@weavecode/weave 0.0.0-stage → 0.1.0

package/node_modules/@weavecode/server/dist/index.d.ts

@@ -0,0 +1,99 @@
+/**
+ * @weavecode/server — Weave daemon.
+ *
+ * Data layer, HTTP server, and hook ingestion are implemented across the
+ * db/, repositories/, and daemon/ modules. This file re-exports the public
+ * surface.
+ */
+export { openDatabase } from './db/db.js';
+export { getDataDir, getDbPath, getDaemonStatePath, getAuthPath, getInitialPasswordPath } from './db/paths.js';
+export { ProjectRepository } from './repositories/projects.js';
+export type { ProjectRow, RegisterProjectInput } from './repositories/projects.js';
+export { HookEventRepository } from './repositories/hook-events.js';
+export type { HookEventInput, HookEventRow } from './repositories/hook-events.js';
+export { SessionRepository } from './repositories/sessions.js';
+export type { SessionRow } from './repositories/sessions.js';
+export { LibraryRepository } from './repositories/libraries.js';
+export type { LibraryRow } from './repositories/libraries.js';
+export { DEFAULT_PORT, DAEMON_HOST, isPortFree, findFreePort } from './daemon/port.js';
+export { readDaemonState, writeDaemonState, clearDaemonState } from './daemon/state.js';
+export type { DaemonState } from './daemon/state.js';
+export { generateToken } from './daemon/auth.js';
+export { createWeaveServer, weaveRequestHandler, DAEMON_VERSION } from './daemon/server.js';
+export type { WeaveServerDeps } from './daemon/server.js';
+export { accessUrls, lanIps, ensureDaemonCert, startTlsServer, daemonCertsDir } from './daemon/tls.js';
+export type { AccessUrl, DaemonCert, TlsListener } from './daemon/tls.js';
+export { readDaemonSettings, writeDaemonSettings, terminalPresetsFor, resolveLocale, DEFAULT_DAEMON_SETTINGS, SUPPORTED_LOCALES, DEFAULT_LOCALE, } from './daemon/settings.js';
+export type { DaemonSettings, TerminalSettings, TerminalPreset, TerminalPresetMeta, Locale } from './daemon/settings.js';
+export { resolveTerminalLaunch, resolveExplorerLaunch, openInExplorer, openInTerminal, runInTerminal, defaultProjectOpener, } from './daemon/opener.js';
+export type { ProjectOpener, TerminalLaunch } from './daemon/opener.js';
+export { resolveStaticDir } from './daemon/static.js';
+export { startDaemon } from './daemon/start.js';
+export { registerProject, unregisterProject } from './registry.js';
+export type { RegisterResult, UnregisterResult } from './registry.js';
+export { classifyAsset, normalizeRelPath } from './watch/classifier.js';
+export { WatchCache } from './watch/cache.js';
+export { WatchService } from './watch/watch-service.js';
+export type { WatchServiceOptions } from './watch/watch-service.js';
+export { SyncScheduler } from './watch/sync-scheduler.js';
+export type { SyncSchedulerOptions } from './watch/sync-scheduler.js';
+export type { AssetCategory, AssetEntry, AssetChangeKind, AssetChangeEvent } from './watch/types.js';
+export { ClaudeCodeAdapter } from './hooks/adapter.js';
+export type { HookAdapter } from './hooks/adapter.js';
+export type { HookReport, NormalizedHookPayload } from './hooks/types.js';
+export { drainInboxOnce, handleIngestedRecords } from './hooks/inbox-worker.js';
+export type { InboxRecord, InboxDrainDeps } from './hooks/inbox-worker.js';
+export { MirrorWriter, hooksRoot, hookShardId, appendOutbox } from './hooks/mirror.js';
+export type { HookMirrorDoc, MirrorRule } from './hooks/mirror.js';
+export { scanLibrarySkills, scanLibraryMcp, scanLibraryFileAssets } from './install/scanner.js';
+export type { SkillAsset, McpTemplate, FileAssetTemplate } from './install/scanner.js';
+export { FILE_ASSET_SPECS, FILE_ASSET_CATEGORIES, fileAssetTargetDir, isFileAssetCategory, } from './install/file-assets.js';
+export type { FileAssetCategory, FileAssetSpec } from './install/file-assets.js';
+export { installSkill, uninstallSkill, installFileAsset, uninstallFileAsset, installMcp, uninstallMcp, InstallConflictError, AssetNotFoundError, } from './install/installer.js';
+export type { McpServerConfig } from './install/installer.js';
+export { readMcpServers, readMcpJson } from './install/installer.js';
+export { codexConfigFile, readCodexMcpServers, writeCodexMcpServer, removeCodexMcpServer, codexMcpExists, readCodexMcpFromText, upsertCodexMcpInText, removeCodexMcpFromText, upsertCodexPluginEnabledInText, parseDottedKey, sectionHeaderKey, renderTomlHeader, renderTomlKey, renderTomlString, splitTomlSections, upsertTomlSection, removeTomlSection, parseSectionEntries, CodexTomlCorruptError, } from './install/codex-toml.js';
+export type { TomlSection } from './install/codex-toml.js';
+export { buildLibraryIndex, findSkillSource, findFileAssetSource } from './install/library-index.js';
+export type { SkillSource, LibraryIndex, FileAssetSource } from './install/library-index.js';
+export { hashSkillDir, maxMtimeDir, hashMcpConfig, hashFile, FingerprintCache } from './install/fingerprint.js';
+export type { FingerprintCacheEntry } from './install/fingerprint.js';
+export { projectFileNamespaces, projectPackFiles } from './hooks/toolkit.js';
+export { detectUpdates, detectSkillUpdates, detectFileAssetUpdates, detectProjectUpdateCounts, } from './install/updates.js';
+export type { SkillUpdate, McpUpdate, FileAssetUpdate, UpdateReport } from './install/updates.js';
+export { detectPluginTemplateUpdates } from './install/plugin-templates.js';
+export type { PluginTemplateUpdate, PluginTemplateCategory } from './install/plugin-templates.js';
+export { readProjectFile, resolveProjectFile, PathEscapeError, FileTooLargeError, } from './install/reader.js';
+export type { ProjectFile } from './install/reader.js';
+export { readGlobalClaudeJson, readGlobalMcpServers, writeGlobalMcpServer, removeGlobalMcpServer, readGlobalSkills, installGlobalSkill, uninstallGlobalSkill, ClaudeJsonCorruptError, globalPersonalSkillRoots, resolveGlobalSkillDir, listGlobalSkillFiles, readGlobalSkillFile, } from './install/global-config.js';
+export type { GlobalSkillSource, GlobalSkillEntry, GlobalSkillGroup, } from './install/global-config.js';
+export { readMcpEnableMap, setMcpEnableState } from './install/settings-mcp.js';
+export type { McpEnableState, McpEnableMap } from './install/settings-mcp.js';
+export { mcpOverrideOf, resolveMcpEffective, setMcpEnableOverride } from './install/settings-mcp.js';
+export { readMcpRows } from './install/mcp-rows.js';
+export type { McpToolRow } from './install/mcp-rows.js';
+export { readPluginRows } from './install/plugin-rows.js';
+export type { PluginToolRow } from './install/plugin-rows.js';
+export { installPluginPack } from './install/plugin-install.js';
+export { readProjectConfig, writeProjectConfig, markSynced, DEFAULT_PROJECT_CONFIG, } from './install/project-config.js';
+export type { ProjectConfig } from './install/project-config.js';
+export { applyUpdate, syncAll, refreshStatusline } from './install/apply-update.js';
+export type { ApplyUpdateInput } from './install/apply-update.js';
+export { DEFAULT_STATUSLINE_CONFIG, POWERLINE_DEFAULT_GLYPHS, SEGMENT_ORDER, LEGACY_IDENTITY_LINE, LEGACY_METRICS_LINE, NAMED_COLORS, SEGMENT_TOKENS, SEGMENT_DEFAULT_FORMAT, CONTEXT_STYLE_FORMAT, PLAIN_STATUSLINE_CONFIG, } from './statusline/config.js';
+export type { StatuslineConfig, StatuslinePowerline, StatuslineSegment, StatuslineColor, StatuslineNamedColor, StatuslineBar, SegmentKey, } from './statusline/config.js';
+export { WEAVE_VERSION } from './version.js';
+export { generateStatuslineScript, statuslineCacheDir } from './statusline/generator.js';
+export { StatuslineCacheSweeper, startStatuslineCacheSweeper } from './statusline/cache-sweeper.js';
+export { readStatuslineConfig, writeStatuslineConfig, readGlobalStatuslineConfig, writeGlobalStatuslineConfig, applyStatuslineConfig, ensureSettingsStatusLine, readStatuslineScript, } from './statusline/manager.js';
+/**
+ * Absolute path of the standalone daemon entry, resolved beside this module:
+ * the compiled `entry.js` when running from dist (production), the TS source
+ * under the `development` condition. Only the TS form needs tsx to spawn —
+ * published bundles carry no tsx.
+ */
+export declare function resolveDaemonEntry(): {
+    path: string;
+    isTs: boolean;
+};
+export { installPlugin, uninstallPlugin, exportPlugin, searchPlugins, globalPluginRoot, isGitSource, } from './hooks/plugin-installer.js';
+export type { InstallResult, PluginIndexEntry } from './hooks/plugin-installer.js';

package/node_modules/@weavecode/server/dist/index.js

@@ -0,0 +1 @@
+import{existsSync as o}from"node:fs";import{fileURLToPath as r}from"node:url";export{openDatabase}from"./db/db.js";export{getDataDir,getDbPath,getDaemonStatePath,getAuthPath,getInitialPasswordPath}from"./db/paths.js";export{ProjectRepository}from"./repositories/projects.js";export{HookEventRepository}from"./repositories/hook-events.js";export{SessionRepository}from"./repositories/sessions.js";export{LibraryRepository}from"./repositories/libraries.js";export{DEFAULT_PORT,DAEMON_HOST,isPortFree,findFreePort}from"./daemon/port.js";export{readDaemonState,writeDaemonState,clearDaemonState}from"./daemon/state.js";export{generateToken}from"./daemon/auth.js";export{createWeaveServer,weaveRequestHandler,DAEMON_VERSION}from"./daemon/server.js";export{accessUrls,lanIps,ensureDaemonCert,startTlsServer,daemonCertsDir}from"./daemon/tls.js";export{readDaemonSettings,writeDaemonSettings,terminalPresetsFor,resolveLocale,DEFAULT_DAEMON_SETTINGS,SUPPORTED_LOCALES,DEFAULT_LOCALE}from"./daemon/settings.js";export{resolveTerminalLaunch,resolveExplorerLaunch,openInExplorer,openInTerminal,runInTerminal,defaultProjectOpener}from"./daemon/opener.js";export{resolveStaticDir}from"./daemon/static.js";export{startDaemon}from"./daemon/start.js";export{registerProject,unregisterProject}from"./registry.js";export{classifyAsset,normalizeRelPath}from"./watch/classifier.js";export{WatchCache}from"./watch/cache.js";export{WatchService}from"./watch/watch-service.js";export{SyncScheduler}from"./watch/sync-scheduler.js";export{ClaudeCodeAdapter}from"./hooks/adapter.js";export{drainInboxOnce,handleIngestedRecords}from"./hooks/inbox-worker.js";export{MirrorWriter,hooksRoot,hookShardId,appendOutbox}from"./hooks/mirror.js";export{scanLibrarySkills,scanLibraryMcp,scanLibraryFileAssets}from"./install/scanner.js";export{FILE_ASSET_SPECS,FILE_ASSET_CATEGORIES,fileAssetTargetDir,isFileAssetCategory}from"./install/file-assets.js";export{installSkill,uninstallSkill,installFileAsset,uninstallFileAsset,installMcp,uninstallMcp,InstallConflictError,AssetNotFoundError}from"./install/installer.js";export{readMcpServers,readMcpJson}from"./install/installer.js";export{codexConfigFile,readCodexMcpServers,writeCodexMcpServer,removeCodexMcpServer,codexMcpExists,readCodexMcpFromText,upsertCodexMcpInText,removeCodexMcpFromText,upsertCodexPluginEnabledInText,parseDottedKey,sectionHeaderKey,renderTomlHeader,renderTomlKey,renderTomlString,splitTomlSections,upsertTomlSection,removeTomlSection,parseSectionEntries,CodexTomlCorruptError}from"./install/codex-toml.js";export{buildLibraryIndex,findSkillSource,findFileAssetSource}from"./install/library-index.js";export{hashSkillDir,maxMtimeDir,hashMcpConfig,hashFile,FingerprintCache}from"./install/fingerprint.js";export{projectFileNamespaces,projectPackFiles}from"./hooks/toolkit.js";export{detectUpdates,detectSkillUpdates,detectFileAssetUpdates,detectProjectUpdateCounts}from"./install/updates.js";export{detectPluginTemplateUpdates}from"./install/plugin-templates.js";export{readProjectFile,resolveProjectFile,PathEscapeError,FileTooLargeError}from"./install/reader.js";export{readGlobalClaudeJson,readGlobalMcpServers,writeGlobalMcpServer,removeGlobalMcpServer,readGlobalSkills,installGlobalSkill,uninstallGlobalSkill,ClaudeJsonCorruptError,globalPersonalSkillRoots,resolveGlobalSkillDir,listGlobalSkillFiles,readGlobalSkillFile}from"./install/global-config.js";export{readMcpEnableMap,setMcpEnableState}from"./install/settings-mcp.js";export{mcpOverrideOf,resolveMcpEffective,setMcpEnableOverride}from"./install/settings-mcp.js";export{readMcpRows}from"./install/mcp-rows.js";export{readPluginRows}from"./install/plugin-rows.js";export{installPluginPack}from"./install/plugin-install.js";export{readProjectConfig,writeProjectConfig,markSynced,DEFAULT_PROJECT_CONFIG}from"./install/project-config.js";export{applyUpdate,syncAll,refreshStatusline}from"./install/apply-update.js";export{DEFAULT_STATUSLINE_CONFIG,POWERLINE_DEFAULT_GLYPHS,SEGMENT_ORDER,LEGACY_IDENTITY_LINE,LEGACY_METRICS_LINE,NAMED_COLORS,SEGMENT_TOKENS,SEGMENT_DEFAULT_FORMAT,CONTEXT_STYLE_FORMAT,PLAIN_STATUSLINE_CONFIG}from"./statusline/config.js";export{WEAVE_VERSION}from"./version.js";export{generateStatuslineScript,statuslineCacheDir}from"./statusline/generator.js";export{StatuslineCacheSweeper,startStatuslineCacheSweeper}from"./statusline/cache-sweeper.js";export{readStatuslineConfig,writeStatuslineConfig,readGlobalStatuslineConfig,writeGlobalStatuslineConfig,applyStatuslineConfig,ensureSettingsStatusLine,readStatuslineScript}from"./statusline/manager.js";export function resolveDaemonEntry(){const e=r(new URL("./daemon/entry.js",import.meta.url));return o(e)?{path:e,isTs:!1}:{path:r(new URL("./daemon/entry.ts",import.meta.url)),isTs:!0}}export{installPlugin,uninstallPlugin,exportPlugin,searchPlugins,globalPluginRoot,isGitSource}from"./hooks/plugin-installer.js";

package/node_modules/@weavecode/server/dist/install/apply-update.d.ts

@@ -0,0 +1,40 @@
+import type { Harness } from '@weavecode/core';
+import { type LibraryIndex } from './library-index.js';
+import { FingerprintCache } from './fingerprint.js';
+import type { LibraryRow } from '../repositories/libraries.js';
+/**
+ * Apply updates — overwrite installed assets with their library sources.
+ *
+ * Update = destructive overwrite: the installed copy is removed and replaced
+ * with the current source content. Any local edits to the installed copy are
+ * lost. The UI must surface this clearly before invoking.
+ *
+ * Scope + agent are honoured:
+ *   project skill → `.claude/skills/` (claude) · `.codex/skills/` (codex)
+ *   user    skill → `~/.claude/skills/` (claude) · `~/.agents/skills/` (codex)
+ *   project mcp   → `.mcp.json`, user mcp → `~/.claude.json`
+ *   codex  mcp    → `~/.codex/config.toml` (agent: 'codex')
+ *   file assets   → the kind's project dir (see file-assets.ts)
+ */
+export interface ApplyUpdateInput {
+    category: 'skill' | 'mcp' | 'command' | 'agent' | 'workflow' | 'rule' | 'output-style';
+    name: string;
+    scope: 'project' | 'user';
+    /** Which agent's surface to refresh (skills + codex MCP matter). */
+    agent?: Harness;
+}
+/** Overwrite one installed asset from its library source. */
+export declare function applyUpdate(projectPath: string, input: ApplyUpdateInput, index?: LibraryIndex, libraries?: LibraryRow[]): Promise<void>;
+/**
+ * Sync every outdated, non-custom asset in a project. Returns a summary of what
+ * was updated. Skills and MCP entries with no library source are skipped.
+ */
+export declare function syncAll(projectPath: string, libraries: LibraryRow[], cache: FingerprintCache, index?: LibraryIndex): Promise<{
+    updated: ApplyUpdateInput[];
+    skipped: number;
+}>;
+/**
+ * Re-apply the statusline config (regenerates the script + settings entry).
+ * Used when weave itself upgrades and the generator output changes.
+ */
+export declare function refreshStatusline(projectPath: string): Promise<void>;

package/node_modules/@weavecode/server/dist/install/apply-update.js

@@ -0,0 +1 @@
+import{rm as l,cp as u,mkdir as w}from"node:fs/promises";import{homedir as g}from"node:os";import p from"node:path";import{installMcp as d,uninstallMcp as S}from"./installer.js";import{writeGlobalMcpServer as h}from"./global-config.js";import{writeCodexMcpServer as k}from"./codex-toml.js";import{applyStatuslineConfig as b}from"../statusline/manager.js";import{readStatuslineConfig as x}from"../statusline/manager.js";import{buildLibraryIndex as f,findSkillSource as C,findMcpSource as E,findFileAssetSource as M}from"./library-index.js";import{detectUpdates as $}from"./updates.js";import{materializePluginTemplate as v}from"./plugin-templates.js";import{FILE_ASSET_SPECS as A,fileAssetTargetDir as j,isFileAssetCategory as F}from"./file-assets.js";import{assetSurfaceFor as y}from"../surfaces.js";export async function applyUpdate(t,a,m,c){const s=m??(c?await f(c):await f([])),o=a.agent??"claude";if(a.category==="skill"){const e=C(s,a.name);if(!e)throw new Error(`No library source for skill "${a.name}"`);const n=a.scope==="user"?y(o).globalSkillsRoots(g())[0]:p.join(t,...y(o).projectSkillsDir().split("/")),i=p.join(n,a.name);await l(i,{recursive:!0,force:!0}),await u(e.dirPath,i,{recursive:!0});return}if(F(a.category)){const e=M(s,a.category,a.name);if(!e)throw new Error(`No library source for ${a.category} "${a.name}"`);const n=j(a.category,o,a.scope,t,g());await w(n,{recursive:!0});const i=p.join(n,`${a.name}${A[a.category].ext}`);await l(i,{force:!0}),await u(e.filePath,i);return}const r=E(s,a.name);if(!r)throw new Error(`No library source for MCP "${a.name}"`);if(o==="codex"){await k(a.name,r.config);return}if(a.scope==="user")await h(a.name,r.config);else{try{await S(t,a.name)}catch{}await d(t,a.name,r.config)}}export async function syncAll(t,a,m,c){const s=c??await f(a),o=await $(t,a,m,s),r=[];for(const e of o.skills)e.custom||!e.outdated||(await applyUpdate(t,{category:"skill",name:e.name,scope:e.scope,agent:e.agent},s),r.push({category:"skill",name:e.name,scope:e.scope,agent:e.agent}));for(const e of o.mcp)e.custom||!e.outdated||(await applyUpdate(t,{category:"mcp",name:e.name,scope:e.scope,agent:e.agent},s),r.push({category:"mcp",name:e.name,scope:e.scope,agent:e.agent}));for(const e of o.files)e.custom||!e.outdated||(await applyUpdate(t,{category:e.category,name:e.name,scope:e.scope},s),r.push({category:e.category,name:e.name,scope:e.scope}));for(const e of o.pluginTemplates)e.outdated&&(await v(e),r.push({category:e.category,name:e.name,scope:"project"}));return{updated:r,skipped:0}}export async function refreshStatusline(t){const a=await x(t);await b(t,a)}

package/node_modules/@weavecode/server/dist/install/capabilities.d.ts

@@ -0,0 +1,22 @@
+import { type Harness } from '@weavecode/core';
+import { type FileAssetCategory } from './file-assets.js';
+/** 安装范围（与 InstallBody.scope 同形；`user` = 个人全局配置面）。 */
+export type InstallScope = 'project' | 'user';
+/** 可安装资产类别（skill / mcp + 5 类单文件资产）。 */
+export type InstallCategory = 'skill' | 'mcp' | FileAssetCategory;
+/** 单个 harness 面的可用范围；无该面 = 该 harness 不支持此类别。 */
+export interface CategorySurface {
+    harness: Harness;
+    scopes: InstallScope[];
+    /** 各 scope 的安装落点（显示形：项目内相对路径 posix 原样、用户级以 `~`
+     *  缩写）——web 的范围落点提示按此渲染，不自拼 harness 路径（§6-4）。 */
+    dest?: Partial<Record<InstallScope, string>>;
+}
+export interface CategoryCapability {
+    surfaces: CategorySurface[];
+}
+/** `GET /capabilities` 响应体（web 镜像于 api.ts，唯一事实源在这里）。 */
+export interface InstallCapabilities {
+    categories: Record<InstallCategory, CategoryCapability>;
+}
+export declare function installCapabilities(): InstallCapabilities;

package/node_modules/@weavecode/server/dist/install/capabilities.js

@@ -0,0 +1 @@
+import i from"node:path";import{homedir as l}from"node:os";import{HARNESS_KEYS as f}from"@weavecode/core";import{FILE_ASSET_SPECS as m,FILE_ASSET_CATEGORIES as S}from"./file-assets.js";import{assetSurfaces as a}from"../surfaces.js";function u(t,c){return i.join("~",i.relative(c,t)).split(i.sep).join("/")}export function installCapabilities(){const t=l(),c={};for(const s of S){const r=m[s].dirs,e=[];for(const o of f){const n=r[o];if(!n)continue;const p=[];n.project&&p.push("project"),n.user&&p.push("user"),p.length>0&&e.push({harness:o,scopes:p})}c[s]={surfaces:e}}return c.skill={surfaces:a().map(s=>{const r=[],e={};s.projectSkillsDir()&&(r.push("project"),e.project=s.projectSkillsDir());const o=s.globalSkillsRoots(t)[0];return o&&(r.push("user"),e.user=u(o,t)),{harness:s.harness,scopes:r,dest:e}})},c.mcp={surfaces:a().map(s=>{const r={},e=s.mcpDest("project",t),o=s.mcpDest("user",t);return e&&(r.project=e),o&&(r.user=u(o,t)),{harness:s.harness,scopes:s.mcpScopes(),dest:r}}).filter(s=>s.scopes.length>0)},{categories:c}}

package/node_modules/@weavecode/server/dist/install/codex-toml.d.ts

@@ -0,0 +1,39 @@
+import type { McpServerConfig } from './installer.js';
+/**
+ * Codex config.toml 的 **fs 侧**（路径解析 + MCP servers 表示法）。
+ *
+ * 行级增量编辑器（纯文本层）已下沉 @weavecode/harness 的 `codex/toml.ts`
+ * （P2 专属格式下沉）；本模块原位置 re-export 下沉符号，存量 import 零改动。
+ * MCP 表示法的下沉留后续批次（其类型 McpServerConfig 仍住 server）。
+ */
+export { CodexTomlCorruptError, parseDottedKey, sectionHeaderKey, renderTomlKey, renderTomlHeader, renderTomlString, splitTomlSections, upsertTomlSection, removeTomlSection, parseSectionEntries, upsertCodexPluginEnabledInText, } from '@weavecode/harness';
+export type { TomlSection } from '@weavecode/harness';
+/** Absolute path of the Codex user config (`~/.codex/config.toml`),
+ * respecting the test override. 批 4a：路径本体在 AssetSurface（`userConfigFile`）。 */
+export declare function codexConfigFile(home?: string): string;
+/** Read the `mcp_servers` map from config.toml text (empty when absent or
+ * unparseable). stdio servers only — entries without a `command` (e.g. remote
+ * url servers) are skipped. */
+export declare function readCodexMcpFromText(text: string): Record<string, McpServerConfig>;
+/** Insert or replace an `[mcp_servers.<name>]` entry in config.toml text,
+ * preserving everything else. Merge-validated: if preserving user-added keys
+ * produces invalid TOML, the section is written clean instead. */
+export declare function upsertCodexMcpInText(text: string, name: string, config: McpServerConfig): string;
+/** Remove an `[mcp_servers.<name>]` entry (with its sub-sections) from
+ * config.toml text. Returns whether a section was removed. */
+export declare function removeCodexMcpFromText(text: string, name: string): {
+    text: string;
+    removed: boolean;
+};
+export declare function setCodexConfigFileOverride(file: string | null): void;
+/** Read MCP servers from `~/.codex/config.toml` (empty when absent/corrupt). */
+export declare function readCodexMcpServers(file?: string): Promise<Record<string, McpServerConfig>>;
+/** Whether an `[mcp_servers.<name>]` section exists (cheap line-level check). */
+export declare function codexMcpExists(name: string, file?: string): Promise<boolean>;
+/** Insert or replace an MCP server in `~/.codex/config.toml`. Refuses to
+ * write a file that does not parse (protects the user's hand-written config);
+ * creates the file when absent. */
+export declare function writeCodexMcpServer(name: string, config: McpServerConfig, file?: string): Promise<void>;
+/** Remove an MCP server section from `~/.codex/config.toml`. Returns whether
+ * a section was removed (false = was not configured). */
+export declare function removeCodexMcpServer(name: string, file?: string): Promise<boolean>;

package/node_modules/@weavecode/server/dist/install/codex-toml.js

@@ -0,0 +1 @@
+import{readFile as p,writeFile as x,access as C,mkdir as M}from"node:fs/promises";import{homedir as $}from"node:os";import b from"node:path";import{parse as m}from"smol-toml";import{assetSurfaceFor as E}from"../surfaces.js";import{CodexTomlCorruptError as l,parseSectionEntries as w,removeTomlSection as j,renderTomlHeader as A,renderTomlKey as F,renderTomlString as d,sameKey as y,splitTomlSections as v,upsertTomlSection as h}from"@weavecode/harness";export{CodexTomlCorruptError,parseDottedKey,sectionHeaderKey,renderTomlKey,renderTomlHeader,renderTomlString,splitTomlSections,upsertTomlSection,removeTomlSection,parseSectionEntries,upsertCodexPluginEnabledInText}from"@weavecode/harness";export function codexConfigFile(r=$()){return S??E("codex").userConfigFile(r)}export function readCodexMcpFromText(r){let e;try{e=m(r)}catch{return{}}const n=e.mcp_servers;if(!n||typeof n!="object"||Array.isArray(n))return{};const t={};for(const[s,o]of Object.entries(n)){const c=O(o);c&&(t[s]=c)}return t}function O(r){if(!r||typeof r!="object"||Array.isArray(r))return null;const e=r;if(typeof e.command!="string")return null;const n={command:e.command};if(Array.isArray(e.args)){const t=e.args.filter(s=>typeof s=="string");t.length>0&&(n.args=t)}if(e.env&&typeof e.env=="object"&&!Array.isArray(e.env)){const t={};for(const[s,o]of Object.entries(e.env))typeof o=="string"&&(t[s]=o);Object.keys(t).length>0&&(n.env=t)}return n}function T(r,e,n,t,s){const o=[`command = ${d(e.command)}`];if(e.args&&e.args.length>0&&o.push(`args = [${e.args.map(d).join(", ")}]`),s&&n){const i=new Set(["command","args","env"]);for(const[a,u]of w(n.lines.slice(1)))i.has(a)||o.push(u)}const c=Object.entries(e.env??{}),f=s&&t?w(t.lines.slice(1)).filter(([i])=>!(i in(e.env??{}))):[];if(c.length>0||f.length>0){o.push(""),o.push(A([...r,"env"]));for(const[i,a]of c)o.push(`${F(i)} = ${d(a)}`);for(const[,i]of f)o.push(i)}return o}export function upsertCodexMcpInText(r,e,n){const t=["mcp_servers",e],s=_(r);if(s)throw s;const o=v(r),c=o.find(a=>y(a.key,t)),f=o.find(a=>y(a.key,[...t,"env"])),i=h(r,t,T(t,n,c,f,!0));try{return m(i),i}catch{const a=h(r,t,T(t,n,c,f,!1));try{return m(a),a}catch(u){throw new l(`unable to produce valid TOML for [mcp_servers.${e}]: ${u instanceof Error?u.message:String(u)}`)}}}export function removeCodexMcpFromText(r,e){return j(r,["mcp_servers",e])}function _(r){return v(r)[0].lines.find(e=>/^\s*mcp_servers\s*=/.test(e))?new l('~/.codex/config.toml defines "mcp_servers" as an inline value \u2014 weave only manages the [mcp_servers.<name>] section form'):null}let S=null;export function setCodexConfigFileOverride(r){S=r}async function k(r){try{return await p(r,"utf-8")}catch{return""}}async function g(r){try{return await C(r),!0}catch{return!1}}export async function readCodexMcpServers(r=codexConfigFile()){return await g(r)?readCodexMcpFromText(await p(r,"utf-8")):{}}export async function codexMcpExists(r,e=codexConfigFile()){return await g(e)?K(await p(e,"utf-8"),["mcp_servers",r]):!1}function K(r,e){return v(r).some(n=>y(n.key,e))}export async function writeCodexMcpServer(r,e,n=codexConfigFile()){const t=await k(n);if(t.trim()!=="")try{m(t)}catch(s){throw new l(`${n} is not valid TOML \u2014 refusing to write: ${s instanceof Error?s.message:String(s)}`)}await M(b.dirname(n),{recursive:!0}),await x(n,upsertCodexMcpInText(t,r,e),"utf-8")}export async function removeCodexMcpServer(r,e=codexConfigFile()){if(!await g(e))return!1;const n=await p(e,"utf-8");try{m(n)}catch(o){throw new l(`${e} is not valid TOML \u2014 refusing to write: ${o instanceof Error?o.message:String(o)}`)}const{text:t,removed:s}=removeCodexMcpFromText(n,r);return s&&await x(e,t,"utf-8"),s}

package/node_modules/@weavecode/server/dist/install/file-assets.d.ts

@@ -0,0 +1,19 @@
+import type { Harness } from '@weavecode/core';
+import type { FileAssetCategory } from '@weavecode/harness';
+/**
+ * File-backed harness asset kinds — the single source of truth for everything
+ * that installs as ONE file (unlike skills, which install as a directory).
+ *
+ * 批 4a：矩阵本体（FileAssetCategory / FileAssetSpec / FILE_ASSET_SPECS /
+ * FILE_ASSET_CATEGORIES / isFileAssetCategory）迁至 `@weavecode/harness` 的
+ * `shared/file-specs.ts`，此处 re-export 保持存量 import 与测试零改动；
+ * `fileAssetTargetDir` 保留原名原签名，内部委托 AssetSurface（经 registry 查 surface）。
+ *
+ * The same table drives: library scanning (scanner.ts), install/uninstall
+ * (installer.ts), update detection (updates.ts) and the dashboard badges.
+ */
+export { FILE_ASSET_SPECS, FILE_ASSET_CATEGORIES, isFileAssetCategory, type FileAssetCategory, type FileAssetSpec, } from '@weavecode/harness';
+/** Resolve the install target directory for a file asset.
+ * `agent` + `scope` decide the surface; kinds without a matching surface throw
+ * (e.g. rules are project-only, agents have no Codex equivalent). */
+export declare function fileAssetTargetDir(category: FileAssetCategory, agent: Harness, scope: 'project' | 'user', projectPath: string, homedir: string): string;

package/node_modules/@weavecode/server/dist/install/file-assets.js

@@ -0,0 +1 @@
+import{assetSurfaceFor as s}from"../surfaces.js";export{FILE_ASSET_SPECS,FILE_ASSET_CATEGORIES,isFileAssetCategory}from"@weavecode/harness";export function fileAssetTargetDir(r,e,t,i,o){return s(e).targetDir(r,t,i,o)}

package/node_modules/@weavecode/server/dist/install/fingerprint.d.ts

@@ -0,0 +1,33 @@
+import type { McpServerConfig } from './installer.js';
+export interface FingerprintCacheEntry {
+    /** Max mtime (ms) across all files in the tree when this hash was computed. */
+    maxMtime: number;
+    hash: string;
+}
+/**
+ * Recursively hash a directory tree. The digest is stable: files are sorted by
+ * their path relative to `dir`, and each contributes `${relPath}\0${content}`.
+ * Empty / missing directories hash to a constant.
+ */
+export declare function hashSkillDir(dir: string, skipNames?: Set<string>): Promise<string>;
+/** Max mtime (ms) across all files in a tree — cache-invalidation signal. */
+export declare function maxMtimeDir(dir: string, skipNames?: Set<string>): Promise<number>;
+/** Stable hash of an MCP server config (sorted keys → JSON → sha256). */
+export declare function hashMcpConfig(config: McpServerConfig): string;
+/** Hash a single file's content (sha256); missing files hash to a constant. */
+export declare function hashFile(file: string): Promise<string>;
+/**
+ * LRU-ish in-memory cache for directory hashes. An entry is reused while the
+ * directory's max mtime is unchanged; otherwise it is recomputed.
+ */
+export declare class FingerprintCache {
+    private readonly cache;
+    private readonly fileCache;
+    /** Get the hash for `dir`, recomputing only when its max mtime changed. */
+    get(dir: string): Promise<string>;
+    /** Get the hash for a single `file`, recomputing only when its mtime changed. */
+    getFile(file: string): Promise<string>;
+    /** Force-drop an entry (e.g. after a known write to the directory). */
+    invalidate(dir: string): void;
+    clear(): void;
+}

package/node_modules/@weavecode/server/dist/install/fingerprint.js

@@ -0,0 +1 @@
+import{readdir as h,readFile as m,stat as l}from"node:fs/promises";import{createHash as c}from"node:crypto";import n from"node:path";const f=new Set([".weave",".git","node_modules"]);export async function hashSkillDir(a,e=f){const t=c("sha256"),r=[];await u(a,a,r,e),r.sort((i,s)=>i.rel.localeCompare(s.rel));for(const i of r){t.update(i.rel),t.update("\0");let s;try{s=await m(i.abs)}catch{continue}t.update(s),t.update("\0")}return t.digest("hex")}async function u(a,e,t,r){let i;try{i=await h(e,{withFileTypes:!0})}catch{return}for(const s of i)s.name.startsWith(".")&&r.has(s.name)||(!r.has(s.name)&&s.isDirectory()?await u(a,n.join(e,s.name),t,r):s.isFile()&&t.push({rel:n.relative(a,e).replace(/\\/g,"/")+"/"+s.name,abs:n.join(e,s.name)}))}export async function maxMtimeDir(a,e=f){let t=0,r;try{r=await h(a,{withFileTypes:!0})}catch{return 0}for(const i of r){if(i.name.startsWith(".")&&e.has(i.name))continue;const s=n.join(a,i.name);if(i.isDirectory())t=Math.max(t,await maxMtimeDir(s,e));else if(i.isFile())try{const p=await l(s);t=Math.max(t,p.mtimeMs)}catch{}}return t}export function hashMcpConfig(a){return c("sha256").update(JSON.stringify(o(a))).digest("hex")}export async function hashFile(a){try{const e=await m(a);return c("sha256").update(e).digest("hex")}catch{return"missing"}}function o(a){if(Array.isArray(a))return a.map(o);if(a&&typeof a=="object"){const e={};for(const t of Object.keys(a).sort())e[t]=o(a[t]);return e}return a}export class FingerprintCache{cache=new Map;fileCache=new Map;async get(e){const t=await maxMtimeDir(e),r=this.cache.get(e);if(r&&r.maxMtime===t)return r.hash;const i=await hashSkillDir(e);return this.cache.set(e,{maxMtime:t,hash:i}),i}async getFile(e){let t;try{t=(await l(e)).mtimeMs}catch{return"missing"}const r=this.fileCache.get(e);if(r&&r.maxMtime===t)return r.hash;const i=await hashFile(e);return this.fileCache.set(e,{maxMtime:t,hash:i}),i}invalidate(e){this.cache.delete(e)}clear(){this.cache.clear(),this.fileCache.clear()}}

package/node_modules/@weavecode/server/dist/install/global-config.d.ts

@@ -0,0 +1,131 @@
+import type { Harness } from '@weavecode/core';
+import type { McpServerConfig } from './installer.js';
+import { type ProjectFile } from './reader.js';
+import type { AssetEntry } from '../watch/types.js';
+import { type InstallLinkMode } from '../market/install-link.js';
+/**
+ * Global (user-scope) Claude Code configuration.
+ *
+ * `~/.claude.json` is Claude Code's runtime file: it holds user-level MCP
+ * servers among many other keys. weave treats it as read-modify-write and MUST
+ * preserve every top-level key it does not own. A file that fails to parse is
+ * never written (we refuse rather than risk corrupting it). Skill assets at the
+ * global scope live under `~/.claude/skills/` — plain directory operations.
+ *
+ * Beyond the user's own skills, the global view also enumerates skills coming
+ * from installed Claude Code plugins (`~/.claude/plugins/installed_plugins.json`
+ * → each plugin's `skills/` dir) and Codex skills (`~/.agents/skills/`, plus the
+ * deprecated `~/.codex/skills/`
+ * Codex plugin caches). Plugin enable state is read from / written to the
+ * host config: `~/.claude/settings.json` (`enabledPlugins`) for Claude and
+ * `~/.codex/config.toml` (`[plugins."key"] enabled`) for Codex.
+ */
+/** `~/.claude.json` could not be parsed; refuse to write to avoid corruption. */
+export declare class ClaudeJsonCorruptError extends Error {
+    constructor(message: string);
+}
+/** Where a global skill came from — used as the grouping key in the UI. */
+export type GlobalSkillSource = `${Harness}-personal` | `${Harness}-plugin`;
+/** A single resolved skill directory. `dir` is absolute (may be a symlink). */
+export interface GlobalSkillEntry {
+    name: string;
+    dir: string;
+    /** 装面形态：`link` = 链接（全局位置无副本）、`copy` = 链接不可用时的回退复制。
+     * 读侧 lstat 判定，不落状态——用户手动改过、包升级后重铺过，状态都会失真。 */
+    form: InstallLinkMode;
+}
+/** A labelled group of skills sharing a source. Plugin groups carry enable
+ * state (per-plugin, keyed `plugin@marketplace`); personal groups do not. */
+export interface GlobalSkillGroup {
+    source: GlobalSkillSource;
+    label: string;
+    skills: GlobalSkillEntry[];
+    /** `plugin@marketplace` for plugin groups; undefined for personal groups. */
+    pluginKey?: string;
+    /** 所属市场 = 插件的 namespace（`pluginKey` 的 `@` 后半段，经 harness 面拆解）。
+     *  前端按它做一级折叠块，**不得自己 split `@`**。个人组无此字段。 */
+    namespace?: string;
+    /** Enable state for plugin groups (undefined → not applicable). */
+    enabled?: boolean;
+}
+declare function claudeJsonPath(): string;
+/** Claude 全局 skills 根（`~/.claude/skills`）——经 AssetSurface 查询。 */
+declare function globalSkillsPath(): string;
+declare function claudePluginsJsonPath(home?: string): string;
+/** Claude 用户级配置（`~/.claude/settings.json`）——经 AssetSurface 查询。 */
+declare function claudeSettingsPath(): string;
+/** Codex user-level skills root — the one installs target. */
+declare function codexSkillsPath(): string;
+declare function codexPluginsCachePath(): string;
+/** Personal skill roots that may contain symlinks to dev repos — the roots the
+ * watch service observes so edits to a symlinked skill's original files flow
+ * through SSE. Plugin caches are versioned/static and intentionally excluded.
+ * 带归属版：根来自各 harness 的 AssetSurface，归属即 surface 自身——watch 侧
+ * 据此定 agent，不写路径段白名单。 */
+export declare function globalPersonalSkillRootsOwned(): Array<{
+    harness: Harness;
+    root: string;
+}>;
+/** 与 `globalPersonalSkillRootsOwned` 同源的纯根列表（顺序不变）。 */
+export declare function globalPersonalSkillRoots(): string[];
+/** Read + parse ~/.claude.json. Missing file → {}. Unparseable → corrupt error. */
+export declare function readGlobalClaudeJson(): Promise<Record<string, unknown>>;
+/** Read user-level MCP servers from ~/.claude.json (empty if absent). */
+export declare function readGlobalMcpServers(): Promise<Record<string, McpServerConfig>>;
+/**
+ * Add or replace a user-level MCP server in ~/.claude.json. Preserves every
+ * other top-level key. Refuses to write if the file is corrupt (unreadable as
+ * JSON); in that case the caller should surface the error to the user.
+ */
+export declare function writeGlobalMcpServer(name: string, config: McpServerConfig): Promise<void>;
+/** Remove a user-level MCP server from ~/.claude.json (no-op if absent). */
+export declare function removeGlobalMcpServer(name: string): Promise<void>;
+/** List skill directory names under ~/.claude/skills/ (follows symlinks). */
+export declare function readGlobalSkills(): Promise<string[]>;
+/** Install a skill directory to the agent's global skills root
+ * (`~/.claude/skills/<name>/` or `~/.agents/skills/<name>/`).
+ * 批 9：symlink 优先（指向市场/原目录），EPERM 等回退复制（install-link 单点）。 */
+export declare function installGlobalSkill(sourceDir: string, name: string, agent?: Harness): Promise<string>;
+/** Remove a global skill directory from the agent's skills root.
+ * 批 9：先 lstat——链接只删链接（防删穿市场源），复制体才递归删。 */
+export declare function uninstallGlobalSkill(name: string, agent?: Harness): Promise<void>;
+/** 已装 Claude 插件的安装目录 → 所属市场 namespace（全局文件树给每个文件打仓库
+ *  标记用）。installPath 与键形都取自宿主记录、经 `parsePluginKey` 拆解点取市场，
+ *  不在这里猜缓存目录的形状——装了哪些版本、装在哪儿都随记录走。 */
+export declare function installedPluginNamespaces(home?: string): Promise<Array<{
+    dir: string;
+    namespace: string;
+}>>;
+/**
+ * Aggregate every global skill source into ordered groups. Plugin groups are
+ * decorated with their enable state (read from the host config). Empty groups
+ * are kept so the UI can show "none installed" per source. Order:
+ * claude-personal, claude-plugin(s), codex-personal, codex-plugin(s).
+ */
+export declare function readGlobalSkillGroups(): Promise<GlobalSkillGroup[]>;
+/** Resolve a single global skill's directory by source + name (+ pluginKey for
+ * plugins). Targeted lookup — does not re-read every group. Returns null when
+ * the skill (or its enclosing plugin install) is not found. */
+export declare function resolveGlobalSkillDir(source: GlobalSkillSource, name: string, pluginKey?: string): Promise<string | null>;
+/** Recursively list files inside a global skill directory (symlinks followed),
+ * with paths relative to the skill dir (posix separators). Hidden entries are
+ * skipped. agent 取该目录的归属 harness。 */
+export declare function listGlobalSkillFiles(dir: string): Promise<AssetEntry[]>;
+/** Read a text file inside a global skill directory, following symlinks. The
+ * `relPath` is relative to `dir`; absolute paths and `..` segments are rejected,
+ * and the resolved real path must stay within the (possibly symlinked) skill
+ * dir — so a symlinked file pointing outside the skill is refused. */
+export declare function readGlobalSkillFile(dir: string, relPath: string): Promise<ProjectFile>;
+/** Read `enabledPlugins` from ~/.claude/settings.json (empty if absent/corrupt).
+ * P2：实现经 pluginState 槽取（claude 的实现在 harness plugins 槽内），薄委托。 */
+export declare function readClaudePluginEnabled(): Promise<Record<string, boolean>>;
+/** Set `enabledPlugins[key]` in ~/.claude/settings.json, preserving all other
+ * keys. The file is created if missing. P2：薄委托。 */
+export declare function writeClaudePluginEnabled(key: string, enabled: boolean): Promise<void>;
+/** Read `[plugins."key"] enabled` from ~/.codex/config.toml (empty if absent).
+ * P2：实现迁入 harness `codex/plugin-state.ts`（含 TOML 表示法），薄委托。 */
+export declare function readCodexPluginEnabled(): Promise<Record<string, boolean>>;
+/** Set `[plugins."key"] enabled` in ~/.codex/config.toml（增量段编辑，注释与
+ * 键序保留）。P2：薄委托。 */
+export declare function writeCodexPluginEnabled(key: string, enabled: boolean): Promise<void>;
+export { globalSkillsPath, claudeJsonPath, claudePluginsJsonPath, claudeSettingsPath, codexSkillsPath, codexPluginsCachePath, };

package/node_modules/@weavecode/server/dist/install/global-config.js

@@ -0,0 +1,2 @@
+import{readFile as x,writeFile as N,readdir as d,access as K,stat as P,realpath as G}from"node:fs/promises";import{homedir as f}from"node:os";import l from"node:path";import{AssetNotFoundError as b}from"./installer.js";import{FileTooLargeError as B,MAX_BYTES as D}from"./reader.js";import{assetSurfaceFor as h,assetSurfaces as J,pluginStateFor as S,pluginSurfaceFor as O}from"../surfaces.js";import{installForm as R,linkOrCopy as W,removeInstalled as z}from"../market/install-link.js";export class ClaudeJsonCorruptError extends Error{constructor(e){super(e),this.name="ClaudeJsonCorruptError"}}const I=".claude.json",_=".claude/plugins/installed_plugins.json";function j(){return l.join(f(),I)}function k(){return h("claude").globalSkillsRoots(f())[0]}function L(t=f()){return l.join(t,_)}function X(){return h("claude").userConfigFile(f())}function T(){return h("codex").globalSkillsRoots(f())[0]}function Y(){return h("codex").globalSkillsRoots(f())}function A(){const t=h("codex").pluginCacheDir?.(f());if(!t)throw new Error("codex has no plugin cache surface");return t}export function globalPersonalSkillRootsOwned(){return J().flatMap(t=>t.globalSkillsRoots(f()).map(e=>({harness:t.harness,root:e})))}export function globalPersonalSkillRoots(){return globalPersonalSkillRootsOwned().map(t=>t.root)}async function F(t){try{return await K(t),!0}catch{return!1}}async function y(t){try{return(await P(t)).isDirectory()}catch{return!1}}export async function readGlobalClaudeJson(){const t=j();if(!await F(t))return{};let e;try{e=await x(t,"utf-8")}catch{return{}}let n;try{n=JSON.parse(e)}catch(a){throw new ClaudeJsonCorruptError(`~/.claude.json is not valid JSON \u2014 refusing to write: ${a instanceof Error?a.message:String(a)}`)}if(!n||typeof n!="object"||Array.isArray(n))throw new ClaudeJsonCorruptError("~/.claude.json is not a JSON object \u2014 refusing to write");return n}export async function readGlobalMcpServers(){const t=(await readGlobalClaudeJson()).mcpServers;return!t||typeof t!="object"||Array.isArray(t)?{}:t}async function M(t){await N(j(),`${JSON.stringify(t,null,2)}
+`,"utf-8")}export async function writeGlobalMcpServer(t,e){const n=await readGlobalClaudeJson(),a=n.mcpServers??{};a[t]=e,n.mcpServers=a,await M(n)}export async function removeGlobalMcpServer(t){const e=await readGlobalClaudeJson(),n=e.mcpServers??{};t in n&&(delete n[t],e.mcpServers=n,await M(e))}export async function readGlobalSkills(){const t=k();try{const e=await d(t,{withFileTypes:!0}),n=[];for(const a of e)!a.isDirectory()&&!a.isSymbolicLink()||await y(l.join(t,a.name))&&n.push(a.name);return n.sort((a,r)=>a.localeCompare(r))}catch{return[]}}export async function installGlobalSkill(t,e,n="claude"){const a=h(n).globalSkillsRoots(f())[0],r=l.join(a,e);if(await F(r))throw new Error(`Global ${n} skill "${e}" already exists`);return await W(t,r),r}export async function uninstallGlobalSkill(t,e="claude"){const n=h(e).globalSkillsRoots(f())[0];await z(l.join(n,t))}async function C(t=f()){const e=L(t);if(!await F(e))return{};try{const n=JSON.parse(await x(e,"utf-8"));return n&&typeof n=="object"&&!Array.isArray(n)?n:{}}catch{return{}}}async function E(t){if(!await y(t))return[];let e;try{e=await d(t,{withFileTypes:!0})}catch{return[]}const n=[];for(const a of e){if(a.name.startsWith(".")||!a.isDirectory()&&!a.isSymbolicLink())continue;const r=l.join(t,a.name);if(!await y(r))continue;const o=await R(r);o!=="absent"&&n.push({name:a.name,dir:r,form:o})}return n.sort((a,r)=>a.name.localeCompare(r.name))}export async function installedPluginNamespaces(t=f()){const e=(await C(t)).plugins;if(!e||typeof e!="object"||Array.isArray(e))return[];const n=[];for(const[a,r]of Object.entries(e)){const{market:o}=O("claude").parsePluginKey(a);for(const i of Array.isArray(r)?r:[])i&&typeof i.installPath=="string"&&n.push({dir:i.installPath,namespace:o})}return n}async function q(){const t=(await C()).plugins;if(!t||typeof t!="object"||Array.isArray(t))return[];const e=[];for(const[n,a]of Object.entries(t)){const r=Array.isArray(a)?a:[];if(r.length===0)continue;const o=[...r].filter(p=>p&&typeof p.installPath=="string").pop();if(!o?.installPath)continue;const i=await E(l.join(o.installPath,"skills")),{name:s,market:u}=O("claude").parsePluginKey(n);e.push({source:"claude-plugin",label:s,namespace:u,skills:i,pluginKey:n})}return e.sort((n,a)=>n.label.localeCompare(a.label))}async function H(){const t=new Map;for(const e of Y())for(const n of await E(e))t.has(n.name)||t.set(n.name,n);return{source:"codex-personal",label:"Codex \xB7 \u4E2A\u4EBA",skills:[...t.values()].sort((e,n)=>e.name.localeCompare(n.name))}}async function Q(){const t=A();if(!await y(t))return[];const e=[];let n;try{n=await d(t,{withFileTypes:!0})}catch{return[]}for(const a of n){if(!a.isDirectory()&&!a.isSymbolicLink())continue;const r=l.join(t,a.name);let o;try{o=await d(r,{withFileTypes:!0})}catch{continue}for(const i of o){if(!i.isDirectory()&&!i.isSymbolicLink())continue;const s=l.join(r,i.name);let u;try{u=await d(s,{withFileTypes:!0})}catch{continue}const p=u.filter(w=>w.isDirectory()||w.isSymbolicLink());if(p.length===0)continue;const m=p.map(w=>w.name).sort().pop(),c=await E(l.join(s,m,"skills")),g=`${i.name}@${a.name}`;e.push({source:"codex-plugin",label:i.name,namespace:a.name,skills:c,pluginKey:g})}}return e.sort((a,r)=>a.label.localeCompare(r.label))}async function U(){const t=k(),e=await readGlobalSkills(),n=[];for(const a of e){const r=l.join(t,a),o=await R(r);o!=="absent"&&n.push({name:a,dir:r,form:o})}return{source:"claude-personal",label:"Claude Code \xB7 \u4E2A\u4EBA",skills:n}}export async function readGlobalSkillGroups(){const[t,e,n,a,r,o]=await Promise.all([U(),q(),H(),Q(),readClaudePluginEnabled(),readCodexPluginEnabled()]),i=(s,u)=>({...s,enabled:s.pluginKey?u[s.pluginKey]??!1:void 0});return[t,...e.map(s=>i(s,r)),n,...a.map(s=>i(s,o))]}export async function resolveGlobalSkillDir(t,e,n){if(t==="claude-personal"){const c=l.join(k(),e);return await y(c)?c:null}if(t==="codex-personal"){const c=l.join(T(),e);return await y(c)?c:null}if(t==="claude-plugin"){if(!n)return null;const c=(await C()).plugins;if(!c||typeof c!="object"||Array.isArray(c))return null;const g=c[n],w=[...Array.isArray(g)?g:[]].filter($=>$&&typeof $.installPath=="string").pop();if(!w?.installPath)return null;const v=l.join(w.installPath,"skills",e);return await y(v)?v:null}if(!n)return null;const a=n.lastIndexOf("@");if(a<=0)return null;const r=n.slice(0,a),o=n.slice(a+1),i=l.join(A(),o,r);if(!await y(i))return null;let s;try{s=await d(i,{withFileTypes:!0})}catch{return null}const u=s.filter(c=>c.isDirectory()||c.isSymbolicLink());if(u.length===0)return null;const p=u.map(c=>c.name).sort().pop(),m=l.join(i,p,"skills",e);return await y(m)?m:null}function V(t){const e=l.resolve(t),n=f();return J().find(a=>{const r=[...a.globalSkillsRoots(n)],o=a.pluginCacheDir?.(n);return o&&r.push(o),r.some(i=>e===l.resolve(i)||e.startsWith(l.resolve(i)+l.sep))})?.harness??"claude"}export async function listGlobalSkillFiles(t){const e=V(t),n=[],a=async(r,o)=>{let i;try{i=await d(r,{withFileTypes:!0})}catch{return}for(const s of i){if(s.name.startsWith("."))continue;const u=l.join(r,s.name),p=o?`${o}/${s.name}`:s.name;if((s.isDirectory()||s.isSymbolicLink())&&await y(u))await a(u,p);else if(s.isFile()||s.isSymbolicLink())try{const m=await P(u);m.isFile()&&n.push({absPath:u,relPath:p,category:"skill",agent:e,mtimeMs:m.mtimeMs})}catch{}}};return await a(t,""),n.sort((r,o)=>r.relPath.localeCompare(o.relPath))}export async function readGlobalSkillFile(t,e){const n=l.normalize(e).replace(/\\/g,"/");if(l.isAbsolute(e))throw new b(`Absolute paths are not allowed: "${e}"`);if(n.split("/").some(u=>u===".."))throw new b(`Path traversal is not allowed: "${e}"`);const a=l.join(t,n);let r;try{r=await P(a)}catch{throw new b(`File not found: "${e}"`)}if(!r.isFile())throw new b(`Not a file: "${e}"`);if(r.size>D)throw new B(`File exceeds ${D} bytes: "${e}"`);let o=t,i=a;try{[o,i]=await Promise.all([G(t),G(a)])}catch{throw new b(`File not found: "${e}"`)}const s=o.endsWith(l.sep)?o:o+l.sep;if(i!==o&&!i.startsWith(s))throw new b(`Resolved path escapes the skill directory: "${e}"`);return{content:await x(a,"utf-8"),size:r.size}}export async function readClaudePluginEnabled(){return S("claude").readGlobalEnabled()}export async function writeClaudePluginEnabled(t,e){return S("claude").writeGlobalEnabled(t,e)}export async function readCodexPluginEnabled(){return S("codex").readGlobalEnabled()}export async function writeCodexPluginEnabled(t,e){return S("codex").writeGlobalEnabled(t,e)}export{k as globalSkillsPath,j as claudeJsonPath,L as claudePluginsJsonPath,X as claudeSettingsPath,T as codexSkillsPath,A as codexPluginsCachePath};

package/node_modules/@weavecode/server/dist/install/global-file-assets.d.ts

@@ -0,0 +1,6 @@
+import type { AssetEntry } from '../watch/types.js';
+/**
+ * List every machine-level harness file weave knows about, bounded by the
+ * whitelist above. `home` is injectable for tests.
+ */
+export declare function listGlobalFileAssets(home?: string): Promise<AssetEntry[]>;

package/node_modules/@weavecode/server/dist/install/global-file-assets.js

@@ -0,0 +1 @@
+import{lstat as y,readdir as k,stat as p}from"node:fs/promises";import{homedir as P}from"node:os";import l from"node:path";import{classifyAgent as S,classifyAsset as $}from"../watch/classifier.js";import{PluginModsSniffer as j}from"../watch/plugin-mods.js";import{installedPluginNamespaces as x}from"./global-config.js";const A=["commands","agents","workflows","rules","output-styles","hooks","themes","routines","plugins"],b=["CLAUDE.md","settings.json","settings.local.json"],v=["prompts"],D=["config.toml","AGENTS.md"],F=new Set(["skills","node_modules",".git"]),L=new Set(["marketplaces","data",".in_use"]),h=".claude/plugins",E=`${h}/`,M=6,N=10,d=5e3,T=[{prefix:".claude",dirs:A,files:b},{prefix:".codex",dirs:v,files:D}];async function g(e,i,s){try{const n=await y(e),t=n.isSymbolicLink(),o=t?await p(e):n;if(!o.isFile())return null;let a=$(i);return a==="plugin"&&(a=s.refine(a,i,e)),{absPath:e,relPath:i,category:a,agent:S(i),mtimeMs:o.mtimeMs,...t?{isSymlink:!0}:{}}}catch{return null}}async function m(e,i,s,n,t,o){if(s>t||n.length>=d)return;let a;try{a=await k(e,{withFileTypes:!0})}catch{return}for(const r of a){if(n.length>=d)return;const c=l.join(e,r.name),f=`${i}/${r.name}`;if(r.isDirectory()){if(w(f,r.name))continue;await m(c,f,s+1,n,t,o);continue}if(r.isSymbolicLink())try{if((await p(c)).isDirectory()){w(f,r.name)||await m(c,f,s+1,n,t,o);continue}}catch{continue}const u=await g(c,f,o);u&&n.push(u)}}function w(e,i){return F.has(i)?!0:e.startsWith(E)&&L.has(i)}export async function listGlobalFileAssets(e=P()){const i=new j({revalidate:!1}),s=[];for(const t of T){const o=l.join(e,...t.prefix.split("/"));for(const a of t.files){const r=await g(l.join(o,a),`${t.prefix}/${a}`,i);r&&s.push(r)}for(const a of t.dirs){const r=`${t.prefix}/${a}`,c=r===h?N:M;await m(l.join(o,a),r,1,s,c,i)}}const n=await x(e);return s.sort((t,o)=>t.relPath.localeCompare(o.relPath)),s.map(t=>{const o=_(t.absPath,n);return o?{...t,namespace:o}:t})}function _(e,i){let s;for(const n of i){const t=l.relative(l.resolve(n.dir),l.resolve(e));t===""||t.startsWith("..")||l.isAbsolute(t)||(!s||n.dir.length>s.dir.length)&&(s=n)}return s?.namespace}

package/node_modules/@weavecode/server/dist/install/install-ledger.d.ts

@@ -0,0 +1,20 @@
+import type { Harness } from '@weavecode/core';
+import type { FileAssetCategory } from './file-assets.js';
+/**
+ * 安装意图账本（`.weave/installed.json`）——"本该装着"的资产清单。
+ *
+ * 扫盘只能看到现存的东西：**被删掉的和从没装过的在报告里长得一模一样**，自动同步
+ * 因此无从补齐。安装时登记、卸载时删账（主动卸载不该被补齐逆回），账本损坏一律
+ * 当空（读侧口径同 server 其它 JSON 读）。只收 project scope —— 全局资产是用户级
+ * 共享，不随某个项目的同步走。
+ */
+export interface InstalledAssetRecord {
+    category: 'skill' | 'mcp' | 'file';
+    name: string;
+    agent: Harness;
+    /** file 资产必填（FILE_ASSET_SPECS 的键）。 */
+    assetCategory?: FileAssetCategory;
+}
+export declare function readInstalledLedger(projectPath: string): Promise<InstalledAssetRecord[]>;
+export declare function recordInstalled(projectPath: string, record: InstalledAssetRecord): Promise<void>;
+export declare function forgetInstalled(projectPath: string, record: InstalledAssetRecord): Promise<void>;

package/node_modules/@weavecode/server/dist/install/install-ledger.js

@@ -0,0 +1,2 @@
+import{mkdir as l,readFile as f,writeFile as y}from"node:fs/promises";import r from"node:path";const i=r.join(".weave","installed.json"),s=e=>[e.category,e.name,e.agent,e.assetCategory??""].join("\0");function g(e){if(!e||typeof e!="object")return!1;const t=e;return(t.category==="skill"||t.category==="mcp"||t.category==="file")&&typeof t.name=="string"&&t.name!==""&&typeof t.agent=="string"}export async function readInstalledLedger(e){try{const t=JSON.parse(await f(r.join(e,i),"utf-8"));return Array.isArray(t.assets)?t.assets.filter(g):[]}catch{return[]}}export async function recordInstalled(e,t){const n=await readInstalledLedger(e);n.some(a=>s(a)===s(t))||await o(e,[...n,t])}export async function forgetInstalled(e,t){const n=await readInstalledLedger(e),a=n.filter(c=>s(c)!==s(t));a.length!==n.length&&await o(e,a)}async function o(e,t){const n=r.join(e,i);await l(r.dirname(n),{recursive:!0}),await y(n,`${JSON.stringify({version:1,assets:t},null,2)}
+`,"utf-8")}

package/node_modules/@weavecode/server/dist/install/installer.d.ts

@@ -0,0 +1,46 @@
+import type { Harness } from '@weavecode/core';
+import { type FileAssetCategory } from './file-assets.js';
+/**
+ * Asset install/uninstall — pure filesystem operations, no sqlite writes.
+ *
+ * The watch service observes `.claude/`, `.codex/`, `.mcp.json` and the two
+ * instruction files, so after install/uninstall returns, chokidar fires
+ * add/unlink → the cache + SSE stream update the dashboard automatically. The
+ * API layer therefore does not push asset changes itself.
+ */
+export declare class InstallConflictError extends Error {
+    constructor(message: string);
+}
+export declare class AssetNotFoundError extends Error {
+    constructor(message: string);
+}
+export interface McpServerConfig {
+    command: string;
+    args?: string[];
+    env?: Record<string, string>;
+}
+/** Which coding agent an install targets — Claude Code or Codex surfaces. */
+export type InstallAgent = Harness;
+/** Copy an entire skill directory into the agent's `<skills>/<name>/`. */
+export declare function installSkill(projectPath: string, sourceDir: string, name: string, agent?: InstallAgent): Promise<string>;
+/** Remove the agent's skill directory `<skills>/<name>/`. */
+export declare function uninstallSkill(projectPath: string, name: string, agent?: InstallAgent): Promise<void>;
+/**
+ * Copy a single template file to the agent/scope-resolved target directory
+ * (see file-assets.ts for the surface table). The file is renamed to
+ * `<name><ext>` — the library's file stem and the install name agree in
+ * practice, but the install name wins so renames stay explicit.
+ */
+export declare function installFileAsset(projectPath: string, category: FileAssetCategory, name: string, sourceFile: string, agent?: InstallAgent, scope?: 'project' | 'user'): Promise<string>;
+/** Remove a single installed file asset (agent/scope-resolved path). */
+export declare function uninstallFileAsset(projectPath: string, category: FileAssetCategory, name: string, agent?: InstallAgent, scope?: 'project' | 'user'): Promise<void>;
+/** Add a `mcpServers[name]` entry to `.mcp.json`, preserving existing entries. */
+export declare function installMcp(projectPath: string, name: string, config: McpServerConfig): Promise<void>;
+/** Remove the `mcpServers[name]` entry from `.mcp.json`. */
+export declare function uninstallMcp(projectPath: string, name: string): Promise<void>;
+/** Read and parse `.mcp.json`; a missing/invalid file yields an empty object. */
+export declare function readMcpJson(file: string): Promise<{
+    mcpServers?: Record<string, unknown>;
+}>;
+/** Read the `mcpServers` map from a project's `.mcp.json` (empty if absent). */
+export declare function readMcpServers(projectPath: string): Promise<Record<string, McpServerConfig>>;

package/node_modules/@weavecode/server/dist/install/installer.js

@@ -0,0 +1,3 @@
+import{cp as w,rm as m,readFile as j,writeFile as y,access as v,mkdir as h}from"node:fs/promises";import{homedir as g}from"node:os";import s from"node:path";import{FILE_ASSET_SPECS as S,fileAssetTargetDir as x}from"./file-assets.js";import{assetSurfaceFor as E}from"../surfaces.js";import{forgetInstalled as f,recordInstalled as p}from"./install-ledger.js";export class InstallConflictError extends Error{constructor(a){super(a),this.name="InstallConflictError"}}export class AssetNotFoundError extends Error{constructor(a){super(a),this.name="AssetNotFoundError"}}const d=".mcp.json";function i(e){if(!e||e.includes("/")||e.includes("\\")||e.includes("..")||e.includes(s.sep))throw new Error(`Invalid asset name: "${e}"`)}async function l(e){try{return await v(e),!0}catch{return!1}}function $(e){return E(e).projectSkillsDir()}export async function installSkill(e,a,t,r="claude"){i(t);const n=s.join(e,$(r),t);if(await l(n))throw new InstallConflictError(`Skill "${t}" is already installed${r==="codex"?" (Codex)":""}`);return await w(a,n,{recursive:!0}),await p(e,{category:"skill",name:t,agent:r}),n}export async function uninstallSkill(e,a,t="claude"){i(a);const r=s.join(e,$(t),a);if(!await l(r))throw new AssetNotFoundError(`Skill "${a}" is not installed${t==="codex"?" (Codex)":""}`);await m(r,{recursive:!0,force:!0}),await f(e,{category:"skill",name:a,agent:t})}export async function installFileAsset(e,a,t,r,n="claude",o="project"){i(t);const c=x(a,n,o,e,g()),u=s.join(c,`${t}${S[a].ext}`);if(await l(u))throw new InstallConflictError(`${a} "${t}" is already installed`);return await h(c,{recursive:!0}),await w(r,u),o==="project"&&await p(e,{category:"file",name:t,agent:n,assetCategory:a}),u}export async function uninstallFileAsset(e,a,t,r="claude",n="project"){i(t);const o=x(a,r,n,e,g()),c=s.join(o,`${t}${S[a].ext}`);if(!await l(c))throw new AssetNotFoundError(`${a} "${t}" is not installed`);await m(c,{force:!0}),n==="project"&&await f(e,{category:"file",name:t,agent:r,assetCategory:a})}export async function installMcp(e,a,t){i(a);const r=s.join(e,d),n=await readMcpJson(r),o=n.mcpServers??{};if(a in o)throw new InstallConflictError(`MCP server "${a}" is already configured`);o[a]=t,n.mcpServers=o,await y(r,`${JSON.stringify(n,null,2)}
+`,"utf-8"),await p(e,{category:"mcp",name:a,agent:"claude"})}export async function uninstallMcp(e,a){i(a);const t=s.join(e,d),r=await readMcpJson(t),n=r.mcpServers??{};if(!(a in n))throw new AssetNotFoundError(`MCP server "${a}" is not configured`);delete n[a],r.mcpServers=n,await y(t,`${JSON.stringify(r,null,2)}
+`,"utf-8"),await f(e,{category:"mcp",name:a,agent:"claude"})}export async function readMcpJson(e){try{const a=await j(e,"utf-8"),t=JSON.parse(a);return t&&typeof t=="object"?t:{}}catch{return{}}}export async function readMcpServers(e){return(await readMcpJson(s.join(e,d))).mcpServers??{}}