@weavecode/weave 0.0.0-stage → 0.1.1

package/node_modules/@weavecode/server/dist/hooks/watch-engine.d.ts

@@ -0,0 +1,86 @@
+import { type Harness } from '@weavecode/core';
+import type { MessagingSurface } from '@weavecode/harness';
+import type { SessionWatchRepository, SessionWatchRow, WatchOn } from '../repositories/session-watches.js';
+import type { SessionRepository } from '../repositories/sessions.js';
+import type { HookEventBus } from './bus.js';
+import type { MessageDeliverer } from './message-deliverer.js';
+/**
+ * 会话订阅引擎（session-orchestration 批 2 + 提醒类型）：`session_watches` 的
+ * one-shot 触发器，三条 fire 路径（订阅的 `onEvents` 决定听哪几条）——
+ *
+ * ① onEvent：ingest 消费路径见到**目标会话**的事件 → `idle` 听 idleSignals
+ *    全集（经 MessagingSurface 取），`turnEnd` 只听一轮对话结束
+ *    （HARNESS_LIFECYCLE[<harness>].close，claude = Stop）——两者都不散写
+ *    Stop/SessionEnd 字面量；
+ * ② onBus：`message.finished` 且终态 failed/timeout → `messageFailed`；
+ * ③ sweepTerminated：既有 SessionSweeper tick 挂钩——daemon 重启或目标异常
+ *    终止（未打 idle 信号，claude 注册表判死）后的补射（第七章 7.3-1）；只补
+ *    空闲类订阅（投递类等的是投递事件，进程死不给它编触发）。
+ *
+ * fire 语义（D3）：watcher 是会话 → 通知文本经 MessageDeliverer 的 inject
+ * 通道注入（非抢占，随它下一拍 hook 事件收到；线程留痕 + message.* 帧）；
+ * watcher 是 dashboard → watch.fired 帧由 web toast + 浏览器通知。markFired
+ * 先行（CAS），投递结果不再回滚——one-shot 落定即失效。
+ *
+ * 一切异常在内部吞掉：watch 失败永不影响采集（hooks 非阻塞不变式）。
+ */
+export declare class WatchEngine {
+    private readonly deps;
+    /** 订阅 id → 上次命中的时刻：同一次转场可能带来多个事件（Stop + SessionEnd），
+     *  窗口内的重复命中不重复计数/提醒（计数订阅的一次 = 一次转场）。 */
+    private readonly lastHitAt;
+    constructor(deps: {
+        watches: Pick<SessionWatchRepository, 'listPendingByTarget' | 'listPending' | 'consumeHit'>;
+        deliverer: Pick<MessageDeliverer, 'send'>;
+        sessions: Pick<SessionRepository, 'getBySessionId' | 'listWithCounts' | 'turnOpenOf'>;
+        bus: HookEventBus;
+        /** 能力面访问器（测试注入）；缺省 surfaces.ts 模块级 registry。 */
+        surfaceFor?: (harness: Harness) => MessagingSurface;
+        /** liveness 探测（测试注入）；缺省 claude 注册表全量扫描。 */
+        livenessOf?: () => Map<string, boolean>;
+    });
+    /**
+     * ingest 消费路径的事件钩子（fire-and-forget；内部全吞）。source 即目标
+     * 会话的 harness（事件来自它）——空闲/回合结束判定按 harness 表取。
+     */
+    onEvent(input: {
+        sessionId: string;
+        eventType: string;
+        source: Harness;
+    }): void;
+    /** 管道终态帧：目标会话的消息投递失败/超时 → `messageFailed` 订阅。 */
+    private onBus;
+    /**
+     * 订阅落库后的即时段（路由插入后调用）：目标**此刻已空闲**（turnOpen
+     * false——服务端基线）→ 立即 fire，不等下一拍。「空闲时提醒我」点在空闲
+     * 会话上，答案就是现在；turnOpen 未知（null）不猜。投递类订阅没有「此刻
+     * 已成真」态，不参与即时段。
+     */
+    created(row: SessionWatchRow): void;
+    /**
+     * terminated 补射：全部 pending 订阅里，目标已判死（claude 注册表 pidAlive
+     * false；目标行已消失 = 等待永不可解）的补 fire。判不动（null）不猜——
+     * 会话可能只是安静。返回补射数（可反复调用，已 fire 的自然不在 pending）。
+     *
+     * 只补计数订阅：补射是为了找回「离线期间错过的那一次」转场，计数订阅 fire
+     * 即落定（consumeHit 减到 0），tick 反复扫也幂等。持久化订阅（remaining
+     * null）没有「那一次」，且 consumeHit 永不落定——放在这里就是每 5 分钟给
+     * 已终止的会话补一记「已空闲」，toast/浏览器通知/Web Push 三腿齐发刷屏
+     * （实机见三条 pending 齐刷）。已终止的会话不会再有转场；目标被 resume 后
+     * 的真实事件会自己来。
+     */
+    sweepTerminated(): number;
+    /**
+     * fire 一条订阅（one-shot）：CAS 落定 → 按订阅方分流。返回 false = 并发
+     * 路径（同批 Stop+SessionEnd / 补射与 ingest 竞速）已 fire，本次零副作用。
+     * 同步方法——markFired/bus.emit 均同步；注入投递 fire-and-forget。
+     */
+    private fire;
+    /**
+     * 缺省通知文本（server 单点）：载荷自包含纪律（第七章 7.3-4）——触发类
+     * 消息必须自带「为何此刻收到」，接收会话的上下文可能已被压缩。
+     */
+    private defaultNotify;
+}
+/** 触发类型的英文措辞（注入文本与推送载荷共用同一出处）。 */
+export declare function watchReasonPhrase(reason: WatchOn): string;

package/node_modules/@weavecode/server/dist/hooks/watch-engine.js

@@ -0,0 +1 @@
+import{HARNESS_LIFECYCLE as o}from"@weavecode/core";import{messagingSurfaceFor as c}from"../surfaces.js";import{claudeLivenessById as a,pidAliveOf as l}from"../daemon/claude-liveness.js";const f=1e3;export class WatchEngine{deps;lastHitAt=new Map;constructor(e){this.deps=e,e.bus.subscribe(t=>this.onBus(t))}onEvent(e){try{const i=(this.deps.surfaceFor?.(e.source)??c(e.source)).idleSignals.includes(e.eventType),n=o[e.source].close.includes(e.eventType);if(!i&&!n)return;for(const d of this.deps.watches.listPendingByTarget(e.sessionId))n&&d.onEvents.includes("turnEnd")?this.fire(d,"turnEnd"):i&&d.onEvents.includes("idle")&&this.fire(d,"idle")}catch{}}onBus(e){if(e.kind==="message.finished"&&!(e.status!=="failed"&&e.status!=="timeout"))try{for(const t of this.deps.watches.listPendingByTarget(e.sessionId))t.onEvents.includes("messageFailed")&&this.fire(t,"messageFailed")}catch{}}created(e){try{if(!e.onEvents.includes("idle")&&!e.onEvents.includes("turnEnd"))return;this.deps.sessions.turnOpenOf(e.targetSessionId)===!1&&this.fire(e,e.onEvents.includes("idle")?"idle":"turnEnd")}catch{}}sweepTerminated(){try{const e=this.deps.livenessOf?.()??a(),t=new Map(this.deps.sessions.listWithCounts().map(s=>[s.sessionId,s]));let i=0;for(const s of this.deps.watches.listPending()){if(s.remaining===null||!s.onEvents.includes("idle")&&!s.onEvents.includes("turnEnd"))continue;const n=t.get(s.targetSessionId);n&&l(n,e)!==!1||this.fire(s,"idle")&&i++}return i}catch{return 0}}fire(e,t){const i=Date.now(),s=this.lastHitAt.get(e.id);if(s!==void 0&&i-s<f)return!1;const n=this.deps.watches.consumeHit(e.id);if(!n)return!1;this.lastHitAt.set(e.id,i),n.firedAt!==null&&this.lastHitAt.delete(e.id);const d=new Date(i).toISOString();return this.deps.bus.emit({kind:"watch.fired",watchId:e.id,targetSessionId:e.targetSessionId,watcherSessionId:e.watcherSessionId,reason:t,at:d}),e.watcherSessionId==null||this.deps.deliverer.send({toSessionId:e.watcherSessionId,text:e.notify??this.defaultNotify(e.targetSessionId,t),fromKind:"session",fromSessionId:e.targetSessionId,mode:"inject"}).catch(()=>{}),!0}defaultNotify(e,t){return`Session ${this.deps.sessions.getBySessionId(e)?.title??e.slice(0,8)} ${watchReasonPhrase(t)} (trigger=watch:${e})`}}export function watchReasonPhrase(r){return r==="messageFailed"?"had a failed message delivery":r==="turnEnd"?"finished its turn":"is now idle"}

package/node_modules/@weavecode/server/dist/index.d.ts

@@ -0,0 +1,99 @@
+/**
+ * @weavecode/server — Weave daemon.
+ *
+ * Data layer, HTTP server, and hook ingestion are implemented across the
+ * db/, repositories/, and daemon/ modules. This file re-exports the public
+ * surface.
+ */
+export { openDatabase } from './db/db.js';
+export { getDataDir, getDbPath, getDaemonStatePath, getAuthPath, getInitialPasswordPath } from './db/paths.js';
+export { ProjectRepository } from './repositories/projects.js';
+export type { ProjectRow, RegisterProjectInput } from './repositories/projects.js';
+export { HookEventRepository } from './repositories/hook-events.js';
+export type { HookEventInput, HookEventRow } from './repositories/hook-events.js';
+export { SessionRepository } from './repositories/sessions.js';
+export type { SessionRow } from './repositories/sessions.js';
+export { LibraryRepository } from './repositories/libraries.js';
+export type { LibraryRow } from './repositories/libraries.js';
+export { DEFAULT_PORT, DAEMON_HOST, isPortFree, findFreePort } from './daemon/port.js';
+export { readDaemonState, writeDaemonState, clearDaemonState } from './daemon/state.js';
+export type { DaemonState } from './daemon/state.js';
+export { generateToken } from './daemon/auth.js';
+export { createWeaveServer, weaveRequestHandler, DAEMON_VERSION } from './daemon/server.js';
+export type { WeaveServerDeps } from './daemon/server.js';
+export { accessUrls, lanIps, ensureDaemonCert, startTlsServer, daemonCertsDir } from './daemon/tls.js';
+export type { AccessUrl, DaemonCert, TlsListener } from './daemon/tls.js';
+export { readDaemonSettings, writeDaemonSettings, terminalPresetsFor, resolveLocale, DEFAULT_DAEMON_SETTINGS, SUPPORTED_LOCALES, DEFAULT_LOCALE, } from './daemon/settings.js';
+export type { DaemonSettings, TerminalSettings, TerminalPreset, TerminalPresetMeta, Locale } from './daemon/settings.js';
+export { resolveTerminalLaunch, resolveExplorerLaunch, openInExplorer, openInTerminal, runInTerminal, defaultProjectOpener, } from './daemon/opener.js';
+export type { ProjectOpener, TerminalLaunch } from './daemon/opener.js';
+export { resolveStaticDir } from './daemon/static.js';
+export { startDaemon } from './daemon/start.js';
+export { registerProject, unregisterProject } from './registry.js';
+export type { RegisterResult, UnregisterResult } from './registry.js';
+export { classifyAsset, normalizeRelPath } from './watch/classifier.js';
+export { WatchCache } from './watch/cache.js';
+export { WatchService } from './watch/watch-service.js';
+export type { WatchServiceOptions } from './watch/watch-service.js';
+export { SyncScheduler } from './watch/sync-scheduler.js';
+export type { SyncSchedulerOptions } from './watch/sync-scheduler.js';
+export type { AssetCategory, AssetEntry, AssetChangeKind, AssetChangeEvent } from './watch/types.js';
+export { ClaudeCodeAdapter } from './hooks/adapter.js';
+export type { HookAdapter } from './hooks/adapter.js';
+export type { HookReport, NormalizedHookPayload } from './hooks/types.js';
+export { drainInboxOnce, handleIngestedRecords } from './hooks/inbox-worker.js';
+export type { InboxRecord, InboxDrainDeps } from './hooks/inbox-worker.js';
+export { MirrorWriter, hooksRoot, hookShardId, appendOutbox } from './hooks/mirror.js';
+export type { HookMirrorDoc, MirrorRule } from './hooks/mirror.js';
+export { scanLibrarySkills, scanLibraryMcp, scanLibraryFileAssets } from './install/scanner.js';
+export type { SkillAsset, McpTemplate, FileAssetTemplate } from './install/scanner.js';
+export { FILE_ASSET_SPECS, FILE_ASSET_CATEGORIES, fileAssetTargetDir, isFileAssetCategory, } from './install/file-assets.js';
+export type { FileAssetCategory, FileAssetSpec } from './install/file-assets.js';
+export { installSkill, uninstallSkill, installFileAsset, uninstallFileAsset, installMcp, uninstallMcp, InstallConflictError, AssetNotFoundError, } from './install/installer.js';
+export type { McpServerConfig } from './install/installer.js';
+export { readMcpServers, readMcpJson } from './install/installer.js';
+export { codexConfigFile, readCodexMcpServers, writeCodexMcpServer, removeCodexMcpServer, codexMcpExists, readCodexMcpFromText, upsertCodexMcpInText, removeCodexMcpFromText, upsertCodexPluginEnabledInText, parseDottedKey, sectionHeaderKey, renderTomlHeader, renderTomlKey, renderTomlString, splitTomlSections, upsertTomlSection, removeTomlSection, parseSectionEntries, CodexTomlCorruptError, } from './install/codex-toml.js';
+export type { TomlSection } from './install/codex-toml.js';
+export { buildLibraryIndex, findSkillSource, findFileAssetSource } from './install/library-index.js';
+export type { SkillSource, LibraryIndex, FileAssetSource } from './install/library-index.js';
+export { hashSkillDir, maxMtimeDir, hashMcpConfig, hashFile, FingerprintCache } from './install/fingerprint.js';
+export type { FingerprintCacheEntry } from './install/fingerprint.js';
+export { projectFileNamespaces, projectPackFiles } from './hooks/toolkit.js';
+export { detectUpdates, detectSkillUpdates, detectFileAssetUpdates, detectProjectUpdateCounts, } from './install/updates.js';
+export type { SkillUpdate, McpUpdate, FileAssetUpdate, UpdateReport, ProjectUpdateSummary, } from './install/updates.js';
+export { detectPluginTemplateUpdates } from './install/plugin-templates.js';
+export type { PluginTemplateUpdate, PluginTemplateCategory } from './install/plugin-templates.js';
+export { readProjectFile, resolveProjectFile, PathEscapeError, FileTooLargeError, } from './install/reader.js';
+export type { ProjectFile } from './install/reader.js';
+export { readGlobalClaudeJson, readGlobalMcpServers, writeGlobalMcpServer, removeGlobalMcpServer, readGlobalSkills, installGlobalSkill, uninstallGlobalSkill, ClaudeJsonCorruptError, globalPersonalSkillRoots, resolveGlobalSkillDir, listGlobalSkillFiles, readGlobalSkillFile, } from './install/global-config.js';
+export type { GlobalSkillSource, GlobalSkillEntry, GlobalSkillGroup, } from './install/global-config.js';
+export { readMcpEnableMap, setMcpEnableState } from './install/settings-mcp.js';
+export type { McpEnableState, McpEnableMap } from './install/settings-mcp.js';
+export { mcpOverrideOf, resolveMcpEffective, setMcpEnableOverride } from './install/settings-mcp.js';
+export { readMcpRows } from './install/mcp-rows.js';
+export type { McpToolRow } from './install/mcp-rows.js';
+export { readPluginRows } from './install/plugin-rows.js';
+export type { PluginToolRow } from './install/plugin-rows.js';
+export { installPluginPack } from './install/plugin-install.js';
+export { readProjectConfig, writeProjectConfig, markSynced, DEFAULT_PROJECT_CONFIG, } from './install/project-config.js';
+export type { ProjectConfig } from './install/project-config.js';
+export { applyUpdate, syncAll, refreshStatusline } from './install/apply-update.js';
+export type { ApplyUpdateInput } from './install/apply-update.js';
+export { DEFAULT_STATUSLINE_CONFIG, POWERLINE_DEFAULT_GLYPHS, SEGMENT_ORDER, LEGACY_IDENTITY_LINE, LEGACY_METRICS_LINE, NAMED_COLORS, SEGMENT_TOKENS, SEGMENT_DEFAULT_FORMAT, CONTEXT_STYLE_FORMAT, PLAIN_STATUSLINE_CONFIG, } from './statusline/config.js';
+export type { StatuslineConfig, StatuslinePowerline, StatuslineSegment, StatuslineColor, StatuslineNamedColor, StatuslineBar, SegmentKey, } from './statusline/config.js';
+export { WEAVE_VERSION } from './version.js';
+export { generateStatuslineScript, statuslineCacheDir } from './statusline/generator.js';
+export { StatuslineCacheSweeper, startStatuslineCacheSweeper } from './statusline/cache-sweeper.js';
+export { readStatuslineConfig, writeStatuslineConfig, readGlobalStatuslineConfig, writeGlobalStatuslineConfig, applyStatuslineConfig, ensureSettingsStatusLine, readStatuslineScript, } from './statusline/manager.js';
+/**
+ * Absolute path of the standalone daemon entry, resolved beside this module:
+ * the compiled `entry.js` when running from dist (production), the TS source
+ * under the `development` condition. Only the TS form needs tsx to spawn —
+ * published bundles carry no tsx.
+ */
+export declare function resolveDaemonEntry(): {
+    path: string;
+    isTs: boolean;
+};
+export { installPlugin, uninstallPlugin, exportPlugin, searchPlugins, globalPluginRoot, isGitSource, } from './hooks/plugin-installer.js';
+export type { InstallResult, PluginIndexEntry } from './hooks/plugin-installer.js';

package/node_modules/@weavecode/server/dist/index.js

@@ -0,0 +1 @@
+import{existsSync as o}from"node:fs";import{fileURLToPath as r}from"node:url";export{openDatabase}from"./db/db.js";export{getDataDir,getDbPath,getDaemonStatePath,getAuthPath,getInitialPasswordPath}from"./db/paths.js";export{ProjectRepository}from"./repositories/projects.js";export{HookEventRepository}from"./repositories/hook-events.js";export{SessionRepository}from"./repositories/sessions.js";export{LibraryRepository}from"./repositories/libraries.js";export{DEFAULT_PORT,DAEMON_HOST,isPortFree,findFreePort}from"./daemon/port.js";export{readDaemonState,writeDaemonState,clearDaemonState}from"./daemon/state.js";export{generateToken}from"./daemon/auth.js";export{createWeaveServer,weaveRequestHandler,DAEMON_VERSION}from"./daemon/server.js";export{accessUrls,lanIps,ensureDaemonCert,startTlsServer,daemonCertsDir}from"./daemon/tls.js";export{readDaemonSettings,writeDaemonSettings,terminalPresetsFor,resolveLocale,DEFAULT_DAEMON_SETTINGS,SUPPORTED_LOCALES,DEFAULT_LOCALE}from"./daemon/settings.js";export{resolveTerminalLaunch,resolveExplorerLaunch,openInExplorer,openInTerminal,runInTerminal,defaultProjectOpener}from"./daemon/opener.js";export{resolveStaticDir}from"./daemon/static.js";export{startDaemon}from"./daemon/start.js";export{registerProject,unregisterProject}from"./registry.js";export{classifyAsset,normalizeRelPath}from"./watch/classifier.js";export{WatchCache}from"./watch/cache.js";export{WatchService}from"./watch/watch-service.js";export{SyncScheduler}from"./watch/sync-scheduler.js";export{ClaudeCodeAdapter}from"./hooks/adapter.js";export{drainInboxOnce,handleIngestedRecords}from"./hooks/inbox-worker.js";export{MirrorWriter,hooksRoot,hookShardId,appendOutbox}from"./hooks/mirror.js";export{scanLibrarySkills,scanLibraryMcp,scanLibraryFileAssets}from"./install/scanner.js";export{FILE_ASSET_SPECS,FILE_ASSET_CATEGORIES,fileAssetTargetDir,isFileAssetCategory}from"./install/file-assets.js";export{installSkill,uninstallSkill,installFileAsset,uninstallFileAsset,installMcp,uninstallMcp,InstallConflictError,AssetNotFoundError}from"./install/installer.js";export{readMcpServers,readMcpJson}from"./install/installer.js";export{codexConfigFile,readCodexMcpServers,writeCodexMcpServer,removeCodexMcpServer,codexMcpExists,readCodexMcpFromText,upsertCodexMcpInText,removeCodexMcpFromText,upsertCodexPluginEnabledInText,parseDottedKey,sectionHeaderKey,renderTomlHeader,renderTomlKey,renderTomlString,splitTomlSections,upsertTomlSection,removeTomlSection,parseSectionEntries,CodexTomlCorruptError}from"./install/codex-toml.js";export{buildLibraryIndex,findSkillSource,findFileAssetSource}from"./install/library-index.js";export{hashSkillDir,maxMtimeDir,hashMcpConfig,hashFile,FingerprintCache}from"./install/fingerprint.js";export{projectFileNamespaces,projectPackFiles}from"./hooks/toolkit.js";export{detectUpdates,detectSkillUpdates,detectFileAssetUpdates,detectProjectUpdateCounts}from"./install/updates.js";export{detectPluginTemplateUpdates}from"./install/plugin-templates.js";export{readProjectFile,resolveProjectFile,PathEscapeError,FileTooLargeError}from"./install/reader.js";export{readGlobalClaudeJson,readGlobalMcpServers,writeGlobalMcpServer,removeGlobalMcpServer,readGlobalSkills,installGlobalSkill,uninstallGlobalSkill,ClaudeJsonCorruptError,globalPersonalSkillRoots,resolveGlobalSkillDir,listGlobalSkillFiles,readGlobalSkillFile}from"./install/global-config.js";export{readMcpEnableMap,setMcpEnableState}from"./install/settings-mcp.js";export{mcpOverrideOf,resolveMcpEffective,setMcpEnableOverride}from"./install/settings-mcp.js";export{readMcpRows}from"./install/mcp-rows.js";export{readPluginRows}from"./install/plugin-rows.js";export{installPluginPack}from"./install/plugin-install.js";export{readProjectConfig,writeProjectConfig,markSynced,DEFAULT_PROJECT_CONFIG}from"./install/project-config.js";export{applyUpdate,syncAll,refreshStatusline}from"./install/apply-update.js";export{DEFAULT_STATUSLINE_CONFIG,POWERLINE_DEFAULT_GLYPHS,SEGMENT_ORDER,LEGACY_IDENTITY_LINE,LEGACY_METRICS_LINE,NAMED_COLORS,SEGMENT_TOKENS,SEGMENT_DEFAULT_FORMAT,CONTEXT_STYLE_FORMAT,PLAIN_STATUSLINE_CONFIG}from"./statusline/config.js";export{WEAVE_VERSION}from"./version.js";export{generateStatuslineScript,statuslineCacheDir}from"./statusline/generator.js";export{StatuslineCacheSweeper,startStatuslineCacheSweeper}from"./statusline/cache-sweeper.js";export{readStatuslineConfig,writeStatuslineConfig,readGlobalStatuslineConfig,writeGlobalStatuslineConfig,applyStatuslineConfig,ensureSettingsStatusLine,readStatuslineScript}from"./statusline/manager.js";export function resolveDaemonEntry(){const e=r(new URL("./daemon/entry.js",import.meta.url));return o(e)?{path:e,isTs:!1}:{path:r(new URL("./daemon/entry.ts",import.meta.url)),isTs:!0}}export{installPlugin,uninstallPlugin,exportPlugin,searchPlugins,globalPluginRoot,isGitSource}from"./hooks/plugin-installer.js";

package/node_modules/@weavecode/server/dist/install/apply-update.d.ts

@@ -0,0 +1,40 @@
+import type { Harness } from '@weavecode/core';
+import { type LibraryIndex } from './library-index.js';
+import { FingerprintCache } from './fingerprint.js';
+import type { LibraryRow } from '../repositories/libraries.js';
+/**
+ * Apply updates — overwrite installed assets with their library sources.
+ *
+ * Update = destructive overwrite: the installed copy is removed and replaced
+ * with the current source content. Any local edits to the installed copy are
+ * lost. The UI must surface this clearly before invoking.
+ *
+ * Scope + agent are honoured:
+ *   project skill → `.claude/skills/` (claude) · `.codex/skills/` (codex)
+ *   user    skill → `~/.claude/skills/` (claude) · `~/.agents/skills/` (codex)
+ *   project mcp   → `.mcp.json`, user mcp → `~/.claude.json`
+ *   codex  mcp    → `~/.codex/config.toml` (agent: 'codex')
+ *   file assets   → the kind's project dir (see file-assets.ts)
+ */
+export interface ApplyUpdateInput {
+    category: 'skill' | 'mcp' | 'command' | 'agent' | 'workflow' | 'rule' | 'output-style' | 'init';
+    name: string;
+    scope: 'project' | 'user';
+    /** Which agent's surface to refresh (skills + codex MCP matter). */
+    agent?: Harness;
+}
+/** Overwrite one installed asset from its library source. */
+export declare function applyUpdate(projectPath: string, input: ApplyUpdateInput, index?: LibraryIndex, libraries?: LibraryRow[]): Promise<void>;
+/**
+ * Sync every outdated, non-custom asset in a project. Returns a summary of what
+ * was updated. Skills and MCP entries with no library source are skipped.
+ */
+export declare function syncAll(projectPath: string, libraries: LibraryRow[], cache: FingerprintCache, index?: LibraryIndex): Promise<{
+    updated: ApplyUpdateInput[];
+    skipped: number;
+}>;
+/**
+ * Re-apply the statusline config (regenerates the script + settings entry).
+ * Used when weave itself upgrades and the generator output changes.
+ */
+export declare function refreshStatusline(projectPath: string): Promise<void>;

package/node_modules/@weavecode/server/dist/install/apply-update.js

@@ -0,0 +1 @@
+import{rm as g,cp as p,mkdir as d}from"node:fs/promises";import{homedir as y}from"node:os";import f from"node:path";import{installMcp as w,uninstallMcp as S}from"./installer.js";import{writeGlobalMcpServer as k}from"./global-config.js";import{writeCodexMcpServer as x}from"./codex-toml.js";import{applyStatuslineConfig as h}from"../statusline/manager.js";import{readStatuslineConfig as C}from"../statusline/manager.js";import{buildLibraryIndex as l,findSkillSource as E,findMcpSource as F,findFileAssetSource as M}from"./library-index.js";import{detectUpdates as $}from"./updates.js";import{materializePluginTemplate as b}from"./plugin-templates.js";import{applyInitFile as v}from"./init-files.js";import{FILE_ASSET_SPECS as A,fileAssetTargetDir as D,isFileAssetCategory as T}from"./file-assets.js";import{assetSurfaceFor as u}from"../surfaces.js";export async function applyUpdate(r,o,m,s){const c=m??(s?await l(s):await l([])),t=o.agent??"claude";if(o.category==="skill"){const e=E(c,o.name);if(!e)throw new Error(`No library source for skill "${o.name}"`);const n=o.scope==="user"?u(t).globalSkillsRoots(y())[0]:f.join(r,...u(t).projectSkillsDir().split("/")),i=f.join(n,o.name);await g(i,{recursive:!0,force:!0}),await p(e.dirPath,i,{recursive:!0});return}if(T(o.category)){const e=M(c,o.category,o.name);if(!e)throw new Error(`No library source for ${o.category} "${o.name}"`);const n=D(o.category,t,o.scope,r,y());await d(n,{recursive:!0});const i=f.join(n,`${o.name}${A[o.category].ext}`);await g(i,{force:!0}),await p(e.filePath,i);return}const a=F(c,o.name);if(!a)throw new Error(`No library source for MCP "${o.name}"`);if(t==="codex"){await x(o.name,a.config);return}if(o.scope==="user")await k(o.name,a.config);else{try{await S(r,o.name)}catch{}await w(r,o.name,a.config)}}export async function syncAll(r,o,m,s){const c=s??await l(o),t=await $(r,o,m,c),a=[];for(const e of t.skills)e.custom||!e.outdated||(await applyUpdate(r,{category:"skill",name:e.name,scope:e.scope,agent:e.agent},c),a.push({category:"skill",name:e.name,scope:e.scope,agent:e.agent}));for(const e of t.mcp)e.custom||!e.outdated||(await applyUpdate(r,{category:"mcp",name:e.name,scope:e.scope,agent:e.agent},c),a.push({category:"mcp",name:e.name,scope:e.scope,agent:e.agent}));for(const e of t.files)e.custom||!e.outdated||(await applyUpdate(r,{category:e.category,name:e.name,scope:e.scope},c),a.push({category:e.category,name:e.name,scope:e.scope}));for(const e of t.pluginTemplates)e.outdated&&(await b(e),a.push({category:e.category,name:e.name,scope:"project"}));for(const e of t.initFiles)await v(e)&&a.push({category:"init",name:e.relPath,scope:"project"});return{updated:a,skipped:0}}export async function refreshStatusline(r){const o=await C(r);await h(r,o)}

package/node_modules/@weavecode/server/dist/install/capabilities.d.ts

@@ -0,0 +1,22 @@
+import { type Harness } from '@weavecode/core';
+import { type FileAssetCategory } from './file-assets.js';
+/** 安装范围（与 InstallBody.scope 同形；`user` = 个人全局配置面）。 */
+export type InstallScope = 'project' | 'user';
+/** 可安装资产类别（skill / mcp + 5 类单文件资产）。 */
+export type InstallCategory = 'skill' | 'mcp' | FileAssetCategory;
+/** 单个 harness 面的可用范围；无该面 = 该 harness 不支持此类别。 */
+export interface CategorySurface {
+    harness: Harness;
+    scopes: InstallScope[];
+    /** 各 scope 的安装落点（显示形：项目内相对路径 posix 原样、用户级以 `~`
+     *  缩写）——web 的范围落点提示按此渲染，不自拼 harness 路径（§6-4）。 */
+    dest?: Partial<Record<InstallScope, string>>;
+}
+export interface CategoryCapability {
+    surfaces: CategorySurface[];
+}
+/** `GET /capabilities` 响应体（web 镜像于 api.ts，唯一事实源在这里）。 */
+export interface InstallCapabilities {
+    categories: Record<InstallCategory, CategoryCapability>;
+}
+export declare function installCapabilities(): InstallCapabilities;

package/node_modules/@weavecode/server/dist/install/capabilities.js

@@ -0,0 +1 @@
+import n from"node:path";import{homedir as a}from"node:os";import{HARNESS_KEYS as l}from"@weavecode/core";import{FILE_ASSET_SPECS as m,FILE_ASSET_CATEGORIES as h}from"./file-assets.js";import{assetSurfaces as u}from"../surfaces.js";function f(t,c){return n.join("~",n.relative(c,t)).split(n.sep).join("/")}export function installCapabilities(){const t=a(),c={};for(const s of h){const o=m[s].dirs,r=[];for(const e of l){const p=o[e];if(!p)continue;const i=[];p.project&&i.push("project"),p.user&&i.push("user"),i.length>0&&r.push({harness:e,scopes:i})}c[s]={surfaces:r}}return c.skill={surfaces:u().map(s=>{const o=[],r={};s.projectSkillsDir()&&(o.push("project"),r.project=s.projectSkillsDir());const e=s.globalSkillsRoots(t)[0];return e&&(o.push("user"),r.user=f(e,t)),{harness:s.harness,scopes:o,dest:r}})},c.mcp={surfaces:u().map(s=>{const o={},r=s.mcpDest("project",t),e=s.mcpDest("user",t);return r&&(o.project=r),e&&(o.user=f(e,t)),{harness:s.harness,scopes:s.mcpScopes(),dest:o}}).filter(s=>s.scopes.length>0)},{categories:c}}

package/node_modules/@weavecode/server/dist/install/codex-toml.d.ts

@@ -0,0 +1,39 @@
+import type { McpServerConfig } from './installer.js';
+/**
+ * Codex config.toml 的 **fs 侧**（路径解析 + MCP servers 表示法）。
+ *
+ * 行级增量编辑器（纯文本层）已下沉 @weavecode/harness 的 `codex/toml.ts`
+ * （P2 专属格式下沉）；本模块原位置 re-export 下沉符号，存量 import 零改动。
+ * MCP 表示法的下沉留后续批次（其类型 McpServerConfig 仍住 server）。
+ */
+export { CodexTomlCorruptError, parseDottedKey, sectionHeaderKey, renderTomlKey, renderTomlHeader, renderTomlString, splitTomlSections, upsertTomlSection, removeTomlSection, parseSectionEntries, upsertCodexPluginEnabledInText, } from '@weavecode/harness';
+export type { TomlSection } from '@weavecode/harness';
+/** Absolute path of the Codex user config (`~/.codex/config.toml`),
+ * respecting the test override. 批 4a：路径本体在 AssetSurface（`userConfigFile`）。 */
+export declare function codexConfigFile(home?: string): string;
+/** Read the `mcp_servers` map from config.toml text (empty when absent or
+ * unparseable). stdio servers only — entries without a `command` (e.g. remote
+ * url servers) are skipped. */
+export declare function readCodexMcpFromText(text: string): Record<string, McpServerConfig>;
+/** Insert or replace an `[mcp_servers.<name>]` entry in config.toml text,
+ * preserving everything else. Merge-validated: if preserving user-added keys
+ * produces invalid TOML, the section is written clean instead. */
+export declare function upsertCodexMcpInText(text: string, name: string, config: McpServerConfig): string;
+/** Remove an `[mcp_servers.<name>]` entry (with its sub-sections) from
+ * config.toml text. Returns whether a section was removed. */
+export declare function removeCodexMcpFromText(text: string, name: string): {
+    text: string;
+    removed: boolean;
+};
+export declare function setCodexConfigFileOverride(file: string | null): void;
+/** Read MCP servers from `~/.codex/config.toml` (empty when absent/corrupt). */
+export declare function readCodexMcpServers(file?: string): Promise<Record<string, McpServerConfig>>;
+/** Whether an `[mcp_servers.<name>]` section exists (cheap line-level check). */
+export declare function codexMcpExists(name: string, file?: string): Promise<boolean>;
+/** Insert or replace an MCP server in `~/.codex/config.toml`. Refuses to
+ * write a file that does not parse (protects the user's hand-written config);
+ * creates the file when absent. */
+export declare function writeCodexMcpServer(name: string, config: McpServerConfig, file?: string): Promise<void>;
+/** Remove an MCP server section from `~/.codex/config.toml`. Returns whether
+ * a section was removed (false = was not configured). */
+export declare function removeCodexMcpServer(name: string, file?: string): Promise<boolean>;

package/node_modules/@weavecode/server/dist/install/codex-toml.js

@@ -0,0 +1 @@
+import{readFile as p,writeFile as g,access as C,mkdir as E}from"node:fs/promises";import{homedir as M}from"node:os";import b from"node:path";import{parse as m}from"smol-toml";import{assetSurfaceFor as $}from"../surfaces.js";import{CodexTomlCorruptError as d,parseSectionEntries as h,removeTomlSection as k,renderTomlHeader as F,renderTomlKey as O,renderTomlString as l,sameKey as y,splitTomlSections as v,upsertTomlSection as w}from"@weavecode/harness";export{CodexTomlCorruptError,parseDottedKey,sectionHeaderKey,renderTomlKey,renderTomlHeader,renderTomlString,splitTomlSections,upsertTomlSection,removeTomlSection,parseSectionEntries,upsertCodexPluginEnabledInText}from"@weavecode/harness";export function codexConfigFile(e=M()){return S??$("codex").userConfigFile(e)}export function readCodexMcpFromText(e){let r;try{r=m(e)}catch{return{}}const n=r.mcp_servers;if(!n||typeof n!="object"||Array.isArray(n))return{};const t={};for(const[s,o]of Object.entries(n)){const a=j(o);a&&(t[s]=a)}return t}function j(e){if(!e||typeof e!="object"||Array.isArray(e))return null;const r=e;if(typeof r.command!="string")return null;const n={command:r.command};if(Array.isArray(r.args)){const t=r.args.filter(s=>typeof s=="string");t.length>0&&(n.args=t)}if(r.env&&typeof r.env=="object"&&!Array.isArray(r.env)){const t={};for(const[s,o]of Object.entries(r.env))typeof o=="string"&&(t[s]=o);Object.keys(t).length>0&&(n.env=t)}return n}function T(e,r,n,t,s){const o=[`command = ${l(r.command)}`];if(r.args&&r.args.length>0&&o.push(`args = [${r.args.map(l).join(", ")}]`),s&&n){const i=new Set(["command","args","env"]);for(const[c,u]of h(n.lines.slice(1)))i.has(c)||o.push(u)}const a=Object.entries(r.env??{}),f=s&&t?h(t.lines.slice(1)).filter(([i])=>!(i in(r.env??{}))):[];if(a.length>0||f.length>0){o.push(""),o.push(F([...e,"env"]));for(const[i,c]of a)o.push(`${O(i)} = ${l(c)}`);for(const[,i]of f)o.push(i)}return o}export function upsertCodexMcpInText(e,r,n){const t=["mcp_servers",r],s=A(e);if(s)throw s;const o=v(e),a=o.find(c=>y(c.key,t)),f=o.find(c=>y(c.key,[...t,"env"])),i=w(e,t,T(t,n,a,f,!0));try{return m(i),i}catch{const c=w(e,t,T(t,n,a,f,!1));try{return m(c),c}catch(u){throw new d(`unable to produce valid TOML for [mcp_servers.${r}]: ${u instanceof Error?u.message:String(u)}`)}}}export function removeCodexMcpFromText(e,r){return k(e,["mcp_servers",r])}function A(e){return v(e)[0].lines.find(t=>/^\s*mcp_servers\s*=/.test(t))?new d('~/.codex/config.toml defines "mcp_servers" as an inline value \u2014 weave only manages the [mcp_servers.<name>] section form'):null}let S=null;export function setCodexConfigFileOverride(e){S=e}async function _(e){try{return await p(e,"utf-8")}catch{return""}}async function x(e){try{return await C(e),!0}catch{return!1}}export async function readCodexMcpServers(e=codexConfigFile()){return await x(e)?readCodexMcpFromText(await p(e,"utf-8")):{}}export async function codexMcpExists(e,r=codexConfigFile()){return await x(r)?K(await p(r,"utf-8"),["mcp_servers",e]):!1}function K(e,r){return v(e).some(n=>y(n.key,r))}export async function writeCodexMcpServer(e,r,n=codexConfigFile()){const t=await _(n);if(t.trim()!=="")try{m(t)}catch(s){throw new d(`${n} is not valid TOML \u2014 refusing to write: ${s instanceof Error?s.message:String(s)}`)}await E(b.dirname(n),{recursive:!0}),await g(n,upsertCodexMcpInText(t,e,r),"utf-8")}export async function removeCodexMcpServer(e,r=codexConfigFile()){if(!await x(r))return!1;const n=await p(r,"utf-8");try{m(n)}catch(o){throw new d(`${r} is not valid TOML \u2014 refusing to write: ${o instanceof Error?o.message:String(o)}`)}const{text:t,removed:s}=removeCodexMcpFromText(n,e);return s&&await g(r,t,"utf-8"),s}

package/node_modules/@weavecode/server/dist/install/file-assets.d.ts

@@ -0,0 +1,19 @@
+import type { Harness } from '@weavecode/core';
+import type { FileAssetCategory } from '@weavecode/harness';
+/**
+ * File-backed harness asset kinds — the single source of truth for everything
+ * that installs as ONE file (unlike skills, which install as a directory).
+ *
+ * 批 4a：矩阵本体（FileAssetCategory / FileAssetSpec / FILE_ASSET_SPECS /
+ * FILE_ASSET_CATEGORIES / isFileAssetCategory）迁至 `@weavecode/harness` 的
+ * `shared/file-specs.ts`，此处 re-export 保持存量 import 与测试零改动；
+ * `fileAssetTargetDir` 保留原名原签名，内部委托 AssetSurface（经 registry 查 surface）。
+ *
+ * The same table drives: library scanning (scanner.ts), install/uninstall
+ * (installer.ts), update detection (updates.ts) and the dashboard badges.
+ */
+export { FILE_ASSET_SPECS, FILE_ASSET_CATEGORIES, isFileAssetCategory, type FileAssetCategory, type FileAssetSpec, } from '@weavecode/harness';
+/** Resolve the install target directory for a file asset.
+ * `agent` + `scope` decide the surface; kinds without a matching surface throw
+ * (e.g. rules are project-only, agents have no Codex equivalent). */
+export declare function fileAssetTargetDir(category: FileAssetCategory, agent: Harness, scope: 'project' | 'user', projectPath: string, homedir: string): string;

package/node_modules/@weavecode/server/dist/install/file-assets.js

@@ -0,0 +1 @@
+import{assetSurfaceFor as i}from"../surfaces.js";export{FILE_ASSET_SPECS,FILE_ASSET_CATEGORIES,isFileAssetCategory}from"@weavecode/harness";export function fileAssetTargetDir(r,e,t,o,S){return i(e).targetDir(r,t,o,S)}

package/node_modules/@weavecode/server/dist/install/fingerprint.d.ts

@@ -0,0 +1,37 @@
+import type { McpServerConfig } from './installer.js';
+export interface FingerprintCacheEntry {
+    /** Max mtime (ms) across all files in the tree when this hash was computed. */
+    maxMtime: number;
+    hash: string;
+}
+/**
+ * Recursively hash a directory tree. The digest is stable: files are sorted by
+ * their path relative to `dir`, and each contributes `${relPath}\0${content}`.
+ * Empty / missing directories hash to a constant.
+ */
+export declare function hashSkillDir(dir: string, skipNames?: Set<string>): Promise<string>;
+/**
+ * Max mtime (ms) across all files in a tree — cache-invalidation signal.
+ * 逐文件 stat 是这一轮的全部成本（Windows 上每次往返 ~0.1ms、一百来个技能文件
+ * 串起来就是 100ms+），故整层并行发起，只保序不排队。
+ */
+export declare function maxMtimeDir(dir: string, skipNames?: Set<string>): Promise<number>;
+/** Stable hash of an MCP server config (sorted keys → JSON → sha256). */
+export declare function hashMcpConfig(config: McpServerConfig): string;
+/** Hash a single file's content (sha256); missing files hash to a constant. */
+export declare function hashFile(file: string): Promise<string>;
+/**
+ * LRU-ish in-memory cache for directory hashes. An entry is reused while the
+ * directory's max mtime is unchanged; otherwise it is recomputed.
+ */
+export declare class FingerprintCache {
+    private readonly cache;
+    private readonly fileCache;
+    /** Get the hash for `dir`, recomputing only when its max mtime changed. */
+    get(dir: string): Promise<string>;
+    /** Get the hash for a single `file`, recomputing only when its mtime changed. */
+    getFile(file: string): Promise<string>;
+    /** Force-drop an entry (e.g. after a known write to the directory). */
+    invalidate(dir: string): void;
+    clear(): void;
+}

package/node_modules/@weavecode/server/dist/install/fingerprint.js

@@ -0,0 +1 @@
+import{readdir as m,readFile as u,stat as l}from"node:fs/promises";import{createHash as h}from"node:crypto";import c from"node:path";const f=new Set([".weave",".git","node_modules"]);export async function hashSkillDir(e,t=f){const a=h("sha256"),r=[];await p(e,e,r,t),r.sort((n,i)=>n.rel.localeCompare(i.rel));for(const n of r){a.update(n.rel),a.update("\0");let i;try{i=await u(n.abs)}catch{continue}a.update(i),a.update("\0")}return a.digest("hex")}async function p(e,t,a,r){let n;try{n=await m(t,{withFileTypes:!0})}catch{return}const i=[];for(const s of n)s.name.startsWith(".")&&r.has(s.name)||(!r.has(s.name)&&s.isDirectory()?i.push(p(e,c.join(t,s.name),a,r)):s.isFile()&&a.push({rel:c.relative(e,t).replace(/\\/g,"/")+"/"+s.name,abs:c.join(t,s.name)}));await Promise.all(i)}export async function maxMtimeDir(e,t=f){let a;try{a=await m(e,{withFileTypes:!0})}catch{return 0}return(await Promise.all(a.map(async n=>{if(n.name.startsWith(".")&&t.has(n.name))return 0;const i=c.join(e,n.name);if(n.isDirectory())return maxMtimeDir(i,t);if(!n.isFile())return 0;try{return(await l(i)).mtimeMs}catch{return 0}}))).reduce((n,i)=>Math.max(n,i),0)}export function hashMcpConfig(e){return h("sha256").update(JSON.stringify(o(e))).digest("hex")}export async function hashFile(e){try{const t=await u(e);return h("sha256").update(t).digest("hex")}catch{return"missing"}}function o(e){if(Array.isArray(e))return e.map(o);if(e&&typeof e=="object"){const t={};for(const a of Object.keys(e).sort())t[a]=o(e[a]);return t}return e}export class FingerprintCache{cache=new Map;fileCache=new Map;async get(t){const a=await maxMtimeDir(t),r=this.cache.get(t);if(r&&r.maxMtime===a)return r.hash;const n=await hashSkillDir(t);return this.cache.set(t,{maxMtime:a,hash:n}),n}async getFile(t){let a;try{a=(await l(t)).mtimeMs}catch{return"missing"}const r=this.fileCache.get(t);if(r&&r.maxMtime===a)return r.hash;const n=await hashFile(t);return this.fileCache.set(t,{maxMtime:a,hash:n}),n}invalidate(t){this.cache.delete(t)}clear(){this.cache.clear(),this.fileCache.clear()}}

package/node_modules/@weavecode/server/dist/install/git-classify.d.ts

@@ -0,0 +1,30 @@
+/**
+ * 项目内路径「进不进 git」的分类——同步域自动/手动分界的唯一判据。
+ *
+ * 用户裁决：**不进 git 的自动同步；进 git 的仍走 `weave init` 生成 + commit**，
+ * 同步域只检测漂移、dashboard 提醒用户去终端跑 `weave init`（不代写）。
+ *
+ * 「会进 git」= tracked ∪ untracked-but-not-ignored（后者下次 `git add` 就进）。
+ * 所以 `check-ignore` 单独用不够——tracked 文件也可能命中 ignore 规则，判序恒为
+ * 先 tracked、后 ignored。非 git 仓库全算「不进 git」。
+ *
+ * 一轮 sweep 建一次（`gitClassify`），别逐文件起进程。
+ */
+/** 一条路径的同步归类。 */
+export type SyncClass = 'auto' | 'manual';
+export type GitPathKind = 'tracked' | 'ignored' | 'untracked' | 'outside';
+export interface GitClassify {
+    /** 相对路径 → 实际 git 状态。 */
+    kindOf(relPath: string): GitPathKind;
+    /** `auto` = 不进 git（代写无害、自愈）；`manual` = 会进 git（只报不写）。 */
+    classOf(relPath: string): SyncClass;
+}
+/**
+ * 对给定的项目相对路径（posix 分隔）做一次批量分类。
+ *
+ * 两条查询**并行**起：`ls-files` 取 tracked、`check-ignore --stdin` 取 ignored，
+ * 都没命中的在仓库里即 untracked。原先串行三轮（ls-files → rev-parse → check-ignore）
+ * 在 Windows 上是 `/projects/:id/updates` 的全部耗时（实测 ~450ms，每个 git 子进程
+ * 约 150ms）；仓库探测改看 `ls-files` 的退出码，省掉 `rev-parse` 那一轮。
+ */
+export declare function gitClassify(projectPath: string, relPaths: readonly string[]): Promise<GitClassify>;

package/node_modules/@weavecode/server/dist/install/git-classify.js

@@ -0,0 +1 @@
+import{spawn as l}from"node:child_process";function c(o,s,t){return new Promise(n=>{const e=l("git",["-C",o,...s],{stdio:[t===void 0?"ignore":"pipe","pipe","ignore"],windowsHide:!0});let d="";e.stdout?.setEncoding("utf-8"),e.stdout?.on("data",r=>{d+=r}),e.on("error",()=>n({stdout:"",ran:!1,code:null})),e.on("close",r=>n({stdout:d,ran:!0,code:r})),t!==void 0&&e.stdin?.end(t)})}function a(o){return o.split("\0").filter(s=>s.length>0)}export async function gitClassify(o,s){const t=[...new Set(s)],n=new Map;if(t.length===0)return u(n);const[e,d]=await Promise.all([c(o,["ls-files","-z","--",...t]),c(o,["check-ignore","-z","--stdin"],t.map(i=>`${i}\0`).join(""))]);if(!e.ran||e.code!==0){for(const i of t)n.set(i,"outside");return u(n)}const r=new Set(a(e.stdout)),f=new Set(a(d.stdout));for(const i of t)n.set(i,r.has(i)?"tracked":f.has(i)?"ignored":"untracked");return u(n)}function u(o){const s=t=>o.get(t)??"outside";return{kindOf:s,classOf:t=>{const n=s(t);return n==="ignored"||n==="outside"?"auto":"manual"}}}

package/node_modules/@weavecode/server/dist/install/global-config.d.ts

@@ -0,0 +1,131 @@
+import type { Harness } from '@weavecode/core';
+import type { McpServerConfig } from './installer.js';
+import { type ProjectFile } from './reader.js';
+import type { AssetEntry } from '../watch/types.js';
+import { type InstallLinkMode } from '../market/install-link.js';
+/**
+ * Global (user-scope) Claude Code configuration.
+ *
+ * `~/.claude.json` is Claude Code's runtime file: it holds user-level MCP
+ * servers among many other keys. weave treats it as read-modify-write and MUST
+ * preserve every top-level key it does not own. A file that fails to parse is
+ * never written (we refuse rather than risk corrupting it). Skill assets at the
+ * global scope live under `~/.claude/skills/` — plain directory operations.
+ *
+ * Beyond the user's own skills, the global view also enumerates skills coming
+ * from installed Claude Code plugins (`~/.claude/plugins/installed_plugins.json`
+ * → each plugin's `skills/` dir) and Codex skills (`~/.agents/skills/`, plus the
+ * deprecated `~/.codex/skills/`
+ * Codex plugin caches). Plugin enable state is read from / written to the
+ * host config: `~/.claude/settings.json` (`enabledPlugins`) for Claude and
+ * `~/.codex/config.toml` (`[plugins."key"] enabled`) for Codex.
+ */
+/** `~/.claude.json` could not be parsed; refuse to write to avoid corruption. */
+export declare class ClaudeJsonCorruptError extends Error {
+    constructor(message: string);
+}
+/** Where a global skill came from — used as the grouping key in the UI. */
+export type GlobalSkillSource = `${Harness}-personal` | `${Harness}-plugin`;
+/** A single resolved skill directory. `dir` is absolute (may be a symlink). */
+export interface GlobalSkillEntry {
+    name: string;
+    dir: string;
+    /** 装面形态：`link` = 链接（全局位置无副本）、`copy` = 链接不可用时的回退复制。
+     * 读侧 lstat 判定，不落状态——用户手动改过、包升级后重铺过，状态都会失真。 */
+    form: InstallLinkMode;
+}
+/** A labelled group of skills sharing a source. Plugin groups carry enable
+ * state (per-plugin, keyed `plugin@marketplace`); personal groups do not. */
+export interface GlobalSkillGroup {
+    source: GlobalSkillSource;
+    label: string;
+    skills: GlobalSkillEntry[];
+    /** `plugin@marketplace` for plugin groups; undefined for personal groups. */
+    pluginKey?: string;
+    /** 所属市场 = 插件的 namespace（`pluginKey` 的 `@` 后半段，经 harness 面拆解）。
+     *  前端按它做一级折叠块，**不得自己 split `@`**。个人组无此字段。 */
+    namespace?: string;
+    /** Enable state for plugin groups (undefined → not applicable). */
+    enabled?: boolean;
+}
+declare function claudeJsonPath(): string;
+/** Claude 全局 skills 根（`~/.claude/skills`）——经 AssetSurface 查询。 */
+declare function globalSkillsPath(): string;
+declare function claudePluginsJsonPath(home?: string): string;
+/** Claude 用户级配置（`~/.claude/settings.json`）——经 AssetSurface 查询。 */
+declare function claudeSettingsPath(): string;
+/** Codex user-level skills root — the one installs target. */
+declare function codexSkillsPath(): string;
+declare function codexPluginsCachePath(): string;
+/** Personal skill roots that may contain symlinks to dev repos — the roots the
+ * watch service observes so edits to a symlinked skill's original files flow
+ * through SSE. Plugin caches are versioned/static and intentionally excluded.
+ * 带归属版：根来自各 harness 的 AssetSurface，归属即 surface 自身——watch 侧
+ * 据此定 agent，不写路径段白名单。 */
+export declare function globalPersonalSkillRootsOwned(): Array<{
+    harness: Harness;
+    root: string;
+}>;
+/** 与 `globalPersonalSkillRootsOwned` 同源的纯根列表（顺序不变）。 */
+export declare function globalPersonalSkillRoots(): string[];
+/** Read + parse ~/.claude.json. Missing file → {}. Unparseable → corrupt error. */
+export declare function readGlobalClaudeJson(): Promise<Record<string, unknown>>;
+/** Read user-level MCP servers from ~/.claude.json (empty if absent). */
+export declare function readGlobalMcpServers(): Promise<Record<string, McpServerConfig>>;
+/**
+ * Add or replace a user-level MCP server in ~/.claude.json. Preserves every
+ * other top-level key. Refuses to write if the file is corrupt (unreadable as
+ * JSON); in that case the caller should surface the error to the user.
+ */
+export declare function writeGlobalMcpServer(name: string, config: McpServerConfig): Promise<void>;
+/** Remove a user-level MCP server from ~/.claude.json (no-op if absent). */
+export declare function removeGlobalMcpServer(name: string): Promise<void>;
+/** List skill directory names under ~/.claude/skills/ (follows symlinks). */
+export declare function readGlobalSkills(): Promise<string[]>;
+/** Install a skill directory to the agent's global skills root
+ * (`~/.claude/skills/<name>/` or `~/.agents/skills/<name>/`).
+ * 批 9：symlink 优先（指向市场/原目录），EPERM 等回退复制（install-link 单点）。 */
+export declare function installGlobalSkill(sourceDir: string, name: string, agent?: Harness): Promise<string>;
+/** Remove a global skill directory from the agent's skills root.
+ * 批 9：先 lstat——链接只删链接（防删穿市场源），复制体才递归删。 */
+export declare function uninstallGlobalSkill(name: string, agent?: Harness): Promise<void>;
+/** 已装 Claude 插件的安装目录 → 所属市场 namespace（全局文件树给每个文件打仓库
+ *  标记用）。installPath 与键形都取自宿主记录、经 `parsePluginKey` 拆解点取市场，
+ *  不在这里猜缓存目录的形状——装了哪些版本、装在哪儿都随记录走。 */
+export declare function installedPluginNamespaces(home?: string): Promise<Array<{
+    dir: string;
+    namespace: string;
+}>>;
+/**
+ * Aggregate every global skill source into ordered groups. Plugin groups are
+ * decorated with their enable state (read from the host config). Empty groups
+ * are kept so the UI can show "none installed" per source. Order:
+ * claude-personal, claude-plugin(s), codex-personal, codex-plugin(s).
+ */
+export declare function readGlobalSkillGroups(): Promise<GlobalSkillGroup[]>;
+/** Resolve a single global skill's directory by source + name (+ pluginKey for
+ * plugins). Targeted lookup — does not re-read every group. Returns null when
+ * the skill (or its enclosing plugin install) is not found. */
+export declare function resolveGlobalSkillDir(source: GlobalSkillSource, name: string, pluginKey?: string): Promise<string | null>;
+/** Recursively list files inside a global skill directory (symlinks followed),
+ * with paths relative to the skill dir (posix separators). Hidden entries are
+ * skipped. agent 取该目录的归属 harness。 */
+export declare function listGlobalSkillFiles(dir: string): Promise<AssetEntry[]>;
+/** Read a text file inside a global skill directory, following symlinks. The
+ * `relPath` is relative to `dir`; absolute paths and `..` segments are rejected,
+ * and the resolved real path must stay within the (possibly symlinked) skill
+ * dir — so a symlinked file pointing outside the skill is refused. */
+export declare function readGlobalSkillFile(dir: string, relPath: string): Promise<ProjectFile>;
+/** Read `enabledPlugins` from ~/.claude/settings.json (empty if absent/corrupt).
+ * P2：实现经 pluginState 槽取（claude 的实现在 harness plugins 槽内），薄委托。 */
+export declare function readClaudePluginEnabled(): Promise<Record<string, boolean>>;
+/** Set `enabledPlugins[key]` in ~/.claude/settings.json, preserving all other
+ * keys. The file is created if missing. P2：薄委托。 */
+export declare function writeClaudePluginEnabled(key: string, enabled: boolean): Promise<void>;
+/** Read `[plugins."key"] enabled` from ~/.codex/config.toml (empty if absent).
+ * P2：实现迁入 harness `codex/plugin-state.ts`（含 TOML 表示法），薄委托。 */
+export declare function readCodexPluginEnabled(): Promise<Record<string, boolean>>;
+/** Set `[plugins."key"] enabled` in ~/.codex/config.toml（增量段编辑，注释与
+ * 键序保留）。P2：薄委托。 */
+export declare function writeCodexPluginEnabled(key: string, enabled: boolean): Promise<void>;
+export { globalSkillsPath, claudeJsonPath, claudePluginsJsonPath, claudeSettingsPath, codexSkillsPath, codexPluginsCachePath, };

package/node_modules/@weavecode/server/dist/install/global-config.js

@@ -0,0 +1,2 @@
+import{readFile as x,writeFile as W,readdir as m,access as _,stat as j,realpath as $}from"node:fs/promises";import{homedir as f}from"node:os";import l from"node:path";import{AssetNotFoundError as g}from"./installer.js";import{FileTooLargeError as z,MAX_BYTES as J}from"./reader.js";import{assetSurfaceFor as h,assetSurfaces as O,pluginStateFor as S,pluginSurfaceFor as R}from"../surfaces.js";import{installForm as L,linkOrCopy as I,removeInstalled as U}from"../market/install-link.js";export class ClaudeJsonCorruptError extends Error{constructor(e){super(e),this.name="ClaudeJsonCorruptError"}}const B=".claude.json",K=".claude/plugins/installed_plugins.json";function P(){return l.join(f(),B)}function k(){return h("claude").globalSkillsRoots(f())[0]}function N(t=f()){return l.join(t,K)}function X(){return h("claude").userConfigFile(f())}function M(){return h("codex").globalSkillsRoots(f())[0]}function Y(){return h("codex").globalSkillsRoots(f())}function C(){const t=h("codex").pluginCacheDir?.(f());if(!t)throw new Error("codex has no plugin cache surface");return t}export function globalPersonalSkillRootsOwned(){return O().flatMap(t=>t.globalSkillsRoots(f()).map(e=>({harness:t.harness,root:e})))}export function globalPersonalSkillRoots(){return globalPersonalSkillRootsOwned().map(t=>t.root)}async function A(t){try{return await _(t),!0}catch{return!1}}async function y(t){try{return(await j(t)).isDirectory()}catch{return!1}}export async function readGlobalClaudeJson(){const t=P();if(!await A(t))return{};let e;try{e=await x(t,"utf-8")}catch{return{}}let n;try{n=JSON.parse(e)}catch(o){throw new ClaudeJsonCorruptError(`~/.claude.json is not valid JSON \u2014 refusing to write: ${o instanceof Error?o.message:String(o)}`)}if(!n||typeof n!="object"||Array.isArray(n))throw new ClaudeJsonCorruptError("~/.claude.json is not a JSON object \u2014 refusing to write");return n}export async function readGlobalMcpServers(){const e=(await readGlobalClaudeJson()).mcpServers;return!e||typeof e!="object"||Array.isArray(e)?{}:e}async function T(t){await W(P(),`${JSON.stringify(t,null,2)}
+`,"utf-8")}export async function writeGlobalMcpServer(t,e){const n=await readGlobalClaudeJson(),o=n.mcpServers??{};o[t]=e,n.mcpServers=o,await T(n)}export async function removeGlobalMcpServer(t){const e=await readGlobalClaudeJson(),n=e.mcpServers??{};t in n&&(delete n[t],e.mcpServers=n,await T(e))}export async function readGlobalSkills(){const t=k();try{const e=await m(t,{withFileTypes:!0}),n=[];for(const o of e)!o.isDirectory()&&!o.isSymbolicLink()||await y(l.join(t,o.name))&&n.push(o.name);return n.sort((o,r)=>o.localeCompare(r))}catch{return[]}}export async function installGlobalSkill(t,e,n="claude"){const o=h(n).globalSkillsRoots(f())[0],r=l.join(o,e);if(await A(r))throw new Error(`Global ${n} skill "${e}" already exists`);return await I(t,r),r}export async function uninstallGlobalSkill(t,e="claude"){const n=h(e).globalSkillsRoots(f())[0];await U(l.join(n,t))}async function F(t=f()){const e=N(t);if(!await A(e))return{};try{const n=JSON.parse(await x(e,"utf-8"));return n&&typeof n=="object"&&!Array.isArray(n)?n:{}}catch{return{}}}async function v(t){if(!await y(t))return[];let e;try{e=await m(t,{withFileTypes:!0})}catch{return[]}const n=[];for(const o of e){if(o.name.startsWith(".")||!o.isDirectory()&&!o.isSymbolicLink())continue;const r=l.join(t,o.name);if(!await y(r))continue;const i=await L(r);i!=="absent"&&n.push({name:o.name,dir:r,form:i})}return n.sort((o,r)=>o.name.localeCompare(r.name))}export async function installedPluginNamespaces(t=f()){const n=(await F(t)).plugins;if(!n||typeof n!="object"||Array.isArray(n))return[];const o=[];for(const[r,i]of Object.entries(n)){const{market:s}=R("claude").parsePluginKey(r);for(const a of Array.isArray(i)?i:[])a&&typeof a.installPath=="string"&&o.push({dir:a.installPath,namespace:s})}return o}async function q(){const e=(await F()).plugins;if(!e||typeof e!="object"||Array.isArray(e))return[];const n=[];for(const[o,r]of Object.entries(e)){const i=Array.isArray(r)?r:[];if(i.length===0)continue;const s=[...i].filter(d=>d&&typeof d.installPath=="string").pop();if(!s?.installPath)continue;const a=await v(l.join(s.installPath,"skills")),{name:c,market:p}=R("claude").parsePluginKey(o);n.push({source:"claude-plugin",label:c,namespace:p,skills:a,pluginKey:o})}return n.sort((o,r)=>o.label.localeCompare(r.label))}async function H(){const t=new Map;for(const n of Y())for(const o of await v(n))t.has(o.name)||t.set(o.name,o);return{source:"codex-personal",label:"Codex \xB7 \u4E2A\u4EBA",skills:[...t.values()].sort((n,o)=>n.name.localeCompare(o.name))}}async function Q(){const t=C();if(!await y(t))return[];const e=[];let n;try{n=await m(t,{withFileTypes:!0})}catch{return[]}for(const o of n){if(!o.isDirectory()&&!o.isSymbolicLink())continue;const r=l.join(t,o.name);let i;try{i=await m(r,{withFileTypes:!0})}catch{continue}for(const s of i){if(!s.isDirectory()&&!s.isSymbolicLink())continue;const a=l.join(r,s.name);let c;try{c=await m(a,{withFileTypes:!0})}catch{continue}const p=c.filter(w=>w.isDirectory()||w.isSymbolicLink());if(p.length===0)continue;const d=p.map(w=>w.name).sort().pop(),u=await v(l.join(a,d,"skills")),b=`${s.name}@${o.name}`;e.push({source:"codex-plugin",label:s.name,namespace:o.name,skills:u,pluginKey:b})}}return e.sort((o,r)=>o.label.localeCompare(r.label))}async function V(){const t=k(),e=await readGlobalSkills(),n=[];for(const o of e){const r=l.join(t,o),i=await L(r);i!=="absent"&&n.push({name:o,dir:r,form:i})}return{source:"claude-personal",label:"Claude Code \xB7 \u4E2A\u4EBA",skills:n}}export async function readGlobalSkillGroups(){const[t,e,n,o,r,i]=await Promise.all([V(),q(),H(),Q(),readClaudePluginEnabled(),readCodexPluginEnabled()]),s=(a,c)=>({...a,enabled:a.pluginKey?c[a.pluginKey]??!1:void 0});return[t,...e.map(a=>s(a,r)),n,...o.map(a=>s(a,i))]}export async function resolveGlobalSkillDir(t,e,n){if(t==="claude-personal"){const u=l.join(k(),e);return await y(u)?u:null}if(t==="codex-personal"){const u=l.join(M(),e);return await y(u)?u:null}if(t==="claude-plugin"){if(!n)return null;const b=(await F()).plugins;if(!b||typeof b!="object"||Array.isArray(b))return null;const w=b[n],E=[...Array.isArray(w)?w:[]].filter(G=>G&&typeof G.installPath=="string").pop();if(!E?.installPath)return null;const D=l.join(E.installPath,"skills",e);return await y(D)?D:null}if(!n)return null;const o=n.lastIndexOf("@");if(o<=0)return null;const r=n.slice(0,o),i=n.slice(o+1),s=l.join(C(),i,r);if(!await y(s))return null;let a;try{a=await m(s,{withFileTypes:!0})}catch{return null}const c=a.filter(u=>u.isDirectory()||u.isSymbolicLink());if(c.length===0)return null;const p=c.map(u=>u.name).sort().pop(),d=l.join(s,p,"skills",e);return await y(d)?d:null}function Z(t){const e=l.resolve(t),n=f();return O().find(r=>{const i=[...r.globalSkillsRoots(n)],s=r.pluginCacheDir?.(n);return s&&i.push(s),i.some(a=>e===l.resolve(a)||e.startsWith(l.resolve(a)+l.sep))})?.harness??"claude"}export async function listGlobalSkillFiles(t){const e=Z(t),n=[],o=async(r,i)=>{let s;try{s=await m(r,{withFileTypes:!0})}catch{return}for(const a of s){if(a.name.startsWith("."))continue;const c=l.join(r,a.name),p=i?`${i}/${a.name}`:a.name;if((a.isDirectory()||a.isSymbolicLink())&&await y(c))await o(c,p);else if(a.isFile()||a.isSymbolicLink())try{const d=await j(c);d.isFile()&&n.push({absPath:c,relPath:p,category:"skill",agent:e,mtimeMs:d.mtimeMs})}catch{}}};return await o(t,""),n.sort((r,i)=>r.relPath.localeCompare(i.relPath))}export async function readGlobalSkillFile(t,e){const n=l.normalize(e).replace(/\\/g,"/");if(l.isAbsolute(e))throw new g(`Absolute paths are not allowed: "${e}"`);if(n.split("/").some(p=>p===".."))throw new g(`Path traversal is not allowed: "${e}"`);const o=l.join(t,n);let r;try{r=await j(o)}catch{throw new g(`File not found: "${e}"`)}if(!r.isFile())throw new g(`Not a file: "${e}"`);if(r.size>J)throw new z(`File exceeds ${J} bytes: "${e}"`);let i=t,s=o;try{[i,s]=await Promise.all([$(t),$(o)])}catch{throw new g(`File not found: "${e}"`)}const a=i.endsWith(l.sep)?i:i+l.sep;if(s!==i&&!s.startsWith(a))throw new g(`Resolved path escapes the skill directory: "${e}"`);return{content:await x(o,"utf-8"),size:r.size}}export async function readClaudePluginEnabled(){return S("claude").readGlobalEnabled()}export async function writeClaudePluginEnabled(t,e){return S("claude").writeGlobalEnabled(t,e)}export async function readCodexPluginEnabled(){return S("codex").readGlobalEnabled()}export async function writeCodexPluginEnabled(t,e){return S("codex").writeGlobalEnabled(t,e)}export{k as globalSkillsPath,P as claudeJsonPath,N as claudePluginsJsonPath,X as claudeSettingsPath,M as codexSkillsPath,C as codexPluginsCachePath};

package/node_modules/@weavecode/server/dist/install/global-file-assets.d.ts

@@ -0,0 +1,6 @@
+import type { AssetEntry } from '../watch/types.js';
+/**
+ * List every machine-level harness file weave knows about, bounded by the
+ * whitelist above. `home` is injectable for tests.
+ */
+export declare function listGlobalFileAssets(home?: string): Promise<AssetEntry[]>;