@dotobokuri/fleet-console 1.28.0 → 1.30.0

package/dist/fleet-plugins/skills/routes.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import path5 from 'path';
+import path from 'path';
 import { execFile } from 'child_process';
 import fs4 from 'fs/promises';
 import os2 from 'os';
@@ -16312,7 +16312,7 @@ function findBinaryPath(command, env, options = {}) {
   return findOnPath(command, pathValue, pathExts, platform);
 }
 function wrapWindowsShim(resolved, env, platform) {
-  if (platform !== "win32" || !WINDOWS_SHIM_EXTENSIONS.has(path5.extname(resolved).toLowerCase())) {
+  if (platform !== "win32" || !WINDOWS_SHIM_EXTENSIONS.has(path.extname(resolved).toLowerCase())) {
     return { bin: resolved, prefixArgs: [] };
   }
   rejectCmdExpansionSensitiveShim(resolved);
@@ -16330,13 +16330,13 @@ function forceWindowsArgQuoting(value) {
   return `${value} `;
 }
 function findOnPath(bin, pathValue, pathExts, platform) {
-  const pathSeparator = platform === "win32" ? WINDOWS_PATH_SEPARATOR : path5.delimiter;
-  if (hasPathSeparator(bin, platform) || path5.isAbsolute(bin)) {
+  const pathSeparator = platform === "win32" ? WINDOWS_PATH_SEPARATOR : path.delimiter;
+  if (hasPathSeparator(bin, platform) || path.isAbsolute(bin)) {
     return resolveWithExtensions(bin, pathExts, platform);
   }
   for (const entry of pathValue.split(pathSeparator)) {
     const searchDir = entry.length === 0 ? "." : entry;
-    const candidate = resolveWithExtensions(path5.join(searchDir, bin), pathExts, platform);
+    const candidate = resolveWithExtensions(path.join(searchDir, bin), pathExts, platform);
     if (candidate) {
       return candidate;
     }
@@ -16344,7 +16344,7 @@ function findOnPath(bin, pathValue, pathExts, platform) {
   return void 0;
 }
 function resolveWithExtensions(candidate, pathExts, platform) {
-  if (platform !== "win32" || path5.extname(candidate).length > 0) {
+  if (platform !== "win32" || path.extname(candidate).length > 0) {
     return isAccessibleExecutable(candidate, platform) ? candidate : void 0;
   }
   for (const ext of pathExts) {
@@ -16387,7 +16387,7 @@ function withHidden(options) {
 // ../../packages/core-unified-agent/models.json
 var models_default = {
   version: 1,
-  updatedAt: "2026-07-10T00:00:00Z",
+  updatedAt: "2026-07-20T00:00:00Z",
   providers: {
     claude: {
       name: "Claude Code",
@@ -16406,15 +16406,16 @@ var models_default = {
       name: "Kimi via Claude Code",
       defaultModel: "kimi-for-coding",
       models: [
-        { modelId: "kimi-for-coding", name: "Kimi for Coding", description: "Available on every Kimi Code membership tier (262K context)", effort: { supported: false } },
-        { modelId: "k3", name: "Kimi K3", description: "Available on Moderato and higher tiers (262K context)", effort: { supported: true, levels: ["max"], default: "max" } },
-        { modelId: "k3[1m]", name: "Kimi K3 [1M]", description: "Available on Allegretto and higher tiers (1M context)", effort: { supported: true, levels: ["max"], default: "max" } },
-        { modelId: "kimi-for-coding-highspeed", name: "Kimi for Coding Highspeed", description: "Available on Allegretto and higher tiers (262K context)", effort: { supported: false } }
+        { modelId: "kimi-for-coding", name: "Kimi for Coding", description: "Available on every Kimi Code membership tier (262K context)", effort: { supported: false }, contextWindow: 262144 },
+        { modelId: "k3", name: "Kimi K3", description: "Available on Moderato and higher tiers (262K context)", effort: { supported: true, levels: ["low", "high", "max"], default: "high" }, contextWindow: 262144 },
+        { modelId: "k3[1m]", name: "Kimi K3 [1M]", description: "Available on Allegretto and higher tiers (1M context)", effort: { supported: true, levels: ["low", "high", "max"], default: "high" }, contextWindow: 1048576 },
+        { modelId: "kimi-for-coding-highspeed", name: "Kimi for Coding Highspeed", description: "Available on Allegretto and higher tiers (262K context)", effort: { supported: false }, contextWindow: 262144 }
       ],
       modelsMapping: {
         haiku: "kimi-for-coding",
         sonnet: "kimi-for-coding",
-        opus: "kimi-for-coding"
+        opus: "kimi-for-coding",
+        fable: "kimi-for-coding"
       }
     },
     codex: {
@@ -16488,6 +16489,8 @@ var ModelEntrySchema = external_exports.object({
   description: external_exports.string().optional(),
   /** spawn 시 실제 CLI 모델 ID를 조립해야 하는 경우의 템플릿 */
   spawnModelTemplate: external_exports.string().optional(),
+  /** 모델의 컨텍스트 윈도우 크기 (토큰) */
+  contextWindow: external_exports.number().int().positive().optional(),
   /** 모델별 effort 설정 */
   effort: EffortSchema
 }).check((ctx) => {
@@ -16704,8 +16707,8 @@ async function ensureCliMjs(cliHome, onBootstrap) {
   if (_cliMjsPath) return _cliMjsPath;
   if (_bootstrapPromise) return _bootstrapPromise;
   _bootstrapPromise = (async () => {
-    const mjsPath = path5.join(cliHome, "node_modules", SKILLS_PACKAGE, "bin", "cli.mjs");
-    const pkgPath = path5.join(cliHome, "node_modules", SKILLS_PACKAGE, "package.json");
+    const mjsPath = path.join(cliHome, "node_modules", SKILLS_PACKAGE, "bin", "cli.mjs");
+    const pkgPath = path.join(cliHome, "node_modules", SKILLS_PACKAGE, "package.json");
     let needsInstall = true;
     try {
       const raw = await fs4.readFile(pkgPath, "utf-8");
@@ -16848,52 +16851,29 @@ var ProjectPathError = class extends Error {
     this.code = code;
   }
 };
-async function resolveProjectCwd(theaterRoot, relPath) {
-  if (relPath !== null && !isSafeRelativePath(relPath)) {
-    throw new ProjectPathError("invalid_rel_path");
-  }
-  const lexicalRoot = path5.resolve(theaterRoot);
-  const lexicalTarget = path5.resolve(lexicalRoot, relPath ?? ".");
-  if (!isContainedBy(lexicalRoot, lexicalTarget)) {
-    throw new ProjectPathError("path_outside_theater");
-  }
+async function resolveProjectCwd(theaterRoot) {
+  const lexicalRoot = path.resolve(theaterRoot);
   let realRoot;
-  let realTarget;
   try {
-    [realRoot, realTarget] = await Promise.all([
-      fs4.realpath(lexicalRoot),
-      fs4.realpath(lexicalTarget)
-    ]);
+    realRoot = await fs4.realpath(lexicalRoot);
   } catch (error51) {
     throw mapFilesystemError(error51);
   }
-  if (!isContainedBy(realRoot, realTarget)) {
-    throw new ProjectPathError("path_outside_theater");
-  }
   try {
-    if (!(await fs4.stat(realTarget)).isDirectory()) {
-      throw new ProjectPathError("invalid_rel_path");
+    if (!(await fs4.stat(realRoot)).isDirectory()) {
+      throw new ProjectPathError("invalid_path");
     }
   } catch (error51) {
     if (error51 instanceof ProjectPathError) throw error51;
     throw mapFilesystemError(error51);
   }
-  return realTarget;
-}
-function isSafeRelativePath(value) {
-  if (!value || value.includes("\0") || path5.isAbsolute(value) || path5.posix.isAbsolute(value) || path5.win32.isAbsolute(value)) {
-    return false;
-  }
-  return value.split(/[\\/]/).every((segment) => segment !== "" && segment !== "." && segment !== "..");
-}
-function isContainedBy(root, target) {
-  return target === root || target.startsWith(root.endsWith(path5.sep) ? root : root + path5.sep);
+  return realRoot;
 }
 function mapFilesystemError(error51) {
   const code = error51.code;
   if (code === "EACCES" || code === "EPERM") return new ProjectPathError("path_outside_theater");
   if (code === "ENOENT" || code === "ENOTDIR") return new ProjectPathError("not_found");
-  return new ProjectPathError("invalid_rel_path");
+  return new ProjectPathError("invalid_path");
 }
 
 // ../fleet-plugins/skills/server/registry-search.ts
@@ -16974,7 +16954,7 @@ var TOKEN_URL_PARAM_RE = /([?&](?:access_?token|token|api_?key|apikey|auth(?:ori
 async function readSkillSources(cwd) {
   const sources = /* @__PURE__ */ new Map();
   try {
-    const raw = await fs4.readFile(path5.join(cwd, "skills-lock.json"), "utf-8");
+    const raw = await fs4.readFile(path.join(cwd, "skills-lock.json"), "utf-8");
     const parsed = JSON.parse(raw);
     if (typeof parsed === "object" && parsed !== null) {
       for (const [name, entry] of Object.entries(parsed)) {
@@ -16985,7 +16965,7 @@ async function readSkillSources(cwd) {
   } catch {
   }
   try {
-    const raw = await fs4.readFile(path5.join(cwd, ".agents", ".skill-lock.json"), "utf-8");
+    const raw = await fs4.readFile(path.join(cwd, ".agents", ".skill-lock.json"), "utf-8");
     const parsed = JSON.parse(raw);
     if (typeof parsed === "object" && parsed !== null) {
       for (const [name, entry] of Object.entries(parsed)) {
@@ -17011,15 +16991,10 @@ async function runListCommand(args, cwd, executor) {
 function buildDisplayPath(scope, name) {
   return scope === "global" ? `~/.agents/skills/${name}` : `.agents/skills/${name}`;
 }
-function parseOptionalRelPath(value) {
-  if (value === void 0 || value === null) return null;
-  return typeof value === "string" ? value : void 0;
-}
-async function resolveProjectScopeCwd(ctx, theaterId, relPath) {
+async function resolveProjectScopeCwd(ctx, theaterId) {
   if (!theaterId) return null;
-  if (relPath === void 0) throw new ProjectPathError("invalid_rel_path");
   const theaterRoot = ctx.host.paths.resolveTheaterPath(theaterId);
-  return theaterRoot ? resolveProjectCwd(theaterRoot, relPath) : null;
+  return theaterRoot ? resolveProjectCwd(theaterRoot) : null;
 }
 function writeProjectPathError(res, ctx, error51) {
   if (!(error51 instanceof ProjectPathError)) throw error51;
@@ -17072,12 +17047,15 @@ async function handleList(req, res, ctx, executor) {
     return;
   }
   const url2 = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+  if (url2.searchParams.has("relPath")) {
+    ctx.host.http.writeJson(res, 400, { error: "invalid_argument" });
+    return;
+  }
   const theaterId = url2.searchParams.get("theaterId") ?? void 0;
-  const relPath = url2.searchParams.has("relPath") ? url2.searchParams.get("relPath") || null : null;
   let projectCwd = null;
   if (theaterId) {
     try {
-      projectCwd = await resolveProjectScopeCwd(ctx, theaterId, relPath);
+      projectCwd = await resolveProjectScopeCwd(ctx, theaterId);
     } catch (error51) {
       writeProjectPathError(res, ctx, error51);
       return;
@@ -17138,6 +17116,10 @@ async function handleSearch(req, res, ctx) {
     return;
   }
   const url2 = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+  if (url2.searchParams.has("relPath")) {
+    ctx.host.http.writeJson(res, 400, { error: "invalid_argument" });
+    return;
+  }
   const q = url2.searchParams.get("q") ?? "";
   const rawLimit = parseInt(url2.searchParams.get("limit") ?? "10", 10);
   const limit = isNaN(rawLimit) ? 10 : rawLimit;
@@ -17162,13 +17144,12 @@ async function handleInstall(req, res, ctx, executor) {
     return;
   }
   const body = await ctx.host.http.readJsonBody(req);
-  if (!isPlainObject2(body)) {
+  if (!isPlainObject2(body) || "relPath" in body) {
     ctx.host.http.writeJson(res, 400, { error: "invalid_argument" });
     return;
   }
-  const { source, skill, scope, agents, theaterId: rawTheaterId, relPath: rawRelPath } = body;
+  const { source, skill, scope, agents, theaterId: rawTheaterId } = body;
   const theaterId = typeof rawTheaterId === "string" ? rawTheaterId : void 0;
-  const relPath = parseOptionalRelPath(rawRelPath);
   if (!validateSource(source)) {
     ctx.host.http.writeJson(res, 400, { error: "invalid_argument" });
     return;
@@ -17194,7 +17175,7 @@ async function handleInstall(req, res, ctx, executor) {
   let projectCwd = null;
   if (scope === "project") {
     try {
-      projectCwd = await resolveProjectScopeCwd(ctx, theaterId, relPath);
+      projectCwd = await resolveProjectScopeCwd(ctx, theaterId);
     } catch (error51) {
       writeProjectPathError(res, ctx, error51);
       return;
@@ -17226,13 +17207,12 @@ async function handleUpdate(req, res, ctx, executor) {
     return;
   }
   const body = await ctx.host.http.readJsonBody(req);
-  if (!isPlainObject2(body)) {
+  if (!isPlainObject2(body) || "relPath" in body) {
     ctx.host.http.writeJson(res, 400, { error: "invalid_argument" });
     return;
   }
-  const { scope, theaterId: rawTheaterId, relPath: rawRelPath } = body;
+  const { scope, theaterId: rawTheaterId } = body;
   const theaterId = typeof rawTheaterId === "string" ? rawTheaterId : void 0;
-  const relPath = parseOptionalRelPath(rawRelPath);
   if (!validateScope(scope)) {
     ctx.host.http.writeJson(res, 400, { error: "invalid_argument" });
     return;
@@ -17240,7 +17220,7 @@ async function handleUpdate(req, res, ctx, executor) {
   let projectCwd = null;
   if (scope === "project") {
     try {
-      projectCwd = await resolveProjectScopeCwd(ctx, theaterId, relPath);
+      projectCwd = await resolveProjectScopeCwd(ctx, theaterId);
     } catch (error51) {
       writeProjectPathError(res, ctx, error51);
       return;
@@ -17271,6 +17251,10 @@ async function handleGetJob(req, res, ctx) {
     return;
   }
   const url2 = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+  if (url2.searchParams.has("relPath")) {
+    ctx.host.http.writeJson(res, 400, { error: "invalid_argument" });
+    return;
+  }
   const jobId = url2.searchParams.get("jobId");
   const rawCursor = parseInt(url2.searchParams.get("cursor") ?? "0", 10);
   const cursor = isNaN(rawCursor) || rawCursor < 0 ? 0 : rawCursor;
@@ -17295,13 +17279,12 @@ async function handleRemove(req, res, ctx, executor) {
     return;
   }
   const body = await ctx.host.http.readJsonBody(req);
-  if (!isPlainObject2(body)) {
+  if (!isPlainObject2(body) || "relPath" in body) {
     ctx.host.http.writeJson(res, 400, { error: "invalid_argument" });
     return;
   }
-  const { scope, skill, theaterId: rawTheaterId, relPath: rawRelPath } = body;
+  const { scope, skill, theaterId: rawTheaterId } = body;
   const theaterId = typeof rawTheaterId === "string" ? rawTheaterId : void 0;
-  const relPath = parseOptionalRelPath(rawRelPath);
   if (!validateScope(scope)) {
     ctx.host.http.writeJson(res, 400, { error: "invalid_argument" });
     return;
@@ -17313,7 +17296,7 @@ async function handleRemove(req, res, ctx, executor) {
   let projectCwd = null;
   if (scope === "project") {
     try {
-      projectCwd = await resolveProjectScopeCwd(ctx, theaterId, relPath);
+      projectCwd = await resolveProjectScopeCwd(ctx, theaterId);
     } catch (error51) {
       writeProjectPathError(res, ctx, error51);
       return;
@@ -17345,13 +17328,12 @@ async function handlePreview(req, res, ctx, executor) {
     return;
   }
   const body = await ctx.host.http.readJsonBody(req);
-  if (!isPlainObject2(body)) {
+  if (!isPlainObject2(body) || "relPath" in body) {
     ctx.host.http.writeJson(res, 400, { error: "invalid_argument" });
     return;
   }
-  const { source, skill, theaterId: rawTheaterId, relPath: rawRelPath } = body;
+  const { source, skill, theaterId: rawTheaterId } = body;
   const theaterId = typeof rawTheaterId === "string" ? rawTheaterId : void 0;
-  const relPath = parseOptionalRelPath(rawRelPath);
   if (!validateSource(source)) {
     ctx.host.http.writeJson(res, 400, { error: "invalid_argument" });
     return;
@@ -17363,7 +17345,7 @@ async function handlePreview(req, res, ctx, executor) {
   let cwd = defaultCwd();
   if (theaterId) {
     try {
-      const projectCwd = await resolveProjectScopeCwd(ctx, theaterId, relPath);
+      const projectCwd = await resolveProjectScopeCwd(ctx, theaterId);
       if (!projectCwd) {
         ctx.host.http.writeJson(res, 404, { error: "theater_not_found" });
         return;
@@ -17391,13 +17373,12 @@ async function handleInstalledFile(req, res, ctx, executor) {
     return;
   }
   const body = await ctx.host.http.readJsonBody(req);
-  if (!isPlainObject2(body)) {
+  if (!isPlainObject2(body) || "relPath" in body) {
     ctx.host.http.writeJson(res, 400, { error: "invalid_argument" });
     return;
   }
-  const { scope, skill, theaterId: rawTheaterId, relPath: rawRelPath } = body;
+  const { scope, skill, theaterId: rawTheaterId } = body;
   const theaterId = typeof rawTheaterId === "string" ? rawTheaterId : void 0;
-  const relPath = parseOptionalRelPath(rawRelPath);
   if (!validateScope(scope)) {
     ctx.host.http.writeJson(res, 400, { error: "invalid_argument" });
     return;
@@ -17409,7 +17390,7 @@ async function handleInstalledFile(req, res, ctx, executor) {
   let projectCwd = null;
   if (scope === "project") {
     try {
-      projectCwd = await resolveProjectScopeCwd(ctx, theaterId, relPath);
+      projectCwd = await resolveProjectScopeCwd(ctx, theaterId);
     } catch (error51) {
       writeProjectPathError(res, ctx, error51);
       return;
@@ -17429,7 +17410,7 @@ async function handleInstalledFile(req, res, ctx, executor) {
       return;
     }
     const skillRoot = entry.path;
-    const skillMdPath = path5.join(skillRoot, "SKILL.md");
+    const skillMdPath = path.join(skillRoot, "SKILL.md");
     const [realAllowedRoot, realRoot, realMd] = await Promise.all([
       // CLI가 보고한 skillRoot 자체도 신뢰하지 않는다 — scope의 정당한 상위 경계
       // (project=theater 루트, global=홈)를 벗어나면 읽지 않는다. `.agents/skills`로
@@ -17442,11 +17423,11 @@ async function handleInstalledFile(req, res, ctx, executor) {
       ctx.host.http.writeJson(res, 404, { error: "skill_not_found" });
       return;
     }
-    if (realRoot !== realAllowedRoot && !realRoot.startsWith(realAllowedRoot + path5.sep)) {
+    if (realRoot !== realAllowedRoot && !realRoot.startsWith(realAllowedRoot + path.sep)) {
       ctx.host.http.writeJson(res, 403, { error: "path_outside_theater" });
       return;
     }
-    if (realMd !== realRoot && !realMd.startsWith(realRoot + path5.sep)) {
+    if (realMd !== realRoot && !realMd.startsWith(realRoot + path.sep)) {
       ctx.host.http.writeJson(res, 403, { error: "path_outside_theater" });
       return;
     }
@@ -17461,7 +17442,7 @@ async function handleInstalledFile(req, res, ctx, executor) {
 var routes_default = definePlugin({
   id: "skills",
   register(ctx) {
-    const cliHome = path5.join(ctx.host.paths.pluginDataDir("skills"), "cli");
+    const cliHome = path.join(ctx.host.paths.pluginDataDir("skills"), "cli");
     const executor = createDefaultExecutor(cliHome);
     registerRouter(ctx, "list", async ({ req, res }) => {
       await handleList(req, res, ctx, executor);