@dotobokuri/fleet-console 1.28.0 → 1.29.0

package/dist/fleet-plugins/repository/routes.mjs

@@ -8,12 +8,12 @@ import fs from 'fs/promises';
 function definePlugin(definition) {
   return definition;
 }
-function registerRouter(ctx, path5, handler) {
-  ctx.registerRouter(normalizePath(path5), handler);
+function registerRouter(ctx, path4, handler) {
+  ctx.registerRouter(normalizePath(path4), handler);
 }
-function normalizePath(path5) {
-  if (path5.length === 0 || path5 === "/") return "/";
-  return path5;
+function normalizePath(path4) {
+  if (path4.length === 0 || path4 === "/") return "/";
+  return path4;
 }
 
 // ../../packages/core-process/src/hidden.ts
@@ -154,24 +154,8 @@ function isNoHeadError(error) {
   if (error.code !== "non_zero_exit") return false;
   return error.stderr.includes("unknown revision") || error.stderr.includes("bad revision");
 }
-async function resolveGitCwd(theaterPath, rawSubPath) {
-  if (rawSubPath === "") return { gitCwd: theaterPath };
-  const resolvedSub = path2.resolve(theaterPath, rawSubPath);
-  if (!resolvedSub.startsWith(theaterPath + path2.sep) && resolvedSub !== theaterPath) return null;
-  if (path2.normalize(rawSubPath).startsWith("..")) return null;
-  let realTheater;
-  let realSub;
-  try {
-    [realTheater, realSub] = await Promise.all([
-      fs.realpath(theaterPath),
-      fs.realpath(resolvedSub)
-    ]);
-  } catch {
-    return null;
-  }
-  const norm = realTheater.endsWith(path2.sep) ? realTheater : realTheater + path2.sep;
-  if (realSub !== realTheater && !realSub.startsWith(norm)) return null;
-  return { gitCwd: resolvedSub };
+function resolveGitCwd(theaterPath) {
+  return { gitCwd: theaterPath };
 }
 async function handleRepositoryChanged(req, res, ctx) {
   if (req.method !== "POST") {
@@ -183,7 +167,7 @@ async function handleRepositoryChanged(req, res, ctx) {
     return;
   }
   const body = await ctx.host.http.readJsonBody(req);
-  if (!isPlainObject(body)) {
+  if (!isPlainObject(body) || "subPath" in body) {
     ctx.host.http.writeJson(res, 400, { error: "invalid_request" });
     return;
   }
@@ -197,12 +181,7 @@ async function handleRepositoryChanged(req, res, ctx) {
     ctx.host.http.writeJson(res, 404, { error: "theater_not_found" });
     return;
   }
-  const rawSubPath = typeof body.subPath === "string" ? body.subPath : "";
-  const cwdResult = await resolveGitCwd(theaterPath, rawSubPath);
-  if (!cwdResult) {
-    ctx.host.http.writeJson(res, 403, { error: "path_outside_theater" });
-    return;
-  }
+  const cwdResult = resolveGitCwd(theaterPath);
   const { gitCwd } = cwdResult;
   try {
     await ensureGitRepository(gitCwd);
@@ -252,7 +231,7 @@ async function handleRepositoryFile(req, res, ctx) {
     return;
   }
   const body = await ctx.host.http.readJsonBody(req);
-  if (!isPlainObject(body) || typeof body.filePath !== "string") {
+  if (!isPlainObject(body) || "subPath" in body || typeof body.filePath !== "string") {
     ctx.host.http.writeJson(res, 400, { error: "invalid_request" });
     return;
   }
@@ -271,12 +250,7 @@ async function handleRepositoryFile(req, res, ctx) {
     ctx.host.http.writeJson(res, 404, { error: "theater_not_found" });
     return;
   }
-  const rawSubPath = typeof body.subPath === "string" ? body.subPath : "";
-  const cwdResult = await resolveGitCwd(theaterPath, rawSubPath);
-  if (!cwdResult) {
-    ctx.host.http.writeJson(res, 403, { error: "path_outside_theater" });
-    return;
-  }
+  const cwdResult = resolveGitCwd(theaterPath);
   const { gitCwd } = cwdResult;
   const rawFilePath = body.filePath;
   const resolvedFilePath = path2.resolve(gitCwd, rawFilePath);
@@ -376,7 +350,7 @@ async function handleRepositoryCommit(req, res, ctx) {
     return;
   }
   const body = await ctx.host.http.readJsonBody(req);
-  if (!isPlainObject2(body)) {
+  if (!isPlainObject2(body) || "subPath" in body) {
     ctx.host.http.writeJson(res, 400, { error: "invalid_request" });
     return;
   }
@@ -395,12 +369,7 @@ async function handleRepositoryCommit(req, res, ctx) {
     ctx.host.http.writeJson(res, 404, { error: "theater_not_found" });
     return;
   }
-  const rawSubPath = typeof body.subPath === "string" ? body.subPath : "";
-  const cwdResult = await resolveGitCwd(theaterPath, rawSubPath);
-  if (!cwdResult) {
-    ctx.host.http.writeJson(res, 403, { error: "path_outside_theater" });
-    return;
-  }
+  const cwdResult = resolveGitCwd(theaterPath);
   const { gitCwd } = cwdResult;
   try {
     const [metaResult, nameStatusResult, numstatResult] = await Promise.all([
@@ -452,7 +421,7 @@ async function handleRepositoryCommitFile(req, res, ctx) {
     return;
   }
   const body = await ctx.host.http.readJsonBody(req);
-  if (!isPlainObject3(body) || typeof body.theaterId !== "string" || typeof body.ref !== "string" || typeof body.filePath !== "string") {
+  if (!isPlainObject3(body) || "subPath" in body || typeof body.theaterId !== "string" || typeof body.ref !== "string" || typeof body.filePath !== "string") {
     ctx.host.http.writeJson(res, 400, { error: "invalid_request" });
     return;
   }
@@ -473,11 +442,7 @@ async function handleRepositoryCommitFile(req, res, ctx) {
     ctx.host.http.writeJson(res, 404, { error: "theater_not_found" });
     return;
   }
-  const cwdResult = await resolveGitCwd(theaterPath, typeof body.subPath === "string" ? body.subPath : "");
-  if (!cwdResult) {
-    ctx.host.http.writeJson(res, 403, { error: "path_outside_theater" });
-    return;
-  }
+  const cwdResult = resolveGitCwd(theaterPath);
   const relativePath = resolveLiteralFilePath(cwdResult.gitCwd, body.filePath);
   const oldPath = typeof body.oldPath === "string" ? resolveLiteralFilePath(cwdResult.gitCwd, body.oldPath) : void 0;
   if (!relativePath || body.oldPath !== void 0 && !oldPath) {
@@ -623,7 +588,7 @@ async function handleRepositoryLog(req, res, ctx) {
     return;
   }
   const body = await ctx.host.http.readJsonBody(req);
-  if (!isPlainObject4(body)) {
+  if (!isPlainObject4(body) || "subPath" in body) {
     ctx.host.http.writeJson(res, 400, { error: "invalid_request" });
     return;
   }
@@ -637,12 +602,7 @@ async function handleRepositoryLog(req, res, ctx) {
     ctx.host.http.writeJson(res, 404, { error: "theater_not_found" });
     return;
   }
-  const rawSubPath = typeof body.subPath === "string" ? body.subPath : "";
-  const cwdResult = await resolveGitCwd(theaterPath, rawSubPath);
-  if (!cwdResult) {
-    ctx.host.http.writeJson(res, 403, { error: "path_outside_theater" });
-    return;
-  }
+  const cwdResult = resolveGitCwd(theaterPath);
   const { gitCwd } = cwdResult;
   const requestedRef = body.ref;
   if (requestedRef !== void 0 && (typeof requestedRef !== "string" || !isCanonicalRepositoryRef(requestedRef))) {
@@ -690,6 +650,8 @@ async function handleRepositoryLog(req, res, ctx) {
     throw error;
   }
 }
+
+// ../fleet-plugins/repository/server/refs.ts
 function isObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -702,14 +664,6 @@ function parseRefItems(stdout, current) {
     return ref && label ? [{ ref, label, current: ref === current }] : [];
   });
 }
-async function readCurrentWorktreePath2(gitCwd) {
-  try {
-    return (await runGit(["rev-parse", "--show-toplevel"], { cwd: gitCwd })).stdout.trim();
-  } catch (error) {
-    if (error instanceof GitExecutorError) return "";
-    throw error;
-  }
-}
 async function readStashes(gitCwd) {
   try {
     return (await runGit(["stash", "list", "--format=%gd%x00%s"], { cwd: gitCwd })).stdout;
@@ -718,28 +672,6 @@ async function readStashes(gitCwd) {
     throw error;
   }
 }
-async function parseWorktrees(stdout, currentWorktreePath, theaterPath, deps = {}) {
-  const records = stdout.split("\n\n").map((record) => record.split("\n"));
-  const realpath = deps.realpath ?? fs.realpath;
-  const normalizedCurrent = currentWorktreePath ? await realpath(currentWorktreePath).catch(() => currentWorktreePath) : "";
-  const realTheaterPath = await realpath(theaterPath).catch(() => null);
-  return Promise.all(records.flatMap((record) => {
-    const rawPath = record.find((line) => line.startsWith("worktree "))?.slice(9);
-    if (!rawPath) return [];
-    const branchRef = record.find((line) => line.startsWith("branch "))?.slice(7) ?? null;
-    const branch = branchRef?.startsWith("refs/heads/") ? branchRef.slice(11) : null;
-    return [{ rawPath, name: path2.basename(rawPath) || "worktree", branch }];
-  }).map(async ({ rawPath, ...item }) => {
-    const realWorktreePath = await realpath(rawPath).catch(() => null);
-    const currentPath = realWorktreePath ?? rawPath;
-    const contextRelPath = realTheaterPath !== null && realWorktreePath !== null && isWithinTheater(realWorktreePath, realTheaterPath) ? path2.relative(realTheaterPath, realWorktreePath).split(path2.sep).join("/") : null;
-    return { ...item, current: normalizedCurrent !== "" && currentPath === normalizedCurrent, contextRelPath };
-  }));
-}
-function isWithinTheater(candidate, theaterPath) {
-  const normalizedTheaterPath = theaterPath.endsWith(path2.sep) ? theaterPath : `${theaterPath}${path2.sep}`;
-  return candidate === theaterPath || candidate.startsWith(normalizedTheaterPath);
-}
 async function handleRepositoryRefs(req, res, ctx) {
   if (req.method !== "POST") {
     ctx.host.http.writeJson(res, 405, { error: "Method not allowed" });
@@ -750,7 +682,7 @@ async function handleRepositoryRefs(req, res, ctx) {
     return;
   }
   const body = await ctx.host.http.readJsonBody(req);
-  if (!isObject(body) || typeof body.theaterId !== "string") {
+  if (!isObject(body) || "subPath" in body || typeof body.theaterId !== "string") {
     ctx.host.http.writeJson(res, 400, { error: "invalid_request" });
     return;
   }
@@ -759,22 +691,16 @@ async function handleRepositoryRefs(req, res, ctx) {
     ctx.host.http.writeJson(res, 404, { error: "theater_not_found" });
     return;
   }
-  const resolved = await resolveGitCwd(theaterPath, typeof body.subPath === "string" ? body.subPath : "");
-  if (!resolved) {
-    ctx.host.http.writeJson(res, 403, { error: "path_outside_theater" });
-    return;
-  }
+  const resolved = resolveGitCwd(theaterPath);
   try {
-    const [head, local, remote, tags, stashes, worktrees] = await Promise.all([
+    const [head, local, remote, tags, stashes] = await Promise.all([
       runGit(["symbolic-ref", "--quiet", "HEAD"], { cwd: resolved.gitCwd, allowExitCodes: [1] }),
       runGit(["for-each-ref", "--format=%(refname)%00%(refname:short)", "refs/heads"], { cwd: resolved.gitCwd }),
       runGit(["for-each-ref", "--format=%(refname)%00%(refname:short)", "refs/remotes"], { cwd: resolved.gitCwd }),
       runGit(["for-each-ref", "--format=%(refname)%00%(refname:short)", "refs/tags"], { cwd: resolved.gitCwd }),
-      readStashes(resolved.gitCwd),
-      runGit(["worktree", "list", "--porcelain"], { cwd: resolved.gitCwd })
+      readStashes(resolved.gitCwd)
     ]);
     const current = head.stdout.trim();
-    const currentWorktreePath = await readCurrentWorktreePath2(resolved.gitCwd);
     ctx.host.http.writeJson(res, 200, {
       branches: parseRefItems(local.stdout, current),
       remotes: parseRefItems(remote.stdout, current),
@@ -782,12 +708,11 @@ async function handleRepositoryRefs(req, res, ctx) {
       stashes: lines(stashes).map((line) => {
         const [name, subject = ""] = line.split("\0");
         return { name, subject };
-      }),
-      worktrees: await parseWorktrees(worktrees.stdout, currentWorktreePath, theaterPath)
+      })
     });
   } catch (error) {
     if (error instanceof GitExecutorError && error.code === "no_git_repo") {
-      ctx.host.http.writeJson(res, 200, { branches: [], remotes: [], tags: [], stashes: [], worktrees: [] });
+      ctx.host.http.writeJson(res, 200, { branches: [], remotes: [], tags: [], stashes: [] });
       return;
     }
     if (error instanceof GitExecutorError && error.code === "git_unavailable") {

package/dist/fleet-plugins/skills/routes.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import path5 from 'path';
+import path from 'path';
 import { execFile } from 'child_process';
 import fs4 from 'fs/promises';
 import os2 from 'os';
@@ -16312,7 +16312,7 @@ function findBinaryPath(command, env, options = {}) {
   return findOnPath(command, pathValue, pathExts, platform);
 }
 function wrapWindowsShim(resolved, env, platform) {
-  if (platform !== "win32" || !WINDOWS_SHIM_EXTENSIONS.has(path5.extname(resolved).toLowerCase())) {
+  if (platform !== "win32" || !WINDOWS_SHIM_EXTENSIONS.has(path.extname(resolved).toLowerCase())) {
     return { bin: resolved, prefixArgs: [] };
   }
   rejectCmdExpansionSensitiveShim(resolved);
@@ -16330,13 +16330,13 @@ function forceWindowsArgQuoting(value) {
   return `${value} `;
 }
 function findOnPath(bin, pathValue, pathExts, platform) {
-  const pathSeparator = platform === "win32" ? WINDOWS_PATH_SEPARATOR : path5.delimiter;
-  if (hasPathSeparator(bin, platform) || path5.isAbsolute(bin)) {
+  const pathSeparator = platform === "win32" ? WINDOWS_PATH_SEPARATOR : path.delimiter;
+  if (hasPathSeparator(bin, platform) || path.isAbsolute(bin)) {
     return resolveWithExtensions(bin, pathExts, platform);
   }
   for (const entry of pathValue.split(pathSeparator)) {
     const searchDir = entry.length === 0 ? "." : entry;
-    const candidate = resolveWithExtensions(path5.join(searchDir, bin), pathExts, platform);
+    const candidate = resolveWithExtensions(path.join(searchDir, bin), pathExts, platform);
     if (candidate) {
       return candidate;
     }
@@ -16344,7 +16344,7 @@ function findOnPath(bin, pathValue, pathExts, platform) {
   return void 0;
 }
 function resolveWithExtensions(candidate, pathExts, platform) {
-  if (platform !== "win32" || path5.extname(candidate).length > 0) {
+  if (platform !== "win32" || path.extname(candidate).length > 0) {
     return isAccessibleExecutable(candidate, platform) ? candidate : void 0;
   }
   for (const ext of pathExts) {
@@ -16704,8 +16704,8 @@ async function ensureCliMjs(cliHome, onBootstrap) {
   if (_cliMjsPath) return _cliMjsPath;
   if (_bootstrapPromise) return _bootstrapPromise;
   _bootstrapPromise = (async () => {
-    const mjsPath = path5.join(cliHome, "node_modules", SKILLS_PACKAGE, "bin", "cli.mjs");
-    const pkgPath = path5.join(cliHome, "node_modules", SKILLS_PACKAGE, "package.json");
+    const mjsPath = path.join(cliHome, "node_modules", SKILLS_PACKAGE, "bin", "cli.mjs");
+    const pkgPath = path.join(cliHome, "node_modules", SKILLS_PACKAGE, "package.json");
     let needsInstall = true;
     try {
       const raw = await fs4.readFile(pkgPath, "utf-8");
@@ -16848,52 +16848,29 @@ var ProjectPathError = class extends Error {
     this.code = code;
   }
 };
-async function resolveProjectCwd(theaterRoot, relPath) {
-  if (relPath !== null && !isSafeRelativePath(relPath)) {
-    throw new ProjectPathError("invalid_rel_path");
-  }
-  const lexicalRoot = path5.resolve(theaterRoot);
-  const lexicalTarget = path5.resolve(lexicalRoot, relPath ?? ".");
-  if (!isContainedBy(lexicalRoot, lexicalTarget)) {
-    throw new ProjectPathError("path_outside_theater");
-  }
+async function resolveProjectCwd(theaterRoot) {
+  const lexicalRoot = path.resolve(theaterRoot);
   let realRoot;
-  let realTarget;
   try {
-    [realRoot, realTarget] = await Promise.all([
-      fs4.realpath(lexicalRoot),
-      fs4.realpath(lexicalTarget)
-    ]);
+    realRoot = await fs4.realpath(lexicalRoot);
   } catch (error51) {
     throw mapFilesystemError(error51);
   }
-  if (!isContainedBy(realRoot, realTarget)) {
-    throw new ProjectPathError("path_outside_theater");
-  }
   try {
-    if (!(await fs4.stat(realTarget)).isDirectory()) {
-      throw new ProjectPathError("invalid_rel_path");
+    if (!(await fs4.stat(realRoot)).isDirectory()) {
+      throw new ProjectPathError("invalid_path");
     }
   } catch (error51) {
     if (error51 instanceof ProjectPathError) throw error51;
     throw mapFilesystemError(error51);
   }
-  return realTarget;
-}
-function isSafeRelativePath(value) {
-  if (!value || value.includes("\0") || path5.isAbsolute(value) || path5.posix.isAbsolute(value) || path5.win32.isAbsolute(value)) {
-    return false;
-  }
-  return value.split(/[\\/]/).every((segment) => segment !== "" && segment !== "." && segment !== "..");
-}
-function isContainedBy(root, target) {
-  return target === root || target.startsWith(root.endsWith(path5.sep) ? root : root + path5.sep);
+  return realRoot;
 }
 function mapFilesystemError(error51) {
   const code = error51.code;
   if (code === "EACCES" || code === "EPERM") return new ProjectPathError("path_outside_theater");
   if (code === "ENOENT" || code === "ENOTDIR") return new ProjectPathError("not_found");
-  return new ProjectPathError("invalid_rel_path");
+  return new ProjectPathError("invalid_path");
 }
 
 // ../fleet-plugins/skills/server/registry-search.ts
@@ -16974,7 +16951,7 @@ var TOKEN_URL_PARAM_RE = /([?&](?:access_?token|token|api_?key|apikey|auth(?:ori
 async function readSkillSources(cwd) {
   const sources = /* @__PURE__ */ new Map();
   try {
-    const raw = await fs4.readFile(path5.join(cwd, "skills-lock.json"), "utf-8");
+    const raw = await fs4.readFile(path.join(cwd, "skills-lock.json"), "utf-8");
     const parsed = JSON.parse(raw);
     if (typeof parsed === "object" && parsed !== null) {
       for (const [name, entry] of Object.entries(parsed)) {
@@ -16985,7 +16962,7 @@ async function readSkillSources(cwd) {
   } catch {
   }
   try {
-    const raw = await fs4.readFile(path5.join(cwd, ".agents", ".skill-lock.json"), "utf-8");
+    const raw = await fs4.readFile(path.join(cwd, ".agents", ".skill-lock.json"), "utf-8");
     const parsed = JSON.parse(raw);
     if (typeof parsed === "object" && parsed !== null) {
       for (const [name, entry] of Object.entries(parsed)) {
@@ -17011,15 +16988,10 @@ async function runListCommand(args, cwd, executor) {
 function buildDisplayPath(scope, name) {
   return scope === "global" ? `~/.agents/skills/${name}` : `.agents/skills/${name}`;
 }
-function parseOptionalRelPath(value) {
-  if (value === void 0 || value === null) return null;
-  return typeof value === "string" ? value : void 0;
-}
-async function resolveProjectScopeCwd(ctx, theaterId, relPath) {
+async function resolveProjectScopeCwd(ctx, theaterId) {
   if (!theaterId) return null;
-  if (relPath === void 0) throw new ProjectPathError("invalid_rel_path");
   const theaterRoot = ctx.host.paths.resolveTheaterPath(theaterId);
-  return theaterRoot ? resolveProjectCwd(theaterRoot, relPath) : null;
+  return theaterRoot ? resolveProjectCwd(theaterRoot) : null;
 }
 function writeProjectPathError(res, ctx, error51) {
   if (!(error51 instanceof ProjectPathError)) throw error51;
@@ -17072,12 +17044,15 @@ async function handleList(req, res, ctx, executor) {
     return;
   }
   const url2 = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+  if (url2.searchParams.has("relPath")) {
+    ctx.host.http.writeJson(res, 400, { error: "invalid_argument" });
+    return;
+  }
   const theaterId = url2.searchParams.get("theaterId") ?? void 0;
-  const relPath = url2.searchParams.has("relPath") ? url2.searchParams.get("relPath") || null : null;
   let projectCwd = null;
   if (theaterId) {
     try {
-      projectCwd = await resolveProjectScopeCwd(ctx, theaterId, relPath);
+      projectCwd = await resolveProjectScopeCwd(ctx, theaterId);
     } catch (error51) {
       writeProjectPathError(res, ctx, error51);
       return;
@@ -17138,6 +17113,10 @@ async function handleSearch(req, res, ctx) {
     return;
   }
   const url2 = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+  if (url2.searchParams.has("relPath")) {
+    ctx.host.http.writeJson(res, 400, { error: "invalid_argument" });
+    return;
+  }
   const q = url2.searchParams.get("q") ?? "";
   const rawLimit = parseInt(url2.searchParams.get("limit") ?? "10", 10);
   const limit = isNaN(rawLimit) ? 10 : rawLimit;
@@ -17162,13 +17141,12 @@ async function handleInstall(req, res, ctx, executor) {
     return;
   }
   const body = await ctx.host.http.readJsonBody(req);
-  if (!isPlainObject2(body)) {
+  if (!isPlainObject2(body) || "relPath" in body) {
     ctx.host.http.writeJson(res, 400, { error: "invalid_argument" });
     return;
   }
-  const { source, skill, scope, agents, theaterId: rawTheaterId, relPath: rawRelPath } = body;
+  const { source, skill, scope, agents, theaterId: rawTheaterId } = body;
   const theaterId = typeof rawTheaterId === "string" ? rawTheaterId : void 0;
-  const relPath = parseOptionalRelPath(rawRelPath);
   if (!validateSource(source)) {
     ctx.host.http.writeJson(res, 400, { error: "invalid_argument" });
     return;
@@ -17194,7 +17172,7 @@ async function handleInstall(req, res, ctx, executor) {
   let projectCwd = null;
   if (scope === "project") {
     try {
-      projectCwd = await resolveProjectScopeCwd(ctx, theaterId, relPath);
+      projectCwd = await resolveProjectScopeCwd(ctx, theaterId);
     } catch (error51) {
       writeProjectPathError(res, ctx, error51);
       return;
@@ -17226,13 +17204,12 @@ async function handleUpdate(req, res, ctx, executor) {
     return;
   }
   const body = await ctx.host.http.readJsonBody(req);
-  if (!isPlainObject2(body)) {
+  if (!isPlainObject2(body) || "relPath" in body) {
     ctx.host.http.writeJson(res, 400, { error: "invalid_argument" });
     return;
   }
-  const { scope, theaterId: rawTheaterId, relPath: rawRelPath } = body;
+  const { scope, theaterId: rawTheaterId } = body;
   const theaterId = typeof rawTheaterId === "string" ? rawTheaterId : void 0;
-  const relPath = parseOptionalRelPath(rawRelPath);
   if (!validateScope(scope)) {
     ctx.host.http.writeJson(res, 400, { error: "invalid_argument" });
     return;
@@ -17240,7 +17217,7 @@ async function handleUpdate(req, res, ctx, executor) {
   let projectCwd = null;
   if (scope === "project") {
     try {
-      projectCwd = await resolveProjectScopeCwd(ctx, theaterId, relPath);
+      projectCwd = await resolveProjectScopeCwd(ctx, theaterId);
     } catch (error51) {
       writeProjectPathError(res, ctx, error51);
       return;
@@ -17271,6 +17248,10 @@ async function handleGetJob(req, res, ctx) {
     return;
   }
   const url2 = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+  if (url2.searchParams.has("relPath")) {
+    ctx.host.http.writeJson(res, 400, { error: "invalid_argument" });
+    return;
+  }
   const jobId = url2.searchParams.get("jobId");
   const rawCursor = parseInt(url2.searchParams.get("cursor") ?? "0", 10);
   const cursor = isNaN(rawCursor) || rawCursor < 0 ? 0 : rawCursor;
@@ -17295,13 +17276,12 @@ async function handleRemove(req, res, ctx, executor) {
     return;
   }
   const body = await ctx.host.http.readJsonBody(req);
-  if (!isPlainObject2(body)) {
+  if (!isPlainObject2(body) || "relPath" in body) {
     ctx.host.http.writeJson(res, 400, { error: "invalid_argument" });
     return;
   }
-  const { scope, skill, theaterId: rawTheaterId, relPath: rawRelPath } = body;
+  const { scope, skill, theaterId: rawTheaterId } = body;
   const theaterId = typeof rawTheaterId === "string" ? rawTheaterId : void 0;
-  const relPath = parseOptionalRelPath(rawRelPath);
   if (!validateScope(scope)) {
     ctx.host.http.writeJson(res, 400, { error: "invalid_argument" });
     return;
@@ -17313,7 +17293,7 @@ async function handleRemove(req, res, ctx, executor) {
   let projectCwd = null;
   if (scope === "project") {
     try {
-      projectCwd = await resolveProjectScopeCwd(ctx, theaterId, relPath);
+      projectCwd = await resolveProjectScopeCwd(ctx, theaterId);
     } catch (error51) {
       writeProjectPathError(res, ctx, error51);
       return;
@@ -17345,13 +17325,12 @@ async function handlePreview(req, res, ctx, executor) {
     return;
   }
   const body = await ctx.host.http.readJsonBody(req);
-  if (!isPlainObject2(body)) {
+  if (!isPlainObject2(body) || "relPath" in body) {
     ctx.host.http.writeJson(res, 400, { error: "invalid_argument" });
     return;
   }
-  const { source, skill, theaterId: rawTheaterId, relPath: rawRelPath } = body;
+  const { source, skill, theaterId: rawTheaterId } = body;
   const theaterId = typeof rawTheaterId === "string" ? rawTheaterId : void 0;
-  const relPath = parseOptionalRelPath(rawRelPath);
   if (!validateSource(source)) {
     ctx.host.http.writeJson(res, 400, { error: "invalid_argument" });
     return;
@@ -17363,7 +17342,7 @@ async function handlePreview(req, res, ctx, executor) {
   let cwd = defaultCwd();
   if (theaterId) {
     try {
-      const projectCwd = await resolveProjectScopeCwd(ctx, theaterId, relPath);
+      const projectCwd = await resolveProjectScopeCwd(ctx, theaterId);
       if (!projectCwd) {
         ctx.host.http.writeJson(res, 404, { error: "theater_not_found" });
         return;
@@ -17391,13 +17370,12 @@ async function handleInstalledFile(req, res, ctx, executor) {
     return;
   }
   const body = await ctx.host.http.readJsonBody(req);
-  if (!isPlainObject2(body)) {
+  if (!isPlainObject2(body) || "relPath" in body) {
     ctx.host.http.writeJson(res, 400, { error: "invalid_argument" });
     return;
   }
-  const { scope, skill, theaterId: rawTheaterId, relPath: rawRelPath } = body;
+  const { scope, skill, theaterId: rawTheaterId } = body;
   const theaterId = typeof rawTheaterId === "string" ? rawTheaterId : void 0;
-  const relPath = parseOptionalRelPath(rawRelPath);
   if (!validateScope(scope)) {
     ctx.host.http.writeJson(res, 400, { error: "invalid_argument" });
     return;
@@ -17409,7 +17387,7 @@ async function handleInstalledFile(req, res, ctx, executor) {
   let projectCwd = null;
   if (scope === "project") {
     try {
-      projectCwd = await resolveProjectScopeCwd(ctx, theaterId, relPath);
+      projectCwd = await resolveProjectScopeCwd(ctx, theaterId);
     } catch (error51) {
       writeProjectPathError(res, ctx, error51);
       return;
@@ -17429,7 +17407,7 @@ async function handleInstalledFile(req, res, ctx, executor) {
       return;
     }
     const skillRoot = entry.path;
-    const skillMdPath = path5.join(skillRoot, "SKILL.md");
+    const skillMdPath = path.join(skillRoot, "SKILL.md");
     const [realAllowedRoot, realRoot, realMd] = await Promise.all([
       // CLI가 보고한 skillRoot 자체도 신뢰하지 않는다 — scope의 정당한 상위 경계
       // (project=theater 루트, global=홈)를 벗어나면 읽지 않는다. `.agents/skills`로
@@ -17442,11 +17420,11 @@ async function handleInstalledFile(req, res, ctx, executor) {
       ctx.host.http.writeJson(res, 404, { error: "skill_not_found" });
       return;
     }
-    if (realRoot !== realAllowedRoot && !realRoot.startsWith(realAllowedRoot + path5.sep)) {
+    if (realRoot !== realAllowedRoot && !realRoot.startsWith(realAllowedRoot + path.sep)) {
       ctx.host.http.writeJson(res, 403, { error: "path_outside_theater" });
       return;
     }
-    if (realMd !== realRoot && !realMd.startsWith(realRoot + path5.sep)) {
+    if (realMd !== realRoot && !realMd.startsWith(realRoot + path.sep)) {
       ctx.host.http.writeJson(res, 403, { error: "path_outside_theater" });
       return;
     }
@@ -17461,7 +17439,7 @@ async function handleInstalledFile(req, res, ctx, executor) {
 var routes_default = definePlugin({
   id: "skills",
   register(ctx) {
-    const cliHome = path5.join(ctx.host.paths.pluginDataDir("skills"), "cli");
+    const cliHome = path.join(ctx.host.paths.pluginDataDir("skills"), "cli");
     const executor = createDefaultExecutor(cliHome);
     registerRouter(ctx, "list", async ({ req, res }) => {
       await handleList(req, res, ctx, executor);