"');
+  assert.equal(byMatch.length, 0, "2-char MATCH must not hit (documents the LIKE fallback need)");
+  // LIKE on the FTS table is the short-query path — hits both columns.
+  const byTitleLike = db.prepare("SELECT session_id FROM session_search WHERE title LIKE ?").all("%登录%");
+  assert.equal(byTitleLike.length, 1);
+  const byBodyLike = db.prepare("SELECT session_id FROM session_search WHERE body LIKE ?").all("%登录%");
+  assert.equal(byBodyLike.length, 1);
+  // LIKE stays case-insensitive-free for Latin (trigram) — plain contains check:
+  const byEnglishLike = db.prepare("SELECT session_id FROM session_search WHERE body LIKE ?").all("%hello%");
+  assert.equal(byEnglishLike.length, 1);
+});
+
+test("session_search keeps UNINDEXED session_id column distinct from content", () => {
+  const db = memoryDb();
+  db.prepare("INSERT INTO session_search(session_id, title, body) VALUES (?, ?, ?)")
+    .run("s-a-b", "t1", "b1");
+  db.prepare("INSERT INTO session_search(session_id, title, body) VALUES (?, ?, ?)")
+    .run("s-x-y", "t2", "b2");
+  const rows = db.prepare("SELECT session_id FROM session_search").all();
+  assert.deepEqual(rows.map((r) => r.session_id), ["s-a-b", "s-x-y"]);
+});