@winspan/claude-forge 8.41.0 → 8.51.0

package/src/web/routes/sessions.ts

@@ -0,0 +1,250 @@
+import type { Application } from 'express';
+import type { RouteContext } from './types.js';
+import { truncateField } from './_helpers.js';
+import { getCommand, getFilePath, getUserPrompt } from '../../core/event-fields.js';
+
+/**
+ * /api/sessions* — session lists, per-session detail, timeline.
+ *
+ * Also hosts /api/injections since they are session-adjacent views.
+ */
+export function registerSessionsRoutes(app: Application, ctx: RouteContext): void {
+  const { storage } = ctx;
+
+  // Sessions: list with first prompt
+  app.get('/api/sessions', (req, res) => {
+    const limit = parseInt(req.query.limit as string) || 10;
+    const projectPath = req.query.project as string | undefined;
+    const sessions = storage.querySessions({ project_path: projectPath, limit });
+    res.json(sessions);
+  });
+
+  // Injections: query injection history
+  app.get('/api/injections', (req, res) => {
+    const limit = parseInt(req.query.limit as string) || 50;
+    const sessionId = req.query.session as string | undefined;
+    const eventId = req.query.event as string | undefined;
+    const handler = req.query.handler as string | undefined;
+    const injections = storage.queryInjections({
+      session_id: sessionId,
+      event_id: eventId,
+      source_handler: handler,
+      limit,
+    });
+    res.json(injections);
+  });
+
+  // Session Events Search: server-side filtering
+  app.get('/api/sessions/:sessionId/events/search', (req, res) => {
+    const { sessionId } = req.params;
+    const { q, tool_name, hook_type, limit = '100', offset = '0' } = req.query;
+
+    const sessions = storage.querySessions({ limit: 1000 });
+    const session = sessions.find(s => s.session_id === sessionId || s.session_id.startsWith(sessionId));
+
+    if (!session) {
+      res.status(404).json({ error: 'Session not found' });
+      return;
+    }
+
+    const results = storage.searchEvents({
+      session_id: session.session_id,
+      query: q as string | undefined,
+      tool_name: tool_name as string | undefined,
+      hook_type: hook_type as string | undefined,
+      limit: parseInt(limit as string, 10),
+      offset: parseInt(offset as string, 10),
+    });
+
+    res.json({ events: results, total: results.length, session_id: session.session_id });
+  });
+
+  // Session Detail: task-grouped session data
+  app.get('/api/sessions/:sessionId/detail', (req, res) => {
+    const sessionId = req.params.sessionId;
+    const eventLimit = parseInt(req.query.eventLimit as string) || 200;
+    const eventOffset = parseInt(req.query.eventOffset as string) || 0;
+
+    const sessions = storage.querySessions({ limit: 1000 });
+    const session = sessions.find(s => s.session_id === sessionId || s.session_id.startsWith(sessionId));
+    if (!session) {
+      res.status(404).json({ error: 'Session not found' });
+      return;
+    }
+
+    const fullSessionId = session.session_id;
+    const tasks = storage.queryTasks({ session_id: fullSessionId });
+    const totalEvents = storage.countEvents({ session_id: fullSessionId });
+    const allEvents = storage.queryEvents({ session_id: fullSessionId, limit: eventLimit, offset: eventOffset });
+    const allInjections = storage.queryInjections({ session_id: fullSessionId, limit: 200 });
+
+    const buildTaskDetail = (events: typeof allEvents, injections: typeof allInjections) => {
+      const prompts = events
+        .filter(e => e.hook_type === 'UserPromptSubmit' && getUserPrompt(e))
+        .map(e => ({ timestamp: e.timestamp, content: getUserPrompt(e) }));
+
+      const toolUsage: Record<string, number> = {};
+      events.forEach(e => { if (e.tool_name) toolUsage[e.tool_name] = (toolUsage[e.tool_name] || 0) + 1; });
+
+      const filesChanged = [...new Set(
+        events
+          .filter(e => (e.tool_name === 'Edit' || e.tool_name === 'Write') && getFilePath(e))
+          .map(e => getFilePath(e)!),
+      )];
+
+      const commits = events
+        .filter(e => e.tool_name === 'Bash' && getCommand(e)?.includes('git commit'))
+        .map(e => {
+          const cmd = getCommand(e) || '';
+          const match = cmd.match(/git commit.*-m\s+["']([^"']+)["']/);
+          return { timestamp: e.timestamp, message: match ? match[1] : 'commit' };
+        });
+
+      return { prompts, events: events.slice(0, 200), injections, summary: { toolUsage, filesChanged, commits } };
+    };
+
+    if (tasks.length === 0) {
+      const detail = buildTaskDetail(allEvents, allInjections);
+      const virtualTask = {
+        id: 'virtual',
+        session_id: fullSessionId,
+        title: session.first_prompt || '(未分类任务)',
+        start_time: session.start_time,
+        end_time: session.end_time,
+        status: 'completed' as const,
+        event_count: allEvents.length,
+        ...detail,
+      };
+      res.json({ session, tasks: [virtualTask], total_events: totalEvents, event_limit: eventLimit, event_offset: eventOffset });
+      return;
+    }
+
+    const taskDetails = tasks.map(task => {
+      const taskEventIds = new Set(storage.getTaskEventIds(task.id));
+      const events = allEvents.filter(e => taskEventIds.has(e.event_id ?? ''));
+      const injections = allInjections.filter(i => i.event_id && taskEventIds.has(i.event_id));
+      const detail = buildTaskDetail(events, injections);
+      return { ...task, ...detail };
+    });
+
+    res.json({ session, tasks: taskDetails, total_events: totalEvents, event_limit: eventLimit, event_offset: eventOffset });
+  });
+
+  // Session timeline: detailed event timeline for a session
+  app.get('/api/sessions/:id/timeline', (req, res) => {
+    const sessionIdPrefix = req.params.id;
+    const limit = parseInt(req.query.limit as string) || 50;
+    const offset = parseInt(req.query.offset as string) || 0;
+
+    const sessions = storage.querySessions({ limit: 1000 });
+    const session = sessions.find(s => s.session_id.startsWith(sessionIdPrefix));
+
+    if (!session) {
+      res.status(404).json({ error: 'Session not found' });
+      return;
+    }
+
+    const fullSessionId = session.session_id;
+    const events = storage.queryEvents({ session_id: fullSessionId, limit: 2000 });
+    const injections = storage.queryInjections({ session_id: fullSessionId, limit: 200 });
+
+    // Build timeline: merge events and injections, sort by timestamp
+    const timeline: Array<{
+      timestamp: string;
+      type: 'user_input' | 'injection' | 'tool_call' | 'quality_check';
+      data: any;
+    }> = [];
+
+    // User inputs
+    events
+      .filter(e => e.hook_type === 'UserPromptSubmit' && getUserPrompt(e))
+      .forEach(e => {
+        timeline.push({
+          timestamp: e.timestamp,
+          type: 'user_input',
+          data: { content: getUserPrompt(e) },
+        });
+      });
+
+    // Injections (truncate content for preview)
+    injections.forEach(inj => {
+      timeline.push({
+        timestamp: inj.timestamp,
+        type: 'injection',
+        data: {
+          source: inj.source_handler,
+          injection_type: inj.injection_type,
+          content: inj.content.slice(0, 500),
+          length: inj.content.length,
+          truncated: inj.content.length > 500,
+        },
+      });
+    });
+
+    // Tool calls (truncate large fields)
+    events
+      .filter(e => e.tool_name && e.hook_type === 'PreToolUse')
+      .forEach(e => {
+        const toolInput = e.tool_input;
+        const toolOutput = e.tool_output;
+
+        timeline.push({
+          timestamp: e.timestamp,
+          type: 'tool_call',
+          data: {
+            tool: e.tool_name,
+            input: truncateField(toolInput, 200, 5),
+            output: truncateField(toolOutput, 200, 5),
+            success: !toolOutput?.error,
+          },
+        });
+      });
+
+    // Quality checks (from PostToolUse events with quality gate results)
+    events
+      .filter(e => e.hook_type === 'PostToolUse' && (e.tool_output as any)?.quality_check)
+      .forEach(e => {
+        const qc = (e.tool_output as any).quality_check;
+        timeline.push({
+          timestamp: e.timestamp,
+          type: 'quality_check',
+          data: qc,
+        });
+      });
+
+    // Sort by timestamp
+    timeline.sort((a, b) => a.timestamp.localeCompare(b.timestamp));
+
+    // Paginate
+    const total = timeline.length;
+    const paginatedTimeline = timeline.slice(offset, offset + limit);
+
+    // Summary
+    const commits = events
+      .filter(e => e.tool_name === 'Bash' && getCommand(e)?.includes('git commit'))
+      .map(e => {
+        const cmd = getCommand(e) || '';
+        const match = cmd.match(/git commit.*-m\s+["']([^"']+)["']/);
+        return { message: match ? match[1] : 'commit' };
+      });
+
+    const filesChanged = [...new Set(
+      events
+        .filter(e => (e.tool_name === 'Edit' || e.tool_name === 'Write') && getFilePath(e))
+        .map(e => getFilePath(e)!),
+    )];
+
+    res.json({
+      session,
+      timeline: paginatedTimeline,
+      total,
+      offset,
+      limit,
+      hasMore: offset + limit < total,
+      summary: {
+        commits,
+        filesChanged,
+      },
+    });
+  });
+}

package/src/web/routes/skill-stats.ts

@@ -0,0 +1,92 @@
+import type { Application } from 'express';
+import type { RouteContext } from './types.js';
+
+/**
+ * /api/skill-stats/* — Skill usage statistics and analytics
+ *
+ * Provides data for the Skill Statistics dashboard:
+ *   - /api/skill-stats/distribution — routing type distribution (agent/skill/none)
+ *   - /api/skill-stats/frequency — skill usage frequency
+ *   - /api/skill-stats/trend — skill usage rate trend over time
+ *
+ * H1: All endpoints now use storage-layer SQL aggregation (no JS GROUP BY).
+ */
+export function registerSkillStatsRoutes(app: Application, ctx: RouteContext): void {
+  const { storage } = ctx;
+
+  // Routing type distribution (for pie chart)
+  app.get('/api/skill-stats/distribution', (req, res) => {
+    const windowHours = parseInt((req.query.window as string) || '168'); // default 7d
+    const since = Date.now() - windowHours * 3600 * 1000;
+    const agg = storage.aggregateRoutingStats({ since_ts: since });
+
+    // Ensure stable ordering and presence of all three buckets (agent/skill/none)
+    const counts: Record<string, number> = { agent: 0, skill: 0, none: 0 };
+    for (const row of agg.by_type) {
+      counts[row.type] = row.count;
+    }
+    const result = Object.entries(counts).map(([type, count]) => ({ type, count }));
+
+    res.json({ windowHours, distribution: result });
+  });
+
+  // Skill usage frequency (for bar chart)
+  app.get('/api/skill-stats/frequency', (req, res) => {
+    const windowHours = parseInt((req.query.window as string) || '168');
+    const since = Date.now() - windowHours * 3600 * 1000;
+    const agg = storage.aggregateRoutingStats({ since_ts: since });
+
+    const result = agg.by_skill_routed.map(({ skill, count }) => ({ name: skill, count }));
+
+    res.json({ windowHours, frequency: result });
+  });
+
+  // Skill usage rate trend over time (for line chart)
+  app.get('/api/skill-stats/trend', (req, res) => {
+    const windowHours = parseInt((req.query.window as string) || '168');
+    const since = Date.now() - windowHours * 3600 * 1000;
+    const rows = storage.aggregateRoutingTrendByDay({ since_ts: since });
+
+    const result = rows
+      .map(r => ({
+        day: r.day,
+        skillRate: r.total > 0 ? Math.round((r.skill / r.total) * 100) : 0,
+      }))
+      .sort((a, b) => a.day.localeCompare(b.day));
+
+    res.json({ windowHours, trend: result });
+  });
+
+  // Skill invocations from skill_invocations table (real call records)
+  app.get('/api/skill-stats/invocations', (req, res) => {
+    const days = parseInt((req.query.days as string) || '7');
+    const since = Date.now() - days * 24 * 3600 * 1000;
+    const rows = storage.aggregateSkillInvocationsBySkill({ since });
+
+    const total = rows.reduce((sum, r) => sum + r.total, 0);
+    const result = rows.map(r => ({
+      skill_id: r.skill_id,
+      total: r.total,
+      success: r.success,
+      failed: r.failed,
+    }));
+
+    res.json({ days, total, invocations: result });
+  });
+
+  // Routing/Agent call rate stats
+  app.get('/api/routing/stats', (req, res) => {
+    const days = parseInt((req.query.days as string) || '7');
+    const since = Date.now() - days * 24 * 3600 * 1000;
+    const agg = storage.aggregateRoutingStats({ since_ts: since });
+
+    const total = agg.total;
+    const agentCalls = agg.obeyed;
+    const noAgent = total - agentCalls;
+    const agentRate = total > 0 ? Math.round((agentCalls / total) * 1000) / 10 : 0;
+
+    const byAgent = agg.by_agent.map(({ agent, count }) => ({ agent, count }));
+
+    res.json({ days, total, agentCalls, noAgent, agentRate, byAgent });
+  });
+}

package/src/web/routes/skills.ts

@@ -0,0 +1,350 @@
+import type { Application } from 'express';
+import fs from 'fs';
+import path from 'path';
+import { homedir } from 'os';
+import { logger } from '../../core/utils/logger.js';
+import type { RouteContext } from './types.js';
+import { FORGE_PATHS } from '../../core/constants.js';
+
+/**
+ * /api/skills/* — list, read, update, version, rollback.
+ *
+ * Supports both flat `<name>.md` and directory-style `<name>/SKILL.md` layouts.
+ * Prefers the registry when available so built-in skills resolve correctly.
+ */
+export function registerSkillsRoutes(app: Application, ctx: RouteContext): void {
+  const skillRegistry = ctx.skillRegistry;
+
+  // GET /api/skills — list all skills (official + user; supports flat & directory formats)
+  app.get('/api/skills', (_req, res) => {
+    try {
+      if (skillRegistry) {
+        // Preferred path: reuse SkillRegistry (handles flat .md and <name>/SKILL.md)
+        const skills = skillRegistry.getAll().map(s => ({
+          name: s.name,
+          id: s.id,
+          description: s.description ?? '',
+          keywords: s.keywords,
+          path: s.path,
+          isOfficial: s.isOfficial === true,
+          source: s.isOfficial ? 'official' : 'user',
+        }));
+        res.json({ skills });
+        return;
+      }
+
+      // Fallback: scan directly if registry not injected
+      const skillsDir = path.join(homedir(), '.claude', 'skills');
+      const skills: Array<{
+        name: string;
+        id: string;
+        description: string;
+        keywords: string[];
+        path: string;
+        isOfficial: boolean;
+        source: 'official' | 'user';
+      }> = [];
+
+      if (fs.existsSync(skillsDir)) {
+        const entries = fs.readdirSync(skillsDir, { withFileTypes: true });
+        for (const entry of entries) {
+          let filePath: string | null = null;
+          let id: string;
+
+          if (entry.isFile() && entry.name.endsWith('.md')) {
+            filePath = path.join(skillsDir, entry.name);
+            id = entry.name.replace(/\.md$/, '');
+          } else if (entry.isDirectory() || entry.isSymbolicLink()) {
+            const skillMd = path.join(skillsDir, entry.name, 'SKILL.md');
+            if (!fs.existsSync(skillMd)) continue;
+            filePath = skillMd;
+            id = entry.name;
+          } else {
+            continue;
+          }
+
+          try {
+            const content = fs.readFileSync(filePath, 'utf-8');
+            const match = content.match(/^---\n([\s\S]*?)\n---/);
+            let description = '';
+            const keywords: string[] = [];
+            if (match) {
+              const fm = match[1];
+              const descMatch = fm.match(/description:\s*["']?([^"'\n]+)["']?/);
+              description = descMatch?.[1]?.trim() || '';
+            }
+            skills.push({
+              name: id,
+              id,
+              description,
+              keywords,
+              path: filePath,
+              isOfficial: false,
+              source: 'user',
+            });
+          } catch (err) {
+            logger.warn(`[Web] Failed to read skill ${id}: ${err}`);
+          }
+        }
+      }
+
+      res.json({ skills });
+    } catch (err) {
+      logger.warn(`[Web] Failed to list skills: ${err}`);
+      res.status(500).json({ error: String(err) });
+    }
+  });
+
+  // GET /api/skills/:name — get skill details (supports flat & directory formats)
+  app.get('/api/skills/:name', (req, res) => {
+    try {
+      const { name } = req.params;
+
+      // Security: prevent path traversal attacks
+      if (!name || name.includes('/') || name.includes('\\') || name.includes('..')) {
+        res.status(400).json({ error: 'Invalid skill name' });
+        return;
+      }
+
+      if (skillRegistry) {
+        const skill = skillRegistry.getAll().find(s => s.id === name || s.name === name);
+        if (skill) {
+          if (skill.path === '<built-in>') {
+            res.json({
+              name: skill.name,
+              id: skill.id,
+              description: skill.description ?? '',
+              keywords: skill.keywords,
+              isOfficial: true,
+              source: 'official',
+              content: skill.content,
+            });
+            return;
+          }
+          // For user skills, fall through to disk read so edits show latest content
+          if (fs.existsSync(skill.path)) {
+            const content = fs.readFileSync(skill.path, 'utf-8');
+            res.json({
+              name: skill.name,
+              id: skill.id,
+              description: skill.description ?? '',
+              keywords: skill.keywords,
+              isOfficial: false,
+              source: 'user',
+              path: skill.path,
+              content,
+            });
+            return;
+          }
+        }
+      }
+
+      // Fallback: try flat .md then <name>/SKILL.md
+      const skillsDir = path.join(homedir(), '.claude', 'skills');
+      const flatPath = path.join(skillsDir, `${name}.md`);
+      const dirPath = path.join(skillsDir, name, 'SKILL.md');
+      const filePath = fs.existsSync(flatPath)
+        ? flatPath
+        : fs.existsSync(dirPath)
+          ? dirPath
+          : null;
+
+      if (!filePath) {
+        res.status(404).json({ error: 'Skill not found' });
+        return;
+      }
+
+      const content = fs.readFileSync(filePath, 'utf-8');
+      const match = content.match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/);
+      if (!match) {
+        res.json({ name, id: name, content, path: filePath });
+        return;
+      }
+
+      const fm = match[1];
+      const descMatch = fm.match(/description:\s*["']?([^"'\n]+)["']?/);
+      const verMatch = fm.match(/version:\s*["']?([^"'\n]+)["']?/);
+      const sourceMatch = fm.match(/source:\s*["']?([^"'\n]+)["']?/);
+
+      res.json({
+        name,
+        id: name,
+        description: descMatch?.[1]?.trim() || '',
+        version: verMatch?.[1],
+        source: sourceMatch?.[1] || 'user',
+        path: filePath,
+        content,
+      });
+    } catch (err) {
+      logger.warn(`[Web] Failed to get skill ${req.params.name}: ${err}`);
+      res.status(500).json({ error: String(err) });
+    }
+  });
+
+  // PUT /api/skills/:name — update skill content
+  app.put('/api/skills/:name', (req, res) => {
+    try {
+      const { name } = req.params;
+      const { content } = req.body;
+
+      // Security: prevent path traversal attacks
+      if (!name || name.includes('/') || name.includes('\\') || name.includes('..')) {
+        res.status(400).json({ error: 'Invalid skill name' });
+        return;
+      }
+
+      if (!content || typeof content !== 'string') {
+        res.status(400).json({ error: 'Missing content' });
+        return;
+      }
+
+      const skillsDir = path.join(homedir(), '.claude', 'skills');
+      const filePath = path.join(skillsDir, `${name}.md`);
+
+      if (!fs.existsSync(filePath)) {
+        res.status(404).json({ error: 'Skill not found' });
+        return;
+      }
+
+      const backupDir = FORGE_PATHS.backups('skills');
+      fs.mkdirSync(backupDir, { recursive: true });
+      const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
+      const backupPath = path.join(backupDir, `${name}-${timestamp}.md`);
+      fs.copyFileSync(filePath, backupPath);
+
+      fs.writeFileSync(filePath, content, 'utf-8');
+      logger.info(`[Web] Updated skill ${name} (backup: ${backupPath})`);
+
+      res.json({ success: true, backup: backupPath });
+    } catch (err) {
+      logger.warn(`[Web] Failed to update skill ${req.params.name}: ${err}`);
+      res.status(500).json({ error: String(err) });
+    }
+  });
+
+  // GET /api/skills/:name/versions — list backup versions
+  app.get('/api/skills/:name/versions', (req, res) => {
+    try {
+      const { name } = req.params;
+
+      // Security: prevent path traversal attacks
+      if (!name || name.includes('/') || name.includes('\\') || name.includes('..')) {
+        res.status(400).json({ error: 'Invalid skill name' });
+        return;
+      }
+
+      const backupDir = FORGE_PATHS.backups('skills');
+
+      if (!fs.existsSync(backupDir)) {
+        res.json({ versions: [] });
+        return;
+      }
+
+      const files = fs.readdirSync(backupDir)
+        .filter(f => f.startsWith(`${name}-`) && f.endsWith('.md'))
+        .map(f => {
+          const filePath = path.join(backupDir, f);
+          const stats = fs.statSync(filePath);
+          const timestampMatch = f.match(/-(\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}-\d{3}Z)\.md$/);
+          return {
+            filename: f,
+            timestamp: timestampMatch ? timestampMatch[1].replace(/-/g, ':').replace(/T(\d{2}):(\d{2}):(\d{2})/, 'T$1:$2:$3') : '',
+            size: stats.size,
+            mtime: stats.mtime.toISOString(),
+          };
+        })
+        .sort((a, b) => new Date(b.mtime).getTime() - new Date(a.mtime).getTime());
+
+      res.json({ versions: files });
+    } catch (err) {
+      logger.warn(`[Web] Failed to list skill versions: ${err}`);
+      res.status(500).json({ error: String(err) });
+    }
+  });
+
+  // GET /api/skills/:name/versions/:timestamp — get specific version content
+  app.get('/api/skills/:name/versions/:timestamp', (req, res) => {
+    try {
+      const { name, timestamp } = req.params;
+
+      // Security: prevent path traversal attacks
+      if (!name || name.includes('/') || name.includes('\\') || name.includes('..')) {
+        res.status(400).json({ error: 'Invalid skill name' });
+        return;
+      }
+      if (!timestamp || timestamp.includes('/') || timestamp.includes('\\') || timestamp.includes('..')) {
+        res.status(400).json({ error: 'Invalid timestamp' });
+        return;
+      }
+
+      const backupDir = FORGE_PATHS.backups('skills');
+      const filename = `${name}-${timestamp}.md`;
+      const filePath = path.join(backupDir, filename);
+
+      if (!fs.existsSync(filePath)) {
+        res.status(404).json({ error: 'Version not found' });
+        return;
+      }
+
+      const content = fs.readFileSync(filePath, 'utf-8');
+      res.json({ content });
+    } catch (err) {
+      logger.warn(`[Web] Failed to get skill version: ${err}`);
+      res.status(500).json({ error: String(err) });
+    }
+  });
+
+  // POST /api/skills/:name/rollback — rollback to a specific version
+  app.post('/api/skills/:name/rollback', (req, res) => {
+    try {
+      const { name } = req.params;
+      const { timestamp } = req.body;
+
+      // Security: prevent path traversal attacks
+      if (!name || name.includes('/') || name.includes('\\') || name.includes('..')) {
+        res.status(400).json({ error: 'Invalid skill name' });
+        return;
+      }
+
+      if (!timestamp) {
+        res.status(400).json({ error: 'Missing timestamp' });
+        return;
+      }
+
+      // Security: validate timestamp format
+      if (timestamp.includes('/') || timestamp.includes('\\') || timestamp.includes('..')) {
+        res.status(400).json({ error: 'Invalid timestamp' });
+        return;
+      }
+
+      const skillsDir = path.join(homedir(), '.claude', 'skills');
+      const currentPath = path.join(skillsDir, `${name}.md`);
+      const backupDir = FORGE_PATHS.backups('skills');
+      const versionPath = path.join(backupDir, `${name}-${timestamp}.md`);
+
+      if (!fs.existsSync(currentPath)) {
+        res.status(404).json({ error: 'Skill not found' });
+        return;
+      }
+
+      if (!fs.existsSync(versionPath)) {
+        res.status(404).json({ error: 'Version not found' });
+        return;
+      }
+
+      fs.mkdirSync(backupDir, { recursive: true });
+      const rollbackTimestamp = new Date().toISOString().replace(/[:.]/g, '-');
+      const rollbackBackupPath = path.join(backupDir, `${name}-${rollbackTimestamp}.md`);
+      fs.copyFileSync(currentPath, rollbackBackupPath);
+
+      const versionContent = fs.readFileSync(versionPath, 'utf-8');
+      fs.writeFileSync(currentPath, versionContent, 'utf-8');
+
+      logger.info(`[Web] Rolled back skill ${name} to ${timestamp} (backup: ${rollbackBackupPath})`);
+      res.json({ success: true, backup: rollbackBackupPath });
+    } catch (err) {
+      logger.warn(`[Web] Failed to rollback skill: ${err}`);
+      res.status(500).json({ error: String(err) });
+    }
+  });
+}