@seojin08/skill-finder 0.0.0-stage → 0.3.2

package/server/src/analyze/frontmatter.js

@@ -0,0 +1,130 @@
+import { parse } from 'yaml';
+import { sanitizeLine, sanitizeName, sanitizeText } from "../util/sanitize.js";
+/**
+ * YAML is parsed on the main thread; deeply nested frontmatter takes ~0.2s each, so a repo full of them
+ * could block the server for minutes. Real frontmatter is far smaller (largest stored: 13.7K chars).
+ */
+export const FRONTMATTER_MAX_CHARS = 16 * 1024;
+// Claude Code only treats the block as frontmatter when the very first line is `---`.
+const FRONTMATTER_RE = /^---[ \t]*\r?\n(?:([\s\S]*?)\r?\n)?---[ \t]*(?:\r?\n|$)([\s\S]*)$/;
+function regexField(block, key) {
+    const m = block.match(new RegExp(`^${key}:[ \\t]*(.+)$`, 'm'));
+    if (!m)
+        return undefined;
+    return m[1].trim().replace(/^(['"])(.*)\1$/, '$2');
+}
+export function parseSkillMd(raw) {
+    const text = raw.replace(/^/, '');
+    const m = text.match(FRONTMATTER_RE);
+    if (!m)
+        return { hasFrontmatter: false, frontmatter: {}, body: text, yamlError: null };
+    const block = m[1] ?? '';
+    const body = m[2] ?? '';
+    if (block.length > FRONTMATTER_MAX_CHARS) {
+        const fallback = {};
+        const name = regexField(block, 'name');
+        const description = regexField(block, 'description');
+        if (name)
+            fallback.name = name;
+        if (description)
+            fallback.description = description;
+        const yamlError = `frontmatter가 ${FRONTMATTER_MAX_CHARS / 1024}KB를 넘어 해석하지 않았습니다`;
+        return { hasFrontmatter: true, frontmatter: fallback, body, yamlError, frontmatterTooLarge: true };
+    }
+    try {
+        const data = parse(block, { prettyErrors: false });
+        if (data == null)
+            return { hasFrontmatter: true, frontmatter: {}, body, yamlError: null };
+        if (typeof data !== 'object' || Array.isArray(data)) {
+            return { hasFrontmatter: true, frontmatter: {}, body, yamlError: 'frontmatter가 매핑이 아닙니다' };
+        }
+        return { hasFrontmatter: true, frontmatter: data, body, yamlError: null };
+    }
+    catch (err) {
+        const fallback = {};
+        const name = regexField(block, 'name');
+        const description = regexField(block, 'description');
+        if (name)
+            fallback.name = name;
+        if (description)
+            fallback.description = description;
+        return { hasFrontmatter: true, frontmatter: fallback, body, yamlError: String(err.message ?? err).split('\n')[0] };
+    }
+}
+/** Splits `allowed-tools` given as a YAML list or a comma/space separated string, respecting parentheses. */
+export function parseAllowedTools(value) {
+    if (Array.isArray(value))
+        return value.map((v) => String(v).trim()).filter(Boolean);
+    if (typeof value !== 'string')
+        return [];
+    const out = [];
+    let depth = 0;
+    let cur = '';
+    for (const ch of value) {
+        if (ch === '(')
+            depth++;
+        if (ch === ')')
+            depth = Math.max(0, depth - 1);
+        if (depth === 0 && (ch === ',' || /\s/.test(ch))) {
+            if (cur.trim())
+                out.push(cur.trim());
+            cur = '';
+            continue;
+        }
+        cur += ch;
+    }
+    if (cur.trim())
+        out.push(cur.trim());
+    return out;
+}
+const asString = (v) => (typeof v === 'string' && v.trim() ? v : null);
+function firstBodyLine(body) {
+    for (const line of body.split('\n')) {
+        const t = line.replace(/^#+\s*/, '').trim();
+        if (t)
+            return t;
+    }
+    return '';
+}
+const PICKED_FIELDS = [
+    'name',
+    'description',
+    'when_to_use',
+    'allowed-tools',
+    'disable-model-invocation',
+    'user-invocable',
+    'hooks',
+    'paths',
+    'model',
+    'context',
+    'license',
+    'compatibility',
+    'metadata',
+];
+/** Applies Claude Code's defaults: name falls back to the folder, description to the first body line. */
+export function extractSkillMeta(raw, folderName) {
+    const parsed = parseSkillMd(sanitizeText(raw));
+    const fm = parsed.frontmatter;
+    const nameFm = asString(fm.name);
+    const descFm = asString(fm.description);
+    const picked = {};
+    for (const k of PICKED_FIELDS)
+        if (fm[k] !== undefined)
+            picked[k] = fm[k];
+    const body = parsed.body;
+    return {
+        name: sanitizeName(nameFm ?? folderName),
+        description: sanitizeLine(descFm ?? firstBodyLine(body)),
+        whenToUse: asString(fm.when_to_use) ? sanitizeLine(fm.when_to_use) : null,
+        nameFromFrontmatter: nameFm ? sanitizeName(nameFm) : null,
+        descriptionFromFrontmatter: descFm ? sanitizeLine(descFm) : null,
+        allowedTools: parseAllowedTools(fm['allowed-tools']),
+        hasHooks: fm.hooks != null && fm.hooks !== false,
+        frontmatter: picked,
+        body,
+        bodyLines: body.length === 0 ? 0 : body.replace(/\n$/, '').split('\n').length,
+        hasFrontmatter: parsed.hasFrontmatter,
+        yamlError: parsed.yamlError,
+        frontmatterTooLarge: parsed.frontmatterTooLarge === true,
+    };
+}

package/server/src/analyze/quality.js

@@ -0,0 +1,34 @@
+export const LISTING_LIMIT = 1536;
+/** Badge-only checks (agentskills.io spec + Claude Code listing limits); never part of the score. */
+export function qualityWarnings(meta, folderName) {
+    const out = [];
+    if (!meta.hasFrontmatter)
+        out.push('noFrontmatter');
+    if (meta.yamlError)
+        out.push('yamlError');
+    const name = meta.nameFromFrontmatter;
+    if (!name)
+        out.push('nameMissing');
+    else {
+        const len = Array.from(name).length;
+        if (len < 1 || len > 64)
+            out.push('nameLength');
+        if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(name))
+            out.push('nameFormat');
+        if (folderName && name !== folderName)
+            out.push('nameMismatch');
+    }
+    const desc = meta.descriptionFromFrontmatter;
+    if (!desc)
+        out.push('descriptionMissing');
+    else if (Array.from(desc).length > 1024)
+        out.push('descriptionLength');
+    if (meta.bodyLines > 500)
+        out.push('bodyTooLong');
+    const listing = (meta.description ?? '') + (meta.whenToUse ?? '');
+    if (Array.from(listing).length > LISTING_LIMIT)
+        out.push('listingTruncated');
+    if (/anthropic|claude/i.test(meta.name))
+        out.push('reservedWord');
+    return out;
+}

package/server/src/analyze/risk.js

@@ -0,0 +1,123 @@
+/**
+ * Bumped whenever a rule reading the SKILL.md text changes, so rows checked under older rules are checked
+ * again (stored per row, and part of the search cache key). 2: the wider download-and-run rule (U3).
+ */
+export const RISK_RULES_VERSION = 2;
+/** Flags that come from the SKILL.md text; the others come from the file list or the plugin. */
+export const TEXT_RISK_FLAGS = new Set([
+    'preapprovedBash',
+    'unscopedBash',
+    'shellInjection',
+    'skillHooks',
+    'pluginRootDependency',
+    'curlPipeShell',
+    'rmRf',
+    'unscanned',
+]);
+const SCRIPT_EXT = /\.(sh|bash|zsh|py|js|mjs|cjs|ts|rb|pl|ps1|bat|cmd|exe)$/i;
+const SHELL_INLINE = /(^|[\s(])!`[^`\n]+`/m;
+const SHELL_BLOCK = /^[ \t]*```!/m;
+// The two checks below scan remote SKILL.md text, so they must stay linear in its length: the single regexes
+// they replace (`\b(curl|wget)\b[^\n|]*\|…sh` and a nested-`[a-zA-Z]*` rm -rf) took 46s and 207s on a
+// crafted 512KB file, blocking the whole server. They catch everything those regexes did (fuzzed) and, since
+// the search debate (U3, user decision), the other common download-and-run forms too. Rows indexed before that
+// are checked again in the background (tasks.ts recheckRiskRules, RISK_RULES_VERSION).
+const DOWNLOADER = /\b(?:curl|wget|irm|iwr|invoke-webrequest|invoke-restmethod)\b/i;
+// sh-like shells run stdin whatever follows; python/node/perl/ruby only when the command ends there
+// (`| python3 -`): `| python -m json.tool` just formats the output, and `| curl | node |` is a markdown table.
+// Paths and sudo options never cross a `|`: `[^\s|]` keeps one match from running past the next pipe, which
+// made each pipe rescan the rest of the text (quadratic, 110s on 512KB of "/curl|").
+const PIPE_TO_SHELL = /\s*(?:sudo[ \t]+(?:-[^\s|]+[ \t]+)*)?(?:(?:\/[^\s|]*\/)?env[ \t]+)?(?:\/[^\s|]*\/)?(?:(?:(?:ba|z|da|k)?sh|iex|invoke-expression)\b|(?:python[0-9.]*|node|perl|ruby)(?:[ \t]+-)?(?=[ \t]*(?:[\r\n;&)'"`]|$)))/iy;
+/** `bash <(curl …)`, `sh -c "$(wget …)"`, `eval "$(curl …)"`, `source <(curl …)`: a shell running a download. */
+const SUBST_TO_SHELL = /\b(?:(?:ba|z|da|k)?sh|eval|source)\b[^\n<$]{0,80}[<$]\([ \t]*(?:curl|wget)\b/i;
+/** PowerShell `iex (iwr …)`, `Invoke-Expression (New-Object Net.WebClient).DownloadString(…)`. */
+const PS_EXPR = /\b(?:iex|invoke-expression)[ \t]*\(+[ \t]*(?:iwr|irm|invoke-webrequest|invoke-restmethod|new-object[ \t]+(?:system\.)?net\.webclient)\b/i;
+/**
+ * A downloader (curl, wget, PowerShell iwr/irm) in a `|`- or newline-delimited segment that ends in `|` followed by
+ * a shell or interpreter; or a shell/iex running a download's output directly. A line ending in `\` continues.
+ */
+export function hasCurlPipeShell(raw) {
+    const text = raw.replace(/\\\r?\n/g, ' ');
+    if (SUBST_TO_SHELL.test(text) || PS_EXPR.test(text))
+        return true;
+    let start = 0;
+    for (let i = 0; i <= text.length; i++) {
+        const ch = text[i];
+        if (i < text.length && ch !== '|' && ch !== '\n')
+            continue;
+        if (ch === '|' && DOWNLOADER.test(text.slice(start, i))) {
+            PIPE_TO_SHELL.lastIndex = i + 1; // \s* may cross newlines, as in the original
+            if (PIPE_TO_SHELL.test(text))
+                return true;
+        }
+        start = i + 1;
+    }
+    return false;
+}
+const RM_FLAGS = /\brm\s+-([a-zA-Z]+)(?!\w)/g;
+const RM_SPLIT_FLAGS = /\brm\s+-([rRfF])\s+-([rRfF])\b/g;
+/** `rm -rf` in any flag order (`-fr`, `-Rf`, `-rfv`, `-r -f`). */
+export function hasRmRf(text) {
+    for (const m of text.matchAll(RM_FLAGS))
+        if (/[rR]/.test(m[1]) && /[fF]/.test(m[1]))
+            return true;
+    for (const m of text.matchAll(RM_SPLIT_FLAGS))
+        if (m[1].toLowerCase() !== m[2].toLowerCase())
+            return true;
+    return false;
+}
+const PLUGIN_ROOT = /\$\{?CLAUDE_PLUGIN_ROOT\}?/;
+export function skillRiskFlags(input) {
+    const flags = new Set();
+    if (input.files.some((f) => SCRIPT_EXT.test(f)))
+        flags.add('scripts');
+    for (const tool of input.allowedTools) {
+        const t = tool.trim();
+        if (/^Bash(?:\(|$)/.test(t))
+            flags.add('preapprovedBash');
+        if (t === 'Bash' || /^Bash\(\s*\*\s*\)$/.test(t))
+            flags.add('unscopedBash');
+    }
+    if (SHELL_INLINE.test(input.body) || SHELL_BLOCK.test(input.body))
+        flags.add('shellInjection');
+    if (input.hasHooks)
+        flags.add('skillHooks');
+    if (PLUGIN_ROOT.test(input.raw))
+        flags.add('pluginRootDependency');
+    if (hasCurlPipeShell(input.raw))
+        flags.add('curlPipeShell');
+    if (hasRmRf(input.raw))
+        flags.add('rmRf');
+    if (input.partial)
+        flags.add('unscanned');
+    return [...flags];
+}
+export function pluginRiskFlags(signals, sourceKind) {
+    const flags = [];
+    if (signals?.hooks)
+        flags.push('pluginHooks');
+    if (signals?.mcp)
+        flags.push('pluginMcp');
+    if (signals?.bin)
+        flags.push('pluginBin');
+    if (signals?.monitors)
+        flags.push('pluginMonitors');
+    if (sourceKind === 'command')
+        flags.push('commandSource');
+    return flags;
+}
+// Shown, but they do not raise the level: rm -rf is common cleanup, and pluginRootDependency says how the skill must
+// be installed (as a plugin), not that it is dangerous (UI debate D-3). Scripts and a plugin's bin run only through
+// Bash, which Claude Code asks about first; what runs without asking (hooks, MCP servers, monitors, pre-approved
+// Bash, shell injection) stays "주의" (user decision 2026-11-02: 60% of skills were "주의", official pdf too).
+const INFO_ONLY = new Set(['rmRf', 'pluginRootDependency', 'scripts', 'pluginBin']);
+export function riskLevel(flags) {
+    const has = (f) => flags.includes(f);
+    // unscanned stands in for unscopedBash too: an oversized frontmatter hides `allowed-tools: Bash` from the check
+    if ((has('shellInjection') && (has('unscopedBash') || has('unscanned'))) || has('curlPipeShell') || has('commandSource'))
+        return 'high';
+    if (flags.some((f) => !INFO_ONLY.has(f)))
+        return 'medium';
+    return 'low';
+}
+export const RISK_ORDER = { low: 0, medium: 1, high: 2 };

package/server/src/app.js

@@ -0,0 +1,57 @@
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import express, {} from 'express';
+import { WEB_DIST_DIR } from "./config.js";
+import { adminRouter } from "./routes/admin.js";
+import { healthRouter } from "./routes/health.js";
+import { installRouter } from "./routes/install.js";
+import { presetsRouter } from "./routes/presets.js";
+import { favoritesRouter } from "./routes/favorites.js";
+import { recommendRouter } from "./routes/recommend.js";
+import { searchRouter } from "./routes/search.js";
+import { skillsRouter } from "./routes/skills.js";
+import { CSP, securityMiddleware } from "./security.js";
+export function createApp(ctx, opts = {}) {
+    const app = express();
+    app.disable('x-powered-by');
+    app.set('etag', false);
+    // /API/... must not reach the /api routes past a check written for /api (project review 2026-11-02)
+    app.set('case sensitive routing', true);
+    app.use(securityMiddleware(ctx.config));
+    app.use('/api', express.json({ limit: '64kb' }));
+    app.use('/api', healthRouter(ctx));
+    app.use('/api', searchRouter(ctx, opts.searchDeps));
+    app.use('/api', skillsRouter(ctx));
+    app.use('/api', installRouter(ctx));
+    app.use('/api', presetsRouter(ctx));
+    app.use('/api', favoritesRouter(ctx));
+    app.use('/api', recommendRouter(ctx));
+    app.use('/api', adminRouter(ctx));
+    // any other /api path, in any case (/API/... is not an API route and not a page either)
+    app.use((req, res, next) => {
+        if (!req.path.toLowerCase().startsWith('/api'))
+            return next();
+        res.status(404).json({ error: '없는 API 주소입니다' });
+    });
+    if (existsSync(WEB_DIST_DIR)) {
+        app.use((_req, res, next) => {
+            res.setHeader('Content-Security-Policy', CSP);
+            next();
+        });
+        // index.html must never be cached (it names the current hashed bundles); it is served by the fallback below.
+        app.use(express.static(WEB_DIST_DIR, { index: false, maxAge: '1h' }));
+        app.get(/^\/(?!api\/).*/i, (_req, res) => {
+            res.setHeader('Cache-Control', 'no-cache');
+            res.sendFile(join(WEB_DIST_DIR, 'index.html'));
+        });
+    }
+    const onError = (err, _req, res, _next) => {
+        const status = typeof err?.status === 'number' && err.status >= 400 && err.status < 600 ? err.status : 500;
+        if (status >= 500)
+            console.error('[api]', err);
+        if (!res.headersSent)
+            res.status(status).json({ error: status >= 500 ? '서버 오류' : String(err.message ?? err) });
+    };
+    app.use(onError);
+    return app;
+}

package/server/src/bootstrap.js

@@ -0,0 +1,46 @@
+import { copyFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { isCorruptDb, latestBackup, openDb, setAsideCorrupt } from "./db/index.js";
+import { Store } from "./db/store.js";
+import { Indexer } from "./indexer.js";
+import { Jobs } from "./jobs.js";
+import { seedMarketplaces } from "./settings.js";
+import { GitHub } from "./sources/github.js";
+import { APP_VERSION } from "./version.js";
+export function createContext(config, dbPath = join(config.dataDir, 'skill-finder.db')) {
+    const store = new Store(openDb(dbPath, { backupLabel: dbPath === ':memory:' ? null : APP_VERSION }));
+    seedMarketplaces(store);
+    const github = new GitHub(store, config);
+    const indexer = new Indexer(store, github);
+    return { config, store, github, indexer, jobs: new Jobs() };
+}
+/**
+ * createContext for the server: a damaged database file (project review #4) is moved aside and the newest backup
+ * made before a migration is put in its place, or, without one, the app starts with an empty one (the index is
+ * collected again; settings and the search log start over). Each step is said on the console and in the log.
+ */
+export function openContext(config) {
+    const dbPath = join(config.dataDir, 'skill-finder.db');
+    let restored = null;
+    for (;;) {
+        try {
+            return createContext(config, dbPath);
+        }
+        catch (err) {
+            if (!isCorruptDb(err))
+                throw err;
+            const moved = setAsideCorrupt(dbPath);
+            console.error(`[db] 데이터 파일이 손상되어 열 수 없습니다. 살펴볼 수 있게 옮겨 두었습니다: ${moved}`);
+            const backup = restored ? null : latestBackup(dbPath);
+            if (backup) {
+                copyFileSync(backup, dbPath);
+                restored = backup;
+                console.error(`[db] 백업으로 되살려 시작합니다: ${backup}`);
+            }
+            else {
+                console.error('[db] 새 데이터로 시작합니다. 스킬 목록은 다시 모으고, 설정과 검색 기록은 처음 값으로 돌아갑니다.');
+                return createContext(config, dbPath);
+            }
+        }
+    }
+}

package/server/src/claude/cli.js

@@ -0,0 +1,89 @@
+import { accessSync, constants, statSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { delimiter, join } from 'node:path';
+import { run } from "../util/proc.js";
+const isWin = process.platform === 'win32';
+function isFile(p) {
+    try {
+        if (!statSync(p).isFile())
+            return false;
+        if (!isWin)
+            accessSync(p, constants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Finds the `claude` executable. On Windows a native `.exe` wins; a `.cmd` shim needs a shell. */
+export function findClaudeBinary() {
+    const dirs = (process.env.PATH ?? '').split(delimiter).filter(Boolean);
+    const home = homedir();
+    if (isWin) {
+        const exeDirs = [...dirs, join(home, '.local', 'bin'), join(home, '.claude', 'local')];
+        for (const d of exeDirs) {
+            const p = join(d, 'claude.exe');
+            if (isFile(p))
+                return { file: p, shell: false };
+        }
+        const cmdDirs = [...dirs, join(process.env.APPDATA ?? join(home, 'AppData', 'Roaming'), 'npm')];
+        for (const d of cmdDirs) {
+            const p = join(d, 'claude.cmd');
+            if (isFile(p))
+                return { file: p, shell: true };
+        }
+        return null;
+    }
+    for (const d of [...dirs, join(home, '.local', 'bin'), join(home, '.claude', 'local')]) {
+        const p = join(d, 'claude');
+        if (isFile(p))
+            return { file: p, shell: false };
+    }
+    return null;
+}
+let cached;
+export function claudeBinary() {
+    if (cached === undefined)
+        cached = findClaudeBinary();
+    return cached;
+}
+/** Args are validated by callers; with a `.cmd` shim each one is double-quoted for cmd.exe. */
+function quoteForCmd(arg) {
+    if (/["%^&|<>!\r\n]/.test(arg))
+        throw new Error(`unsafe argument for shell: ${arg}`);
+    return `"${arg}"`;
+}
+export async function runClaude(args, opts = {}) {
+    const bin = claudeBinary();
+    if (!bin)
+        throw new Error('claude 실행 파일을 찾을 수 없습니다');
+    if (bin.shell)
+        return run(quoteForCmd(bin.file), args.map(quoteForCmd), { ...opts, shell: true });
+    return run(bin.file, args, opts);
+}
+/** Display form of a command line (for previews and logs). */
+export function formatCommand(file, args) {
+    return [file, ...args].map((a) => (/^[A-Za-z0-9._@/:=-]+$/.test(a) ? a : `"${a}"`)).join(' ');
+}
+const VERSION_RETRY_MS = 60_000;
+let versionPromise = null;
+let versionFailedAt = 0;
+/**
+ * `claude --version`, asked once. A failure is asked again after a minute: Claude Code installed while the app
+ * runs would otherwise show as missing until a restart.
+ */
+export function claudeVersion() {
+    if (versionPromise && versionFailedAt && Date.now() - versionFailedAt >= VERSION_RETRY_MS) {
+        versionPromise = null;
+        if (cached === null)
+            cached = undefined; // look for the binary again too
+    }
+    versionPromise ??= runClaude(['--version'], { timeoutMs: 15_000 })
+        .then((r) => (r.exitCode === 0 ? r.stdout.trim().split(/\s+/)[0] || null : null))
+        .catch(() => null)
+        .then((v) => {
+        versionFailedAt = v ? 0 : Date.now();
+        return v;
+    });
+    return versionPromise;
+}

package/server/src/config.js

@@ -0,0 +1,70 @@
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+export const ROOT_DIR = resolve(dirname(fileURLToPath(import.meta.url)), '../..');
+export const SERVER_DIR = join(ROOT_DIR, 'server');
+export const WEB_DIST_DIR = join(ROOT_DIR, 'web', 'dist');
+/** The release launcher keeps the token outside the app folder (UI debate D-6); from the environment only. */
+export const ENV_PATH = process.env.SKILL_FINDER_ENV_PATH ? resolve(process.env.SKILL_FINDER_ENV_PATH) : join(ROOT_DIR, '.env');
+export const SKILLS_CLI_VERSION = '1.7.4';
+/** The bundled skills CLI: under the app, or wherever npm put it when installed as a package (npx hoists it). */
+export const SKILLS_CLI_PATH = (() => {
+    const local = join(ROOT_DIR, 'node_modules', 'skills', 'bin', 'cli.mjs');
+    if (existsSync(local))
+        return local;
+    try {
+        return join(dirname(createRequire(import.meta.url).resolve('skills/package.json')), 'bin', 'cli.mjs');
+    }
+    catch {
+        return local;
+    }
+})();
+/** Vite dev server port (web/vite.config.ts); allowed as a Host/Origin in --dev mode only. */
+export const DEV_VITE_PORT = 5174;
+function parseEnvFile(text) {
+    const out = {};
+    for (const line of text.split(/\r?\n/)) {
+        const m = line.match(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/);
+        if (!m)
+            continue;
+        let value = m[2].trim();
+        if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'")))
+            value = value.slice(1, -1);
+        out[m[1]] = value;
+    }
+    return out;
+}
+const fileEnv = existsSync(ENV_PATH) ? parseEnvFile(readFileSync(ENV_PATH, 'utf8')) : {};
+const env = (key) => process.env[key] ?? fileEnv[key];
+export const config = {
+    port: Number(env('PORT') ?? 4317) || 4317,
+    dev: process.argv.includes('--dev') || env('SKILL_FINDER_DEV') === '1',
+    dataDir: resolve(env('SKILL_FINDER_DATA_DIR') ?? join(ROOT_DIR, 'data')),
+    githubToken: env('GITHUB_TOKEN')?.trim() || null,
+};
+export function ensureDataDirs() {
+    mkdirSync(join(config.dataDir, 'tmp', 'git'), { recursive: true });
+}
+/**
+ * Writes GITHUB_TOKEN into .env (creating it if needed) and updates the in-memory config. Written to a temporary
+ * file first and renamed over .env, so a crash or a full disk mid-write cannot leave a cut-off .env.
+ */
+export function saveGithubToken(token) {
+    const value = token?.trim() || '';
+    const lines = existsSync(ENV_PATH) ? readFileSync(ENV_PATH, 'utf8').split(/\r?\n/) : [];
+    let found = false;
+    const next = lines.map((line) => {
+        if (/^\s*(?:export\s+)?GITHUB_TOKEN\s*=/.test(line)) {
+            found = true;
+            return `GITHUB_TOKEN=${value}`;
+        }
+        return line;
+    });
+    if (!found)
+        next.push(`GITHUB_TOKEN=${value}`);
+    const tmp = `${ENV_PATH}.${process.pid}.tmp`;
+    writeFileSync(tmp, next.join('\n').replace(/\n*$/, '\n'), { encoding: 'utf8', mode: 0o600 });
+    renameSync(tmp, ENV_PATH);
+    config.githubToken = value || null;
+}

package/server/src/context.js

@@ -0,0 +1 @@
+export {};