@morehao/dsh-skills-console 0.0.0 → 0.2.0

package/lib/core/state.js

@@ -0,0 +1,149 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+export const STATE_VERSION = 1;
+
+export function emptyState() {
+  return {
+    version: STATE_VERSION,
+    settings: { autoLinkTargets: null, placement: 'settings' },
+    agents: { custom: [], dismissed: [] },
+    subscriptions: [],
+    installs: [],
+    links: [],
+    checks: {},
+  };
+}
+
+function isPlainObject(value) {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+/**
+ * 状态读写。写入规则：全量读 → 校验 → 临时文件 → rename。
+ * 损坏时**只读降级**，绝不 fail-open：宁可只读，也不要拿坏状态去覆盖链接。
+ */
+export class StateStore {
+  constructor(paths, logger = () => {}) {
+    this.paths = paths;
+    this.logger = logger;
+    this.readOnly = false;
+    this.problem = null;
+    this.state = emptyState();
+  }
+
+  load() {
+    const file = this.paths.stateFile;
+    let raw;
+    try {
+      raw = fs.readFileSync(file, 'utf8');
+    } catch (error) {
+      if (error && error.code === 'ENOENT') {
+        this.state = emptyState();
+        this.readOnly = false;
+        this.problem = null;
+        return this.state;
+      }
+      this.readOnly = true;
+      this.problem = `state unreadable: ${error.message}`;
+      return this.state;
+    }
+
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch (error) {
+      this.readOnly = true;
+      this.problem = `state not JSON: ${error.message}`;
+      this.logger('state.corrupt', { reason: this.problem });
+      return this.state;
+    }
+
+    const verdict = validateState(parsed);
+    if (!verdict.ok) {
+      this.readOnly = true;
+      this.problem = verdict.reason;
+      this.logger('state.corrupt', { reason: verdict.reason });
+      return this.state;
+    }
+
+    this.state = verdict.state;
+    this.readOnly = false;
+    this.problem = null;
+    return this.state;
+  }
+
+  save(next) {
+    if (this.readOnly) throw new StateReadOnlyError(this.problem);
+    const state = { ...next, version: STATE_VERSION };
+    fs.mkdirSync(this.paths.stateDir, { recursive: true });
+    const tmp = path.join(this.paths.stateDir, `.state.${process.pid}.${Date.now()}.tmp`);
+    fs.writeFileSync(tmp, `${JSON.stringify(state, null, 2)}\n`, 'utf8');
+    fs.renameSync(tmp, this.paths.stateFile);
+    this.state = state;
+    return state;
+  }
+
+  /** 便捷读改写：mutator 直接改传入对象，返回值写回。 */
+  update(mutator) {
+    const draft = structuredClone(this.state);
+    const result = mutator(draft);
+    const next = result && typeof result === 'object' && result.version ? result : draft;
+    return this.save(next);
+  }
+
+  get installs() {
+    return this.state.installs;
+  }
+
+  findInstall(name) {
+    return this.state.installs.find((item) => item.name === name);
+  }
+}
+
+export class StateReadOnlyError extends Error {
+  constructor(problem) {
+    super(problem || 'state is read-only');
+    this.code = 'error.skills.state-readonly';
+    this.problem = problem;
+  }
+}
+
+export function validateState(value) {
+  if (!isPlainObject(value)) return { ok: false, reason: 'state is not an object' };
+  if (typeof value.version !== 'number' || !Number.isInteger(value.version)) {
+    return { ok: false, reason: 'state.version missing' };
+  }
+  if (value.version > STATE_VERSION) {
+    return { ok: false, reason: `state.version ${value.version} newer than ${STATE_VERSION}` };
+  }
+  if (value.version < 1) return { ok: false, reason: `state.version ${value.version} invalid` };
+
+  const state = { ...emptyState(), ...value };
+  for (const key of ['subscriptions', 'installs', 'links']) {
+    if (!Array.isArray(state[key])) return { ok: false, reason: `state.${key} is not an array` };
+  }
+  if (!isPlainObject(state.settings)) return { ok: false, reason: 'state.settings is not an object' };
+  if (!isPlainObject(state.agents)) return { ok: false, reason: 'state.agents is not an object' };
+  if (!isPlainObject(state.checks)) state.checks = {};
+  if (!Array.isArray(state.agents.custom)) state.agents.custom = [];
+  if (!Array.isArray(state.agents.dismissed)) state.agents.dismissed = [];
+  // v1 的老状态只有布尔 autoLinkAgents：true 表示"所有探测到的 Agent"（null），false 表示一个都不选。
+  const settings = state.settings;
+  if (settings.autoLinkTargets === undefined) {
+    settings.autoLinkTargets = settings.autoLinkAgents === false ? [] : null;
+  }
+  if (settings.autoLinkTargets !== null && !Array.isArray(settings.autoLinkTargets)) {
+    settings.autoLinkTargets = null;
+  }
+  if (Array.isArray(settings.autoLinkTargets)) {
+    settings.autoLinkTargets = settings.autoLinkTargets.filter(
+      (item) => typeof item === 'string' && item.startsWith('agent:'),
+    );
+  }
+  delete settings.autoLinkAgents;
+  // 入口位置：settings = 设置页分区（默认），sidebar = 左侧栏独立面板。
+  if (settings.placement !== 'sidebar') settings.placement = 'settings';
+  state.version = STATE_VERSION;
+  return { ok: true, state };
+}

package/lib/core/trash.js

@@ -0,0 +1,142 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+
+const KEEP_GENERATIONS = 5;
+const MAX_BYTES = 200 * 1024 * 1024;
+
+function dirSize(dir) {
+  let total = 0;
+  let entries;
+  try {
+    entries = fs.readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return 0;
+  }
+  for (const entry of entries) {
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) total += dirSize(full);
+    else if (entry.isFile()) {
+      try {
+        total += fs.statSync(full).size;
+      } catch {
+        /* 忽略统计失败 */
+      }
+    }
+  }
+  return total;
+}
+
+function copyTree(from, to) {
+  fs.mkdirSync(path.dirname(to), { recursive: true });
+  fs.cpSync(from, to, { recursive: true, dereference: false, preserveTimestamps: true });
+}
+
+export function newKey(skill) {
+  const stamp = new Date().toISOString().replace(/[:.]/g, '-');
+  const rand = crypto.randomBytes(3).toString('hex');
+  return `${skill}-${stamp}-${rand}`;
+}
+
+/**
+ * 备份落 `skills-console/backups/<key>/`，**绝不进 `skills/`**：
+ * 任何含 `SKILL.md` 的子目录都会被原生当成技能扫到（F13）。
+ */
+export function createBackup({ paths, skill, fromDir, hash = null }) {
+  const key = newKey(skill);
+  const target = path.join(paths.backupsDir, key);
+  copyTree(fromDir, path.join(target, 'content'));
+  const meta = { key, skill, hash, from: fromDir, createdAt: new Date().toISOString() };
+  fs.writeFileSync(path.join(target, 'meta.json'), `${JSON.stringify(meta, null, 2)}\n`, 'utf8');
+  pruneBackups({ paths });
+  return { key, dir: target, ...meta };
+}
+
+export function readBackup({ paths, key }) {
+  const dir = path.join(paths.backupsDir, key);
+  const metaPath = path.join(dir, 'meta.json');
+  if (!fs.existsSync(metaPath)) return null;
+  const meta = JSON.parse(fs.readFileSync(metaPath, 'utf8'));
+  return { ...meta, dir, contentDir: path.join(dir, 'content') };
+}
+
+export function listBackups({ paths }) {
+  let entries;
+  try {
+    entries = fs.readdirSync(paths.backupsDir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  return entries
+    .filter((entry) => entry.isDirectory())
+    .map((entry) => readBackup({ paths, key: entry.name }))
+    .filter(Boolean)
+    .sort((a, b) => String(b.createdAt).localeCompare(String(a.createdAt)));
+}
+
+/** 保留最近 N 代 + 总量上限，超出按最旧清理。 */
+export function pruneBackups({ paths, keep = KEEP_GENERATIONS, maxBytes = MAX_BYTES }) {
+  const backups = listBackups({ paths });
+  let total = backups.reduce((sum, item) => sum + dirSize(item.dir), 0);
+  backups.forEach((item, index) => {
+    const tooMany = index >= keep;
+    const tooBig = total > maxBytes;
+    if (!tooMany && !tooBig) return;
+    const size = dirSize(item.dir);
+    fs.rmSync(item.dir, { recursive: true, force: true });
+    total -= size;
+  });
+}
+
+/** 回收站：删除前的快照，保留 7 天。 */
+export function trashSkill({ paths, skill, fromDir, hash = null }) {
+  const key = newKey(skill);
+  const target = path.join(paths.trashDir, key);
+  copyTree(fromDir, path.join(target, 'content'));
+  const meta = {
+    key,
+    skill,
+    hash,
+    from: fromDir,
+    createdAt: new Date().toISOString(),
+    expiresAt: new Date(Date.now() + 7 * 24 * 3600 * 1000).toISOString(),
+  };
+  fs.writeFileSync(path.join(target, 'meta.json'), `${JSON.stringify(meta, null, 2)}\n`, 'utf8');
+  return { key, dir: target, ...meta };
+}
+
+export function listTrash({ paths }) {
+  let entries;
+  try {
+    entries = fs.readdirSync(paths.trashDir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const now = Date.now();
+  return entries
+    .filter((entry) => entry.isDirectory())
+    .map((entry) => {
+      const metaPath = path.join(paths.trashDir, entry.name, 'meta.json');
+      if (!fs.existsSync(metaPath)) return null;
+      try {
+        const meta = JSON.parse(fs.readFileSync(metaPath, 'utf8'));
+        return { ...meta, dir: path.join(paths.trashDir, entry.name), expired: Date.parse(meta.expiresAt) < now };
+      } catch {
+        return null;
+      }
+    })
+    .filter(Boolean);
+}
+
+export function pruneTrash({ paths }) {
+  for (const item of listTrash({ paths })) {
+    if (item.expired) fs.rmSync(item.dir, { recursive: true, force: true });
+  }
+}
+
+/** 把备份内容换回 canonical（先删再拷，保持原子性由调用方的 add/校验兜底）。 */
+export function restoreBackup({ backup, toDir }) {
+  fs.rmSync(toDir, { recursive: true, force: true });
+  copyTree(backup.contentDir, toDir);
+  return { restored: true, toDir };
+}

package/lib/core/updates.js

@@ -0,0 +1,138 @@
+import crypto from 'node:crypto';
+
+const API = 'https://api.github.com';
+
+/** `owner/repo`、`https://github.com/owner/repo(.git)`、`git@github.com:owner/repo.git` 都能认。 */
+export function parseSource(source) {
+  if (!source || typeof source !== 'string') return null;
+  const trimmed = source.trim();
+  const short = trimmed.match(/^([\w.-]+)\/([\w.-]+)$/);
+  if (short) return { owner: short[1], repo: short[2].replace(/\.git$/, ''), kind: 'short' };
+  const url = trimmed.match(/github\.com[/:]([\w.-]+)\/([\w.-]+?)(?:\.git)?(?:[/#?].*)?$/);
+  if (url) return { owner: url[1], repo: url[2], kind: 'url' };
+  return null;
+}
+
+export function snapshotId({ source, ref, subpath }) {
+  return crypto
+    .createHash('sha256')
+    .update(`${source}\n${ref || ''}\n${subpath || ''}`)
+    .digest('hex')
+    .slice(0, 16);
+}
+
+export function githubToken(env = process.env) {
+  return env.GITHUB_TOKEN || env.GH_TOKEN || null;
+}
+
+async function callJson(url, { token, etag, fetchImpl = fetch } = {}) {
+  const headers = {
+    accept: 'application/vnd.github+json',
+    'user-agent': 'dsh-skills-console',
+    'x-github-api-version': '2022-11-28',
+  };
+  if (token) headers.authorization = `Bearer ${token}`;
+  if (etag) headers['if-none-match'] = etag;
+  const response = await fetchImpl(url, { headers });
+  if (response.status === 304) return { status: 304, notModified: true, etag };
+  if (!response.ok) {
+    const text = await response.text().catch(() => '');
+    return { status: response.status, error: `HTTP ${response.status} ${text.slice(0, 200)}` };
+  }
+  const body = await response.json();
+  return { status: response.status, body, etag: response.headers.get('etag') };
+}
+
+/**
+ * 一次 Trees 请求取整树（F8）。`ref` 可以是分支 / tag / commit —— Trees API 两种都收。
+ * ETag 是**整响应级**，缓存键是 `(repo, ref, commit)`；304 时只能复用上次数据，绝不把 entries 置空。
+ */
+export async function fetchTree({ source, ref = 'main', etag, token, fetchImpl } = {}) {
+  const parsed = parseSource(source);
+  if (!parsed) return { error: 'invalid-source' };
+  const url = `${API}/repos/${parsed.owner}/${parsed.repo}/git/trees/${encodeURIComponent(ref)}?recursive=1`;
+  const result = await callJson(url, { token, etag, fetchImpl });
+  if (result.notModified) return { notModified: true, etag: result.etag };
+  if (result.error) return { error: result.error, status: result.status };
+  const tree = Array.isArray(result.body?.tree) ? result.body.tree : [];
+  return {
+    tree,
+    rootSha: result.body?.sha || null,
+    truncated: Boolean(result.body?.truncated),
+    etag: result.etag,
+    repo: `${parsed.owner}/${parsed.repo}`,
+  };
+}
+
+/** 解析 ref 对应的 commit（只在安装/计划时需要，检测阶段不付这笔成本）。 */
+export async function resolveCommit({ source, ref = 'main', token, fetchImpl } = {}) {
+  const parsed = parseSource(source);
+  if (!parsed) return null;
+  const result = await callJson(`${API}/repos/${parsed.owner}/${parsed.repo}/commits/${encodeURIComponent(ref)}`, {
+    token,
+    fetchImpl,
+  });
+  if (result.error || !result.body?.sha) return null;
+  return result.body.sha;
+}
+
+/** `KEY` + `/dir/SKILL.md` → `dir`（F18：`skillPath` 是文件路径，目录运算先 dirname）。 */
+export function skillDir(skillPath) {
+  const parts = String(skillPath).split('/');
+  parts.pop();
+  return parts.join('/');
+}
+
+export function skillTreeSha({ tree, skillPath, rootSha }) {
+  const dir = skillDir(skillPath);
+  if (!dir) return rootSha;
+  const entry = tree.find((item) => item.type === 'tree' && item.path === dir);
+  return entry ? entry.sha : null;
+}
+
+/**
+ * 快照 = 仓库里所有 `SKILL.md` 的目录条目。
+ * 名字取目录名；根级 `SKILL.md` 用仓库名（读不到 frontmatter，名字只能是近似值，装完以 canonical 为准）。
+ */
+export function listSkillsFromTree({ tree, rootSha, subpath, repoName }) {
+  const prefix = subpath ? `${subpath.replace(/\/+$/, '')}/` : '';
+  const byName = new Map();
+  for (const entry of tree) {
+    if (entry.type !== 'blob') continue;
+    if (entry.path !== 'SKILL.md' && !entry.path.endsWith('/SKILL.md')) continue;
+    if (prefix && !entry.path.startsWith(prefix)) continue;
+    const dir = skillDir(entry.path);
+    const name = dir ? dir.split('/').pop() : repoName || 'root';
+    if (byName.has(name)) continue;
+    byName.set(name, {
+      name,
+      skillPath: entry.path,
+      treeSha: skillTreeSha({ tree, skillPath: entry.path, rootSha }),
+    });
+  }
+  return [...byName.values()].sort((a, b) => a.name.localeCompare(b.name));
+}
+
+/**
+ * 单技能判定（L2/L3）。哈希形态必须配对（F19）：
+ * `sourceType=github` 时 lock 里应是 40 位 tree SHA；64 位内容哈希说明来源形态不对，直接给 `unknown`。
+ */
+export function checkSkill({ lockHash, snapshotEntry, tree, rootSha }) {
+  if (!snapshotEntry) return { status: 'upstream-deleted', detail: '上游整树里已找不到这个 skillPath' };
+  if (!lockHash) return { status: 'unknown', detail: 'lock 里没有 skillFolderHash' };
+  if (!/^[0-9a-f]{40}$/.test(lockHash)) {
+    return {
+      status: 'unknown',
+      detail: 'lock 的哈希不是 40 位 tree SHA（形态不配对），无法按 tree 比对',
+    };
+  }
+  const target = skillTreeSha({ tree, skillPath: snapshotEntry.skillPath, rootSha });
+  if (!target) return { status: 'unknown', detail: '整树里找不到该目录的 tree 条目' };
+  if (target === lockHash) return { status: 'current', detail: '与安装时的 tree SHA 一致' };
+  return { status: 'update-available', detail: 'tree SHA 已变化', targetTreeSha: target };
+}
+
+/** 计划 → 应用的防换手 token：磁盘或上游在"计划"之后被改动就拒绝（设计 §7.4③）。 */
+export function planToken(parts) {
+  return crypto.createHash('sha256').update(JSON.stringify(parts)).digest('hex');
+}

package/lib/index.js

@@ -0,0 +1,77 @@
+import { createCli } from './core/cli.js';
+import { createLogger } from './core/log.js';
+import { createPaths } from './core/paths.js';
+import { createRegistry } from './core/agents.js';
+import { createService } from './core/service.js';
+import { StateStore } from './core/state.js';
+import { createRoutes, ROUTE_PREFIX } from './routes.js';
+
+/** cordis 插件 id：必须等于 `cordis.patch.yml` 的 `insert[0].id`（设计 §15.2）。 */
+export const name = 'dsh-skills-console';
+
+/** 硬依赖只有 HTTP 载体；skills 注册表按可选服务取（缺失时不影响清单与链接）。 */
+export const inject = ['webServer'];
+
+export function apply(ctx, config = {}) {
+  const env = process.env;
+  const paths = createPaths(env, config.stateDir ? { stateDir: config.stateDir } : {});
+  const logger = createLogger(paths.logFile);
+
+  const store = new StateStore(paths, logger);
+  store.load();
+  if (store.readOnly) logger('state.readonly', { problem: store.problem });
+
+  const registry = createRegistry({ paths, getState: () => store.state });
+  const cli = createCli({ env, logger });
+
+  const visibleProvider = async (cwd) => {
+    const skills = ctx.get('skills');
+    if (!skills) return { skills: [], complete: false };
+    const snapshot = await skills.snapshot({ cwd: cwd || undefined });
+    return {
+      complete: snapshot.complete,
+      skills: snapshot.skills.map((item) => ({
+        name: item.name,
+        description: item.description,
+        source: item.source,
+        provider: item.provider,
+        path: item.path || null,
+        invocation: item.invocation,
+      })),
+    };
+  };
+
+  /**
+   * 「作用范围」里可以直接勾 DSH 工作区，不必每次走系统目录选择器。
+   * 只把目录还在的工作区列出来，避免把链接写进一个已经消失的路径。
+   */
+  const workspacesProvider = async () => {
+    const workspaces = ctx.get('workspaceRegistry');
+    if (!workspaces?.list) return [];
+    const rows = [];
+    for (const workspace of workspaces.list()) {
+      try {
+        if ((await workspace.status()) !== 'ok') continue;
+      } catch {
+        continue;
+      }
+      rows.push({ id: workspace.id, title: workspace.title, path: workspace.path });
+    }
+    return rows;
+  };
+
+  const service = createService({
+    paths,
+    store,
+    registry,
+    cli,
+    logger,
+    env,
+    visibleProvider,
+    workspacesProvider,
+  });
+
+  const handler = createRoutes({ service, logger });
+  ctx.effect(() => ctx.webServer.register({ kind: 'prefix', path: ROUTE_PREFIX, handler }), 'dsh-skills-console:routes');
+  logger('plugin.apply', { stateDir: paths.stateDir, canonical: paths.canonical, readOnly: store.readOnly });
+}

package/lib/routes.js

@@ -0,0 +1,163 @@
+import { ServiceError } from './core/service.js';
+import { StateReadOnlyError } from './core/state.js';
+
+export const ROUTE_PREFIX = '/api/morehao/skills-console';
+const MAX_BODY = 256 * 1024;
+
+function sendJson(res, status, payload) {
+  const body = JSON.stringify(payload);
+  res.writeHead(status, {
+    'content-type': 'application/json; charset=utf-8',
+    'cache-control': 'no-store',
+    'content-length': Buffer.byteLength(body),
+  });
+  res.end(body);
+}
+
+async function readBody(req) {
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of req) {
+    size += chunk.length;
+    if (size > MAX_BODY) {
+      throw new ServiceError('error.skills.body-too-large', 'request body too large');
+    }
+    chunks.push(chunk);
+  }
+  if (chunks.length === 0) return {};
+  try {
+    return JSON.parse(Buffer.concat(chunks).toString('utf8'));
+  } catch {
+    throw new ServiceError('error.skills.bad-json', 'request body is not JSON');
+  }
+}
+
+function matchRoute(method, pathname) {
+  const segments = pathname.split('/').filter(Boolean);
+  // 前缀在 handler 之前已被剥掉：这里拿到的是 /state、/skills/:name 之类
+  if (segments.length === 1 && segments[0] === 'state' && method === 'GET') return { name: 'state' };
+  if (segments.length === 1 && segments[0] === 'agents' && method === 'GET') return { name: 'agents' };
+  if (segments.length === 1 && segments[0] === 'settings' && method === 'POST') return { name: 'settings' };
+  if (segments.length === 1 && segments[0] === 'links' && method === 'POST') return { name: 'links' };
+  if (segments.length === 1 && segments[0] === 'install' && method === 'POST') return { name: 'install' };
+  if (segments.length === 1 && segments[0] === 'diagnostics' && method === 'GET') return { name: 'diagnostics' };
+
+  if (segments[0] === 'skills' && segments.length === 2 && method === 'GET') {
+    return { name: 'skill.body', params: { name: decodeURIComponent(segments[1]) } };
+  }
+  if (segments[0] === 'skills' && segments.length === 3 && segments[2] === 'adopt' && method === 'POST') {
+    return { name: 'skill.adopt', params: { name: decodeURIComponent(segments[1]) } };
+  }
+  if (segments[0] === 'skills' && segments.length === 3 && segments[2] === 'mode' && method === 'POST') {
+    return { name: 'skill.mode', params: { name: decodeURIComponent(segments[1]) } };
+  }
+  if (segments[0] === 'skills' && segments.length === 2 && method === 'DELETE') {
+    return { name: 'skill.remove', params: { name: decodeURIComponent(segments[1]) } };
+  }
+
+  if (segments[0] === 'subscriptions') {
+    if (segments.length === 1 && method === 'POST') return { name: 'subscriptions.add' };
+    if (segments.length === 2 && method === 'DELETE') {
+      return { name: 'subscriptions.remove', params: { id: decodeURIComponent(segments[1]) } };
+    }
+    if (segments.length === 3 && segments[2] === 'refresh' && method === 'POST') {
+      return { name: 'subscriptions.refresh', params: { id: decodeURIComponent(segments[1]) } };
+    }
+  }
+
+  if (segments[0] === 'updates') {
+    if (segments.length === 2 && segments[1] === 'check' && method === 'POST') return { name: 'updates.check' };
+    if (segments.length === 2 && segments[1] === 'plan' && method === 'POST') return { name: 'updates.plan' };
+    if (segments.length === 2 && segments[1] === 'apply' && method === 'POST') return { name: 'updates.apply' };
+    if (segments.length === 2 && segments[1] === 'rollback' && method === 'POST') return { name: 'updates.rollback' };
+  }
+
+  return null;
+}
+
+export function createRoutes({ service, logger }) {
+  return async function handler(req, res) {
+    const url = new URL(req.url || '/', 'http://127.0.0.1');
+    const pathname = url.pathname.startsWith(ROUTE_PREFIX)
+      ? url.pathname.slice(ROUTE_PREFIX.length) || '/'
+      : url.pathname;
+    const method = (req.method || 'GET').toUpperCase();
+
+    // 只认自己的页面：一律要求自定义头。跨源请求带自定义头会先触发预检，等于顺带挡住 CSRF。
+    if (req.headers['x-dsh-skills-console'] !== '1') {
+      sendJson(res, 403, { ok: false, code: 'error.skills.forbidden', message: 'missing x-dsh-skills-console header' });
+      return;
+    }
+
+    const route = matchRoute(method, pathname);
+    if (!route) {
+      sendJson(res, 404, { ok: false, code: 'error.skills.no-route', message: `${method} ${pathname}` });
+      return;
+    }
+
+    try {
+      service.reloadState();
+      const body = method === 'GET' ? {} : await readBody(req);
+      const query = Object.fromEntries(url.searchParams.entries());
+      const result = await dispatch(route, { body, query, service });
+      sendJson(res, 200, result);
+    } catch (error) {
+      if (error instanceof StateReadOnlyError) {
+        sendJson(res, 409, {
+          ok: false,
+          code: 'error.skills.state-readonly',
+          message: '状态文件损坏，插件处于只读模式',
+          detail: error.problem || null,
+        });
+        return;
+      }
+      if (error instanceof ServiceError) {
+        sendJson(res, 400, { ok: false, code: error.code, message: error.message, detail: error.detail ?? null });
+        return;
+      }
+      logger('route.error', { message: error?.message, stack: String(error?.stack || '').slice(0, 800) });
+      sendJson(res, 500, { ok: false, code: 'error.skills.internal', message: error?.message || 'internal error' });
+    }
+  };
+}
+
+async function dispatch(route, { body, query, service }) {
+  switch (route.name) {
+    case 'state':
+      return service.getState({ cwd: query.cwd || body.cwd, workspace: query.workspace });
+    case 'agents':
+      return { ok: true, all: service.registry.all(), detected: service.registry.detected() };
+    case 'settings':
+      return service.setSettings(body);
+    case 'links':
+      return service.setLinks(body);
+    case 'install':
+      return service.install(body);
+    case 'diagnostics':
+      return service.diagnostics();
+    case 'skill.body':
+      return service.listSkillBody({ name: route.params.name });
+    case 'skill.adopt':
+      return service.adopt({ name: route.params.name });
+    case 'skill.mode':
+      return service.setMode({ name: route.params.name, mode: body.mode });
+    case 'skill.remove':
+      return service.remove({ name: route.params.name });
+    case 'subscriptions.add':
+      return service.addSubscription(body);
+    case 'subscriptions.remove':
+      return service.removeSubscription({ id: route.params.id, keepInstalled: body.keepInstalled !== false });
+    case 'subscriptions.refresh':
+      return service.refreshSubscription({ id: route.params.id, force: Boolean(body.force) });
+    case 'updates.check':
+      return service.checkUpdates(body);
+    case 'updates.plan':
+      return service.planUpdate({ name: body.name });
+    case 'updates.apply':
+      return service.applyUpdate({ name: body.name, token: body.token, overwrite: Boolean(body.overwrite) });
+    case 'updates.rollback':
+      return service.rollback({ name: body.name });
+    default:
+      throw new ServiceError('error.skills.no-route', `unhandled route ${route.name}`);
+  }
+}

package/locale/en.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "Skills Console",
+    "description": "Install, update, remove, link and enable local agent skills. Skill bodies stay owned by the skills CLI."
+  }
+}

package/locale/zh.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "技能控制台",
+    "description": "安装、更新、删除、接入与启停本机 Agent 技能；技能正文始终由 skills CLI 写入。"
+  }
+}