@litfamily/litclaude 1.0.6 → 1.0.7

package/plugins/litclaude/lib/skill-loop/common.mjs

@@ -1,280 +0,0 @@
-import { createHash, randomUUID } from "node:crypto";
-import {
-  closeSync,
-  constants,
-  existsSync,
-  fstatSync,
-  fsyncSync,
-  lstatSync,
-  mkdirSync,
-  openSync,
-  readFileSync,
-  realpathSync,
-  renameSync,
-  rmSync,
-  writeFileSync,
-} from "node:fs";
-import { dirname, isAbsolute, join, relative, resolve } from "node:path";
-import { tmpdir } from "node:os";
-
-import { acquireOwnerLock, releaseOwnerLock } from "../owner-lock.mjs";
-import { directoryIdentity, pathIdentity, sameDirectoryIdentity, samePathIdentity } from "../secure-path-read.mjs";
-import { containsSecret } from "../secret-shapes.mjs";
-import { decodeStrictUtf8, parseStrictJson } from "../strict-json.mjs";
-
-export const PROPOSAL_MAX_BYTES = 64 * 1024;
-export const SKILL_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u;
-export const RECORD_ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
-const RFC3339 = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d+)?(Z|([+-])(\d{2}):(\d{2}))$/u;
-const PORTABLE_FORBIDDEN = /[\\:*?"<>|\u0000-\u001f\u007f-\u009f]/u;
-const RESERVED_BASENAME = /^(?:CON|PRN|AUX|NUL|COM[1-9]|LPT[1-9])$/iu;
-
-export const isPlainObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
-
-export function requireExactKeys(value, required, optional = []) {
-  if (!isPlainObject(value)) return false;
-  const allowed = new Set([...required, ...optional]);
-  return required.every((key) => Object.hasOwn(value, key))
-    && Object.keys(value).every((key) => allowed.has(key));
-}
-
-export function parseTimestamp(value) {
-  if (typeof value !== "string") return null;
-  const match = value.match(RFC3339);
-  if (!match) return null;
-  const [, year, month, day, hour, minute, second, , , offsetHour, offsetMinute] = match;
-  const parts = [year, month, day, hour, minute, second].map(Number);
-  const [yyyy, mm, dd, hh, min, ss] = parts;
-  const calendarProbe = new Date(Date.UTC(yyyy, mm - 1, dd, hh, min, ss));
-  if (calendarProbe.getUTCFullYear() !== yyyy || calendarProbe.getUTCMonth() !== mm - 1
-    || calendarProbe.getUTCDate() !== dd || calendarProbe.getUTCHours() !== hh
-    || calendarProbe.getUTCMinutes() !== min || calendarProbe.getUTCSeconds() !== ss
-    || (offsetHour !== undefined && (Number(offsetHour) > 23 || Number(offsetMinute) > 59))) return null;
-  const milliseconds = Date.parse(value);
-  return Number.isFinite(milliseconds) ? milliseconds : null;
-}
-
-export function portablePathIdentity(value) {
-  if (typeof value !== "string" || value === "" || value.length > 1024
-    || isAbsolute(value) || /^[A-Za-z]:/u.test(value) || value.startsWith("//")
-    || value.includes("//") || PORTABLE_FORBIDDEN.test(value)) return null;
-  const segments = value.split("/");
-  if (segments.some((segment) => segment === "" || segment === "." || segment === ".."
-    || /[. ]$/u.test(segment) || RESERVED_BASENAME.test(segment.split(".")[0]))) return null;
-  return segments.map((segment) => segment.normalize("NFC").toLocaleLowerCase("en-US")
-    .replace(/[. ]+$/u, "")).join("/");
-}
-
-export function assertNoSecretStrings(value, fail) {
-  const visit = (candidate) => {
-    if (typeof candidate === "string") {
-      if (containsSecret(candidate)) fail();
-      return;
-    }
-    if (Array.isArray(candidate)) {
-      for (const item of candidate) visit(item);
-      return;
-    }
-    if (isPlainObject(candidate)) {
-      for (const [key, item] of Object.entries(candidate)) {
-        visit(key);
-        visit(item);
-      }
-    }
-  };
-  visit(value);
-}
-
-export const projectStateRoot = (root) => join(resolve(root), ".litclaude");
-export const skillRootFor = (root) => join(resolve(root), ".claude", "skills");
-
-export function canonicalSkillRootFor(root, ErrorType, code = "TARGET_PATH_UNSAFE") {
-  const workspace = assertWorkspace(root, ErrorType, code);
-  try {
-    return join(realpathSync.native(workspace), ".claude", "skills");
-  } catch {
-    throw new ErrorType(code, "workspace root cannot be canonicalized");
-  }
-}
-
-export function skillRootsEquivalent(root, targetRoot) {
-  const expected = skillRootFor(root);
-  if (targetRoot === expected) return true;
-  if (typeof targetRoot !== "string" || !isAbsolute(targetRoot) || resolve(targetRoot) !== targetRoot) return false;
-  const candidateRoot = dirname(dirname(targetRoot));
-  if (join(candidateRoot, ".claude", "skills") !== targetRoot) return false;
-  const expectedRoot = resolve(root);
-  const expectedDetails = lstatSync(expectedRoot, { throwIfNoEntry: false });
-  const candidateDetails = lstatSync(candidateRoot, { throwIfNoEntry: false });
-  if (!expectedDetails?.isDirectory() || expectedDetails.isSymbolicLink()
-    || !candidateDetails?.isDirectory() || candidateDetails.isSymbolicLink()) return false;
-  try {
-    return realpathSync.native(expectedRoot) === realpathSync.native(candidateRoot);
-  } catch {
-    return false;
-  }
-}
-
-export function assertWorkspace(root, ErrorType, code = "TARGET_PATH_UNSAFE") {
-  const path = resolve(root);
-  const details = lstatSync(path, { throwIfNoEntry: false });
-  if (!details?.isDirectory() || details.isSymbolicLink()) throw new ErrorType(code, "workspace root is unsafe");
-  return path;
-}
-
-export function ensureSafeDirectoryChain(root, parts, { create = false, ErrorType, code }) {
-  let current = assertWorkspace(root, ErrorType, code);
-  for (const part of parts) {
-    current = join(current, part);
-    let details = lstatSync(current, { throwIfNoEntry: false });
-    if (!details && create) {
-      mkdirSync(current, { mode: 0o700 });
-      details = lstatSync(current, { throwIfNoEntry: false });
-    }
-    if (!details) return null;
-    if (!details.isDirectory() || details.isSymbolicLink()) {
-      throw new ErrorType(code, "state path contains a non-directory or symbolic link");
-    }
-  }
-  return current;
-}
-
-export function captureDirectoryIdentity(path, ErrorType, code, { allowMissing = false } = {}) {
-  const details = lstatSync(path, { throwIfNoEntry: false });
-  if (!details) {
-    if (allowMissing) return null;
-    throw new ErrorType(code, "expected directory is missing");
-  }
-  if (!details.isDirectory() || details.isSymbolicLink()) {
-    throw new ErrorType(code, "expected path is not a real directory");
-  }
-  return directoryIdentity(details);
-}
-
-export function directoryIdentityMatches(path, expected) {
-  const details = lstatSync(path, { throwIfNoEntry: false });
-  if (expected === null) return !details;
-  return Boolean(details?.isDirectory() && !details.isSymbolicLink()
-    && sameDirectoryIdentity(directoryIdentity(details), expected));
-}
-
-export function assertRegularSingleLink(path, ErrorType, code, { maxBytes } = {}) {
-  const named = lstatSync(path, { throwIfNoEntry: false });
-  if (!named?.isFile() || named.isSymbolicLink() || named.nlink !== 1
-    || (maxBytes !== undefined && named.size > maxBytes)) {
-    throw new ErrorType(code, "record must be a bounded regular file with one link");
-  }
-  let descriptor;
-  try {
-    descriptor = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
-    const opened = fstatSync(descriptor);
-    if (!opened.isFile() || opened.nlink !== 1 || !samePathIdentity(pathIdentity(opened), pathIdentity(named))
-      || opened.size !== named.size || opened.mtimeMs !== named.mtimeMs) {
-      throw new ErrorType(code, "record identity changed while opening");
-    }
-    const bytes = readFileSync(descriptor);
-    const after = fstatSync(descriptor);
-    if (!samePathIdentity(pathIdentity(after), pathIdentity(opened)) || after.size !== opened.size
-      || after.mtimeMs !== opened.mtimeMs) {
-      throw new ErrorType(code, "record identity changed while reading");
-    }
-    return bytes;
-  } finally {
-    if (descriptor !== undefined) closeSync(descriptor);
-  }
-}
-
-export function readStrictJsonFile(path, ErrorType, code, options) {
-  const bytes = assertRegularSingleLink(path, ErrorType, code, options);
-  try {
-    return parseStrictJson(decodeSkillLoopUtf8(bytes));
-  } catch (error) {
-    if (error instanceof ErrorType) throw error;
-    throw new ErrorType(options?.parseCode ?? code, "record is not strict JSON");
-  }
-}
-
-export function decodeSkillLoopUtf8(bytes) {
-  if (bytes.length >= 3 && bytes[0] === 0xef && bytes[1] === 0xbb && bytes[2] === 0xbf) {
-    throw new TypeError("UTF-8 BOM is not permitted");
-  }
-  return decodeStrictUtf8(bytes);
-}
-
-export function atomicWriteJson(path, value, ErrorType, code) {
-  return atomicWriteBytes(path, prettyJsonBytes(value), ErrorType, code);
-}
-
-export function prettyJsonBytes(value) {
-  return Buffer.from(`${JSON.stringify(value, null, 2)}\n`, "utf8");
-}
-
-export function atomicWriteBytes(path, bytes, ErrorType, code) {
-  const directory = dirname(path);
-  const current = lstatSync(path, { throwIfNoEntry: false });
-  if (current && (!current.isFile() || current.isSymbolicLink() || current.nlink !== 1)) {
-    throw new ErrorType(code, "destination is not a regular single-link file");
-  }
-  const temporary = join(directory, `.${randomUUID()}.tmp`);
-  let descriptor;
-  try {
-    writeFileSync(temporary, bytes, { flag: "wx", mode: 0o600 });
-    descriptor = openSync(temporary, "r");
-    fsyncSync(descriptor);
-    closeSync(descriptor);
-    descriptor = undefined;
-    renameSync(temporary, path);
-    try {
-      descriptor = openSync(directory, "r");
-      fsyncSync(descriptor);
-    } catch {
-      // The file data and rename are already durable on filesystems that reject directory fsync.
-    }
-  } catch (error) {
-    if (error instanceof ErrorType) throw error;
-    throw new ErrorType(code, "atomic state write failed");
-  } finally {
-    if (descriptor !== undefined) closeSync(descriptor);
-    rmSync(temporary, { force: true });
-  }
-}
-
-export function withSkillLoopLock(root, scope, operation, ErrorType, code) {
-  const realRoot = realpathSync.native(assertWorkspace(root, ErrorType, code));
-  const digest = createHash("sha256").update(`${realRoot}\0${scope}`).digest("hex");
-  const lockPath = join(tmpdir(), "litclaude-skill-loop-locks", `${digest}.lock`);
-  let owner;
-  try {
-    owner = acquireOwnerLock(lockPath, { timeoutMs: 2_000, staleMs: 0 });
-  } catch (error) {
-    if (error instanceof ErrorType) throw error;
-    throw new ErrorType(code, "skill-loop lock failed");
-  }
-  let result;
-  let operationError;
-  try {
-    result = operation();
-  } catch (error) {
-    operationError = error;
-  }
-  if (!releaseOwnerLock(lockPath, owner)) throw new ErrorType(code, "skill-loop lock release failed");
-  if (operationError) throw operationError;
-  return result;
-}
-
-export function isContained(root, child) {
-  const rel = relative(resolve(root), resolve(child));
-  return rel === "" || (!isAbsolute(rel) && rel !== ".." && !rel.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`));
-}
-
-export function sha256(bytes) {
-  return createHash("sha256").update(bytes).digest("hex");
-}
-
-export function safeIsoPath(timestamp) {
-  return timestamp.replace(/[:.]/gu, "-");
-}
-
-export function pathExists(path) {
-  return existsSync(path);
-}

package/plugins/litclaude/lib/skill-loop/config.mjs

@@ -1,91 +0,0 @@
-import { lstatSync } from "node:fs";
-import { join } from "node:path";
-
-import {
-  atomicWriteJson,
-  ensureSafeDirectoryChain,
-  isPlainObject,
-  parseTimestamp,
-  prettyJsonBytes,
-  readStrictJsonFile,
-  requireExactKeys,
-  withSkillLoopLock,
-} from "./common.mjs";
-import { recoverSkillMutationTransactionUnlocked } from "./mutation-transaction.mjs";
-
-class SkillLoopConfigError extends Error {
-  constructor(code, message = code) {
-    super(`${code}: ${message}`);
-    this.name = "SkillLoopConfigError";
-    this.code = code;
-  }
-}
-
-export const DEFAULT_SKILL_LOOP_CONFIG = Object.freeze({
-  autoApply: false,
-  nudgeInterval: 10,
-  curator: Object.freeze({
-    intervalDays: 7,
-    minIdleHours: 2,
-    staleAfterDays: 30,
-    archiveAfterDays: 90,
-    delete: false,
-    consolidation: false,
-  }),
-});
-
-const cloneDefaults = () => ({ ...DEFAULT_SKILL_LOOP_CONFIG, curator: { ...DEFAULT_SKILL_LOOP_CONFIG.curator } });
-const configPath = (root, create) => {
-  const state = ensureSafeDirectoryChain(root, [".litclaude"], {
-    create,
-    ErrorType: SkillLoopConfigError,
-    code: "CONFIG_STORE_UNSAFE",
-  });
-  return state === null ? null : join(state, "skill-loop.json");
-};
-
-export function validateSkillLoopConfig(value) {
-  let persisted;
-  try {
-    persisted = prettyJsonBytes(value);
-  } catch {
-    throw new SkillLoopConfigError("CONFIG_INVALID", "skill-loop config is invalid");
-  }
-  if (persisted.length > 64 * 1024) throw new SkillLoopConfigError("CONFIG_TOO_LARGE");
-  if (!requireExactKeys(value, ["autoApply", "nudgeInterval", "curator"], ["lastCuratorRunAt"])
-    || typeof value.autoApply !== "boolean"
-    || !Number.isSafeInteger(value.nudgeInterval) || value.nudgeInterval < 1
-    || !requireExactKeys(value.curator, [
-      "intervalDays", "minIdleHours", "staleAfterDays", "archiveAfterDays", "delete", "consolidation",
-    ])
-    || !["intervalDays", "minIdleHours", "staleAfterDays", "archiveAfterDays"].every(
-      (field) => Number.isFinite(value.curator[field]) && value.curator[field] >= 0,
-    )
-    || typeof value.curator.delete !== "boolean" || typeof value.curator.consolidation !== "boolean"
-    || value.curator.delete !== false || value.curator.consolidation !== false
-    || (Object.hasOwn(value, "lastCuratorRunAt") && parseTimestamp(value.lastCuratorRunAt) === null)) {
-    throw new SkillLoopConfigError("CONFIG_INVALID", "skill-loop config is invalid");
-  }
-  return value;
-}
-
-export function readSkillLoopConfig(root) {
-  const path = configPath(root, false);
-  if (path === null || !lstatSync(path, { throwIfNoEntry: false })) return cloneDefaults();
-  const parsed = readStrictJsonFile(path, SkillLoopConfigError, "CONFIG_STORE_UNSAFE", { maxBytes: 64 * 1024 });
-  if (!isPlainObject(parsed)) throw new SkillLoopConfigError("CONFIG_INVALID", "skill-loop config is invalid");
-  return validateSkillLoopConfig(parsed);
-}
-
-export function writeSkillLoopConfigUnlocked(root, value) {
-  validateSkillLoopConfig(value);
-  atomicWriteJson(configPath(root, true), value, SkillLoopConfigError, "CONFIG_STORE_UNSAFE");
-  return value;
-}
-
-export function writeSkillLoopConfig(root, value) {
-  return withSkillLoopLock(root, "transaction", () => {
-    recoverSkillMutationTransactionUnlocked(root);
-    return writeSkillLoopConfigUnlocked(root, value);
-  }, SkillLoopConfigError, "CONFIG_STORE_UNSAFE");
-}