@swarmclawai/swarmclaw 0.7.7 → 0.8.0

package/src/lib/server/skills-normalize.ts

@@ -1,4 +1,5 @@
 import path from 'path'
+import type { SkillInstallOption, SkillRequirements, SkillSecuritySummary } from '@/types'
 
 export type SkillSourceFormat = 'openclaw' | 'plain'
 
@@ -8,6 +9,19 @@ type NormalizeSkillInput = {
   filename?: unknown
   content?: unknown
   sourceUrl?: unknown
+  sourceFormat?: unknown
+  author?: unknown
+  tags?: unknown
+  version?: unknown
+  homepage?: unknown
+  primaryEnv?: unknown
+  skillKey?: unknown
+  always?: unknown
+  installOptions?: unknown
+  skillRequirements?: unknown
+  detectedEnvVars?: unknown
+  security?: unknown
+  frontmatter?: unknown
 }
 
 export type NormalizedSkill = {
@@ -17,6 +31,23 @@ export type NormalizedSkill = {
   content: string
   sourceUrl?: string
   sourceFormat: SkillSourceFormat
+  author?: string
+  tags?: string[]
+  version?: string
+  homepage?: string
+  primaryEnv?: string | null
+  skillKey?: string | null
+  always?: boolean
+  installOptions?: SkillInstallOption[]
+  skillRequirements?: SkillRequirements
+  detectedEnvVars?: string[]
+  security?: SkillSecuritySummary | null
+  frontmatter?: Record<string, unknown> | null
+}
+
+type ParsedFrontmatter = {
+  frontmatter: Record<string, unknown>
+  body: string
 }
 
 function asTrimmedString(value: unknown): string | null {
@@ -25,8 +56,30 @@ function asTrimmedString(value: unknown): string | null {
   return trimmed.length > 0 ? trimmed : null
 }
 
+function asStringArray(value: unknown): string[] | undefined {
+  if (!Array.isArray(value)) return undefined
+  const items = value
+    .map((item) => asTrimmedString(item))
+    .filter((item): item is string => Boolean(item))
+  return items.length ? items : undefined
+}
+
+function asBoolean(value: unknown): boolean | undefined {
+  if (typeof value === 'boolean') return value
+  if (typeof value === 'string') {
+    if (value.trim().toLowerCase() === 'true') return true
+    if (value.trim().toLowerCase() === 'false') return false
+  }
+  return undefined
+}
+
+function asObject(value: unknown): Record<string, unknown> | null {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return null
+  return value as Record<string, unknown>
+}
+
 function stripQuotes(value: string): string {
-  if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) {
+  if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith('\'') && value.endsWith('\''))) {
     return value.slice(1, -1)
   }
   return value
@@ -47,26 +100,6 @@ function sanitizeFilename(input: string): string {
   return safe.toLowerCase().endsWith('.md') ? safe : `${safe}.md`
 }
 
-function parseFrontmatterBlock(content: string): { frontmatter: Record<string, string>; body: string } | null {
-  const match = content.match(/^\s*---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/)
-  if (!match) return null
-  const rawFrontmatter = match[1]
-  const body = match[2] || ''
-
-  const frontmatter: Record<string, string> = {}
-  for (const rawLine of rawFrontmatter.split(/\r?\n/)) {
-    const line = rawLine.trim()
-    if (!line || line.startsWith('#')) continue
-    const idx = line.indexOf(':')
-    if (idx === -1) continue
-    const key = line.slice(0, idx).trim().toLowerCase()
-    const value = stripQuotes(line.slice(idx + 1).trim())
-    if (key) frontmatter[key] = value
-  }
-
-  return { frontmatter, body }
-}
-
 function deriveNameFromFilename(filename: string): string {
   return filename
     .replace(/\.md$/i, '')
@@ -89,15 +122,285 @@ function deriveFilenameFromUrl(url: string): string | null {
   }
 }
 
+function parseInlineArray(value: string): unknown[] {
+  const inner = value.slice(1, -1).trim()
+  if (!inner) return []
+  return inner
+    .split(',')
+    .map((part) => parseScalar(part.trim()))
+}
+
+function parseScalar(value: string): unknown {
+  const trimmed = value.trim()
+  if (!trimmed) return ''
+  if ((trimmed.startsWith('"') && trimmed.endsWith('"')) || (trimmed.startsWith('\'') && trimmed.endsWith('\''))) {
+    return stripQuotes(trimmed)
+  }
+  if (trimmed.startsWith('[') && trimmed.endsWith(']')) {
+    return parseInlineArray(trimmed)
+  }
+  if (/^(true|false)$/i.test(trimmed)) return trimmed.toLowerCase() === 'true'
+  if (/^(null|~)$/i.test(trimmed)) return null
+  if (/^-?\d+(?:\.\d+)?$/.test(trimmed)) return Number(trimmed)
+  return trimmed
+}
+
+function nextNestedContainer(lines: string[], start: number, currentIndent: number): Record<string, unknown> | unknown[] {
+  for (let index = start + 1; index < lines.length; index += 1) {
+    const raw = lines[index]
+    const trimmed = raw.trim()
+    if (!trimmed || trimmed.startsWith('#')) continue
+    const indent = raw.match(/^\s*/)?.[0]?.length || 0
+    if (indent <= currentIndent) break
+    return trimmed.startsWith('- ') ? [] : {}
+  }
+  return {}
+}
+
+function parseFrontmatterData(rawFrontmatter: string): Record<string, unknown> {
+  const lines = rawFrontmatter.split(/\r?\n/)
+  const root: Record<string, unknown> = {}
+  const stack: Array<{ indent: number; value: Record<string, unknown> | unknown[] }> = [{ indent: -1, value: root }]
+
+  for (let index = 0; index < lines.length; index += 1) {
+    const rawLine = lines[index]
+    const trimmed = rawLine.trim()
+    if (!trimmed || trimmed.startsWith('#')) continue
+    const indent = rawLine.match(/^\s*/)?.[0]?.length || 0
+
+    while (stack.length > 1 && indent <= stack[stack.length - 1].indent) {
+      stack.pop()
+    }
+
+    const parent = stack[stack.length - 1]?.value
+    if (!parent) continue
+
+    if (trimmed.startsWith('- ')) {
+      if (!Array.isArray(parent)) continue
+      const rest = trimmed.slice(2).trim()
+      if (!rest) {
+        const container = nextNestedContainer(lines, index, indent)
+        parent.push(container)
+        stack.push({ indent, value: container })
+        continue
+      }
+
+      const objectItemMatch = rest.match(/^([A-Za-z0-9_.-]+):\s*(.*)$/)
+      if (objectItemMatch) {
+        const [, key, rawValue] = objectItemMatch
+        const objectItem: Record<string, unknown> = {}
+        if (rawValue.trim()) {
+          objectItem[key] = parseScalar(rawValue)
+          parent.push(objectItem)
+          stack.push({ indent, value: objectItem })
+        } else {
+          const container = nextNestedContainer(lines, index, indent)
+          objectItem[key] = container
+          parent.push(objectItem)
+          stack.push({ indent, value: objectItem })
+          stack.push({ indent: indent + 1, value: container })
+        }
+        continue
+      }
+
+      parent.push(parseScalar(rest))
+      continue
+    }
+
+    if (Array.isArray(parent)) continue
+
+    const keyMatch = trimmed.match(/^([A-Za-z0-9_.-]+):\s*(.*)$/)
+    if (!keyMatch) continue
+    const [, key, rawValue] = keyMatch
+    if (rawValue.trim()) {
+      parent[key] = parseScalar(rawValue)
+      continue
+    }
+    const container = nextNestedContainer(lines, index, indent)
+    parent[key] = container
+    stack.push({ indent, value: container })
+  }
+
+  return root
+}
+
+function parseFrontmatterBlock(content: string): ParsedFrontmatter | null {
+  const match = content.match(/^\s*---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/)
+  if (!match) return null
+  const rawFrontmatter = match[1]
+  const body = match[2] || ''
+  return {
+    frontmatter: parseFrontmatterData(rawFrontmatter),
+    body,
+  }
+}
+
+function normalizeInstallOptions(value: unknown): SkillInstallOption[] | undefined {
+  if (!Array.isArray(value)) return undefined
+  const normalized: SkillInstallOption[] = value.flatMap((entry) => {
+      const row = asObject(entry)
+      if (!row) return []
+      const kind = asTrimmedString(row.kind)
+      const label = asTrimmedString(row.label)
+        || asTrimmedString(row.formula)
+        || asTrimmedString(row.package)
+        || asTrimmedString(row.url)
+      if (!kind || !label) return []
+      if (!['brew', 'node', 'go', 'uv', 'download'].includes(kind)) return []
+      return [{
+        kind: kind as SkillInstallOption['kind'],
+        label,
+        bins: asStringArray(row.bins),
+      } satisfies SkillInstallOption]
+    })
+  return normalized.length ? normalized : undefined
+}
+
+function normalizeRequirements(value: unknown): SkillRequirements | undefined {
+  const source = asObject(value)
+  if (!source) return undefined
+  const requires = asObject(source.requires) || source
+  const anyBins = Array.isArray(requires.anyBins)
+    ? requires.anyBins
+        .map((group) => asStringArray(group) || [])
+        .filter((group) => group.length > 0)
+    : undefined
+  const normalized: SkillRequirements = {
+    bins: asStringArray(requires.bins),
+    anyBins,
+    env: asStringArray(requires.env),
+    config: asStringArray(requires.config),
+    os: asStringArray(source.os ?? requires.os),
+  }
+  if (!normalized.bins && !normalized.anyBins && !normalized.env && !normalized.config && !normalized.os) {
+    return undefined
+  }
+  return normalized
+}
+
+function pickRuntimeMetadata(frontmatter: Record<string, unknown>): Record<string, unknown> | null {
+  const metadata = asObject(frontmatter.metadata)
+  if (metadata) {
+    const scoped = asObject(metadata.openclaw)
+      || asObject(metadata.clawdbot)
+      || asObject(metadata.clawdis)
+    if (scoped) return scoped
+  }
+  return asObject(frontmatter.openclaw)
+    || asObject(frontmatter.clawdbot)
+    || asObject(frontmatter.clawdis)
+}
+
+function uniqueStrings(values: string[]): string[] {
+  return Array.from(new Set(values.map((value) => value.trim()).filter(Boolean)))
+}
+
+function extractDetectedEnvVars(rawContent: string): string[] {
+  const detected = new Set<string>()
+  const patterns = [
+    /process\.env\.([A-Z][A-Z0-9_]+)/g,
+    /\$\{([A-Z][A-Z0-9_]+)\}/g,
+    /\bexport\s+([A-Z][A-Z0-9_]+)\b/g,
+  ]
+  for (const pattern of patterns) {
+    let match: RegExpExecArray | null
+    while ((match = pattern.exec(rawContent)) !== null) {
+      detected.add(match[1])
+    }
+  }
+  return [...detected].sort()
+}
+
+function extractInstallCommands(rawContent: string): string[] {
+  const commands: string[] = []
+  for (const line of rawContent.split(/\r?\n/)) {
+    const trimmed = line.trim()
+    if (!trimmed) continue
+    if (
+      /(brew install|npm install|pnpm add|yarn add|go install|uv tool install|curl .*\|\s*(?:bash|sh)|wget .*\|\s*(?:bash|sh))/i.test(trimmed)
+    ) {
+      commands.push(trimmed)
+    }
+  }
+  return uniqueStrings(commands).slice(0, 8)
+}
+
+function buildSkillSecuritySummary(params: {
+  rawContent: string
+  requirements?: SkillRequirements
+  installOptions?: SkillInstallOption[]
+  primaryEnv?: string | null
+}): SkillSecuritySummary | null {
+  const detectedEnvVars = extractDetectedEnvVars(params.rawContent)
+  const declaredEnv = new Set<string>([
+    ...(params.requirements?.env || []),
+    ...(params.primaryEnv ? [params.primaryEnv] : []),
+  ])
+  const missingDeclarations = detectedEnvVars.filter((name) => !declaredEnv.has(name))
+  const installCommands = extractInstallCommands(params.rawContent)
+  const notes: string[] = []
+
+  if (missingDeclarations.length) {
+    notes.push(`Detected env vars missing from frontmatter: ${missingDeclarations.join(', ')}`)
+  }
+  if (installCommands.length) {
+    notes.push('Skill content includes install instructions or executable bootstrap commands.')
+  }
+  if ((params.installOptions?.length || 0) > 0) {
+    notes.push('Skill declares install options that should be reviewed before enabling.')
+  }
+  if (/(curl .*\|\s*(?:bash|sh)|wget .*\|\s*(?:bash|sh)|sudo\s+)/i.test(params.rawContent)) {
+    notes.push('Skill content includes high-risk shell patterns.')
+  }
+
+  if (!notes.length && !detectedEnvVars.length && !installCommands.length) return null
+
+  const level: SkillSecuritySummary['level'] =
+    notes.some((note) => /high-risk|missing from frontmatter/i.test(note))
+      ? 'high'
+      : installCommands.length || detectedEnvVars.length
+        ? 'medium'
+        : 'low'
+
+  return {
+    level,
+    notes,
+    detectedEnvVars,
+    missingDeclarations,
+    installCommands,
+  }
+}
+
 export function normalizeSkillPayload(input: NormalizeSkillInput): NormalizedSkill {
   const rawContent = typeof input.content === 'string' ? input.content : ''
   const parsed = parseFrontmatterBlock(rawContent)
+  const preservedFrontmatter = asObject(input.frontmatter)
+  const frontmatter = parsed?.frontmatter || preservedFrontmatter || null
+  const runtimeMeta = frontmatter ? pickRuntimeMetadata(frontmatter) : null
 
-  const frontmatterName = asTrimmedString(parsed?.frontmatter?.name)
-  const frontmatterDescription = asTrimmedString(parsed?.frontmatter?.description)
+  const frontmatterName = asTrimmedString(frontmatter?.name)
+  const frontmatterDescription = asTrimmedString(frontmatter?.description)
+  const frontmatterAuthor = asTrimmedString(frontmatter?.author)
+  const frontmatterTags = asStringArray(frontmatter?.tags)
+  const version = asTrimmedString(frontmatter?.version)
+    || asTrimmedString(runtimeMeta?.version)
+    || asTrimmedString(input.version)
+  const homepage = asTrimmedString(runtimeMeta?.homepage)
+    || asTrimmedString(frontmatter?.homepage)
+    || asTrimmedString(input.homepage)
+  const primaryEnv = asTrimmedString(runtimeMeta?.primaryEnv)
+    || asTrimmedString(input.primaryEnv)
+    || null
+  const skillKey = asTrimmedString(runtimeMeta?.skillKey)
+    || asTrimmedString(input.skillKey)
+    || null
+  const always = asBoolean(runtimeMeta?.always) ?? asBoolean(input.always)
+  const installOptions = normalizeInstallOptions(runtimeMeta?.install)
+    || normalizeInstallOptions(input.installOptions)
+  const skillRequirements = normalizeRequirements(runtimeMeta)
+    || normalizeRequirements(input.skillRequirements)
 
   const sourceUrl = asTrimmedString(input.sourceUrl) || undefined
-
   const initialFilename = asTrimmedString(input.filename)
     || (sourceUrl ? deriveFilenameFromUrl(sourceUrl) : null)
     || (frontmatterName ? `${slugify(frontmatterName)}.md` : null)
@@ -112,10 +415,41 @@ export function normalizeSkillPayload(input: NormalizeSkillInput): NormalizedSki
     || frontmatterDescription
     || ''
 
-  // For OpenClaw SKILL.md, keep only body instructions when frontmatter exists.
+  const author = asTrimmedString(input.author)
+    || frontmatterAuthor
+    || undefined
+
+  const tags = asStringArray(input.tags)
+    || frontmatterTags
+    || undefined
+
   const normalizedContent = parsed ? parsed.body.trimStart() : rawContent
+  const detectedEnvVars = extractDetectedEnvVars(rawContent)
+  const preservedDetectedEnvVars = asStringArray(input.detectedEnvVars)
+  const generatedSecurity = buildSkillSecuritySummary({
+    rawContent,
+    requirements: skillRequirements,
+    installOptions,
+    primaryEnv,
+  })
+  const securityRecord = asObject(input.security)
+  const security = generatedSecurity || (securityRecord
+    ? {
+        level: securityRecord.level === 'high' || securityRecord.level === 'medium' ? securityRecord.level : 'low',
+        notes: asStringArray(securityRecord.notes) || [],
+        detectedEnvVars: asStringArray(securityRecord.detectedEnvVars),
+        missingDeclarations: asStringArray(securityRecord.missingDeclarations),
+        installCommands: asStringArray(securityRecord.installCommands),
+      } satisfies SkillSecuritySummary
+    : null)
 
-  const sourceFormat: SkillSourceFormat = parsed && (frontmatterName !== null || frontmatterDescription !== null || parsed.frontmatter.metadata)
+  const sourceFormat: SkillSourceFormat = (parsed && (
+    frontmatterName !== null
+    || frontmatterDescription !== null
+    || runtimeMeta !== null
+  ))
+    || input.sourceFormat === 'openclaw'
+    || preservedFrontmatter !== null
     ? 'openclaw'
     : 'plain'
 
@@ -126,5 +460,17 @@ export function normalizeSkillPayload(input: NormalizeSkillInput): NormalizedSki
     content: normalizedContent,
     sourceUrl,
     sourceFormat,
+    author,
+    tags,
+    version: version || undefined,
+    homepage: homepage || undefined,
+    primaryEnv,
+    skillKey,
+    always,
+    installOptions,
+    skillRequirements,
+    detectedEnvVars: detectedEnvVars.length ? detectedEnvVars : preservedDetectedEnvVars,
+    security,
+    frontmatter,
   }
 }