@elizaos/agent 2.0.0-beta.1 → 2.0.11-beta.5

package/dist/packages/agent/src/api/skills-routes.js

@@ -1,978 +0,0 @@
-import fs from "node:fs";
-import path from "node:path";
-import { logger } from "@elizaos/core";
-import { installMarketplaceSkill, listInstalledMarketplaceSkills, searchSkillsMarketplace, uninstallMarketplaceSkill, } from "../services/skill-marketplace.js";
-import { resolveDefaultAgentWorkspaceDir } from "../shared/workspace-resolution.js";
-import { skillScaffoldMarkdown } from "../templates/skill-scaffold.js";
-import { parseClampedInteger } from "../utils/number-parsing.js";
-// ---------------------------------------------------------------------------
-// Skill ID validation
-// ---------------------------------------------------------------------------
-const SAFE_SKILL_ID_RE = /^[a-zA-Z0-9._-]+$/;
-function validateSkillId(skillId, res, errorFn) {
-    if (!skillId ||
-        !SAFE_SKILL_ID_RE.test(skillId) ||
-        skillId === "." ||
-        skillId.includes("..")) {
-        const safeDisplay = skillId.slice(0, 80).replace(/[^\x20-\x7e]/g, "?");
-        errorFn(res, `Invalid skill ID: "${safeDisplay}"`, 400);
-        return null;
-    }
-    return skillId;
-}
-// ---------------------------------------------------------------------------
-// Binance skill filtering
-// ---------------------------------------------------------------------------
-const EXPOSED_BINANCE_SKILL_IDS = new Set([
-    "binance-crypto-market-rank",
-    "binance-meme-rush",
-    "binance-query-address-info",
-    "binance-query-token-audit",
-    "binance-query-token-info",
-    "binance-trading-signal",
-]);
-function shouldExposeBinanceSkillId(skillId) {
-    const normalized = skillId.trim();
-    if (!normalized.startsWith("binance-"))
-        return true;
-    return EXPOSED_BINANCE_SKILL_IDS.has(normalized);
-}
-function shouldExposeBinanceSkillRecord(skill) {
-    const slug = typeof skill.slug === "string" ? skill.slug.trim() : "";
-    if (slug)
-        return shouldExposeBinanceSkillId(slug);
-    const id = typeof skill.id === "string" ? skill.id.trim() : "";
-    if (id)
-        return shouldExposeBinanceSkillId(id);
-    return true;
-}
-// ---------------------------------------------------------------------------
-// Skill preferences (per-agent, persisted in agent database)
-// ---------------------------------------------------------------------------
-const SKILL_PREFS_CACHE_KEY = "eliza:skill-preferences";
-async function loadSkillPreferences(runtime) {
-    if (!runtime)
-        return {};
-    try {
-        const prefs = await runtime.getCache(SKILL_PREFS_CACHE_KEY);
-        return prefs ?? {};
-    }
-    catch {
-        return {};
-    }
-}
-async function saveSkillPreferences(runtime, prefs) {
-    try {
-        await runtime.setCache(SKILL_PREFS_CACHE_KEY, prefs);
-    }
-    catch (err) {
-        logger.debug(`[eliza-api] Failed to save skill preferences: ${err instanceof Error ? err.message : err}`);
-    }
-}
-// ---------------------------------------------------------------------------
-// Skill scan acknowledgments
-// ---------------------------------------------------------------------------
-const SKILL_ACK_CACHE_KEY = "eliza:skill-scan-acknowledgments";
-async function loadSkillAcknowledgments(runtime) {
-    if (!runtime)
-        return {};
-    try {
-        const acks = await runtime.getCache(SKILL_ACK_CACHE_KEY);
-        return acks ?? {};
-    }
-    catch {
-        return {};
-    }
-}
-async function saveSkillAcknowledgments(runtime, acks) {
-    try {
-        await runtime.setCache(SKILL_ACK_CACHE_KEY, acks);
-    }
-    catch (err) {
-        logger.debug(`[eliza-api] Failed to save skill acknowledgments: ${err instanceof Error ? err.message : err}`);
-    }
-}
-// ---------------------------------------------------------------------------
-// Scan report loading
-// ---------------------------------------------------------------------------
-async function loadScanReportFromDisk(skillId, workspaceDir, runtime) {
-    const candidates = [
-        path.join(workspaceDir, "skills", skillId, ".scan-results.json"),
-        path.join(workspaceDir, "skills", ".marketplace", skillId, ".scan-results.json"),
-    ];
-    if (runtime) {
-        const svc = runtime.getService("AGENT_SKILLS_SERVICE");
-        if (svc?.getLoadedSkills) {
-            const loaded = svc.getLoadedSkills().find((s) => s.slug === skillId);
-            if (loaded?.path) {
-                candidates.push(path.join(loaded.path, ".scan-results.json"));
-            }
-        }
-    }
-    const seen = new Set();
-    for (const candidate of candidates) {
-        const resolved = path.resolve(candidate);
-        if (seen.has(resolved))
-            continue;
-        seen.add(resolved);
-        if (!fs.existsSync(resolved))
-            continue;
-        const content = fs.readFileSync(resolved, "utf-8");
-        let parsed;
-        try {
-            parsed = JSON.parse(content);
-        }
-        catch {
-            continue;
-        }
-        if (typeof parsed.scannedAt === "string" &&
-            typeof parsed.status === "string" &&
-            Array.isArray(parsed.findings) &&
-            Array.isArray(parsed.manifestFindings)) {
-            return parsed;
-        }
-    }
-    return null;
-}
-// ---------------------------------------------------------------------------
-// Main handler
-// ---------------------------------------------------------------------------
-export async function handleSkillsRoutes(ctx) {
-    const { req, res, method, pathname, url, state, json, error, readJsonBody, readBody, discoverSkills, saveElizaConfig, } = ctx;
-    // ── GET /api/skills/catalog ───────────────────────────────────────────
-    // Browse the full skill catalog (paginated).
-    if (method === "GET" && pathname === "/api/skills/catalog") {
-        try {
-            const { getCatalogSkills } = await import("../services/skill-catalog-client.js");
-            const all = (await getCatalogSkills()).filter((skill) => shouldExposeBinanceSkillRecord(skill));
-            const page = Math.max(1, Number(url.searchParams.get("page")) || 1);
-            const perPage = Math.min(100, Math.max(1, Number(url.searchParams.get("perPage")) || 50));
-            const sort = url.searchParams.get("sort") ?? "downloads";
-            const sorted = [...all];
-            if (sort === "downloads")
-                sorted.sort((a, b) => b.stats.downloads - a.stats.downloads || b.updatedAt - a.updatedAt);
-            else if (sort === "stars")
-                sorted.sort((a, b) => b.stats.stars - a.stats.stars || b.updatedAt - a.updatedAt);
-            else if (sort === "updated")
-                sorted.sort((a, b) => b.updatedAt - a.updatedAt);
-            else if (sort === "name")
-                sorted.sort((a, b) => (a.displayName ?? a.slug).localeCompare(b.displayName ?? b.slug));
-            // Resolve installed status from the AgentSkillsService
-            const installedSlugs = new Set();
-            if (state.runtime) {
-                try {
-                    const svc = state.runtime.getService("AGENT_SKILLS_SERVICE");
-                    if (svc && typeof svc.getLoadedSkills === "function") {
-                        for (const s of svc.getLoadedSkills()) {
-                            if (!shouldExposeBinanceSkillId(s.slug))
-                                continue;
-                            installedSlugs.add(s.slug);
-                        }
-                    }
-                }
-                catch (err) {
-                    logger.debug(`[api] Service not available: ${err instanceof Error ? err.message : err}`);
-                }
-            }
-            // Also check locally discovered skills
-            for (const s of state.skills) {
-                installedSlugs.add(s.id);
-            }
-            const start = (page - 1) * perPage;
-            const skills = sorted.slice(start, start + perPage).map((s) => ({
-                ...s,
-                installed: installedSlugs.has(s.slug),
-            }));
-            json(res, {
-                total: all.length,
-                page,
-                perPage,
-                totalPages: Math.ceil(all.length / perPage),
-                installedCount: installedSlugs.size,
-                skills,
-            });
-        }
-        catch (err) {
-            error(res, `Failed to load skill catalog: ${err instanceof Error ? err.message : String(err)}`, 500);
-        }
-        return true;
-    }
-    // ── GET /api/skills/catalog/search ─────────────────────────────────────
-    if (method === "GET" && pathname === "/api/skills/catalog/search") {
-        const q = url.searchParams.get("q");
-        if (!q) {
-            error(res, "Missing query parameter ?q=", 400);
-            return true;
-        }
-        try {
-            const { searchCatalogSkills } = await import("../services/skill-catalog-client.js");
-            const limit = Math.min(100, Math.max(1, Number(url.searchParams.get("limit")) || 30));
-            const results = (await searchCatalogSkills(q, limit)).filter((skill) => shouldExposeBinanceSkillRecord(skill));
-            json(res, { query: q, count: results.length, results });
-        }
-        catch (err) {
-            error(res, `Skill catalog search failed: ${err instanceof Error ? err.message : String(err)}`, 500);
-        }
-        return true;
-    }
-    // ── GET /api/skills/catalog/:slug ──────────────────────────────────────
-    if (method === "GET" && pathname.startsWith("/api/skills/catalog/")) {
-        const slug = decodeURIComponent(pathname.slice("/api/skills/catalog/".length));
-        // Exclude "search" which is handled above
-        if (slug && slug !== "search") {
-            if (!shouldExposeBinanceSkillId(slug)) {
-                error(res, `Skill "${slug}" not found in catalog`, 404);
-                return true;
-            }
-            try {
-                const { getCatalogSkill } = await import("../services/skill-catalog-client.js");
-                const skill = await getCatalogSkill(slug);
-                if (!skill) {
-                    error(res, `Skill "${slug}" not found in catalog`, 404);
-                    return true;
-                }
-                json(res, { skill });
-            }
-            catch (err) {
-                error(res, `Failed to fetch skill: ${err instanceof Error ? err.message : String(err)}`, 500);
-            }
-            return true;
-        }
-    }
-    // ── POST /api/skills/catalog/refresh ───────────────────────────────────
-    // First triggers the remote registry sync (via AgentSkillsService), then
-    // re-reads the local catalog file. This ensures the UI gets fresh data
-    // from the remote marketplace (clawhub.ai or configured registryUrl).
-    if (method === "POST" && pathname === "/api/skills/catalog/refresh") {
-        try {
-            // Trigger remote sync if the runtime + skills service are available
-            if (state.runtime) {
-                const svc = state.runtime.getService("AGENT_SKILLS_SERVICE");
-                if (svc?.syncCatalog) {
-                    await svc.syncCatalog();
-                }
-            }
-            // Then re-read the now-updated local catalog file
-            const { refreshCatalog } = await import("../services/skill-catalog-client.js");
-            const skills = await refreshCatalog();
-            json(res, { ok: true, count: skills.length });
-        }
-        catch (err) {
-            error(res, `Catalog refresh failed: ${err instanceof Error ? err.message : String(err)}`, 500);
-        }
-        return true;
-    }
-    // ── POST /api/skills/catalog/install ───────────────────────────────────
-    if (method === "POST" && pathname === "/api/skills/catalog/install") {
-        const body = await readJsonBody(req, res);
-        if (!body)
-            return true;
-        if (!body.slug) {
-            error(res, "Missing required field: slug", 400);
-            return true;
-        }
-        if (!state.runtime) {
-            error(res, "Agent runtime not available — start the agent first", 503);
-            return true;
-        }
-        try {
-            const service = state.runtime.getService("AGENT_SKILLS_SERVICE");
-            if (!service || typeof service.install !== "function") {
-                error(res, "AgentSkillsService not available — ensure @elizaos/plugin-agent-skills is loaded", 501);
-                return true;
-            }
-            const alreadyInstalled = typeof service.isInstalled === "function"
-                ? await service.isInstalled(body.slug)
-                : false;
-            if (alreadyInstalled) {
-                json(res, {
-                    ok: true,
-                    slug: body.slug,
-                    message: `Skill "${body.slug}" is already installed`,
-                    alreadyInstalled: true,
-                });
-                return true;
-            }
-            const success = await service.install(body.slug, {
-                version: body.version,
-            });
-            if (success) {
-                // Refresh the skills list so the UI picks up the new skill
-                const workspaceDir = state.config.agents?.defaults?.workspace ??
-                    resolveDefaultAgentWorkspaceDir();
-                state.skills = await discoverSkills(workspaceDir, state.config, state.runtime);
-                json(res, {
-                    ok: true,
-                    slug: body.slug,
-                    message: `Skill "${body.slug}" installed successfully`,
-                });
-            }
-            else {
-                error(res, `Failed to install skill "${body.slug}"`, 500);
-            }
-        }
-        catch (err) {
-            error(res, `Skill install failed: ${err instanceof Error ? err.message : String(err)}`, 500);
-        }
-        return true;
-    }
-    // ── POST /api/skills/catalog/uninstall ─────────────────────────────────
-    if (method === "POST" && pathname === "/api/skills/catalog/uninstall") {
-        const body = await readJsonBody(req, res);
-        if (!body)
-            return true;
-        if (!body.slug) {
-            error(res, "Missing required field: slug", 400);
-            return true;
-        }
-        if (!state.runtime) {
-            error(res, "Agent runtime not available — start the agent first", 503);
-            return true;
-        }
-        try {
-            const service = state.runtime.getService("AGENT_SKILLS_SERVICE");
-            if (!service || typeof service.uninstall !== "function") {
-                error(res, "AgentSkillsService not available — ensure @elizaos/plugin-agent-skills is loaded", 501);
-                return true;
-            }
-            const success = await service.uninstall(body.slug);
-            if (success) {
-                // Refresh the skills list
-                const workspaceDir = state.config.agents?.defaults?.workspace ??
-                    resolveDefaultAgentWorkspaceDir();
-                state.skills = await discoverSkills(workspaceDir, state.config, state.runtime);
-                json(res, {
-                    ok: true,
-                    slug: body.slug,
-                    message: `Skill "${body.slug}" uninstalled successfully`,
-                });
-            }
-            else {
-                error(res, `Failed to uninstall skill "${body.slug}" — it may be a bundled skill`, 400);
-            }
-        }
-        catch (err) {
-            error(res, `Skill uninstall failed: ${err instanceof Error ? err.message : String(err)}`, 500);
-        }
-        return true;
-    }
-    // ── GET /api/skills ─────────────────────────────────────────────────────
-    if (method === "GET" && pathname === "/api/skills") {
-        json(res, { skills: state.skills });
-        return true;
-    }
-    // ── POST /api/skills/refresh ──────────────────────────────────────────
-    if (method === "POST" && pathname === "/api/skills/refresh") {
-        try {
-            const workspaceDir = state.config.agents?.defaults?.workspace ??
-                resolveDefaultAgentWorkspaceDir();
-            state.skills = await discoverSkills(workspaceDir, state.config, state.runtime);
-            json(res, { ok: true, skills: state.skills });
-        }
-        catch (err) {
-            error(res, `Failed to refresh skills: ${err instanceof Error ? err.message : err}`, 500);
-        }
-        return true;
-    }
-    // ── GET /api/skills/:id/scan ───────────────────────────────────────────
-    if (method === "GET" && pathname.match(/^\/api\/skills\/[^/]+\/scan$/)) {
-        const skillId = validateSkillId(decodeURIComponent(pathname.split("/")[3]), res, error);
-        if (!skillId)
-            return true;
-        const workspaceDir = state.config.agents?.defaults?.workspace ??
-            resolveDefaultAgentWorkspaceDir();
-        const report = await loadScanReportFromDisk(skillId, workspaceDir, state.runtime);
-        const acks = await loadSkillAcknowledgments(state.runtime);
-        const ack = acks[skillId] ?? null;
-        json(res, { ok: true, report, acknowledged: !!ack, acknowledgment: ack });
-        return true;
-    }
-    // ── POST /api/skills/:id/acknowledge ──────────────────────────────────
-    if (method === "POST" &&
-        pathname.match(/^\/api\/skills\/[^/]+\/acknowledge$/)) {
-        const skillId = validateSkillId(decodeURIComponent(pathname.split("/")[3]), res, error);
-        if (!skillId)
-            return true;
-        const body = await readJsonBody(req, res);
-        if (!body)
-            return true;
-        const workspaceDir = state.config.agents?.defaults?.workspace ??
-            resolveDefaultAgentWorkspaceDir();
-        const report = await loadScanReportFromDisk(skillId, workspaceDir, state.runtime);
-        if (!report) {
-            error(res, `No scan report found for skill "${skillId}".`, 404);
-            return true;
-        }
-        if (report.status === "blocked") {
-            error(res, `Skill "${skillId}" is blocked and cannot be acknowledged.`, 403);
-            return true;
-        }
-        if (report.status === "clean") {
-            json(res, {
-                ok: true,
-                message: "No findings to acknowledge.",
-                acknowledged: true,
-            });
-            return true;
-        }
-        const findings = report.findings;
-        const manifestFindings = report.manifestFindings;
-        const totalFindings = findings.length + manifestFindings.length;
-        if (state.runtime) {
-            const acks = await loadSkillAcknowledgments(state.runtime);
-            acks[skillId] = {
-                acknowledgedAt: new Date().toISOString(),
-                findingCount: totalFindings,
-            };
-            await saveSkillAcknowledgments(state.runtime, acks);
-        }
-        if (body.enable === true) {
-            const skill = state.skills.find((s) => s.id === skillId);
-            if (skill) {
-                skill.enabled = true;
-                if (state.runtime) {
-                    const prefs = await loadSkillPreferences(state.runtime);
-                    prefs[skillId] = true;
-                    await saveSkillPreferences(state.runtime, prefs);
-                }
-            }
-        }
-        json(res, {
-            ok: true,
-            skillId,
-            acknowledged: true,
-            enabled: body.enable === true,
-            findingCount: totalFindings,
-        });
-        return true;
-    }
-    // ── POST /api/skills/create ───────────────────────────────────────────
-    if (method === "POST" && pathname === "/api/skills/create") {
-        const body = await readJsonBody(req, res);
-        if (!body)
-            return true;
-        const rawName = body.name?.trim();
-        if (!rawName) {
-            error(res, "Skill name is required", 400);
-            return true;
-        }
-        const slug = rawName
-            .toLowerCase()
-            .replace(/[^a-z0-9-]/g, "-")
-            .replace(/-+/g, "-")
-            .replace(/^-+|-+$/g, "");
-        if (!slug || slug.length > 64) {
-            error(res, "Skill name must produce a valid slug (1-64 chars, lowercase alphanumeric + hyphens)", 400);
-            return true;
-        }
-        const workspaceDir = state.config.agents?.defaults?.workspace ??
-            resolveDefaultAgentWorkspaceDir();
-        const skillDir = path.join(workspaceDir, "skills", slug);
-        if (fs.existsSync(skillDir)) {
-            error(res, `Skill "${slug}" already exists`, 409);
-            return true;
-        }
-        const description = body.description?.trim() || "Describe what this skill does.";
-        const escapedDescription = description
-            .replace(/\\/g, "\\\\")
-            .replace(/"/g, '\\"');
-        const template = skillScaffoldMarkdown
-            .replace(/__SLUG__/g, slug)
-            .replace(/__DESCRIPTION__/g, escapedDescription);
-        fs.mkdirSync(skillDir, { recursive: true });
-        fs.writeFileSync(path.join(skillDir, "SKILL.md"), template, "utf-8");
-        state.skills = await discoverSkills(workspaceDir, state.config, state.runtime);
-        const skill = state.skills.find((s) => s.id === slug);
-        json(res, {
-            ok: true,
-            skill: skill ?? { id: slug, name: slug, description, enabled: true },
-            path: skillDir,
-        });
-        return true;
-    }
-    // ── POST /api/skills/:id/open ─────────────────────────────────────────
-    if (method === "POST" && pathname.match(/^\/api\/skills\/[^/]+\/open$/)) {
-        const skillId = validateSkillId(decodeURIComponent(pathname.split("/")[3]), res, error);
-        if (!skillId)
-            return true;
-        const workspaceDir = state.config.agents?.defaults?.workspace ??
-            resolveDefaultAgentWorkspaceDir();
-        const candidates = [
-            path.join(workspaceDir, "skills", skillId),
-            path.join(workspaceDir, "skills", ".marketplace", skillId),
-        ];
-        let skillPath = null;
-        for (const c of candidates) {
-            if (fs.existsSync(path.join(c, "SKILL.md"))) {
-                skillPath = c;
-                break;
-            }
-        }
-        // Try AgentSkillsService for bundled skills — copy to workspace for editing
-        if (!skillPath && state.runtime) {
-            try {
-                const svc = state.runtime.getService("AGENT_SKILLS_SERVICE");
-                if (svc?.getLoadedSkills) {
-                    const loaded = svc.getLoadedSkills().find((s) => s.slug === skillId);
-                    if (loaded) {
-                        if (loaded.source === "bundled" || loaded.source === "plugin") {
-                            const targetDir = path.join(workspaceDir, "skills", skillId);
-                            if (!fs.existsSync(targetDir)) {
-                                fs.cpSync(loaded.path, targetDir, { recursive: true });
-                                state.skills = await discoverSkills(workspaceDir, state.config, state.runtime);
-                            }
-                            skillPath = targetDir;
-                        }
-                        else {
-                            skillPath = loaded.path;
-                        }
-                    }
-                }
-            }
-            catch (err) {
-                logger.debug(`[api] Service not available: ${err instanceof Error ? err.message : err}`);
-            }
-        }
-        if (!skillPath) {
-            error(res, `Skill "${skillId}" not found`, 404);
-            return true;
-        }
-        const { execFile } = await import("node:child_process");
-        const opener = process.platform === "darwin"
-            ? "open"
-            : process.platform === "win32"
-                ? "explorer"
-                : "xdg-open";
-        execFile(opener, [skillPath], (err) => {
-            if (err)
-                logger.warn(`[eliza-api] Failed to open skill folder: ${err.message}`);
-        });
-        json(res, { ok: true, path: skillPath });
-        return true;
-    }
-    // ── GET /api/skills/:id/source ──────────────────────────────────────────
-    if (method === "GET" && pathname.match(/^\/api\/skills\/[^/]+\/source$/)) {
-        const skillId = validateSkillId(decodeURIComponent(pathname.split("/")[3]), res, error);
-        if (!skillId)
-            return true;
-        const workspaceDir = state.config.agents?.defaults?.workspace ??
-            resolveDefaultAgentWorkspaceDir();
-        const candidates = [
-            path.join(workspaceDir, "skills", skillId),
-            path.join(workspaceDir, "skills", ".marketplace", skillId),
-        ];
-        let skillMdPath = null;
-        for (const c of candidates) {
-            const md = path.join(c, "SKILL.md");
-            if (fs.existsSync(md)) {
-                skillMdPath = md;
-                break;
-            }
-        }
-        // Try AgentSkillsService for bundled/plugin skills — copy to workspace for editing
-        if (!skillMdPath && state.runtime) {
-            try {
-                const svc = state.runtime.getService("AGENT_SKILLS_SERVICE");
-                if (svc?.getLoadedSkills) {
-                    const loaded = svc.getLoadedSkills().find((s) => s.slug === skillId);
-                    if (loaded) {
-                        if (loaded.source === "bundled" || loaded.source === "plugin") {
-                            const targetDir = path.join(workspaceDir, "skills", skillId);
-                            if (!fs.existsSync(targetDir)) {
-                                fs.cpSync(loaded.path, targetDir, { recursive: true });
-                                state.skills = await discoverSkills(workspaceDir, state.config, state.runtime);
-                            }
-                            const md = path.join(targetDir, "SKILL.md");
-                            if (fs.existsSync(md))
-                                skillMdPath = md;
-                        }
-                        else {
-                            const md = path.join(loaded.path, "SKILL.md");
-                            if (fs.existsSync(md))
-                                skillMdPath = md;
-                        }
-                    }
-                }
-            }
-            catch {
-                /* ignore */
-            }
-        }
-        if (!skillMdPath) {
-            error(res, `Skill "${skillId}" not found`, 404);
-            return true;
-        }
-        try {
-            const content = fs.readFileSync(skillMdPath, "utf-8");
-            json(res, { ok: true, skillId, content, path: skillMdPath });
-        }
-        catch (err) {
-            error(res, `Failed to read skill: ${err instanceof Error ? err.message : "unknown"}`, 500);
-        }
-        return true;
-    }
-    // ── POST /api/skills/:id/enable ─────────────────────────────────────────
-    // Canonical verb endpoint for enabling a skill. Honors scan acknowledgment
-    // requirements; returns 409 when an unack'd scan blocks enabling.
-    if (method === "POST" && pathname.match(/^\/api\/skills\/[^/]+\/enable$/)) {
-        const skillId = validateSkillId(decodeURIComponent(pathname.split("/")[3]), res, error);
-        if (!skillId)
-            return true;
-        const skill = state.skills.find((s) => s.id === skillId);
-        if (!skill) {
-            error(res, `Skill "${skillId}" not found`, 404);
-            return true;
-        }
-        const workspaceDir = state.config.agents?.defaults?.workspace ??
-            resolveDefaultAgentWorkspaceDir();
-        const report = await loadScanReportFromDisk(skillId, workspaceDir, state.runtime);
-        if (report &&
-            (report.status === "critical" || report.status === "warning")) {
-            const acks = await loadSkillAcknowledgments(state.runtime);
-            const ack = acks[skillId];
-            const findings = report.findings;
-            const manifestFindings = report.manifestFindings;
-            const totalFindings = findings.length + manifestFindings.length;
-            if (!ack || ack.findingCount !== totalFindings) {
-                error(res, `Skill "${skillId}" has ${totalFindings} security finding(s) that must be acknowledged first. Use POST /api/skills/${skillId}/acknowledge.`, 409);
-                return true;
-            }
-        }
-        skill.enabled = true;
-        if (state.runtime) {
-            const prefs = await loadSkillPreferences(state.runtime);
-            prefs[skillId] = true;
-            await saveSkillPreferences(state.runtime, prefs);
-            const svc = state.runtime.getService("AGENT_SKILLS_SERVICE");
-            svc?.setSkillEnabled?.(skillId, true);
-        }
-        json(res, {
-            ok: true,
-            skill,
-            scanStatus: skill.scanStatus ?? null,
-        });
-        return true;
-    }
-    // ── POST /api/skills/:id/disable ────────────────────────────────────────
-    // Canonical verb endpoint for disabling a skill.
-    if (method === "POST" && pathname.match(/^\/api\/skills\/[^/]+\/disable$/)) {
-        const skillId = validateSkillId(decodeURIComponent(pathname.split("/")[3]), res, error);
-        if (!skillId)
-            return true;
-        const skill = state.skills.find((s) => s.id === skillId);
-        if (!skill) {
-            error(res, `Skill "${skillId}" not found`, 404);
-            return true;
-        }
-        skill.enabled = false;
-        if (state.runtime) {
-            const prefs = await loadSkillPreferences(state.runtime);
-            prefs[skillId] = false;
-            await saveSkillPreferences(state.runtime, prefs);
-            const svc = state.runtime.getService("AGENT_SKILLS_SERVICE");
-            svc?.setSkillEnabled?.(skillId, false);
-        }
-        json(res, {
-            ok: true,
-            skill,
-            scanStatus: skill.scanStatus ?? null,
-        });
-        return true;
-    }
-    // ── PUT /api/skills/:id/source ──────────────────────────────────────────
-    if (method === "PUT" && pathname.match(/^\/api\/skills\/[^/]+\/source$/)) {
-        const skillId = validateSkillId(decodeURIComponent(pathname.split("/")[3]), res, error);
-        if (!skillId)
-            return true;
-        const body = await readBody(req);
-        if (!body)
-            return true;
-        let parsed;
-        try {
-            parsed = JSON.parse(body);
-        }
-        catch {
-            error(res, "Invalid JSON body", 400);
-            return true;
-        }
-        if (typeof parsed.content !== "string") {
-            error(res, "Missing 'content' field", 400);
-            return true;
-        }
-        const workspaceDir = state.config.agents?.defaults?.workspace ??
-            resolveDefaultAgentWorkspaceDir();
-        const candidates = [
-            path.join(workspaceDir, "skills", skillId),
-            path.join(workspaceDir, "skills", ".marketplace", skillId),
-        ];
-        let skillMdPath = null;
-        for (const c of candidates) {
-            const md = path.join(c, "SKILL.md");
-            if (fs.existsSync(md)) {
-                skillMdPath = md;
-                break;
-            }
-        }
-        // Try AgentSkillsService for bundled/plugin skills — copy to workspace for editing
-        if (!skillMdPath && state.runtime) {
-            try {
-                const svc = state.runtime.getService("AGENT_SKILLS_SERVICE");
-                if (svc?.getLoadedSkills) {
-                    const loaded = svc.getLoadedSkills().find((s) => s.slug === skillId);
-                    if (loaded) {
-                        if (loaded.source === "bundled" || loaded.source === "plugin") {
-                            const targetDir = path.join(workspaceDir, "skills", skillId);
-                            if (!fs.existsSync(targetDir)) {
-                                fs.cpSync(loaded.path, targetDir, { recursive: true });
-                            }
-                            const md = path.join(targetDir, "SKILL.md");
-                            if (fs.existsSync(md))
-                                skillMdPath = md;
-                        }
-                        else {
-                            const md = path.join(loaded.path, "SKILL.md");
-                            if (fs.existsSync(md))
-                                skillMdPath = md;
-                        }
-                    }
-                }
-            }
-            catch {
-                /* ignore */
-            }
-        }
-        if (!skillMdPath) {
-            error(res, `Skill "${skillId}" not found`, 404);
-            return true;
-        }
-        try {
-            fs.writeFileSync(skillMdPath, parsed.content, "utf-8");
-            // Re-discover skills to pick up unknown name/description changes
-            state.skills = await discoverSkills(workspaceDir, state.config, state.runtime);
-            const skill = state.skills.find((s) => s.id === skillId);
-            json(res, { ok: true, skillId, skill });
-        }
-        catch (err) {
-            error(res, `Failed to save skill: ${err instanceof Error ? err.message : "unknown"}`, 500);
-        }
-        return true;
-    }
-    // ── DELETE /api/skills/:id ────────────────────────────────────────────
-    if (method === "DELETE" &&
-        pathname.match(/^\/api\/skills\/[^/]+$/) &&
-        !pathname.includes("/marketplace")) {
-        const skillId = validateSkillId(decodeURIComponent(pathname.slice("/api/skills/".length)), res, error);
-        if (!skillId)
-            return true;
-        const workspaceDir = state.config.agents?.defaults?.workspace ??
-            resolveDefaultAgentWorkspaceDir();
-        const wsDir = path.join(workspaceDir, "skills", skillId);
-        const mpDir = path.join(workspaceDir, "skills", ".marketplace", skillId);
-        let deleted = false;
-        let source = "";
-        if (fs.existsSync(path.join(wsDir, "SKILL.md"))) {
-            fs.rmSync(wsDir, { recursive: true, force: true });
-            deleted = true;
-            source = "workspace";
-        }
-        else if (fs.existsSync(path.join(mpDir, "SKILL.md"))) {
-            try {
-                const { uninstallMarketplaceSkill: uninstallMp } = await import("../services/skill-marketplace.js");
-                await uninstallMp(workspaceDir, skillId);
-                deleted = true;
-                source = "marketplace";
-            }
-            catch (err) {
-                error(res, `Failed to uninstall: ${err instanceof Error ? err.message : String(err)}`, 500);
-                return true;
-            }
-        }
-        else if (state.runtime) {
-            try {
-                const svc = state.runtime.getService("AGENT_SKILLS_SERVICE");
-                if (svc?.uninstall) {
-                    deleted = await svc.uninstall(skillId);
-                    source = "catalog";
-                }
-            }
-            catch (err) {
-                logger.debug(`[api] Service not available: ${err instanceof Error ? err.message : err}`);
-            }
-        }
-        if (!deleted) {
-            error(res, `Skill "${skillId}" not found or is a bundled skill that cannot be deleted`, 404);
-            return true;
-        }
-        state.skills = await discoverSkills(workspaceDir, state.config, state.runtime);
-        if (state.runtime) {
-            const prefs = await loadSkillPreferences(state.runtime);
-            delete prefs[skillId];
-            await saveSkillPreferences(state.runtime, prefs);
-            const acks = await loadSkillAcknowledgments(state.runtime);
-            delete acks[skillId];
-            await saveSkillAcknowledgments(state.runtime, acks);
-        }
-        json(res, { ok: true, skillId, source });
-        return true;
-    }
-    // ── GET /api/skills/marketplace/search ─────────────────────────────────
-    if (method === "GET" && pathname === "/api/skills/marketplace/search") {
-        const query = url.searchParams.get("q") ?? "";
-        if (!query.trim()) {
-            error(res, "Query parameter 'q' is required", 400);
-            return true;
-        }
-        try {
-            const limitStr = url.searchParams.get("limit");
-            const limit = limitStr
-                ? parseClampedInteger(limitStr, { min: 1, max: 50, fallback: 20 })
-                : 20;
-            const results = (await searchSkillsMarketplace(query, { limit })).filter((skill) => shouldExposeBinanceSkillRecord(skill));
-            json(res, { ok: true, results });
-        }
-        catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            error(res, msg, 502);
-        }
-        return true;
-    }
-    // ── GET /api/skills/marketplace/installed ─────────────────────────────
-    if (method === "GET" && pathname === "/api/skills/marketplace/installed") {
-        try {
-            const workspaceDir = state.config.agents?.defaults?.workspace ??
-                resolveDefaultAgentWorkspaceDir();
-            const installed = await listInstalledMarketplaceSkills(workspaceDir);
-            json(res, { ok: true, skills: installed });
-        }
-        catch (err) {
-            error(res, `Failed to list installed skills: ${err instanceof Error ? err.message : err}`, 500);
-        }
-        return true;
-    }
-    // ── POST /api/skills/marketplace/install ──────────────────────────────
-    if (method === "POST" && pathname === "/api/skills/marketplace/install") {
-        const body = await readJsonBody(req, res);
-        if (!body)
-            return true;
-        const slug = body.slug?.trim() || "";
-        const githubUrl = body.githubUrl?.trim() || "";
-        const repository = body.repository?.trim() || "";
-        if (!slug && !githubUrl && !repository) {
-            error(res, "Install requires a slug, githubUrl, or repository", 400);
-            return true;
-        }
-        try {
-            const workspaceDir = state.config.agents?.defaults?.workspace ??
-                resolveDefaultAgentWorkspaceDir();
-            // ClawHub-native install path (slug-based via AgentSkillsService).
-            if (slug && !githubUrl && !repository) {
-                if (!state.runtime) {
-                    error(res, "Agent runtime not available — start the agent first", 503);
-                    return true;
-                }
-                const service = state.runtime.getService("AGENT_SKILLS_SERVICE");
-                if (!service || typeof service.install !== "function") {
-                    error(res, "AgentSkillsService not available — ensure @elizaos/plugin-agent-skills is loaded", 501);
-                    return true;
-                }
-                const alreadyInstalled = typeof service.isInstalled === "function"
-                    ? await service.isInstalled(slug)
-                    : false;
-                if (alreadyInstalled) {
-                    json(res, {
-                        ok: true,
-                        skill: {
-                            id: slug,
-                            name: body.name?.trim() || slug,
-                            source: "clawhub",
-                            installedAt: new Date().toISOString(),
-                        },
-                        alreadyInstalled: true,
-                    });
-                    return true;
-                }
-                const success = await service.install(slug);
-                if (!success) {
-                    error(res, `Failed to install skill "${slug}"`, 500);
-                    return true;
-                }
-                state.skills = await discoverSkills(workspaceDir, state.config, state.runtime);
-                json(res, {
-                    ok: true,
-                    skill: {
-                        id: slug,
-                        name: body.name?.trim() || slug,
-                        source: "clawhub",
-                        installedAt: new Date().toISOString(),
-                    },
-                });
-            }
-            else {
-                const result = await installMarketplaceSkill(workspaceDir, {
-                    githubUrl: body.githubUrl,
-                    repository: body.repository,
-                    path: body.path,
-                    name: body.name,
-                    description: body.description,
-                    source: body.source === "manual" || body.source === "skillsmp"
-                        ? body.source
-                        : "clawhub",
-                });
-                state.skills = await discoverSkills(workspaceDir, state.config, state.runtime);
-                json(res, { ok: true, skill: result });
-            }
-        }
-        catch (err) {
-            error(res, `Install failed: ${err instanceof Error ? err.message : err}`, 500);
-        }
-        return true;
-    }
-    // ── POST /api/skills/marketplace/uninstall ────────────────────────────
-    if (method === "POST" && pathname === "/api/skills/marketplace/uninstall") {
-        const body = await readJsonBody(req, res);
-        if (!body)
-            return true;
-        if (!body.id?.trim()) {
-            error(res, "Request body must include 'id' (skill id to uninstall)", 400);
-            return true;
-        }
-        const uninstallId = validateSkillId(body.id.trim(), res, error);
-        if (!uninstallId)
-            return true;
-        try {
-            const workspaceDir = state.config.agents?.defaults?.workspace ??
-                resolveDefaultAgentWorkspaceDir();
-            const result = await uninstallMarketplaceSkill(workspaceDir, uninstallId);
-            state.skills = await discoverSkills(workspaceDir, state.config, state.runtime);
-            json(res, { ok: true, skill: result });
-        }
-        catch (err) {
-            error(res, `Uninstall failed: ${err instanceof Error ? err.message : err}`, 500);
-        }
-        return true;
-    }
-    // ── GET /api/skills/marketplace/config ──────────────────────────────────
-    if (method === "GET" && pathname === "/api/skills/marketplace/config") {
-        json(res, { keySet: Boolean(process.env.SKILLSMP_API_KEY?.trim()) });
-        return true;
-    }
-    // ── PUT /api/skills/marketplace/config ─────────────────────────────────
-    if (method === "PUT" && pathname === "/api/skills/marketplace/config") {
-        const body = await readJsonBody(req, res);
-        if (!body)
-            return true;
-        const apiKey = typeof body.apiKey === "string" ? body.apiKey.trim() : "";
-        if (!apiKey) {
-            error(res, "Request body must include 'apiKey'", 400);
-            return true;
-        }
-        process.env.SKILLSMP_API_KEY = apiKey;
-        if (!state.config.env)
-            state.config.env = {};
-        state.config.env.SKILLSMP_API_KEY = apiKey;
-        saveElizaConfig(state.config);
-        json(res, { ok: true, keySet: true });
-        return true;
-    }
-    return false;
-}