@weavecode/weave 0.0.0-stage → 0.1.0

package/node_modules/@weavecode/server/dist/install/library-index.d.ts

@@ -0,0 +1,71 @@
+import type { FileAssetCategory } from './file-assets.js';
+import type { LibraryRow } from '../repositories/libraries.js';
+import type { McpServerConfig } from './installer.js';
+/**
+ * Library source index — resolves "where did this installed asset come from?"
+ * WITHOUT persisting a source mapping to sqlite.
+ *
+ * The join key is the asset's *name*: a skill installed at
+ * `.claude/skills/<name>/` is matched against every registered library's
+ * `scanLibrarySkills` output (which also keys by directory basename). MCP
+ * entries (`.mcp.json` key = name) are matched the same way against library
+ * MCP templates. This keeps the filesystem the single source of truth: we
+ * never store "skill X came from library Y" as state — we recompute it on
+ * demand from the live library directories.
+ *
+ * Scope is likewise inferred from path, not stored:
+ *   project → `<project>/.claude/skills/`
+ *   user    → `~/.claude/skills/`
+ *
+ * Multi-source edge case: if two libraries both define `<name>`, the first one
+ * (by `libraries.list()` order) wins for update-checking. Any matching source
+ * is sufficient to detect "outdated"; a precise multi-source UI can be layered
+ * on later without a schema change.
+ *
+ * 批 9（R11）：传入的 `LibraryRow[]` 假定已由 `LibraryRepository` 读侧经
+ * `market/resolve` 解析为绝对路径（最浅接入——收编在 repo 读侧，本模块不逐处
+ * resolve）；测试直构的行本就是绝对路径，行为不变。
+ */
+export interface SkillSource {
+    name: string;
+    libraryId: number;
+    libraryPath: string;
+    /** Absolute path to the skill directory in the library (copy source). */
+    dirPath: string;
+}
+export interface McpSource {
+    name: string;
+    libraryId: number;
+    libraryPath: string;
+    config: McpServerConfig;
+    /** Absolute path to the JSON file this template was loaded from. */
+    sourcePath: string;
+}
+export interface FileAssetSource {
+    name: string;
+    category: FileAssetCategory;
+    libraryId: number;
+    libraryPath: string;
+    /** Absolute path to the template file (copy source). */
+    filePath: string;
+}
+export interface LibraryIndex {
+    /** name → source (first library wins on collision). */
+    skills: Map<string, SkillSource>;
+    /** name → source (first library wins on collision). */
+    mcp: Map<string, McpSource>;
+    /** `${category}/${name}` → source (first library wins on collision). */
+    files: Map<string, FileAssetSource>;
+}
+/**
+ * Scan every registered library and build name→source indexes for skills and
+ * MCP templates. Libraries whose kind excludes a category, or that are
+ * unreadable, are skipped for that category.
+ */
+export declare function buildLibraryIndex(libraries: LibraryRow[]): Promise<LibraryIndex>;
+/** Resolve the library source for an installed skill by name, if any. */
+export declare function findSkillSource(index: LibraryIndex, name: string): SkillSource | undefined;
+/** Resolve the library source for an installed MCP server by name, if any. */
+export declare function findMcpSource(index: LibraryIndex, name: string): McpSource | undefined;
+/** Resolve the library source for an installed file asset, if any. */
+export declare function findFileAssetSource(index: LibraryIndex, category: FileAssetCategory, name: string): FileAssetSource | undefined;

package/node_modules/@weavecode/server/dist/install/library-index.js

@@ -0,0 +1 @@
+import{getLibraryScan as u}from"./scan-cache.js";export async function buildLibraryIndex(e){const a=new Map,i=new Map,s=new Map;for(const n of e){const m=n.kind==="skill"||n.kind==="both",d=n.kind==="mcp"||n.kind==="both";let o;try{o=await u(n.path)}catch{continue}if(m){for(const t of o.skills)a.has(t.name)||a.set(t.name,{name:t.name,libraryId:n.id,libraryPath:n.path,dirPath:t.dirPath});for(const t of Object.values(o.files))for(const r of t){const c=`${r.category}/${r.name}`;s.has(c)||s.set(c,{name:r.name,category:r.category,libraryId:n.id,libraryPath:n.path,filePath:r.filePath})}}if(d){for(const t of o.mcp)if(!i.has(t.name)){const{name:r,command:c,args:f,env:l,sourcePath:h}=t,p={command:c,...f&&{args:f},...l&&{env:l}};i.set(t.name,{name:r,libraryId:n.id,libraryPath:n.path,config:p,sourcePath:h})}}}return{skills:a,mcp:i,files:s}}export function findSkillSource(e,a){return e.skills.get(a)}export function findMcpSource(e,a){return e.mcp.get(a)}export function findFileAssetSource(e,a,i){return e.files.get(`${a}/${i}`)}

package/node_modules/@weavecode/server/dist/install/mcp-rows.d.ts

@@ -0,0 +1,11 @@
+import type { ToolStateRow } from '@weavecode/core';
+import { type McpServerConfig } from './installer.js';
+export type McpToolRow = ToolStateRow<McpServerConfig>;
+/**
+ * MCP 工具行装配（工具对象模型首个产消方）：三处表示法（项目 `.mcp.json` /
+ * `~/.claude.json` / `~/.codex/config.toml`）读出的服务器映射展平成
+ * harness × scope 状态行。范围来自 `AssetSurface.mcpScopes`；启停覆写与
+ * 生效态由服务端解析（词表桥在 settings-mcp，文件表示法不出 server）。
+ * 行行携带 installScopes——web 的视图选择与安装控制不依赖能力表二次拉取。
+ */
+export declare function readMcpRows(projectPath: string): Promise<McpToolRow[]>;

package/node_modules/@weavecode/server/dist/install/mcp-rows.js

@@ -0,0 +1 @@
+import{readMcpServers as u}from"./installer.js";import{readGlobalMcpServers as M}from"./global-config.js";import{readCodexMcpServers as v}from"./codex-toml.js";import{readMcpEnableMap as h,mcpOverrideOf as S,resolveMcpEffective as b}from"./settings-mcp.js";import{assetSurfaces as w}from"../surfaces.js";export async function readMcpRows(s){const[t,p,l,n]=await Promise.all([u(s).catch(()=>({})),M().catch(()=>({})),v().catch(()=>({})),h(s)]),f=new Map(w().map(e=>[e.harness,e.mcpScopes()])),o=[],r=(e,m,i,a)=>{for(const[c,d]of Object.entries(i))o.push({key:c,category:"mcp",harness:e,scope:m,installScopes:f.get(e)??[],enable:a?S(a,c):null,effective:a?b(a,c):!0,detail:d})};return r("claude","project",t,n),r("claude","user",p,null),r("codex","user",l,null),o}

package/node_modules/@weavecode/server/dist/install/plugin-install.d.ts

@@ -0,0 +1,12 @@
+import type { PluginInstallInfo, PluginSurface } from '@weavecode/harness';
+/**
+ * user 档安装（globalInstall）的服务端唯一编排：市场身份判据（marketIdOf 的
+ * 唯一实现）+ marketplace 落点拼装收在此——toolkit 管线与安装路由同源取用，
+ * 不得各自内联。server 只给面传语义参数（包名 + 市场身份），表示法留 harness。
+ */
+export declare function installPluginPack(surface: PluginSurface, pack: {
+    dir: string;
+    name: string;
+    version?: string;
+    description?: string;
+}): Promise<PluginInstallInfo>;

package/node_modules/@weavecode/server/dist/install/plugin-install.js

@@ -0,0 +1 @@
+import r from"node:path";import{marketIdOf as t}from"../market/identity.js";import{marketDir as a}from"../market/manifest.js";export async function installPluginPack(o,i){const n=t(i.dir);return o.globalInstall(i.dir,{name:i.name,version:i.version,description:i.description,...n?{marketplace:{name:n,dir:r.join(a(),n)}}:{}})}

package/node_modules/@weavecode/server/dist/install/plugin-rows.d.ts

@@ -0,0 +1,9 @@
+import type { ToolStateRow } from '@weavecode/core';
+/**
+ * 插件工具行装配（工具对象模型 §2，PluginEnabledMap 的替换面）：行 = 每键 ×
+ * 每可装档一行，install/enable 逐档独立，effective 由本模块唯一解析
+ * （档序弱→强 = local > project > user；全链无覆写 = 不加载，CC 三阶段模型）。
+ * 依赖注入与 mcp-rows 同式：无——测试经 HOME/USERPROFILE 假家目录控文件。
+ */
+export type PluginToolRow = ToolStateRow;
+export declare function readPluginRows(projectPath: string): Promise<PluginToolRow[]>;

package/node_modules/@weavecode/server/dist/install/plugin-rows.js

@@ -0,0 +1 @@
+import{pluginSurfaces as b,pluginStateSurfaces as g}from"../surfaces.js";const u=["user","project","local"],y=(s,e)=>e in s?s[e]?"on":"off":"inherit";function S(s,e){for(let n=u.length-1;n>=0;n--){const o=s[u[n]][e];if(o!==void 0)return o}return!1}export async function readPluginRows(s){const e=[],n=b();for(const{harness:o,surface:a}of n){const f=a.pluginScopes(),[t,c]=await Promise.all([a.readInstalled().catch(()=>({})),a.readEnabledOverrides(s).catch(()=>({user:{},project:{},local:{}}))]),p=new Set(Object.keys(t));for(const r of u)for(const l of Object.keys(c[r]))p.add(l);for(const r of p){const l=t[r],d=S(c,r);for(const i of f)e.push({key:r,category:"plugin",harness:o,scope:i,installScopes:f,install:l?.some(h=>(h.scope??"user")===i)?"installed":"absent",enable:y(c[i],r),effective:d})}}for(const{harness:o,state:a}of g()){if(n.some(t=>t.harness===o))continue;const f=await a.readGlobalEnabled().catch(()=>({}));for(const[t,c]of Object.entries(f))e.push({key:t,category:"plugin",harness:o,scope:"user",installScopes:[],enable:c?"on":"off",effective:c})}return e}

package/node_modules/@weavecode/server/dist/install/plugin-templates.d.ts

@@ -0,0 +1,19 @@
+import type { FingerprintCache } from './fingerprint.js';
+export type PluginTemplateCategory = 'skill' | 'command' | 'agent';
+export interface PluginTemplateUpdate {
+    pluginId: string;
+    category: PluginTemplateCategory;
+    /** 模板名（basename 去 `.md`）。 */
+    name: string;
+    sourcePath: string;
+    targetPath: string;
+    /** 目标缺失或内容与源不同。 */
+    outdated: boolean;
+}
+/** 项目插件模板的漂移清单（含全部声明，`outdated` 标注是否需同步）。 */
+export declare function detectPluginTemplateUpdates(projectPath: string, cache: FingerprintCache): Promise<PluginTemplateUpdate[]>;
+/**
+ * 覆盖物化一个模板副本——显式同步动作，已存在的副本被源覆盖（init 侧的
+ * `writeFileIfAbsent` 不覆盖语义不适用于用户点同步）。
+ */
+export declare function materializePluginTemplate(t: PluginTemplateUpdate): Promise<void>;

package/node_modules/@weavecode/server/dist/install/plugin-templates.js

@@ -0,0 +1 @@
+import{cp as f,mkdir as h,readdir as d,readFile as P,rm as w}from"node:fs/promises";import{homedir as j}from"node:os";import r from"node:path";import{WEAVE_PLUGIN_MANIFEST as y,WeavePluginManifestSchema as k}from"@weavecode/core";import{assetSurfaceFor as v}from"../surfaces.js";const S={skills:"skill",commands:"command",agents:"agent"};async function F(t){const a=[];let s;try{s=await d(t)}catch{return a}for(const o of s){const i=r.join(t,o);try{const c=JSON.parse(await P(r.join(i,y),"utf8")),e=k.safeParse(c);e.success&&a.push({dir:i,manifest:e.data})}catch{}}return a}function E(t,a,s){const o=[];if(!s.templates)return o;const i=v("claude"),c=r.join(t,...i.projectSkillsDir().split("/"));for(const[e,l]of Object.entries(s.templates)){const n=S[e];if(n)for(const p of l??[]){const u=r.resolve(a,p);if(!u.startsWith(r.resolve(a)+r.sep))continue;const m=r.basename(u),g=n==="skill"?c:i.targetDir(n,"project",t,j());o.push({pluginId:s.id,category:n,name:m.replace(/\.md$/,""),sourcePath:u,targetPath:r.join(g,m)})}}return o}export async function detectPluginTemplateUpdates(t,a){const s=[],o=r.join(t,".weave","plugins");for(const{dir:i,manifest:c}of await F(o))for(const e of E(t,i,c)){const[l,n]=e.category==="skill"?await Promise.all([a.get(e.sourcePath),a.get(e.targetPath)]):await Promise.all([a.getFile(e.sourcePath),a.getFile(e.targetPath)]);s.push({...e,outdated:l!==n})}return s}export async function materializePluginTemplate(t){if(t.category==="skill"){await w(t.targetPath,{recursive:!0,force:!0}),await f(t.sourcePath,t.targetPath,{recursive:!0});return}await h(r.dirname(t.targetPath),{recursive:!0}),await f(t.sourcePath,t.targetPath)}

package/node_modules/@weavecode/server/dist/install/project-config.d.ts

@@ -0,0 +1,13 @@
+export interface ProjectConfig {
+    /** When true, the SyncScheduler auto-applies outdated updates on its tick. */
+    autoSync: boolean;
+    /** ISO timestamp of the last successful sync (null if never). */
+    lastSyncAt: string | null;
+}
+export declare const DEFAULT_PROJECT_CONFIG: ProjectConfig;
+/** Read the project's weave config; falls back to defaults when absent. */
+export declare function readProjectConfig(projectPath: string): Promise<ProjectConfig>;
+/** Persist the project config, creating `.weave/` if needed. */
+export declare function writeProjectConfig(projectPath: string, config: ProjectConfig): Promise<void>;
+/** Mark a sync as having happened at the given ISO timestamp. */
+export declare function markSynced(projectPath: string, iso: string): Promise<void>;

package/node_modules/@weavecode/server/dist/install/project-config.js

@@ -0,0 +1,2 @@
+import{readFile as i,writeFile as e,mkdir as s}from"node:fs/promises";import c from"node:path";const o=".weave",u="config.json";export const DEFAULT_PROJECT_CONFIG={autoSync:!1,lastSyncAt:null};function r(t){return c.join(t,o,u)}function y(t){return{autoSync:t.autoSync??DEFAULT_PROJECT_CONFIG.autoSync,lastSyncAt:t.lastSyncAt??DEFAULT_PROJECT_CONFIG.lastSyncAt}}export async function readProjectConfig(t){try{const n=await i(r(t),"utf-8");return y(JSON.parse(n))}catch{return DEFAULT_PROJECT_CONFIG}}export async function writeProjectConfig(t,n){const a=c.join(t,o);await s(a,{recursive:!0}),await e(r(t),`${JSON.stringify(n,null,2)}
+`,"utf-8")}export async function markSynced(t,n){const a=await readProjectConfig(t);await writeProjectConfig(t,{...a,lastSyncAt:n})}

package/node_modules/@weavecode/server/dist/install/reader.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Project file reader — serves text content of Claude Code assets for the
+ * dashboard (e.g. a skill's `SKILL.md`). Pure read: the watch service observes
+ * `.claude/` and `.mcp.json`, so edits made elsewhere still flow through SSE.
+ *
+ * Access is confined to the allowed roots: `.claude/` and `.codex/` (any
+ * depth), `.weave/` (weave's own surface — the watch service observes it, so
+ * the dashboard must be able to open what it lists), the MCP config
+ * (`.mcp.json`), and the instruction files (`CLAUDE.md` / `AGENTS.md`).
+ * Path traversal and absolute paths are rejected before touching the
+ * filesystem.
+ */
+/** A project-relative path tried to escape its allowed roots. */
+export declare class PathEscapeError extends Error {
+    constructor(message: string);
+}
+/** A requested file exceeds the size cap. */
+export declare class FileTooLargeError extends Error {
+    constructor(message: string);
+}
+export interface ProjectFile {
+    content: string;
+    size: number;
+}
+/** Maximum bytes returned by the reader (keep payloads small for the browser). */
+export declare const MAX_BYTES: number;
+/**
+ * Resolve a project-relative path and ensure it stays inside the allowed roots.
+ * Rejects absolute paths and any segment equal to `..`.
+ */
+export declare function resolveProjectFile(projectPath: string, relPath: string): string;
+/** Read a text file from the project, enforcing the allowed-root + size limits. */
+export declare function readProjectFile(projectPath: string, relPath: string): Promise<ProjectFile>;
+/** Read a machine-level harness file (`~/.claude/…`, `~/.codex/…`).
+ * Same allowed roots as the project reader — only the base changes to the
+ * user's home directory. */
+export declare function readGlobalFile(relPath: string): Promise<ProjectFile>;

package/node_modules/@weavecode/server/dist/install/reader.js

@@ -0,0 +1 @@
+import{readFile as l,stat as c}from"node:fs/promises";import{homedir as h}from"node:os";import s from"node:path";import{AssetNotFoundError as a}from"./installer.js";export class PathEscapeError extends Error{constructor(e){super(e),this.name="PathEscapeError"}}export class FileTooLargeError extends Error{constructor(e){super(e),this.name="FileTooLargeError"}}export const MAX_BYTES=512*1024;export function resolveProjectFile(r,e){const t=s.normalize(e).replace(/\\/g,"/");if(s.isAbsolute(e))throw new PathEscapeError(`Absolute paths are not allowed: "${e}"`);if(t.split("/").some(n=>n===".."))throw new PathEscapeError(`Path traversal is not allowed: "${e}"`);if(!(t===".mcp.json"||t==="CLAUDE.md"||t==="AGENTS.md"||t===".claude"||t.startsWith(".claude/")||t===".codex"||t.startsWith(".codex/")||t===".weave"||t.startsWith(".weave/")))throw new PathEscapeError(`Path is outside the allowed roots: "${e}"`);const o=s.join(r,t),i=r.endsWith(s.sep)?r:r+s.sep;if(o!==r&&!o.startsWith(i))throw new PathEscapeError(`Resolved path escapes the project: "${e}"`);return o}export async function readProjectFile(r,e){const t=resolveProjectFile(r,e);let o;try{o=await c(t)}catch{throw new a(`File not found: "${e}"`)}if(!o.isFile())throw new a(`Not a file: "${e}"`);if(o.size>MAX_BYTES)throw new FileTooLargeError(`File exceeds ${MAX_BYTES} bytes: "${e}"`);return{content:await l(t,"utf-8"),size:o.size}}export async function readGlobalFile(r){return readProjectFile(h(),r)}

package/node_modules/@weavecode/server/dist/install/scan-cache.d.ts

@@ -0,0 +1,20 @@
+import { type FileAssetTemplate, type MarketPluginAsset, type McpTemplate, type SkillAsset } from './scanner.js';
+import type { FileAssetCategory } from './file-assets.js';
+/** 四扫描全量原料（不带 kind 门控——门控是调用方的事，缓存只存原料）。 */
+export interface LibraryScan {
+    plugins: MarketPluginAsset[];
+    packRoots: string[];
+    skills: SkillAsset[];
+    mcp: McpTemplate[];
+    files: Record<FileAssetCategory, FileAssetTemplate[]>;
+}
+/** 四扫描编排唯一出口：plugins 先行定 packRoots（包内资源排除），再三线并扫。 */
+export declare function scanLibrary(libPath: string): Promise<LibraryScan>;
+/**
+ * 缓存读取：内存 → 旁挂 `scans.json` → 扫描（write-through）。
+ * 只有导入覆盖/刷新/检查更新等事件失效，开页读路径一律走这里不扫树。
+ */
+export declare function getLibraryScan(libPath: string): Promise<LibraryScan>;
+/** 热层删键 + 删该库的 `.weave-scans/<名>/`；等在途扫描落地再删，防旧结果回写。 */
+export declare function invalidateScan(dir: string): Promise<void>;
+export declare function clearScanCache(): void;

package/node_modules/@weavecode/server/dist/install/scan-cache.js

@@ -0,0 +1 @@
+import{mkdir as f,readFile as p,rm as w,writeFile as m}from"node:fs/promises";import s from"node:path";import{scanLibraryFileAssets as g,scanLibraryMcp as v,scanLibraryPlugins as A,scanLibrarySkills as b}from"./scanner.js";const l="scans.json",u=1;function c(a){const r=s.resolve(a);return s.join(s.dirname(r),".weave-scans",s.basename(r))}const e=new Map,o=new Map;export async function scanLibrary(a){const{plugins:r,packRoots:t}=await A(a),[i,n,y]=await Promise.all([b(a,t),v(a,t),g(a,t)]);return{plugins:r,packRoots:t,skills:i,mcp:n,files:y}}export async function getLibraryScan(a){const r=s.resolve(a),t=e.get(r);if(t)return t;const i=o.get(r);if(i)return i;const n=d(r);o.set(r,n);try{return await n}finally{o.delete(r)}}async function d(a){const r=await k(a);if(r)return e.set(a,r),r;const t=await scanLibrary(a);return await L(a,t),e.set(a,t),t}async function k(a){try{const r=JSON.parse(await p(s.join(c(a),l),"utf8"));return!r||r.version!==u||!Array.isArray(r.plugins)||!Array.isArray(r.packRoots)||!Array.isArray(r.skills)||!Array.isArray(r.mcp)||!r.files||typeof r.files!="object"?null:r}catch{return null}}async function L(a,r){try{await f(c(a),{recursive:!0}),await m(s.join(c(a),l),JSON.stringify({version:u,...r}),"utf8")}catch{}}export async function invalidateScan(a){const r=s.resolve(a);e.delete(r);const t=o.get(r);t&&await t.catch(()=>{}),await w(c(r),{recursive:!0,force:!0}),e.delete(r)}export function clearScanCache(){e.clear()}

package/node_modules/@weavecode/server/dist/install/scanner.d.ts

@@ -0,0 +1,111 @@
+import type { Harness } from '@weavecode/core';
+import { type FileAssetCategory } from './file-assets.js';
+import { type ToolkitKind, type ToolkitComponent } from '../hooks/toolkit-scan.js';
+export interface SkillAsset {
+    /** Skill name — the containing directory's basename. */
+    name: string;
+    /** Absolute path to the skill directory (copy this whole tree). */
+    dirPath: string;
+    /** Path relative to the library root (for display). */
+    relPath: string;
+    /**
+     * The skill's parent directory (typically a `skills/` folder) relative to the
+     * library root. Skills sharing a parent group together in the panel; an empty
+     * string means the skill sits directly under the library root.
+     */
+    group: string;
+}
+/** Minimal MCP server template (matches Claude Code `.mcp.json` entry shape). */
+export interface McpTemplate {
+    name: string;
+    command: string;
+    args?: string[];
+    env?: Record<string, string>;
+    /** Absolute path to the JSON file this template was loaded from. */
+    sourcePath: string;
+    /** Path relative to the library root (for display). */
+    relPath: string;
+}
+/** A single-file asset template (command / agent / workflow / rule / output-style). */
+export interface FileAssetTemplate {
+    /** Asset name — the file stem (e.g. "review" for review.md). */
+    name: string;
+    /** Absolute path to the template file (install = copy this one file). */
+    filePath: string;
+    /** Path relative to the library root (for display). */
+    relPath: string;
+    /** The kind directory's parent relative to the library root, for grouping. */
+    group: string;
+    category: FileAssetCategory;
+}
+/** 插件包发现于注册库内（市场扫描出口；web/src/lib/api.ts 镜像同形）。 */
+export interface MarketPluginAsset {
+    name: string;
+    version: string;
+    description?: string;
+    /** CC 注册键 `name@<市场>`（仅 CC 落地包有）：UI 直接展示「是哪个市场的插件」。
+     *  键形由 harness 的 `pluginKey` 拼（server 不写 harness 硬编码）；非市场来源
+     *  落 weave 自建市场。 */
+    key?: string;
+    /** Absolute path to the pack directory (install / enable source). */
+    dirPath: string;
+    /** Pack dir relative to the library root (posix; 包子树排除根的匹配键). */
+    relPath: string;
+    ccPack: boolean;
+    weavePack: boolean;
+    kind: ToolkitKind;
+    components: ToolkitComponent[];
+    targets: Harness[];
+    /** Pack-internal skills carrying a SKILL.md（隶属包，随包启停，不独立安装）。 */
+    skills: string[];
+}
+/** `scanLibraryPlugins` 出参：可展示的包 + 全部排除根（见 packRoots 语义）。 */
+export interface LibraryPluginsScan {
+    /** 可装载成分解析成功的包（web plugin 区展示用）。 */
+    plugins: MarketPluginAsset[];
+    /**
+     * 谓词命中的全部包根 relPath——**含 `parseToolkitPack` 返回 null 的空成分包**
+     * （manifest-only 外壳：plugins 不产出，但其子树资源仍隶属包，必须排除，
+     * 否则壳内嵌套的 skill/表面成分会从 skill 区泄漏）。空串 = 根即包（整库排除）。
+     */
+    packRoots: string[];
+}
+/**
+ * 扫描库内插件包：**全递归**遍历任意深度子目录做窄谓词命中 → 解析委托
+ * `parseToolkitPack` → 停钻（包是原子单元，不进包内找嵌套包）。`.claude`/
+ * `.codex` 等点目录与 SKIP_DIRS 由 walk 跳过。
+ *
+ * 包内资源（skill/表面成分/mcp）**隶属该包**——不独立安装、随包启停；
+ * 路由侧把 `packRoots` 作为 excludeRelRoots 传给其余三条扫描。
+ */
+export declare function scanLibraryPlugins(libPath: string): Promise<LibraryPluginsScan>;
+/**
+ * Recursively scan a library directory for skills. A skill is any directory
+ * that directly contains a `SKILL.md` file. Once a skill directory is found we
+ * do NOT descend into it (its `assets/`, `scripts/`, `references/` subtrees are
+ * part of the skill, not separate skills).
+ *
+ * Handles both library layouts: weave-templates (`templates/skills/<name>/SKILL.md`)
+ * and personal libraries like zj-skills (`<name>/SKILL.md` at the top level).
+ *
+ * `excludeRelRoots`：位于插件包子树内的 skill 不产出——skill 隶属 plugin，
+ * 随包启停、不独立安装（缺省空数组 = 现状行为，存量调用零改）。
+ */
+export declare function scanLibrarySkills(libPath: string, excludeRelRoots?: string[]): Promise<SkillAsset[]>;
+/**
+ * Scan a library for MCP server templates. A template is a JSON file that
+ * either (a) IS a single server config `{ command, args?, env? }` named after
+ * its file stem, or (b) wraps multiple servers under `mcpServers`. Two file
+ * layouts are recognised: `<lib>/mcp/<name>.json` and `<lib>/<name>.mcp.json`.
+ * Files that fail to parse are skipped (never throw).
+ */
+export declare function scanLibraryMcp(libPath: string, excludeRelRoots?: string[]): Promise<McpTemplate[]>;
+/**
+ * Scan a library for single-file asset templates. A directory whose basename
+ * matches a kind dir ("commands", "agents", "workflows", "rules",
+ * "output-styles") contributes its direct files of the matching extension;
+ * the kind dir is not descended into. Directories containing SKILL.md are
+ * always skipped — they are skill dirs, even if coincidentally named like a
+ * kind dir. Results are grouped per kind.
+ */
+export declare function scanLibraryFileAssets(libPath: string, excludeRelRoots?: string[]): Promise<Record<FileAssetCategory, FileAssetTemplate[]>>;

package/node_modules/@weavecode/server/dist/install/scanner.js

@@ -0,0 +1 @@
+import{readdir as p,readFile as k,stat as F}from"node:fs/promises";import{join as c,basename as u,relative as l,dirname as j}from"node:path";import{FILE_ASSET_SPECS as P,FILE_ASSET_CATEGORIES as h}from"./file-assets.js";import{hasNonEmptyModules as L}from"../watch/plugin-mods.js";import{parseToolkitPack as E}from"../hooks/toolkit-scan.js";import{marketIdOf as O}from"../market/identity.js";import{pluginSurfaceFor as T}from"../surfaces.js";function C(e){if(!(!(e.ccPack||e.kind==="mod")||!e.targets.includes("claude")))return T("claude").pluginKey(e.name,O(e.dir))}const y=new Set(["node_modules",".git","dist","build",".next","coverage",".cache"]);async function d(e){try{return(await F(e)).isFile()}catch{return!1}}async function I(e){if(await d(c(e,".claude-plugin","plugin.json"))||await d(c(e,"weave-plugin.json")))return!0;try{const a=JSON.parse(await k(c(e,"hooks","hooks.json"),"utf8"));return L(a)}catch{return!1}}const x=10;export async function scanLibraryPlugins(e){const a=[],n=[],o=async(t,r)=>{if(await I(t)){n.push(l(e,t).replace(/\\/g,"/"));const s=await E(t,{root:e,provenance:"market"},"");if(s){const m=[];for(const w of s.skills)await d(c(t,"skills",w,"SKILL.md"))&&m.push(w);const f=C(s);a.push({name:s.name,version:s.version,...s.description?{description:s.description}:{},...f?{key:f}:{},dirPath:s.dir,relPath:l(e,t).replace(/\\/g,"/"),ccPack:s.ccPack,weavePack:s.weavePack,kind:s.kind,components:s.components,targets:s.targets,skills:m})}return}if(r>=x)return;let i;try{i=await p(t,{withFileTypes:!0})}catch{return}for(const s of i)s.isDirectory()&&(s.name.startsWith(".")||y.has(s.name)||await o(c(t,s.name),r+1))};return await o(e,0),{plugins:a.sort((t,r)=>t.relPath.localeCompare(r.relPath)),packRoots:n.sort((t,r)=>t.localeCompare(r))}}function g(e,a){return!a||a.length===0?!1:a.some(n=>n===""||e===n||e.startsWith(`${n}/`))}export async function scanLibrarySkills(e,a){const n=[];return await b(e,e,n,a),n.sort((o,t)=>o.name.localeCompare(t.name))}async function b(e,a,n,o){if(g(l(e,a).replace(/\\/g,"/"),o))return;let t;try{t=await p(a,{withFileTypes:!0})}catch{return}if(t.some(r=>r.isFile()&&r.name==="SKILL.md")){n.push({name:u(a),dirPath:a,relPath:l(e,a).replace(/\\/g,"/"),group:l(e,j(a)).replace(/\\/g,"/")});return}for(const r of t)r.isDirectory()&&(r.name.startsWith(".")||y.has(r.name)||await b(e,c(a,r.name),n,o))}export async function scanLibraryMcp(e,a){const n=[];await v(e,e,n,a);const o=[];for(const t of n)try{const r=JSON.parse(await k(t.abs,"utf-8"));$(r,t,o)}catch{}return o.sort((t,r)=>t.name.localeCompare(r.name))}async function v(e,a,n,o){if(g(l(e,a).replace(/\\/g,"/"),o))return;let t;try{t=await p(a,{withFileTypes:!0})}catch{return}for(const r of t)if(r.isDirectory()){if(r.name.startsWith(".")||y.has(r.name))continue;await v(e,c(a,r.name),n,o)}else if(r.isFile()){const i=r.name.replace(/\.mcp\.json$/i,"").replace(/\.json$/i,""),s=/\.mcp\.json$/i.test(r.name),m=u(a)==="mcp"&&/\.json$/i.test(r.name);(s||m)&&i&&n.push({abs:c(a,r.name),rel:l(e,c(a,r.name)).replace(/\\/g,"/")})}}function $(e,a,n){const o=a.rel.replace(/\.mcp\.json$/i,"").replace(/\.json$/i,"").replace(/^.*\//,"");if(e&&typeof e=="object"&&!Array.isArray(e)){const t=e,r=t.mcpServers;if(r&&typeof r=="object"&&!Array.isArray(r)){for(const[s,m]of Object.entries(r)){const f=S(s,m);f&&n.push({...f,sourcePath:a.abs,relPath:a.rel})}return}const i=S(o,t);i&&n.push({...i,sourcePath:a.abs,relPath:a.rel})}}function S(e,a){if(!a||typeof a!="object"||Array.isArray(a))return null;const n=a;if(typeof n.command!="string"||!n.command)return null;const o={name:e,command:n.command};if(Array.isArray(n.args)&&(o.args=n.args.filter(t=>typeof t=="string")),n.env&&typeof n.env=="object"&&!Array.isArray(n.env)){const t={};for(const[r,i]of Object.entries(n.env))typeof i=="string"&&(t[r]=i);Object.keys(t).length&&(o.env=t)}return o}const W=Object.fromEntries(h.flatMap(e=>Object.values(P[e].dirs).map(a=>a?.project).filter(a=>a!==void 0).map(a=>[u(a),e])));export async function scanLibraryFileAssets(e,a){const n={};for(const o of h)n[o]=[];await A(e,e,n,a);for(const o of h)n[o].sort((t,r)=>t.name.localeCompare(r.name));return n}async function A(e,a,n,o){if(g(l(e,a).replace(/\\/g,"/"),o))return;let t;try{t=await p(a,{withFileTypes:!0})}catch{return}if(t.some(i=>i.isFile()&&i.name==="SKILL.md"))return;const r=W[u(a)];if(r){const i=P[r];for(const s of t){if(!s.isFile()||!s.name.endsWith(i.ext))continue;const m=s.name.slice(0,-i.ext.length);if(!m)continue;const f=c(a,s.name);n[r].push({name:m,filePath:f,relPath:l(e,f).replace(/\\/g,"/"),group:l(e,j(a)).replace(/\\/g,"/"),category:r})}return}for(const i of t)i.isDirectory()&&(i.name.startsWith(".")||y.has(i.name)||await A(e,c(a,i.name),n,o))}

package/node_modules/@weavecode/server/dist/install/settings-mcp.d.ts

@@ -0,0 +1,18 @@
+import type { EnableOverride } from '@weavecode/core';
+export type McpEnableState = 'enabled' | 'disabled' | 'default';
+export interface McpEnableMap {
+    /** name → enable state for servers with an explicit override. */
+    overrides: Record<string, McpEnableState>;
+    /** Whether `enableAllProjectMcpServers` is set true. */
+    enableAll: boolean;
+}
+/** Read the MCP enable map from settings.json. */
+export declare function readMcpEnableMap(projectPath: string): Promise<McpEnableMap>;
+/** 某服务器的覆写态，以模型词表返回（无覆写 = inherit）。 */
+export declare function mcpOverrideOf(map: McpEnableMap, name: string): EnableOverride;
+/** 生效态解析（服务端唯一）：显式覆写优先，未覆写跟随 enableAll。 */
+export declare function resolveMcpEffective(map: McpEnableMap, name: string): boolean;
+/** Set the enable state for one project MCP server, then persist settings.json. */
+export declare function setMcpEnableState(projectPath: string, name: string, state: McpEnableState): Promise<void>;
+/** 以模型词表（on/off/inherit）覆写某服务器的启停，落 settings 三键。 */
+export declare function setMcpEnableOverride(projectPath: string, name: string, state: EnableOverride): Promise<void>;

package/node_modules/@weavecode/server/dist/install/settings-mcp.js

@@ -0,0 +1,2 @@
+import{readFile as f,writeFile as u,mkdir as b,access as p}from"node:fs/promises";import o from"node:path";const c=".claude/settings.json";async function v(r){try{return await p(r),!0}catch{return!1}}async function d(r){const e=o.join(r,c);if(!await v(e))return{};try{const n=JSON.parse(await f(e,"utf-8"));return n&&typeof n=="object"&&!Array.isArray(n)?n:{}}catch{return{}}}async function y(r,e){const n=o.join(r,c);await b(o.dirname(n),{recursive:!0}),await u(n,`${JSON.stringify(e,null,2)}
+`,"utf-8")}export async function readMcpEnableMap(r){const e=await d(r),n=i(e.enabledMcpjsonServers),t=i(e.disabledMcpjsonServers),a={};for(const s of n)a[s]="enabled";for(const s of t)a[s]="disabled";return{overrides:a,enableAll:e.enableAllProjectMcpServers===!0}}const M={enabled:"on",disabled:"off",default:"inherit"},S={on:"enabled",off:"disabled",inherit:"default"};export function mcpOverrideOf(r,e){return M[r.overrides[e]??"default"]}export function resolveMcpEffective(r,e){const n=r.overrides[e];return n==="enabled"?!0:n==="disabled"?!1:r.enableAll}export async function setMcpEnableState(r,e,n){const t=await d(r),a=new Set(i(t.enabledMcpjsonServers)),s=new Set(i(t.disabledMcpjsonServers));a.delete(e),s.delete(e),n==="enabled"?a.add(e):n==="disabled"&&s.add(e),l(t,"enabledMcpjsonServers",a),l(t,"disabledMcpjsonServers",s),await y(r,t)}export function setMcpEnableOverride(r,e,n){return setMcpEnableState(r,e,S[n])}function i(r){return Array.isArray(r)?r.filter(e=>typeof e=="string"):[]}function l(r,e,n){n.size===0?delete r[e]:r[e]=[...n].sort()}

package/node_modules/@weavecode/server/dist/install/updates.d.ts

@@ -0,0 +1,91 @@
+import type { Harness } from '@weavecode/core';
+import { FingerprintCache } from './fingerprint.js';
+import { type LibraryIndex } from './library-index.js';
+import { readGlobalSkills } from './global-config.js';
+import type { FileAssetCategory } from './file-assets.js';
+import { type PluginTemplateUpdate } from './plugin-templates.js';
+import type { LibraryRow } from '../repositories/libraries.js';
+/**
+ * Update detection — compares installed assets against their library sources.
+ *
+ * An installed skill is "outdated" when its directory content hash differs from
+ * the source directory's hash; an MCP entry is outdated when its config hash
+ * differs from the source template's; a file asset when its file hash differs.
+ * Assets without a matching library source are `custom` (no update path) —
+ * e.g. hand-authored skills or MCP entries added via the form, not from a
+ * template.
+ *
+ * Scope + agent are inferred from the install path:
+ *   project skill → `<project>/.claude/skills/<name>/` (claude)
+ *                   `<project>/.codex/skills/<name>/`  (codex)
+ *   user    skill → `~/.claude/skills/<name>/` (claude) · `~/.agents/skills/<name>/` (codex)
+ *   project mcp   → `.mcp.json`
+ *   user    mcp   → `~/.claude.json`
+ *   codex   mcp   → `~/.codex/config.toml`
+ */
+export interface SkillUpdate {
+    name: string;
+    scope: 'project' | 'user';
+    /** Which agent's surface the skill is installed on. */
+    agent: Harness;
+    /** true = installed content differs from source (update available). */
+    outdated: boolean;
+    /** true = no library source found (cannot update). */
+    custom: boolean;
+    /** true = 账本登记过但盘上已不在（补齐路径会重装）。 */
+    missing?: boolean;
+    /** Resolved source directory when not custom. */
+    sourceDir?: string;
+    libraryId?: number;
+}
+export interface McpUpdate {
+    name: string;
+    scope: 'project' | 'user';
+    /** Which agent's surface the server is configured on (Codex = config.toml). */
+    agent?: Harness;
+    outdated: boolean;
+    custom: boolean;
+    /** true = 账本登记过但配置已不在（补齐路径会重新写回）。 */
+    missing?: boolean;
+    libraryId?: number;
+}
+export interface FileAssetUpdate {
+    category: FileAssetCategory;
+    name: string;
+    scope: 'project' | 'user';
+    outdated: boolean;
+    custom: boolean;
+    /** true = 账本登记过但盘上已不在（补齐路径会重装）。 */
+    missing?: boolean;
+    libraryId?: number;
+}
+export interface UpdateReport {
+    skills: SkillUpdate[];
+    mcp: McpUpdate[];
+    files: FileAssetUpdate[];
+    /** 项目自有 weave 源（`.weave/plugins` 的 manifest.templates）的物化漂移。 */
+    pluginTemplates: PluginTemplateUpdate[];
+    /** Count of outdated, non-custom assets (plugin templates included). */
+    available: number;
+}
+/**
+ * Detect skill + MCP + file-asset updates for a project against the registered
+ * libraries. `index` may be passed in (reused across calls) or omitted to
+ * rebuild it.
+ */
+export declare function detectUpdates(projectPath: string, libraries: LibraryRow[], cache: FingerprintCache, index?: LibraryIndex): Promise<UpdateReport>;
+/**
+ * 全项目「有更新待同步」计数（projectId → available，含 0）：项目行角标推送面
+ * 的数据源。与 `GET /projects/:id/updates` 同一检测函数（同源不双算），库索引
+ * 一轮构建一次、整轮复用。
+ */
+export declare function detectProjectUpdateCounts(projects: ReadonlyArray<{
+    id: number;
+    path: string;
+}>, libraries: LibraryRow[], cache: FingerprintCache): Promise<Record<number, number>>;
+/** Detect skill updates (project + user, Claude + Codex) against the index. */
+export declare function detectSkillUpdates(projectPath: string, cache: FingerprintCache, idx: LibraryIndex): Promise<SkillUpdate[]>;
+/** Detect single-file asset updates (commands/agents/workflows/rules/output-styles). */
+export declare function detectFileAssetUpdates(projectPath: string, cache: FingerprintCache, idx: LibraryIndex): Promise<FileAssetUpdate[]>;
+/** Re-export for callers that only want the global skills listing. */
+export { readGlobalSkills };

package/node_modules/@weavecode/server/dist/install/updates.js

@@ -0,0 +1 @@
+import{readdir as g,stat as I}from"node:fs/promises";import{homedir as k}from"node:os";import u from"node:path";import{hashMcpConfig as l}from"./fingerprint.js";import{buildLibraryIndex as h,findSkillSource as y,findMcpSource as f,findFileAssetSource as b}from"./library-index.js";import{readMcpServers as x}from"./installer.js";import{readGlobalMcpServers as F,readGlobalSkills as P}from"./global-config.js";import{readCodexMcpServers as E}from"./codex-toml.js";import{FILE_ASSET_CATEGORIES as T,FILE_ASSET_SPECS as v}from"./file-assets.js";import{assetSurfaces as j}from"../surfaces.js";import{readInstalledLedger as C}from"./install-ledger.js";import{detectPluginTemplateUpdates as A}from"./plugin-templates.js";export async function detectUpdates(r,a,i,o){const s=o??await h(a),t=await detectSkillUpdates(r,i,s),e=await U(r,s),n=await detectFileAssetUpdates(r,i,s);await L(r,{skills:t,mcp:e,files:n},s);const c=await A(r,i),p=t.filter(m=>!m.custom&&m.outdated).length+e.filter(m=>!m.custom&&m.outdated).length+n.filter(m=>!m.custom&&m.outdated).length+c.filter(m=>m.outdated).length;return{skills:t,mcp:e,files:n,pluginTemplates:c,available:p}}export async function detectProjectUpdateCounts(r,a,i){const o=await h(a),s={};for(const t of r){const e=await detectUpdates(t.path,a,i,o);s[t.id]=e.available}return s}async function L(r,a,i){for(const o of await C(r)){if(o.category==="skill"){if(!y(i,o.name)||a.skills.some(t=>t.scope==="project"&&t.name===o.name&&t.agent===o.agent))continue;a.skills.push({name:o.name,scope:"project",agent:o.agent,outdated:!0,custom:!1,missing:!0});continue}if(o.category==="mcp"){if(!f(i,o.name)||a.mcp.some(t=>t.scope==="project"&&t.name===o.name))continue;a.mcp.push({name:o.name,scope:"project",outdated:!0,custom:!1,missing:!0});continue}const s=o.assetCategory;s===void 0||!b(i,s,o.name)||a.files.some(t=>t.scope==="project"&&t.category===s&&t.name===o.name)||a.files.push({category:s,name:o.name,scope:"project",outdated:!0,custom:!1,missing:!0})}}async function M(r){let a;try{a=await g(r,{withFileTypes:!0})}catch{return[]}const i=[];for(const o of a)if(!(!o.isDirectory()&&!o.isSymbolicLink()))try{(await I(u.join(r,o.name))).isDirectory()&&i.push(o.name)}catch{}return i}export async function detectSkillUpdates(r,a,i){const o=k(),s=[...j().map(e=>({dir:u.join(r,...e.projectSkillsDir().split("/")),scope:"project",agent:e.harness})),...j().map(e=>({dir:e.globalSkillsRoots(o)[0],scope:"user",agent:e.harness}))],t=[];for(const e of s)for(const n of await M(e.dir)){const c=u.join(e.dir,n),p=y(i,n);if(!p){t.push({name:n,scope:e.scope,agent:e.agent,outdated:!1,custom:!0});continue}const[m,d]=await Promise.all([a.get(c),a.get(p.dirPath)]);t.push({name:n,scope:e.scope,agent:e.agent,outdated:m!==d,custom:!1,sourceDir:p.dirPath,libraryId:p.libraryId})}return t}export async function detectFileAssetUpdates(r,a,i){const o=[];for(const s of T){const t=v[s],e=t.dirs.claude?.project;if(!e)continue;const n=u.join(r,...e.split("/"));let c;try{c=(await g(n,{withFileTypes:!0})).filter(p=>p.isFile()&&p.name.endsWith(t.ext)).map(p=>p.name)}catch{continue}for(const p of c){const m=p.slice(0,-t.ext.length),d=b(i,s,m);if(!d){o.push({category:s,name:m,scope:"project",outdated:!1,custom:!0});continue}const[S,w]=await Promise.all([a.getFile(u.join(n,p)),a.getFile(d.filePath)]);o.push({category:s,name:m,scope:"project",outdated:S!==w,custom:!1,libraryId:d.libraryId})}}return o}async function U(r,a){const[i,o,s]=await Promise.all([x(r).catch(()=>({})),F().catch(()=>({})),E().catch(()=>({}))]),t=[];for(const[e,n]of Object.entries(i)){const c=f(a,e);c?t.push({name:e,scope:"project",outdated:l(n)!==l(c.config),custom:!1,libraryId:c.libraryId}):t.push({name:e,scope:"project",outdated:!1,custom:!0})}for(const[e,n]of Object.entries(o)){const c=f(a,e);c?t.push({name:e,scope:"user",outdated:l(n)!==l(c.config),custom:!1,libraryId:c.libraryId}):t.push({name:e,scope:"user",outdated:!1,custom:!0})}for(const[e,n]of Object.entries(s)){const c=f(a,e);c?t.push({name:e,scope:"user",agent:"codex",outdated:l(n)!==l(c.config),custom:!1,libraryId:c.libraryId}):t.push({name:e,scope:"user",agent:"codex",outdated:!1,custom:!0})}return t}export{P as readGlobalSkills};

package/node_modules/@weavecode/server/dist/market/builtin.d.ts

@@ -0,0 +1,41 @@
+import { type InstallLinkMode } from './install-link.js';
+import type { LibraryRepository } from '../repositories/libraries.js';
+/**
+ * 内置仓在市场里的 id。它**必须**等于 harness 的注册键缺省市场
+ * （`PluginSurface.pluginKey` 的 `name@weave` 里那个 `weave`）——`marketIdOf`
+ * 会把 `<dataDir>/market/weave/<...>` 下的包判成 `name@weave`，两边同名才使得
+ * 「内置仓落地前回落自建市场 / 落地后判成 weaver 市场」得到**同一个键**。
+ * 故这里直接引 harness 的常量，不另抄一个字符串。
+ */
+export declare const BUILTIN_MARKET_ID = "weave";
+/** 内置仓在数据目录里的落点：`<dataDir>/market/weave/`。 */
+export declare function builtinMarketDir(dataDir: string): string;
+/** 内置工具包扫描根（仓内 `plugins/`）——`ToolkitSource.root` 用。 */
+export declare function builtinPacksDir(dataDir: string): string;
+/** 内置 SPI 规则包装载根（仓内 `rules/`）。 */
+export declare function builtinRulesDir(dataDir: string): string;
+export declare function isBuiltinMarketDir(candidate: string, dataDir: string): boolean;
+export interface BuiltinMarketResult {
+    /** 本次是否重铺（false = 既有落点已指向当前源，未动盘）。 */
+    changed: boolean;
+    /** 链接或复制；重铺失败时为 undefined。 */
+    form?: InstallLinkMode;
+    error?: string;
+}
+/**
+ * 把 `@weavecode/templates` 随包发布的内置仓落到 `<dataDir>/market/weave/`，
+ * 并登记为一条 `libraries` 行（`/market` 与资源管理页据此把它当一个仓库渲染）。
+ *
+ * **落点用链接（失败回退复制）**：这是「公共全局位置优先链接」的直接落实 ——
+ * 落点不是数据，而是随包发布的只读内容，链接既不复制一份、也让「改仓即改内置」
+ * 在开发态（源 = `src/resources`）真正即时生效。故**不得**往落点写任何东西
+ * （清单/扫描缓存都不落这里：扫描缓存写 `<dataDir>/market/.weave-scans/`，
+ * 是市场根的**兄弟**目录）。
+ *
+ * 幂等：落点已是指向当前源的链接则不动盘；源变更（换包版本 / 开发态换目录）或
+ * 落点是旧的复制件时重铺 —— 重铺走 `removeInstalled`（lstat 判定），
+ * 绝不会把链接当目录递归删而删穿到包内。
+ */
+export declare function ensureBuiltinMarket(deps: {
+    libraries: Pick<LibraryRepository, 'add' | 'dataDir'>;
+}): Promise<BuiltinMarketResult>;

package/node_modules/@weavecode/server/dist/market/builtin.js

@@ -0,0 +1 @@
+import i from"node:path";import{lstat as u,realpath as s}from"node:fs/promises";import{builtinMarketRoot as c}from"@weavecode/templates";import{WEAVE_MARKETPLACE as m}from"@weavecode/harness";import{marketDir as f}from"./manifest.js";import{linkOrCopy as p,removeInstalled as h}from"./install-link.js";export const BUILTIN_MARKET_ID=m;export function builtinMarketDir(r){return i.join(f(r),BUILTIN_MARKET_ID)}export function builtinPacksDir(r){return i.join(builtinMarketDir(r),"plugins")}export function builtinRulesDir(r){return i.join(builtinMarketDir(r),"rules")}export function isBuiltinMarketDir(r,n){return i.resolve(r)===i.resolve(builtinMarketDir(n))}export async function ensureBuiltinMarket(r){const n=r.libraries.dataDir,o=c(),t=builtinMarketDir(n);r.libraries.add({path:t,kind:"both"});const l=await s(o),e=await u(t).catch(()=>null);if(e){if(e.isSymbolicLink()&&await s(t).catch(()=>null)===l)return{changed:!1,form:"link"};await h(t)}try{return{changed:!0,form:await p(o,t)}}catch(a){return{changed:!1,error:a instanceof Error?a.message:String(a)}}}

package/node_modules/@weavecode/server/dist/market/identity.d.ts

@@ -0,0 +1,9 @@
+/**
+ * 包所属的市场身份——**判据的唯一实现**（安装分流与 UI 展示同源）。
+ *
+ * 判据：包目录落在 `<dataDir>/market/<id>/…` 里 = 外部市场导入的包 → 返回该市场
+ * id（CC 键 `name@<id>`，文件留在数据目录、可整体迁移）；否则 undefined = weave
+ * 自己的包（内置仓 `plugins/`、SPI 插件、手加目录）→ 走 weave 自建
+ * 市场 `name@weave`。
+ */
+export declare function marketIdOf(packDir: string, marketRoot?: string): string | undefined;

package/node_modules/@weavecode/server/dist/market/identity.js

@@ -0,0 +1 @@
+import t from"node:path";import{marketDir as s}from"./manifest.js";export function marketIdOf(e,o=s()){const r=t.relative(t.resolve(o),t.resolve(e));return r===""||r.startsWith("..")||t.isAbsolute(r)?void 0:r.split(t.sep)[0]||void 0}

package/node_modules/@weavecode/server/dist/market/import.d.ts

@@ -0,0 +1,45 @@
+import type { LibraryRepository, LibraryRow } from '../repositories/libraries.js';
+import { type MarketManifest } from './manifest.js';
+export interface GitExecOptions {
+    timeout: number;
+    maxBuffer: number;
+    windowsHide: boolean;
+}
+export type GitResult = {
+    stdout: string;
+    stderr: string;
+};
+/** git 执行注入点（execFile 边界）：测试传假 exec 断言参数数组，不真联网。 */
+export type GitExec = (file: string, args: string[], options: GitExecOptions) => Promise<GitResult>;
+export interface ImportDeps {
+    libraries: LibraryRepository;
+    /** 覆盖 dataDir（测试注入）；默认 getDataDir()。 */
+    dataDir?: string;
+    /** 覆盖 git 执行（测试注入假 exec）。 */
+    execGit?: GitExec;
+}
+export interface ImportedResource {
+    /** 市场目录名（slug，白名单 `[a-z0-9-]`）。 */
+    id: string;
+    /** 市场内绝对路径。 */
+    dir: string;
+    /** 相对 dataDir 的 posix 形（libraries.path 规范存储形）。 */
+    relPath: string;
+    manifest: MarketManifest;
+    libraryId: number;
+    /** 同一来源重复导入 → 复用同一市场目录与 libraries 行（不新增）。 */
+    reused: boolean;
+    /** 同源再导入时覆盖刷新了缓存内容（M4：覆盖重导 + 触发重扫）。 */
+    refreshed: boolean;
+}
+/** resourceId slug：白名单 `[a-z0-9-]`，其余字符折叠为 `-`；空结果回落 `resource`（防穿越）。 */
+export declare function slugifyResourceId(name: string): string;
+/** git URL 协议白名单：`https://`、`ssh://`、`git@host:path`；拒 `ext::`、`--upload-pack` 等向量。 */
+export declare function assertSafeGitUrl(raw: string): string;
+/** 本地目录 → 复制进市场 + 写清单 + 登记 libraries 行。 */
+export declare function importFromDir(srcPath: string, deps: ImportDeps): Promise<ImportedResource>;
+/** git URL → clone 进市场 + 写清单 + 登记 libraries 行（execFile 数组传参无 shell）。 */
+export declare function importFromGit(rawUrl: string, deps: ImportDeps): Promise<ImportedResource>;
+/** legacy 外部源显式迁入：复制进市场 + 改写既有 libraries 行为相对形（不新增行）。 */
+export declare function importLibraryIntoMarket(row: LibraryRow, deps: ImportDeps): Promise<ImportedResource>;
+export declare const defaultGitExec: GitExec;

package/node_modules/@weavecode/server/dist/market/import.js

@@ -0,0 +1,2 @@
+import{execFile as M}from"node:child_process";import{cp as F,mkdir as v,readdir as P,rename as b,rm as p,stat as I}from"node:fs/promises";import s from"node:path";import{promisify as z}from"node:util";import{getDataDir as h}from"../db/paths.js";import{isInsideDir as A,toRelPosix as g}from"./resolve.js";import{isBuiltinMarketDir as C}from"./builtin.js";import{marketDir as D,readManifest as y,writeManifest as w}from"./manifest.js";const O=z(M),k=6e4,B=2e3;export function slugifyResourceId(r){const t=r.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"");return/^[a-z0-9][a-z0-9-]*$/.test(t)?t:"resource"}export function assertSafeGitUrl(r){const t=r.trim();if(!t)throw new Error("Missing git URL");if(t.includes("--upload-pack"))throw new Error("Invalid git URL (--upload-pack rejected)");if(!(t.startsWith("https://")||t.startsWith("ssh://")||/^git@[^:/\s]+:/.test(t)))throw new Error(`Unsupported git URL (allowed: https/ssh): ${t}`);if(/[\s\r\n\t]/.test(t))throw new Error("Invalid git URL (whitespace)");return t}function l(){return new Date().toISOString()}function S(r){return r.length>B?`${r.slice(0,B)}\u2026(truncated)`:r}function d(r,t){if(!A(r,t))throw new Error(`Import target escapes the market directory: ${r}`)}async function j(r){try{return await I(r),!0}catch{return!1}}async function x(r,t){let a=s.join(t,r),i=1;for(;await j(a);)i+=1,a=s.join(t,`${r}-${i}`);return a}async function L(r,t){let a;try{a=await P(r,{withFileTypes:!0})}catch{return null}for(const i of a){if(!i.isDirectory())continue;const e=s.join(r,i.name);if((await y(e))?.origin===t)return e}return null}async function E(r,t,a,i,e=!1){const n=a.dataDir??h(),o=g(r,n),u=a.libraries.add({path:o,kind:"both"});return{id:s.basename(r),dir:r,relPath:o,manifest:t,libraryId:u.id,reused:i,refreshed:e}}async function H(r,t,a){const i=`${t}.refresh-tmp`;await p(i,{recursive:!0,force:!0}),await F(r,i,{recursive:!0}),d(s.resolve(i),a),await p(t,{recursive:!0,force:!0}),await b(i,t)}export async function importFromDir(r,t){const a=t.dataDir??h(),i=s.resolve(r);if(!(await I(i).catch(()=>null))?.isDirectory())throw new Error(`Not a directory: ${r}`);const e=D(a),n=await L(e,i);if(n){const c=await y(n);await H(i,n,e);const f={...c,importedAt:l()};return await w(n,f),E(n,f,t,!0,!0)}const o=await x(slugifyResourceId(s.basename(i)),e);d(o,e),await v(s.dirname(o),{recursive:!0}),await F(i,o,{recursive:!0});const u={source:"dir",origin:i,importedAt:l()};return await w(o,u),d(s.resolve(o),e),E(o,u,t,!1)}export async function importFromGit(r,t){const a=t.dataDir??h(),i=assertSafeGitUrl(r),e=D(a),n=await L(e,i);if(n){const f=await y(n),m=`${n}.refresh-tmp`;await p(m,{recursive:!0,force:!0});const U=["clone","--depth","1",i,m];try{await(t.execGit??defaultGitExec)("git",U,{timeout:k,maxBuffer:4*1024*1024,windowsHide:!0})}catch(G){throw new Error(`git clone failed: ${S(R(G))}`)}d(s.resolve(m),e),await p(n,{recursive:!0,force:!0}),await b(m,n);const $={...f,importedAt:l()};return await w(n,$),E(n,$,t,!0,!0)}const o=await x(slugifyResourceId(T(i)),e);d(o,e),await v(e,{recursive:!0});const u=["clone","--depth","1",i,o];try{await(t.execGit??defaultGitExec)("git",u,{timeout:k,maxBuffer:4*1024*1024,windowsHide:!0})}catch(f){throw new Error(`git clone failed: ${S(R(f))}`)}d(s.resolve(o),e);const c={source:"git",origin:i,importedAt:l()};return await w(o,c),E(o,c,t,!1)}export async function importLibraryIntoMarket(r,t){const a=t.dataDir??h(),i=s.isAbsolute(r.path)?r.path:s.join(a,r.path),e=s.resolve(i),n=D(a);if(!await j(e))throw new Error(`Source directory not found: ${e}`);if(C(e,a))throw new Error("\u5185\u7F6E\u4ED3\u4E0D\u53EF\u8FC1\u5165\uFF1A\u5B83\u968F\u5305\u53D1\u5E03\u3001\u65E0\u5916\u90E8\u6765\u6E90\uFF0C\u4E14\u843D\u70B9\u662F\u94FE\u63A5\uFF08\u5199\u5165\u4F1A\u6539\u5230\u5305\u5185\u5BB9\uFF09");if(A(e,n)){let c=await y(e);return c||(c={source:"dir",origin:e,importedAt:l()},await w(e,c)),{id:s.basename(e),dir:e,relPath:g(e,a),manifest:c,libraryId:r.id,reused:!0,refreshed:!1}}const o=await x(slugifyResourceId(s.basename(e)),n);d(o,n),await v(s.dirname(o),{recursive:!0}),await F(e,o,{recursive:!0});const u={source:"dir",origin:e,importedAt:l()};return await w(o,u),t.libraries.setPath(r.id,g(o,a)),{id:s.basename(o),dir:o,relPath:g(o,a),manifest:u,libraryId:r.id,reused:!1,refreshed:!1}}function T(r){const t=r.split(/[?#]/)[0],a=t.lastIndexOf("/"),i=t.lastIndexOf(":");return(a>i?t.slice(a+1):t.slice(i+1)).replace(/\.git$/,"")||"repo"}function R(r){const t=r,a=[t?.stderr,t?.stdout].filter(Boolean).map(String);return(a.length?a.join(`
+`):r instanceof Error?r.message:String(r)).trim()||"unknown error"}export const defaultGitExec=async(r,t,a)=>{const{stdout:i,stderr:e}=await O(r,t,a);return{stdout:String(i),stderr:String(e)}};