@weavecode/weave 0.1.1 → 0.1.3

package/node_modules/@weavecode/server/dist/install/global-config.js

@@ -1,2 +1 @@
-import{readFile as x,writeFile as W,readdir as m,access as _,stat as j,realpath as $}from"node:fs/promises";import{homedir as f}from"node:os";import l from"node:path";import{AssetNotFoundError as g}from"./installer.js";import{FileTooLargeError as z,MAX_BYTES as J}from"./reader.js";import{assetSurfaceFor as h,assetSurfaces as O,pluginStateFor as S,pluginSurfaceFor as R}from"../surfaces.js";import{installForm as L,linkOrCopy as I,removeInstalled as U}from"../market/install-link.js";export class ClaudeJsonCorruptError extends Error{constructor(e){super(e),this.name="ClaudeJsonCorruptError"}}const B=".claude.json",K=".claude/plugins/installed_plugins.json";function P(){return l.join(f(),B)}function k(){return h("claude").globalSkillsRoots(f())[0]}function N(t=f()){return l.join(t,K)}function X(){return h("claude").userConfigFile(f())}function M(){return h("codex").globalSkillsRoots(f())[0]}function Y(){return h("codex").globalSkillsRoots(f())}function C(){const t=h("codex").pluginCacheDir?.(f());if(!t)throw new Error("codex has no plugin cache surface");return t}export function globalPersonalSkillRootsOwned(){return O().flatMap(t=>t.globalSkillsRoots(f()).map(e=>({harness:t.harness,root:e})))}export function globalPersonalSkillRoots(){return globalPersonalSkillRootsOwned().map(t=>t.root)}async function A(t){try{return await _(t),!0}catch{return!1}}async function y(t){try{return(await j(t)).isDirectory()}catch{return!1}}export async function readGlobalClaudeJson(){const t=P();if(!await A(t))return{};let e;try{e=await x(t,"utf-8")}catch{return{}}let n;try{n=JSON.parse(e)}catch(o){throw new ClaudeJsonCorruptError(`~/.claude.json is not valid JSON \u2014 refusing to write: ${o instanceof Error?o.message:String(o)}`)}if(!n||typeof n!="object"||Array.isArray(n))throw new ClaudeJsonCorruptError("~/.claude.json is not a JSON object \u2014 refusing to write");return n}export async function readGlobalMcpServers(){const e=(await readGlobalClaudeJson()).mcpServers;return!e||typeof e!="object"||Array.isArray(e)?{}:e}async function T(t){await W(P(),`${JSON.stringify(t,null,2)}
-`,"utf-8")}export async function writeGlobalMcpServer(t,e){const n=await readGlobalClaudeJson(),o=n.mcpServers??{};o[t]=e,n.mcpServers=o,await T(n)}export async function removeGlobalMcpServer(t){const e=await readGlobalClaudeJson(),n=e.mcpServers??{};t in n&&(delete n[t],e.mcpServers=n,await T(e))}export async function readGlobalSkills(){const t=k();try{const e=await m(t,{withFileTypes:!0}),n=[];for(const o of e)!o.isDirectory()&&!o.isSymbolicLink()||await y(l.join(t,o.name))&&n.push(o.name);return n.sort((o,r)=>o.localeCompare(r))}catch{return[]}}export async function installGlobalSkill(t,e,n="claude"){const o=h(n).globalSkillsRoots(f())[0],r=l.join(o,e);if(await A(r))throw new Error(`Global ${n} skill "${e}" already exists`);return await I(t,r),r}export async function uninstallGlobalSkill(t,e="claude"){const n=h(e).globalSkillsRoots(f())[0];await U(l.join(n,t))}async function F(t=f()){const e=N(t);if(!await A(e))return{};try{const n=JSON.parse(await x(e,"utf-8"));return n&&typeof n=="object"&&!Array.isArray(n)?n:{}}catch{return{}}}async function v(t){if(!await y(t))return[];let e;try{e=await m(t,{withFileTypes:!0})}catch{return[]}const n=[];for(const o of e){if(o.name.startsWith(".")||!o.isDirectory()&&!o.isSymbolicLink())continue;const r=l.join(t,o.name);if(!await y(r))continue;const i=await L(r);i!=="absent"&&n.push({name:o.name,dir:r,form:i})}return n.sort((o,r)=>o.name.localeCompare(r.name))}export async function installedPluginNamespaces(t=f()){const n=(await F(t)).plugins;if(!n||typeof n!="object"||Array.isArray(n))return[];const o=[];for(const[r,i]of Object.entries(n)){const{market:s}=R("claude").parsePluginKey(r);for(const a of Array.isArray(i)?i:[])a&&typeof a.installPath=="string"&&o.push({dir:a.installPath,namespace:s})}return o}async function q(){const e=(await F()).plugins;if(!e||typeof e!="object"||Array.isArray(e))return[];const n=[];for(const[o,r]of Object.entries(e)){const i=Array.isArray(r)?r:[];if(i.length===0)continue;const s=[...i].filter(d=>d&&typeof d.installPath=="string").pop();if(!s?.installPath)continue;const a=await v(l.join(s.installPath,"skills")),{name:c,market:p}=R("claude").parsePluginKey(o);n.push({source:"claude-plugin",label:c,namespace:p,skills:a,pluginKey:o})}return n.sort((o,r)=>o.label.localeCompare(r.label))}async function H(){const t=new Map;for(const n of Y())for(const o of await v(n))t.has(o.name)||t.set(o.name,o);return{source:"codex-personal",label:"Codex \xB7 \u4E2A\u4EBA",skills:[...t.values()].sort((n,o)=>n.name.localeCompare(o.name))}}async function Q(){const t=C();if(!await y(t))return[];const e=[];let n;try{n=await m(t,{withFileTypes:!0})}catch{return[]}for(const o of n){if(!o.isDirectory()&&!o.isSymbolicLink())continue;const r=l.join(t,o.name);let i;try{i=await m(r,{withFileTypes:!0})}catch{continue}for(const s of i){if(!s.isDirectory()&&!s.isSymbolicLink())continue;const a=l.join(r,s.name);let c;try{c=await m(a,{withFileTypes:!0})}catch{continue}const p=c.filter(w=>w.isDirectory()||w.isSymbolicLink());if(p.length===0)continue;const d=p.map(w=>w.name).sort().pop(),u=await v(l.join(a,d,"skills")),b=`${s.name}@${o.name}`;e.push({source:"codex-plugin",label:s.name,namespace:o.name,skills:u,pluginKey:b})}}return e.sort((o,r)=>o.label.localeCompare(r.label))}async function V(){const t=k(),e=await readGlobalSkills(),n=[];for(const o of e){const r=l.join(t,o),i=await L(r);i!=="absent"&&n.push({name:o,dir:r,form:i})}return{source:"claude-personal",label:"Claude Code \xB7 \u4E2A\u4EBA",skills:n}}export async function readGlobalSkillGroups(){const[t,e,n,o,r,i]=await Promise.all([V(),q(),H(),Q(),readClaudePluginEnabled(),readCodexPluginEnabled()]),s=(a,c)=>({...a,enabled:a.pluginKey?c[a.pluginKey]??!1:void 0});return[t,...e.map(a=>s(a,r)),n,...o.map(a=>s(a,i))]}export async function resolveGlobalSkillDir(t,e,n){if(t==="claude-personal"){const u=l.join(k(),e);return await y(u)?u:null}if(t==="codex-personal"){const u=l.join(M(),e);return await y(u)?u:null}if(t==="claude-plugin"){if(!n)return null;const b=(await F()).plugins;if(!b||typeof b!="object"||Array.isArray(b))return null;const w=b[n],E=[...Array.isArray(w)?w:[]].filter(G=>G&&typeof G.installPath=="string").pop();if(!E?.installPath)return null;const D=l.join(E.installPath,"skills",e);return await y(D)?D:null}if(!n)return null;const o=n.lastIndexOf("@");if(o<=0)return null;const r=n.slice(0,o),i=n.slice(o+1),s=l.join(C(),i,r);if(!await y(s))return null;let a;try{a=await m(s,{withFileTypes:!0})}catch{return null}const c=a.filter(u=>u.isDirectory()||u.isSymbolicLink());if(c.length===0)return null;const p=c.map(u=>u.name).sort().pop(),d=l.join(s,p,"skills",e);return await y(d)?d:null}function Z(t){const e=l.resolve(t),n=f();return O().find(r=>{const i=[...r.globalSkillsRoots(n)],s=r.pluginCacheDir?.(n);return s&&i.push(s),i.some(a=>e===l.resolve(a)||e.startsWith(l.resolve(a)+l.sep))})?.harness??"claude"}export async function listGlobalSkillFiles(t){const e=Z(t),n=[],o=async(r,i)=>{let s;try{s=await m(r,{withFileTypes:!0})}catch{return}for(const a of s){if(a.name.startsWith("."))continue;const c=l.join(r,a.name),p=i?`${i}/${a.name}`:a.name;if((a.isDirectory()||a.isSymbolicLink())&&await y(c))await o(c,p);else if(a.isFile()||a.isSymbolicLink())try{const d=await j(c);d.isFile()&&n.push({absPath:c,relPath:p,category:"skill",agent:e,mtimeMs:d.mtimeMs})}catch{}}};return await o(t,""),n.sort((r,i)=>r.relPath.localeCompare(i.relPath))}export async function readGlobalSkillFile(t,e){const n=l.normalize(e).replace(/\\/g,"/");if(l.isAbsolute(e))throw new g(`Absolute paths are not allowed: "${e}"`);if(n.split("/").some(p=>p===".."))throw new g(`Path traversal is not allowed: "${e}"`);const o=l.join(t,n);let r;try{r=await j(o)}catch{throw new g(`File not found: "${e}"`)}if(!r.isFile())throw new g(`Not a file: "${e}"`);if(r.size>J)throw new z(`File exceeds ${J} bytes: "${e}"`);let i=t,s=o;try{[i,s]=await Promise.all([$(t),$(o)])}catch{throw new g(`File not found: "${e}"`)}const a=i.endsWith(l.sep)?i:i+l.sep;if(s!==i&&!s.startsWith(a))throw new g(`Resolved path escapes the skill directory: "${e}"`);return{content:await x(o,"utf-8"),size:r.size}}export async function readClaudePluginEnabled(){return S("claude").readGlobalEnabled()}export async function writeClaudePluginEnabled(t,e){return S("claude").writeGlobalEnabled(t,e)}export async function readCodexPluginEnabled(){return S("codex").readGlobalEnabled()}export async function writeCodexPluginEnabled(t,e){return S("codex").writeGlobalEnabled(t,e)}export{k as globalSkillsPath,P as claudeJsonPath,N as claudePluginsJsonPath,X as claudeSettingsPath,M as codexSkillsPath,C as codexPluginsCachePath};
+import{readFile as E,readdir as w,access as J,stat as S,realpath as G}from"node:fs/promises";import{homedir as f}from"node:os";import s from"node:path";import{AssetNotFoundError as b}from"./installer.js";import{readClaudeJson as K}from"@weavecode/harness";import{FileTooLargeError as O,MAX_BYTES as v}from"./reader.js";import{assetSurfaceFor as m,assetSurfaces as $,pluginStateFor as k,pluginSurfaceFor as R}from"../surfaces.js";import{installForm as D,linkOrCopy as W,removeInstalled as B}from"../market/install-link.js";export{ClaudeJsonCorruptError}from"@weavecode/harness";const z=".claude.json",N=".claude/plugins/installed_plugins.json";function I(){return s.join(f(),z)}function x(){return m("claude").globalSkillsRoots(f())[0]}function L(t=f()){return s.join(t,N)}function _(){return m("claude").userConfigFile(f())}function T(){return m("codex").globalSkillsRoots(f())[0]}function X(){return m("codex").globalSkillsRoots(f())}function P(){const t=m("codex").pluginCacheDir?.(f());if(!t)throw new Error("codex has no plugin cache surface");return t}export function globalPersonalSkillRootsOwned(){return $().flatMap(t=>t.globalSkillsRoots(f()).map(e=>({harness:t.harness,root:e})))}export function globalPersonalSkillRoots(){return globalPersonalSkillRootsOwned().map(t=>t.root)}async function M(t){try{return await J(t),!0}catch{return!1}}async function y(t){try{return(await S(t)).isDirectory()}catch{return!1}}export function readGlobalClaudeJson(){return K(f())}export async function readGlobalMcpServers(){const t=(await readGlobalClaudeJson()).mcpServers;return!t||typeof t!="object"||Array.isArray(t)?{}:t}export async function writeGlobalMcpServer(t,e){await m("claude").mcpWrite("user","",f(),t,e)}export async function removeGlobalMcpServer(t){await m("claude").mcpRemove("user","",f(),t)}export async function readGlobalSkills(){const t=x();try{const e=await w(t,{withFileTypes:!0}),n=[];for(const a of e)!a.isDirectory()&&!a.isSymbolicLink()||await y(s.join(t,a.name))&&n.push(a.name);return n.sort((a,o)=>a.localeCompare(o))}catch{return[]}}export async function installGlobalSkill(t,e,n="claude"){const a=m(n).globalSkillsRoots(f())[0],o=s.join(a,e);if(await M(o))throw new Error(`Global ${n} skill "${e}" already exists`);return await W(t,o),o}export async function uninstallGlobalSkill(t,e="claude"){const n=m(e).globalSkillsRoots(f())[0];await B(s.join(n,t))}async function j(t=f()){const e=L(t);if(!await M(e))return{};try{const n=JSON.parse(await E(e,"utf-8"));return n&&typeof n=="object"&&!Array.isArray(n)?n:{}}catch{return{}}}async function A(t){if(!await y(t))return[];let e;try{e=await w(t,{withFileTypes:!0})}catch{return[]}const n=[];for(const a of e){if(a.name.startsWith(".")||!a.isDirectory()&&!a.isSymbolicLink())continue;const o=s.join(t,a.name);if(!await y(o))continue;const r=await D(o);r!=="absent"&&n.push({name:a.name,dir:o,form:r})}return n.sort((a,o)=>a.name.localeCompare(o.name))}export async function installedPluginNamespaces(t=f()){const e=(await j(t)).plugins;if(!e||typeof e!="object"||Array.isArray(e))return[];const n=[];for(const[a,o]of Object.entries(e)){const{market:r}=R("claude").parsePluginKey(a);for(const i of Array.isArray(o)?o:[])i&&typeof i.installPath=="string"&&n.push({dir:i.installPath,namespace:r})}return n}async function Y(){const t=(await j()).plugins;if(!t||typeof t!="object"||Array.isArray(t))return[];const e=[];for(const[n,a]of Object.entries(t)){const o=Array.isArray(a)?a:[];if(o.length===0)continue;const r=[...o].filter(p=>p&&typeof p.installPath=="string").pop();if(!r?.installPath)continue;const i=await A(s.join(r.installPath,"skills")),{name:l,market:u}=R("claude").parsePluginKey(n);e.push({source:"claude-plugin",label:l,namespace:u,skills:i,pluginKey:n})}return e.sort((n,a)=>n.label.localeCompare(a.label))}async function q(){const t=new Map;for(const e of X())for(const n of await A(e))t.has(n.name)||t.set(n.name,n);return{source:"codex-personal",label:"Codex \xB7 \u4E2A\u4EBA",skills:[...t.values()].sort((e,n)=>e.name.localeCompare(n.name))}}async function H(){const t=P();if(!await y(t))return[];const e=[];let n;try{n=await w(t,{withFileTypes:!0})}catch{return[]}for(const a of n){if(!a.isDirectory()&&!a.isSymbolicLink())continue;const o=s.join(t,a.name);let r;try{r=await w(o,{withFileTypes:!0})}catch{continue}for(const i of r){if(!i.isDirectory()&&!i.isSymbolicLink())continue;const l=s.join(o,i.name);let u;try{u=await w(l,{withFileTypes:!0})}catch{continue}const p=u.filter(h=>h.isDirectory()||h.isSymbolicLink());if(p.length===0)continue;const d=p.map(h=>h.name).sort().pop(),c=await A(s.join(l,d,"skills")),g=`${i.name}@${a.name}`;e.push({source:"codex-plugin",label:i.name,namespace:a.name,skills:c,pluginKey:g})}}return e.sort((a,o)=>a.label.localeCompare(o.label))}async function Q(){const t=x(),e=await readGlobalSkills(),n=[];for(const a of e){const o=s.join(t,a),r=await D(o);r!=="absent"&&n.push({name:a,dir:o,form:r})}return{source:"claude-personal",label:"Claude Code \xB7 \u4E2A\u4EBA",skills:n}}export async function readGlobalSkillGroups(){const[t,e,n,a,o,r]=await Promise.all([Q(),Y(),q(),H(),readClaudePluginEnabled(),readCodexPluginEnabled()]),i=(l,u)=>({...l,enabled:l.pluginKey?u[l.pluginKey]??!1:void 0});return[t,...e.map(l=>i(l,o)),n,...a.map(l=>i(l,r))]}export async function resolveGlobalSkillDir(t,e,n){if(t==="claude-personal"){const c=s.join(x(),e);return await y(c)?c:null}if(t==="codex-personal"){const c=s.join(T(),e);return await y(c)?c:null}if(t==="claude-plugin"){if(!n)return null;const c=(await j()).plugins;if(!c||typeof c!="object"||Array.isArray(c))return null;const g=c[n],h=[...Array.isArray(g)?g:[]].filter(C=>C&&typeof C.installPath=="string").pop();if(!h?.installPath)return null;const F=s.join(h.installPath,"skills",e);return await y(F)?F:null}if(!n)return null;const a=n.lastIndexOf("@");if(a<=0)return null;const o=n.slice(0,a),r=n.slice(a+1),i=s.join(P(),r,o);if(!await y(i))return null;let l;try{l=await w(i,{withFileTypes:!0})}catch{return null}const u=l.filter(c=>c.isDirectory()||c.isSymbolicLink());if(u.length===0)return null;const p=u.map(c=>c.name).sort().pop(),d=s.join(i,p,"skills",e);return await y(d)?d:null}function U(t){const e=s.resolve(t),n=f();return $().find(a=>{const o=[...a.globalSkillsRoots(n)],r=a.pluginCacheDir?.(n);return r&&o.push(r),o.some(i=>e===s.resolve(i)||e.startsWith(s.resolve(i)+s.sep))})?.harness??"claude"}export async function listGlobalSkillFiles(t){const e=U(t),n=[],a=async(o,r)=>{let i;try{i=await w(o,{withFileTypes:!0})}catch{return}for(const l of i){if(l.name.startsWith("."))continue;const u=s.join(o,l.name),p=r?`${r}/${l.name}`:l.name;if((l.isDirectory()||l.isSymbolicLink())&&await y(u))await a(u,p);else if(l.isFile()||l.isSymbolicLink())try{const d=await S(u);d.isFile()&&n.push({absPath:u,relPath:p,category:"skill",agent:e,mtimeMs:d.mtimeMs})}catch{}}};return await a(t,""),n.sort((o,r)=>o.relPath.localeCompare(r.relPath))}export async function readGlobalSkillFile(t,e){const n=s.normalize(e).replace(/\\/g,"/");if(s.isAbsolute(e))throw new b(`Absolute paths are not allowed: "${e}"`);if(n.split("/").some(u=>u===".."))throw new b(`Path traversal is not allowed: "${e}"`);const a=s.join(t,n);let o;try{o=await S(a)}catch{throw new b(`File not found: "${e}"`)}if(!o.isFile())throw new b(`Not a file: "${e}"`);if(o.size>v)throw new O(`File exceeds ${v} bytes: "${e}"`);let r=t,i=a;try{[r,i]=await Promise.all([G(t),G(a)])}catch{throw new b(`File not found: "${e}"`)}const l=r.endsWith(s.sep)?r:r+s.sep;if(i!==r&&!i.startsWith(l))throw new b(`Resolved path escapes the skill directory: "${e}"`);return{content:await E(a,"utf-8"),size:o.size}}export async function readClaudePluginEnabled(){return k("claude").readGlobalEnabled()}export async function writeClaudePluginEnabled(t,e){return k("claude").writeGlobalEnabled(t,e)}export async function readCodexPluginEnabled(){return k("codex").readGlobalEnabled()}export async function writeCodexPluginEnabled(t,e){return k("codex").writeGlobalEnabled(t,e)}export{x as globalSkillsPath,I as claudeJsonPath,L as claudePluginsJsonPath,_ as claudeSettingsPath,T as codexSkillsPath,P as codexPluginsCachePath};

package/node_modules/@weavecode/server/dist/install/global-file-assets.js

@@ -1 +1 @@
-import{lstat as S,readdir as _,stat as P}from"node:fs/promises";import{homedir as g}from"node:os";import c from"node:path";import{classifyAgent as w,classifyAsset as h}from"../watch/classifier.js";import{PluginModsSniffer as I}from"../watch/plugin-mods.js";import{installedPluginNamespaces as D}from"./global-config.js";const L=["commands","agents","workflows","rules","output-styles","hooks","themes","routines","plugins"],A=["CLAUDE.md","settings.json","settings.local.json"],k=["prompts"],R=["config.toml","AGENTS.md"],T=new Set(["skills","node_modules",".git"]),U=new Set(["marketplaces","data",".in_use"]),y=".claude/plugins",F=`${y}/`,N=6,O=10,$=5e3,j=[{prefix:".claude",dirs:L,files:A},{prefix:".codex",dirs:k,files:R}];async function d(s,n,o){try{const e=await S(s),a=e.isSymbolicLink(),t=a?await P(s):e;if(!t.isFile())return null;let i=h(n);return i==="plugin"&&(i=o.refine(i,n,s)),{absPath:s,relPath:n,category:i,agent:w(n),mtimeMs:t.mtimeMs,...a?{isSymlink:!0}:{}}}catch{return null}}async function f(s,n,o,e,a){if(o>e)return[];let t;try{t=await _(s,{withFileTypes:!0})}catch{return[]}return(await Promise.all(t.map(async l=>{const u=c.join(s,l.name),r=`${n}/${l.name}`;if(l.isDirectory())return E(r,l.name)?[]:f(u,r,o+1,e,a);if(l.isSymbolicLink())try{if((await P(u)).isDirectory())return E(r,l.name)?[]:f(u,r,o+1,e,a)}catch{return[]}const m=await d(u,r,a);return m?[m]:[]}))).flat()}function E(s,n){return T.has(n)?!0:s.startsWith(F)&&U.has(n)}export async function listGlobalFileAssets(s=g()){const n=new I({revalidate:!1}),e=(await Promise.all(j.map(async t=>{const i=c.join(s,...t.prefix.split("/")),[l,u]=await Promise.all([Promise.all(t.files.map(r=>d(c.join(i,r),`${t.prefix}/${r}`,n))),Promise.all(t.dirs.map(r=>{const m=`${t.prefix}/${r}`,p=m===y?O:N;return f(c.join(i,r),m,1,p,n)}))]);return[...l.filter(r=>r!==null),...u.flat()]}))).flat(),a=await D(s);return e.sort((t,i)=>t.relPath.localeCompare(i.relPath)),e.slice(0,$).map(t=>{const i=x(t.absPath,a);return i?{...t,namespace:i}:t})}function x(s,n){let o;for(const e of n){const a=c.relative(c.resolve(e.dir),c.resolve(s));a===""||a.startsWith("..")||c.isAbsolute(a)||(!o||e.dir.length>o.dir.length)&&(o=e)}return o?.namespace}
+import{lstat as g,readdir as w,stat as f}from"node:fs/promises";import{homedir as P}from"node:os";import l from"node:path";import{classifyAgent as k,classifyAsset as x}from"../watch/classifier.js";import{PluginModsSniffer as S}from"../watch/plugin-mods.js";import{installedPluginNamespaces as $}from"./global-config.js";const j=["commands","agents","workflows","rules","output-styles","hooks","themes","routines","plugins"],A=["CLAUDE.md","settings.json","settings.local.json"],b=["prompts"],v=["config.toml","AGENTS.md"],D=new Set(["skills","node_modules",".git"]),F=new Set(["marketplaces","data",".in_use"]),p=".claude/plugins",L=`${p}/`,E=6,M=10,N=5e3,T=[{prefix:".claude",dirs:j,files:A},{prefix:".codex",dirs:b,files:v}];async function d(e,i,s){try{const o=await g(e),t=o.isSymbolicLink(),a=t?await f(e):o;if(!a.isFile())return null;let r=x(i);return r==="plugin"&&(r=s.refine(r,i,e)),{absPath:e,relPath:i,category:r,agent:k(i),mtimeMs:a.mtimeMs,...t?{isSymlink:!0}:{}}}catch{return null}}async function u(e,i,s,o,t){if(s>o)return[];let a;try{a=await w(e,{withFileTypes:!0})}catch{return[]}return(await Promise.all(a.map(async r=>{const m=l.join(e,r.name),n=`${i}/${r.name}`;if(r.isDirectory())return h(n,r.name)?[]:u(m,n,s+1,o,t);if(r.isSymbolicLink())try{if((await f(m)).isDirectory())return h(n,r.name)?[]:u(m,n,s+1,o,t)}catch{return[]}const c=await d(m,n,t);return c?[c]:[]}))).flat()}function h(e,i){return D.has(i)?!0:e.startsWith(L)&&F.has(i)}export async function listGlobalFileAssets(e=P()){const i=new S({revalidate:!1}),s=(await Promise.all(T.map(async t=>{const a=l.join(e,...t.prefix.split("/")),[r,m]=await Promise.all([Promise.all(t.files.map(n=>d(l.join(a,n),`${t.prefix}/${n}`,i))),Promise.all(t.dirs.map(n=>{const c=`${t.prefix}/${n}`,y=c===p?M:E;return u(l.join(a,n),c,1,y,i)}))]);return[...r.filter(n=>n!==null),...m.flat()]}))).flat(),o=await $(e);return s.sort((t,a)=>t.relPath.localeCompare(a.relPath)),s.slice(0,N).map(t=>{const a=_(t.absPath,o);return a?{...t,namespace:a}:t})}function _(e,i){let s;for(const o of i){const t=l.relative(l.resolve(o.dir),l.resolve(e));t===""||t.startsWith("..")||l.isAbsolute(t)||(!s||o.dir.length>s.dir.length)&&(s=o)}return s?.namespace}

package/node_modules/@weavecode/server/dist/install/init-files.js

@@ -1,2 +1,2 @@
-import{mkdir as y,readFile as m,writeFile as g}from"node:fs/promises";import l from"node:path";import{DEFAULT_HOOKS as f,DEFAULT_MCP as w,HARNESS_KEYS as C,detectPlatform as E,isHarness as x,resolveComponents as O}from"@weavecode/core";import{WEAVE_CONTENT_MARKER as h,generateInitFiles as S}from"@weavecode/harness";import{gitClassify as k}from"./git-classify.js";import{generateStatuslineScript as F}from"../statusline/generator.js";import{readStatuslineConfig as v,statuslineScriptRelPath as A}from"../statusline/manager.js";import{WEAVE_VERSION as P}from"../version.js";function b(t){const e={};for(const o of t.split(`
-`)){const n=o.indexOf(":");if(n<=0)continue;const s=o.slice(0,n).trim(),i=o.slice(n+1).trim();if(s)try{e[s]=JSON.parse(i)}catch{e[s]=i}}return e}function I(t){if(typeof t!="object"||t===null)return f;const e=t,o=Object.fromEntries(Object.keys(f).filter(n=>typeof f[n]=="boolean"&&!(n in e)).map(n=>[n,!1]));return{...f,...o,...e}}export async function readInitRuntime(t){let e;try{e=await m(l.join(t,".weave","config.yaml"),"utf-8")}catch{e=""}const o=b(e),n=o.preset,s=o.components,i=o.hooks,a=o.mcp,c=o.harnesses;return{initVersion:typeof o.initVersion=="string"?o.initVersion:null,preset:n==="minimal"||n==="full"||n==="default"?n:"default",harnesses:Array.isArray(c)?c.filter(x):[],components:O(n==="minimal"||n==="full"||n==="default"?n:"default",typeof s=="object"&&s!==null?s:void 0),hooks:I(i),mcp:{...w,...typeof a=="object"&&a!==null?a:{}}}}function R(){return E()}function V(t,e){return{projectPath:t,version:P,platform:R(),components:e.components,hooks:e.hooks,mcp:e.mcp}}async function _(t,e){if(!e.components.helpers)return[];const o=await v(t);return[{relPath:A(),weaveMarker:h,content:F(o)}]}async function N(t){try{return await m(t,"utf-8")}catch{return null}}function H(t,e){return t.merge?e===null?t.content:t.merge(e,t.content):e!==null&&!e.includes(t.weaveMarker??h)?null:t.content}async function M(t){try{return await m(l.join(t,".weave","config.yaml"),"utf-8"),!0}catch{return!1}}export async function detectInitFileUpdates(t){if(!await M(t))return[];const e=await readInitRuntime(t),o=V(t,e),n=e.harnesses.length>0?e.harnesses:[C[0]],s=[...await _(t,e)];for(const r of n)s.push(...await S(r,o));const i=[];for(const r of s){const p=l.join(t,...r.relPath.split("/")),d=await N(p),u=H(r,d);i.push({relPath:r.relPath,targetPath:p,outdated:u!==null&&u!==d,syncClass:null,expectedContent:u})}const a=i.filter(r=>r.outdated),c=await k(t,a.map(r=>r.relPath));for(const r of a)r.syncClass=c.classOf(r.relPath);return i}export async function applyInitFile(t){return t.syncClass!=="auto"||!t.outdated||t.expectedContent===null?!1:(await y(l.dirname(t.targetPath),{recursive:!0}),await g(t.targetPath,t.expectedContent,"utf-8"),!0)}export function needsInit(t){return t.some(e=>e.syncClass==="manual"&&e.outdated)}
+import{mkdir as y,readFile as p,writeFile as w}from"node:fs/promises";import l from"node:path";import{DEFAULT_HOOKS as u,DEFAULT_MCP as g,HARNESS_KEYS as P,detectPlatform as C,isHarness as E,resolveComponents as S}from"@weavecode/core";import{WEAVE_CONTENT_MARKER as h,generateInitFiles as O}from"@weavecode/harness";import{gitClassify as j}from"./git-classify.js";import{generateStatuslineScript as k}from"../statusline/generator.js";import{readStatuslineConfig as v,statuslineScriptRelPath as x}from"../statusline/manager.js";import{WEAVE_VERSION as A}from"../version.js";function F(t){const e={};for(const r of t.split(`
+`)){const n=r.indexOf(":");if(n<=0)continue;const a=r.slice(0,n).trim(),s=r.slice(n+1).trim();if(a)try{e[a]=JSON.parse(s)}catch{e[a]=s}}return e}function b(t){if(typeof t!="object"||t===null)return u;const e=t,r=Object.fromEntries(Object.keys(u).filter(n=>typeof u[n]=="boolean"&&!(n in e)).map(n=>[n,!1]));return{...u,...r,...e}}export async function readInitRuntime(t){let e;try{e=await p(l.join(t,".weave","config.yaml"),"utf-8")}catch{e=""}const r=F(e),n=r.preset,a=r.components,s=r.hooks,i=r.mcp,c=r.harnesses;return{initVersion:typeof r.initVersion=="string"?r.initVersion:null,preset:n==="minimal"||n==="full"||n==="default"?n:"default",harnesses:Array.isArray(c)?c.filter(E):[],components:S(n==="minimal"||n==="full"||n==="default"?n:"default",typeof a=="object"&&a!==null?a:void 0),hooks:b(s),mcp:{...g,...typeof i=="object"&&i!==null?i:{}}}}function I(){return C()}function R(t,e){return{projectPath:t,version:A,platform:I(),components:e.components,hooks:e.hooks,mcp:e.mcp}}async function V(t,e){if(!e.components.helpers)return[];const r=await v(t);return[{relPath:x(),weaveMarker:h,content:k(r)}]}async function _(t){try{return await p(t,"utf-8")}catch{return null}}function N(t,e){return t.merge?e===null?t.content:t.merge(e,t.content):e!==null&&!e.includes(t.weaveMarker??h)?null:t.content}async function M(t){try{return await p(l.join(t,".weave","config.yaml"),"utf-8"),!0}catch{return!1}}export async function detectInitFileUpdates(t){if(!await M(t))return[];const e=await readInitRuntime(t),r=R(t,e),n=e.harnesses.length>0?e.harnesses:[P[0]],a=[...await V(t,e)];for(const o of n)a.push(...await O(o,r));const s=[];for(const o of a){const m=l.join(t,...o.relPath.split("/")),d=await _(m),f=N(o,d);s.push({relPath:o.relPath,targetPath:m,outdated:f!==null&&f!==d,syncClass:null,expectedContent:f})}const i=s.filter(o=>o.outdated),c=await j(t,i.map(o=>o.relPath));for(const o of i)o.syncClass=c.classOf(o.relPath);return s}export async function applyInitFile(t){return t.syncClass!=="auto"||!t.outdated||t.expectedContent===null?!1:(await y(l.dirname(t.targetPath),{recursive:!0}),await w(t.targetPath,t.expectedContent,"utf-8"),!0)}export function needsInit(t){return t.some(e=>e.syncClass==="manual"&&e.outdated)}

package/node_modules/@weavecode/server/dist/install/install-ledger.js

@@ -1,2 +1,2 @@
-import{mkdir as c,readFile as l,writeFile as y}from"node:fs/promises";import r from"node:path";const i=r.join(".weave","installed.json"),s=t=>[t.category,t.name,t.agent,t.assetCategory??""].join("\0");function g(t){if(!t||typeof t!="object")return!1;const e=t;return(e.category==="skill"||e.category==="mcp"||e.category==="file")&&typeof e.name=="string"&&e.name!==""&&typeof e.agent=="string"}export async function readInstalledLedger(t){try{const e=JSON.parse(await l(r.join(t,i),"utf-8"));return Array.isArray(e.assets)?e.assets.filter(g):[]}catch{return[]}}export async function recordInstalled(t,e){const n=await readInstalledLedger(t);n.some(a=>s(a)===s(e))||await o(t,[...n,e])}export async function forgetInstalled(t,e){const n=await readInstalledLedger(t),a=n.filter(f=>s(f)!==s(e));a.length!==n.length&&await o(t,a)}async function o(t,e){const n=r.join(t,i);await c(r.dirname(n),{recursive:!0}),await y(n,`${JSON.stringify({version:1,assets:e},null,2)}
+import{mkdir as l,readFile as f,writeFile as y}from"node:fs/promises";import r from"node:path";const i=r.join(".weave","installed.json"),s=e=>[e.category,e.name,e.agent,e.assetCategory??""].join("\0");function g(e){if(!e||typeof e!="object")return!1;const t=e;return(t.category==="skill"||t.category==="mcp"||t.category==="file")&&typeof t.name=="string"&&t.name!==""&&typeof t.agent=="string"}export async function readInstalledLedger(e){try{const t=JSON.parse(await f(r.join(e,i),"utf-8"));return Array.isArray(t.assets)?t.assets.filter(g):[]}catch{return[]}}export async function recordInstalled(e,t){const n=await readInstalledLedger(e);n.some(a=>s(a)===s(t))||await o(e,[...n,t])}export async function forgetInstalled(e,t){const n=await readInstalledLedger(e),a=n.filter(c=>s(c)!==s(t));a.length!==n.length&&await o(e,a)}async function o(e,t){const n=r.join(e,i);await l(r.dirname(n),{recursive:!0}),await y(n,`${JSON.stringify({version:1,assets:t},null,2)}
 `,"utf-8")}

package/node_modules/@weavecode/server/dist/install/installer.d.ts

@@ -1,4 +1,5 @@
 import type { Harness } from '@weavecode/core';
+import type { McpServerConfig } from '@weavecode/harness';
 import { type FileAssetCategory } from './file-assets.js';
 /**
  * Asset install/uninstall — pure filesystem operations, no sqlite writes.
@@ -14,16 +15,15 @@ export declare class InstallConflictError extends Error {
 export declare class AssetNotFoundError extends Error {
     constructor(message: string);
 }
-export interface McpServerConfig {
-    command: string;
-    args?: string[];
-    env?: Record<string, string>;
-}
+/** MCP 配置的通用形（定义随 `AssetSurface` 的方法签名住在 harness 包）。 */
+export type { McpServerConfig };
 /** Which coding agent an install targets — Claude Code or Codex surfaces. */
 export type InstallAgent = Harness;
-/** Copy an entire skill directory into the agent's `<skills>/<name>/`. */
+/** Copy an entire skill directory into the agent's install root `<skills>/<name>/`.
+ *  共用根里已有同名 skill 也算冲突——再铺一份只会被宿主遮住。 */
 export declare function installSkill(projectPath: string, sourceDir: string, name: string, agent?: InstallAgent): Promise<string>;
-/** Remove the agent's skill directory `<skills>/<name>/`. */
+/** Remove the agent's skill directory `<skills>/<name>/` — 按根序找第一个存在的
+ *  （共用根里的副本由别的工具铺的，也一并管得动）。 */
 export declare function uninstallSkill(projectPath: string, name: string, agent?: InstallAgent): Promise<void>;
 /**
  * Copy a single template file to the agent/scope-resolved target directory

package/node_modules/@weavecode/server/dist/install/installer.js

@@ -1,3 +1 @@
-import{cp as p,rm as S,readFile as E,writeFile as x,access as g,mkdir as C}from"node:fs/promises";import{homedir as y}from"node:os";import n from"node:path";import{FILE_ASSET_SPECS as $,fileAssetTargetDir as v}from"./file-assets.js";import{assetSurfaceFor as F}from"../surfaces.js";import{forgetInstalled as f,recordInstalled as d}from"./install-ledger.js";export class InstallConflictError extends Error{constructor(t){super(t),this.name="InstallConflictError"}}export class AssetNotFoundError extends Error{constructor(t){super(t),this.name="AssetNotFoundError"}}const w=".mcp.json";function c(r){if(!r||r.includes("/")||r.includes("\\")||r.includes("..")||r.includes(n.sep))throw new Error(`Invalid asset name: "${r}"`)}async function l(r){try{return await g(r),!0}catch{return!1}}function j(r){return F(r).projectSkillsDir()}export async function installSkill(r,t,i,s="claude"){c(i);const e=n.join(r,j(s),i);if(await l(e))throw new InstallConflictError(`Skill "${i}" is already installed${s==="codex"?" (Codex)":""}`);return await p(t,e,{recursive:!0}),await d(r,{category:"skill",name:i,agent:s}),e}export async function uninstallSkill(r,t,i="claude"){c(t);const s=n.join(r,j(i),t);if(!await l(s))throw new AssetNotFoundError(`Skill "${t}" is not installed${i==="codex"?" (Codex)":""}`);await S(s,{recursive:!0,force:!0}),await f(r,{category:"skill",name:t,agent:i})}export async function installFileAsset(r,t,i,s,e="claude",o="project"){c(i);const a=v(t,e,o,r,y()),u=n.join(a,`${i}${$[t].ext}`);if(await l(u))throw new InstallConflictError(`${t} "${i}" is already installed`);return await C(a,{recursive:!0}),await p(s,u),o==="project"&&await d(r,{category:"file",name:i,agent:e,assetCategory:t}),u}export async function uninstallFileAsset(r,t,i,s="claude",e="project"){c(i);const o=v(t,s,e,r,y()),a=n.join(o,`${i}${$[t].ext}`);if(!await l(a))throw new AssetNotFoundError(`${t} "${i}" is not installed`);await S(a,{force:!0}),e==="project"&&await f(r,{category:"file",name:i,agent:s,assetCategory:t})}export async function installMcp(r,t,i){c(t);const s=n.join(r,w),e=await readMcpJson(s),o=e.mcpServers??{};if(t in o)throw new InstallConflictError(`MCP server "${t}" is already configured`);o[t]=i,e.mcpServers=o,await x(s,`${JSON.stringify(e,null,2)}
-`,"utf-8"),await d(r,{category:"mcp",name:t,agent:"claude"})}export async function uninstallMcp(r,t){c(t);const i=n.join(r,w),s=await readMcpJson(i),e=s.mcpServers??{};if(!(t in e))throw new AssetNotFoundError(`MCP server "${t}" is not configured`);delete e[t],s.mcpServers=e,await x(i,`${JSON.stringify(s,null,2)}
-`,"utf-8"),await f(r,{category:"mcp",name:t,agent:"claude"})}export async function readMcpJson(r){try{const t=await E(r,"utf-8"),i=JSON.parse(t);return i&&typeof i=="object"?i:{}}catch{return{}}}export async function readMcpServers(r){return(await readMcpJson(n.join(r,w))).mcpServers??{}}
+import{cp as w,rm as j,readFile as S,access as h,mkdir as E}from"node:fs/promises";import{homedir as c}from"node:os";import i from"node:path";import{FILE_ASSET_SPECS as m,fileAssetTargetDir as y}from"./file-assets.js";import{assetSurfaceFor as l}from"../surfaces.js";import{forgetInstalled as d,recordInstalled as p}from"./install-ledger.js";import{installForm as g,removeInstalled as k}from"../market/install-link.js";export class InstallConflictError extends Error{constructor(a){super(a),this.name="InstallConflictError"}}export class AssetNotFoundError extends Error{constructor(a){super(a),this.name="AssetNotFoundError"}}function u(e){if(!e||e.includes("/")||e.includes("\\")||e.includes("..")||e.includes(i.sep))throw new Error(`Invalid asset name: "${e}"`)}async function x(e){try{return await h(e),!0}catch{return!1}}function $(e){return l(e).projectSkillsRoots()}export async function installSkill(e,a,t,n="claude"){u(t);const r=$(n);for(const o of r)if(await g(i.join(e,o,t))!=="absent")throw new InstallConflictError(`Skill "${t}" is already installed${n==="codex"?" (Codex)":""}`);const s=i.join(e,r[0],t);return await w(a,s,{recursive:!0}),await p(e,{category:"skill",name:t,agent:n}),s}export async function uninstallSkill(e,a,t="claude"){u(a);let n;for(const r of $(t)){const s=i.join(e,r,a);if(await g(s)!=="absent"){n=s;break}}if(!n)throw new AssetNotFoundError(`Skill "${a}" is not installed${t==="codex"?" (Codex)":""}`);await k(n),await d(e,{category:"skill",name:a,agent:t})}export async function installFileAsset(e,a,t,n,r="claude",s="project"){u(t);const o=y(a,r,s,e,c()),f=i.join(o,`${t}${m[a].ext}`);if(await x(f))throw new InstallConflictError(`${a} "${t}" is already installed`);return await E(o,{recursive:!0}),await w(n,f),s==="project"&&await p(e,{category:"file",name:t,agent:r,assetCategory:a}),f}export async function uninstallFileAsset(e,a,t,n="claude",r="project"){u(t);const s=y(a,n,r,e,c()),o=i.join(s,`${t}${m[a].ext}`);if(!await x(o))throw new AssetNotFoundError(`${a} "${t}" is not installed`);await j(o,{force:!0}),r==="project"&&await d(e,{category:"file",name:t,agent:n,assetCategory:a})}export async function installMcp(e,a,t){if(a in await readMcpServers(e))throw new InstallConflictError(`MCP server "${a}" is already configured`);await l("claude").mcpWrite("project",e,c(),a,t),await p(e,{category:"mcp",name:a,agent:"claude"})}export async function uninstallMcp(e,a){if(!await l("claude").mcpRemove("project",e,c(),a))throw new AssetNotFoundError(`MCP server "${a}" is not configured`);await d(e,{category:"mcp",name:a,agent:"claude"})}export async function readMcpJson(e){try{const a=await S(e,"utf-8"),t=JSON.parse(a);return t&&typeof t=="object"?t:{}}catch{return{}}}export async function readMcpServers(e){return l("claude").mcpRead("project",e,c())}

package/node_modules/@weavecode/server/dist/install/library-index.js

@@ -1 +1 @@
-import{getLibraryScan as u}from"./scan-cache.js";export async function buildLibraryIndex(e){const a=new Map,r=new Map,s=new Map;for(const t of e){const m=t.kind==="skill"||t.kind==="both",p=t.kind==="mcp"||t.kind==="both";let o;try{o=await u(t.path)}catch{continue}if(m){for(const n of o.skills)a.has(n.name)||a.set(n.name,{name:n.name,libraryId:t.id,libraryPath:t.path,dirPath:n.dirPath});for(const n of Object.values(o.files))for(const i of n){const c=`${i.category}/${i.name}`;s.has(c)||s.set(c,{name:i.name,category:i.category,libraryId:t.id,libraryPath:t.path,filePath:i.filePath})}}if(p){for(const n of o.mcp)if(!r.has(n.name)){const{name:i,command:c,args:f,env:l,sourcePath:d}=n,h={command:c,...f&&{args:f},...l&&{env:l}};r.set(n.name,{name:i,libraryId:t.id,libraryPath:t.path,config:h,sourcePath:d})}}}return{skills:a,mcp:r,files:s}}export function findSkillSource(e,a){return e.skills.get(a)}export function findMcpSource(e,a){return e.mcp.get(a)}export function findFileAssetSource(e,a,r){return e.files.get(`${a}/${r}`)}
+import{getLibraryScan as u}from"./scan-cache.js";export async function buildLibraryIndex(e){const a=new Map,i=new Map,s=new Map;for(const n of e){const m=n.kind==="skill"||n.kind==="both",d=n.kind==="mcp"||n.kind==="both";let o;try{o=await u(n.path)}catch{continue}if(m){for(const t of o.skills)a.has(t.name)||a.set(t.name,{name:t.name,libraryId:n.id,libraryPath:n.path,dirPath:t.dirPath});for(const t of Object.values(o.files))for(const r of t){const c=`${r.category}/${r.name}`;s.has(c)||s.set(c,{name:r.name,category:r.category,libraryId:n.id,libraryPath:n.path,filePath:r.filePath})}}if(d){for(const t of o.mcp)if(!i.has(t.name)){const{name:r,command:c,args:f,env:l,sourcePath:h}=t,p={command:c,...f&&{args:f},...l&&{env:l}};i.set(t.name,{name:r,libraryId:n.id,libraryPath:n.path,config:p,sourcePath:h})}}}return{skills:a,mcp:i,files:s}}export function findSkillSource(e,a){return e.skills.get(a)}export function findMcpSource(e,a){return e.mcp.get(a)}export function findFileAssetSource(e,a,i){return e.files.get(`${a}/${i}`)}

package/node_modules/@weavecode/server/dist/install/mcp-rows.d.ts

@@ -1,11 +1,11 @@
 import type { ToolStateRow } from '@weavecode/core';
-import { type McpServerConfig } from './installer.js';
+import type { McpServerConfig } from './installer.js';
 export type McpToolRow = ToolStateRow<McpServerConfig>;
 /**
- * MCP 工具行装配（工具对象模型首个产消方）：三处表示法（项目 `.mcp.json` /
- * `~/.claude.json` / `~/.codex/config.toml`）读出的服务器映射展平成
- * harness × scope 状态行。范围来自 `AssetSurface.mcpScopes`；启停覆写与
- * 生效态由服务端解析（词表桥在 settings-mcp，文件表示法不出 server）。
+ * MCP 工具行装配（工具对象模型首个产消方）：每个 surface 按自己的 `mcpScopes()`
+ * 读出服务器映射、展平成 harness × scope 状态行——表示法（项目 `.mcp.json` /
+ * `~/.claude.json` / `~/.codex/config.toml`）只活在各自的 `AssetSurface.mcpRead`
+ * 里，本函数不认识任何一种。启停覆写与生效态由服务端解析（词表桥在 settings-mcp）。
  * 行行携带 installScopes——web 的视图选择与安装控制不依赖能力表二次拉取。
  */
 export declare function readMcpRows(projectPath: string): Promise<McpToolRow[]>;

package/node_modules/@weavecode/server/dist/install/mcp-rows.js

@@ -1 +1 @@
-import{readMcpServers as d}from"./installer.js";import{readGlobalMcpServers as v}from"./global-config.js";import{readCodexMcpServers as M}from"./codex-toml.js";import{readMcpEnableMap as S,mcpOverrideOf as h,resolveMcpEffective as w}from"./settings-mcp.js";import{assetSurfaces as x}from"../surfaces.js";export async function readMcpRows(s){const[p,a,n,f]=await Promise.all([d(s).catch(()=>({})),v().catch(()=>({})),M().catch(()=>({})),S(s)]),l=new Map(x().map(e=>[e.harness,e.mcpScopes()])),t=[],c=(e,m,i,r)=>{for(const[o,u]of Object.entries(i))t.push({key:o,category:"mcp",harness:e,scope:m,installScopes:l.get(e)??[],enable:r?h(r,o):null,effective:r?w(r,o):!0,detail:u})};return c("claude","project",p,f),c("claude","user",a,null),c("codex","user",n,null),t}
+import{homedir as m}from"node:os";import{readMcpEnableMap as u,mcpOverrideOf as d,resolveMcpEffective as h}from"./settings-mcp.js";import{assetSurfaces as n}from"../surfaces.js";import{BUILTIN_MCP_SERVERS as S}from"./builtin-mcp.js";import{readDaemonState as b}from"../daemon/state.js";export async function readMcpRows(c){const p=await u(c),o=[];for(const e of n()){const s=e.mcpScopes();for(const a of s){const t=e.harness==="claude"&&a==="project"?p:null,l=await e.mcpRead(a,c,m()).catch(()=>({}));for(const[r,i]of Object.entries(l))o.push({key:r,category:"mcp",harness:e.harness,scope:a,installScopes:s,enable:t?d(t,r):null,effective:t?h(t,r):!0,detail:i})}}const f=b()?.port;for(const e of n())for(const s of S)e.harness==="claude"&&(o.some(a=>a.harness==="claude"&&a.key===s.name)||o.push({key:s.name,category:"mcp",harness:"claude",scope:"user",installScopes:["user"],install:"absent",enable:null,effective:!1,detail:{url:`http://127.0.0.1:${f??6420}${s.path}`},builtin:!0}));return o}

package/node_modules/@weavecode/server/dist/install/plugin-install.js

@@ -1 +1 @@
-import t from"node:path";import{marketIdOf as o}from"../market/identity.js";import{marketDir as e}from"../market/manifest.js";export async function installPluginPack(n,r){const i=o(r.dir);return n.globalInstall(r.dir,{name:r.name,version:r.version,description:r.description,...i?{marketplace:{name:i,dir:t.join(e(),i)}}:{}})}
+import r from"node:path";import{marketIdOf as t}from"../market/identity.js";import{marketDir as a}from"../market/manifest.js";export async function installPluginPack(o,i){const n=t(i.dir);return o.globalInstall(i.dir,{name:i.name,version:i.version,description:i.description,...n?{marketplace:{name:n,dir:r.join(a(),n)}}:{}})}

package/node_modules/@weavecode/server/dist/install/plugin-rows.js

@@ -1 +1 @@
-import{pluginSurfaces as b,pluginStateSurfaces as g}from"../surfaces.js";const u=["user","project","local"],v=(s,e)=>e in s?s[e]?"on":"off":"inherit";function y(s,e){for(let n=u.length-1;n>=0;n--){const o=s[u[n]][e];if(o!==void 0)return o}return!1}export async function readPluginRows(s){const e=[],n=b();for(const{harness:o,surface:a}of n){const l=a.pluginScopes(),[t,c]=await Promise.all([a.readInstalled().catch(()=>({})),a.readEnabledOverrides(s).catch(()=>({user:{},project:{},local:{}}))]),p=new Set(Object.keys(t));for(const r of u)for(const f of Object.keys(c[r]))p.add(f);for(const r of p){const f=t[r],d=y(c,r);for(const i of l)e.push({key:r,category:"plugin",harness:o,scope:i,installScopes:l,install:f?.some(h=>(h.scope??"user")===i)?"installed":"absent",enable:v(c[i],r),effective:d})}}for(const{harness:o,state:a}of g()){if(n.some(t=>t.harness===o))continue;const l=await a.readGlobalEnabled().catch(()=>({}));for(const[t,c]of Object.entries(l))e.push({key:t,category:"plugin",harness:o,scope:"user",installScopes:[],enable:c?"on":"off",effective:c})}return e}
+import{pluginSurfaces as b,pluginStateSurfaces as g}from"../surfaces.js";const u=["user","project","local"],y=(s,e)=>e in s?s[e]?"on":"off":"inherit";function S(s,e){for(let n=u.length-1;n>=0;n--){const o=s[u[n]][e];if(o!==void 0)return o}return!1}export async function readPluginRows(s){const e=[],n=b();for(const{harness:o,surface:a}of n){const f=a.pluginScopes(),[t,c]=await Promise.all([a.readInstalled().catch(()=>({})),a.readEnabledOverrides(s).catch(()=>({user:{},project:{},local:{}}))]),p=new Set(Object.keys(t));for(const r of u)for(const l of Object.keys(c[r]))p.add(l);for(const r of p){const l=t[r],d=S(c,r);for(const i of f)e.push({key:r,category:"plugin",harness:o,scope:i,installScopes:f,install:l?.some(h=>(h.scope??"user")===i)?"installed":"absent",enable:y(c[i],r),effective:d})}}for(const{harness:o,state:a}of g()){if(n.some(t=>t.harness===o))continue;const f=await a.readGlobalEnabled().catch(()=>({}));for(const[t,c]of Object.entries(f))e.push({key:t,category:"plugin",harness:o,scope:"user",installScopes:[],enable:c?"on":"off",effective:c})}return e}

package/node_modules/@weavecode/server/dist/install/plugin-templates.js

@@ -1 +1 @@
-import{cp as f,mkdir as d,readdir as P,readFile as h,rm as w}from"node:fs/promises";import{homedir as y}from"node:os";import a from"node:path";import{WEAVE_PLUGIN_MANIFEST as k,WeavePluginManifestSchema as v}from"@weavecode/core";import{assetSurfaceFor as E}from"../surfaces.js";const T={skills:"skill",commands:"command",agents:"agent"};async function j(t){const e=[];let s;try{s=await P(t)}catch{return e}for(const o of s){const i=a.join(t,o);try{const c=JSON.parse(await h(a.join(i,k),"utf8")),r=v.safeParse(c);r.success&&e.push({dir:i,manifest:r.data})}catch{}}return e}function S(t,e,s){const o=[];if(!s.templates)return o;const i=E("claude"),c=a.join(t,...i.projectSkillsDir().split("/"));for(const[r,l]of Object.entries(s.templates)){const n=T[r];if(n)for(const p of l??[]){const u=a.resolve(e,p);if(!u.startsWith(a.resolve(e)+a.sep))continue;const m=a.basename(u),g=n==="skill"?c:i.targetDir(n,"project",t,y());o.push({pluginId:s.id,category:n,name:m.replace(/\.md$/,""),sourcePath:u,targetPath:a.join(g,m)})}}return o}export async function detectPluginTemplateUpdates(t,e){const s=[],o=a.join(t,".weave","plugins");for(const{dir:i,manifest:c}of await j(o))for(const r of S(t,i,c)){const[l,n]=r.category==="skill"?await Promise.all([e.get(r.sourcePath),e.get(r.targetPath)]):await Promise.all([e.getFile(r.sourcePath),e.getFile(r.targetPath)]);s.push({...r,outdated:l!==n})}return s}export async function materializePluginTemplate(t){if(t.category==="skill"){await w(t.targetPath,{recursive:!0,force:!0}),await f(t.sourcePath,t.targetPath,{recursive:!0});return}await d(a.dirname(t.targetPath),{recursive:!0}),await f(t.sourcePath,t.targetPath)}
+import{cp as f,mkdir as h,readdir as d,readFile as P,rm as w}from"node:fs/promises";import{homedir as j}from"node:os";import r from"node:path";import{WEAVE_PLUGIN_MANIFEST as y,WeavePluginManifestSchema as k}from"@weavecode/core";import{assetSurfaceFor as v}from"../surfaces.js";const S={skills:"skill",commands:"command",agents:"agent"};async function F(t){const a=[];let s;try{s=await d(t)}catch{return a}for(const o of s){const i=r.join(t,o);try{const c=JSON.parse(await P(r.join(i,y),"utf8")),e=k.safeParse(c);e.success&&a.push({dir:i,manifest:e.data})}catch{}}return a}function E(t,a,s){const o=[];if(!s.templates)return o;const i=v("claude"),c=r.join(t,...i.projectSkillsRoots()[0].split("/"));for(const[e,l]of Object.entries(s.templates)){const n=S[e];if(n)for(const p of l??[]){const u=r.resolve(a,p);if(!u.startsWith(r.resolve(a)+r.sep))continue;const m=r.basename(u),g=n==="skill"?c:i.targetDir(n,"project",t,j());o.push({pluginId:s.id,category:n,name:m.replace(/\.md$/,""),sourcePath:u,targetPath:r.join(g,m)})}}return o}export async function detectPluginTemplateUpdates(t,a){const s=[],o=r.join(t,".weave","plugins");for(const{dir:i,manifest:c}of await F(o))for(const e of E(t,i,c)){const[l,n]=e.category==="skill"?await Promise.all([a.get(e.sourcePath),a.get(e.targetPath)]):await Promise.all([a.getFile(e.sourcePath),a.getFile(e.targetPath)]);s.push({...e,outdated:l!==n})}return s}export async function materializePluginTemplate(t){if(t.category==="skill"){await w(t.targetPath,{recursive:!0,force:!0}),await f(t.sourcePath,t.targetPath,{recursive:!0});return}await h(r.dirname(t.targetPath),{recursive:!0}),await f(t.sourcePath,t.targetPath)}

package/node_modules/@weavecode/server/dist/install/project-config.js

@@ -1,2 +1,2 @@
-import{readFile as a,writeFile as e,mkdir as s}from"node:fs/promises";import i from"node:path";const c=".weave",f="config.json";export const DEFAULT_PROJECT_CONFIG={lastSyncAt:null};function o(t){return i.join(t,c,f)}function u(t){return{lastSyncAt:t.lastSyncAt??DEFAULT_PROJECT_CONFIG.lastSyncAt}}export async function readProjectConfig(t){try{const n=await a(o(t),"utf-8");return u(JSON.parse(n))}catch{return DEFAULT_PROJECT_CONFIG}}export async function writeProjectConfig(t,n){const r=i.join(t,c);await s(r,{recursive:!0}),await e(o(t),`${JSON.stringify(n,null,2)}
+import{readFile as i,writeFile as e,mkdir as s}from"node:fs/promises";import a from"node:path";const o=".weave",u="config.json";export const DEFAULT_PROJECT_CONFIG={lastSyncAt:null};function c(t){return a.join(t,o,u)}function f(t){return{lastSyncAt:t.lastSyncAt??DEFAULT_PROJECT_CONFIG.lastSyncAt}}export async function readProjectConfig(t){try{const n=await i(c(t),"utf-8");return f(JSON.parse(n))}catch{return DEFAULT_PROJECT_CONFIG}}export async function writeProjectConfig(t,n){const r=a.join(t,o);await s(r,{recursive:!0}),await e(c(t),`${JSON.stringify(n,null,2)}
 `,"utf-8")}export async function markSynced(t,n){const r=await readProjectConfig(t);await writeProjectConfig(t,{...r,lastSyncAt:n})}

package/node_modules/@weavecode/server/dist/install/reader.d.ts

@@ -25,8 +25,14 @@ export interface ProjectFile {
 /** Maximum bytes returned by the reader (keep payloads small for the browser). */
 export declare const MAX_BYTES: number;
 /**
- * Resolve a project-relative path and ensure it stays inside the allowed roots.
- * Rejects absolute paths and any segment equal to `..`.
+ * Resolve a project-relative path and keep it inside the project root. Rejects
+ * absolute paths and any segment equal to `..`. No allowed-root narrowing —
+ * callers that need it (`resolveProjectFile`) apply their own whitelist on top.
+ */
+export declare function resolveWithinProject(projectPath: string, relPath: string): string;
+/**
+ * Resolve a project-relative path and ensure it stays inside the allowed roots
+ * (`.claude/`, `.codex/`, `.weave/`, the MCP config and the instruction files).
  */
 export declare function resolveProjectFile(projectPath: string, relPath: string): string;
 /** Read a text file from the project, enforcing the allowed-root + size limits. */

package/node_modules/@weavecode/server/dist/install/reader.js

@@ -1 +1 @@
-import{readFile as l,stat as d}from"node:fs/promises";import{homedir as w}from"node:os";import s from"node:path";import{AssetNotFoundError as n}from"./installer.js";export class PathEscapeError extends Error{constructor(e){super(e),this.name="PathEscapeError"}}export class FileTooLargeError extends Error{constructor(e){super(e),this.name="FileTooLargeError"}}export const MAX_BYTES=512*1024;export function resolveProjectFile(t,e){const o=s.normalize(e).replace(/\\/g,"/");if(s.isAbsolute(e))throw new PathEscapeError(`Absolute paths are not allowed: "${e}"`);if(o.split("/").some(c=>c===".."))throw new PathEscapeError(`Path traversal is not allowed: "${e}"`);if(!(o===".mcp.json"||o==="CLAUDE.md"||o==="AGENTS.md"||o===".claude"||o.startsWith(".claude/")||o===".codex"||o.startsWith(".codex/")||o===".weave"||o.startsWith(".weave/")))throw new PathEscapeError(`Path is outside the allowed roots: "${e}"`);const i=s.join(t,o),a=t.endsWith(s.sep)?t:t+s.sep;if(i!==t&&!i.startsWith(a))throw new PathEscapeError(`Resolved path escapes the project: "${e}"`);return i}export async function readProjectFile(t,e){const o=resolveProjectFile(t,e);let r;try{r=await d(o)}catch{throw new n(`File not found: "${e}"`)}if(!r.isFile())throw new n(`Not a file: "${e}"`);if(r.size>MAX_BYTES)throw new FileTooLargeError(`File exceeds ${MAX_BYTES} bytes: "${e}"`);return{content:await l(o,"utf-8"),size:r.size}}export async function readGlobalFile(t){return readProjectFile(w(),t)}
+import{readFile as c,stat as p}from"node:fs/promises";import{homedir as h}from"node:os";import s from"node:path";import{AssetNotFoundError as n}from"./installer.js";import{assetSurfaces as w}from"../surfaces.js";export class PathEscapeError extends Error{constructor(t){super(t),this.name="PathEscapeError"}}export class FileTooLargeError extends Error{constructor(t){super(t),this.name="FileTooLargeError"}}export const MAX_BYTES=512*1024;export function resolveWithinProject(e,t){const r=s.normalize(t).replace(/\\/g,"/");if(s.isAbsolute(t))throw new PathEscapeError(`Absolute paths are not allowed: "${t}"`);if(r.split("/").some(i=>i===".."))throw new PathEscapeError(`Path traversal is not allowed: "${t}"`);const o=s.join(e,r),a=e.endsWith(s.sep)?e:e+s.sep;if(o!==e&&!o.startsWith(a))throw new PathEscapeError(`Resolved path escapes the project: "${t}"`);return o}export function resolveProjectFile(e,t){const r=s.normalize(t).replace(/\\/g,"/"),o=w().flatMap(i=>i.projectSkillsRoots().map(l=>l.split("/")[0])),a=r.split("/")[0]??"";if(!(r===".mcp.json"||r==="CLAUDE.md"||r==="AGENTS.md"||o.includes(a)||r===".weave"||r.startsWith(".weave/")))throw new PathEscapeError(`Path is outside the allowed roots: "${t}"`);return resolveWithinProject(e,r)}export async function readProjectFile(e,t){const r=resolveProjectFile(e,t);let o;try{o=await p(r)}catch{throw new n(`File not found: "${t}"`)}if(!o.isFile())throw new n(`Not a file: "${t}"`);if(o.size>MAX_BYTES)throw new FileTooLargeError(`File exceeds ${MAX_BYTES} bytes: "${t}"`);return{content:await c(r,"utf-8"),size:o.size}}export async function readGlobalFile(e){return readProjectFile(h(),e)}

package/node_modules/@weavecode/server/dist/install/scan-cache.js

@@ -1 +1 @@
-import{mkdir as f,readFile as p,rm as w,writeFile as m}from"node:fs/promises";import t from"node:path";import{scanLibraryFileAssets as d,scanLibraryMcp as g,scanLibraryPlugins as A,scanLibrarySkills as v}from"./scanner.js";const u="scans.json",y=1;function c(n){const r=t.resolve(n);return t.join(t.dirname(r),".weave-scans",t.basename(r))}const a=new Map,o=new Map;export async function scanLibrary(n){const{plugins:r,packRoots:e}=await A(n),[s,i,l]=await Promise.all([v(n,e),g(n,e),d(n,e)]);return{plugins:r,packRoots:e,skills:s,mcp:i,files:l}}export async function getLibraryScan(n){const r=t.resolve(n),e=a.get(r);if(e)return e;const s=o.get(r);if(s)return s;const i=S(r);o.set(r,i);try{return await i}finally{o.delete(r)}}async function S(n){const r=await k(n);if(r)return a.set(n,r),r;const e=await scanLibrary(n);return await L(n,e),a.set(n,e),e}async function k(n){try{const r=JSON.parse(await p(t.join(c(n),u),"utf8"));return!r||r.version!==y||!Array.isArray(r.plugins)||!Array.isArray(r.packRoots)||!Array.isArray(r.skills)||!Array.isArray(r.mcp)||!r.files||typeof r.files!="object"?null:r}catch{return null}}async function L(n,r){try{await f(c(n),{recursive:!0}),await m(t.join(c(n),u),JSON.stringify({version:y,...r}),"utf8")}catch{}}export async function invalidateScan(n){const r=t.resolve(n);a.delete(r);const e=o.get(r);e&&await e.catch(()=>{}),await w(c(r),{recursive:!0,force:!0}),a.delete(r)}export function clearScanCache(){a.clear()}
+import{mkdir as f,readFile as p,rm as w,writeFile as m}from"node:fs/promises";import s from"node:path";import{scanLibraryFileAssets as g,scanLibraryMcp as v,scanLibraryPlugins as A,scanLibrarySkills as b}from"./scanner.js";const l="scans.json",u=1;function c(a){const r=s.resolve(a);return s.join(s.dirname(r),".weave-scans",s.basename(r))}const e=new Map,o=new Map;export async function scanLibrary(a){const{plugins:r,packRoots:t}=await A(a),[i,n,y]=await Promise.all([b(a,t),v(a,t),g(a,t)]);return{plugins:r,packRoots:t,skills:i,mcp:n,files:y}}export async function getLibraryScan(a){const r=s.resolve(a),t=e.get(r);if(t)return t;const i=o.get(r);if(i)return i;const n=d(r);o.set(r,n);try{return await n}finally{o.delete(r)}}async function d(a){const r=await k(a);if(r)return e.set(a,r),r;const t=await scanLibrary(a);return await L(a,t),e.set(a,t),t}async function k(a){try{const r=JSON.parse(await p(s.join(c(a),l),"utf8"));return!r||r.version!==u||r.root!==a||!Array.isArray(r.plugins)||!Array.isArray(r.packRoots)||!Array.isArray(r.skills)||!Array.isArray(r.mcp)||!r.files||typeof r.files!="object"?null:r}catch{return null}}async function L(a,r){try{await f(c(a),{recursive:!0}),await m(s.join(c(a),l),JSON.stringify({version:u,root:a,...r}),"utf8")}catch{}}export async function invalidateScan(a){const r=s.resolve(a);e.delete(r);const t=o.get(r);t&&await t.catch(()=>{}),await w(c(r),{recursive:!0,force:!0}),e.delete(r)}export function clearScanCache(){e.clear()}

package/node_modules/@weavecode/server/dist/install/scanner.js

@@ -1 +1 @@
-import{readdir as l,readFile as j,stat as E}from"node:fs/promises";import{join as o,basename as p,relative as f,dirname as S}from"node:path";import{FILE_ASSET_SPECS as A,FILE_ASSET_CATEGORIES as h}from"./file-assets.js";import{hasNonEmptyModules as L}from"../watch/plugin-mods.js";import{parseToolkitPack as I}from"../hooks/toolkit-scan.js";import{marketIdOf as T}from"../market/identity.js";import{pluginSurfaceFor as d}from"../surfaces.js";function _(t){if(!(!(t.ccPack||t.kind==="mod")||!t.targets.includes("claude")))return d("claude").pluginKey(t.name,T(t.dir))}const y=new Set(["node_modules",".git","dist","build",".next","coverage",".cache"]);async function g(t){try{return(await E(t)).isFile()}catch{return!1}}async function D(t){if(await g(o(t,".claude-plugin","plugin.json"))||await g(o(t,"weave-plugin.json")))return!0;try{const e=JSON.parse(await j(o(t,"hooks","hooks.json"),"utf8"));return L(e)}catch{return!1}}const M=10;export async function scanLibraryPlugins(t){const e=[],r=[],c=async(a,n)=>{if(await D(a)){r.push(f(t,a).replace(/\\/g,"/"));const s=await I(a,{root:t,provenance:"market"},"");if(s){const u=[];for(const k of s.skills)await g(o(a,"skills",k,"SKILL.md"))&&u.push(k);const m=_(s);e.push({name:s.name,version:s.version,...s.description?{description:s.description}:{},...m?{key:m}:{},dirPath:s.dir,relPath:f(t,a).replace(/\\/g,"/"),ccPack:s.ccPack,weavePack:s.weavePack,kind:s.kind,components:s.components,targets:s.targets,skills:u})}return}if(n>=M)return;let i;try{i=await l(a,{withFileTypes:!0})}catch{return}for(const s of i)s.isDirectory()&&(s.name.startsWith(".")||y.has(s.name)||await c(o(a,s.name),n+1))};return await c(t,0),{plugins:e.sort((a,n)=>a.relPath.localeCompare(n.relPath)),packRoots:r.sort((a,n)=>a.localeCompare(n))}}function w(t,e){return!e||e.length===0?!1:e.some(r=>r===""||t===r||t.startsWith(`${r}/`))}export async function scanLibrarySkills(t,e){const r=[];return await P(t,t,r,e),r.sort((c,a)=>c.name.localeCompare(a.name))}async function P(t,e,r,c){if(w(f(t,e).replace(/\\/g,"/"),c))return;let a;try{a=await l(e,{withFileTypes:!0})}catch{return}if(a.some(n=>n.isFile()&&n.name==="SKILL.md")){r.push({name:p(e),dirPath:e,relPath:f(t,e).replace(/\\/g,"/"),group:f(t,S(e)).replace(/\\/g,"/")});return}for(const n of a)n.isDirectory()&&(n.name.startsWith(".")||y.has(n.name)||await P(t,o(e,n.name),r,c))}export async function scanLibraryMcp(t,e){const r=[];await v(t,t,r,e);const c=[];for(const a of r)try{const n=JSON.parse(await j(a.abs,"utf-8"));O(n,a,c)}catch{}return c.sort((a,n)=>a.name.localeCompare(n.name))}async function v(t,e,r,c){if(w(f(t,e).replace(/\\/g,"/"),c))return;let a;try{a=await l(e,{withFileTypes:!0})}catch{return}for(const n of a)if(n.isDirectory()){if(n.name.startsWith(".")||y.has(n.name))continue;await v(t,o(e,n.name),r,c)}else if(n.isFile()){const i=n.name.replace(/\.mcp\.json$/i,"").replace(/\.json$/i,""),s=/\.mcp\.json$/i.test(n.name),u=p(e)==="mcp"&&/\.json$/i.test(n.name);(s||u)&&i&&r.push({abs:o(e,n.name),rel:f(t,o(e,n.name)).replace(/\\/g,"/")})}}function O(t,e,r){const c=e.rel.replace(/\.mcp\.json$/i,"").replace(/\.json$/i,"").replace(/^.*\//,"");if(t&&typeof t=="object"&&!Array.isArray(t)){const a=t,n=a.mcpServers;if(n&&typeof n=="object"&&!Array.isArray(n)){for(const[s,u]of Object.entries(n)){const m=F(s,u);m&&r.push({...m,sourcePath:e.abs,relPath:e.rel})}return}const i=F(c,a);i&&r.push({...i,sourcePath:e.abs,relPath:e.rel})}}function F(t,e){if(!e||typeof e!="object"||Array.isArray(e))return null;const r=e;if(typeof r.command!="string"||!r.command)return null;const c={name:t,command:r.command};if(Array.isArray(r.args)&&(c.args=r.args.filter(a=>typeof a=="string")),r.env&&typeof r.env=="object"&&!Array.isArray(r.env)){const a={};for(const[n,i]of Object.entries(r.env))typeof i=="string"&&(a[n]=i);Object.keys(a).length&&(c.env=a)}return c}const C=Object.fromEntries(h.flatMap(t=>Object.values(A[t].dirs).map(e=>e?.project).filter(e=>e!==void 0).map(e=>[p(e),t])));export async function scanLibraryFileAssets(t,e){const r={};for(const c of h)r[c]=[];await b(t,t,r,e);for(const c of h)r[c].sort((a,n)=>a.name.localeCompare(n.name));return r}async function b(t,e,r,c){if(w(f(t,e).replace(/\\/g,"/"),c))return;let a;try{a=await l(e,{withFileTypes:!0})}catch{return}if(a.some(i=>i.isFile()&&i.name==="SKILL.md"))return;const n=C[p(e)];if(n){const i=A[n];for(const s of a){if(!s.isFile()||!s.name.endsWith(i.ext))continue;const u=s.name.slice(0,-i.ext.length);if(!u)continue;const m=o(e,s.name);r[n].push({name:u,filePath:m,relPath:f(t,m).replace(/\\/g,"/"),group:f(t,S(e)).replace(/\\/g,"/"),category:n})}return}for(const i of a)i.isDirectory()&&(i.name.startsWith(".")||y.has(i.name)||await b(t,o(e,i.name),r,c))}
+import{readdir as p,readFile as k,stat as F}from"node:fs/promises";import{join as c,basename as u,relative as l,dirname as j}from"node:path";import{FILE_ASSET_SPECS as P,FILE_ASSET_CATEGORIES as h}from"./file-assets.js";import{hasNonEmptyModules as L}from"../watch/plugin-mods.js";import{parseToolkitPack as E}from"../hooks/toolkit-scan.js";import{marketIdOf as O}from"../market/identity.js";import{pluginSurfaceFor as T}from"../surfaces.js";function C(e){if(!(!(e.ccPack||e.kind==="mod")||!e.targets.includes("claude")))return T("claude").pluginKey(e.name,O(e.dir))}const y=new Set(["node_modules",".git","dist","build",".next","coverage",".cache"]);async function d(e){try{return(await F(e)).isFile()}catch{return!1}}async function I(e){if(await d(c(e,".claude-plugin","plugin.json"))||await d(c(e,"weave-plugin.json")))return!0;try{const a=JSON.parse(await k(c(e,"hooks","hooks.json"),"utf8"));return L(a)}catch{return!1}}const x=10;export async function scanLibraryPlugins(e){const a=[],n=[],o=async(t,r)=>{if(await I(t)){n.push(l(e,t).replace(/\\/g,"/"));const s=await E(t,{root:e,provenance:"market"},"");if(s){const m=[];for(const w of s.skills)await d(c(t,"skills",w,"SKILL.md"))&&m.push(w);const f=C(s);a.push({name:s.name,version:s.version,...s.description?{description:s.description}:{},...f?{key:f}:{},dirPath:s.dir,relPath:l(e,t).replace(/\\/g,"/"),ccPack:s.ccPack,weavePack:s.weavePack,kind:s.kind,components:s.components,targets:s.targets,skills:m})}return}if(r>=x)return;let i;try{i=await p(t,{withFileTypes:!0})}catch{return}for(const s of i)s.isDirectory()&&(s.name.startsWith(".")||y.has(s.name)||await o(c(t,s.name),r+1))};return await o(e,0),{plugins:a.sort((t,r)=>t.relPath.localeCompare(r.relPath)),packRoots:n.sort((t,r)=>t.localeCompare(r))}}function g(e,a){return!a||a.length===0?!1:a.some(n=>n===""||e===n||e.startsWith(`${n}/`))}export async function scanLibrarySkills(e,a){const n=[];return await b(e,e,n,a),n.sort((o,t)=>o.name.localeCompare(t.name))}async function b(e,a,n,o){if(g(l(e,a).replace(/\\/g,"/"),o))return;let t;try{t=await p(a,{withFileTypes:!0})}catch{return}if(t.some(r=>r.isFile()&&r.name==="SKILL.md")){n.push({name:u(a),dirPath:a,relPath:l(e,a).replace(/\\/g,"/"),group:l(e,j(a)).replace(/\\/g,"/")});return}for(const r of t)r.isDirectory()&&(r.name.startsWith(".")||y.has(r.name)||await b(e,c(a,r.name),n,o))}export async function scanLibraryMcp(e,a){const n=[];await v(e,e,n,a);const o=[];for(const t of n)try{const r=JSON.parse(await k(t.abs,"utf-8"));$(r,t,o)}catch{}return o.sort((t,r)=>t.name.localeCompare(r.name))}async function v(e,a,n,o){if(g(l(e,a).replace(/\\/g,"/"),o))return;let t;try{t=await p(a,{withFileTypes:!0})}catch{return}for(const r of t)if(r.isDirectory()){if(r.name.startsWith(".")||y.has(r.name))continue;await v(e,c(a,r.name),n,o)}else if(r.isFile()){const i=r.name.replace(/\.mcp\.json$/i,"").replace(/\.json$/i,""),s=/\.mcp\.json$/i.test(r.name),m=u(a)==="mcp"&&/\.json$/i.test(r.name);(s||m)&&i&&n.push({abs:c(a,r.name),rel:l(e,c(a,r.name)).replace(/\\/g,"/")})}}function $(e,a,n){const o=a.rel.replace(/\.mcp\.json$/i,"").replace(/\.json$/i,"").replace(/^.*\//,"");if(e&&typeof e=="object"&&!Array.isArray(e)){const t=e,r=t.mcpServers;if(r&&typeof r=="object"&&!Array.isArray(r)){for(const[s,m]of Object.entries(r)){const f=S(s,m);f&&n.push({...f,sourcePath:a.abs,relPath:a.rel})}return}const i=S(o,t);i&&n.push({...i,sourcePath:a.abs,relPath:a.rel})}}function S(e,a){if(!a||typeof a!="object"||Array.isArray(a))return null;const n=a;if(typeof n.command!="string"||!n.command)return null;const o={name:e,command:n.command};if(Array.isArray(n.args)&&(o.args=n.args.filter(t=>typeof t=="string")),n.env&&typeof n.env=="object"&&!Array.isArray(n.env)){const t={};for(const[r,i]of Object.entries(n.env))typeof i=="string"&&(t[r]=i);Object.keys(t).length&&(o.env=t)}return o}const W=Object.fromEntries(h.flatMap(e=>Object.values(P[e].dirs).map(a=>a?.project).filter(a=>a!==void 0).map(a=>[u(a),e])));export async function scanLibraryFileAssets(e,a){const n={};for(const o of h)n[o]=[];await A(e,e,n,a);for(const o of h)n[o].sort((t,r)=>t.name.localeCompare(r.name));return n}async function A(e,a,n,o){if(g(l(e,a).replace(/\\/g,"/"),o))return;let t;try{t=await p(a,{withFileTypes:!0})}catch{return}if(t.some(i=>i.isFile()&&i.name==="SKILL.md"))return;const r=W[u(a)];if(r){const i=P[r];for(const s of t){if(!s.isFile()||!s.name.endsWith(i.ext))continue;const m=s.name.slice(0,-i.ext.length);if(!m)continue;const f=c(a,s.name);n[r].push({name:m,filePath:f,relPath:l(e,f).replace(/\\/g,"/"),group:l(e,j(a)).replace(/\\/g,"/"),category:r})}return}for(const i of t)i.isDirectory()&&(i.name.startsWith(".")||y.has(i.name)||await A(e,c(a,i.name),n,o))}

package/node_modules/@weavecode/server/dist/install/settings-mcp.js

@@ -1,2 +1,2 @@
-import{readFile as f,writeFile as u,mkdir as b,access as p}from"node:fs/promises";import o from"node:path";const c=".claude/settings.json";async function S(t){try{return await p(t),!0}catch{return!1}}async function d(t){const e=o.join(t,c);if(!await S(e))return{};try{const r=JSON.parse(await f(e,"utf-8"));return r&&typeof r=="object"&&!Array.isArray(r)?r:{}}catch{return{}}}async function v(t,e){const r=o.join(t,c);await b(o.dirname(r),{recursive:!0}),await u(r,`${JSON.stringify(e,null,2)}
-`,"utf-8")}export async function readMcpEnableMap(t){const e=await d(t),r=i(e.enabledMcpjsonServers),n=i(e.disabledMcpjsonServers),s={};for(const a of r)s[a]="enabled";for(const a of n)s[a]="disabled";return{overrides:s,enableAll:e.enableAllProjectMcpServers===!0}}const y={enabled:"on",disabled:"off",default:"inherit"},M={on:"enabled",off:"disabled",inherit:"default"};export function mcpOverrideOf(t,e){return y[t.overrides[e]??"default"]}export function resolveMcpEffective(t,e){const r=t.overrides[e];return r==="enabled"?!0:r==="disabled"?!1:t.enableAll}export async function setMcpEnableState(t,e,r){const n=await d(t),s=new Set(i(n.enabledMcpjsonServers)),a=new Set(i(n.disabledMcpjsonServers));s.delete(e),a.delete(e),r==="enabled"?s.add(e):r==="disabled"&&a.add(e),l(n,"enabledMcpjsonServers",s),l(n,"disabledMcpjsonServers",a),await v(t,n)}export function setMcpEnableOverride(t,e,r){return setMcpEnableState(t,e,M[r])}function i(t){return Array.isArray(t)?t.filter(e=>typeof e=="string"):[]}function l(t,e,r){r.size===0?delete t[e]:t[e]=[...r].sort()}
+import{readFile as f,writeFile as u,mkdir as b,access as p}from"node:fs/promises";import o from"node:path";const c=".claude/settings.json";async function v(r){try{return await p(r),!0}catch{return!1}}async function d(r){const e=o.join(r,c);if(!await v(e))return{};try{const n=JSON.parse(await f(e,"utf-8"));return n&&typeof n=="object"&&!Array.isArray(n)?n:{}}catch{return{}}}async function y(r,e){const n=o.join(r,c);await b(o.dirname(n),{recursive:!0}),await u(n,`${JSON.stringify(e,null,2)}
+`,"utf-8")}export async function readMcpEnableMap(r){const e=await d(r),n=i(e.enabledMcpjsonServers),t=i(e.disabledMcpjsonServers),a={};for(const s of n)a[s]="enabled";for(const s of t)a[s]="disabled";return{overrides:a,enableAll:e.enableAllProjectMcpServers===!0}}const M={enabled:"on",disabled:"off",default:"inherit"},S={on:"enabled",off:"disabled",inherit:"default"};export function mcpOverrideOf(r,e){return M[r.overrides[e]??"default"]}export function resolveMcpEffective(r,e){const n=r.overrides[e];return n==="enabled"?!0:n==="disabled"?!1:r.enableAll}export async function setMcpEnableState(r,e,n){const t=await d(r),a=new Set(i(t.enabledMcpjsonServers)),s=new Set(i(t.disabledMcpjsonServers));a.delete(e),s.delete(e),n==="enabled"?a.add(e):n==="disabled"&&s.add(e),l(t,"enabledMcpjsonServers",a),l(t,"disabledMcpjsonServers",s),await y(r,t)}export function setMcpEnableOverride(r,e,n){return setMcpEnableState(r,e,S[n])}function i(r){return Array.isArray(r)?r.filter(e=>typeof e=="string"):[]}function l(r,e,n){n.size===0?delete r[e]:r[e]=[...n].sort()}

package/node_modules/@weavecode/server/dist/install/updates.js

@@ -1 +1 @@
-import{readdir as g,stat as w}from"node:fs/promises";import{homedir as F}from"node:os";import f from"node:path";import{hashMcpConfig as p}from"./fingerprint.js";import{buildLibraryIndex as h,findSkillSource as y,findMcpSource as m,findFileAssetSource as S}from"./library-index.js";import{readMcpServers as k}from"./installer.js";import{readGlobalMcpServers as x,readGlobalSkills as v}from"./global-config.js";import{readCodexMcpServers as C}from"./codex-toml.js";import{FILE_ASSET_CATEGORIES as E,FILE_ASSET_SPECS as M}from"./file-assets.js";import{assetSurfaces as b}from"../surfaces.js";import{readInstalledLedger as T}from"./install-ledger.js";import{detectPluginTemplateUpdates as U}from"./plugin-templates.js";import{detectInitFileUpdates as D,needsInit as L}from"./init-files.js";export async function detectUpdates(a,o,l,t){const n=t??await h(o),[s,e,r,i,u]=await Promise.all([detectSkillUpdates(a,l,n),H(a,n),detectFileAssetUpdates(a,l,n),U(a,l),D(a)]);await A(a,{skills:s,mcp:e,files:r},n);const d=s.filter(c=>!c.custom&&c.outdated).length+e.filter(c=>!c.custom&&c.outdated).length+r.filter(c=>!c.custom&&c.outdated).length+i.filter(c=>c.outdated).length+u.filter(c=>c.outdated&&c.syncClass==="auto").length;return{skills:s,mcp:e,files:r,pluginTemplates:i,initFiles:u,available:d,needsInit:L(u)}}export async function detectProjectUpdateCounts(a,o,l){const t=await h(o),n={};for(const s of a){const e=await detectUpdates(s.path,o,l,t);n[s.id]={available:e.available,needsInit:e.needsInit}}return n}async function A(a,o,l){for(const t of await T(a)){if(t.category==="skill"){if(!y(l,t.name)||o.skills.some(r=>r.scope==="project"&&r.name===t.name&&r.agent===t.agent))continue;o.skills.push({name:t.name,scope:"project",agent:t.agent,outdated:!0,custom:!1,missing:!0});continue}if(t.category==="mcp"){if(!m(l,t.name)||o.mcp.some(e=>e.scope==="project"&&e.name===t.name))continue;o.mcp.push({name:t.name,scope:"project",outdated:!0,custom:!1,missing:!0});continue}const n=t.assetCategory;n===void 0||!S(l,n,t.name)||o.files.some(e=>e.scope==="project"&&e.category===n&&e.name===t.name)||o.files.push({category:n,name:t.name,scope:"project",outdated:!0,custom:!1,missing:!0})}}async function P(a){let o;try{o=await g(a,{withFileTypes:!0})}catch{return[]}const l=[];for(const t of o)if(!(!t.isDirectory()&&!t.isSymbolicLink()))try{(await w(f.join(a,t.name))).isDirectory()&&l.push(t.name)}catch{}return l}export async function detectSkillUpdates(a,o,l){const t=F(),n=[...b().map(e=>({dir:f.join(a,...e.projectSkillsDir().split("/")),scope:"project",agent:e.harness})),...b().map(e=>({dir:e.globalSkillsRoots(t)[0],scope:"user",agent:e.harness}))],s=[];for(const e of n)for(const r of await P(e.dir)){const i=f.join(e.dir,r),u=y(l,r);if(!u){s.push({name:r,scope:e.scope,agent:e.agent,outdated:!1,custom:!0});continue}const[d,c]=await Promise.all([o.get(i),o.get(u.dirPath)]);s.push({name:r,scope:e.scope,agent:e.agent,outdated:d!==c,custom:!1,sourceDir:u.dirPath,libraryId:u.libraryId})}return s}export async function detectFileAssetUpdates(a,o,l){const t=[];for(const n of E){const s=M[n],e=s.dirs.claude?.project;if(!e)continue;const r=f.join(a,...e.split("/"));let i;try{i=(await g(r,{withFileTypes:!0})).filter(u=>u.isFile()&&u.name.endsWith(s.ext)).map(u=>u.name)}catch{continue}for(const u of i){const d=u.slice(0,-s.ext.length),c=S(l,n,d);if(!c){t.push({category:n,name:d,scope:"project",outdated:!1,custom:!0});continue}const[j,I]=await Promise.all([o.getFile(f.join(r,u)),o.getFile(c.filePath)]);t.push({category:n,name:d,scope:"project",outdated:j!==I,custom:!1,libraryId:c.libraryId})}}return t}async function H(a,o){const[l,t,n]=await Promise.all([k(a).catch(()=>({})),x().catch(()=>({})),C().catch(()=>({}))]),s=[];for(const[e,r]of Object.entries(l)){const i=m(o,e);i?s.push({name:e,scope:"project",outdated:p(r)!==p(i.config),custom:!1,libraryId:i.libraryId}):s.push({name:e,scope:"project",outdated:!1,custom:!0})}for(const[e,r]of Object.entries(t)){const i=m(o,e);i?s.push({name:e,scope:"user",outdated:p(r)!==p(i.config),custom:!1,libraryId:i.libraryId}):s.push({name:e,scope:"user",outdated:!1,custom:!0})}for(const[e,r]of Object.entries(n)){const i=m(o,e);i?s.push({name:e,scope:"user",agent:"codex",outdated:p(r)!==p(i.config),custom:!1,libraryId:i.libraryId}):s.push({name:e,scope:"user",agent:"codex",outdated:!1,custom:!0})}return s}export{v as readGlobalSkills};
+import{readdir as g,stat as w}from"node:fs/promises";import{homedir as k}from"node:os";import u from"node:path";import{hashMcpConfig as p}from"./fingerprint.js";import{buildLibraryIndex as h,findSkillSource as y,findMcpSource as f,findFileAssetSource as b}from"./library-index.js";import{readMcpServers as x}from"./installer.js";import{readGlobalMcpServers as F,readGlobalSkills as P}from"./global-config.js";import{readCodexMcpServers as v}from"./codex-toml.js";import{FILE_ASSET_CATEGORIES as C,FILE_ASSET_SPECS as E}from"./file-assets.js";import{assetSurfaces as j}from"../surfaces.js";import{readInstalledLedger as T}from"./install-ledger.js";import{detectPluginTemplateUpdates as U}from"./plugin-templates.js";import{detectInitFileUpdates as A,needsInit as L}from"./init-files.js";export async function detectUpdates(n,s,i,o){const a=o??await h(s),[e,t,d,c,m]=await Promise.all([detectSkillUpdates(n,i,a),G(n,a),detectFileAssetUpdates(n,i,a),U(n,i),A(n)]);await M(n,{skills:e,mcp:t,files:d},a);const l=e.filter(r=>!r.custom&&r.outdated).length+t.filter(r=>!r.custom&&r.outdated).length+d.filter(r=>!r.custom&&r.outdated).length+c.filter(r=>r.outdated).length+m.filter(r=>r.outdated&&r.syncClass==="auto").length;return{skills:e,mcp:t,files:d,pluginTemplates:c,initFiles:m,available:l,needsInit:L(m)}}export async function detectProjectUpdateCounts(n,s,i){const o=await h(s),a={};for(const e of n){const t=await detectUpdates(e.path,s,i,o);a[e.id]={available:t.available,needsInit:t.needsInit}}return a}async function M(n,s,i){for(const o of await T(n)){if(o.category==="skill"){if(!y(i,o.name)||s.skills.some(e=>e.scope==="project"&&e.name===o.name&&e.agent===o.agent))continue;s.skills.push({name:o.name,scope:"project",agent:o.agent,outdated:!0,custom:!1,missing:!0});continue}if(o.category==="mcp"){if(!f(i,o.name)||s.mcp.some(e=>e.scope==="project"&&e.name===o.name))continue;s.mcp.push({name:o.name,scope:"project",outdated:!0,custom:!1,missing:!0});continue}const a=o.assetCategory;a===void 0||!b(i,a,o.name)||s.files.some(e=>e.scope==="project"&&e.category===a&&e.name===o.name)||s.files.push({category:a,name:o.name,scope:"project",outdated:!0,custom:!1,missing:!0})}}async function D(n){let s;try{s=await g(n,{withFileTypes:!0})}catch{return[]}const i=[];for(const o of s)if(!(!o.isDirectory()&&!o.isSymbolicLink()))try{(await w(u.join(n,o.name))).isDirectory()&&i.push(o.name)}catch{}return i}export async function detectSkillUpdates(n,s,i){const o=k(),a=[...j().map(t=>({dir:u.join(n,...t.projectSkillsRoots()[0].split("/")),scope:"project",agent:t.harness})),...j().map(t=>({dir:t.globalSkillsRoots(o)[0],scope:"user",agent:t.harness}))],e=[];for(const t of a)for(const d of await D(t.dir)){const c=u.join(t.dir,d),m=y(i,d);if(!m){e.push({name:d,scope:t.scope,agent:t.agent,outdated:!1,custom:!0});continue}const[l,r]=await Promise.all([s.get(c),s.get(m.dirPath)]);e.push({name:d,scope:t.scope,agent:t.agent,outdated:l!==r,custom:!1,sourceDir:m.dirPath,libraryId:m.libraryId})}return e}export async function detectFileAssetUpdates(n,s,i){const o=[];for(const a of C){const e=E[a],t=e.dirs.claude?.project;if(!t)continue;const d=u.join(n,...t.split("/"));let c;try{c=(await g(d,{withFileTypes:!0})).filter(m=>m.isFile()&&m.name.endsWith(e.ext)).map(m=>m.name)}catch{continue}for(const m of c){const l=m.slice(0,-e.ext.length),r=b(i,a,l);if(!r){o.push({category:a,name:l,scope:"project",outdated:!1,custom:!0});continue}const[S,I]=await Promise.all([s.getFile(u.join(d,m)),s.getFile(r.filePath)]);o.push({category:a,name:l,scope:"project",outdated:S!==I,custom:!1,libraryId:r.libraryId})}}return o}async function G(n,s){const[i,o,a]=await Promise.all([x(n).catch(()=>({})),F().catch(()=>({})),v().catch(()=>({}))]),e=[];for(const[t,d]of Object.entries(i)){const c=f(s,t);c?e.push({name:t,scope:"project",outdated:p(d)!==p(c.config),custom:!1,libraryId:c.libraryId}):e.push({name:t,scope:"project",outdated:!1,custom:!0})}for(const[t,d]of Object.entries(o)){const c=f(s,t);c?e.push({name:t,scope:"user",outdated:p(d)!==p(c.config),custom:!1,libraryId:c.libraryId}):e.push({name:t,scope:"user",outdated:!1,custom:!0})}for(const[t,d]of Object.entries(a)){const c=f(s,t);c?e.push({name:t,scope:"user",agent:"codex",outdated:p(d)!==p(c.config),custom:!1,libraryId:c.libraryId}):e.push({name:t,scope:"user",agent:"codex",outdated:!1,custom:!0})}return e}export{P as readGlobalSkills};

package/node_modules/@weavecode/server/dist/market/builtin.d.ts

@@ -3,18 +3,18 @@ import type { LibraryRepository } from '../repositories/libraries.js';
 /**
  * 内置仓在市场里的 id。它**必须**等于 harness 的注册键缺省市场
  * （`PluginSurface.pluginKey` 的 `name@weave` 里那个 `weave`）——`marketIdOf`
- * 会把 `<dataDir>/market/weave/<...>` 下的包判成 `name@weave`，两边同名才使得
+ * 会把 `<dataRoot>/market/weave/<...>` 下的包判成 `name@weave`，两边同名才使得
  * 「内置仓落地前回落自建市场 / 落地后判成 weaver 市场」得到**同一个键**。
  * 故这里直接引 harness 的常量，不另抄一个字符串。
  */
 export declare const BUILTIN_MARKET_ID = "weave";
-/** 内置仓在数据目录里的落点：`<dataDir>/market/weave/`。 */
-export declare function builtinMarketDir(dataDir: string): string;
+/** 内置仓在数据目录里的落点：`<dataRoot>/market/weave/`。 */
+export declare function builtinMarketDir(dataRoot: string): string;
 /** 内置工具包扫描根（仓内 `plugins/`）——`ToolkitSource.root` 用。 */
-export declare function builtinPacksDir(dataDir: string): string;
+export declare function builtinPacksDir(dataRoot: string): string;
 /** 内置 SPI 规则包装载根（仓内 `rules/`）。 */
-export declare function builtinRulesDir(dataDir: string): string;
-export declare function isBuiltinMarketDir(candidate: string, dataDir: string): boolean;
+export declare function builtinRulesDir(dataRoot: string): string;
+export declare function isBuiltinMarketDir(candidate: string, dataRoot: string): boolean;
 export interface BuiltinMarketResult {
     /** 本次是否重铺（false = 既有落点已指向当前源，未动盘）。 */
     changed: boolean;
@@ -23,13 +23,13 @@ export interface BuiltinMarketResult {
     error?: string;
 }
 /**
- * 把 `@weavecode/templates` 随包发布的内置仓落到 `<dataDir>/market/weave/`，
+ * 把 `@weavecode/templates` 随包发布的内置仓落到 `<dataRoot>/market/weave/`，
  * 并登记为一条 `libraries` 行（`/market` 与资源管理页据此把它当一个仓库渲染）。
  *
  * **落点用链接（失败回退复制）**：这是「公共全局位置优先链接」的直接落实 ——
  * 落点不是数据，而是随包发布的只读内容，链接既不复制一份、也让「改仓即改内置」
  * 在开发态（源 = `src/resources`）真正即时生效。故**不得**往落点写任何东西
- * （清单/扫描缓存都不落这里：扫描缓存写 `<dataDir>/market/.weave-scans/`，
+ * （清单/扫描缓存都不落这里：扫描缓存写 `<dataRoot>/market/.weave-scans/`，
  * 是市场根的**兄弟**目录）。
  *
  * 幂等：落点已是指向当前源的链接则不动盘；源变更（换包版本 / 开发态换目录）或
@@ -37,5 +37,5 @@ export interface BuiltinMarketResult {
  * 绝不会把链接当目录递归删而删穿到包内。
  */
 export declare function ensureBuiltinMarket(deps: {
-    libraries: Pick<LibraryRepository, 'add' | 'dataDir'>;
+    libraries: Pick<LibraryRepository, 'add' | 'dataRoot'>;
 }): Promise<BuiltinMarketResult>;

package/node_modules/@weavecode/server/dist/market/builtin.js

@@ -1 +1 @@
-import n from"node:path";import{lstat as l,realpath as s}from"node:fs/promises";import{builtinMarketRoot as u}from"@weavecode/templates";import{WEAVE_MARKETPLACE as f}from"@weavecode/harness";import{marketDir as m}from"./manifest.js";import{linkOrCopy as p,removeInstalled as h}from"./install-link.js";export const BUILTIN_MARKET_ID=f;export function builtinMarketDir(t){return n.join(m(t),BUILTIN_MARKET_ID)}export function builtinPacksDir(t){return n.join(builtinMarketDir(t),"plugins")}export function builtinRulesDir(t){return n.join(builtinMarketDir(t),"rules")}export function isBuiltinMarketDir(t,o){return n.resolve(t)===n.resolve(builtinMarketDir(o))}export async function ensureBuiltinMarket(t){const o=t.libraries.dataDir,e=u(),r=builtinMarketDir(o);t.libraries.add({path:r,kind:"both"});const c=await s(e),a=await l(r).catch(()=>null);if(a){if(a.isSymbolicLink()&&await s(r).catch(()=>null)===c)return{changed:!1,form:"link"};await h(r)}try{return{changed:!0,form:await p(e,r)}}catch(i){return{changed:!1,error:i instanceof Error?i.message:String(i)}}}
+import i from"node:path";import{lstat as u,realpath as s}from"node:fs/promises";import{builtinMarketRoot as c}from"@weavecode/templates";import{WEAVE_MARKETPLACE as m}from"@weavecode/harness";import{marketDir as f}from"./manifest.js";import{linkOrCopy as p,removeInstalled as h}from"./install-link.js";export const BUILTIN_MARKET_ID=m;export function builtinMarketDir(r){return i.join(f(r),BUILTIN_MARKET_ID)}export function builtinPacksDir(r){return i.join(builtinMarketDir(r),"plugins")}export function builtinRulesDir(r){return i.join(builtinMarketDir(r),"rules")}export function isBuiltinMarketDir(r,n){return i.resolve(r)===i.resolve(builtinMarketDir(n))}export async function ensureBuiltinMarket(r){const n=r.libraries.dataRoot,a=c(),t=builtinMarketDir(n);r.libraries.add({path:t,kind:"both"});const l=await s(a),e=await u(t).catch(()=>null);if(e){if(e.isSymbolicLink()&&await s(t).catch(()=>null)===l)return{changed:!1,form:"link"};await h(t)}try{return{changed:!0,form:await p(a,t)}}catch(o){return{changed:!1,error:o instanceof Error?o.message:String(o)}}}

package/node_modules/@weavecode/server/dist/market/identity.js

@@ -1 +1 @@
-import e from"node:path";import{marketDir as n}from"./manifest.js";export function marketIdOf(i,o=n()){const r=e.relative(e.resolve(o),e.resolve(i));if(r===""||r.startsWith("..")||e.isAbsolute(r))return;const t=r.split(e.sep)[0];return t||void 0}
+import t from"node:path";import{marketDir as s}from"./manifest.js";export function marketIdOf(e,o=s()){const r=t.relative(t.resolve(o),t.resolve(e));return r===""||r.startsWith("..")||t.isAbsolute(r)?void 0:r.split(t.sep)[0]||void 0}

package/node_modules/@weavecode/server/dist/market/import.d.ts

@@ -13,8 +13,8 @@ export type GitResult = {
 export type GitExec = (file: string, args: string[], options: GitExecOptions) => Promise<GitResult>;
 export interface ImportDeps {
     libraries: LibraryRepository;
-    /** 覆盖 dataDir（测试注入）；默认 getDataDir()。 */
-    dataDir?: string;
+    /** 覆盖 dataRoot（测试注入）；默认 getDataRoot()。 */
+    dataRoot?: string;
     /** 覆盖 git 执行（测试注入假 exec）。 */
     execGit?: GitExec;
 }
@@ -23,7 +23,7 @@ export interface ImportedResource {
     id: string;
     /** 市场内绝对路径。 */
     dir: string;
-    /** 相对 dataDir 的 posix 形（libraries.path 规范存储形）。 */
+    /** 相对 dataRoot 的 posix 形（libraries.path 规范存储形）。 */
     relPath: string;
     manifest: MarketManifest;
     libraryId: number;

package/node_modules/@weavecode/server/dist/market/import.js

@@ -1,2 +1,2 @@
-import{execFile as G}from"node:child_process";import{cp as x,mkdir as D,readdir as R,rename as k,rm as p,stat as A}from"node:fs/promises";import s from"node:path";import{promisify as _}from"node:util";import{getDataDir as h}from"../db/paths.js";import{isInsideDir as E,toRelPosix as g}from"./resolve.js";import{isBuiltinMarketDir as B}from"./builtin.js";import{marketDir as I,readManifest as y,writeManifest as d}from"./manifest.js";const C=_(G),M=6e4,S=2e3;export function slugifyResourceId(r){const t=r.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"");return/^[a-z0-9][a-z0-9-]*$/.test(t)?t:"resource"}export function assertSafeGitUrl(r){const t=r.trim();if(!t)throw new Error("Missing git URL");if(t.includes("--upload-pack"))throw new Error("Invalid git URL (--upload-pack rejected)");if(!(t.startsWith("https://")||t.startsWith("ssh://")||/^git@[^:/\s]+:/.test(t)))throw new Error(`Unsupported git URL (allowed: https/ssh): ${t}`);if(/[\s\r\n\t]/.test(t))throw new Error("Invalid git URL (whitespace)");return t}function w(){return new Date().toISOString()}function U(r){return r.length>S?`${r.slice(0,S)}\u2026(truncated)`:r}function l(r,t){if(!E(r,t))throw new Error(`Import target escapes the market directory: ${r}`)}async function L(r){try{return await A(r),!0}catch{return!1}}async function b(r,t){let i=s.join(t,r),e=1;for(;await L(i);)e+=1,i=s.join(t,`${r}-${e}`);return i}async function O(r,t){let i;try{i=await R(r,{withFileTypes:!0})}catch{return null}for(const e of i){if(!e.isDirectory())continue;const a=s.join(r,e.name);if((await y(a))?.origin===t)return a}return null}async function v(r,t,i,e,a=!1){const o=i.dataDir??h(),n=g(r,o),c=i.libraries.add({path:n,kind:"both"});return{id:s.basename(r),dir:r,relPath:n,manifest:t,libraryId:c.id,reused:e,refreshed:a}}async function P(r,t,i){const e=`${t}.refresh-tmp`;await p(e,{recursive:!0,force:!0}),await x(r,e,{recursive:!0}),l(s.resolve(e),i),await p(t,{recursive:!0,force:!0}),await k(e,t)}export async function importFromDir(r,t){const i=t.dataDir??h(),e=s.resolve(r);if(!(await A(e).catch(()=>null))?.isDirectory())throw new Error(`Not a directory: ${r}`);const o=I(i);if(E(e,o))throw new Error("\u4E0D\u80FD\u628A\u8D44\u6E90\u5E02\u573A\u7684\u5B58\u50A8\u76EE\u5F55\u5F53\u6765\u6E90\u5BFC\u5165\uFF1A\u5176\u4E2D\u7684\u8D44\u6E90\u5DF2\u5728\u5217\u8868\u4E2D\uFF08\u5185\u7F6E\u4ED3\u843D\u70B9 / \u5DF2\u5BFC\u5165\u7684\u526F\u672C\uFF09");const n=await O(o,e);if(n){const m=await y(n);await P(e,n,o);const f={...m,importedAt:w()};return await d(n,f),v(n,f,t,!0,!0)}const c=await b(slugifyResourceId(s.basename(e)),o);l(c,o),await D(s.dirname(c),{recursive:!0}),await x(e,c,{recursive:!0});const u={source:"dir",origin:e,importedAt:w()};return await d(c,u),l(s.resolve(c),o),v(c,u,t,!1)}export async function importFromGit(r,t){const i=t.dataDir??h(),e=assertSafeGitUrl(r),a=I(i),o=await O(a,e);if(o){const m=await y(o),f=`${o}.refresh-tmp`;await p(f,{recursive:!0,force:!0});const j=["clone","--depth","1",e,f];try{await(t.execGit??defaultGitExec)("git",j,{timeout:M,maxBuffer:4*1024*1024,windowsHide:!0})}catch(F){throw new Error(`git clone failed: ${U(T(F))}`)}l(s.resolve(f),a),await p(o,{recursive:!0,force:!0}),await k(f,o);const $={...m,importedAt:w()};return await d(o,$),v(o,$,t,!0,!0)}const n=await b(slugifyResourceId(z(e)),a);l(n,a),await D(a,{recursive:!0});const c=["clone","--depth","1",e,n];try{await(t.execGit??defaultGitExec)("git",c,{timeout:M,maxBuffer:4*1024*1024,windowsHide:!0})}catch(m){throw new Error(`git clone failed: ${U(T(m))}`)}l(s.resolve(n),a);const u={source:"git",origin:e,importedAt:w()};return await d(n,u),v(n,u,t,!1)}export async function importLibraryIntoMarket(r,t){const i=t.dataDir??h(),e=s.isAbsolute(r.path)?r.path:s.join(i,r.path),a=s.resolve(e),o=I(i);if(!await L(a))throw new Error(`Source directory not found: ${a}`);if(B(a,i))throw new Error("\u5185\u7F6E\u4ED3\u4E0D\u53EF\u8FC1\u5165\uFF1A\u5B83\u968F\u5305\u53D1\u5E03\u3001\u65E0\u5916\u90E8\u6765\u6E90\uFF0C\u4E14\u843D\u70B9\u662F\u94FE\u63A5\uFF08\u5199\u5165\u4F1A\u6539\u5230\u5305\u5185\u5BB9\uFF09");if(E(a,o)){let u=await y(a);return u||(u={source:"dir",origin:a,importedAt:w()},await d(a,u)),{id:s.basename(a),dir:a,relPath:g(a,i),manifest:u,libraryId:r.id,reused:!0,refreshed:!1}}const n=await b(slugifyResourceId(s.basename(a)),o);l(n,o),await D(s.dirname(n),{recursive:!0}),await x(a,n,{recursive:!0});const c={source:"dir",origin:a,importedAt:w()};return await d(n,c),t.libraries.setPath(r.id,g(n,i)),{id:s.basename(n),dir:n,relPath:g(n,i),manifest:c,libraryId:r.id,reused:!1,refreshed:!1}}function z(r){const t=r.split(/[?#]/)[0],i=t.lastIndexOf("/"),e=t.lastIndexOf(":");return(i>e?t.slice(i+1):t.slice(e+1)).replace(/\.git$/,"")||"repo"}function T(r){const t=r,i=[t?.stderr,t?.stdout].filter(Boolean).map(String);return(i.length?i.join(`
-`):r instanceof Error?r.message:String(r)).trim()||"unknown error"}export const defaultGitExec=async(r,t,i)=>{const{stdout:e,stderr:a}=await C(r,t,i);return{stdout:String(e),stderr:String(a)}};
+import{execFile as G}from"node:child_process";import{cp as y,mkdir as D,readdir as M,rename as b,rm as p,stat as B}from"node:fs/promises";import u from"node:path";import{promisify as P}from"node:util";import{getDataRoot as h}from"../db/paths.js";import{isInsideDir as v,toRelPosix as E}from"./resolve.js";import{isBuiltinMarketDir as z}from"./builtin.js";import{marketDir as x,readManifest as F,writeManifest as w}from"./manifest.js";const O=P(G),I=6e4,R=2e3;export function slugifyResourceId(r){const t=r.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"");return/^[a-z0-9][a-z0-9-]*$/.test(t)?t:"resource"}export function assertSafeGitUrl(r){const t=r.trim();if(!t)throw new Error("Missing git URL");if(t.includes("--upload-pack"))throw new Error("Invalid git URL (--upload-pack rejected)");if(!(t.startsWith("https://")||t.startsWith("ssh://")||/^git@[^:/\s]+:/.test(t)))throw new Error(`Unsupported git URL (allowed: https/ssh): ${t}`);if(/[\s\r\n\t]/.test(t))throw new Error("Invalid git URL (whitespace)");return t}function l(){return new Date().toISOString()}function k(r){return r.length>R?`${r.slice(0,R)}\u2026(truncated)`:r}function d(r,t){if(!v(r,t))throw new Error(`Import target escapes the market directory: ${r}`)}async function S(r){try{return await B(r),!0}catch{return!1}}async function A(r,t){let a=u.join(t,r),i=1;for(;await S(a);)i+=1,a=u.join(t,`${r}-${i}`);return a}async function j(r,t){let a;try{a=await M(r,{withFileTypes:!0})}catch{return null}for(const i of a){if(!i.isDirectory())continue;const e=u.join(r,i.name);if((await F(e))?.origin===t)return e}return null}async function g(r,t,a,i,e=!1){const n=a.dataRoot??h(),o=E(r,n),s=a.libraries.add({path:o,kind:"both"});return{id:u.basename(r),dir:r,relPath:o,manifest:t,libraryId:s.id,reused:i,refreshed:e}}async function H(r,t,a){const i=`${t}.refresh-tmp`;await p(i,{recursive:!0,force:!0}),await y(r,i,{recursive:!0}),d(u.resolve(i),a),await p(t,{recursive:!0,force:!0}),await b(i,t)}export async function importFromDir(r,t){const a=t.dataRoot??h(),i=u.resolve(r);if(!(await B(i).catch(()=>null))?.isDirectory())throw new Error(`Not a directory: ${r}`);const e=x(a);if(v(i,e))throw new Error("\u4E0D\u80FD\u628A\u8D44\u6E90\u5E02\u573A\u7684\u5B58\u50A8\u76EE\u5F55\u5F53\u6765\u6E90\u5BFC\u5165\uFF1A\u5176\u4E2D\u7684\u8D44\u6E90\u5DF2\u5728\u5217\u8868\u4E2D\uFF08\u5185\u7F6E\u4ED3\u843D\u70B9 / \u5DF2\u5BFC\u5165\u7684\u526F\u672C\uFF09");const n=await j(e,i);if(n){const c=await F(n);await H(i,n,e);const f={...c,importedAt:l()};return await w(n,f),g(n,f,t,!0,!0)}const o=await A(slugifyResourceId(u.basename(i)),e);d(o,e),await D(u.dirname(o),{recursive:!0}),await y(i,o,{recursive:!0});const s={source:"dir",origin:i,importedAt:l()};return await w(o,s),d(u.resolve(o),e),g(o,s,t,!1)}export async function importFromGit(r,t){const a=t.dataRoot??h(),i=assertSafeGitUrl(r),e=x(a),n=await j(e,i);if(n){const f=await F(n),m=`${n}.refresh-tmp`;await p(m,{recursive:!0,force:!0});const L=["clone","--depth","1",i,m];try{await(t.execGit??defaultGitExec)("git",L,{timeout:I,maxBuffer:4*1024*1024,windowsHide:!0})}catch(U){throw new Error(`git clone failed: ${k(C(U))}`)}d(u.resolve(m),e),await p(n,{recursive:!0,force:!0}),await b(m,n);const $={...f,importedAt:l()};return await w(n,$),g(n,$,t,!0,!0)}const o=await A(slugifyResourceId(T(i)),e);d(o,e),await D(e,{recursive:!0});const s=["clone","--depth","1",i,o];try{await(t.execGit??defaultGitExec)("git",s,{timeout:I,maxBuffer:4*1024*1024,windowsHide:!0})}catch(f){throw new Error(`git clone failed: ${k(C(f))}`)}d(u.resolve(o),e);const c={source:"git",origin:i,importedAt:l()};return await w(o,c),g(o,c,t,!1)}export async function importLibraryIntoMarket(r,t){const a=t.dataRoot??h(),i=u.isAbsolute(r.path)?r.path:u.join(a,r.path),e=u.resolve(i),n=x(a);if(!await S(e))throw new Error(`Source directory not found: ${e}`);if(z(e,a))throw new Error("\u5185\u7F6E\u4ED3\u4E0D\u53EF\u8FC1\u5165\uFF1A\u5B83\u968F\u5305\u53D1\u5E03\u3001\u65E0\u5916\u90E8\u6765\u6E90\uFF0C\u4E14\u843D\u70B9\u662F\u94FE\u63A5\uFF08\u5199\u5165\u4F1A\u6539\u5230\u5305\u5185\u5BB9\uFF09");if(v(e,n)){let c=await F(e);return c||(c={source:"dir",origin:e,importedAt:l()},await w(e,c)),{id:u.basename(e),dir:e,relPath:E(e,a),manifest:c,libraryId:r.id,reused:!0,refreshed:!1}}const o=await A(slugifyResourceId(u.basename(e)),n);d(o,n),await D(u.dirname(o),{recursive:!0}),await y(e,o,{recursive:!0});const s={source:"dir",origin:e,importedAt:l()};return await w(o,s),t.libraries.setPath(r.id,E(o,a)),{id:u.basename(o),dir:o,relPath:E(o,a),manifest:s,libraryId:r.id,reused:!1,refreshed:!1}}function T(r){const t=r.split(/[?#]/)[0],a=t.lastIndexOf("/"),i=t.lastIndexOf(":");return(a>i?t.slice(a+1):t.slice(i+1)).replace(/\.git$/,"")||"repo"}function C(r){const t=r,a=[t?.stderr,t?.stdout].filter(Boolean).map(String);return(a.length?a.join(`
+`):r instanceof Error?r.message:String(r)).trim()||"unknown error"}export const defaultGitExec=async(r,t,a)=>{const{stdout:i,stderr:e}=await O(r,t,a);return{stdout:String(i),stderr:String(e)}};

package/node_modules/@weavecode/server/dist/market/manifest.d.ts

@@ -8,8 +8,8 @@ export interface MarketManifest {
     /** 预留给 git 更新检查（BACKLOG）——当前恒为空。 */
     commit?: string;
 }
-/** 资源市场收纳根：`<getDataDir()>/market/`。 */
-export declare function marketDir(dataDir?: string): string;
+/** 资源市场收纳根：`<dataDir>/data/market/`（随数据迁移）。 */
+export declare function marketDir(dataRoot?: string): string;
 export declare function manifestPath(resourceDir: string): string;
 /** 读清单；缺失或不合法返回 null（legacy 目录没有清单）。 */
 export declare function readManifest(resourceDir: string): Promise<MarketManifest | null>;

package/node_modules/@weavecode/server/dist/market/manifest.js

@@ -1,2 +1,2 @@
-import e from"node:path";import{readFile as n,writeFile as i}from"node:fs/promises";import{getDataDir as o}from"../db/paths.js";export const MANIFEST_FILE=".weave-market.json";export function marketDir(t=o()){return e.join(t,"market")}export function manifestPath(t){return e.join(t,MANIFEST_FILE)}export async function readManifest(t){try{const r=JSON.parse(await n(manifestPath(t),"utf-8"));return r&&typeof r=="object"&&(r.source==="dir"||r.source==="git")?r:null}catch{return null}}export async function writeManifest(t,r){await i(manifestPath(t),`${JSON.stringify(r,null,2)}
+import e from"node:path";import{readFile as n,writeFile as o}from"node:fs/promises";import{getDataRoot as i}from"../db/paths.js";export const MANIFEST_FILE=".weave-market.json";export function marketDir(t=i()){return e.join(t,"market")}export function manifestPath(t){return e.join(t,MANIFEST_FILE)}export async function readManifest(t){try{const r=JSON.parse(await n(manifestPath(t),"utf-8"));return r&&typeof r=="object"&&(r.source==="dir"||r.source==="git")?r:null}catch{return null}}export async function writeManifest(t,r){await o(manifestPath(t),`${JSON.stringify(r,null,2)}
 `,"utf-8")}

package/node_modules/@weavecode/server/dist/market/refresh.d.ts

@@ -15,8 +15,8 @@ export interface RefreshResult {
 }
 export interface RefreshDeps {
     libraries: LibraryRepository;
-    /** 覆盖 dataDir（测试注入）；默认 getDataDir()。 */
-    dataDir?: string;
+    /** 覆盖数据根（测试注入）；默认 getDataRoot()。 */
+    dataRoot?: string;
     /** 覆盖 git 执行（测试注入假 exec）。 */
     execGit?: GitExec;
 }

package/node_modules/@weavecode/server/dist/market/refresh.js

@@ -1 +1 @@
-import{stat as d}from"node:fs/promises";import{defaultGitExec as u,importFromDir as c,importFromGit as f}from"./import.js";import{readManifest as n,writeManifest as m}from"./manifest.js";async function w(t){try{return(await d(t)).isDirectory()}catch{return!1}}export async function refreshMarketItems(t,e){return Promise.all(t.map(async i=>{const r=await n(i.dir);if(!r)return{id:i.id,status:"skipped"};if(r.source==="dir"&&!await w(r.origin))return{id:i.id,status:"origin-missing"};try{if(r.source==="git"){const a=await f(r.origin,e),s=await h(a.dir,e.execGit??u);if(s){const o={...await n(a.dir),commit:s};return await m(a.dir,o),{id:i.id,status:"refreshed",commit:s}}return{id:i.id,status:"refreshed"}}return await c(r.origin,e),{id:i.id,status:"refreshed"}}catch{return{id:i.id,status:"failed"}}}))}async function h(t,e){try{return(await e("git",["-C",t,"rev-parse","HEAD"],{timeout:15e3,maxBuffer:1048576,windowsHide:!0})).stdout.trim()||void 0}catch{return}}
+import{stat as d}from"node:fs/promises";import{defaultGitExec as u,importFromDir as c,importFromGit as m}from"./import.js";import{readManifest as n,writeManifest as f}from"./manifest.js";async function w(i){try{return(await d(i)).isDirectory()}catch{return!1}}export async function refreshMarketItems(i,a){return Promise.all(i.map(async t=>{const r=await n(t.dir);if(!r)return{id:t.id,status:"skipped"};if(r.source==="dir"&&!await w(r.origin))return{id:t.id,status:"origin-missing"};try{if(r.source==="git"){const s=await m(r.origin,a),e=await p(s.dir,a.execGit??u);if(e){const o={...await n(s.dir),commit:e};return await f(s.dir,o),{id:t.id,status:"refreshed",commit:e}}return{id:t.id,status:"refreshed"}}return await c(r.origin,a),{id:t.id,status:"refreshed"}}catch{return{id:t.id,status:"failed"}}}))}async function p(i,a){try{return(await a("git",["-C",i,"rev-parse","HEAD"],{timeout:15e3,maxBuffer:1048576,windowsHide:!0})).stdout.trim()||void 0}catch{return}}