@winspan/claude-forge 8.41.0 → 8.50.6

package/src/web/routes/skills.ts

@@ -0,0 +1,349 @@
+import type { Application } from 'express';
+import fs from 'fs';
+import path from 'path';
+import { homedir } from 'os';
+import { logger } from '../../core/utils/logger.js';
+import type { RouteContext } from './types.js';
+
+/**
+ * /api/skills/* — list, read, update, version, rollback.
+ *
+ * Supports both flat `<name>.md` and directory-style `<name>/SKILL.md` layouts.
+ * Prefers the registry when available so built-in skills resolve correctly.
+ */
+export function registerSkillsRoutes(app: Application, ctx: RouteContext): void {
+  const skillRegistry = ctx.skillRegistry;
+
+  // GET /api/skills — list all skills (official + user; supports flat & directory formats)
+  app.get('/api/skills', (_req, res) => {
+    try {
+      if (skillRegistry) {
+        // Preferred path: reuse SkillRegistry (handles flat .md and <name>/SKILL.md)
+        const skills = skillRegistry.getAll().map(s => ({
+          name: s.name,
+          id: s.id,
+          description: s.description ?? '',
+          keywords: s.keywords,
+          path: s.path,
+          isOfficial: s.isOfficial === true,
+          source: s.isOfficial ? 'official' : 'user',
+        }));
+        res.json({ skills });
+        return;
+      }
+
+      // Fallback: scan directly if registry not injected
+      const skillsDir = path.join(homedir(), '.claude', 'skills');
+      const skills: Array<{
+        name: string;
+        id: string;
+        description: string;
+        keywords: string[];
+        path: string;
+        isOfficial: boolean;
+        source: 'official' | 'user';
+      }> = [];
+
+      if (fs.existsSync(skillsDir)) {
+        const entries = fs.readdirSync(skillsDir, { withFileTypes: true });
+        for (const entry of entries) {
+          let filePath: string | null = null;
+          let id: string;
+
+          if (entry.isFile() && entry.name.endsWith('.md')) {
+            filePath = path.join(skillsDir, entry.name);
+            id = entry.name.replace(/\.md$/, '');
+          } else if (entry.isDirectory() || entry.isSymbolicLink()) {
+            const skillMd = path.join(skillsDir, entry.name, 'SKILL.md');
+            if (!fs.existsSync(skillMd)) continue;
+            filePath = skillMd;
+            id = entry.name;
+          } else {
+            continue;
+          }
+
+          try {
+            const content = fs.readFileSync(filePath, 'utf-8');
+            const match = content.match(/^---\n([\s\S]*?)\n---/);
+            let description = '';
+            const keywords: string[] = [];
+            if (match) {
+              const fm = match[1];
+              const descMatch = fm.match(/description:\s*["']?([^"'\n]+)["']?/);
+              description = descMatch?.[1]?.trim() || '';
+            }
+            skills.push({
+              name: id,
+              id,
+              description,
+              keywords,
+              path: filePath,
+              isOfficial: false,
+              source: 'user',
+            });
+          } catch (err) {
+            logger.warn(`[Web] Failed to read skill ${id}: ${err}`);
+          }
+        }
+      }
+
+      res.json({ skills });
+    } catch (err) {
+      logger.warn(`[Web] Failed to list skills: ${err}`);
+      res.status(500).json({ error: String(err) });
+    }
+  });
+
+  // GET /api/skills/:name — get skill details (supports flat & directory formats)
+  app.get('/api/skills/:name', (req, res) => {
+    try {
+      const { name } = req.params;
+
+      // Security: prevent path traversal attacks
+      if (!name || name.includes('/') || name.includes('\\') || name.includes('..')) {
+        res.status(400).json({ error: 'Invalid skill name' });
+        return;
+      }
+
+      if (skillRegistry) {
+        const skill = skillRegistry.getAll().find(s => s.id === name || s.name === name);
+        if (skill) {
+          if (skill.path === '<built-in>') {
+            res.json({
+              name: skill.name,
+              id: skill.id,
+              description: skill.description ?? '',
+              keywords: skill.keywords,
+              isOfficial: true,
+              source: 'official',
+              content: skill.content,
+            });
+            return;
+          }
+          // For user skills, fall through to disk read so edits show latest content
+          if (fs.existsSync(skill.path)) {
+            const content = fs.readFileSync(skill.path, 'utf-8');
+            res.json({
+              name: skill.name,
+              id: skill.id,
+              description: skill.description ?? '',
+              keywords: skill.keywords,
+              isOfficial: false,
+              source: 'user',
+              path: skill.path,
+              content,
+            });
+            return;
+          }
+        }
+      }
+
+      // Fallback: try flat .md then <name>/SKILL.md
+      const skillsDir = path.join(homedir(), '.claude', 'skills');
+      const flatPath = path.join(skillsDir, `${name}.md`);
+      const dirPath = path.join(skillsDir, name, 'SKILL.md');
+      const filePath = fs.existsSync(flatPath)
+        ? flatPath
+        : fs.existsSync(dirPath)
+          ? dirPath
+          : null;
+
+      if (!filePath) {
+        res.status(404).json({ error: 'Skill not found' });
+        return;
+      }
+
+      const content = fs.readFileSync(filePath, 'utf-8');
+      const match = content.match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/);
+      if (!match) {
+        res.json({ name, id: name, content, path: filePath });
+        return;
+      }
+
+      const fm = match[1];
+      const descMatch = fm.match(/description:\s*["']?([^"'\n]+)["']?/);
+      const verMatch = fm.match(/version:\s*["']?([^"'\n]+)["']?/);
+      const sourceMatch = fm.match(/source:\s*["']?([^"'\n]+)["']?/);
+
+      res.json({
+        name,
+        id: name,
+        description: descMatch?.[1]?.trim() || '',
+        version: verMatch?.[1],
+        source: sourceMatch?.[1] || 'user',
+        path: filePath,
+        content,
+      });
+    } catch (err) {
+      logger.warn(`[Web] Failed to get skill ${req.params.name}: ${err}`);
+      res.status(500).json({ error: String(err) });
+    }
+  });
+
+  // PUT /api/skills/:name — update skill content
+  app.put('/api/skills/:name', (req, res) => {
+    try {
+      const { name } = req.params;
+      const { content } = req.body;
+
+      // Security: prevent path traversal attacks
+      if (!name || name.includes('/') || name.includes('\\') || name.includes('..')) {
+        res.status(400).json({ error: 'Invalid skill name' });
+        return;
+      }
+
+      if (!content || typeof content !== 'string') {
+        res.status(400).json({ error: 'Missing content' });
+        return;
+      }
+
+      const skillsDir = path.join(homedir(), '.claude', 'skills');
+      const filePath = path.join(skillsDir, `${name}.md`);
+
+      if (!fs.existsSync(filePath)) {
+        res.status(404).json({ error: 'Skill not found' });
+        return;
+      }
+
+      const backupDir = path.join(homedir(), '.claude-forge', 'backups', 'skills');
+      fs.mkdirSync(backupDir, { recursive: true });
+      const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
+      const backupPath = path.join(backupDir, `${name}-${timestamp}.md`);
+      fs.copyFileSync(filePath, backupPath);
+
+      fs.writeFileSync(filePath, content, 'utf-8');
+      logger.info(`[Web] Updated skill ${name} (backup: ${backupPath})`);
+
+      res.json({ success: true, backup: backupPath });
+    } catch (err) {
+      logger.warn(`[Web] Failed to update skill ${req.params.name}: ${err}`);
+      res.status(500).json({ error: String(err) });
+    }
+  });
+
+  // GET /api/skills/:name/versions — list backup versions
+  app.get('/api/skills/:name/versions', (req, res) => {
+    try {
+      const { name } = req.params;
+
+      // Security: prevent path traversal attacks
+      if (!name || name.includes('/') || name.includes('\\') || name.includes('..')) {
+        res.status(400).json({ error: 'Invalid skill name' });
+        return;
+      }
+
+      const backupDir = path.join(homedir(), '.claude-forge', 'backups', 'skills');
+
+      if (!fs.existsSync(backupDir)) {
+        res.json({ versions: [] });
+        return;
+      }
+
+      const files = fs.readdirSync(backupDir)
+        .filter(f => f.startsWith(`${name}-`) && f.endsWith('.md'))
+        .map(f => {
+          const filePath = path.join(backupDir, f);
+          const stats = fs.statSync(filePath);
+          const timestampMatch = f.match(/-(\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}-\d{3}Z)\.md$/);
+          return {
+            filename: f,
+            timestamp: timestampMatch ? timestampMatch[1].replace(/-/g, ':').replace(/T(\d{2}):(\d{2}):(\d{2})/, 'T$1:$2:$3') : '',
+            size: stats.size,
+            mtime: stats.mtime.toISOString(),
+          };
+        })
+        .sort((a, b) => new Date(b.mtime).getTime() - new Date(a.mtime).getTime());
+
+      res.json({ versions: files });
+    } catch (err) {
+      logger.warn(`[Web] Failed to list skill versions: ${err}`);
+      res.status(500).json({ error: String(err) });
+    }
+  });
+
+  // GET /api/skills/:name/versions/:timestamp — get specific version content
+  app.get('/api/skills/:name/versions/:timestamp', (req, res) => {
+    try {
+      const { name, timestamp } = req.params;
+
+      // Security: prevent path traversal attacks
+      if (!name || name.includes('/') || name.includes('\\') || name.includes('..')) {
+        res.status(400).json({ error: 'Invalid skill name' });
+        return;
+      }
+      if (!timestamp || timestamp.includes('/') || timestamp.includes('\\') || timestamp.includes('..')) {
+        res.status(400).json({ error: 'Invalid timestamp' });
+        return;
+      }
+
+      const backupDir = path.join(homedir(), '.claude-forge', 'backups', 'skills');
+      const filename = `${name}-${timestamp}.md`;
+      const filePath = path.join(backupDir, filename);
+
+      if (!fs.existsSync(filePath)) {
+        res.status(404).json({ error: 'Version not found' });
+        return;
+      }
+
+      const content = fs.readFileSync(filePath, 'utf-8');
+      res.json({ content });
+    } catch (err) {
+      logger.warn(`[Web] Failed to get skill version: ${err}`);
+      res.status(500).json({ error: String(err) });
+    }
+  });
+
+  // POST /api/skills/:name/rollback — rollback to a specific version
+  app.post('/api/skills/:name/rollback', (req, res) => {
+    try {
+      const { name } = req.params;
+      const { timestamp } = req.body;
+
+      // Security: prevent path traversal attacks
+      if (!name || name.includes('/') || name.includes('\\') || name.includes('..')) {
+        res.status(400).json({ error: 'Invalid skill name' });
+        return;
+      }
+
+      if (!timestamp) {
+        res.status(400).json({ error: 'Missing timestamp' });
+        return;
+      }
+
+      // Security: validate timestamp format
+      if (timestamp.includes('/') || timestamp.includes('\\') || timestamp.includes('..')) {
+        res.status(400).json({ error: 'Invalid timestamp' });
+        return;
+      }
+
+      const skillsDir = path.join(homedir(), '.claude', 'skills');
+      const currentPath = path.join(skillsDir, `${name}.md`);
+      const backupDir = path.join(homedir(), '.claude-forge', 'backups', 'skills');
+      const versionPath = path.join(backupDir, `${name}-${timestamp}.md`);
+
+      if (!fs.existsSync(currentPath)) {
+        res.status(404).json({ error: 'Skill not found' });
+        return;
+      }
+
+      if (!fs.existsSync(versionPath)) {
+        res.status(404).json({ error: 'Version not found' });
+        return;
+      }
+
+      fs.mkdirSync(backupDir, { recursive: true });
+      const rollbackTimestamp = new Date().toISOString().replace(/[:.]/g, '-');
+      const rollbackBackupPath = path.join(backupDir, `${name}-${rollbackTimestamp}.md`);
+      fs.copyFileSync(currentPath, rollbackBackupPath);
+
+      const versionContent = fs.readFileSync(versionPath, 'utf-8');
+      fs.writeFileSync(currentPath, versionContent, 'utf-8');
+
+      logger.info(`[Web] Rolled back skill ${name} to ${timestamp} (backup: ${rollbackBackupPath})`);
+      res.json({ success: true, backup: rollbackBackupPath });
+    } catch (err) {
+      logger.warn(`[Web] Failed to rollback skill: ${err}`);
+      res.status(500).json({ error: String(err) });
+    }
+  });
+}

package/src/web/routes/static.ts

@@ -0,0 +1,67 @@
+import express from 'express';
+import type { Application } from 'express';
+import fs from 'fs';
+import path from 'path';
+import { fileURLToPath } from 'url';
+import { logger } from '../../core/utils/logger.js';
+import type { RouteContext } from './types.js';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+function findStaticDir(): string | null {
+  const candidates = [
+    path.join(__dirname, '..', 'static'),           // dist/web/routes -> dist/web/static
+    path.join(__dirname, '../../..', 'src/web/static'), // dev: src/web/routes -> src/web/static
+  ];
+  return candidates.find(d => fs.existsSync(d)) ?? null;
+}
+
+/**
+ * Static assets — Vite-built UI + cache headers + SPA fallback.
+ *
+ * index.html: no-cache (always fetch latest, avoids stale UI after deploy)
+ * /assets/*:  immutable, content-hashed, safe to cache for a year.
+ *
+ * SPA fallback MUST be registered last so it doesn't shadow any API route;
+ * that constraint is enforced by splitting into `registerStaticAssets` (runs
+ * early, sets up express.static) and `registerStaticFallback` (runs last).
+ */
+export function registerStaticAssets(app: Application, _ctx: RouteContext): void {
+  const staticDir = findStaticDir();
+  if (!staticDir) {
+    logger.warn('[Web] Static directory not found; UI will not be served.');
+    return;
+  }
+
+  app.use(express.static(staticDir, {
+    setHeaders: (res, filePath) => {
+      if (filePath.endsWith('index.html')) {
+        res.setHeader('Cache-Control', 'no-cache, no-store, must-revalidate');
+        res.setHeader('Pragma', 'no-cache');
+        res.setHeader('Expires', '0');
+      } else if (filePath.includes('/assets/')) {
+        res.setHeader('Cache-Control', 'public, max-age=31536000, immutable');
+      }
+    },
+  }));
+
+  app.get('/', (_req, res) => {
+    res.setHeader('Cache-Control', 'no-cache, no-store, must-revalidate');
+    res.sendFile('index.html', { root: staticDir });
+  });
+
+  logger.info(`[Web] Serving static files from ${staticDir}`);
+}
+
+/**
+ * SPA catch-all — must be registered last. Routes any non-/api path to
+ * index.html so the frontend router handles deep links on refresh.
+ */
+export function registerStaticFallback(app: Application, _ctx: RouteContext): void {
+  const staticDir = findStaticDir();
+  if (!staticDir) return;
+  app.get(/^(?!\/api).*$/, (_req, res) => {
+    res.setHeader('Cache-Control', 'no-cache, no-store, must-revalidate');
+    res.sendFile('index.html', { root: staticDir });
+  });
+}

package/src/web/routes/stats.ts

@@ -0,0 +1,60 @@
+import type { Application } from 'express';
+import type { RouteContext } from './types.js';
+
+/**
+ * /api/stats — System-wide statistics for the Dashboard.
+ */
+export function registerStatsRoutes(app: Application, ctx: RouteContext): void {
+  const { storage } = ctx;
+
+  app.get('/api/stats', (_req, res) => {
+    const db = storage.getDatabase();
+
+    const totalEvents = (db.prepare('SELECT COUNT(*) as cnt FROM events').get() as any).cnt;
+    const totalSessions = (db.prepare('SELECT COUNT(*) as cnt FROM sessions').get() as any).cnt;
+
+    // Tool usage distribution
+    const toolRows = db.prepare(
+      `SELECT tool_name, COUNT(*) as cnt FROM events
+       WHERE tool_name IS NOT NULL AND tool_name != ''
+       GROUP BY tool_name ORDER BY cnt DESC LIMIT 15`
+    ).all() as Array<{ tool_name: string; cnt: number }>;
+    const toolUsage: Record<string, number> = {};
+    for (const r of toolRows) {
+      toolUsage[r.tool_name] = r.cnt;
+    }
+
+    // Daily activity (last 7 days)
+    const dailyRows = db.prepare(
+      `SELECT date(timestamp) as d, COUNT(*) as eventCount
+       FROM events
+       WHERE timestamp >= date('now', '-7 days')
+       GROUP BY d ORDER BY d`
+    ).all() as Array<{ d: string; eventCount: number }>;
+
+    const sessionDailyRows = db.prepare(
+      `SELECT date(start_time) as d, COUNT(*) as sessionCount
+       FROM sessions
+       WHERE start_time >= date('now', '-7 days')
+       GROUP BY d ORDER BY d`
+    ).all() as Array<{ d: string; sessionCount: number }>;
+
+    const sessionMap = new Map(sessionDailyRows.map(r => [r.d, r.sessionCount]));
+    const dailyActivity = dailyRows.map(r => ({
+      date: r.d,
+      eventCount: r.eventCount,
+      sessionCount: sessionMap.get(r.d) || 0,
+    }));
+
+    // Skill invocation count
+    const skillCount = (db.prepare('SELECT COUNT(*) as cnt FROM skill_invocations').get() as any)?.cnt ?? 0;
+
+    res.json({
+      totalSessions,
+      totalEvents,
+      toolUsage,
+      dailyActivity,
+      skillInvocations: skillCount,
+    });
+  });
+}

package/src/web/routes/status.ts

@@ -0,0 +1,30 @@
+import type { Application } from 'express';
+import type { RouteContext } from './types.js';
+
+/**
+ * Status / health endpoints for the daemon and background worker.
+ */
+export function registerStatusRoutes(app: Application, ctx: RouteContext): void {
+  const { storage } = ctx;
+
+  // Worker auth probe: legacy endpoint kept for UI backwards-compat.
+  // The background worker subsystem was removed alongside the methodology
+  // system (v8.36.0 hard deprecation B.1); the probe now always reports
+  // unavailable so the UI hides background-mode affordances.
+  app.get('/api/worker-auth-status', (_req, res) => {
+    res.json({
+      available: false,
+      reason: 'background worker subsystem removed (methodology deprecation)',
+    });
+  });
+
+  // Dashboard: daemon status
+  app.get('/api/status', (_req, res) => {
+    res.json({
+      pid: process.pid,
+      uptime: process.uptime(),
+      memory: process.memoryUsage(),
+      eventCount: storage.countEvents(),
+    });
+  });
+}