@ikie-dev/cli 9.8.7 → 9.9.1

package/src/extensions/prompt-construction/prompt-enrichment.test.ts

@@ -3,6 +3,7 @@ import { arch, version as osVersion, platform, release, tmpdir } from "node:os"
 import { join } from "node:path"
 import type { AssistantMessage, ToolResultMessage } from "@earendil-works/pi-ai"
 import type { ExtensionAPI, ToolInfo } from "@earendil-works/pi-coding-agent"
+import { loadSkillsFromDir } from "@earendil-works/pi-coding-agent"
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest"
 import * as config from "../../config.js"
 import type { ModelMetadata } from "../../models.js"
@@ -11,6 +12,7 @@ import * as startupContext from "../../startup-context.js"
 import * as agentWorkerContext from "../agent-worker-context.js"
 import { CLAUDE_CODE_SKILLS_RESOURCE_ID } from "../claude-code-skills/definition.js"
 import type { OrchestratorMessages } from "../orchestration/continuation-nudge.js"
+import * as modelRoles from "../orchestration/model-roles.js"
 import promptEnrichmentExtension, {
 	stripEmptyToolCalls,
 	_resetDeprecatedNotificationTracking,
@@ -509,6 +511,46 @@ describe("prompt enrichment Claude Code skills", () => {
 
 		expect(result.systemPrompt).not.toContain("<name>typescript-safety</name>")
 	})
+
+	it("sanitizes project skill names and emits no name-validation diagnostics", async () => {
+		const cwd = join(dir, "project")
+		const skillDir = join(cwd, ".ikie", "skills", "ckm-slides")
+		writeRawSkill(
+			join(skillDir, "SKILL.md"),
+			`---
+name: ckm:slides
+description: Ikie project slides skill.
+---
+
+# Slides
+
+Slides skill body.
+`,
+		)
+
+		const { createSkillSanitizer } = await import("../skills-manager/skill-sanitizer.js")
+		const sanitizer = createSkillSanitizer()
+		const sanitizedDir = sanitizer.sanitizePath(skillDir)
+		const directLoad = loadSkillsFromDir({ dir: sanitizedDir, source: "project" })
+		const nameDiagnostics = directLoad.diagnostics.filter(
+			(d) => d.type === "warning" && typeof d.message === "string" && d.message.toLowerCase().includes("name"),
+		)
+		expect(nameDiagnostics).toEqual([])
+		expect(directLoad.skills.map((s) => s.name)).toContain("ckm-slides")
+		sanitizer.cleanup()
+
+		const { beforeAgentStart } = buildPromptExtensionWithHandlers([])
+		if (!beforeAgentStart) throw new Error("before_agent_start handler was not registered")
+
+		const result = (await beforeAgentStart(
+			{},
+			{ cwd, model: undefined, hasUI: false, sessionManager: { getSessionId: () => "session-1" } },
+		)) as { systemPrompt: string }
+
+		expect(result.systemPrompt).toContain("<available_skills>")
+		expect(result.systemPrompt).toContain("<name>ckm-slides</name>")
+		expect(result.systemPrompt).toContain("Ikie project slides skill.")
+	})
 })
 
 describe("append system prompt", () => {
@@ -646,9 +688,13 @@ describe("model role startup warnings", () => {
 		expect(warn).not.toHaveBeenCalledWith(expect.stringContaining("[model-roles] Warning:"))
 	})
 
-	it("keeps unavailable role warnings when Ikie auth is already configured", () => {
+	it("keeps unavailable role warnings for explicit user role overrides when Ikie auth is already configured", () => {
 		vi.spyOn(config, "loadConfig").mockReturnValue({ apiKey: "test-key" } as ReturnType<typeof config.loadConfig>)
 		vi.spyOn(startupContext, "getAvailableModels").mockReturnValue([modelMetadata("different-model")])
+		vi.spyOn(modelRoles, "getModelRoles").mockReturnValue({
+			...modelRoles.DEFAULT_MODEL_ROLES,
+			builder: "anthropic/claude-sonnet-4-5",
+		})
 		const warn = vi.spyOn(console, "warn").mockImplementation(() => {})
 		const pi = {
 			registerFlag: () => {},
@@ -661,7 +707,7 @@ describe("model role startup warnings", () => {
 
 		promptEnrichmentExtension([])(pi)
 
-		expect(warn).toHaveBeenCalledWith(expect.stringContaining("[model-roles] Warning: orchestrator"))
+		expect(warn).toHaveBeenCalledWith(expect.stringContaining("[model-roles] Warning: builder"))
 	})
 })
 
@@ -1054,7 +1100,7 @@ describe("continuation nudge turn_end handler", () => {
 		// The handler should allow a second nudge since the model did not
 		// intentionally stop.
 		await fire("turn_end", {
-			message: makeAssistantWithStop([{ type: "text", text: "I was going to say..." }], "length"),
+			message: makeAssistantWithStop([{ type: "text", text: "I was going to call the Agent tool." }], "length"),
 		})
 		expect(sendMessageCalls.length).toBe(2)
 	})

package/src/extensions/prompt-construction/prompt-enrichment.ts

@@ -63,6 +63,7 @@ import {
 	splitModelRef,
 	validateModelRoles,
 } from "../orchestration/model-roles.js"
+import { createSkillSanitizer } from "../skills-manager/skill-sanitizer.js"
 import { getCurrentPhase } from "../tags.js"
 import { type ContextFile, loadGlobalContextFiles, loadProjectContextFiles } from "./context-files.js"
 import {
@@ -476,6 +477,8 @@ export default function (skillPaths: string[]) {
 		const cachedUsername = safeUsername()
 		const cachedHomeDir = homedir()
 
+		const skillSanitizer = createSkillSanitizer()
+
 		let cachedContextFiles: ContextFile[] | undefined
 		let cachedSkills: Skill[] | undefined
 		let cachedGitRemote: string | undefined | null = null
@@ -505,7 +508,7 @@ export default function (skillPaths: string[]) {
 				cachedSkills = loadSkills({
 					cwd: ctx.cwd,
 					agentDir: getAgentDir(),
-					skillPaths: allSkillPaths,
+					skillPaths: allSkillPaths.map((p) => skillSanitizer.sanitizePath(p)),
 					includeDefaults: false,
 				}).skills
 			}

package/src/extensions/skills-manager/skill-manager.test.ts

@@ -15,36 +15,53 @@ import {
 
 describe("validateName", () => {
 	const valid = (name: string) => expect(validateName(name)).toBeNull()
-	const invalid = (name: string, contains: string) => {
-		const result = validateName(name)
-		expect(result).not.toBeNull()
-		expect(result?.toLowerCase()).toContain(contains)
+	const invalid = (name: string) => {
+		expect(validateName(name)).not.toBeNull()
 	}
 
 	it("accepts valid names", () => {
+		valid("ckm-slides")
+		valid("ui-ux-pro-max")
 		valid("systematic-debugging")
-		valid("debug_v2")
-		valid("foo.bar")
 		valid("abc123")
 	})
 
-	it("rejects names starting with non-alphanumeric", () => {
-		invalid("-foo", "start")
-		invalid("_bar", "start")
+	it("rejects names with colons", () => {
+		invalid("ckm:slides")
+	})
+
+	it("rejects names with underscores", () => {
+		invalid("foo_bar")
+		invalid("debug_v2")
+	})
+
+	it("rejects names with dots", () => {
+		invalid("foo.bar")
+	})
+
+	it("rejects names with a leading hyphen", () => {
+		invalid("-bad")
+	})
+
+	it("rejects names with consecutive hyphens", () => {
+		invalid("bad--bad")
+	})
+
+	it("rejects names starting with an underscore", () => {
+		invalid("_bar")
 	})
 
 	it("rejects uppercase letters", () => {
-		invalid("Foo", "lowercase")
-		invalid("SYSTEM", "lowercase")
+		invalid("Foo")
+		invalid("SYSTEM")
 	})
 
 	it("rejects names longer than 64 chars", () => {
-		invalid("a".repeat(65), "64")
+		invalid("a".repeat(65))
 	})
 
 	it("rejects names with spaces", () => {
-		const result = validateName("foo bar")
-		expect(result).not.toBeNull()
+		invalid("foo bar")
 	})
 })
 

package/src/extensions/skills-manager/skill-manager.ts

@@ -44,23 +44,32 @@ export interface SkillManageResult {
 	path?: string
 }
 
-const NAME_RE = /^[a-z0-9][a-z0-9._-]*$/
+// Agent Skills spec: only lowercase a-z, 0-9, hyphens; no leading/trailing
+// hyphens; no consecutive hyphens; max 64 characters.
+const SKILL_NAME_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/
+// Category directory names are filesystem-side only, so they allow a broader
+// set of characters (dots, underscores) but still reject spaces and must
+// start with a lowercase letter or digit.
+const CATEGORY_RE = /^[a-z0-9][a-z0-9._-]*$/
 const MAX_NAME_LEN = 64
 const ALLOWED_SUBDIRS = new Set(["references", "templates", "scripts", "assets"])
 
 export function validateName(name: string): string | null {
 	if (name.length === 0) return "Name cannot be empty."
 	if (name.length > MAX_NAME_LEN) return `Name must be at most ${MAX_NAME_LEN} characters.`
-	if (!NAME_RE.test(name)) {
-		if (!/^[a-z0-9]/.test(name)) return "Name must start with a lowercase letter or digit."
-		return "Name must contain only lowercase letters, digits, dots, underscores, or hyphens."
+	if (!SKILL_NAME_RE.test(name)) {
+		return "Name must contain only lowercase letters, digits, and hyphens, with no leading or trailing hyphens or consecutive hyphens."
 	}
 	return null
 }
 
 export function validateCategory(category?: string): string | null {
 	if (!category) return null
-	return validateName(category)
+	if (category.length > MAX_NAME_LEN) return `Category must be at most ${MAX_NAME_LEN} characters.`
+	if (!CATEGORY_RE.test(category)) {
+		return "Category must start with a lowercase letter or digit and contain only lowercase letters, digits, dots, underscores, or hyphens."
+	}
+	return null
 }
 
 /**

package/src/extensions/skills-manager/skill-sanitizer.test.ts

@@ -0,0 +1,287 @@
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs"
+import { tmpdir } from "node:os"
+import { join } from "node:path"
+import { loadSkillsFromDir } from "@earendil-works/pi-coding-agent"
+import { afterEach, describe, expect, it } from "vitest"
+import { createSkillSanitizer, isValidSkillName, normalizeSkillName, sanitizeSkillMarkdown } from "./skill-sanitizer.js"
+
+describe("normalizeSkillName", () => {
+	it("lowercases input", () => {
+		expect(normalizeSkillName("FooBar")).toBe("foobar")
+	})
+
+	it("replaces runs of invalid chars with a single hyphen", () => {
+		expect(normalizeSkillName("ckm:slides")).toBe("ckm-slides")
+		expect(normalizeSkillName("foo_bar")).toBe("foo-bar")
+		expect(normalizeSkillName("a   b")).toBe("a-b")
+		expect(normalizeSkillName("a___b")).toBe("a-b")
+	})
+
+	it("trims leading and trailing hyphens", () => {
+		expect(normalizeSkillName("-foo-")).toBe("foo")
+		expect(normalizeSkillName("---bar---")).toBe("bar")
+	})
+
+	it("truncates to 64 characters", () => {
+		const long = "a".repeat(100)
+		expect(normalizeSkillName(long)).toHaveLength(64)
+	})
+
+	it("falls back to 'skill' when empty after normalization", () => {
+		expect(normalizeSkillName("")).toBe("skill")
+		expect(normalizeSkillName("___")).toBe("skill")
+		expect(normalizeSkillName("---")).toBe("skill")
+	})
+
+	it("collapses consecutive hyphens", () => {
+		expect(normalizeSkillName("foo--bar")).toBe("foo-bar")
+	})
+})
+
+describe("isValidSkillName", () => {
+	it("accepts valid names", () => {
+		expect(isValidSkillName("ckm-slides")).toBe(true)
+		expect(isValidSkillName("ui-ux-pro-max")).toBe(true)
+		expect(isValidSkillName("abc")).toBe(true)
+		expect(isValidSkillName("a1b2")).toBe(true)
+	})
+
+	it("rejects empty or too long", () => {
+		expect(isValidSkillName("")).toBe(false)
+		expect(isValidSkillName("a".repeat(65))).toBe(false)
+	})
+
+	it("rejects invalid characters", () => {
+		expect(isValidSkillName("ckm:slides")).toBe(false)
+		expect(isValidSkillName("Foo_Bar")).toBe(false)
+		expect(isValidSkillName("foo.bar")).toBe(false)
+	})
+
+	it("rejects leading/trailing hyphens", () => {
+		expect(isValidSkillName("-bad")).toBe(false)
+		expect(isValidSkillName("bad-")).toBe(false)
+	})
+
+	it("rejects consecutive hyphens", () => {
+		expect(isValidSkillName("bad--bad")).toBe(false)
+	})
+})
+
+describe("sanitizeSkillMarkdown", () => {
+	it("leaves valid skill content unchanged", () => {
+		const input = `---
+name: ckm-slides
+description: My slides skill
+---
+
+# Body
+
+Some content.`
+		expect(sanitizeSkillMarkdown(input)).toBe(input)
+	})
+
+	it("rewrites name: ckm:slides to quoted normalized form", () => {
+		const input = `---
+name: ckm:slides
+description: slides
+---
+
+Body content`
+		const out = sanitizeSkillMarkdown(input)
+		expect(out).toContain('name: "ckm-slides"')
+		expect(out).not.toContain("ckm:slides")
+	})
+
+	it("rewrites name: Foo_Bar to quoted normalized form", () => {
+		const input = `---
+name: Foo_Bar
+description: foo bar
+---
+
+Body`
+		const out = sanitizeSkillMarkdown(input)
+		expect(out).toContain('name: "foo-bar"')
+		expect(out).not.toContain("Foo_Bar")
+	})
+
+	it("preserves body content", () => {
+		const input = `---
+name: ckm:slides
+description: slides
+---
+
+# Heading
+
+Important body content with code:
+
+\`\`\`bash
+echo hi
+\`\`\`
+`
+		const out = sanitizeSkillMarkdown(input)
+		expect(out).toContain("# Heading")
+		expect(out).toContain("Important body content")
+		expect(out).toContain("echo hi")
+	})
+
+	it("preserves non-name frontmatter keys", () => {
+		const input = `---
+name: ckm:slides
+description: slides
+allowed-tools: Read, Write
+---
+
+Body`
+		const out = sanitizeSkillMarkdown(input)
+		expect(out).toContain('name: "ckm-slides"')
+		expect(out).toContain("allowed-tools: Read, Write")
+		expect(out).toContain("description: slides")
+	})
+
+	it("returns content unchanged when name is missing", () => {
+		const input = `---
+description: only description
+---
+
+Body`
+		expect(sanitizeSkillMarkdown(input)).toBe(input)
+	})
+
+	it("returns content unchanged when there is no frontmatter", () => {
+		const input = "Just a body with no frontmatter."
+		expect(sanitizeSkillMarkdown(input)).toBe(input)
+	})
+
+	it("returns content unchanged on frontmatter parse failure", () => {
+		const input = `---
+name: ckm:slides
+description: [unterminated
+---
+
+Body`
+		expect(sanitizeSkillMarkdown(input)).toBe(input)
+	})
+})
+
+describe("createSkillSanitizer / sanitizeDir", () => {
+	let createdTempDirs: string[] = []
+
+	afterEach(() => {
+		for (const d of createdTempDirs) {
+			try {
+				rmSync(d, { recursive: true, force: true })
+			} catch {
+				// ignore
+			}
+		}
+		createdTempDirs = []
+	})
+
+	function makeSourceDir(files: Record<string, string>): string {
+		const dir = mkdtempSync(join(tmpdir(), "ikie-sanitizer-test-src-"))
+		createdTempDirs.push(dir)
+		for (const [relPath, content] of Object.entries(files)) {
+			const full = join(dir, relPath)
+			mkdirSync(join(full, ".."), { recursive: true })
+			writeFileSync(full, content, "utf-8")
+		}
+		return dir
+	}
+
+	it("produces a directory that loads cleanly via upstream loadSkillsFromDir", () => {
+		const source = makeSourceDir({
+			"ckm:slides/SKILL.md": `---
+name: ckm:slides
+description: slides skill
+---
+
+body`,
+		})
+
+		const sanitizer = createSkillSanitizer()
+		const sanitizedDir = sanitizer.sanitizeDir(source)
+		createdTempDirs.push(sanitizedDir)
+		expect(existsSync(join(sanitizedDir, "ckm:slides", "SKILL.md"))).toBe(true)
+
+		const result = loadSkillsFromDir({ dir: sanitizedDir, source: "user" })
+		const nameDiagnostics = result.diagnostics.filter(
+			(d) => typeof d.message === "string" && d.message.toLowerCase().includes("name"),
+		)
+		expect(nameDiagnostics).toEqual([])
+		expect(result.skills.length).toBe(1)
+		expect(result.skills[0].name).toBe("ckm-slides")
+
+		const sanitizedContent = readFileSync(join(sanitizedDir, "ckm:slides", "SKILL.md"), "utf-8")
+		expect(sanitizedContent).toContain('name: "ckm-slides"')
+
+		sanitizer.cleanup()
+	})
+
+	it("sanitizePath handles a directory via sanitizeDir", () => {
+		const source = makeSourceDir({
+			"ckm:slides/SKILL.md": `---
+name: ckm:slides
+description: slides skill
+---
+
+body`,
+		})
+
+		const sanitizer = createSkillSanitizer()
+		const sanitizedDir = sanitizer.sanitizePath(source)
+		createdTempDirs.push(sanitizedDir)
+		expect(existsSync(join(sanitizedDir, "ckm:slides", "SKILL.md"))).toBe(true)
+
+		const result = loadSkillsFromDir({ dir: sanitizedDir, source: "user" })
+		const nameDiagnostics = result.diagnostics.filter(
+			(d) => typeof d.message === "string" && d.message.toLowerCase().includes("name"),
+		)
+		expect(nameDiagnostics).toEqual([])
+		expect(result.skills.length).toBe(1)
+		expect(result.skills[0].name).toBe("ckm-slides")
+
+		sanitizer.cleanup()
+	})
+
+	it("sanitizePath handles a single .md file by copying it into a cached skill directory", () => {
+		const sourceDir = mkdtempSync(join(tmpdir(), "ikie-sanitizer-test-src-"))
+		createdTempDirs.push(sourceDir)
+		const sourceFile = join(sourceDir, "ckm:slides.md")
+		writeFileSync(
+			sourceFile,
+			`---
+name: ckm:slides
+description: slides skill
+---
+
+body content`,
+			"utf-8",
+		)
+
+		const sanitizer = createSkillSanitizer()
+		const sanitizedDir = sanitizer.sanitizePath(sourceFile)
+		createdTempDirs.push(sanitizedDir)
+		expect(existsSync(join(sanitizedDir, "SKILL.md"))).toBe(true)
+
+		const result = loadSkillsFromDir({ dir: sanitizedDir, source: "user" })
+		const nameDiagnostics = result.diagnostics.filter(
+			(d) => typeof d.message === "string" && d.message.toLowerCase().includes("name"),
+		)
+		expect(nameDiagnostics).toEqual([])
+		expect(result.skills.length).toBe(1)
+		expect(result.skills[0].name).toBe("ckm-slides")
+
+		const sanitizedContent = readFileSync(join(sanitizedDir, "SKILL.md"), "utf-8")
+		expect(sanitizedContent).toContain('name: "ckm-slides"')
+		expect(sanitizedContent).toContain("body content")
+
+		sanitizer.cleanup()
+	})
+
+	it("sanitizePath returns the original path for non-existent paths", () => {
+		const sanitizer = createSkillSanitizer()
+		const missing = join(tmpdir(), "ikie-sanitizer-missing-", Date.now().toString())
+		expect(sanitizer.sanitizePath(missing)).toBe(missing)
+		sanitizer.cleanup()
+	})
+})