@seojin08/skill-finder 0.0.0-stage → 0.3.3

package/server/src/routes/admin.js

@@ -0,0 +1,203 @@
+import { arch, platform, release } from 'node:os';
+import { Router } from 'express';
+import { z } from 'zod';
+import { claudeVersion } from "../claude/cli.js";
+import { ENV_PATH, saveGithubToken, SKILLS_CLI_VERSION } from "../config.js";
+import { isPluginName, isRepo } from "../install/validate.js";
+import { getSettings, saveSettings, SettingsSchema } from "../settings.js";
+import { fetchMarketplaceManifest } from "../sources/marketplace.js";
+import { parseGithubRepo } from "../sources/pluginSource.js";
+import { popularState } from "../sources/popularRepos.js";
+import { startCollect, startPopularCollect, startSync } from "../tasks.js";
+import { addSecret, logFilePath, logTail, maskSecrets } from "../util/log.js";
+import { APP_VERSION } from "../version.js";
+const SettingsPut = z.object({
+    settings: SettingsSchema.partial().optional(),
+    githubToken: z.string().max(400).regex(/^[A-Za-z0-9_\-]*$/, '토큰 형식이 올바르지 않습니다').optional(),
+});
+const ClientError = z.object({ message: z.string().max(2000), stack: z.string().max(8000).optional() });
+const AddMarketplace = z.object({ repo: z.string().min(3).max(200), indexMode: z.enum(['eager', 'lazy']).default('lazy') });
+const PatchMarketplace = z.object({ enabled: z.boolean().optional(), indexMode: z.enum(['eager', 'lazy']).optional() });
+export function adminRouter(ctx) {
+    const r = Router();
+    const { store, jobs } = ctx;
+    const marketplaces = () => store.listMarketplaces().map((m) => ({
+        name: m.name,
+        repo: m.repo,
+        enabled: m.enabled === 1,
+        indexMode: m.index_mode,
+        syncedAt: m.synced_at,
+        pluginCount: m.plugin_count,
+        error: m.error,
+        pendingSkillIndex: store.listPluginsNeedingIndex(m.name).length,
+    }));
+    const settingsResponse = () => ({
+        settings: getSettings(store),
+        githubToken: !!ctx.config.githubToken,
+        /** Where the index, search log and token live, so people know what to keep or delete (UI debate D-6). */
+        dataDir: ctx.config.dataDir,
+        envPath: ENV_PATH,
+        marketplaces: marketplaces(),
+        searchLogCount: store.countSearchLog(),
+    });
+    r.get('/settings', (_req, res) => {
+        res.json(settingsResponse());
+    });
+    r.put('/settings', (req, res) => {
+        const parsed = SettingsPut.safeParse(req.body);
+        if (!parsed.success) {
+            res.status(400).json({ error: parsed.error.issues[0]?.message ?? '설정 형식이 올바르지 않습니다' });
+            return;
+        }
+        if (parsed.data.settings) {
+            const cur = getSettings(store);
+            const next = SettingsSchema.safeParse({ ...cur, ...parsed.data.settings, weights: cur.weights });
+            if (!next.success) {
+                res.status(400).json({ error: next.error.issues[0]?.message ?? '설정 형식이 올바르지 않습니다' });
+                return;
+            }
+            saveSettings(store, next.data);
+            store.clearSearchCache();
+        }
+        if (parsed.data.githubToken !== undefined) {
+            addSecret(parsed.data.githubToken);
+            saveGithubToken(parsed.data.githubToken || null);
+            store.clearSearchCache();
+        }
+        res.json(settingsResponse());
+    });
+    // "진단 정보 복사" in the settings (project review F2): what helps tell a problem, without the token, searches or
+    // the home folder's name (shown as ~). The page copies it to the clipboard; nothing is sent anywhere.
+    r.get('/diagnostics', async (_req, res) => {
+        const s = getSettings(store);
+        const broken = marketplaces().filter((m) => m.error || m.pendingSkillIndex);
+        const lines = [
+            `Skill Finder ${APP_VERSION ?? '?'} · Node ${process.version} · ${platform()} ${release()} ${arch()}`,
+            `Claude Code ${(await claudeVersion()) ?? '찾지 못함'} · skills CLI ${SKILLS_CLI_VERSION}`,
+            `GitHub 토큰 ${ctx.config.githubToken ? '있음' : '없음'} · 포트 ${ctx.config.port}`,
+            `데이터 ${ctx.config.dataDir} · 로그 ${logFilePath() ?? '없음'}`,
+            `색인 플러그인 ${store.countPlugins()} · 스킬 ${store.countSkills()} · 마켓플레이스 ${store.listMarketplaces().length}`,
+            ...broken.map((m) => `  ${m.name}: ${m.error ?? ''}${m.pendingSkillIndex ? ` (색인 대기 ${m.pendingSkillIndex})` : ''}`),
+            `설정 최소 별 ${s.minStars} · 자동 수집 ${s.autoCollect ? '켬' : '끔'} · 기본 범위 ${s.defaultScope} · 검색 기록 ${s.searchLog ? '켬' : '끔'}`,
+            ...jobs
+                .list()
+                .slice(-5)
+                .map((j) => `작업 ${j.kind} ${j.status} ${j.done}/${j.total} ${j.label}${j.errors.length ? ` · 오류 ${j.errors.length} (${j.errors[0]})` : ''}`),
+            '',
+            '최근 로그',
+            logTail(80) || '(없음)',
+        ];
+        res.json({ text: maskSecrets(lines.join('\n')) });
+    });
+    // A screen error caught by the page (its ErrorBoundary) goes into the log file, so the diagnostics carry it.
+    r.post('/client-error', (req, res) => {
+        const parsed = ClientError.safeParse(req.body);
+        if (parsed.success)
+            console.error('[화면 오류]', parsed.data.message, parsed.data.stack ?? '');
+        res.status(204).end();
+    });
+    // "기록 지우기" in the settings (U5-2)
+    r.delete('/search-log', (_req, res) => {
+        store.clearSearchLog();
+        res.json(settingsResponse());
+    });
+    r.get('/marketplaces', (_req, res) => {
+        res.json({ marketplaces: marketplaces() });
+    });
+    r.post('/marketplaces', async (req, res) => {
+        const parsed = AddMarketplace.safeParse(req.body);
+        const repo = parsed.success ? parseGithubRepo(parsed.data.repo) : null;
+        if (!parsed.success || !repo || !isRepo(repo)) {
+            res.status(400).json({ error: 'GitHub 저장소(owner/repo 또는 URL)를 입력하세요' });
+            return;
+        }
+        try {
+            const { manifest } = await fetchMarketplaceManifest(ctx.github, repo);
+            if (!isPluginName(manifest.name))
+                throw new Error('마켓플레이스 이름 형식이 올바르지 않습니다');
+            if (store.getMarketplace(manifest.name))
+                throw new Error(`이미 있는 마켓플레이스입니다: ${manifest.name}`);
+            store.upsertMarketplace({ name: manifest.name, repo, enabled: true, index_mode: parsed.data.indexMode });
+            const job = startSync(ctx, manifest.name, true);
+            res.json({ marketplaces: marketplaces(), jobId: job.id });
+        }
+        catch (err) {
+            res.status(400).json({ error: String(err.message ?? err).slice(0, 300) });
+        }
+    });
+    r.patch('/marketplaces/:name', (req, res) => {
+        const parsed = PatchMarketplace.safeParse(req.body);
+        const m = store.getMarketplace(req.params.name);
+        if (!parsed.success || !m) {
+            res.status(m ? 400 : 404).json({ error: m ? '요청 형식이 올바르지 않습니다' : '마켓플레이스가 없습니다' });
+            return;
+        }
+        store.upsertMarketplace({
+            name: m.name,
+            repo: m.repo,
+            enabled: parsed.data.enabled ?? m.enabled === 1,
+            index_mode: parsed.data.indexMode ?? m.index_mode,
+        });
+        store.clearSearchCache();
+        res.json({ marketplaces: marketplaces() });
+    });
+    r.delete('/marketplaces/:name', (req, res) => {
+        if (!store.getMarketplace(req.params.name)) {
+            res.status(404).json({ error: '마켓플레이스가 없습니다' });
+            return;
+        }
+        store.deleteMarketplace(req.params.name);
+        store.clearSearchCache();
+        res.json({ marketplaces: marketplaces() });
+    });
+    r.post('/sync', (req, res) => {
+        const name = typeof req.body?.marketplace === 'string' ? req.body.marketplace : undefined;
+        if (name && !store.getMarketplace(name)) {
+            res.status(404).json({ error: '마켓플레이스가 없습니다' });
+            return;
+        }
+        res.json({ jobId: startSync(ctx, name, true).id });
+    });
+    r.post('/collect', (req, res) => {
+        const name = typeof req.body?.marketplace === 'string' ? req.body.marketplace : '';
+        if (!store.getMarketplace(name)) {
+            res.status(404).json({ error: '마켓플레이스가 없습니다' });
+            return;
+        }
+        res.json({ jobId: startCollect(ctx, name).id });
+    });
+    r.get('/popular-repos', (_req, res) => {
+        const s = popularState(ctx);
+        const repos = Object.values(s.repos);
+        res.json({ lastRunAt: s.lastRunAt, repos: repos.length, withSkills: repos.filter((r) => r.skills > 0).length, skills: repos.reduce((n, r) => n + r.skills, 0) });
+    });
+    r.post('/popular-repos/collect', (req, res) => {
+        res.json({ jobId: startPopularCollect(ctx, false, req.body?.force === true).id });
+    });
+    r.get('/jobs', (_req, res) => {
+        res.json({ jobs: jobs.list() });
+    });
+    r.get('/jobs/:id', (req, res) => {
+        const job = jobs.get(req.params.id);
+        if (!job) {
+            res.status(404).json({ error: '작업이 없습니다' });
+            return;
+        }
+        res.json(job);
+    });
+    r.post('/jobs/:id/:action', (req, res) => {
+        const { id, action } = req.params;
+        const ok = action === 'pause' ? jobs.pause(id) : action === 'resume' ? jobs.resume(id) : action === 'cancel' ? jobs.cancel(id) : null;
+        if (ok === null) {
+            res.status(404).json({ error: '알 수 없는 동작입니다' });
+            return;
+        }
+        const job = jobs.get(id);
+        if (!job) {
+            res.status(404).json({ error: '작업이 없습니다' });
+            return;
+        }
+        res.status(ok ? 200 : 409).json(job);
+    });
+    return r;
+}

package/server/src/routes/favorites.js

@@ -0,0 +1,61 @@
+import { Router } from 'express';
+import { z } from 'zod';
+import { freshInstalls, freshness, TRUST_SCORE, trustTier } from "../search/rank.js";
+import { buildResultItem, githubSource, marketplaceSource, storeLookup } from "../search/result.js";
+const FavoriteBody = z.object({ id: z.string().min(1).max(400) });
+/**
+ * `name`: a search result not in the index yet (still being checked) is kept by it until it is. Unusable (empty,
+ * not text) it is left out rather than refused, so an indexed skill still gets its star.
+ */
+const FavoriteAdd = FavoriteBody.extend({ name: z.unknown().optional() });
+const usableName = (v) => (typeof v === 'string' && v.trim() ? v.trim().slice(0, 200) : undefined);
+/**
+ * This PC's favorite skills (user decision 2026-11-02). No accounts: the app runs for one person on 127.0.0.1, so a
+ * login kept only here protected nothing. The API's header and same-origin checks apply as everywhere.
+ */
+export function favoritesRouter(ctx) {
+    const r = Router();
+    const { store } = ctx;
+    r.get('/favorites/ids', (_req, res) => {
+        res.json({ ids: store.listFavorites().map((f) => f.skill_id) });
+    });
+    /** The favorites as result cards; ones whose skill left the index are listed by name. */
+    r.get('/favorites', (_req, res) => {
+        const lookup = storeLookup(store);
+        const items = [];
+        const gone = [];
+        for (const f of store.listFavorites()) {
+            const s = store.getSkill(f.skill_id);
+            if (!s) {
+                gone.push({ id: f.skill_id, name: f.skill_name });
+                continue;
+            }
+            const plugin = lookup.plugin(s.plugin_id);
+            const source = plugin ? marketplaceSource(s, plugin) : githubSource(s);
+            const breakdown = { R: 0, P: 0, F: freshness(s.last_commit_at), T: TRUST_SCORE[trustTier(s, plugin)] };
+            items.push(buildResultItem({ skill: s, lookup, sources: source ? [source] : [], installs: freshInstalls(s), stars: s.repo ? (store.getRepo(s.repo)?.stars ?? null) : null, breakdown, score: 0 }));
+        }
+        res.json({ items, gone });
+    });
+    r.post('/favorites', (req, res) => {
+        const parsed = FavoriteAdd.safeParse(req.body);
+        if (!parsed.success)
+            return void res.status(400).json({ error: '스킬 id가 없습니다' });
+        const skill = store.getSkill(parsed.data.id);
+        // not indexed: listed by name on the favorites page, as a card once the index has it
+        const name = skill?.name ?? usableName(parsed.data.name);
+        if (!name)
+            return void res.status(404).json({ error: '스킬을 찾을 수 없습니다' });
+        store.addFavorite(parsed.data.id, name);
+        res.json({ ok: true });
+    });
+    // the id in the address: some clients send no body with DELETE
+    r.delete('/favorites', (req, res) => {
+        const parsed = FavoriteBody.safeParse({ id: req.query.id });
+        if (!parsed.success)
+            return void res.status(400).json({ error: '스킬 id가 없습니다' });
+        store.removeFavorite(parsed.data.id);
+        res.json({ ok: true });
+    });
+    return r;
+}

package/server/src/routes/health.js

@@ -0,0 +1,27 @@
+import { Router } from 'express';
+import { SKILLS_CLI_VERSION } from "../config.js";
+import { claudeVersion } from "../claude/cli.js";
+import { updateInfo } from "../update.js";
+import { APP_VERSION } from "../version.js";
+export function healthRouter(ctx) {
+    const r = Router();
+    r.get('/health', async (_req, res) => {
+        res.json({
+            ok: true,
+            /** Fixed: the launcher tells this server from any other dev server answering /api/health on the port. */
+            app: 'skill-finder',
+            appVersion: APP_VERSION,
+            /** The server's process: `skill-finder stop` ends only the one its own pid file names. */
+            pid: process.pid,
+            /** A newer version on the download page (installed app only); the launcher installs it at the next start. */
+            update: updateInfo(APP_VERSION),
+            node: process.version,
+            claudeVersion: await claudeVersion(),
+            skillsCli: SKILLS_CLI_VERSION,
+            githubToken: !!ctx.config.githubToken,
+            plugins: ctx.store.countPlugins(),
+            skills: ctx.store.countSkills(),
+        });
+    });
+    return r;
+}

package/server/src/routes/install.js

@@ -0,0 +1,283 @@
+import { readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { Router } from 'express';
+import { z } from 'zod';
+import { buildSteps, planInstall } from "../install/plan.js";
+import { executeInstall } from "../install/run.js";
+import { existingSkillFolder, forgetPlugins, installedPluginCommits, listInstalledPlugins, pluginCommitKey, pluginIndexInfo, pluginSkills, scanInstalledSkills } from "../install/installed.js";
+import { uninstallPlugin, uninstallSkill } from "../install/uninstall.js";
+import { isProjectDir } from "../install/validate.js";
+import { getSettings } from "../settings.js";
+import { maskSecrets } from "../util/log.js";
+import { FolderPickerUnavailable, pickFolder } from "../util/folderPicker.js";
+import { ndjson } from "../util/ndjson.js";
+import { isPlainFolderName, resolveDroppedFolder } from "../util/resolveFolder.js";
+const Body = z.object({
+    id: z.string().min(1).max(500),
+    scope: z.enum(['user', 'project', 'local']),
+    projectPath: z.string().max(1000).optional(),
+    /**
+     * The same-name folder the confirm dialog showed as replaced. Only that folder may be replaced without another
+     * check: a dialog opened on an earlier preview (another scope or folder) names another one (review 2026-11-02).
+     */
+    overwrite: z.string().max(2000).optional(),
+});
+const UninstallBody = z.object({
+    kind: z.enum(['plugin', 'skill']),
+    /** plugin id (name@marketplace) or skill folder name */
+    id: z.string().min(1).max(300),
+    scope: z.enum(['user', 'project', 'local']),
+    projectPath: z.string().max(1000).optional(),
+});
+/** enabledPlugins[id] from the settings file that owns an install (user / project / local scope); null when unknown. */
+function enabledInSettings(id, scope, projectPath) {
+    const file = scope === 'user'
+        ? join(homedir(), '.claude', 'settings.json')
+        : scope === 'project' && projectPath
+            ? join(projectPath, '.claude', 'settings.json')
+            : scope === 'local' && projectPath
+                ? join(projectPath, '.claude', 'settings.local.json')
+                : null;
+    if (!file)
+        return null;
+    try {
+        const value = JSON.parse(readFileSync(file, 'utf8')).enabledPlugins?.[id];
+        return typeof value === 'boolean' ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+let installing = false;
+let picking = false;
+export function installRouter(ctx) {
+    const r = Router();
+    const { store } = ctx;
+    r.post('/install', async (req, res) => {
+        const parsed = Body.safeParse(req.body);
+        if (!parsed.success) {
+            res.status(400).json({ error: '요청 형식이 올바르지 않습니다' });
+            return;
+        }
+        const { id, scope } = parsed.data;
+        const projectPath = parsed.data.projectPath?.trim() || null;
+        const skill = store.getSkill(id);
+        if (!skill) {
+            res.status(404).json({ error: '스킬을 찾을 수 없습니다' });
+            return;
+        }
+        const plugin = skill.plugin_id ? (store.getPlugin(skill.plugin_id) ?? null) : null;
+        const plan = planInstall(skill, plugin, plugin ? (store.getMarketplace(plugin.marketplace) ?? null) : null);
+        if (plan.method === 'manual-only' || plan.disabled) {
+            res.status(400).json({ error: plan.reason ?? '앱에서 설치할 수 없는 스킬입니다' });
+            return;
+        }
+        if (!plan.scopes.includes(scope)) {
+            res.status(400).json({ error: '이 설치 방식에서 지원하지 않는 범위입니다' });
+            return;
+        }
+        if (scope !== 'user' && !isProjectDir(projectPath)) {
+            res.status(400).json({ error: '프로젝트 경로는 존재하는 디렉터리의 절대경로여야 합니다' });
+            return;
+        }
+        if (plan.method === 'skills-cli' && scope !== 'local') {
+            const existing = await existingSkillFolder(store, skill.id, plan.skillName, scope, projectPath);
+            if (existing && existing.same !== true && parsed.data.overwrite !== existing.path) {
+                res.status(409).json({ error: `${existing.path}에 같은 이름의 다른 스킬이 있습니다. 설치 확인 창에서 덮어쓰기를 확인한 뒤 다시 설치하세요.` });
+                return;
+            }
+        }
+        if (installing) {
+            res.status(409).json({ error: '다른 설치가 진행 중입니다' });
+            return;
+        }
+        installing = true;
+        const out = ndjson(res);
+        try {
+            const settings = getSettings(store);
+            const env = { ...process.env, ...(settings.telemetryDisabled ? { DISABLE_TELEMETRY: '1', DO_NOT_TRACK: '1' } : {}) };
+            const steps = buildSteps(plan, scope, projectPath);
+            const result = await executeInstall(plan, steps, (line, stream) => out.send({ type: 'log', line, stream: stream ?? 'stdout' }), env);
+            store.logInstall({
+                skill_id: skill.id,
+                plugin_id: plan.pluginId ?? null,
+                method: plan.method,
+                scope,
+                project_path: projectPath,
+                argv: result.argv,
+                exit_code: result.exitCode,
+                output: result.output,
+                ref: plan.pinnedRef ?? skill.ref,
+                skill_md_sha256: skill.skill_md_sha256,
+                risk_level: skill.risk_level,
+            });
+            forgetPlugins();
+            let message = result.message;
+            if (result.ok) {
+                store.logEvent('install', skill.id, null);
+                // a plugin cannot be pinned: say when Claude Code fetched another commit than the one checked (UI debate 3-3)
+                if (plan.method === 'plugin' && plan.pluginId) {
+                    const info = pluginIndexInfo(store, plan.pluginId, installedPluginCommits().get(pluginCommitKey(plan.pluginId, scope, projectPath)));
+                    if (info.change === 'changed')
+                        message += ' 설치된 커밋이 위험 검사를 한 커밋과 다릅니다. 설치됨 화면에서 위험 등급을 다시 확인하세요.';
+                }
+            }
+            out.send({ type: 'result', ok: result.ok, exitCode: result.exitCode, message });
+        }
+        catch (err) {
+            out.send({ type: 'result', ok: false, exitCode: -1, message: `실행 실패: ${String(err.message ?? err).slice(0, 200)}` });
+        }
+        finally {
+            installing = false;
+            out.end();
+        }
+    });
+    // What the app ran: installs and removals with their result and output (review 2026-11-02), to find why one
+    // failed without the console. Output masked like the log file and cut to 4,000 characters.
+    r.get('/install/log', (_req, res) => {
+        res.json({
+            entries: store.listInstallLog(50).map((e) => ({
+                id: e.id,
+                at: e.created_at,
+                method: e.method,
+                scope: e.scope,
+                projectPath: e.project_path,
+                target: e.plugin_id ?? e.skill_id,
+                ok: e.exit_code === 0,
+                output: maskSecrets(e.output ?? '').slice(-4000),
+            })),
+        });
+    });
+    // Whether an install or removal is running: the page asks when its result stream ended without a result
+    // (project review F4), to say "still installing" or "check the 설치됨 screen".
+    r.get('/install/status', (_req, res) => {
+        res.json({ installing });
+    });
+    r.post('/uninstall', async (req, res) => {
+        const parsed = UninstallBody.safeParse(req.body);
+        if (!parsed.success) {
+            res.status(400).json({ error: '요청 형식이 올바르지 않습니다' });
+            return;
+        }
+        const b = parsed.data;
+        const projectPath = b.projectPath?.trim() || null;
+        if (b.scope !== 'user' && !isProjectDir(projectPath)) {
+            res.status(400).json({ error: '프로젝트 범위는 존재하는 프로젝트 폴더가 필요합니다' });
+            return;
+        }
+        if (installing) {
+            res.status(409).json({ error: '다른 설치·삭제가 진행 중입니다' });
+            return;
+        }
+        installing = true;
+        try {
+            let result;
+            if (b.kind === 'plugin') {
+                result = await uninstallPlugin(b.id, b.scope, projectPath);
+            }
+            else {
+                if (b.scope === 'local') {
+                    res.status(400).json({ error: '스킬에는 로컬 범위가 없습니다' });
+                    return;
+                }
+                const settings = getSettings(store);
+                const env = { ...process.env, ...(settings.telemetryDisabled ? { DISABLE_TELEMETRY: '1', DO_NOT_TRACK: '1' } : {}) };
+                result = await uninstallSkill(b.id, b.scope, projectPath, env);
+            }
+            store.logInstall({
+                skill_id: b.kind === 'skill' ? b.id : null,
+                plugin_id: b.kind === 'plugin' ? b.id : null,
+                method: `uninstall-${b.kind}`,
+                scope: b.scope,
+                project_path: projectPath,
+                argv: [],
+                exit_code: result.ok ? 0 : 1,
+                output: result.output,
+            });
+            forgetPlugins();
+            res.status(result.ok ? 200 : 500).json(result.ok ? { ok: true, message: result.message } : { error: result.message });
+        }
+        catch (err) {
+            res.status(500).json({ error: `삭제 실패: ${String(err.message ?? err).slice(0, 200)}` });
+        }
+        finally {
+            installing = false;
+        }
+    });
+    r.post('/pick-folder', async (req, res) => {
+        if (picking) {
+            res.status(409).json({ error: '폴더 선택 창이 이미 열려 있습니다' });
+            return;
+        }
+        picking = true;
+        try {
+            const initial = typeof req.body?.initial === 'string' ? req.body.initial : null;
+            res.json({ path: await pickFolder(initial) });
+        }
+        catch (err) {
+            res.status(500).json({ error: err instanceof FolderPickerUnavailable ? err.message : '폴더 선택 창을 열지 못했습니다' });
+        }
+        finally {
+            picking = false;
+        }
+    });
+    // Drag & drop: the browser only knows the dropped folder's name and contents; find its absolute path.
+    const DropBody = z.object({ name: z.string().min(1).max(255), entries: z.array(z.string().max(255)).max(200) });
+    r.post('/resolve-folder', (req, res) => {
+        const parsed = DropBody.safeParse(req.body);
+        if (!parsed.success || !isPlainFolderName(parsed.data.name)) {
+            res.status(400).json({ error: '폴더 이름이 올바르지 않습니다' });
+            return;
+        }
+        const hints = [getSettings(ctx.store).defaultProjectPath].filter(Boolean);
+        res.json({ matches: resolveDroppedFolder(parsed.data.name, parsed.data.entries, hints) });
+    });
+    r.get('/installed', async (req, res) => {
+        const projectPath = typeof req.query.projectPath === 'string' && req.query.projectPath.trim() ? req.query.projectPath.trim() : null;
+        if (projectPath && !isProjectDir(projectPath)) {
+            res.status(400).json({ error: '프로젝트 경로는 존재하는 디렉터리의 절대경로여야 합니다' });
+            return;
+        }
+        const listed = await listInstalledPlugins(projectPath ?? homedir(), true);
+        const commits = installedPluginCommits();
+        const plugins = listed.plugins.map((o) => {
+            const { scope, id: pid } = o;
+            const ownProject = o.projectPath;
+            // `claude plugin list` reports enabled for the folder it runs in; read the settings file that owns this install instead.
+            const fromSettings = enabledInSettings(pid, scope, ownProject);
+            return {
+                id: pid,
+                version: o.version,
+                scope,
+                enabled: fromSettings ?? o.enabled ?? null,
+                enabledWhere: scope === 'user' ? '모든 프로젝트' : scope === 'project' || scope === 'local' ? ownProject : null,
+                installPath: o.installPath,
+                projectPath: ownProject,
+                removeCommand: ['user', 'project', 'local'].includes(scope) ? `claude plugin uninstall ${pid} --scope ${scope}` : null,
+                ...pluginIndexInfo(store, pid, commits.get(pluginCommitKey(pid, scope, ownProject))),
+                skills: pluginSkills(store, pid),
+            };
+        });
+        const skills = [
+            ...(await scanInstalledSkills(store, 'user', null)),
+            ...(projectPath ? await scanInstalledSkills(store, 'project', projectPath) : []),
+        ];
+        res.json({ plugins, pluginError: listed.error, skills, projects: store.listInstalledProjects() });
+    });
+    // What is installed, by index id, for the "설치됨" badges on results (UI debate 3-1). Project skills are those of
+    // the default project folder in the settings. Unknown ones are simply absent: no badge, never "not installed".
+    r.get('/installed/ids', async (_req, res) => {
+        const project = getSettings(store).defaultProjectPath;
+        const listed = await listInstalledPlugins();
+        const skills = [
+            ...(await scanInstalledSkills(store, 'user', null)),
+            ...(isProjectDir(project) ? await scanInstalledSkills(store, 'project', project) : []),
+        ];
+        res.json({
+            plugins: listed.plugins.map((p) => ({ id: p.id, scope: p.scope })),
+            skills: skills.filter((s) => s.skillId).map((s) => ({ id: s.skillId, scope: s.scope })),
+        });
+    });
+    return r;
+}

package/server/src/routes/presets.js

@@ -0,0 +1,66 @@
+import { Router } from 'express';
+import { z } from 'zod';
+import { installSummary } from "../install/summary.js";
+import { isRepo } from "../install/validate.js";
+import { storeLookup } from "../search/result.js";
+import { withTimeout } from "../util/limiter.js";
+// A team preset is a file a teammate exported (설치됨 → 팀 프리셋 내보내기): skill ids from their index and plugin
+// ids. It is untrusted input, so it only names things to look up here: what gets installed is this PC's indexed
+// skill, risk-checked here, through the usual confirm dialog and /install (user decision 2026-11-02).
+const Item = z.object({
+    id: z.string().max(400).optional(),
+    plugin: z.string().max(200).optional(),
+    name: z.string().max(200).optional(),
+});
+const Body = z.object({ items: z.array(Item).max(200) });
+/** GitHub repos to read before resolving: at most this many, each for at most REPO_WAIT_MS. */
+const MAX_NEW_REPOS = 5;
+const REPO_WAIT_MS = 10_000;
+const repoOfId = (id) => id.match(/^gh:([^:]+):/)?.[1] ?? null;
+export function presetsRouter(ctx) {
+    const r = Router();
+    const { store } = ctx;
+    r.post('/presets/resolve', async (req, res) => {
+        const parsed = Body.safeParse(req.body);
+        if (!parsed.success) {
+            res.status(400).json({ error: '프리셋 형식이 맞지 않습니다' });
+            return;
+        }
+        const items = parsed.data.items;
+        // skills from GitHub repos this PC has not indexed yet: read a few of them now, as a repo-name search does
+        const newRepos = [...new Set(items.flatMap((i) => (i.id && !store.getSkill(i.id) ? [repoOfId(i.id)] : [])))]
+            .filter((r) => isRepo(r))
+            .slice(0, MAX_NEW_REPOS);
+        await Promise.all(newRepos.map((repo) => withTimeout(ctx.indexer.indexRepo(repo), REPO_WAIT_MS).catch(() => null)));
+        const lookup = storeLookup(store);
+        const skills = [];
+        const missing = [];
+        const seen = new Set();
+        for (const it of items) {
+            const label = it.name ?? it.id ?? it.plugin ?? '?';
+            let skill = it.id ? (store.getSkill(it.id) ?? null) : null;
+            // a plugin installs whole, through any of its skills
+            if (!skill && it.plugin)
+                skill = store.listSkillsByPlugin(it.plugin)[0] ?? null;
+            if (!skill) {
+                missing.push({ name: label, reason: it.plugin ? '이 PC에서 그 플러그인의 스킬을 아직 색인하지 못했습니다' : '이 PC의 색인에 없습니다' });
+                continue;
+            }
+            const plugin = lookup.plugin(skill.plugin_id);
+            const key = plugin ? `plugin:${plugin.id}` : skill.id;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            const row = installSummary(skill, lookup, plugin ? `${plugin.name} (플러그인)` : skill.name);
+            if (plugin) {
+                // the whole plugin installs: its riskiest skill and every signal of its skills, so the dialog asks for the
+                // tick a high-risk skill inside needs (review 2026-11-02)
+                row.riskLevel = lookup.pluginTopRisk(plugin.id);
+                row.riskFlags = [...new Set(store.listSkillsByPlugin(plugin.id).flatMap((s) => (s.risk_json ? JSON.parse(s.risk_json) : [])))];
+            }
+            skills.push(row);
+        }
+        res.json({ skills, missing });
+    });
+    return r;
+}