@ikie-dev/cli 9.8.7 → 9.9.0

package/src/extensions/skills-manager/skill-sanitizer.test.ts

@@ -0,0 +1,287 @@
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs"
+import { tmpdir } from "node:os"
+import { join } from "node:path"
+import { loadSkillsFromDir } from "@earendil-works/pi-coding-agent"
+import { afterEach, describe, expect, it } from "vitest"
+import { createSkillSanitizer, isValidSkillName, normalizeSkillName, sanitizeSkillMarkdown } from "./skill-sanitizer.js"
+
+describe("normalizeSkillName", () => {
+	it("lowercases input", () => {
+		expect(normalizeSkillName("FooBar")).toBe("foobar")
+	})
+
+	it("replaces runs of invalid chars with a single hyphen", () => {
+		expect(normalizeSkillName("ckm:slides")).toBe("ckm-slides")
+		expect(normalizeSkillName("foo_bar")).toBe("foo-bar")
+		expect(normalizeSkillName("a   b")).toBe("a-b")
+		expect(normalizeSkillName("a___b")).toBe("a-b")
+	})
+
+	it("trims leading and trailing hyphens", () => {
+		expect(normalizeSkillName("-foo-")).toBe("foo")
+		expect(normalizeSkillName("---bar---")).toBe("bar")
+	})
+
+	it("truncates to 64 characters", () => {
+		const long = "a".repeat(100)
+		expect(normalizeSkillName(long)).toHaveLength(64)
+	})
+
+	it("falls back to 'skill' when empty after normalization", () => {
+		expect(normalizeSkillName("")).toBe("skill")
+		expect(normalizeSkillName("___")).toBe("skill")
+		expect(normalizeSkillName("---")).toBe("skill")
+	})
+
+	it("collapses consecutive hyphens", () => {
+		expect(normalizeSkillName("foo--bar")).toBe("foo-bar")
+	})
+})
+
+describe("isValidSkillName", () => {
+	it("accepts valid names", () => {
+		expect(isValidSkillName("ckm-slides")).toBe(true)
+		expect(isValidSkillName("ui-ux-pro-max")).toBe(true)
+		expect(isValidSkillName("abc")).toBe(true)
+		expect(isValidSkillName("a1b2")).toBe(true)
+	})
+
+	it("rejects empty or too long", () => {
+		expect(isValidSkillName("")).toBe(false)
+		expect(isValidSkillName("a".repeat(65))).toBe(false)
+	})
+
+	it("rejects invalid characters", () => {
+		expect(isValidSkillName("ckm:slides")).toBe(false)
+		expect(isValidSkillName("Foo_Bar")).toBe(false)
+		expect(isValidSkillName("foo.bar")).toBe(false)
+	})
+
+	it("rejects leading/trailing hyphens", () => {
+		expect(isValidSkillName("-bad")).toBe(false)
+		expect(isValidSkillName("bad-")).toBe(false)
+	})
+
+	it("rejects consecutive hyphens", () => {
+		expect(isValidSkillName("bad--bad")).toBe(false)
+	})
+})
+
+describe("sanitizeSkillMarkdown", () => {
+	it("leaves valid skill content unchanged", () => {
+		const input = `---
+name: ckm-slides
+description: My slides skill
+---
+
+# Body
+
+Some content.`
+		expect(sanitizeSkillMarkdown(input)).toBe(input)
+	})
+
+	it("rewrites name: ckm:slides to quoted normalized form", () => {
+		const input = `---
+name: ckm:slides
+description: slides
+---
+
+Body content`
+		const out = sanitizeSkillMarkdown(input)
+		expect(out).toContain('name: "ckm-slides"')
+		expect(out).not.toContain("ckm:slides")
+	})
+
+	it("rewrites name: Foo_Bar to quoted normalized form", () => {
+		const input = `---
+name: Foo_Bar
+description: foo bar
+---
+
+Body`
+		const out = sanitizeSkillMarkdown(input)
+		expect(out).toContain('name: "foo-bar"')
+		expect(out).not.toContain("Foo_Bar")
+	})
+
+	it("preserves body content", () => {
+		const input = `---
+name: ckm:slides
+description: slides
+---
+
+# Heading
+
+Important body content with code:
+
+\`\`\`bash
+echo hi
+\`\`\`
+`
+		const out = sanitizeSkillMarkdown(input)
+		expect(out).toContain("# Heading")
+		expect(out).toContain("Important body content")
+		expect(out).toContain("echo hi")
+	})
+
+	it("preserves non-name frontmatter keys", () => {
+		const input = `---
+name: ckm:slides
+description: slides
+allowed-tools: Read, Write
+---
+
+Body`
+		const out = sanitizeSkillMarkdown(input)
+		expect(out).toContain('name: "ckm-slides"')
+		expect(out).toContain("allowed-tools: Read, Write")
+		expect(out).toContain("description: slides")
+	})
+
+	it("returns content unchanged when name is missing", () => {
+		const input = `---
+description: only description
+---
+
+Body`
+		expect(sanitizeSkillMarkdown(input)).toBe(input)
+	})
+
+	it("returns content unchanged when there is no frontmatter", () => {
+		const input = "Just a body with no frontmatter."
+		expect(sanitizeSkillMarkdown(input)).toBe(input)
+	})
+
+	it("returns content unchanged on frontmatter parse failure", () => {
+		const input = `---
+name: ckm:slides
+description: [unterminated
+---
+
+Body`
+		expect(sanitizeSkillMarkdown(input)).toBe(input)
+	})
+})
+
+describe("createSkillSanitizer / sanitizeDir", () => {
+	let createdTempDirs: string[] = []
+
+	afterEach(() => {
+		for (const d of createdTempDirs) {
+			try {
+				rmSync(d, { recursive: true, force: true })
+			} catch {
+				// ignore
+			}
+		}
+		createdTempDirs = []
+	})
+
+	function makeSourceDir(files: Record<string, string>): string {
+		const dir = mkdtempSync(join(tmpdir(), "ikie-sanitizer-test-src-"))
+		createdTempDirs.push(dir)
+		for (const [relPath, content] of Object.entries(files)) {
+			const full = join(dir, relPath)
+			mkdirSync(join(full, ".."), { recursive: true })
+			writeFileSync(full, content, "utf-8")
+		}
+		return dir
+	}
+
+	it("produces a directory that loads cleanly via upstream loadSkillsFromDir", () => {
+		const source = makeSourceDir({
+			"ckm:slides/SKILL.md": `---
+name: ckm:slides
+description: slides skill
+---
+
+body`,
+		})
+
+		const sanitizer = createSkillSanitizer()
+		const sanitizedDir = sanitizer.sanitizeDir(source)
+		createdTempDirs.push(sanitizedDir)
+		expect(existsSync(join(sanitizedDir, "ckm:slides", "SKILL.md"))).toBe(true)
+
+		const result = loadSkillsFromDir({ dir: sanitizedDir, source: "user" })
+		const nameDiagnostics = result.diagnostics.filter(
+			(d) => typeof d.message === "string" && d.message.toLowerCase().includes("name"),
+		)
+		expect(nameDiagnostics).toEqual([])
+		expect(result.skills.length).toBe(1)
+		expect(result.skills[0].name).toBe("ckm-slides")
+
+		const sanitizedContent = readFileSync(join(sanitizedDir, "ckm:slides", "SKILL.md"), "utf-8")
+		expect(sanitizedContent).toContain('name: "ckm-slides"')
+
+		sanitizer.cleanup()
+	})
+
+	it("sanitizePath handles a directory via sanitizeDir", () => {
+		const source = makeSourceDir({
+			"ckm:slides/SKILL.md": `---
+name: ckm:slides
+description: slides skill
+---
+
+body`,
+		})
+
+		const sanitizer = createSkillSanitizer()
+		const sanitizedDir = sanitizer.sanitizePath(source)
+		createdTempDirs.push(sanitizedDir)
+		expect(existsSync(join(sanitizedDir, "ckm:slides", "SKILL.md"))).toBe(true)
+
+		const result = loadSkillsFromDir({ dir: sanitizedDir, source: "user" })
+		const nameDiagnostics = result.diagnostics.filter(
+			(d) => typeof d.message === "string" && d.message.toLowerCase().includes("name"),
+		)
+		expect(nameDiagnostics).toEqual([])
+		expect(result.skills.length).toBe(1)
+		expect(result.skills[0].name).toBe("ckm-slides")
+
+		sanitizer.cleanup()
+	})
+
+	it("sanitizePath handles a single .md file by copying it into a cached skill directory", () => {
+		const sourceDir = mkdtempSync(join(tmpdir(), "ikie-sanitizer-test-src-"))
+		createdTempDirs.push(sourceDir)
+		const sourceFile = join(sourceDir, "ckm:slides.md")
+		writeFileSync(
+			sourceFile,
+			`---
+name: ckm:slides
+description: slides skill
+---
+
+body content`,
+			"utf-8",
+		)
+
+		const sanitizer = createSkillSanitizer()
+		const sanitizedDir = sanitizer.sanitizePath(sourceFile)
+		createdTempDirs.push(sanitizedDir)
+		expect(existsSync(join(sanitizedDir, "SKILL.md"))).toBe(true)
+
+		const result = loadSkillsFromDir({ dir: sanitizedDir, source: "user" })
+		const nameDiagnostics = result.diagnostics.filter(
+			(d) => typeof d.message === "string" && d.message.toLowerCase().includes("name"),
+		)
+		expect(nameDiagnostics).toEqual([])
+		expect(result.skills.length).toBe(1)
+		expect(result.skills[0].name).toBe("ckm-slides")
+
+		const sanitizedContent = readFileSync(join(sanitizedDir, "SKILL.md"), "utf-8")
+		expect(sanitizedContent).toContain('name: "ckm-slides"')
+		expect(sanitizedContent).toContain("body content")
+
+		sanitizer.cleanup()
+	})
+
+	it("sanitizePath returns the original path for non-existent paths", () => {
+		const sanitizer = createSkillSanitizer()
+		const missing = join(tmpdir(), "ikie-sanitizer-missing-", Date.now().toString())
+		expect(sanitizer.sanitizePath(missing)).toBe(missing)
+		sanitizer.cleanup()
+	})
+})

package/src/extensions/skills-manager/skill-sanitizer.ts

@@ -0,0 +1,269 @@
+import { createHash } from "node:crypto"
+import {
+	cpSync,
+	existsSync,
+	mkdirSync,
+	mkdtempSync,
+	readFileSync,
+	readdirSync,
+	rmSync,
+	statSync,
+	writeFileSync,
+} from "node:fs"
+import { tmpdir } from "node:os"
+import { basename, extname, join } from "node:path"
+import { parse as parseYaml } from "yaml"
+
+/**
+ * Shared skill-name sanitizer for ikie.
+ *
+ * Mirrors the Agent Skills spec used by `@earendil-works/pi-coding-agent`:
+ *   - lowercase a-z, digits, hyphens only
+ *   - no leading/trailing hyphens
+ *   - no consecutive hyphens
+ *   - max 64 characters
+ */
+
+const MAX_NAME_LENGTH = 64
+const VALID_NAME_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/
+const FRONTMATTER_REGEX = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?/
+
+/**
+ * Normalize a raw skill name to a valid Agent Skills name.
+ * - lower-case
+ * - replace runs of invalid characters with a single hyphen
+ * - trim leading/trailing hyphens
+ * - truncate to 64 characters
+ * - fall back to `"skill"` if the result would be empty
+ */
+export function normalizeSkillName(raw: string): string {
+	const normalized = raw
+		.toLowerCase()
+		.replace(/[^a-z0-9-]+/g, "-")
+		.replace(/-+/g, "-")
+		.replace(/^-+|-+$/g, "")
+		.slice(0, MAX_NAME_LENGTH)
+		.replace(/^-+|-+$/g, "")
+
+	return normalized.length > 0 ? normalized : "skill"
+}
+
+/**
+ * True iff `name` is a valid Agent Skills name (matches the upstream regex and length limit).
+ */
+export function isValidSkillName(name: string): boolean {
+	if (typeof name !== "string") return false
+	if (name.length === 0 || name.length > MAX_NAME_LENGTH) return false
+	return VALID_NAME_RE.test(name)
+}
+
+/**
+ * Sanitize the frontmatter `name` field of a skill markdown file in-place.
+ *
+ * - If the content does not start with `---` frontmatter, return as-is.
+ * - Parse the frontmatter YAML and read the `name` field.
+ * - If `name` is missing or already valid, return the original content unchanged.
+ * - If `name` is invalid, rewrite the first top-level `name:` line to
+ *   `name: <normalized>` (the normalized value is JSON-quoted).
+ * - If frontmatter parsing fails, return the original content unchanged.
+ */
+export function sanitizeSkillMarkdown(content: string): string {
+	const match = FRONTMATTER_REGEX.exec(content)
+	if (!match) return content
+
+	const frontmatter = match[1]
+	const fmStart = match.index ?? 0
+	const fmEnd = fmStart + match[0].length
+
+	let parsed: unknown
+	try {
+		parsed = parseYaml(frontmatter)
+	} catch {
+		return content
+	}
+
+	if (typeof parsed !== "object" || parsed === null) {
+		return content
+	}
+
+	const record = parsed as Record<string, unknown>
+	const rawName = record.name
+	if (typeof rawName !== "string" || rawName.length === 0) {
+		return content
+	}
+	if (isValidSkillName(rawName)) {
+		return content
+	}
+
+	const normalized = normalizeSkillName(rawName)
+	const replacement = `name: ${JSON.stringify(normalized)}`
+
+	// match[1] is the inner frontmatter text between the two `---` markers.
+	// Its offset within `content` is right after the opening `---` line.
+	const openingPrefix = content.slice(fmStart, fmStart + 4) // "---\n" or "---\r\n"
+	const innerStart = fmStart + openingPrefix.length
+	const innerEnd = innerStart + match[1].length
+
+	const inner = content.slice(innerStart, innerEnd)
+	const lines = inner.split("\n")
+	let replaced = false
+	const newLines = lines.map((line) => {
+		if (replaced) return line
+		// Match top-level "name:" key (no leading whitespace).
+		if (/^name:\s*/.test(line)) {
+			replaced = true
+			return replacement
+		}
+		return line
+	})
+
+	if (!replaced) {
+		// No top-level `name:` line was found; insert one at the top of the frontmatter.
+		newLines.unshift(replacement)
+	}
+
+	const newInner = newLines.join("\n")
+	return content.slice(0, innerStart) + newInner + content.slice(innerEnd)
+}
+
+interface SkillSanitizer {
+	sanitizeDir(dir: string): string
+	sanitizePath(path: string): string
+	cleanup(): void
+}
+
+let cachedRoot: string | undefined
+let cleanupRegistered = false
+
+/**
+ * Create a process-lifetime skill sanitizer. It maintains a single temp
+ * directory and caches per-input sanitized copies so callers can re-use
+ * the result across invocations.
+ *
+ * The returned `sanitizeDir(dir)` copies `dir` (recursively) into the cache
+ * and rewrites every `SKILL.md` in place with `sanitizeSkillMarkdown`.
+ * The cached path is returned.
+ *
+ * `cleanup()` removes the temp directory; it is also registered as a
+ * process-exit handler on first invocation.
+ */
+export function createSkillSanitizer(): SkillSanitizer {
+	function getRoot(): string {
+		if (cachedRoot === undefined) {
+			cachedRoot = mkdtempSync(join(tmpdir(), "ikie-sanitized-skills-"))
+			if (!cleanupRegistered) {
+				cleanupRegistered = true
+				process.once("exit", () => {
+					if (cachedRoot) {
+						try {
+							rmSync(cachedRoot, { recursive: true, force: true })
+						} catch {
+							// best-effort cleanup
+						}
+					}
+				})
+			}
+		}
+		return cachedRoot
+	}
+
+	function sanitizeDir(dir: string): string {
+		const root = getRoot()
+		const key = createHash("sha256").update(dir).digest("hex").slice(0, 12)
+		const target = join(root, key)
+		rmSync(target, { recursive: true, force: true })
+		mkdirSync(target, { recursive: true })
+		cpSync(dir, target, { recursive: true, force: true })
+
+		rewriteSkillFiles(target)
+
+		return target
+	}
+
+	function sanitizePath(path: string): string {
+		if (!existsSync(path)) {
+			return path
+		}
+
+		try {
+			const stats = statSync(path)
+			if (stats.isDirectory()) {
+				return sanitizeDir(path)
+			}
+			if (stats.isFile() && extname(path).toLowerCase() === ".md") {
+				const root = getRoot()
+				const key = createHash("sha256").update(path).digest("hex").slice(0, 12)
+				const targetDir = join(root, key)
+				rmSync(targetDir, { recursive: true, force: true })
+				mkdirSync(targetDir, { recursive: true })
+
+				const stem = basename(path, ".md")
+				const skillDir = join(targetDir, stem)
+				mkdirSync(skillDir, { recursive: true })
+
+				const targetFile = join(skillDir, "SKILL.md")
+				const original = readFileSync(path, "utf-8")
+				const updated = sanitizeSkillMarkdown(original)
+				writeFileSync(targetFile, updated, "utf-8")
+
+				return skillDir
+			}
+		} catch {
+			// fall through to returning the original path
+		}
+
+		return path
+	}
+
+	function cleanup(): void {
+		if (cachedRoot !== undefined) {
+			try {
+				rmSync(cachedRoot, { recursive: true, force: true })
+			} catch {
+				// best-effort cleanup
+			}
+			cachedRoot = undefined
+		}
+	}
+
+	return { sanitizeDir, sanitizePath, cleanup }
+}
+
+function rewriteSkillFiles(dir: string): void {
+	let entries: import("node:fs").Dirent[]
+	try {
+		entries = readdirSync(dir, { withFileTypes: true })
+	} catch {
+		return
+	}
+
+	for (const entry of entries) {
+		const fullPath = join(dir, entry.name.toString())
+		if (entry.isDirectory()) {
+			rewriteSkillFiles(fullPath)
+			continue
+		}
+		const name = entry.name.toString()
+		if (entry.isFile() && name === "SKILL.md") {
+			try {
+				const original = readFileSync(fullPath, "utf-8")
+				const updated = sanitizeSkillMarkdown(original)
+				if (updated !== original) {
+					writeFileSync(fullPath, updated, "utf-8")
+				}
+			} catch {
+				// skip files we can't read/write
+			}
+		} else if (entry.isSymbolicLink() && name === "SKILL.md" && existsSync(fullPath)) {
+			try {
+				const original = readFileSync(fullPath, "utf-8")
+				const updated = sanitizeSkillMarkdown(original)
+				if (updated !== original) {
+					writeFileSync(fullPath, updated, "utf-8")
+				}
+			} catch {
+				// skip
+			}
+		}
+	}
+}

package/src/models.test.ts

@@ -190,7 +190,9 @@ describe("updateModelsConfig", () => {
 			json: async () => ({ models: [KIMI] }),
 		} as Response)
 
-		await updateModelsConfig(modelsJsonPath, "test-key", { endpoint: "https://custom.ikie.example/v1/chat/completions" })
+		await updateModelsConfig(modelsJsonPath, "test-key", {
+			endpoint: "https://custom.ikie.example/v1/chat/completions",
+		})
 
 		expect(fetch).toHaveBeenCalledWith(
 			"https://custom.ikie.example/models",