@bibobonking/opensol 3.1.4 → 3.1.5

package/server/lib/skills.mjs

@@ -1,128 +1,413 @@
-import { gunzipSync } from 'node:zlib'
+// Agent Skills store. A skill is a folder with a SKILL.md (YAML frontmatter: name, description)
+// plus any bundled files (scripts/, references/, assets/). Folders live in <data>/skills/<name>/.
+// The model only sees name + description up front and loads the rest on demand with the `skill` tool.
+import { execFile } from 'node:child_process'
+import { randomBytes } from 'node:crypto'
+import { mkdir, mkdtemp, readdir, readFile, rename, rm, stat, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
 import { HttpError } from './http.mjs'
+import { DATA_DIR, loadState } from './store.mjs'
 
-const MAX_TARBALL = 12 * 1024 * 1024
-const MAX_FILES = 200
-const MAX_FILE = 512 * 1024
-
-function registryName(pkg) {
-  return pkg.startsWith('@') ? pkg.replace('/', '%2f') : encodeURIComponent(pkg)
-}
-
-/** Minimal ustar reader: enough for npm packages, no extra dependency. */
-function untar(buffer) {
-  const files = new Map()
-  let offset = 0
-  while (offset + 512 <= buffer.length) {
-    const header = buffer.subarray(offset, offset + 512)
-    const name = header.subarray(0, 100).toString('utf8').replace(/\0.*$/, '')
-    if (!name) break
-    const size = parseInt(header.subarray(124, 136).toString('utf8').replace(/\0.*$/, '').trim(), 8) || 0
-    const type = String.fromCharCode(header[156] || 48)
-    const prefix = header.subarray(345, 500).toString('utf8').replace(/\0.*$/, '')
-    const full = prefix ? `${prefix}/${name}` : name
-    offset += 512
-    if (type === '0' || type === '\0' || type === '48') {
-      if (files.size < MAX_FILES && size > 0 && size <= MAX_FILE) {
-        files.set(full, buffer.subarray(offset, offset + size).toString('utf8'))
-      }
-    }
-    offset += Math.ceil(size / 512) * 512
-  }
-  return files
+export const SKILLS_DIR = path.join(DATA_DIR, 'skills')
+const STATE_FILE = path.join(SKILLS_DIR, '.state.json')
+const META_FILE = '.skill-meta.json'
+
+const MAX_FILES = 500
+const MAX_FILE_BYTES = 1024 * 1024
+const MAX_TOTAL_BYTES = 6 * 1024 * 1024
+const MAX_READ_BYTES = 200 * 1024
+const NPM_TIMEOUT_MS = 120_000
+const NPM_SPEC = /^(?:@[a-z0-9~][a-z0-9-._~]*\/)?[a-z0-9~][a-z0-9-._~]*(?:@[A-Za-z0-9][A-Za-z0-9._+-]*)?$/
+const SKIP_DIRS = new Set(['node_modules', '.git', '.svn', '.hg', '__pycache__'])
+const TEXT_EXT = /\.(md|markdown|txt|json|ya?ml|toml|csv|tsv|xml|html?|css|js|mjs|cjs|ts|tsx|jsx|py|sh|bash|zsh|ps1|rb|go|rs|java|c|h|cpp|sql|ini|cfg|env|svg)$/i
+
+let writes = Promise.resolve()
+function serial(task) {
+  const next = writes.then(task, task)
+  writes = next.catch(() => undefined)
+  return next
 }
 
-function skillFile(files) {
-  const candidates = [...files.keys()].filter((path) => /(^|\/)SKILL\.md$/i.test(path))
-  candidates.sort((a, b) => a.split('/').length - b.split('/').length || a.localeCompare(b))
-  return candidates[0] ?? ''
+export function slugifySkillName(value) {
+  const slug = String(value ?? '')
+    .toLowerCase()
+    .replace(/[^a-z0-9._-]+/g, '-')
+    .replace(/^[-._]+|[-._]+$/g, '')
+    .slice(0, 64)
+  return slug
 }
 
-function parseSkill(markdown, fallbackName) {
-  const text = markdown.replace(/\r\n/g, '\n')
-  const front = /^---\n([\s\S]*?)\n---\n?/.exec(text)
+function assertName(name) {
+  if (typeof name !== 'string' || !/^[a-z0-9][a-z0-9._-]{0,63}$/.test(name)) {
+    throw new HttpError(400, 'Invalid skill name.', 'invalid_skill_name')
+  }
+  return name
+}
+
+/** Minimal YAML frontmatter reader: scalars, quoted strings and `>` / `|` blocks. */
+export function parseSkillMarkdown(text) {
+  const clean = String(text ?? '').replace(/^/, '')
+  const match = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/.exec(clean)
   const meta = {}
-  let body = text
-  if (front) {
-    for (const line of front[1].split('\n')) {
-      const match = /^([A-Za-z0-9_-]+)\s*:\s*(.*)$/.exec(line.trim())
-      if (match) meta[match[1].toLowerCase()] = match[2].replace(/^["']|["']$/g, '').trim()
+  let body = clean
+  if (match) {
+    body = match[2]
+    const lines = match[1].split(/\r?\n/)
+    for (let index = 0; index < lines.length; index += 1) {
+      const entry = /^([A-Za-z_][\w-]*)\s*:\s*(.*)$/.exec(lines[index])
+      if (!entry) continue
+      const key = entry[1]
+      let value = entry[2].trim()
+      if (/^[>|][+-]?$/.test(value)) {
+        const block = []
+        while (index + 1 < lines.length && (/^\s+/.test(lines[index + 1]) || lines[index + 1] === '')) {
+          block.push(lines[index + 1].trim())
+          index += 1
+        }
+        value = block.join(value.startsWith('>') ? ' ' : '\n').trim()
+      } else if (/^(["']).*\1$/.test(value)) {
+        value = value.slice(1, -1)
+      }
+      meta[key] = value
     }
-    body = text.slice(front[0].length)
   }
+  return { meta, body: body.trim() }
+}
+
+function describeSkill(raw, folder) {
+  const { meta, body } = parseSkillMarkdown(raw)
   const heading = /^#\s+(.+)$/m.exec(body)
-  const paragraph = body
+  const firstParagraph = body
     .split(/\n\s*\n/)
     .map((part) => part.trim())
-    .find((part) => part && !part.startsWith('#') && !part.startsWith('---'))
+    .find((part) => part && !part.startsWith('#'))
   return {
-    name: meta.name || heading?.[1]?.trim() || fallbackName,
-    description: (meta.description || paragraph || 'Installed from npm').replace(/[#>*`]/g, '').replace(/\s+/g, ' ').slice(0, 200),
-    instructions: body.trim(),
+    name: slugifySkillName(meta.name || folder) || slugifySkillName(heading?.[1]) || folder,
+    description: String(meta.description || firstParagraph || heading?.[1] || '')
+      .replace(/\s+/g, ' ')
+      .trim()
+      .slice(0, 600),
   }
 }
 
-function slug(value) {
-  return String(value || 'skill')
-    .toLowerCase()
-    .replace(/^@[^/]+\//, '')
-    .replace(/[^a-z0-9-]+/g, '-')
-    .replace(/^-+|-+$/g, '')
-    .slice(0, 48) || 'skill'
+async function readState() {
+  try {
+    const parsed = JSON.parse(await readFile(STATE_FILE, 'utf8'))
+    return {
+      disabled: Array.isArray(parsed.disabled) ? parsed.disabled.filter((item) => typeof item === 'string') : [],
+      legacyMigrated: parsed.legacyMigrated === true,
+    }
+  } catch {
+    return { disabled: [], legacyMigrated: false }
+  }
+}
+
+async function writeState(state) {
+  await mkdir(SKILLS_DIR, { recursive: true, mode: 0o700 })
+  await writeFile(STATE_FILE, `${JSON.stringify(state, null, 2)}\n`, { mode: 0o600 })
+}
+
+async function walk(root, base = root, depth = 0, out = []) {
+  if (depth > 8) return out
+  let entries
+  try {
+    entries = await readdir(base, { withFileTypes: true })
+  } catch {
+    return out
+  }
+  for (const entry of entries) {
+    if (entry.name === META_FILE) continue
+    const full = path.join(base, entry.name)
+    if (entry.isDirectory()) {
+      if (SKIP_DIRS.has(entry.name)) continue
+      await walk(root, full, depth + 1, out)
+    } else if (entry.isFile()) {
+      const info = await stat(full)
+      out.push({ path: path.relative(root, full).split(path.sep).join('/'), size: info.size })
+    }
+  }
+  return out
 }
 
-export async function installSkillFromNpm(packageName) {
-  const pkg = String(packageName ?? '').trim()
-  if (!/^(@[a-z0-9-_.]+\/)?[a-z0-9-_.]+$/i.test(pkg)) {
-    throw new HttpError(400, 'Enter a valid npm package name, for example @scope/skill-name.', 'bad_skill_package')
+async function loadSkillRecord(folder, disabled) {
+  const dir = path.join(SKILLS_DIR, folder)
+  let raw
+  try {
+    raw = await readFile(path.join(dir, 'SKILL.md'), 'utf8')
+  } catch {
+    return null
   }
-  const metaResponse = await fetch(`https://registry.npmjs.org/${registryName(pkg)}`, {
-    signal: AbortSignal.timeout(20_000),
+  let meta = {}
+  try {
+    meta = JSON.parse(await readFile(path.join(dir, META_FILE), 'utf8'))
+  } catch {
+    // Folder was placed by hand; that is fine.
+  }
+  const info = describeSkill(raw, folder)
+  const files = await walk(dir)
+  return {
+    name: folder,
+    title: info.name,
+    description: info.description,
+    enabled: !disabled.includes(folder),
+    source: typeof meta.source === 'string' ? meta.source : 'folder',
+    installedAt: typeof meta.installedAt === 'string' ? meta.installedAt : '',
+    fileCount: files.length,
+    size: files.reduce((total, file) => total + file.size, 0),
+    path: dir,
+  }
+}
+
+async function migrateLegacy() {
+  const state = await readState()
+  if (state.legacyMigrated) return
+  try {
+    const legacy = (await loadState()).settings?.skills
+    if (Array.isArray(legacy)) {
+      for (const item of legacy) {
+        if (!item || typeof item !== 'object' || item.builtIn === true) continue
+        const name = slugifySkillName(item.name)
+        const instructions = typeof item.instructions === 'string' ? item.instructions.trim() : ''
+        if (!name || !instructions) continue
+        const dir = path.join(SKILLS_DIR, name)
+        await mkdir(dir, { recursive: true, mode: 0o700 })
+        const description = String(item.description ?? '').replace(/\s+/g, ' ').trim()
+        const header = `---\nname: ${name}\ndescription: ${JSON.stringify(description || String(item.name))}\n---\n\n`
+        await writeFile(path.join(dir, 'SKILL.md'), `${header}${instructions}\n`, { mode: 0o600 })
+        await writeFile(path.join(dir, META_FILE), JSON.stringify({ source: 'legacy', installedAt: new Date().toISOString() }))
+        if (item.enabled !== true) state.disabled.push(name)
+      }
+    }
+  } catch {
+    // Migration is best-effort.
+  }
+  state.legacyMigrated = true
+  await writeState(state)
+}
+
+export async function listSkills() {
+  await mkdir(SKILLS_DIR, { recursive: true, mode: 0o700 })
+  await serial(migrateLegacy)
+  const { disabled } = await readState()
+  const folders = (await readdir(SKILLS_DIR, { withFileTypes: true }))
+    .filter((entry) => entry.isDirectory() && !entry.name.startsWith('.'))
+    .map((entry) => entry.name)
+    .sort()
+  const records = []
+  for (const folder of folders) {
+    const record = await loadSkillRecord(folder, disabled)
+    if (record) records.push(record)
+  }
+  return records
+}
+
+function safeRelative(input) {
+  const parts = String(input ?? '')
+    .replace(/\\/g, '/')
+    .split('/')
+    .filter((part) => part && part !== '.')
+  if (parts.length === 0 || parts.some((part) => part === '..' || SKIP_DIRS.has(part))) return null
+  return parts.join('/')
+}
+
+/** files: [{ path, bytes: Buffer }] with forward-slash relative paths. Finds every SKILL.md root and installs it. */
+async function installFiles(files, source) {
+  if (files.length === 0) throw new HttpError(400, 'No files were provided.', 'empty_skill')
+  if (files.length > MAX_FILES) throw new HttpError(400, `A skill can hold at most ${MAX_FILES} files.`, 'skill_too_large')
+  let total = 0
+  for (const file of files) {
+    if (file.bytes.length > MAX_FILE_BYTES) {
+      throw new HttpError(400, `${file.path} is larger than 1 MB.`, 'skill_too_large')
+    }
+    total += file.bytes.length
+  }
+  if (total > MAX_TOTAL_BYTES) throw new HttpError(400, 'Skill folder is larger than 6 MB.', 'skill_too_large')
+
+  const roots = files
+    .filter((file) => path.posix.basename(file.path).toLowerCase() === 'skill.md')
+    .map((file) => path.posix.dirname(file.path))
+    .map((dir) => (dir === '.' ? '' : dir))
+  if (roots.length === 0) {
+    throw new HttpError(400, 'No SKILL.md found. A skill folder must contain a SKILL.md file.', 'missing_skill_md')
+  }
+  // Keep outermost roots only so scripts/ or references/ never turn into skills of their own.
+  const unique = [...new Set(roots)].sort((a, b) => a.length - b.length)
+  const outer = unique.filter((root) => !unique.some((other) => other !== root && (other === '' || root.startsWith(`${other}/`))))
+  const effective = outer.length > 0 ? outer : unique
+
+  const installed = []
+  await serial(async () => {
+    await mkdir(SKILLS_DIR, { recursive: true, mode: 0o700 })
+    for (const root of effective) {
+      const prefix = root ? `${root}/` : ''
+      const members = files.filter((file) => (root ? file.path.startsWith(prefix) : true))
+      const skillFile = members.find((file) => file.path.slice(prefix.length).toLowerCase() === 'skill.md')
+      if (!skillFile) continue
+      const folder = root ? path.posix.basename(root) : ''
+      const info = describeSkill(skillFile.bytes.toString('utf8'), slugifySkillName(folder) || 'skill')
+      const name = slugifySkillName(info.name) || slugifySkillName(folder)
+      if (!name) throw new HttpError(400, 'The skill needs a name in its SKILL.md frontmatter.', 'missing_skill_name')
+
+      const stage = path.join(SKILLS_DIR, `.stage-${randomBytes(4).toString('hex')}`)
+      await mkdir(stage, { recursive: true, mode: 0o700 })
+      for (const member of members) {
+        const relative = member.path.slice(prefix.length)
+        const target = path.join(stage, ...relative.split('/'))
+        await mkdir(path.dirname(target), { recursive: true, mode: 0o700 })
+        await writeFile(target, member.bytes, { mode: 0o600 })
+      }
+      // Normalise the entry file name so lookups are case-stable.
+      if (skillFile.path.slice(prefix.length) !== 'SKILL.md') {
+        await rename(path.join(stage, skillFile.path.slice(prefix.length)), path.join(stage, 'SKILL.md'))
+      }
+      await writeFile(path.join(stage, META_FILE), JSON.stringify({ source, installedAt: new Date().toISOString() }))
+      const final = path.join(SKILLS_DIR, name)
+      await rm(final, { recursive: true, force: true })
+      await rename(stage, final)
+      installed.push(name)
+    }
   })
-  if (!metaResponse.ok) {
-    throw new HttpError(404, `npm could not find "${pkg}".`, 'skill_not_found')
+  if (installed.length === 0) throw new HttpError(400, 'No valid skill was found.', 'missing_skill_md')
+  const state = await readState()
+  if (installed.some((name) => state.disabled.includes(name))) {
+    await writeState({ ...state, disabled: state.disabled.filter((name) => !installed.includes(name)) })
   }
-  const meta = await metaResponse.json()
-  const version = meta?.['dist-tags']?.latest
-  const tarball = version ? meta?.versions?.[version]?.dist?.tarball : ''
-  if (!version || typeof tarball !== 'string' || !tarball.startsWith('https://registry.npmjs.org/')) {
-    throw new HttpError(502, 'npm did not return a download for that package.', 'skill_not_found')
+  return installed
+}
+
+/** Browser folder upload: entries carry webkitRelativePath-style paths and base64 data. */
+export async function installSkillUpload(entries) {
+  if (!Array.isArray(entries)) throw new HttpError(400, 'Expected a list of files.', 'invalid_skill_upload')
+  const files = []
+  for (const entry of entries) {
+    if (!entry || typeof entry !== 'object' || typeof entry.data !== 'string') continue
+    const relative = safeRelative(entry.path)
+    if (!relative) continue
+    files.push({ path: relative, bytes: Buffer.from(entry.data, 'base64') })
   }
-  const archiveResponse = await fetch(tarball, { signal: AbortSignal.timeout(30_000) })
-  if (!archiveResponse.ok) throw new HttpError(502, 'Could not download the skill package.', 'skill_download_failed')
-  const bytes = new Uint8Array(await archiveResponse.arrayBuffer())
-  if (bytes.length > MAX_TARBALL) throw new HttpError(413, 'That package is too large for a skill.', 'skill_too_large')
+  return installFiles(files, 'upload')
+}
 
-  let files
+function run(file, args, options) {
+  return new Promise((resolve, reject) => {
+    execFile(file, args, { ...options, windowsHide: true, maxBuffer: 4 * 1024 * 1024 }, (error, stdout, stderr) => {
+      if (error) reject(Object.assign(error, { stdout, stderr }))
+      else resolve({ stdout, stderr })
+    })
+  })
+}
+
+export async function installSkillFromNpm(spec) {
+  const value = typeof spec === 'string' ? spec.trim() : ''
+  if (!NPM_SPEC.test(value)) {
+    throw new HttpError(400, 'Enter an npm package name such as @scope/my-skills or my-skills@1.2.0.', 'invalid_npm_spec')
+  }
+  const at = value.lastIndexOf('@')
+  const packageName = at > 0 ? value.slice(0, at) : value
+  const work = await mkdtemp(path.join(tmpdir(), 'opensol-skill-'))
   try {
-    files = untar(gunzipSync(bytes))
+    await writeFile(path.join(work, 'package.json'), '{"name":"opensol-skill-install","private":true}\n')
+    const npm = process.platform === 'win32' ? 'npm.cmd' : 'npm'
+    try {
+      await run(
+        npm,
+        ['install', '--ignore-scripts', '--no-audit', '--no-fund', '--no-package-lock', '--omit=dev', '--loglevel=error', value],
+        { cwd: work, timeout: NPM_TIMEOUT_MS, shell: process.platform === 'win32' },
+      )
+    } catch (error) {
+      const detail = String(error?.stderr || error?.message || '').split('\n').find((line) => line.trim()) ?? ''
+      throw new HttpError(
+        400,
+        `npm could not install "${value}".${detail ? ` ${detail.trim().slice(0, 200)}` : ''}`,
+        'npm_install_failed',
+      )
+    }
+    const packageDir = path.join(work, 'node_modules', ...packageName.split('/'))
+    const found = await walk(packageDir)
+    const files = []
+    for (const file of found) {
+      const relative = safeRelative(file.path)
+      if (!relative) continue
+      files.push({ path: relative, bytes: await readFile(path.join(packageDir, ...relative.split('/'))) })
+    }
+    // A package whose only skill is its root SKILL.md takes the package name.
+    const rootSkill = files.find((file) => file.path.toLowerCase() === 'skill.md')
+    if (rootSkill && !parseSkillMarkdown(rootSkill.bytes.toString('utf8')).meta.name) {
+      const body = rootSkill.bytes.toString('utf8')
+      const slug = slugifySkillName(packageName.replace(/^@/, '').replace('/', '-'))
+      rootSkill.bytes = Buffer.from(`---\nname: ${slug}\n---\n\n${body}`)
+    }
+    return await installFiles(files, `npm:${value}`)
+  } finally {
+    await rm(work, { recursive: true, force: true }).catch(() => undefined)
+  }
+}
+
+export async function removeSkill(name) {
+  assertName(name)
+  await serial(async () => {
+    await rm(path.join(SKILLS_DIR, name), { recursive: true, force: true })
+    const state = await readState()
+    await writeState({ ...state, disabled: state.disabled.filter((item) => item !== name) })
+  })
+}
+
+export async function setSkillEnabled(name, enabled) {
+  assertName(name)
+  await serial(async () => {
+    const state = await readState()
+    const disabled = new Set(state.disabled)
+    if (enabled) disabled.delete(name)
+    else disabled.add(name)
+    await writeState({ ...state, disabled: [...disabled] })
+  })
+}
+
+/** Load a skill for the model: SKILL.md (with the frontmatter removed) or one bundled text file. */
+export async function readSkill(name, file) {
+  assertName(name)
+  const dir = path.join(SKILLS_DIR, name)
+  let raw
+  try {
+    raw = await readFile(path.join(dir, 'SKILL.md'), 'utf8')
   } catch {
-    throw new HttpError(502, 'That package is not a readable npm tarball.', 'skill_download_failed')
-  }
-  // Strip the leading "package/" folder npm adds.
-  const normalised = new Map()
-  for (const [path, content] of files) {
-    const clean = path.replace(/^package\//, '').replace(/\\/g, '/')
-    if (clean && !clean.includes('..')) normalised.set(clean, content)
-  }
-  const skillPath = skillFile(normalised)
-  if (!skillPath) throw new HttpError(400, 'That package has no SKILL.md, so it is not a skill.', 'skill_missing_manifest')
-  const root = skillPath.includes('/') ? skillPath.slice(0, skillPath.lastIndexOf('/') + 1) : ''
-  const scoped = new Map()
-  for (const [path, content] of normalised) {
-    if (root && !path.startsWith(root)) continue
-    scoped.set(root ? path.slice(root.length) : path, content)
-  }
-  const parsed = parseSkill(normalised.get(skillPath), pkg)
+    throw new HttpError(404, `Skill "${name}" is not installed.`, 'skill_not_found')
+  }
+  const { disabled } = await readState()
+  if (disabled.includes(name)) throw new HttpError(403, `Skill "${name}" is turned off in Settings → Skills.`, 'skill_disabled')
+
+  if (typeof file === 'string' && file.trim() && file.trim().toLowerCase() !== 'skill.md') {
+    const relative = safeRelative(file)
+    if (!relative) throw new HttpError(400, 'Invalid file path.', 'invalid_skill_file')
+    const target = path.join(dir, ...relative.split('/'))
+    if (!target.startsWith(`${dir}${path.sep}`)) throw new HttpError(400, 'Invalid file path.', 'invalid_skill_file')
+    let info
+    try {
+      info = await stat(target)
+    } catch {
+      throw new HttpError(404, `File "${relative}" is not in skill "${name}".`, 'skill_file_not_found')
+    }
+    if (!info.isFile()) throw new HttpError(400, `"${relative}" is not a file.`, 'invalid_skill_file')
+    if (!TEXT_EXT.test(relative)) {
+      return { name, file: relative, directory: dir, content: `(binary or unknown file type, ${info.size} bytes — use it from a shell command at ${target})` }
+    }
+    const content = await readFile(target, 'utf8')
+    return {
+      name,
+      file: relative,
+      directory: dir,
+      content: content.length > MAX_READ_BYTES ? `${content.slice(0, MAX_READ_BYTES)}\n… truncated` : content,
+    }
+  }
+
+  const { body } = parseSkillMarkdown(raw)
+  const files = (await walk(dir)).filter((item) => item.path !== 'SKILL.md')
   return {
-    id: `skill_${slug(pkg)}`,
-    name: parsed.name,
-    description: parsed.description,
-    instructions: parsed.instructions,
-    enabled: true,
-    source: 'npm',
-    package: pkg,
-    version,
-    files: Object.fromEntries(scoped),
+    name,
+    file: 'SKILL.md',
+    directory: dir,
+    content: body.length > MAX_READ_BYTES ? `${body.slice(0, MAX_READ_BYTES)}\n… truncated` : body,
+    files: files.map((item) => item.path),
   }
 }

package/server/lib/tools.mjs

@@ -5,7 +5,6 @@ import {
   chmod,
   lstat,
   mkdir,
-  mkdtemp,
   readdir,
   readFile,
   realpath,
@@ -15,7 +14,6 @@ import {
   writeFile,
 } from 'node:fs/promises'
 import { isIP } from 'node:net'
-import os from 'node:os'
 import path from 'node:path'
 import { HttpError } from './http.mjs'
 import { loadState, loadSecretsSafe } from './store.mjs'
@@ -973,39 +971,6 @@ export async function checkpointSummary(id) {
   return checkpoint ? describeCheckpoint(checkpoint) : null
 }
 
-/**
- * Skills are uploaded as text files. Materialise them in a throwaway folder,
- * run one command there, and delete the folder so nothing leaks between calls.
- */
-async function runSkillScript({ files, command }) {
-  if (!files || typeof files !== 'object') throw new HttpError(400, 'The skill has no files.', 'bad_skill')
-  const entries = Object.entries(files).filter(
-    (entry) => typeof entry[1] === 'string' && typeof entry[0] === 'string' && entry[0].trim(),
-  )
-  if (entries.length === 0) throw new HttpError(400, 'The skill has no files.', 'bad_skill')
-  if (entries.length > 200) throw new HttpError(400, 'A skill may ship at most 200 files.', 'skill_too_large')
-  const root = await mkdtemp(path.join(os.tmpdir(), 'opensol-skill-'))
-  try {
-    for (const [relative, content] of entries) {
-      const clean = relative.replace(/\\/g, '/').replace(/^\/+/, '')
-      const absolute = path.resolve(root, clean)
-      if (!absolute.startsWith(`${root}${path.sep}`)) {
-        throw new HttpError(400, `Unsafe path in skill files: ${relative}`, 'bad_skill')
-      }
-      await mkdir(path.dirname(absolute), { recursive: true })
-      await writeFile(absolute, content.slice(0, 512 * 1024))
-    }
-    const result = await runProcess('/bin/bash', ['-lc', String(command ?? '')], {
-      cwd: root,
-      timeoutMs: 120_000,
-      env: { OPENSOL_SKILL_ROOT: root },
-    })
-    return result
-  } finally {
-    await rm(root, { recursive: true, force: true }).catch(() => undefined)
-  }
-}
-
 export async function executeTool(name, args = {}, { mode = 'build', checkpoint = '' } = {}) {
   const input = args && typeof args === 'object' ? args : {}
   // The prompt promises the daemon enforces plan mode, so enforce it here and not only in the UI.
@@ -1016,9 +981,6 @@ export async function executeTool(name, args = {}, { mode = 'build', checkpoint
       'plan_readonly',
     )
   }
-  if (mode === 'plan' && name === 'skill_run') {
-    throw new HttpError(403, 'Plan mode is read-only. Skill scripts may change the machine.', 'plan_readonly')
-  }
   if (checkpoint && FILE_MUTATIONS.has(name)) {
     try {
       const { root, absolute, relative } = await resolveWorkspacePath(String(input.path ?? ''), { allowRoot: false })
@@ -1055,8 +1017,6 @@ export async function executeTool(name, args = {}, { mode = 'build', checkpoint
       return readUrl(String(input.url ?? ''))
     case 'git':
       return runGit(String(input.action ?? 'status'), input, { mode })
-    case 'skill_run':
-      return runSkillScript({ files: input.files, command: input.command })
     default:
       throw new HttpError(400, `Unknown tool: ${name}`, 'unknown_tool')
   }

package/src/agent/adapters/openai-responses.ts

@@ -190,11 +190,7 @@ export async function streamOpenAIResponses(request: AdapterRequest): Promise<Ad
       const done = itemRecord(event.response)
       const value = itemRecord(done.usage)
       if (typeof value.input_tokens === 'number' || typeof value.output_tokens === 'number') {
-        usage = {
-          input: Number(value.input_tokens) || undefined,
-          output: Number(value.output_tokens) || undefined,
-          cost: typeof value.cost === 'number' ? value.cost : undefined,
-        }
+        usage = { input: Number(value.input_tokens) || undefined, output: Number(value.output_tokens) || undefined }
         handlers.onUsage(usage)
       }
     }

package/src/agent/adapters/openai.ts

@@ -95,10 +95,8 @@ export async function streamOpenAI(request: AdapterRequest): Promise<AdapterResu
   if (settings.provider === 'openai' || settings.provider === 'openrouter') {
     body.stream_options = { include_usage: true }
   }
-  if (settings.provider === 'openrouter') {
-    // Ask OpenRouter to include the credit cost in the final usage chunk.
-    body.usage = { include: true }
-  }
+  // OpenRouter bills in credits and returns the exact cost when asked.
+  if (settings.provider === 'openrouter') body.usage = { include: true }
   if (usesCompletionTokens(settings.provider, modelId)) {
     body.max_completion_tokens = settings.maxTokens
   } else {
@@ -138,16 +136,11 @@ export async function streamOpenAI(request: AdapterRequest): Promise<AdapterResu
     }
 
     if (payload.usage && typeof payload.usage === 'object') {
-      const value = payload.usage as {
-        prompt_tokens?: number
-        completion_tokens?: number
-        cost?: number
-        total_cost?: number
-      }
+      const value = payload.usage as { prompt_tokens?: number; completion_tokens?: number; cost?: number }
       usage = {
         input: value.prompt_tokens,
         output: value.completion_tokens,
-        cost: typeof value.cost === 'number' ? value.cost : typeof value.total_cost === 'number' ? value.total_cost : undefined,
+        cost: typeof value.cost === 'number' && Number.isFinite(value.cost) ? value.cost : undefined,
       }
       handlers.onUsage(usage)
     }