@myclaw163/clawclaw-cli 0.6.71 → 0.6.74

package/src/lib/hub-client.ts

@@ -1,88 +1,88 @@
-// src/lib/hub-client.ts
-import { AuthStore } from './auth.js';
-import { ServerRegistry } from './server-registry.js';
-import { HttpTransport } from './http-transport.js';
-
-export type ResourceType = 'skill' | 'strategy';
-
-export interface ResourceStats { downloadCount: number; starCount: number; commentCount: number; }
-
-export interface ResourceSummary {
-  id: string;
-  type: ResourceType;
-  title: string;
-  description: string;
-  creator: string;
-  creatorType: string;
-  creatorDisplayName: string;
-  creatorAvatarUrl: string | null;
-  fileName: string;
-  stats: ResourceStats;
-  downloadUrl: string;
-  likedByMe: boolean;
-  createdAt: string;
-  updatedAt: string;
-}
-
-export interface ResourceDetail extends ResourceSummary {
-  artifact: { fileName: string; downloadUrl: string };
-}
-
-export interface Pagination { mode: 'page' | 'none'; page?: number; limit?: number; hasMore: boolean; }
-export interface ResourceListResult { items: ResourceSummary[]; total: number; pagination: Pagination; }
-
-export interface ListOptions {
-  type?: ResourceType;
-  q?: string;
-  sort?: 'latest' | 'downloads' | 'stars';
-  pagination?: 'page' | 'none';
-  page?: number;
-  limit?: number;
-}
-
-const BASE = '/api/client/v1';
-const DEFAULT_HUB_URL = 'https://myclaw.163.com/hub';
-
-/** Parse a `<type>/<id>` resource ref (type ∈ skill|strategy). */
-export function parseResourceRef(ref: string): { type: ResourceType; id: string } {
-  const m = ref.match(/^(skill|strategy)\/([^/\s]+)$/);
-  if (!m) throw new Error(`invalid resource ref '${ref}' (expected <skill|strategy>/<id>)`);
-  return { type: m[1] as ResourceType, id: m[2] };
-}
-
-interface Envelope<T> { data: T; }
-
-export class HubClient {
-  constructor(private readonly http: HttpTransport) {}
-
-  static fromAuth(opts?: { authStore?: AuthStore }): HubClient {
-    const store = opts?.authStore ?? new AuthStore();
-    const profile = store.getActive();
-    const apiKey = profile?.apiKey ?? '';
-    const hubUrl = process.env.CLAWCLAW_HUB_URL || DEFAULT_HUB_URL;
-    const registry = new ServerRegistry({ lobbyUrl: hubUrl });
-    return new HubClient(new HttpTransport(apiKey, registry, { 'X-Hub-Auth-Type': 'clawkey' }));
-  }
-
-  async list(opts: ListOptions = {}): Promise<ResourceListResult> {
-    const qs = new URLSearchParams();
-    if (opts.type) qs.set('type', opts.type);
-    if (opts.q) qs.set('q', opts.q);
-    if (opts.sort) qs.set('sort', opts.sort);
-    if (opts.pagination) qs.set('pagination', opts.pagination);
-    if (opts.page !== undefined) qs.set('page', String(opts.page));
-    if (opts.limit !== undefined) qs.set('limit', String(opts.limit));
-    const suffix = qs.toString() ? `?${qs.toString()}` : '';
-    const res = await this.http.get<Envelope<ResourceListResult>>(`${BASE}/resources${suffix}`);
-    return res.data;
-  }
-
-  async getResource(type: ResourceType, id: string): Promise<ResourceDetail> {
-    const res = await this.http.get<Envelope<ResourceDetail>>(`${BASE}/resources/${type}/${encodeURIComponent(id)}`);
-    return res.data;
-  }
-
-  async downloadArtifact(type: ResourceType, id: string): Promise<Buffer> {
-    return this.http.getBytes(`${BASE}/resources/${type}/${encodeURIComponent(id)}/download`);
-  }
-}
+// src/lib/hub-client.ts
+import { AuthStore } from './auth.js';
+import { ServerRegistry } from './server-registry.js';
+import { HttpTransport } from './http-transport.js';
+
+export type ResourceType = 'skill' | 'strategy';
+
+export interface ResourceStats { downloadCount: number; starCount: number; commentCount: number; }
+
+export interface ResourceSummary {
+  id: string;
+  type: ResourceType;
+  title: string;
+  description: string;
+  creator: string;
+  creatorType: string;
+  creatorDisplayName: string;
+  creatorAvatarUrl: string | null;
+  fileName: string;
+  stats: ResourceStats;
+  downloadUrl: string;
+  likedByMe: boolean;
+  createdAt: string;
+  updatedAt: string;
+}
+
+export interface ResourceDetail extends ResourceSummary {
+  artifact: { fileName: string; downloadUrl: string };
+}
+
+export interface Pagination { mode: 'page' | 'none'; page?: number; limit?: number; hasMore: boolean; }
+export interface ResourceListResult { items: ResourceSummary[]; total: number; pagination: Pagination; }
+
+export interface ListOptions {
+  type?: ResourceType;
+  q?: string;
+  sort?: 'latest' | 'downloads' | 'stars';
+  pagination?: 'page' | 'none';
+  page?: number;
+  limit?: number;
+}
+
+const BASE = '/api/client/v1';
+const DEFAULT_HUB_URL = 'https://myclaw.163.com/hub';
+
+/** Parse a `<type>/<id>` resource ref (type ∈ skill|strategy). */
+export function parseResourceRef(ref: string): { type: ResourceType; id: string } {
+  const m = ref.match(/^(skill|strategy)\/([^/\s]+)$/);
+  if (!m) throw new Error(`invalid resource ref '${ref}' (expected <skill|strategy>/<id>)`);
+  return { type: m[1] as ResourceType, id: m[2] };
+}
+
+interface Envelope<T> { data: T; }
+
+export class HubClient {
+  constructor(private readonly http: HttpTransport) {}
+
+  static fromAuth(opts?: { authStore?: AuthStore }): HubClient {
+    const store = opts?.authStore ?? new AuthStore();
+    const profile = store.getActive();
+    const apiKey = profile?.apiKey ?? '';
+    const hubUrl = process.env.CLAWCLAW_HUB_URL || DEFAULT_HUB_URL;
+    const registry = new ServerRegistry({ lobbyUrl: hubUrl });
+    return new HubClient(new HttpTransport(apiKey, registry, { 'X-Hub-Auth-Type': 'clawkey' }));
+  }
+
+  async list(opts: ListOptions = {}): Promise<ResourceListResult> {
+    const qs = new URLSearchParams();
+    if (opts.type) qs.set('type', opts.type);
+    if (opts.q) qs.set('q', opts.q);
+    if (opts.sort) qs.set('sort', opts.sort);
+    if (opts.pagination) qs.set('pagination', opts.pagination);
+    if (opts.page !== undefined) qs.set('page', String(opts.page));
+    if (opts.limit !== undefined) qs.set('limit', String(opts.limit));
+    const suffix = qs.toString() ? `?${qs.toString()}` : '';
+    const res = await this.http.get<Envelope<ResourceListResult>>(`${BASE}/resources${suffix}`);
+    return res.data;
+  }
+
+  async getResource(type: ResourceType, id: string): Promise<ResourceDetail> {
+    const res = await this.http.get<Envelope<ResourceDetail>>(`${BASE}/resources/${type}/${encodeURIComponent(id)}`);
+    return res.data;
+  }
+
+  async downloadArtifact(type: ResourceType, id: string): Promise<Buffer> {
+    return this.http.getBytes(`${BASE}/resources/${type}/${encodeURIComponent(id)}/download`);
+  }
+}

package/src/lib/hub-install.test.ts

@@ -1,98 +1,98 @@
-import { describe, it, expect, beforeEach, afterEach } from 'vitest';
-import { mkdtempSync, rmSync, existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
-import { tmpdir } from 'os';
-import { join } from 'path';
-import { placementRelPath, slugify, installResource, uninstallResource, listInstalled, readLockfile } from './hub-install.js';
-import type { ResourceDetail } from './hub-client.js';
-
-let ws: string;
-beforeEach(() => { ws = mkdtempSync(join(tmpdir(), 'ccl-ws-')); process.env.CLAWCLAW_WORKSPACE_DIR = ws; });
-afterEach(() => { delete process.env.CLAWCLAW_WORKSPACE_DIR; rmSync(ws, { recursive: true, force: true }); });
-
-function detail(over: Partial<ResourceDetail>): ResourceDetail {
-  return {
-    id: 'ab12', type: 'strategy', title: 'Aggressive Kill', description: 'd',
-    creator: 'alice', creatorType: 'clawkey', creatorDisplayName: 'Alice', creatorAvatarUrl: null,
-    fileName: 'kill.ts', stats: { downloadCount: 0, starCount: 0, commentCount: 0 },
-    downloadUrl: '', likedByMe: false, createdAt: '', updatedAt: '',
-    artifact: { fileName: 'kill.ts', downloadUrl: '' }, ...over,
-  };
-}
-
-function u16(n: number): Buffer { const b = Buffer.alloc(2); b.writeUInt16LE(n); return b; }
-function u32(n: number): Buffer { const b = Buffer.alloc(4); b.writeUInt32LE(n >>> 0); return b; }
-function storeZip(files: Record<string, string>): Buffer {
-  const locals: Buffer[] = [], centrals: Buffer[] = []; let off = 0; const names = Object.keys(files);
-  for (const name of names) {
-    const raw = Buffer.from(files[name], 'utf8'); const nb = Buffer.from(name, 'utf8');
-    const local = Buffer.concat([u32(0x04034b50), u16(20), u16(0), u16(0), u16(0), u16(0), u32(0), u32(raw.length), u32(raw.length), u16(nb.length), u16(0), nb, raw]);
-    const central = Buffer.concat([u32(0x02014b50), u16(20), u16(20), u16(0), u16(0), u16(0), u16(0), u32(0), u32(raw.length), u32(raw.length), u16(nb.length), u16(0), u16(0), u16(0), u16(0), u32(0), u32(off), nb]);
-    locals.push(local); centrals.push(central); off += local.length;
-  }
-  const lp = Buffer.concat(locals), cd = Buffer.concat(centrals);
-  const eocd = Buffer.concat([u32(0x06054b50), u16(0), u16(0), u16(names.length), u16(names.length), u32(cd.length), u32(lp.length), u16(0)]);
-  return Buffer.concat([lp, cd, eocd]);
-}
-
-describe('slugify', () => {
-  it('kebabs a title', () => { expect(slugify('Aggressive Kill!')).toBe('aggressive-kill'); });
-});
-
-describe('placementRelPath', () => {
-  it('strategy → strategies/<slug>__<id>.ts', () => {
-    expect(placementRelPath(detail({})).split('\\').join('/')).toBe('strategies/aggressive-kill__ab12.ts');
-  });
-  it('strategy with non-ASCII title → strategies/<id>.ts', () => {
-    expect(placementRelPath(detail({ title: '就近纯任务' })).split('\\').join('/')).toBe('strategies/ab12.ts');
-  });
-  it('keeps .tsx ext from fileName', () => {
-    expect(placementRelPath(detail({ fileName: 'k.tsx' })).split('\\').join('/')).toBe('strategies/aggressive-kill__ab12.tsx');
-  });
-  it('skill → skills/<slug>', () => {
-    expect(placementRelPath(detail({ type: 'skill', title: 'Cool Helper' })).split('\\').join('/')).toBe('skills/cool-helper');
-  });
-  it('rejects unsafe id', () => {
-    expect(() => placementRelPath(detail({ id: '..' }))).toThrow(/unsafe id/);
-  });
-});
-
-describe('installResource (strategy)', () => {
-  it('writes raw file + lockfile', () => {
-    const res = installResource(detail({}), Buffer.from('export const strategy = {};'));
-    expect(existsSync(res.installedPath)).toBe(true);
-    expect(res.installedPath.split('\\').join('/')).toContain('strategies/aggressive-kill__ab12.ts');
-    expect(readFileSync(res.installedPath, 'utf8')).toBe('export const strategy = {};');
-    expect(readLockfile()['strategy/ab12'].title).toBe('Aggressive Kill');
-  });
-  it('refuses untracked clobber without force', () => {
-    mkdirSync(join(ws, 'strategies'), { recursive: true });
-    writeFileSync(join(ws, 'strategies', 'aggressive-kill__ab12.ts'), 'old');
-    expect(() => installResource(detail({}), Buffer.from('new'))).toThrow(/already exists/);
-    expect(() => installResource(detail({}), Buffer.from('new'), { force: true })).not.toThrow();
-  });
-});
-
-describe('installResource (skill)', () => {
-  it('unzips into skills/<slug>', () => {
-    const zip = storeZip({ 'SKILL.md': '# skill', 'refs/a.md': 'A' });
-    const res = installResource(detail({ id: 'sk1', type: 'skill', title: 'My Skill', fileName: 'pkg.zip' }), zip);
-    expect(res.installedPath.split('\\').join('/')).toContain('skills/my-skill');
-    expect(readFileSync(join(res.installedPath, 'SKILL.md'), 'utf8')).toBe('# skill');
-    expect(readFileSync(join(res.installedPath, 'refs', 'a.md'), 'utf8')).toBe('A');
-  });
-  it('rejects zip path traversal', () => {
-    const zip = storeZip({ '../evil.md': 'x' });
-    expect(() => installResource(detail({ id: 'sk2', type: 'skill', title: 'T' }), zip)).toThrow(/unsafe path/);
-  });
-});
-
-describe('uninstall / list', () => {
-  it('lists then removes', () => {
-    installResource(detail({}), Buffer.from('x'));
-    expect(listInstalled().map(e => `${e.type}/${e.id}`)).toEqual(['strategy/ab12']);
-    const r = uninstallResource('strategy/ab12');
-    expect(r.removed).toBe(true);
-    expect(existsSync(r.path!)).toBe(false);
-    expect(listInstalled()).toEqual([]);
-  });
-});
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { mkdtempSync, rmSync, existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
+import { tmpdir } from 'os';
+import { join } from 'path';
+import { placementRelPath, slugify, installResource, uninstallResource, listInstalled, readLockfile } from './hub-install.js';
+import type { ResourceDetail } from './hub-client.js';
+
+let ws: string;
+beforeEach(() => { ws = mkdtempSync(join(tmpdir(), 'ccl-ws-')); process.env.CLAWCLAW_WORKSPACE_DIR = ws; });
+afterEach(() => { delete process.env.CLAWCLAW_WORKSPACE_DIR; rmSync(ws, { recursive: true, force: true }); });
+
+function detail(over: Partial<ResourceDetail>): ResourceDetail {
+  return {
+    id: 'ab12', type: 'strategy', title: 'Aggressive Kill', description: 'd',
+    creator: 'alice', creatorType: 'clawkey', creatorDisplayName: 'Alice', creatorAvatarUrl: null,
+    fileName: 'kill.ts', stats: { downloadCount: 0, starCount: 0, commentCount: 0 },
+    downloadUrl: '', likedByMe: false, createdAt: '', updatedAt: '',
+    artifact: { fileName: 'kill.ts', downloadUrl: '' }, ...over,
+  };
+}
+
+function u16(n: number): Buffer { const b = Buffer.alloc(2); b.writeUInt16LE(n); return b; }
+function u32(n: number): Buffer { const b = Buffer.alloc(4); b.writeUInt32LE(n >>> 0); return b; }
+function storeZip(files: Record<string, string>): Buffer {
+  const locals: Buffer[] = [], centrals: Buffer[] = []; let off = 0; const names = Object.keys(files);
+  for (const name of names) {
+    const raw = Buffer.from(files[name], 'utf8'); const nb = Buffer.from(name, 'utf8');
+    const local = Buffer.concat([u32(0x04034b50), u16(20), u16(0), u16(0), u16(0), u16(0), u32(0), u32(raw.length), u32(raw.length), u16(nb.length), u16(0), nb, raw]);
+    const central = Buffer.concat([u32(0x02014b50), u16(20), u16(20), u16(0), u16(0), u16(0), u16(0), u32(0), u32(raw.length), u32(raw.length), u16(nb.length), u16(0), u16(0), u16(0), u16(0), u32(0), u32(off), nb]);
+    locals.push(local); centrals.push(central); off += local.length;
+  }
+  const lp = Buffer.concat(locals), cd = Buffer.concat(centrals);
+  const eocd = Buffer.concat([u32(0x06054b50), u16(0), u16(0), u16(names.length), u16(names.length), u32(cd.length), u32(lp.length), u16(0)]);
+  return Buffer.concat([lp, cd, eocd]);
+}
+
+describe('slugify', () => {
+  it('kebabs a title', () => { expect(slugify('Aggressive Kill!')).toBe('aggressive-kill'); });
+});
+
+describe('placementRelPath', () => {
+  it('strategy → strategies/<slug>__<id>.ts', () => {
+    expect(placementRelPath(detail({})).split('\\').join('/')).toBe('strategies/aggressive-kill__ab12.ts');
+  });
+  it('strategy with non-ASCII title → strategies/<id>.ts', () => {
+    expect(placementRelPath(detail({ title: '就近纯任务' })).split('\\').join('/')).toBe('strategies/ab12.ts');
+  });
+  it('keeps .tsx ext from fileName', () => {
+    expect(placementRelPath(detail({ fileName: 'k.tsx' })).split('\\').join('/')).toBe('strategies/aggressive-kill__ab12.tsx');
+  });
+  it('skill → skills/<slug>', () => {
+    expect(placementRelPath(detail({ type: 'skill', title: 'Cool Helper' })).split('\\').join('/')).toBe('skills/cool-helper');
+  });
+  it('rejects unsafe id', () => {
+    expect(() => placementRelPath(detail({ id: '..' }))).toThrow(/unsafe id/);
+  });
+});
+
+describe('installResource (strategy)', () => {
+  it('writes raw file + lockfile', () => {
+    const res = installResource(detail({}), Buffer.from('export const strategy = {};'));
+    expect(existsSync(res.installedPath)).toBe(true);
+    expect(res.installedPath.split('\\').join('/')).toContain('strategies/aggressive-kill__ab12.ts');
+    expect(readFileSync(res.installedPath, 'utf8')).toBe('export const strategy = {};');
+    expect(readLockfile()['strategy/ab12'].title).toBe('Aggressive Kill');
+  });
+  it('refuses untracked clobber without force', () => {
+    mkdirSync(join(ws, 'strategies'), { recursive: true });
+    writeFileSync(join(ws, 'strategies', 'aggressive-kill__ab12.ts'), 'old');
+    expect(() => installResource(detail({}), Buffer.from('new'))).toThrow(/already exists/);
+    expect(() => installResource(detail({}), Buffer.from('new'), { force: true })).not.toThrow();
+  });
+});
+
+describe('installResource (skill)', () => {
+  it('unzips into skills/<slug>', () => {
+    const zip = storeZip({ 'SKILL.md': '# skill', 'refs/a.md': 'A' });
+    const res = installResource(detail({ id: 'sk1', type: 'skill', title: 'My Skill', fileName: 'pkg.zip' }), zip);
+    expect(res.installedPath.split('\\').join('/')).toContain('skills/my-skill');
+    expect(readFileSync(join(res.installedPath, 'SKILL.md'), 'utf8')).toBe('# skill');
+    expect(readFileSync(join(res.installedPath, 'refs', 'a.md'), 'utf8')).toBe('A');
+  });
+  it('rejects zip path traversal', () => {
+    const zip = storeZip({ '../evil.md': 'x' });
+    expect(() => installResource(detail({ id: 'sk2', type: 'skill', title: 'T' }), zip)).toThrow(/unsafe path/);
+  });
+});
+
+describe('uninstall / list', () => {
+  it('lists then removes', () => {
+    installResource(detail({}), Buffer.from('x'));
+    expect(listInstalled().map(e => `${e.type}/${e.id}`)).toEqual(['strategy/ab12']);
+    const r = uninstallResource('strategy/ab12');
+    expect(r.removed).toBe(true);
+    expect(existsSync(r.path!)).toBe(false);
+    expect(listInstalled()).toEqual([]);
+  });
+});

package/src/lib/hub-install.ts

@@ -1,121 +1,121 @@
-// src/lib/hub-install.ts
-import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'fs';
-import { dirname, extname, join } from 'path';
-import { getWorkspaceDir } from './init-command.js';
-import type { ResourceType, ResourceDetail } from './hub-client.js';
-import { unzip } from './hub-unzip.js';
-
-export interface InstalledEntry { type: ResourceType; id: string; title: string; path: string; installedAt: string; }
-export type Lockfile = Record<string, InstalledEntry>; // keyed by "<type>/<id>"
-
-export function hubDir(): string { return join(getWorkspaceDir(), 'hub'); }
-export function lockfilePath(): string { return join(hubDir(), 'installed.json'); }
-
-export function readLockfile(): Lockfile {
-  const p = lockfilePath();
-  if (!existsSync(p)) return {};
-  try {
-    return JSON.parse(readFileSync(p, 'utf8')) as Lockfile;
-  } catch {
-    console.error(`warning: hub lockfile at ${p} is unreadable or corrupt; treating as empty (installed packages may not be tracked)`);
-    return {};
-  }
-}
-
-export function writeLockfile(lock: Lockfile): void {
-  mkdirSync(hubDir(), { recursive: true });
-  writeFileSync(lockfilePath(), JSON.stringify(lock, null, 2) + '\n', 'utf8');
-}
-
-function assertSafeSegment(label: string, s: string): void {
-  if (!s || s === '.' || s === '..' || /[\\/:\0]/.test(s)) {
-    throw new Error(`unsafe ${label} segment: '${s}'`);
-  }
-}
-
-export function slugify(title: string): string {
-  return title.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '');
-}
-
-const STRATEGY_EXTS = new Set(['.ts', '.tsx', '.js']);
-
-/** Workspace-relative install path, decided by resource type. */
-export function placementRelPath(detail: { type: ResourceType; id: string; title: string; fileName?: string }): string {
-  assertSafeSegment('id', detail.id);
-  if (detail.type === 'strategy') {
-    const slug = slugify(detail.title);
-    let ext = detail.fileName ? extname(detail.fileName).toLowerCase() : '.ts';
-    if (!STRATEGY_EXTS.has(ext)) ext = '.ts';
-    const base = slug ? `${slug}__${detail.id}` : detail.id;
-    return join('strategies', `${base}${ext}`);
-  }
-  const slug = slugify(detail.title) || detail.id;
-  assertSafeSegment('skill dir', slug);
-  return join('skills', slug);
-}
-
-function makeRef(type: ResourceType, id: string): string { return `${type}/${id}`; }
-
-export interface InstallResult { ref: string; type: ResourceType; id: string; title: string; installedPath: string; }
-
-export function installResource(detail: ResourceDetail, artifact: Buffer, opts: { force?: boolean } = {}): InstallResult {
-  const ws = getWorkspaceDir();
-  const ref = makeRef(detail.type, detail.id);
-  const relPath = placementRelPath(detail);
-  const absPath = join(ws, relPath);
-  const lock = readLockfile();
-  const tracked = lock[ref] !== undefined;
-
-  if (detail.type === 'strategy') {
-    if (existsSync(absPath) && !tracked && !opts.force) {
-      throw new Error(`${relPath} already exists and is not tracked by hub; re-run with --force to overwrite`);
-    }
-    mkdirSync(join(ws, 'strategies'), { recursive: true });
-    writeFileSync(absPath, artifact);
-  } else {
-    if (existsSync(absPath) && !tracked && !opts.force) {
-      throw new Error(`skills/${slugify(detail.title) || detail.id} already exists and is not tracked by hub; re-run with --force to overwrite`);
-    }
-    const entries = unzip(artifact);
-    // Validate ALL entry paths before any filesystem mutation (no partial/unsafe writes).
-    for (const e of entries) {
-      if (e.path.includes('..') || e.path.startsWith('/') || /^[A-Za-z]:/.test(e.path)) {
-        throw new Error(`unsafe path in skill archive: ${e.path}`);
-      }
-    }
-    // NOTE (v1): non-atomic — entries are decoded+validated in memory above, but a disk
-    // error mid-write could leave a partial skill dir. Acceptable for v1.
-    if (existsSync(absPath)) rmSync(absPath, { recursive: true, force: true });
-    mkdirSync(absPath, { recursive: true });
-    for (const e of entries) {
-      const target = join(absPath, e.path);
-      mkdirSync(dirname(target), { recursive: true });
-      writeFileSync(target, e.content);
-    }
-  }
-
-  lock[ref] = {
-    type: detail.type,
-    id: detail.id,
-    title: detail.title,
-    path: relPath.split('\\').join('/'),
-    installedAt: new Date().toISOString(),
-  };
-  writeLockfile(lock);
-  return { ref, type: detail.type, id: detail.id, title: detail.title, installedPath: absPath };
-}
-
-export function uninstallResource(ref: string): { removed: boolean; path?: string } {
-  const lock = readLockfile();
-  const entry = lock[ref];
-  if (!entry) return { removed: false };
-  const abs = join(getWorkspaceDir(), entry.path);
-  if (existsSync(abs)) rmSync(abs, { recursive: true, force: true });
-  delete lock[ref];
-  writeLockfile(lock);
-  return { removed: true, path: abs };
-}
-
-export function listInstalled(): InstalledEntry[] {
-  return Object.values(readLockfile());
-}
+// src/lib/hub-install.ts
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'fs';
+import { dirname, extname, join } from 'path';
+import { getWorkspaceDir } from './init-command.js';
+import type { ResourceType, ResourceDetail } from './hub-client.js';
+import { unzip } from './hub-unzip.js';
+
+export interface InstalledEntry { type: ResourceType; id: string; title: string; path: string; installedAt: string; }
+export type Lockfile = Record<string, InstalledEntry>; // keyed by "<type>/<id>"
+
+export function hubDir(): string { return join(getWorkspaceDir(), 'hub'); }
+export function lockfilePath(): string { return join(hubDir(), 'installed.json'); }
+
+export function readLockfile(): Lockfile {
+  const p = lockfilePath();
+  if (!existsSync(p)) return {};
+  try {
+    return JSON.parse(readFileSync(p, 'utf8')) as Lockfile;
+  } catch {
+    console.error(`warning: hub lockfile at ${p} is unreadable or corrupt; treating as empty (installed packages may not be tracked)`);
+    return {};
+  }
+}
+
+export function writeLockfile(lock: Lockfile): void {
+  mkdirSync(hubDir(), { recursive: true });
+  writeFileSync(lockfilePath(), JSON.stringify(lock, null, 2) + '\n', 'utf8');
+}
+
+function assertSafeSegment(label: string, s: string): void {
+  if (!s || s === '.' || s === '..' || /[\\/:\0]/.test(s)) {
+    throw new Error(`unsafe ${label} segment: '${s}'`);
+  }
+}
+
+export function slugify(title: string): string {
+  return title.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '');
+}
+
+const STRATEGY_EXTS = new Set(['.ts', '.tsx', '.js']);
+
+/** Workspace-relative install path, decided by resource type. */
+export function placementRelPath(detail: { type: ResourceType; id: string; title: string; fileName?: string }): string {
+  assertSafeSegment('id', detail.id);
+  if (detail.type === 'strategy') {
+    const slug = slugify(detail.title);
+    let ext = detail.fileName ? extname(detail.fileName).toLowerCase() : '.ts';
+    if (!STRATEGY_EXTS.has(ext)) ext = '.ts';
+    const base = slug ? `${slug}__${detail.id}` : detail.id;
+    return join('strategies', `${base}${ext}`);
+  }
+  const slug = slugify(detail.title) || detail.id;
+  assertSafeSegment('skill dir', slug);
+  return join('skills', slug);
+}
+
+function makeRef(type: ResourceType, id: string): string { return `${type}/${id}`; }
+
+export interface InstallResult { ref: string; type: ResourceType; id: string; title: string; installedPath: string; }
+
+export function installResource(detail: ResourceDetail, artifact: Buffer, opts: { force?: boolean } = {}): InstallResult {
+  const ws = getWorkspaceDir();
+  const ref = makeRef(detail.type, detail.id);
+  const relPath = placementRelPath(detail);
+  const absPath = join(ws, relPath);
+  const lock = readLockfile();
+  const tracked = lock[ref] !== undefined;
+
+  if (detail.type === 'strategy') {
+    if (existsSync(absPath) && !tracked && !opts.force) {
+      throw new Error(`${relPath} already exists and is not tracked by hub; re-run with --force to overwrite`);
+    }
+    mkdirSync(join(ws, 'strategies'), { recursive: true });
+    writeFileSync(absPath, artifact);
+  } else {
+    if (existsSync(absPath) && !tracked && !opts.force) {
+      throw new Error(`skills/${slugify(detail.title) || detail.id} already exists and is not tracked by hub; re-run with --force to overwrite`);
+    }
+    const entries = unzip(artifact);
+    // Validate ALL entry paths before any filesystem mutation (no partial/unsafe writes).
+    for (const e of entries) {
+      if (e.path.includes('..') || e.path.startsWith('/') || /^[A-Za-z]:/.test(e.path)) {
+        throw new Error(`unsafe path in skill archive: ${e.path}`);
+      }
+    }
+    // NOTE (v1): non-atomic — entries are decoded+validated in memory above, but a disk
+    // error mid-write could leave a partial skill dir. Acceptable for v1.
+    if (existsSync(absPath)) rmSync(absPath, { recursive: true, force: true });
+    mkdirSync(absPath, { recursive: true });
+    for (const e of entries) {
+      const target = join(absPath, e.path);
+      mkdirSync(dirname(target), { recursive: true });
+      writeFileSync(target, e.content);
+    }
+  }
+
+  lock[ref] = {
+    type: detail.type,
+    id: detail.id,
+    title: detail.title,
+    path: relPath.split('\\').join('/'),
+    installedAt: new Date().toISOString(),
+  };
+  writeLockfile(lock);
+  return { ref, type: detail.type, id: detail.id, title: detail.title, installedPath: absPath };
+}
+
+export function uninstallResource(ref: string): { removed: boolean; path?: string } {
+  const lock = readLockfile();
+  const entry = lock[ref];
+  if (!entry) return { removed: false };
+  const abs = join(getWorkspaceDir(), entry.path);
+  if (existsSync(abs)) rmSync(abs, { recursive: true, force: true });
+  delete lock[ref];
+  writeLockfile(lock);
+  return { removed: true, path: abs };
+}
+
+export function listInstalled(): InstalledEntry[] {
+  return Object.values(readLockfile());
+}