@weavecode/weave 0.0.0-stage → 0.1.1

package/node_modules/@weavecode/server/dist/install/updates.d.ts

@@ -0,0 +1,103 @@
+import type { Harness } from '@weavecode/core';
+import { FingerprintCache } from './fingerprint.js';
+import { type LibraryIndex } from './library-index.js';
+import { readGlobalSkills } from './global-config.js';
+import type { FileAssetCategory } from './file-assets.js';
+import { type PluginTemplateUpdate } from './plugin-templates.js';
+import { type InitFileUpdate } from './init-files.js';
+import type { LibraryRow } from '../repositories/libraries.js';
+/**
+ * Update detection — compares installed assets against their library sources.
+ *
+ * An installed skill is "outdated" when its directory content hash differs from
+ * the source directory's hash; an MCP entry is outdated when its config hash
+ * differs from the source template's; a file asset when its file hash differs.
+ * Assets without a matching library source are `custom` (no update path) —
+ * e.g. hand-authored skills or MCP entries added via the form, not from a
+ * template.
+ *
+ * Scope + agent are inferred from the install path:
+ *   project skill → `<project>/.claude/skills/<name>/` (claude)
+ *                   `<project>/.codex/skills/<name>/`  (codex)
+ *   user    skill → `~/.claude/skills/<name>/` (claude) · `~/.agents/skills/<name>/` (codex)
+ *   project mcp   → `.mcp.json`
+ *   user    mcp   → `~/.claude.json`
+ *   codex   mcp   → `~/.codex/config.toml`
+ */
+export interface SkillUpdate {
+    name: string;
+    scope: 'project' | 'user';
+    /** Which agent's surface the skill is installed on. */
+    agent: Harness;
+    /** true = installed content differs from source (update available). */
+    outdated: boolean;
+    /** true = no library source found (cannot update). */
+    custom: boolean;
+    /** true = 账本登记过但盘上已不在（补齐路径会重装）。 */
+    missing?: boolean;
+    /** Resolved source directory when not custom. */
+    sourceDir?: string;
+    libraryId?: number;
+}
+export interface McpUpdate {
+    name: string;
+    scope: 'project' | 'user';
+    /** Which agent's surface the server is configured on (Codex = config.toml). */
+    agent?: Harness;
+    outdated: boolean;
+    custom: boolean;
+    /** true = 账本登记过但配置已不在（补齐路径会重新写回）。 */
+    missing?: boolean;
+    libraryId?: number;
+}
+export interface FileAssetUpdate {
+    category: FileAssetCategory;
+    name: string;
+    scope: 'project' | 'user';
+    outdated: boolean;
+    custom: boolean;
+    /** true = 账本登记过但盘上已不在（补齐路径会重装）。 */
+    missing?: boolean;
+    libraryId?: number;
+}
+export interface UpdateReport {
+    skills: SkillUpdate[];
+    mcp: McpUpdate[];
+    files: FileAssetUpdate[];
+    /** 项目自有 weave 源（`.weave/plugins` 的 manifest.templates）的物化漂移。 */
+    pluginTemplates: PluginTemplateUpdate[];
+    /** init 生成物的漂移（不进 git 的可自愈；会进 git 的只报不写）。 */
+    initFiles: InitFileUpdate[];
+    /** Count of outdated assets sync can actually apply（含 auto 归类的 init 文件）。 */
+    available: number;
+    /** 会进 git 的 init 文件有漂移 → dashboard 提醒用户跑 `weave init`。 */
+    needsInit: boolean;
+}
+/**
+ * Detect skill + MCP + file-asset updates for a project against the registered
+ * libraries. `index` may be passed in (reused across calls) or omitted to
+ * rebuild it.
+ */
+export declare function detectUpdates(projectPath: string, libraries: LibraryRow[], cache: FingerprintCache, index?: LibraryIndex): Promise<UpdateReport>;
+/** 项目行推送面的一行摘要：角标条数 + 「待 init」提醒（同一次检测的两个面）。 */
+export interface ProjectUpdateSummary {
+    /** 可代写同步的过期项数（含 auto 归类的 init 文件）。 */
+    available: number;
+    /** 会进 git 的 init 文件有漂移 → 提醒用户跑 `weave init`。 */
+    needsInit: boolean;
+}
+/**
+ * 全项目更新摘要（projectId → 摘要，含 0/false）：项目行角标推送面的数据源。
+ * 与 `GET /projects/:id/updates` 同一检测函数（同源不双算），库索引一轮构建
+ * 一次、整轮复用。
+ */
+export declare function detectProjectUpdateCounts(projects: ReadonlyArray<{
+    id: number;
+    path: string;
+}>, libraries: LibraryRow[], cache: FingerprintCache): Promise<Record<number, ProjectUpdateSummary>>;
+/** Detect skill updates (project + user, Claude + Codex) against the index. */
+export declare function detectSkillUpdates(projectPath: string, cache: FingerprintCache, idx: LibraryIndex): Promise<SkillUpdate[]>;
+/** Detect single-file asset updates (commands/agents/workflows/rules/output-styles). */
+export declare function detectFileAssetUpdates(projectPath: string, cache: FingerprintCache, idx: LibraryIndex): Promise<FileAssetUpdate[]>;
+/** Re-export for callers that only want the global skills listing. */
+export { readGlobalSkills };

package/node_modules/@weavecode/server/dist/install/updates.js

@@ -0,0 +1 @@
+import{readdir as g,stat as w}from"node:fs/promises";import{homedir as F}from"node:os";import f from"node:path";import{hashMcpConfig as p}from"./fingerprint.js";import{buildLibraryIndex as h,findSkillSource as y,findMcpSource as m,findFileAssetSource as S}from"./library-index.js";import{readMcpServers as k}from"./installer.js";import{readGlobalMcpServers as x,readGlobalSkills as v}from"./global-config.js";import{readCodexMcpServers as C}from"./codex-toml.js";import{FILE_ASSET_CATEGORIES as E,FILE_ASSET_SPECS as M}from"./file-assets.js";import{assetSurfaces as b}from"../surfaces.js";import{readInstalledLedger as T}from"./install-ledger.js";import{detectPluginTemplateUpdates as U}from"./plugin-templates.js";import{detectInitFileUpdates as D,needsInit as L}from"./init-files.js";export async function detectUpdates(a,o,l,t){const n=t??await h(o),[s,e,r,i,u]=await Promise.all([detectSkillUpdates(a,l,n),H(a,n),detectFileAssetUpdates(a,l,n),U(a,l),D(a)]);await A(a,{skills:s,mcp:e,files:r},n);const d=s.filter(c=>!c.custom&&c.outdated).length+e.filter(c=>!c.custom&&c.outdated).length+r.filter(c=>!c.custom&&c.outdated).length+i.filter(c=>c.outdated).length+u.filter(c=>c.outdated&&c.syncClass==="auto").length;return{skills:s,mcp:e,files:r,pluginTemplates:i,initFiles:u,available:d,needsInit:L(u)}}export async function detectProjectUpdateCounts(a,o,l){const t=await h(o),n={};for(const s of a){const e=await detectUpdates(s.path,o,l,t);n[s.id]={available:e.available,needsInit:e.needsInit}}return n}async function A(a,o,l){for(const t of await T(a)){if(t.category==="skill"){if(!y(l,t.name)||o.skills.some(r=>r.scope==="project"&&r.name===t.name&&r.agent===t.agent))continue;o.skills.push({name:t.name,scope:"project",agent:t.agent,outdated:!0,custom:!1,missing:!0});continue}if(t.category==="mcp"){if(!m(l,t.name)||o.mcp.some(e=>e.scope==="project"&&e.name===t.name))continue;o.mcp.push({name:t.name,scope:"project",outdated:!0,custom:!1,missing:!0});continue}const n=t.assetCategory;n===void 0||!S(l,n,t.name)||o.files.some(e=>e.scope==="project"&&e.category===n&&e.name===t.name)||o.files.push({category:n,name:t.name,scope:"project",outdated:!0,custom:!1,missing:!0})}}async function P(a){let o;try{o=await g(a,{withFileTypes:!0})}catch{return[]}const l=[];for(const t of o)if(!(!t.isDirectory()&&!t.isSymbolicLink()))try{(await w(f.join(a,t.name))).isDirectory()&&l.push(t.name)}catch{}return l}export async function detectSkillUpdates(a,o,l){const t=F(),n=[...b().map(e=>({dir:f.join(a,...e.projectSkillsDir().split("/")),scope:"project",agent:e.harness})),...b().map(e=>({dir:e.globalSkillsRoots(t)[0],scope:"user",agent:e.harness}))],s=[];for(const e of n)for(const r of await P(e.dir)){const i=f.join(e.dir,r),u=y(l,r);if(!u){s.push({name:r,scope:e.scope,agent:e.agent,outdated:!1,custom:!0});continue}const[d,c]=await Promise.all([o.get(i),o.get(u.dirPath)]);s.push({name:r,scope:e.scope,agent:e.agent,outdated:d!==c,custom:!1,sourceDir:u.dirPath,libraryId:u.libraryId})}return s}export async function detectFileAssetUpdates(a,o,l){const t=[];for(const n of E){const s=M[n],e=s.dirs.claude?.project;if(!e)continue;const r=f.join(a,...e.split("/"));let i;try{i=(await g(r,{withFileTypes:!0})).filter(u=>u.isFile()&&u.name.endsWith(s.ext)).map(u=>u.name)}catch{continue}for(const u of i){const d=u.slice(0,-s.ext.length),c=S(l,n,d);if(!c){t.push({category:n,name:d,scope:"project",outdated:!1,custom:!0});continue}const[j,I]=await Promise.all([o.getFile(f.join(r,u)),o.getFile(c.filePath)]);t.push({category:n,name:d,scope:"project",outdated:j!==I,custom:!1,libraryId:c.libraryId})}}return t}async function H(a,o){const[l,t,n]=await Promise.all([k(a).catch(()=>({})),x().catch(()=>({})),C().catch(()=>({}))]),s=[];for(const[e,r]of Object.entries(l)){const i=m(o,e);i?s.push({name:e,scope:"project",outdated:p(r)!==p(i.config),custom:!1,libraryId:i.libraryId}):s.push({name:e,scope:"project",outdated:!1,custom:!0})}for(const[e,r]of Object.entries(t)){const i=m(o,e);i?s.push({name:e,scope:"user",outdated:p(r)!==p(i.config),custom:!1,libraryId:i.libraryId}):s.push({name:e,scope:"user",outdated:!1,custom:!0})}for(const[e,r]of Object.entries(n)){const i=m(o,e);i?s.push({name:e,scope:"user",agent:"codex",outdated:p(r)!==p(i.config),custom:!1,libraryId:i.libraryId}):s.push({name:e,scope:"user",agent:"codex",outdated:!1,custom:!0})}return s}export{v as readGlobalSkills};

package/node_modules/@weavecode/server/dist/market/builtin.d.ts

@@ -0,0 +1,41 @@
+import { type InstallLinkMode } from './install-link.js';
+import type { LibraryRepository } from '../repositories/libraries.js';
+/**
+ * 内置仓在市场里的 id。它**必须**等于 harness 的注册键缺省市场
+ * （`PluginSurface.pluginKey` 的 `name@weave` 里那个 `weave`）——`marketIdOf`
+ * 会把 `<dataDir>/market/weave/<...>` 下的包判成 `name@weave`，两边同名才使得
+ * 「内置仓落地前回落自建市场 / 落地后判成 weaver 市场」得到**同一个键**。
+ * 故这里直接引 harness 的常量，不另抄一个字符串。
+ */
+export declare const BUILTIN_MARKET_ID = "weave";
+/** 内置仓在数据目录里的落点：`<dataDir>/market/weave/`。 */
+export declare function builtinMarketDir(dataDir: string): string;
+/** 内置工具包扫描根（仓内 `plugins/`）——`ToolkitSource.root` 用。 */
+export declare function builtinPacksDir(dataDir: string): string;
+/** 内置 SPI 规则包装载根（仓内 `rules/`）。 */
+export declare function builtinRulesDir(dataDir: string): string;
+export declare function isBuiltinMarketDir(candidate: string, dataDir: string): boolean;
+export interface BuiltinMarketResult {
+    /** 本次是否重铺（false = 既有落点已指向当前源，未动盘）。 */
+    changed: boolean;
+    /** 链接或复制；重铺失败时为 undefined。 */
+    form?: InstallLinkMode;
+    error?: string;
+}
+/**
+ * 把 `@weavecode/templates` 随包发布的内置仓落到 `<dataDir>/market/weave/`，
+ * 并登记为一条 `libraries` 行（`/market` 与资源管理页据此把它当一个仓库渲染）。
+ *
+ * **落点用链接（失败回退复制）**：这是「公共全局位置优先链接」的直接落实 ——
+ * 落点不是数据，而是随包发布的只读内容，链接既不复制一份、也让「改仓即改内置」
+ * 在开发态（源 = `src/resources`）真正即时生效。故**不得**往落点写任何东西
+ * （清单/扫描缓存都不落这里：扫描缓存写 `<dataDir>/market/.weave-scans/`，
+ * 是市场根的**兄弟**目录）。
+ *
+ * 幂等：落点已是指向当前源的链接则不动盘；源变更（换包版本 / 开发态换目录）或
+ * 落点是旧的复制件时重铺 —— 重铺走 `removeInstalled`（lstat 判定），
+ * 绝不会把链接当目录递归删而删穿到包内。
+ */
+export declare function ensureBuiltinMarket(deps: {
+    libraries: Pick<LibraryRepository, 'add' | 'dataDir'>;
+}): Promise<BuiltinMarketResult>;

package/node_modules/@weavecode/server/dist/market/builtin.js

@@ -0,0 +1 @@
+import n from"node:path";import{lstat as l,realpath as s}from"node:fs/promises";import{builtinMarketRoot as u}from"@weavecode/templates";import{WEAVE_MARKETPLACE as f}from"@weavecode/harness";import{marketDir as m}from"./manifest.js";import{linkOrCopy as p,removeInstalled as h}from"./install-link.js";export const BUILTIN_MARKET_ID=f;export function builtinMarketDir(t){return n.join(m(t),BUILTIN_MARKET_ID)}export function builtinPacksDir(t){return n.join(builtinMarketDir(t),"plugins")}export function builtinRulesDir(t){return n.join(builtinMarketDir(t),"rules")}export function isBuiltinMarketDir(t,o){return n.resolve(t)===n.resolve(builtinMarketDir(o))}export async function ensureBuiltinMarket(t){const o=t.libraries.dataDir,e=u(),r=builtinMarketDir(o);t.libraries.add({path:r,kind:"both"});const c=await s(e),a=await l(r).catch(()=>null);if(a){if(a.isSymbolicLink()&&await s(r).catch(()=>null)===c)return{changed:!1,form:"link"};await h(r)}try{return{changed:!0,form:await p(e,r)}}catch(i){return{changed:!1,error:i instanceof Error?i.message:String(i)}}}

package/node_modules/@weavecode/server/dist/market/identity.d.ts

@@ -0,0 +1,9 @@
+/**
+ * 包所属的市场身份——**判据的唯一实现**（安装分流与 UI 展示同源）。
+ *
+ * 判据：包目录落在 `<dataDir>/market/<id>/…` 里 = 外部市场导入的包 → 返回该市场
+ * id（CC 键 `name@<id>`，文件留在数据目录、可整体迁移）；否则 undefined = weave
+ * 自己的包（内置仓 `plugins/`、SPI 插件、手加目录）→ 走 weave 自建
+ * 市场 `name@weave`。
+ */
+export declare function marketIdOf(packDir: string, marketRoot?: string): string | undefined;

package/node_modules/@weavecode/server/dist/market/identity.js

@@ -0,0 +1 @@
+import e from"node:path";import{marketDir as n}from"./manifest.js";export function marketIdOf(i,o=n()){const r=e.relative(e.resolve(o),e.resolve(i));if(r===""||r.startsWith("..")||e.isAbsolute(r))return;const t=r.split(e.sep)[0];return t||void 0}

package/node_modules/@weavecode/server/dist/market/import.d.ts

@@ -0,0 +1,45 @@
+import type { LibraryRepository, LibraryRow } from '../repositories/libraries.js';
+import { type MarketManifest } from './manifest.js';
+export interface GitExecOptions {
+    timeout: number;
+    maxBuffer: number;
+    windowsHide: boolean;
+}
+export type GitResult = {
+    stdout: string;
+    stderr: string;
+};
+/** git 执行注入点（execFile 边界）：测试传假 exec 断言参数数组，不真联网。 */
+export type GitExec = (file: string, args: string[], options: GitExecOptions) => Promise<GitResult>;
+export interface ImportDeps {
+    libraries: LibraryRepository;
+    /** 覆盖 dataDir（测试注入）；默认 getDataDir()。 */
+    dataDir?: string;
+    /** 覆盖 git 执行（测试注入假 exec）。 */
+    execGit?: GitExec;
+}
+export interface ImportedResource {
+    /** 市场目录名（slug，白名单 `[a-z0-9-]`）。 */
+    id: string;
+    /** 市场内绝对路径。 */
+    dir: string;
+    /** 相对 dataDir 的 posix 形（libraries.path 规范存储形）。 */
+    relPath: string;
+    manifest: MarketManifest;
+    libraryId: number;
+    /** 同一来源重复导入 → 复用同一市场目录与 libraries 行（不新增）。 */
+    reused: boolean;
+    /** 同源再导入时覆盖刷新了缓存内容（M4：覆盖重导 + 触发重扫）。 */
+    refreshed: boolean;
+}
+/** resourceId slug：白名单 `[a-z0-9-]`，其余字符折叠为 `-`；空结果回落 `resource`（防穿越）。 */
+export declare function slugifyResourceId(name: string): string;
+/** git URL 协议白名单：`https://`、`ssh://`、`git@host:path`；拒 `ext::`、`--upload-pack` 等向量。 */
+export declare function assertSafeGitUrl(raw: string): string;
+/** 本地目录 → 复制进市场 + 写清单 + 登记 libraries 行。 */
+export declare function importFromDir(srcPath: string, deps: ImportDeps): Promise<ImportedResource>;
+/** git URL → clone 进市场 + 写清单 + 登记 libraries 行（execFile 数组传参无 shell）。 */
+export declare function importFromGit(rawUrl: string, deps: ImportDeps): Promise<ImportedResource>;
+/** legacy 外部源显式迁入：复制进市场 + 改写既有 libraries 行为相对形（不新增行）。 */
+export declare function importLibraryIntoMarket(row: LibraryRow, deps: ImportDeps): Promise<ImportedResource>;
+export declare const defaultGitExec: GitExec;

package/node_modules/@weavecode/server/dist/market/import.js

@@ -0,0 +1,2 @@
+import{execFile as G}from"node:child_process";import{cp as x,mkdir as D,readdir as R,rename as k,rm as p,stat as A}from"node:fs/promises";import s from"node:path";import{promisify as _}from"node:util";import{getDataDir as h}from"../db/paths.js";import{isInsideDir as E,toRelPosix as g}from"./resolve.js";import{isBuiltinMarketDir as B}from"./builtin.js";import{marketDir as I,readManifest as y,writeManifest as d}from"./manifest.js";const C=_(G),M=6e4,S=2e3;export function slugifyResourceId(r){const t=r.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"");return/^[a-z0-9][a-z0-9-]*$/.test(t)?t:"resource"}export function assertSafeGitUrl(r){const t=r.trim();if(!t)throw new Error("Missing git URL");if(t.includes("--upload-pack"))throw new Error("Invalid git URL (--upload-pack rejected)");if(!(t.startsWith("https://")||t.startsWith("ssh://")||/^git@[^:/\s]+:/.test(t)))throw new Error(`Unsupported git URL (allowed: https/ssh): ${t}`);if(/[\s\r\n\t]/.test(t))throw new Error("Invalid git URL (whitespace)");return t}function w(){return new Date().toISOString()}function U(r){return r.length>S?`${r.slice(0,S)}\u2026(truncated)`:r}function l(r,t){if(!E(r,t))throw new Error(`Import target escapes the market directory: ${r}`)}async function L(r){try{return await A(r),!0}catch{return!1}}async function b(r,t){let i=s.join(t,r),e=1;for(;await L(i);)e+=1,i=s.join(t,`${r}-${e}`);return i}async function O(r,t){let i;try{i=await R(r,{withFileTypes:!0})}catch{return null}for(const e of i){if(!e.isDirectory())continue;const a=s.join(r,e.name);if((await y(a))?.origin===t)return a}return null}async function v(r,t,i,e,a=!1){const o=i.dataDir??h(),n=g(r,o),c=i.libraries.add({path:n,kind:"both"});return{id:s.basename(r),dir:r,relPath:n,manifest:t,libraryId:c.id,reused:e,refreshed:a}}async function P(r,t,i){const e=`${t}.refresh-tmp`;await p(e,{recursive:!0,force:!0}),await x(r,e,{recursive:!0}),l(s.resolve(e),i),await p(t,{recursive:!0,force:!0}),await k(e,t)}export async function importFromDir(r,t){const i=t.dataDir??h(),e=s.resolve(r);if(!(await A(e).catch(()=>null))?.isDirectory())throw new Error(`Not a directory: ${r}`);const o=I(i);if(E(e,o))throw new Error("\u4E0D\u80FD\u628A\u8D44\u6E90\u5E02\u573A\u7684\u5B58\u50A8\u76EE\u5F55\u5F53\u6765\u6E90\u5BFC\u5165\uFF1A\u5176\u4E2D\u7684\u8D44\u6E90\u5DF2\u5728\u5217\u8868\u4E2D\uFF08\u5185\u7F6E\u4ED3\u843D\u70B9 / \u5DF2\u5BFC\u5165\u7684\u526F\u672C\uFF09");const n=await O(o,e);if(n){const m=await y(n);await P(e,n,o);const f={...m,importedAt:w()};return await d(n,f),v(n,f,t,!0,!0)}const c=await b(slugifyResourceId(s.basename(e)),o);l(c,o),await D(s.dirname(c),{recursive:!0}),await x(e,c,{recursive:!0});const u={source:"dir",origin:e,importedAt:w()};return await d(c,u),l(s.resolve(c),o),v(c,u,t,!1)}export async function importFromGit(r,t){const i=t.dataDir??h(),e=assertSafeGitUrl(r),a=I(i),o=await O(a,e);if(o){const m=await y(o),f=`${o}.refresh-tmp`;await p(f,{recursive:!0,force:!0});const j=["clone","--depth","1",e,f];try{await(t.execGit??defaultGitExec)("git",j,{timeout:M,maxBuffer:4*1024*1024,windowsHide:!0})}catch(F){throw new Error(`git clone failed: ${U(T(F))}`)}l(s.resolve(f),a),await p(o,{recursive:!0,force:!0}),await k(f,o);const $={...m,importedAt:w()};return await d(o,$),v(o,$,t,!0,!0)}const n=await b(slugifyResourceId(z(e)),a);l(n,a),await D(a,{recursive:!0});const c=["clone","--depth","1",e,n];try{await(t.execGit??defaultGitExec)("git",c,{timeout:M,maxBuffer:4*1024*1024,windowsHide:!0})}catch(m){throw new Error(`git clone failed: ${U(T(m))}`)}l(s.resolve(n),a);const u={source:"git",origin:e,importedAt:w()};return await d(n,u),v(n,u,t,!1)}export async function importLibraryIntoMarket(r,t){const i=t.dataDir??h(),e=s.isAbsolute(r.path)?r.path:s.join(i,r.path),a=s.resolve(e),o=I(i);if(!await L(a))throw new Error(`Source directory not found: ${a}`);if(B(a,i))throw new Error("\u5185\u7F6E\u4ED3\u4E0D\u53EF\u8FC1\u5165\uFF1A\u5B83\u968F\u5305\u53D1\u5E03\u3001\u65E0\u5916\u90E8\u6765\u6E90\uFF0C\u4E14\u843D\u70B9\u662F\u94FE\u63A5\uFF08\u5199\u5165\u4F1A\u6539\u5230\u5305\u5185\u5BB9\uFF09");if(E(a,o)){let u=await y(a);return u||(u={source:"dir",origin:a,importedAt:w()},await d(a,u)),{id:s.basename(a),dir:a,relPath:g(a,i),manifest:u,libraryId:r.id,reused:!0,refreshed:!1}}const n=await b(slugifyResourceId(s.basename(a)),o);l(n,o),await D(s.dirname(n),{recursive:!0}),await x(a,n,{recursive:!0});const c={source:"dir",origin:a,importedAt:w()};return await d(n,c),t.libraries.setPath(r.id,g(n,i)),{id:s.basename(n),dir:n,relPath:g(n,i),manifest:c,libraryId:r.id,reused:!1,refreshed:!1}}function z(r){const t=r.split(/[?#]/)[0],i=t.lastIndexOf("/"),e=t.lastIndexOf(":");return(i>e?t.slice(i+1):t.slice(e+1)).replace(/\.git$/,"")||"repo"}function T(r){const t=r,i=[t?.stderr,t?.stdout].filter(Boolean).map(String);return(i.length?i.join(`
+`):r instanceof Error?r.message:String(r)).trim()||"unknown error"}export const defaultGitExec=async(r,t,i)=>{const{stdout:e,stderr:a}=await C(r,t,i);return{stdout:String(e),stderr:String(a)}};

package/node_modules/@weavecode/server/dist/market/install-link.d.ts

@@ -0,0 +1,6 @@
+/**
+ * 薄委托：装面链接原语已上迁到 `@weavecode/harness` 的 `shared/install-link.ts`
+ * ——harness 侧的全局装面实现（`claude/plugins.ts`）也要用它，原语留在 server
+ * 会让 harness 反向依赖 server。此处保留同名导出，使既有消费点与测试零改。
+ */
+export { linkOrCopy, removeInstalled, installForm, type InstallLinkMode, type RemoveInstalledResult, } from '@weavecode/harness';

package/node_modules/@weavecode/server/dist/market/install-link.js

@@ -0,0 +1 @@
+export{linkOrCopy,removeInstalled,installForm}from"@weavecode/harness";

package/node_modules/@weavecode/server/dist/market/manifest.d.ts

@@ -0,0 +1,16 @@
+/** 市场资源目录内的清单文件名（不加表列，元数据随目录走）。 */
+export declare const MANIFEST_FILE = ".weave-market.json";
+export interface MarketManifest {
+    source: 'dir' | 'git';
+    /** 导入前的原始来源（本地绝对路径或 git URL）。 */
+    origin: string;
+    importedAt: string;
+    /** 预留给 git 更新检查（BACKLOG）——当前恒为空。 */
+    commit?: string;
+}
+/** 资源市场收纳根：`<getDataDir()>/market/`。 */
+export declare function marketDir(dataDir?: string): string;
+export declare function manifestPath(resourceDir: string): string;
+/** 读清单；缺失或不合法返回 null（legacy 目录没有清单）。 */
+export declare function readManifest(resourceDir: string): Promise<MarketManifest | null>;
+export declare function writeManifest(resourceDir: string, manifest: MarketManifest): Promise<void>;

package/node_modules/@weavecode/server/dist/market/manifest.js

@@ -0,0 +1,2 @@
+import e from"node:path";import{readFile as n,writeFile as i}from"node:fs/promises";import{getDataDir as o}from"../db/paths.js";export const MANIFEST_FILE=".weave-market.json";export function marketDir(t=o()){return e.join(t,"market")}export function manifestPath(t){return e.join(t,MANIFEST_FILE)}export async function readManifest(t){try{const r=JSON.parse(await n(manifestPath(t),"utf-8"));return r&&typeof r=="object"&&(r.source==="dir"||r.source==="git")?r:null}catch{return null}}export async function writeManifest(t,r){await i(manifestPath(t),`${JSON.stringify(r,null,2)}
+`,"utf-8")}

package/node_modules/@weavecode/server/dist/market/refresh.d.ts

@@ -0,0 +1,24 @@
+import { type GitExec } from './import.js';
+import type { LibraryRepository } from '../repositories/libraries.js';
+import type { MarketCheckTarget } from './updates.js';
+/**
+ * 市场缓存刷新（M4 一键更新的服务端半程）：dir 源重拷、git 源重 clone——
+ * 复用 import 的同源覆盖分支（containment 双检、libraryId 不变），成功后
+ * git 源回写 manifest.commit（启用预留位）。装面传播仍走既有 sync-all。
+ */
+export type RefreshStatus = 'refreshed' | 'origin-missing' | 'failed' | 'skipped';
+export interface RefreshResult {
+    id: number;
+    status: RefreshStatus;
+    /** git 源刷新后回写的 commit（dir 源无）。 */
+    commit?: string;
+}
+export interface RefreshDeps {
+    libraries: LibraryRepository;
+    /** 覆盖 dataDir（测试注入）；默认 getDataDir()。 */
+    dataDir?: string;
+    /** 覆盖 git 执行（测试注入假 exec）。 */
+    execGit?: GitExec;
+}
+/** 逐项刷新市场缓存（并发）；无 manifest 的 legacy 源跳过、origin 缺失不删缓存。 */
+export declare function refreshMarketItems(targets: MarketCheckTarget[], deps: RefreshDeps): Promise<RefreshResult[]>;

package/node_modules/@weavecode/server/dist/market/refresh.js

@@ -0,0 +1 @@
+import{stat as d}from"node:fs/promises";import{defaultGitExec as u,importFromDir as c,importFromGit as f}from"./import.js";import{readManifest as n,writeManifest as m}from"./manifest.js";async function w(t){try{return(await d(t)).isDirectory()}catch{return!1}}export async function refreshMarketItems(t,e){return Promise.all(t.map(async i=>{const r=await n(i.dir);if(!r)return{id:i.id,status:"skipped"};if(r.source==="dir"&&!await w(r.origin))return{id:i.id,status:"origin-missing"};try{if(r.source==="git"){const a=await f(r.origin,e),s=await h(a.dir,e.execGit??u);if(s){const o={...await n(a.dir),commit:s};return await m(a.dir,o),{id:i.id,status:"refreshed",commit:s}}return{id:i.id,status:"refreshed"}}return await c(r.origin,e),{id:i.id,status:"refreshed"}}catch{return{id:i.id,status:"failed"}}}))}async function h(t,e){try{return(await e("git",["-C",t,"rev-parse","HEAD"],{timeout:15e3,maxBuffer:1048576,windowsHide:!0})).stdout.trim()||void 0}catch{return}}

package/node_modules/@weavecode/server/dist/market/resolve.d.ts

@@ -0,0 +1,24 @@
+import type { LibraryRepository } from '../repositories/libraries.js';
+/**
+ * 批 9（R11 迁移兼容闸）：`libraries.path` 的读侧单点。
+ *
+ * - 相对路径（posix 分隔符入库）→ `path.join(dataDir, rel)` 还原（Windows 下分隔符/盘符经 join 归一）；
+ * - 绝对路径且在 dataDir 内 → 旧写法，返回解析值；`LibraryRepository` 读侧据此惰性 UPDATE 为相对形；
+ * - 绝对路径且在 dataDir 外 → legacy 外部源，原样返回（永不改写、不自动复制，显式迁入才进市场）。
+ */
+export declare function resolveLibraryPath(row: {
+    path: string;
+}, dataDir?: string): string;
+/** `target` 是否落在 `dir` 内（path.resolve 归一后比较，Windows 盘符差异视为界外）。 */
+export declare function isInsideDir(target: string, dir: string): boolean;
+/** 绝对路径 → 相对 dataDir 的 posix 形（markets.path 的规范存储形）。 */
+export declare function toRelPosix(absPath: string, dataDir?: string): string;
+/**
+ * managed 市场资源根（位于 `<dataDir>/market/` 内的库行）——toolkit 扫描源与
+ * plugin-loader 装载源共用的同一口径（M3 装载桥）；legacy 外部源不入内。
+ *
+ * **内置仓排除在外**：它的根由 `discoverToolkitSources()` 以 `provenance:'builtin'`
+ * 单独提供；若这里也返回，同一棵树会被两遍扫描、同一个包出现两条（一遍 builtin
+ * 一遍 market），开关与列表都会重复。
+ */
+export declare function marketLibraryRoots(libraries: Pick<LibraryRepository, 'list'>, dataDir?: string): string[];

package/node_modules/@weavecode/server/dist/market/resolve.js

@@ -0,0 +1 @@
+import t from"node:path";import{getDataDir as s}from"../db/paths.js";import{marketDir as a}from"./manifest.js";import{isBuiltinMarketDir as p}from"./builtin.js";export function resolveLibraryPath(e,o=s()){if(!t.isAbsolute(e.path))return t.join(o,e.path);const r=t.resolve(e.path);return isInsideDir(r,o)?r:e.path}export function isInsideDir(e,o){const r=t.relative(t.resolve(o),t.resolve(e));return t.isAbsolute(r)?!1:r===""||r!==".."&&!r.startsWith(`..${t.sep}`)}export function toRelPosix(e,o=s()){return t.relative(t.resolve(o),t.resolve(e)).split(t.sep).join("/")}export function marketLibraryRoots(e,o=s()){const r=t.resolve(a(o)),n=new Set;for(const l of e.list()){const i=t.resolve(l.path);i===r||p(i,o)||isInsideDir(i,r)&&n.add(i)}return[...n]}

package/node_modules/@weavecode/server/dist/market/updates.d.ts

@@ -0,0 +1,23 @@
+import { type GitExec } from './import.js';
+/**
+ * 市场缓存更新检查（M4）：比对 `<dataDir>/market/<slug>/` 与来源 origin——
+ * dir 源比内容 hash、git 源比本地 HEAD vs ls-remote。只读、不落库（结果由
+ * 调用方存 state，重查即刷）；装面更新由既有 sync-all 从缓存传播。
+ */
+export type MarketUpdateStatus = 'uptodate' | 'update-available' | 'origin-missing' | 'unknown';
+export interface MarketUpdateCheck {
+    id: number;
+    status: MarketUpdateStatus;
+    checkedAt: string;
+}
+export interface MarketCheckTarget {
+    id: number;
+    /** 市场缓存目录（绝对路径）。 */
+    dir: string;
+}
+/** 市场目录 hash 的跳过集：默认 sidecar + 清单文件（origin 侧无清单，跳过不影响对称）。 */
+export declare const MARKET_SKIP_NAMES: Set<string>;
+/** 逐项检查市场缓存是否有可用更新（并发；无 manifest 的 legacy 源 → unknown）。 */
+export declare function checkMarketUpdates(targets: MarketCheckTarget[], opts?: {
+    execGit?: GitExec;
+}): Promise<MarketUpdateCheck[]>;

package/node_modules/@weavecode/server/dist/market/updates.js

@@ -0,0 +1 @@
+import{stat as u}from"node:fs/promises";import m from"node:path";import{hashSkillDir as c}from"../install/fingerprint.js";import{defaultGitExec as l}from"./import.js";import{readManifest as d}from"./manifest.js";const f=15e3;export const MARKET_SKIP_NAMES=new Set([".weave",".git","node_modules",".weave-market.json"]);async function p(i){try{return(await u(i)).isDirectory()}catch{return!1}}async function w(i,o){const r=m.resolve(o);if(!await p(r))return"origin-missing";const[t,e]=await Promise.all([c(i,MARKET_SKIP_NAMES),c(r,MARKET_SKIP_NAMES)]);return t===e?"uptodate":"update-available"}async function h(i,o,r){const t={timeout:f,maxBuffer:1048576,windowsHide:!0};try{const e=await r("git",["-C",i,"rev-parse","HEAD"],t),a=await r("git",["ls-remote",o,"HEAD"],t),n=e.stdout.trim(),s=a.stdout.trim().split(/\s+/)[0]??"";return!n||!s?"unknown":n===s?"uptodate":"update-available"}catch{return"unknown"}}export async function checkMarketUpdates(i,o){const r=o?.execGit??l;return Promise.all(i.map(async t=>{const e=await d(t.dir);let a;return e?e.source==="git"?a=await h(t.dir,e.origin,r):a=await w(t.dir,e.origin):a="unknown",{id:t.id,status:a,checkedAt:new Date().toISOString()}}))}

package/node_modules/@weavecode/server/dist/registry.d.ts

@@ -0,0 +1,31 @@
+export interface RegisterResult {
+    id: number;
+    token: string;
+    path: string;
+}
+/**
+ * Register a project in the global registry and persist its per-project token
+ * into `<project>/.weave/token` (consumed by hook scripts in a later phase).
+ *
+ * Idempotent: re-registering an existing path reuses its original token.
+ */
+export declare function registerProject(targetDir: string, source: 'init' | 'scan', dbPath?: string): RegisterResult;
+export interface UnregisterResult {
+    id: number;
+    name: string;
+    path: string;
+    purged: {
+        events: number;
+        dispatches: number;
+        sessions: number;
+    };
+}
+/**
+ * `registerProject` 的逆：把项目从全局注册表整行删除（含归档行）。先按
+ * 归档路由同一套顺序清运行数据（派发 → 事件 → 会话），焚毁 daemon 侧
+ * 管道文件（inbox/mirror/outbox），再删行——运行中的 daemon 由 watch
+ * reconcile ≤5s 内自然收掉 watcher 并广播 project:removed。
+ *
+ * 未注册返回 null；不触碰项目目录本身（本地生成物归 uninstall 流程管）。
+ */
+export declare function unregisterProject(targetDir: string, dbPath?: string, hooksDir?: string): UnregisterResult | null;

package/node_modules/@weavecode/server/dist/registry.js

@@ -0,0 +1,2 @@
+import{basename as d,join as p}from"node:path";import{mkdirSync as y,writeFileSync as l}from"node:fs";import{openDatabase as m}from"./db/db.js";import{ProjectRepository as a}from"./repositories/projects.js";import{HookDispatchRepository as u}from"./repositories/hook-dispatches.js";import{HookEventRepository as h}from"./repositories/hook-events.js";import{SessionRepository as j}from"./repositories/sessions.js";import{generateToken as w}from"./daemon/auth.js";import{purgeProjectPipeline as P}from"./daemon/hook-pipeline.js";import{hooksRoot as k}from"./hooks/mirror.js";export function registerProject(t,s,c){const o=m(c);try{const r=new a(o),n=r.getByPath(t)?.token??w(),i=r.register({path:t,name:d(t),token:n,source:s});return y(p(t,".weave"),{recursive:!0}),l(p(t,".weave","token"),n+`
+`,"utf-8"),{id:i.id,token:n,path:i.path}}finally{o.close()}}export function unregisterProject(t,s,c){const o=m(s);try{const r=new a(o),e=r.getByPath(t);if(!e)return null;const n=new u(o).deleteByProject(e.id),i=new h(o).deleteByProject(e.id),f=new j(o).removeByProject(e.id);return P(c??k(),e.token),r.remove(e.id),{id:e.id,name:e.name,path:e.path,purged:{events:i,dispatches:n,sessions:f}}}finally{o.close()}}

package/node_modules/@weavecode/server/dist/repositories/hook-dispatches.d.ts

@@ -0,0 +1,53 @@
+import type { DatabaseSync } from 'node:sqlite';
+import type { HookDispatchMode, HookDispatchStatus } from '@weavecode/core';
+export interface HookDispatchInput {
+    ruleId: string;
+    eventId?: number | null;
+    sessionId?: string | null;
+    /** 待运行指令文本（指令池中的“物”）。 */
+    prompt: string;
+    status: HookDispatchStatus;
+    mode: HookDispatchMode;
+}
+export interface HookDispatchRow {
+    id: number;
+    ruleId: string;
+    eventId: number | null;
+    sessionId: string | null;
+    prompt: string;
+    status: HookDispatchStatus;
+    mode: HookDispatchMode;
+    output: string | null;
+    error: string | null;
+    startedAt: string;
+    finishedAt: string | null;
+}
+export interface UpdateDispatchStatusInput {
+    status: HookDispatchStatus;
+    output?: string | null;
+    error?: string | null;
+    finished?: boolean;
+}
+/** hook_dispatches 运行态表（append + 状态流转），与 hook_events 同为只增策略。 */
+export declare class HookDispatchRepository {
+    private readonly db;
+    constructor(db: DatabaseSync);
+    insert(input: HookDispatchInput): HookDispatchRow;
+    getById(id: number): HookDispatchRow | undefined;
+    updateStatus(id: number, input: UpdateDispatchStatusInput): HookDispatchRow | undefined;
+    list(filter?: {
+        ruleId?: string;
+        status?: HookDispatchStatus;
+        sessionId?: string;
+        limit?: number;
+    }): HookDispatchRow[];
+    /** 同一 rule × session 在窗口内的最近一条 auto 记录（防递归去重用）。 */
+    /** 删会话时连带清指令池派发——否则留下指向已消失会话的孤行。 */
+    deleteBySession(sessionId: string): number;
+    /**
+     * 归档项目时清空其派发行：按项目会话与项目事件两条子查询圈定（必须先于
+     * events/sessions 删除执行——子查询依赖那两张表的行还在）。
+     */
+    deleteByProject(projectId: number): number;
+    findRecentAuto(ruleId: string, sessionId: string, sinceIso: string): HookDispatchRow | undefined;
+}

package/node_modules/@weavecode/server/dist/repositories/hook-dispatches.js

@@ -0,0 +1,8 @@
+export class HookDispatchRepository{db;constructor(t){this.db=t}insert(t){const e=this.db.prepare(`INSERT INTO hook_dispatches (rule_id, event_id, session_id, prompt, status, mode, started_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?)`).run(t.ruleId,t.eventId??null,t.sessionId??null,t.prompt,t.status,t.mode,new Date().toISOString());return this.getById(Number(e.lastInsertRowid))}getById(t){const e=this.db.prepare("SELECT * FROM hook_dispatches WHERE id = ?").get(t);return e?r(e):void 0}updateStatus(t,e){const n=new Date().toISOString();return this.db.prepare(`UPDATE hook_dispatches
+         SET status = ?, output = COALESCE(?, output), error = COALESCE(?, error),
+             finished_at = CASE WHEN ? = 1 THEN ? ELSE finished_at END
+         WHERE id = ?`).run(e.status,e.output??null,e.error??null,e.finished?1:0,n,t),this.getById(t)}list(t={}){const e=Math.min(Math.max(t.limit??50,1),200),n=[],i=[];t.ruleId&&(n.push("rule_id = ?"),i.push(t.ruleId)),t.status&&(n.push("status = ?"),i.push(t.status)),t.sessionId&&(n.push("session_id = ?"),i.push(t.sessionId));const d=n.length>0?`WHERE ${n.join(" AND ")}`:"";return this.db.prepare(`SELECT * FROM hook_dispatches ${d} ORDER BY started_at DESC, id DESC LIMIT ?`).all(...i,e).map(r)}deleteBySession(t){return Number(this.db.prepare("DELETE FROM hook_dispatches WHERE session_id = ?").run(t).changes)}deleteByProject(t){return Number(this.db.prepare(`DELETE FROM hook_dispatches WHERE session_id IN (SELECT session_id FROM sessions WHERE project_id = ?)
+             OR event_id IN (SELECT id FROM hook_events WHERE project_id = ?)`).run(t,t).changes)}findRecentAuto(t,e,n){const i=this.db.prepare(`SELECT * FROM hook_dispatches
+         WHERE rule_id = ? AND session_id = ? AND mode = 'auto' AND started_at >= ?
+         ORDER BY started_at DESC LIMIT 1`).get(t,e,n);return i?r(i):void 0}}function r(s){return{id:Number(s.id),ruleId:String(s.rule_id),eventId:s.event_id==null?null:Number(s.event_id),sessionId:s.session_id==null?null:String(s.session_id),prompt:String(s.prompt),status:String(s.status),mode:String(s.mode),output:s.output==null?null:String(s.output),error:s.error==null?null:String(s.error),startedAt:String(s.started_at),finishedAt:s.finished_at==null?null:String(s.finished_at)}}

package/node_modules/@weavecode/server/dist/repositories/hook-events.d.ts

@@ -0,0 +1,57 @@
+import type { DatabaseSync } from 'node:sqlite';
+import type { Harness } from '@weavecode/core';
+export interface HookEventInput {
+    projectId: number;
+    source: Harness;
+    eventType: string;
+    sessionId?: string;
+    /** Serialized JSON payload captured from the agent hook. */
+    payload: string;
+}
+export interface HookEventRow {
+    id: number;
+    projectId: number;
+    source: string;
+    eventType: string;
+    sessionId: string | null;
+    payload: string;
+    createdAt: string;
+}
+export declare class HookEventRepository {
+    private readonly db;
+    /** 上次被动清理的 UTC 天序号（进程内标记；-1=本进程尚未清理过）。 */
+    private lastPruneDay;
+    private readonly insertEvent;
+    private readonly pruneByCutoff;
+    constructor(db: DatabaseSync);
+    /**
+     * 重置被动清理的天标记：全局设置保存保留期后调用——下一条事件写入
+     * 立即按新配置清理（否则要等次日跨天才重扫）。
+     */
+    resetPrune(): void;
+    /** Append-only insert. Returns the new row id. */
+    insert(input: HookEventInput): number;
+    /** 批量插入（spool 积压回灌）：单事务 + 一次 prune，返回新行 id 列表。 */
+    insertMany(inputs: readonly HookEventInput[]): number[];
+    /**
+     * 被动清理（无定时任务）：每个 UTC 天只在本进程的首条写入时执行一次
+     * DELETE——「下一次写入新一天日志时清理过期日志」。保留期读全局设置
+     * （daemon settings.json → events.retentionDays，默认 90 天）。
+     * created_at 为 ISO 字符串，字典序即时间序，直接比较即可；DELETE 留下
+     * 的空页由后续写入复用（不做 VACUUM，避免写路径上的大段停顿）。
+     */
+    private pruneExpired;
+    listByProject(projectId: number, limit?: number): HookEventRow[];
+    /**
+     * 按会话查事件（最新窗口，返回升序——任务视图事件链保序）。
+     * id 单调=插入序，消解 created_at 并列；取最新窗口后 reverse 成升序，
+     * 返回序与原 ORDER BY created_at ASC 一致，调用方零适配。
+     * `beforeId` 游标翻页：只取比游标更早的事件（组头「加载更早」向前翻 prompt）。
+     */
+    /** 删会话时连带清事件（append-only 表只有「删会话」与「保留期」两条删除路径）。 */
+    deleteBySession(sessionId: string): number;
+    /** 归档项目时清空其全部采集事件（含 session_id 为空的散行）。 */
+    deleteByProject(projectId: number): number;
+    /** `types` 非空只取这些事件类型（对话视图按开/闭轮类型翻页，不拉整条事件链）。 */
+    listBySession(sessionId: string, limit?: number, beforeId?: number, types?: readonly string[]): HookEventRow[];
+}

package/node_modules/@weavecode/server/dist/repositories/hook-events.js

@@ -0,0 +1,2 @@
+import{readDaemonSettingsSync as d,DEFAULT_EVENT_RETENTION_DAYS as p}from"../daemon/settings.js";export class HookEventRepository{db;lastPruneDay=-1;insertEvent;pruneByCutoff;constructor(e){this.db=e,this.insertEvent=e.prepare(`INSERT INTO hook_events (project_id, source, event_type, session_id, payload, created_at)
+       VALUES (?, ?, ?, ?, ?, ?)`),this.pruneByCutoff=e.prepare("DELETE FROM hook_events WHERE created_at < ?")}resetPrune(){this.lastPruneDay=-1}insert(e){this.pruneExpired();const s=this.insertEvent.run(e.projectId,e.source,e.eventType,e.sessionId??null,e.payload,new Date().toISOString());return Number(s.lastInsertRowid)}insertMany(e){this.pruneExpired();const s=[];this.db.exec("BEGIN");try{for(const t of e){const r=this.insertEvent.run(t.projectId,t.source,t.eventType,t.sessionId??null,t.payload,new Date().toISOString());s.push(Number(r.lastInsertRowid))}this.db.exec("COMMIT")}catch(t){throw this.db.exec("ROLLBACK"),t}return s}pruneExpired(){const e=Math.floor(Date.now()/864e5);if(e===this.lastPruneDay)return;this.lastPruneDay=e;const s=d().events?.retentionDays??p,t=new Date((e-s)*864e5).toISOString();this.pruneByCutoff.run(t)}listByProject(e,s=100){return this.db.prepare("SELECT * FROM hook_events WHERE project_id = ? ORDER BY created_at DESC LIMIT ?").all(e,s).map(t=>a(t))}deleteBySession(e){return Number(this.db.prepare("DELETE FROM hook_events WHERE session_id = ?").run(e).changes)}deleteByProject(e){return Number(this.db.prepare("DELETE FROM hook_events WHERE project_id = ?").run(e).changes)}listBySession(e,s=300,t,r){const o=["session_id = ?"],i=[e];return t!=null&&(o.push("id < ?"),i.push(t)),r?.length&&(o.push(`event_type IN (${r.map(()=>"?").join(",")})`),i.push(...r)),this.db.prepare(`SELECT * FROM hook_events WHERE ${o.join(" AND ")} ORDER BY id DESC LIMIT ?`).all(...i,s).map(u=>a(u)).reverse()}}function a(n){return{id:Number(n.id),projectId:Number(n.project_id),source:String(n.source),eventType:String(n.event_type),sessionId:n.session_id==null?null:String(n.session_id),payload:String(n.payload),createdAt:String(n.created_at)}}

package/node_modules/@weavecode/server/dist/repositories/hook-rules.d.ts

@@ -0,0 +1,42 @@
+import type { DatabaseSync } from 'node:sqlite';
+import { type HandlerConfig, type HookRule, type HookRuleFilter, type HookRuleOrigin, type HookRuleSource } from '@weavecode/core';
+export interface CreateHookRuleInput {
+    name: string;
+    enabled?: boolean;
+    priority?: number;
+    projectId: number | null;
+    source: HookRuleSource;
+    filter?: HookRuleFilter;
+    handler: HandlerConfig;
+    timeoutMs?: number;
+    record?: boolean;
+    origin?: HookRuleOrigin;
+    pluginId?: string | null;
+}
+/**
+ * hook_rules 配置表（行级 CRUD，enable/disable 单字段 UPDATE）。
+ * JSON 列（source/filter/handler）经 Zod 归一化读出，坏行跳过而非抛错。
+ */
+export declare class HookRuleRepository {
+    private readonly db;
+    constructor(db: DatabaseSync);
+    create(input: CreateHookRuleInput): HookRule;
+    /**
+     * 插件规则 upsert：id 由加载器稳定生成（`plugin:<id>:<n>`）。
+     * 已存在则只覆盖定义字段，**保留用户改过的 enabled**（插件更新不动用户开关）；
+     * 不存在则按插件默认值插入。origin/plugin_id 每次同步为本次加载的值。
+     */
+    upsertPluginRule(rule: HookRule): HookRule;
+    /** 删除某插件的全部规则（插件卸载/校验失败回滚）。返回删除数。 */
+    removeByPlugin(pluginId: string): number;
+    listByPlugin(pluginId: string): HookRule[];
+    getById(id: string): HookRule | undefined;
+    /** 全量列出；projectId 过滤时附带全局规则（project_id IS NULL）。 */
+    list(projectId?: number): HookRule[];
+    update(id: string, patch: Partial<CreateHookRuleInput> & {
+        enabled?: boolean;
+    }): HookRule | undefined;
+    setEnabled(id: string, enabled: boolean): HookRule | undefined;
+    remove(id: string): boolean;
+    private insertRow;
+}

package/node_modules/@weavecode/server/dist/repositories/hook-rules.js

@@ -0,0 +1,8 @@
+import{randomUUID as s}from"node:crypto";import{HookRuleSchema as o}from"@weavecode/core";export class HookRuleRepository{db;constructor(e){this.db=e}create(e){const t=new Date().toISOString(),i=o.parse({id:s(),name:e.name,enabled:e.enabled??!0,priority:e.priority??0,projectId:e.projectId,source:e.source,filter:e.filter??{},handler:e.handler,timeoutMs:e.timeoutMs??1e4,record:e.record??e.handler.type!=="log",origin:e.origin??"user",pluginId:e.pluginId??null});return this.insertRow(i,t,t),i}upsertPluginRule(e){const t=new Date().toISOString(),i=this.getById(e.id);if(!i)return this.insertRow(e,t,t),e;const r=o.parse({...e,enabled:i.enabled});return this.db.prepare(`UPDATE hook_rules SET name = ?, enabled = ?, priority = ?, project_id = ?,
+           source = ?, filter = ?, handler = ?, timeout_ms = ?, record = ?,
+           origin = ?, plugin_id = ?, updated_at = ?
+         WHERE id = ?`).run(r.name,r.enabled?1:0,r.priority,r.projectId,JSON.stringify(r.source),JSON.stringify(r.filter),JSON.stringify(r.handler),r.timeoutMs,r.record?1:0,r.origin,r.pluginId,t,r.id),r}removeByPlugin(e){const t=this.db.prepare("DELETE FROM hook_rules WHERE plugin_id = ?").run(e);return Number(t.changes)}listByPlugin(e){return this.db.prepare("SELECT * FROM hook_rules WHERE plugin_id = ? ORDER BY created_at ASC").all(e).map(d).filter(i=>i!==void 0)}getById(e){const t=this.db.prepare("SELECT * FROM hook_rules WHERE id = ?").get(e);return t?d(t):void 0}list(e){return(e===void 0?this.db.prepare("SELECT * FROM hook_rules ORDER BY priority DESC, created_at ASC").all():this.db.prepare("SELECT * FROM hook_rules WHERE project_id IS NULL OR project_id = ? ORDER BY priority DESC, created_at ASC").all(e)).map(d).filter(i=>i!==void 0)}update(e,t){const i=this.getById(e);if(!i)return;const r=o.parse({...i,...t,id:e,projectId:"projectId"in t?t.projectId:i.projectId});return this.db.prepare(`UPDATE hook_rules SET name = ?, enabled = ?, priority = ?, project_id = ?,
+           source = ?, filter = ?, handler = ?, timeout_ms = ?, record = ?, updated_at = ?
+         WHERE id = ?`).run(r.name,r.enabled?1:0,r.priority,r.projectId,JSON.stringify(r.source),JSON.stringify(r.filter),JSON.stringify(r.handler),r.timeoutMs,r.record?1:0,new Date().toISOString(),e),r}setEnabled(e,t){const i=this.db.prepare("UPDATE hook_rules SET enabled = ?, updated_at = ? WHERE id = ?").run(t?1:0,new Date().toISOString(),e);if(Number(i.changes)!==0)return this.getById(e)}remove(e){const t=this.db.prepare("DELETE FROM hook_rules WHERE id = ?").run(e);return Number(t.changes)>0}insertRow(e,t,i){this.db.prepare(`INSERT INTO hook_rules (id, name, enabled, priority, project_id, source, filter, handler,
+           timeout_ms, record, origin, plugin_id, created_at, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(e.id,e.name,e.enabled?1:0,e.priority,e.projectId,JSON.stringify(e.source),JSON.stringify(e.filter),JSON.stringify(e.handler),e.timeoutMs,e.record?1:0,e.origin,e.pluginId,t,i)}}function d(n){try{return o.parse({id:String(n.id),name:String(n.name),enabled:Number(n.enabled)===1,priority:Number(n.priority),projectId:n.project_id==null?null:Number(n.project_id),source:JSON.parse(String(n.source)),filter:JSON.parse(String(n.filter??"{}")),handler:JSON.parse(String(n.handler)),timeoutMs:Number(n.timeout_ms),record:Number(n.record)===1,origin:n.origin??"user",pluginId:n.plugin_id==null?null:String(n.plugin_id)})}catch{return}}

package/node_modules/@weavecode/server/dist/repositories/libraries.d.ts

@@ -0,0 +1,33 @@
+import type { DatabaseSync } from 'node:sqlite';
+export interface LibraryRow {
+    id: number;
+    path: string;
+    kind: 'skill' | 'mcp' | 'both';
+    addedAt: string;
+}
+export declare class LibraryRepository {
+    private readonly db;
+    /** 该库实例绑定的 dataDir（市场路由的 import/refresh 须与读侧同根）。 */
+    readonly dataDir: string;
+    constructor(db: DatabaseSync, 
+    /** 该库实例绑定的 dataDir（市场路由的 import/refresh 须与读侧同根）。 */
+    dataDir?: string);
+    /** Add a library path. Idempotent on `path` (INSERT OR IGNORE). */
+    add(input: {
+        path: string;
+        kind: 'skill' | 'mcp' | 'both';
+    }): LibraryRow;
+    getByPath(path: string): LibraryRow | undefined;
+    getById(id: number): LibraryRow | undefined;
+    list(): LibraryRow[];
+    /** 改写存储 path（迁入市场时把 legacy 外部源换成相对形）。 */
+    setPath(id: number, nextPath: string): void;
+    remove(id: number): void;
+    /** 绝对且在 dataDir 内 → 相对 posix 形；其余原样（legacy 外部绝对路径不动）。 */
+    private writeForm;
+    /**
+     * 读侧 resolve 单点（批 9，R11）：返回值一律是可直接使用的绝对路径；
+     * 存储形为 dataDir 内绝对路径的旧行在此惰性 UPDATE 为相对形（仅 dataDir 内）。
+     */
+    private resolveRow;
+}