@michengai/dsh-skills-manager 1.2.21 → 1.2.23

package/lib/index.js

@@ -39,7 +39,7 @@ import { listClawHub, searchClawHub } from "./clawhub-catalog.js";
 import { searchSkillsSh } from "./skills-sh-catalog.js";
 import { loadCatalogPackage, readCatalogSkill } from "./catalog-skill.js";
 const name = "skills-manager";
-const inject = ["webServer", "skills", "tools", "sessions"];
+const inject = ["connection", "skills", "tools", "sessions"];
 const CLIENT_MARKER_HEADER = "x-dsh-skills-manager";
 const MAX_LOG_BYTES = 1 << 20;
 const MAX_UPLOAD_BODY_BYTES = 88 << 20;
@@ -62,106 +62,79 @@ function makeLog() {
     await queue;
   };
 }
-function readBody(req, limit = 1 << 20) {
-  return new Promise((resolve, reject) => {
-    let size = 0;
-    let settled = false;
-    const chunks = [];
-    const fail = (error) => {
-      if (settled) return;
-      settled = true;
-      reject(error);
-    };
-    req.on("data", (c) => {
-      if (settled) return;
-      size += c.length;
-      if (size > limit) {
-        const error = new Error("body too large");
-        error.statusCode = 413;
-        error.code = "error.proto.bodyTooLarge";
-        fail(error);
-        req.resume();
-        return;
-      }
-      chunks.push(c);
-    });
-    req.on("end", () => {
-      if (settled) return;
-      try {
-        const raw = Buffer.concat(chunks).toString("utf8");
-        const body = raw ? JSON.parse(raw) : {};
-        settled = true;
-        resolve(body);
-      } catch (caught) {
-        const e = caught;
-        const error = new Error(`invalid JSON body: ${e.message}`);
-        error.statusCode = 400;
-        error.code = "error.proto.invalidJson";
-        fail(error);
-      }
-    });
-    req.on("error", fail);
-  });
-}
-function parseAuthority(authority) {
+async function readJsonBody(request, limit = 1 << 20) {
+  const text = await request.text();
+  if (Buffer.byteLength(text) > limit) {
+    const error = new Error("body too large");
+    error.statusCode = 413;
+    error.code = "error.proto.bodyTooLarge";
+    throw error;
+  }
+  if (!text.trim()) return {};
   try {
-    return new URL(`http://${authority}`);
-  } catch {
-    return void 0;
+    return JSON.parse(text);
+  } catch (caught) {
+    const e = caught;
+    const error = new Error(`invalid JSON body: ${e.message}`);
+    error.statusCode = 400;
+    error.code = "error.proto.invalidJson";
+    throw error;
   }
 }
-function canonicalAuthority(authority, parsed) {
-  const port = parsed.port !== "" ? parsed.port : new URL(`https://${authority}`).port;
-  return port === "" ? parsed.hostname : `${parsed.hostname}:${port}`;
-}
-function isCanonicalAuthority(authority, parsed) {
-  return canonicalAuthority(authority, parsed) === authority.toLowerCase();
-}
-function isLoopbackHostname(hostname) {
-  if (hostname === "localhost" || hostname === "[::1]") return true;
-  const parts = hostname.split(".");
-  return parts.length === 4 && parts[0] === "127" && parts.every((part) => /^\d{1,3}$/.test(part) && Number(part) <= 255);
-}
-function isTrustedAuthority(hostUrl, trustedHosts) {
-  return trustedHosts.some((entry) => {
-    if (typeof entry !== "string") return false;
-    const entryUrl = parseAuthority(entry);
-    if (!entryUrl || !isCanonicalAuthority(entry, entryUrl)) return false;
-    return canonicalAuthority(entry, entryUrl) === entryUrl.hostname ? entryUrl.hostname === hostUrl.hostname : entryUrl.host === hostUrl.host;
-  });
-}
-function validateRequestOrigin(req, trustedHosts = []) {
-  const host = typeof req.headers.host === "string" ? req.headers.host : "";
-  const hostUrl = parseAuthority(host);
-  if (!hostUrl || !isCanonicalAuthority(host, hostUrl)) {
-    return { statusCode: 403, code: "error.proto.forbiddenHost", error: "forbidden host" };
-  }
-  if (!isLoopbackHostname(hostUrl.hostname) && !isTrustedAuthority(hostUrl, trustedHosts)) {
-    return { statusCode: 403, code: "error.proto.forbiddenHost", error: "forbidden host" };
-  }
-  if (req.headers["sec-fetch-site"] === "cross-site") {
-    return { statusCode: 403, code: "error.proto.forbiddenHost", error: "forbidden host" };
-  }
-  const origin = req.headers.origin;
-  if (typeof origin === "string") {
+function validateMutationRequest(req) {
+  const marker = req.headers.get(CLIENT_MARKER_HEADER) || req.headers.get("x-michengai-client");
+  if (marker !== "1") return { statusCode: 403, code: "error.proto.forbidden", error: "forbidden mutation request" };
+  const origin = req.headers.get("origin");
+  if (origin) {
     try {
-      if (new URL(origin).host !== hostUrl.host) {
-        return { statusCode: 403, code: "error.proto.forbiddenHost", error: "forbidden host" };
+      const originHost = new URL(origin).host;
+      const reqHost = req.headers.get("host") || new URL(req.url).host;
+      if (originHost !== reqHost) {
+        return { statusCode: 403, code: "error.proto.forbidden", error: "forbidden cross-origin mutation request" };
       }
     } catch {
-      return { statusCode: 403, code: "error.proto.forbiddenHost", error: "forbidden host" };
+      return { statusCode: 403, code: "error.proto.forbidden", error: "forbidden origin" };
     }
   }
-  return null;
-}
-function validateMutationRequest(req, trustedHosts) {
-  const hostError = validateRequestOrigin(req, trustedHosts);
-  if (hostError) return hostError;
-  if (req.headers[CLIENT_MARKER_HEADER] !== "1") return { statusCode: 403, code: "error.proto.forbidden", error: "forbidden mutation request" };
-  const contentType = String(req.headers["content-type"] || "").split(";", 1)[0].trim().toLowerCase();
+  const contentType = String(req.headers.get("content-type") || "").split(";", 1)[0].trim().toLowerCase();
   if (contentType !== "application/json") return { statusCode: 415, code: "error.proto.contentType", error: "content-type must be application/json" };
   return null;
 }
+function jsonResponse(code, payload, headOnly = false) {
+  const body = JSON.stringify(payload);
+  return new Response(headOnly ? null : body, {
+    status: code,
+    headers: {
+      "content-type": "application/json; charset=utf-8",
+      "cache-control": "no-store",
+      "content-length": String(Buffer.byteLength(body))
+    }
+  });
+}
+async function runFetch(task, afterSuccess, headOnly = false) {
+  try {
+    const r = await task();
+    if (r && typeof r === "object" && "ok" in r && r.ok === false) {
+      return jsonResponse(400, r, headOnly);
+    }
+    if (afterSuccess) {
+      try {
+        afterSuccess();
+      } catch {
+      }
+    }
+    return jsonResponse(200, { ok: true, data: r }, headOnly);
+  } catch (caught) {
+    const e = caught;
+    const status = Number.isInteger(e && e.statusCode) ? e.statusCode : 500;
+    return jsonResponse(status, {
+      ok: false,
+      ...e && typeof e.code === "string" ? { code: e.code } : {},
+      ...e && e.params && typeof e.params === "object" && !Array.isArray(e.params) ? { params: e.params } : {},
+      error: String(e && e.message ? e.message : e)
+    }, headOnly);
+  }
+}
 function json(res, code, payload, headOnly = false) {
   if (!res || res.writableEnded || res.destroyed) return;
   res.once("error", () => {
@@ -176,28 +149,6 @@ function json(res, code, payload, headOnly = false) {
   } catch {
   }
 }
-function run(res, task, afterSuccess, headOnly = false) {
-  return Promise.resolve().then(task).then((r) => {
-    if (r && typeof r === "object" && "ok" in r && r.ok === false) json(res, 400, r, headOnly);
-    else {
-      try {
-        if (afterSuccess) afterSuccess();
-      } catch {
-      }
-      json(res, 200, { ok: true, data: r }, headOnly);
-    }
-  }).catch((e) => {
-    try {
-      json(res, Number.isInteger(e && e.statusCode) ? e.statusCode : 500, {
-        ok: false,
-        ...e && typeof e.code === "string" ? { code: e.code } : {},
-        ...e && e.params && typeof e.params === "object" && !Array.isArray(e.params) ? { params: e.params } : {},
-        error: String(e && e.message ? e.message : e)
-      }, headOnly);
-    } catch {
-    }
-  });
-}
 function notifyChatCatalog(ctx, invalidateSkills) {
   try {
     if (typeof invalidateSkills === "function") invalidateSkills();
@@ -299,18 +250,6 @@ function apply(ctx, config) {
   }), "skills-manager: plugin updater");
   const log = makeLog();
   const repositories = createRepositoryManager({ log, registeredWorkspaces: () => registeredWorkspacePaths(ctx) });
-  const getTrustedHosts = () => {
-    try {
-      const rawCtx = ctx;
-      const root = rawCtx.root || rawCtx;
-      const candidate = root.webRuntime || root.webStartup;
-      if (candidate && typeof candidate === "object" && Array.isArray(candidate.trustedHosts)) {
-        return candidate.trustedHosts;
-      }
-    } catch {
-    }
-    return [];
-  };
   const findUserRoot = (key) => userRoots().find((root) => root.key === key);
   const providerInvalidators = /* @__PURE__ */ new Set();
   const invalidateSkills = () => {
@@ -359,252 +298,459 @@ function apply(ctx, config) {
       return next();
     });
   }
-  ctx.effect(() => ctx.webServer.register({
-    kind: "prefix",
-    path: "/api/michengai/dsh-skills-manager",
-    handler: async (req, res) => {
-      const u = new URL(req.url, "http://localhost");
-      const path = u.pathname.replace(/\/+$/, "");
-      const sessionId = req.headers["x-dsh-skills-session"];
-      const projectOptions = () => ({ projectCwds: activeSessionCwds(ctx, sessionId) });
-      const workspaceTarget = async (body) => {
-        if (body.workspace === void 0) return null;
-        return resolveWorkspaceTarget(body.workspace, registeredWorkspacePaths(ctx));
-      };
-      const workspaceScope = async (body) => {
-        const target = await workspaceTarget(body);
-        if (!target) return null;
-        if ("ok" in target && target.ok === false) return target;
-        return { projectCwds: target.root.workspaceCwds ?? [] };
-      };
-      const scopedOptions = (scope) => scope ?? projectOptions();
-      const requestRoot = async (key, cwds) => cwds ? (await projectRoots(cwds)).find((root) => root.key === key) : findUserRoot(key) || (await projectRoots(projectOptions().projectCwds)).find((root) => root.key === key);
-      const withScope = async (body, action) => {
-        const scope = await workspaceScope(body);
-        if (scope && "ok" in scope && scope.ok === false) return scope;
-        return action(scope);
-      };
-      const attachSources = async (snapshot) => {
-        try {
-          const sources = await repositories.sources();
-          for (const root of snapshot.roots) {
-            const realRoot = await realpath(root.path).catch(() => root.path);
-            for (const skill of root.skills || []) skill.installSource = sources[installationSourceKey(realRoot, skill.name)] ?? null;
-          }
-        } catch (caught) {
-          const error = caught;
-          snapshot.warnings.push({ code: "error.repo.state", error: error.message });
-        }
-        return snapshot;
-      };
-      const stateWithSources = async () => attachSources(await state(projectOptions()));
-      try {
-        const hostError = validateRequestOrigin(req, getTrustedHosts());
-        if (hostError) {
-          json(res, hostError.statusCode, { ok: false, code: hostError.code, error: hostError.error });
-          return;
+  const API_PREFIX = "/api/michengai/dsh-skills-manager";
+  const projectOptions = (sessionId) => ({ projectCwds: activeSessionCwds(ctx, sessionId ?? void 0) });
+  const workspaceTarget = async (body) => {
+    if (body.workspace === void 0) return null;
+    return resolveWorkspaceTarget(body.workspace, registeredWorkspacePaths(ctx));
+  };
+  const workspaceScope = async (body) => {
+    const target = await workspaceTarget(body);
+    if (!target) return null;
+    if ("ok" in target && target.ok === false) return target;
+    return { projectCwds: target.root.workspaceCwds ?? [] };
+  };
+  const scopedOptions = (scope, sessionId) => scope ?? projectOptions(sessionId);
+  const requestRoot = async (key, cwds, sessionId) => cwds ? (await projectRoots(cwds)).find((root) => root.key === key) : findUserRoot(key) || (await projectRoots(projectOptions(sessionId).projectCwds)).find((root) => root.key === key);
+  const attachSources = async (snapshot) => {
+    try {
+      const sources = await repositories.sources();
+      for (const root of snapshot.roots) {
+        const realRoot = await realpath(root.path).catch(() => root.path);
+        for (const skill of root.skills || []) skill.installSource = sources[installationSourceKey(realRoot, skill.name)] ?? null;
+      }
+    } catch (caught) {
+      const error = caught;
+      snapshot.warnings.push({ code: "error.repo.state", error: error.message });
+    }
+    return snapshot;
+  };
+  const stateWithSources = async (req) => attachSources(await state(projectOptions(req.headers.get("x-dsh-skills-session"))));
+  const handlePost = async (req, action, options) => {
+    const mutationError = validateMutationRequest(req);
+    if (mutationError) {
+      return jsonResponse(mutationError.statusCode, { ok: false, code: mutationError.code, error: mutationError.error });
+    }
+    let body;
+    try {
+      body = await readJsonBody(req, options?.maxBytes);
+    } catch (caught) {
+      const e = caught;
+      return jsonResponse(Number.isInteger(e && e.statusCode) ? e.statusCode : 400, {
+        ok: false,
+        code: e && typeof e.code === "string" ? e.code : "error.proto.invalidJson",
+        error: String(e && e.message ? e.message : e)
+      });
+    }
+    if (options?.isRepo && (!body || typeof body !== "object" || Array.isArray(body))) {
+      return jsonResponse(400, { ok: false, code: "error.repo.invalid", error: "\u4ED3\u5E93\u53C2\u6570\u5FC5\u987B\u662F\u5BF9\u8C61" });
+    }
+    const execute = async () => {
+      const scope = await workspaceScope(body);
+      if (scope && "ok" in scope && scope.ok === false) return scope;
+      return action(body, scope);
+    };
+    const afterSuccess = options?.afterSuccess ? () => options.afterSuccess(body) : void 0;
+    return runFetch(() => options?.queued !== false ? enqueueMutation(execute) : execute(), afterSuccess);
+  };
+  const routes = [
+    {
+      path: `${API_PREFIX}/state`,
+      methods: ["GET", "HEAD"],
+      fetch: (req) => runFetch(() => stateWithSources(req), void 0, req.method === "HEAD")
+    },
+    {
+      path: `${API_PREFIX}/sidebar-entry`,
+      methods: ["GET", "HEAD", "POST"],
+      fetch: (req) => {
+        if (req.method === "GET" || req.method === "HEAD") {
+          return runFetch(async () => ({ enabled: await getSidebarEntry() }), void 0, req.method === "HEAD");
         }
-        if (req.method === "GET" && path === "/api/michengai/dsh-skills-manager/state") {
-          return run(res, stateWithSources);
+        return handlePost(req, async (b) => {
+          if (!b || typeof b.enabled !== "boolean") {
+            throw Object.assign(new Error("enabled \u5FC5\u987B\u662F\u5E03\u5C14\u503C"), { statusCode: 400, code: "error.proto.invalidParams" });
+          }
+          const enabled = await setSidebarEntry(b.enabled);
+          return { enabled };
+        });
+      }
+    },
+    {
+      path: `${API_PREFIX}/online-update`,
+      methods: ["GET", "HEAD", "POST"],
+      fetch: (req) => {
+        if (req.method === "GET" || req.method === "HEAD") {
+          return runFetch(async () => ({ enabled: await isUpdateEnabled(), locked: hostDisabled }), void 0, req.method === "HEAD");
         }
-        if (req.method === "GET" && path === "/api/michengai/dsh-skills-manager/sidebar-entry") {
-          return run(res, async () => ({ enabled: await getSidebarEntry() }));
+        return handlePost(req, async (b) => {
+          if (!b || typeof b.enabled !== "boolean") {
+            throw Object.assign(new Error("enabled \u5FC5\u987B\u662F\u5E03\u5C14\u503C"), { statusCode: 400, code: "error.proto.invalidParams" });
+          }
+          if (hostDisabled) {
+            throw Object.assign(new Error("\u5728\u7EBF\u66F4\u65B0\u5DF2\u88AB\u5BBF\u4E3B\u914D\u7F6E\u9501\u5B9A\u7981\u7528"), { statusCode: 403, code: "error.update.disabled" });
+          }
+          const enabled = await setOnlineUpdate(b.enabled);
+          return { enabled };
+        });
+      }
+    },
+    {
+      path: `${API_PREFIX}/workspaces`,
+      methods: ["GET", "HEAD"],
+      fetch: (req) => runFetch(async () => ({ items: await listWorkspaces(registeredWorkspacePaths(ctx) ?? []) }), void 0, req.method === "HEAD")
+    },
+    {
+      path: `${API_PREFIX}/repositories`,
+      methods: ["GET", "HEAD"],
+      fetch: (req) => runFetch(() => enqueueMutation(() => repositories.list()), void 0, req.method === "HEAD")
+    },
+    {
+      path: `${API_PREFIX}/clawhub/list`,
+      methods: ["GET"],
+      fetch: (req) => {
+        const u = new URL(req.url);
+        const allowed = ["limit", "cursor", "sort"];
+        if ([...u.searchParams.keys()].some((key) => !allowed.includes(key) || u.searchParams.getAll(key).length !== 1)) {
+          return Promise.resolve(jsonResponse(400, { ok: false, code: "error.catalog.query", error: "\u76EE\u5F55\u67E5\u8BE2\u53C2\u6570\u65E0\u6548" }));
         }
-        if (req.method === "GET" && path === "/api/michengai/dsh-skills-manager/online-update") {
-          return run(res, async () => ({ enabled: await isUpdateEnabled(), locked: hostDisabled }));
+        const parameter = (key) => u.searchParams.get(key) ?? void 0;
+        return runFetch(() => listClawHub({ limit: parameter("limit"), sort: parameter("sort"), cursor: parameter("cursor") }));
+      }
+    },
+    {
+      path: `${API_PREFIX}/clawhub/search`,
+      methods: ["GET"],
+      fetch: (req) => {
+        const u = new URL(req.url);
+        const allowed = ["q", "limit"];
+        if ([...u.searchParams.keys()].some((key) => !allowed.includes(key) || u.searchParams.getAll(key).length !== 1) || !u.searchParams.has("q")) {
+          return Promise.resolve(jsonResponse(400, { ok: false, code: "error.catalog.query", error: "\u76EE\u5F55\u67E5\u8BE2\u53C2\u6570\u65E0\u6548" }));
         }
-        if ((req.method === "GET" || req.method === "HEAD") && path === "/api/michengai/dsh-skills-manager/workspaces") {
-          return run(res, async () => ({ items: await listWorkspaces(registeredWorkspacePaths(ctx) ?? []) }), void 0, req.method === "HEAD");
+        const parameter = (key) => u.searchParams.get(key) ?? void 0;
+        return runFetch(() => searchClawHub(parameter("q"), { limit: parameter("limit") }));
+      }
+    },
+    {
+      path: `${API_PREFIX}/skills-sh/search`,
+      methods: ["GET"],
+      fetch: (req) => {
+        const u = new URL(req.url);
+        const queries = u.searchParams.getAll("q");
+        if (queries.length !== 1) {
+          return Promise.resolve(jsonResponse(400, { ok: false, code: "error.catalog.query", error: "\u641C\u7D22\u8BCD\u4E0D\u80FD\u4E3A\u7A7A\u4E14\u4E0D\u80FD\u8D85\u8FC7 100 \u4E2A\u5B57\u7B26" }));
         }
-        if ((req.method === "GET" || req.method === "HEAD") && path === "/api/michengai/dsh-skills-manager/repositories") {
-          return run(res, () => enqueueMutation(() => repositories.list()), void 0, req.method === "HEAD");
+        return runFetch(() => searchSkillsSh(queries[0]));
+      }
+    },
+    {
+      path: `${API_PREFIX}/browse`,
+      methods: ["POST"],
+      fetch: (req) => handlePost(req, (b) => browseDirectories(b.path), { queued: false })
+    },
+    {
+      path: `${API_PREFIX}/repositories/refresh`,
+      methods: ["POST"],
+      fetch: (req) => handlePost(req, (b) => repositories.refresh(b), { queued: false, isRepo: true })
+    },
+    {
+      path: `${API_PREFIX}/catalog/detail`,
+      methods: ["POST"],
+      fetch: (req) => handlePost(req, (b) => readCatalogSkill(b), { queued: false })
+    },
+    {
+      path: `${API_PREFIX}/catalog/install`,
+      methods: ["POST"],
+      fetch: (req) => handlePost(req, async (b) => {
+        if (b.root !== void 0 && b.root !== "dsh" && b.root !== "agents") throw Object.assign(new Error("\u6280\u80FD\u5B89\u88C5\u4F4D\u7F6E\u65E0\u6548"), { statusCode: 400, code: "error.repo.invalid" });
+        if (b.workspace !== void 0 && b.root !== void 0 && b.root !== "dsh") throw Object.assign(new Error("\u5DE5\u4F5C\u533A\u53EA\u80FD\u5B89\u88C5\u5230\u9879\u76EE DSH skills"), { statusCode: 400, code: "error.repo.invalid" });
+        const target = await workspaceTarget(b);
+        if (target && "ok" in target && target.ok === false) return target;
+        const pack = await loadCatalogPackage(b);
+        const catalogId = b.catalog === "skillsh" ? `skillsh:${b.source}/${b.skillId}` : `clawhub:${b.owner}/${b.slug}`;
+        return enqueueMutation(() => repositories.installCatalog(catalogId, pack, { root: b.root, ...b.workspace === void 0 ? {} : { workspace: b.workspace } }));
+      }, { queued: false, afterSuccess: afterWrite })
+    },
+    {
+      path: `${API_PREFIX}/repositories/add`,
+      methods: ["POST"],
+      fetch: (req) => handlePost(req, (b) => repositories.add(b), { isRepo: true })
+    },
+    {
+      path: `${API_PREFIX}/repositories/remove`,
+      methods: ["POST"],
+      fetch: (req) => handlePost(req, (b) => repositories.remove(b), { isRepo: true })
+    },
+    {
+      path: `${API_PREFIX}/repositories/detail`,
+      methods: ["POST"],
+      fetch: (req) => handlePost(req, (b) => repositories.detail(b), { isRepo: true })
+    },
+    {
+      path: `${API_PREFIX}/repositories/install`,
+      methods: ["POST"],
+      fetch: (req) => handlePost(req, (b) => repositories.install(b, registeredWorkspacePaths(ctx)), { isRepo: true, afterSuccess: afterWrite })
+    },
+    {
+      path: `${API_PREFIX}/repositories/uninstall`,
+      methods: ["POST"],
+      fetch: (req) => handlePost(req, (b) => repositories.uninstall(b), { isRepo: true, afterSuccess: afterWrite })
+    },
+    {
+      path: `${API_PREFIX}/repositories/preview`,
+      methods: ["POST"],
+      fetch: (req) => handlePost(req, (b) => repositories.preview(b), { isRepo: true })
+    },
+    {
+      path: `${API_PREFIX}/repositories/update`,
+      methods: ["POST"],
+      fetch: (req) => handlePost(req, (b) => repositories.update(b), { isRepo: true, afterSuccess: afterWrite })
+    },
+    {
+      path: `${API_PREFIX}/repositories/rollback`,
+      methods: ["POST"],
+      fetch: (req) => handlePost(req, (b) => repositories.rollback(b), { isRepo: true, afterSuccess: afterWrite })
+    },
+    {
+      path: `${API_PREFIX}/workspace-skills`,
+      methods: ["POST"],
+      fetch: (req) => handlePost(req, async (b) => {
+        const snapshot = await workspaceSkills(b.workspace, registeredWorkspacePaths(ctx));
+        return "roots" in snapshot ? attachSources(snapshot) : snapshot;
+      })
+    },
+    {
+      path: `${API_PREFIX}/enable`,
+      methods: ["POST"],
+      fetch: (req) => handlePost(req, async (b, scope) => setSkillEnabled(await requestRoot(String(b.root || "dsh"), scope?.projectCwds, req.headers.get("x-dsh-skills-session")), String(b.name || ""), true, log), { afterSuccess: afterWrite })
+    },
+    {
+      path: `${API_PREFIX}/disable`,
+      methods: ["POST"],
+      fetch: (req) => handlePost(req, async (b, scope) => setSkillEnabled(await requestRoot(String(b.root || "dsh"), scope?.projectCwds, req.headers.get("x-dsh-skills-session")), String(b.name || ""), false, log), { afterSuccess: afterWrite })
+    },
+    {
+      path: `${API_PREFIX}/source-enable`,
+      methods: ["POST"],
+      fetch: (req) => handlePost(req, (b, scope) => setSourceEnabled(String(b.root || ""), true, log, scopedOptions(scope, req.headers.get("x-dsh-skills-session"))), { afterSuccess: afterWrite })
+    },
+    {
+      path: `${API_PREFIX}/source-disable`,
+      methods: ["POST"],
+      fetch: (req) => handlePost(req, (b, scope) => setSourceEnabled(String(b.root || ""), false, log, scopedOptions(scope, req.headers.get("x-dsh-skills-session"))), { afterSuccess: afterWrite })
+    },
+    {
+      path: `${API_PREFIX}/root-path`,
+      methods: ["POST"],
+      fetch: (req) => handlePost(req, (b) => setRootPath(String(b.key || ""), b.path === void 0 ? null : b.path), { afterSuccess: afterWrite })
+    },
+    {
+      path: `${API_PREFIX}/custom-source-add`,
+      methods: ["POST"],
+      fetch: (req) => handlePost(req, (b) => addCustomSources(Array.isArray(b.sources) ? b.sources : b), { afterSuccess: afterWrite })
+    },
+    {
+      path: `${API_PREFIX}/custom-source-update`,
+      methods: ["POST"],
+      fetch: (req) => handlePost(req, (b) => updateCustomSource(String(b.id || ""), b), { afterSuccess: afterWrite })
+    },
+    {
+      path: `${API_PREFIX}/custom-source-remove`,
+      methods: ["POST"],
+      fetch: (req) => handlePost(req, (b) => removeCustomSource(String(b.id || "")), { afterSuccess: afterWrite })
+    },
+    {
+      path: `${API_PREFIX}/custom-source-scan`,
+      methods: ["POST"],
+      fetch: (req) => handlePost(req, (b) => scanCustomSourceCandidates(b.path))
+    },
+    {
+      path: `${API_PREFIX}/category-create`,
+      methods: ["POST"],
+      fetch: (req) => handlePost(req, (b, scope) => createCategory(String(b.root || ""), String(b.name || ""), log, scopedOptions(scope, req.headers.get("x-dsh-skills-session"))))
+    },
+    {
+      path: `${API_PREFIX}/category-rename`,
+      methods: ["POST"],
+      fetch: (req) => handlePost(req, (b, scope) => renameCategory(String(b.root || ""), String(b.id || ""), String(b.name || ""), log, scopedOptions(scope, req.headers.get("x-dsh-skills-session"))))
+    },
+    {
+      path: `${API_PREFIX}/category-delete`,
+      methods: ["POST"],
+      fetch: (req) => handlePost(req, (b, scope) => deleteCategory(String(b.root || ""), String(b.id || ""), log, scopedOptions(scope, req.headers.get("x-dsh-skills-session"))))
+    },
+    {
+      path: `${API_PREFIX}/category-assign`,
+      methods: ["POST"],
+      fetch: (req) => handlePost(req, (b, scope) => assignSkillCategory(String(b.root || ""), String(b.name || ""), String(b.category || ""), log, scopedOptions(scope, req.headers.get("x-dsh-skills-session"))))
+    },
+    {
+      path: `${API_PREFIX}/category-move`,
+      methods: ["POST"],
+      fetch: (req) => handlePost(req, (b, scope) => moveSkillInCategory(String(b.root || ""), String(b.name || ""), String(b.category || ""), b.targetName ? String(b.targetName) : void 0, b.position === void 0 ? "before" : String(b.position), log, scopedOptions(scope, req.headers.get("x-dsh-skills-session"))))
+    },
+    {
+      path: `${API_PREFIX}/category-enable`,
+      methods: ["POST"],
+      fetch: (req) => handlePost(req, (b, scope) => setCategoryEnabled(String(b.root || ""), String(b.category || ""), true, log, scopedOptions(scope, req.headers.get("x-dsh-skills-session"))), { afterSuccess: afterWrite })
+    },
+    {
+      path: `${API_PREFIX}/category-disable`,
+      methods: ["POST"],
+      fetch: (req) => handlePost(req, (b, scope) => setCategoryEnabled(String(b.root || ""), String(b.category || ""), false, log, scopedOptions(scope, req.headers.get("x-dsh-skills-session"))), { afterSuccess: afterWrite })
+    },
+    {
+      path: `${API_PREFIX}/delete`,
+      methods: ["POST"],
+      fetch: (req) => handlePost(req, async (b, scope) => {
+        const target = await workspaceTarget(b);
+        if (target && "ok" in target && target.ok === false) return target;
+        const root = target ? target.root : await requestRoot(String(b.root || "dsh"), scope?.projectCwds, req.headers.get("x-dsh-skills-session"));
+        return repositories.trashSkill(root, String(b.name || ""));
+      }, { afterSuccess: afterWrite })
+    },
+    {
+      path: `${API_PREFIX}/trash-restore`,
+      methods: ["POST"],
+      fetch: (req) => handlePost(req, (b, scope) => repositories.restoreTrash(String(b.id || ""), { ...scope ?? {}, registeredWorkspaces: registeredWorkspacePaths(ctx) }), { afterSuccess: afterWrite })
+    },
+    {
+      path: `${API_PREFIX}/trash-delete`,
+      methods: ["POST"],
+      fetch: (req) => handlePost(req, (b) => repositories.permanentlyDeleteTrash(String(b.id || "")))
+    },
+    {
+      path: `${API_PREFIX}/detail`,
+      methods: ["POST"],
+      fetch: (req) => handlePost(req, (b, scope) => skillDetail(String(b.root || "dsh"), String(b.name || ""), scope ? { ...scope, workspaceBound: true } : projectOptions(req.headers.get("x-dsh-skills-session"))))
+    },
+    {
+      path: `${API_PREFIX}/create`,
+      methods: ["POST"],
+      fetch: (req) => handlePost(req, async (b) => {
+        const target = await workspaceTarget(b);
+        if (target && "ok" in target && target.ok === false) return target;
+        return createSkill(
+          { name: b.name, description: b.description, body: b.body },
+          log,
+          { root: target ? target.root : await requestRoot(String(b.root || "dsh"), void 0, req.headers.get("x-dsh-skills-session")) }
+        );
+      }, { afterSuccess: afterWrite })
+    },
+    {
+      path: `${API_PREFIX}/import`,
+      methods: ["POST"],
+      fetch: (req) => handlePost(req, async (b) => {
+        const target = await workspaceTarget(b);
+        if (target && "ok" in target && target.ok === false) return target;
+        return importSkill(String(b.source || ""), log, {
+          conflict: b.conflict === "overwrite" ? "overwrite" : "skip",
+          dryRun: b.dryRun === true,
+          ...target ? { root: target.root } : b.root === "agents" ? { root: await requestRoot("agents", void 0, req.headers.get("x-dsh-skills-session")) } : {}
+        });
+      }, { afterSuccess: (b) => {
+        if (b.dryRun !== true) afterWrite();
+      } })
+    },
+    {
+      path: `${API_PREFIX}/upload`,
+      methods: ["POST"],
+      fetch: (req) => handlePost(req, async (b) => {
+        const target = await workspaceTarget(b);
+        if (target && "ok" in target && target.ok === false) return target;
+        return importUploadedSkill({ name: b.name, entries: b.entries, zip: b.zip }, log, {
+          conflict: b.conflict === "overwrite" ? "overwrite" : "skip",
+          ...target ? { root: target.root } : b.root === "agents" ? { root: await requestRoot("agents", void 0, req.headers.get("x-dsh-skills-session")) } : {}
+        });
+      }, { afterSuccess: afterWrite, maxBytes: MAX_UPLOAD_BODY_BYTES })
+    }
+  ];
+  ctx.effect(() => {
+    if (ctx.connection?.fetch?.register) {
+      const disposers = routes.map(
+        (route) => ctx.connection.fetch.register({
+          path: route.path,
+          methods: route.methods,
+          requestBody: route.requestBody ?? "buffered",
+          fetch: route.fetch
+        })
+      );
+      return () => {
+        for (const disposer of disposers) {
+          try {
+            disposer();
+          } catch {
+          }
         }
-        if (req.method === "GET" && (path === "/api/michengai/dsh-skills-manager/clawhub/list" || path === "/api/michengai/dsh-skills-manager/clawhub/search")) {
-          const searching = path.endsWith("/search");
-          const allowed = searching ? ["q", "limit"] : ["limit", "cursor", "sort"];
-          if ([...u.searchParams.keys()].some((key) => !allowed.includes(key) || u.searchParams.getAll(key).length !== 1) || searching && !u.searchParams.has("q")) {
-            json(res, 400, { ok: false, code: "error.catalog.query", error: "\u76EE\u5F55\u67E5\u8BE2\u53C2\u6570\u65E0\u6548" });
+      };
+    }
+    let webServer;
+    try {
+      webServer = ctx.webServer;
+    } catch {
+    }
+    if (webServer?.register) {
+      const routeMap = /* @__PURE__ */ new Map();
+      for (const r of routes) routeMap.set(r.path, r);
+      return webServer.register({
+        kind: "prefix",
+        path: API_PREFIX,
+        handler: async (req, res) => {
+          const u = new URL(req.url, "http://localhost");
+          const path = u.pathname.replace(/\/+$/, "");
+          const route = routeMap.get(path);
+          if (!route) {
+            json(res, 404, { ok: false, code: "error.proto.unknownAction", error: `unknown action: ${path}` });
             return;
           }
-          const parameter = (key) => u.searchParams.get(key) ?? void 0;
-          return run(res, () => searching ? searchClawHub(parameter("q"), { limit: parameter("limit") }) : listClawHub({ limit: parameter("limit"), sort: parameter("sort"), cursor: parameter("cursor") }));
-        }
-        if (req.method === "GET" && path === "/api/michengai/dsh-skills-manager/skills-sh/search") {
-          const queries = u.searchParams.getAll("q");
-          if (queries.length !== 1) {
-            json(res, 400, { ok: false, code: "error.catalog.query", error: "\u641C\u7D22\u8BCD\u4E0D\u80FD\u4E3A\u7A7A\u4E14\u4E0D\u80FD\u8D85\u8FC7 100 \u4E2A\u5B57\u7B26" });
+          if (!route.methods.includes(req.method)) {
+            json(res, 405, { ok: false, code: "error.proto.method", error: `method not allowed: ${req.method}` });
             return;
           }
-          return run(res, () => searchSkillsSh(queries[0]));
-        }
-        if (req.method === "HEAD") {
-          if (path === "/api/michengai/dsh-skills-manager/state") return run(res, stateWithSources, void 0, true);
-          if (path === "/api/michengai/dsh-skills-manager/sidebar-entry") return run(res, async () => ({ enabled: await getSidebarEntry() }), void 0, true);
-          if (path === "/api/michengai/dsh-skills-manager/online-update") return run(res, async () => ({ enabled: await isUpdateEnabled(), locked: hostDisabled }), void 0, true);
-          json(res, 405, { ok: false, code: "error.proto.method", error: `method not allowed: ${req.method}` }, true);
-          return;
-        }
-        if (req.method !== "POST") {
-          json(res, 405, { ok: false, code: "error.proto.method", error: `method not allowed: ${req.method}` });
-          return;
-        }
-        const requestError = validateMutationRequest(req, getTrustedHosts());
-        if (requestError) {
-          json(res, requestError.statusCode, { ok: false, code: requestError.code, error: requestError.error });
-          return;
-        }
-        const body = await readBody(req, path === "/api/michengai/dsh-skills-manager/upload" ? MAX_UPLOAD_BODY_BYTES : void 0);
-        if (path.startsWith("/api/michengai/dsh-skills-manager/repositories/") && (!body || typeof body !== "object" || Array.isArray(body))) {
-          json(res, 400, { ok: false, code: "error.repo.invalid", error: "\u4ED3\u5E93\u53C2\u6570\u5FC5\u987B\u662F\u5BF9\u8C61" });
-          return;
-        }
-        if (path === "/api/michengai/dsh-skills-manager/browse") {
-          return run(res, () => browseDirectories(body.path));
-        }
-        if (path === "/api/michengai/dsh-skills-manager/repositories/refresh") return run(res, () => repositories.refresh(body));
-        if (path === "/api/michengai/dsh-skills-manager/catalog/detail") return run(res, () => readCatalogSkill(body));
-        if (path === "/api/michengai/dsh-skills-manager/catalog/install") {
-          return run(res, async () => {
-            if (body.root !== void 0 && body.root !== "dsh" && body.root !== "agents") throw Object.assign(new Error("\u6280\u80FD\u5B89\u88C5\u4F4D\u7F6E\u65E0\u6548"), { statusCode: 400, code: "error.repo.invalid" });
-            if (body.workspace !== void 0 && body.root !== void 0 && body.root !== "dsh") throw Object.assign(new Error("\u5DE5\u4F5C\u533A\u53EA\u80FD\u5B89\u88C5\u5230\u9879\u76EE DSH skills"), { statusCode: 400, code: "error.repo.invalid" });
-            const target = await workspaceTarget(body);
-            if (target && "ok" in target && target.ok === false) return target;
-            const pack = await loadCatalogPackage(body);
-            const catalogId = body.catalog === "skillsh" ? `skillsh:${body.source}/${body.skillId}` : `clawhub:${body.owner}/${body.slug}`;
-            return enqueueMutation(() => repositories.installCatalog(catalogId, pack, { root: body.root, ...body.workspace === void 0 ? {} : { workspace: body.workspace } }));
-          }, afterWrite);
-        }
-        return enqueueMutation(() => {
-          switch (path) {
-            case "/api/michengai/dsh-skills-manager/sidebar-entry":
-              return run(res, async () => {
-                if (!body || typeof body.enabled !== "boolean") {
-                  throw Object.assign(new Error("enabled \u5FC5\u987B\u662F\u5E03\u5C14\u503C"), { statusCode: 400, code: "error.proto.invalidParams" });
-                }
-                const enabled = await setSidebarEntry(body.enabled);
-                return { enabled };
-              });
-            case "/api/michengai/dsh-skills-manager/online-update":
-              return run(res, async () => {
-                if (!body || typeof body.enabled !== "boolean") {
-                  throw Object.assign(new Error("enabled \u5FC5\u987B\u662F\u5E03\u5C14\u503C"), { statusCode: 400, code: "error.proto.invalidParams" });
-                }
-                if (hostDisabled) {
-                  throw Object.assign(new Error("\u5728\u7EBF\u66F4\u65B0\u5DF2\u88AB\u5BBF\u4E3B\u914D\u7F6E\u9501\u5B9A\u7981\u7528"), { statusCode: 403, code: "error.update.disabled" });
-                }
-                const enabled = await setOnlineUpdate(body.enabled);
-                return { enabled };
-              });
-            case "/api/michengai/dsh-skills-manager/repositories/add":
-              return run(res, () => repositories.add(body));
-            case "/api/michengai/dsh-skills-manager/repositories/remove":
-              return run(res, () => repositories.remove(body));
-            case "/api/michengai/dsh-skills-manager/repositories/detail":
-              return run(res, () => repositories.detail(body));
-            case "/api/michengai/dsh-skills-manager/repositories/install":
-              return run(res, () => repositories.install(body, registeredWorkspacePaths(ctx)), afterWrite);
-            case "/api/michengai/dsh-skills-manager/repositories/uninstall":
-              return run(res, () => repositories.uninstall(body), afterWrite);
-            case "/api/michengai/dsh-skills-manager/repositories/preview":
-              return run(res, () => repositories.preview(body));
-            case "/api/michengai/dsh-skills-manager/repositories/update":
-              return run(res, () => repositories.update(body), afterWrite);
-            case "/api/michengai/dsh-skills-manager/repositories/rollback":
-              return run(res, () => repositories.rollback(body), afterWrite);
-            case "/api/michengai/dsh-skills-manager/workspace-skills":
-              return run(res, async () => {
-                const snapshot = await workspaceSkills(body.workspace, registeredWorkspacePaths(ctx));
-                return "roots" in snapshot ? attachSources(snapshot) : snapshot;
+          const headers = new Headers();
+          for (const [k, v] of Object.entries(req.headers)) {
+            if (v !== void 0) {
+              if (Array.isArray(v)) for (const item of v) headers.append(k, item);
+              else headers.set(k, v);
+            }
+          }
+          try {
+            let bodyBuffer = null;
+            if (req.method !== "GET" && req.method !== "HEAD") {
+              bodyBuffer = await new Promise((resolve, reject) => {
+                const chunks = [];
+                req.on("data", (c) => chunks.push(c));
+                req.on("end", () => resolve(Buffer.concat(chunks)));
+                req.on("error", reject);
               });
-            case "/api/michengai/dsh-skills-manager/enable":
-              return run(res, () => withScope(body, async (scope) => setSkillEnabled(await requestRoot(String(body.root || "dsh"), scope?.projectCwds), String(body.name || ""), true, log)), afterWrite);
-            case "/api/michengai/dsh-skills-manager/disable":
-              return run(res, () => withScope(body, async (scope) => setSkillEnabled(await requestRoot(String(body.root || "dsh"), scope?.projectCwds), String(body.name || ""), false, log)), afterWrite);
-            case "/api/michengai/dsh-skills-manager/source-enable":
-              return run(res, () => withScope(body, (scope) => setSourceEnabled(String(body.root || ""), true, log, scopedOptions(scope))), afterWrite);
-            case "/api/michengai/dsh-skills-manager/source-disable":
-              return run(res, () => withScope(body, (scope) => setSourceEnabled(String(body.root || ""), false, log, scopedOptions(scope))), afterWrite);
-            case "/api/michengai/dsh-skills-manager/root-path":
-              return run(res, () => setRootPath(String(body.key || ""), body.path === void 0 ? null : body.path), afterWrite);
-            case "/api/michengai/dsh-skills-manager/custom-source-add":
-              return run(res, () => addCustomSources(Array.isArray(body.sources) ? body.sources : body), afterWrite);
-            case "/api/michengai/dsh-skills-manager/custom-source-update":
-              return run(res, () => updateCustomSource(String(body.id || ""), body), afterWrite);
-            case "/api/michengai/dsh-skills-manager/custom-source-remove":
-              return run(res, () => removeCustomSource(String(body.id || "")), afterWrite);
-            case "/api/michengai/dsh-skills-manager/custom-source-scan":
-              return run(res, () => scanCustomSourceCandidates(body.path));
-            case "/api/michengai/dsh-skills-manager/category-create":
-              return run(res, () => withScope(body, (scope) => createCategory(String(body.root || ""), String(body.name || ""), log, scopedOptions(scope))));
-            case "/api/michengai/dsh-skills-manager/category-rename":
-              return run(res, () => withScope(body, (scope) => renameCategory(String(body.root || ""), String(body.id || ""), String(body.name || ""), log, scopedOptions(scope))));
-            case "/api/michengai/dsh-skills-manager/category-delete":
-              return run(res, () => withScope(body, (scope) => deleteCategory(String(body.root || ""), String(body.id || ""), log, scopedOptions(scope))));
-            case "/api/michengai/dsh-skills-manager/category-assign":
-              return run(res, () => withScope(body, (scope) => assignSkillCategory(String(body.root || ""), String(body.name || ""), String(body.category || ""), log, scopedOptions(scope))));
-            case "/api/michengai/dsh-skills-manager/category-move":
-              return run(res, () => withScope(body, (scope) => moveSkillInCategory(String(body.root || ""), String(body.name || ""), String(body.category || ""), body.targetName ? String(body.targetName) : void 0, body.position === void 0 ? "before" : String(body.position), log, scopedOptions(scope))));
-            case "/api/michengai/dsh-skills-manager/category-enable":
-              return run(res, () => withScope(body, (scope) => setCategoryEnabled(String(body.root || ""), String(body.category || ""), true, log, scopedOptions(scope))), afterWrite);
-            case "/api/michengai/dsh-skills-manager/category-disable":
-              return run(res, () => withScope(body, (scope) => setCategoryEnabled(String(body.root || ""), String(body.category || ""), false, log, scopedOptions(scope))), afterWrite);
-            case "/api/michengai/dsh-skills-manager/delete":
-              return run(res, () => withScope(body, async (scope) => {
-                const target = await workspaceTarget(body);
-                if (target && "ok" in target && target.ok === false) return target;
-                const root = target ? target.root : await requestRoot(String(body.root || "dsh"), scope?.projectCwds);
-                return repositories.trashSkill(root, String(body.name || ""));
-              }), afterWrite);
-            case "/api/michengai/dsh-skills-manager/trash-restore":
-              return run(res, () => withScope(body, (scope) => repositories.restoreTrash(String(body.id || ""), { ...scope ?? {}, registeredWorkspaces: registeredWorkspacePaths(ctx) })), afterWrite);
-            case "/api/michengai/dsh-skills-manager/trash-delete":
-              return run(res, () => repositories.permanentlyDeleteTrash(String(body.id || "")));
-            case "/api/michengai/dsh-skills-manager/detail":
-              return run(res, () => withScope(body, (scope) => skillDetail(String(body.root || "dsh"), String(body.name || ""), scope ? { ...scope, workspaceBound: true } : projectOptions())));
-            case "/api/michengai/dsh-skills-manager/create":
-              return run(res, async () => {
-                const target = await workspaceTarget(body);
-                if (target && "ok" in target && target.ok === false) return target;
-                return createSkill(
-                  { name: body.name, description: body.description, body: body.body },
-                  log,
-                  { root: target ? target.root : await requestRoot(String(body.root || "dsh")) }
-                );
-              }, afterWrite);
-            case "/api/michengai/dsh-skills-manager/import":
-              return run(res, async () => {
-                const target = await workspaceTarget(body);
-                if (target && "ok" in target && target.ok === false) return target;
-                return importSkill(String(body.source || ""), log, {
-                  conflict: body.conflict === "overwrite" ? "overwrite" : "skip",
-                  dryRun: body.dryRun === true,
-                  ...target ? { root: target.root } : body.root === "agents" ? { root: await requestRoot("agents") } : {}
-                });
-              }, body.dryRun === true ? void 0 : afterWrite);
-            case "/api/michengai/dsh-skills-manager/upload":
-              return run(res, async () => {
-                const target = await workspaceTarget(body);
-                if (target && "ok" in target && target.ok === false) return target;
-                return importUploadedSkill({ name: body.name, entries: body.entries, zip: body.zip }, log, {
-                  conflict: body.conflict === "overwrite" ? "overwrite" : "skip",
-                  ...target ? { root: target.root } : body.root === "agents" ? { root: await requestRoot("agents") } : {}
-                });
-              }, afterWrite);
-            default:
-              json(res, 404, { ok: false, code: "error.proto.unknownAction", error: `unknown action: ${path}` });
+            }
+            const fetchReq = new Request(u.toString(), {
+              method: req.method,
+              headers,
+              body: bodyBuffer && bodyBuffer.length > 0 ? new Uint8Array(bodyBuffer) : void 0
+            });
+            const response = await route.fetch(fetchReq);
+            res.writeHead(response.status, Object.fromEntries(response.headers.entries()));
+            if (req.method === "HEAD") {
+              res.end();
+              return;
+            }
+            const responseBuf = Buffer.from(await response.arrayBuffer());
+            res.end(responseBuf);
+          } catch (caught) {
+            const e = caught;
+            json(res, Number.isInteger(e && e.statusCode) ? e.statusCode : 500, {
+              ok: false,
+              ...e && typeof e.code === "string" ? { code: e.code } : {},
+              ...e && e.params && typeof e.params === "object" && !Array.isArray(e.params) ? { params: e.params } : {},
+              error: String(e && e.message ? e.message : e)
+            });
           }
-        });
-      } catch (caught) {
-        const e = caught;
-        json(res, Number.isInteger(e && e.statusCode) ? e.statusCode : 500, {
-          ok: false,
-          ...e && typeof e.code === "string" ? { code: e.code } : {},
-          ...e && e.params && typeof e.params === "object" && !Array.isArray(e.params) ? { params: e.params } : {},
-          error: String(e && e.message ? e.message : e)
-        });
-      }
+        }
+      });
     }
-  }), "skills-manager: API route");
+    return () => {
+    };
+  }, "skills-manager: API routes");
 }
 export {
   activeSessionCwds,