@dotobokuri/fleet-console 1.69.0 → 1.71.0

package/dist/fleet-plugins/skills/routes.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import path from 'node:path';
 import { execFile } from 'node:child_process';
-import fs3 from 'node:fs/promises';
+import fs4 from 'node:fs/promises';
 import os2 from 'node:os';
 import { existsSync, accessSync, constants } from 'node:fs';
 import crypto from 'node:crypto';
@@ -10,16 +10,16 @@ import crypto from 'node:crypto';
 function definePlugin(definition) {
   return definition;
 }
-function registerRouter(ctx, path6, handler, catalog) {
+function registerRouter(ctx, path7, handler, catalog) {
   if (catalog) {
-    ctx.registerRouter(normalizePath(path6), handler, catalog);
+    ctx.registerRouter(normalizePath(path7), handler, catalog);
     return;
   }
-  ctx.registerRouter(normalizePath(path6), handler);
+  ctx.registerRouter(normalizePath(path7), handler);
 }
-function normalizePath(path6) {
-  if (path6.length === 0 || path6 === "/") return "/";
-  return path6;
+function normalizePath(path7) {
+  if (path7.length === 0 || path7 === "/") return "/";
+  return path7;
 }
 var DEFAULT_WINDOWS_PATHEXT = ".COM;.EXE;.BAT;.CMD";
 var WINDOWS_PATH_SEPARATOR = ";";
@@ -161,14 +161,14 @@ async function ensureCliMjs(cliHome, onBootstrap) {
     const pkgPath = path.join(cliHome, "node_modules", SKILLS_PACKAGE, "package.json");
     let needsInstall = true;
     try {
-      const raw = await fs3.readFile(pkgPath, "utf-8");
+      const raw = await fs4.readFile(pkgPath, "utf-8");
       const pkg = JSON.parse(raw);
       if (pkg.version === SKILLS_VERSION) needsInstall = false;
     } catch {
     }
     if (needsInstall) {
       onBootstrap?.(WARMUP_LINE);
-      await fs3.mkdir(cliHome, { recursive: true });
+      await fs4.mkdir(cliHome, { recursive: true });
       await runNpmInstall(cliHome);
     }
     _cliMjsPath = mjsPath;
@@ -293,6 +293,55 @@ function getJobResult(id, cursor) {
     exitCode: job.exitCode
   };
 }
+var HEAD_BYTES = 8192;
+var MAX_DESCRIPTION = 500;
+function parseSkillDescription(head) {
+  const text = head.charCodeAt(0) === 65279 ? head.slice(1) : head;
+  if (!/^---\r?\n/.test(text)) return void 0;
+  const body = text.slice(text.indexOf("\n") + 1);
+  const endIndex = body.search(/^---\s*$/m);
+  if (endIndex === -1) return void 0;
+  const lines = body.slice(0, endIndex).split(/\r?\n/);
+  const startLine = lines.findIndex((line) => /^description\s*:/.test(line));
+  if (startLine === -1) return void 0;
+  const first = (lines[startLine] ?? "").replace(/^description\s*:\s*/, "");
+  if (/^[>|]/.test(first.trim())) return void 0;
+  const parts = [first.trim()];
+  for (let i = startLine + 1; i < lines.length; i += 1) {
+    const line = lines[i] ?? "";
+    if (!/^\s+\S/.test(line)) break;
+    parts.push(line.trim());
+  }
+  let value = parts.filter(Boolean).join(" ").trim();
+  if (value.startsWith('"') && value.endsWith('"') && value.length > 1 || value.startsWith("'") && value.endsWith("'") && value.length > 1) {
+    value = value.slice(1, -1).trim();
+  }
+  if (!value) return void 0;
+  return value.length > MAX_DESCRIPTION ? value.slice(0, MAX_DESCRIPTION) : value;
+}
+async function readSkillDescription(skillRoot, allowedRoot) {
+  let handle;
+  try {
+    const [realAllowedRoot, realRoot] = await Promise.all([
+      fs4.realpath(allowedRoot),
+      fs4.realpath(skillRoot)
+    ]);
+    if (realRoot !== realAllowedRoot && !realRoot.startsWith(realAllowedRoot + path.sep)) {
+      return void 0;
+    }
+    const realMd = await fs4.realpath(path.join(realRoot, "SKILL.md"));
+    if (!realMd.startsWith(realRoot + path.sep)) return void 0;
+    handle = await fs4.open(realMd, "r");
+    const buffer = Buffer.alloc(HEAD_BYTES);
+    const { bytesRead } = await handle.read(buffer, 0, HEAD_BYTES, 0);
+    return parseSkillDescription(buffer.subarray(0, bytesRead).toString("utf-8"));
+  } catch {
+    return void 0;
+  } finally {
+    await handle?.close().catch(() => {
+    });
+  }
+}
 var ProjectPathError = class extends Error {
   code;
   constructor(code) {
@@ -305,12 +354,12 @@ async function resolveProjectCwd(theaterRoot) {
   const lexicalRoot = path.resolve(theaterRoot);
   let realRoot;
   try {
-    realRoot = await fs3.realpath(lexicalRoot);
+    realRoot = await fs4.realpath(lexicalRoot);
   } catch (error) {
     throw mapFilesystemError(error);
   }
   try {
-    if (!(await fs3.stat(realRoot)).isDirectory()) {
+    if (!(await fs4.stat(realRoot)).isDirectory()) {
       throw new ProjectPathError("invalid_path");
     }
   } catch (error) {
@@ -402,30 +451,47 @@ var CLI_TIMEOUT_MS = 12e4;
 var USERINFO_URL_RE = /\b[a-z][a-z0-9+.-]*:\/\/[^\s/@]+@[^\s]+/gi;
 var TOKEN_URL_PARAM_RE = /([?&](?:access_?token|token|api_?key|apikey|auth(?:orization)?|password|secret|credential)=)[^&#\s]*/gi;
 var installedSkillsByTheater = /* @__PURE__ */ new Map();
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hasSourceEntry(table) {
+  return Object.values(table).some((entry) => isRecord(entry) && typeof entry["source"] === "string");
+}
+function isLockShape(parsed) {
+  if (!isRecord(parsed)) return false;
+  if ("skills" in parsed) return isRecord(parsed["skills"]);
+  return hasSourceEntry(parsed);
+}
+function collectLockSources(lock, sources) {
+  const table = isRecord(lock.skills) ? lock.skills : lock;
+  for (const [name, entry] of Object.entries(table)) {
+    if (isRecord(entry) && typeof entry["source"] === "string") {
+      sources.set(name, entry["source"]);
+    }
+  }
+}
 async function readSkillSources(cwd) {
   const sources = /* @__PURE__ */ new Map();
-  try {
-    const raw = await fs3.readFile(path.join(cwd, "skills-lock.json"), "utf-8");
-    const parsed = JSON.parse(raw);
-    if (typeof parsed === "object" && parsed !== null) {
-      for (const [name, entry] of Object.entries(parsed)) {
-        if (entry && typeof entry.source === "string") sources.set(name, entry.source);
-      }
-      return sources;
+  for (const candidate of [
+    path.join(cwd, "skills-lock.json"),
+    path.join(cwd, ".agents", ".skill-lock.json")
+  ]) {
+    let raw;
+    try {
+      raw = await fs4.readFile(candidate, "utf-8");
+    } catch {
+      continue;
     }
-  } catch {
-  }
-  try {
-    const raw = await fs3.readFile(path.join(cwd, ".agents", ".skill-lock.json"), "utf-8");
-    const parsed = JSON.parse(raw);
-    if (typeof parsed === "object" && parsed !== null) {
-      for (const [name, entry] of Object.entries(parsed)) {
-        if (entry && typeof entry.source === "string") sources.set(name, entry.source);
+    try {
+      const parsed = JSON.parse(raw);
+      if (isLockShape(parsed)) {
+        collectLockSources(parsed, sources);
+        return { sources, lockRead: true };
       }
+    } catch {
     }
-  } catch {
   }
-  return sources;
+  return { sources, lockRead: false };
 }
 async function runListCommand(args, cwd, executor) {
   const result = await executor(args, { cwd, timeout: CLI_TIMEOUT_MS });
@@ -488,42 +554,42 @@ function spawnJobAsync(jobId, args, cwd, redactionPaths, executor) {
     }).then((result) => finishJob(jobId, result.exitCode)).catch(() => finishJob(jobId, 1));
   });
 }
+async function toListItems(raw, scope, lock, allowedRoot) {
+  return Promise.all(raw.map(async (entry) => {
+    const description = entry.path ? await readSkillDescription(entry.path, allowedRoot) : void 0;
+    const source = lock.sources.get(entry.name);
+    const unmanaged = !source && lock.lockRead;
+    return {
+      name: entry.name,
+      scope,
+      agents: entry.agents,
+      ...source ? { source } : {},
+      ...unmanaged ? { unmanaged: true } : {},
+      ...description ? { description } : {},
+      displayPath: buildDisplayPath(scope, entry.name)
+    };
+  }));
+}
 async function listInstalledSkills(projectCwd, executor) {
+  const homeDir = os2.homedir();
   if (projectCwd) {
     const [projectRaw, globalRaw2, projectSources, globalSources2] = await Promise.all([
       runListCommand(["list", "--json"], projectCwd, executor),
-      runListCommand(["list", "-g", "--json"], os2.homedir(), executor),
+      runListCommand(["list", "-g", "--json"], homeDir, executor),
       readSkillSources(projectCwd),
-      readSkillSources(os2.homedir())
+      readSkillSources(homeDir)
+    ]);
+    const [projectItems, globalItems] = await Promise.all([
+      toListItems(projectRaw, "project", projectSources, projectCwd),
+      toListItems(globalRaw2, "global", globalSources2, homeDir)
     ]);
-    return [
-      ...projectRaw.map((entry) => ({
-        name: entry.name,
-        scope: "project",
-        agents: entry.agents,
-        source: projectSources.get(entry.name),
-        displayPath: buildDisplayPath("project", entry.name)
-      })),
-      ...globalRaw2.map((entry) => ({
-        name: entry.name,
-        scope: "global",
-        agents: entry.agents,
-        source: globalSources2.get(entry.name),
-        displayPath: buildDisplayPath("global", entry.name)
-      }))
-    ];
+    return [...projectItems, ...globalItems];
   }
   const [globalRaw, globalSources] = await Promise.all([
-    runListCommand(["list", "-g", "--json"], os2.homedir(), executor),
-    readSkillSources(os2.homedir())
+    runListCommand(["list", "-g", "--json"], homeDir, executor),
+    readSkillSources(homeDir)
   ]);
-  return globalRaw.map((entry) => ({
-    name: entry.name,
-    scope: "global",
-    agents: entry.agents,
-    source: globalSources.get(entry.name),
-    displayPath: buildDisplayPath("global", entry.name)
-  }));
+  return toListItems(globalRaw, "global", globalSources, homeDir);
 }
 async function handleList(req, res, ctx, executor) {
   if (req.method !== "GET") {
@@ -900,9 +966,9 @@ async function handleInstalledFile(req, res, ctx, executor) {
       // CLI가 보고한 skillRoot 자체도 신뢰하지 않는다 — scope의 정당한 상위 경계
       // (project=theater 루트, global=홈)를 벗어나면 읽지 않는다. `.agents/skills`로
       // 고정하지 않는 이유: claude 단독 설치는 `.claude/skills` 아래에 놓인다.
-      fs3.realpath(cwd),
-      fs3.realpath(skillRoot),
-      fs3.realpath(skillMdPath).catch(() => null)
+      fs4.realpath(cwd),
+      fs4.realpath(skillRoot),
+      fs4.realpath(skillMdPath).catch(() => null)
     ]);
     if (!realMd) {
       ctx.host.http.writeJson(res, 404, { error: "skill_not_found" });
@@ -916,7 +982,7 @@ async function handleInstalledFile(req, res, ctx, executor) {
       ctx.host.http.writeJson(res, 403, { error: "path_outside_theater" });
       return;
     }
-    const markdown = await fs3.readFile(realMd, "utf-8");
+    const markdown = await fs4.readFile(realMd, "utf-8");
     ctx.host.http.writeJson(res, 200, { markdown });
   } catch {
     ctx.host.http.writeJson(res, 502, { error: "read_failed" });