@yeaft/webchat-agent 0.1.1075 → 0.1.1077

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yeaft/webchat-agent",
-  "version": "0.1.1075",
+  "version": "0.1.1077",
   "description": "Remote agent for Yeaft WebChat — connects worker machines to the central server",
   "main": "index.js",
   "type": "module",

package/yeaft/config.js

@@ -20,6 +20,7 @@
  */
 
 import { existsSync, readFileSync } from 'fs';
+import { homedir } from 'os';
 import { join } from 'path';
 import { DEFAULT_YEAFT_DIR } from './init.js';
 import { getModelEffortOptions, getThinkingCapability, modelSupportsEffort, resolveModel, parseModelRef, normalizeProviderModels, resolveContextWindow, resolveMaxOutputTokens } from './models.js';
@@ -513,13 +514,16 @@ export function loadConfig(overrides = {}) {
 /**
  * Load MCP server configuration.
  *
- * Merges two tiers, in priority order (highest first):
- *   1. global  — ~/.yeaft authoritative config: config.json "mcpServers"
+ * Merges compatibility tiers, in priority order (highest first):
+ *   1. yeaft-global — ~/.yeaft authoritative config: config.json "mcpServers"
  *      array, else standalone ~/.yeaft/mcp.json ({ servers: [...] }).
- *   2. project — `<workDir>/.mcp.json` (Claude Code standard location), so a
- *      project that integrates Claude Code works out of the box. Supplementary:
- *      a project server whose name collides with a global one is dropped (the
- *      explicit ~/.yeaft config wins).
+ *   2. claude-user  — ~/.claude.json (Claude Code user-scope MCP config).
+ *   3. codex-user   — ~/.codex/config.toml (Codex user-scope MCP config).
+ *   4. project      — `<workDir>/.mcp.json` (Claude Code project location)
+ *      plus `<workDir>/.codex/config.toml` (Codex project location).
+ *
+ * Higher tiers win. Borrowed Claude/Codex configs supplement Yeaft, but never
+ * override explicit ~/.yeaft settings.
  *
  * @param {string} yeaftDir
  * @param {object} [jsonConfig] — Already-parsed config.json (optional, avoids re-read)
@@ -527,24 +531,23 @@ export function loadConfig(overrides = {}) {
  * @returns {{ servers: object[], skipped: { name: string, reason: string, source: string }[] }}
  */
 export function loadMCPConfig(yeaftDir, jsonConfig, workDir) {
-  // ── Global tier: ~/.yeaft authoritative config ──
-  const globalServers = loadGlobalMCPServers(yeaftDir, jsonConfig);
-
-  // ── Project tier: <workDir>/.mcp.json (Claude Code standard) ──
+  const yeaftGlobal = loadGlobalMCPServers(yeaftDir, jsonConfig);
+  const externalUser = loadExternalUserMCPServers();
   const project = workDir
     ? loadProjectMCPServers(workDir)
     : { servers: [], skipped: [] };
 
-  // Dedup: global (~/.yeaft explicit config) wins over project supplements.
-  const seen = new Set(globalServers.map(s => s.name));
-  const servers = [...globalServers];
-  for (const s of project.servers) {
-    if (seen.has(s.name)) continue;
-    seen.add(s.name);
-    servers.push(s);
+  const servers = [];
+  const seen = new Set();
+  for (const tier of [yeaftGlobal, externalUser.servers, project.servers]) {
+    for (const s of tier) {
+      if (!s?.name || seen.has(s.name)) continue;
+      seen.add(s.name);
+      servers.push(s);
+    }
   }
 
-  return { servers, skipped: project.skipped };
+  return { servers, skipped: [...externalUser.skipped, ...project.skipped] };
 }
 
 /**
@@ -579,35 +582,27 @@ function loadGlobalMCPServers(yeaftDir, jsonConfig) {
   }
 }
 
-/**
- * Parse a project's Claude Code MCP config at `<workDir>/.mcp.json`.
- *
- * Format (Claude Code standard):
- *   { "mcpServers": { "<name>": { command, args?, env?, url?, type? } } }
- *
- * Only stdio servers (those with a `command`) are adapted into yeaft's
- * { name, command, args?, env? } shape. SSE/HTTP servers (url/type, no
- * command) cannot be spawned by the current MCPManager, so they're reported
- * in `skipped` with reason 'unsupported-transport' rather than silently
- * dropped or surfaced later as spawn failures.
- *
- * Robust by design: a missing file, malformed JSON, or a non-object
- * `mcpServers` field all return gracefully with empty arrays — a broken
- * project `.mcp.json` must never fail session creation.
- *
- * @param {string} workDir — project working directory
- * @returns {{ servers: object[], skipped: { name: string, reason: string, source: string }[] }}
- */
-export function loadProjectMCPServers(workDir) {
-  const empty = { servers: [], skipped: [] };
-  if (!workDir || typeof workDir !== 'string') return empty;
+function normaliseStdioMCPServer(name, raw, source) {
+  if (!name || !raw || typeof raw !== 'object') return { server: null, skipped: null };
+  if (typeof raw.command === 'string' && raw.command.length > 0) {
+    const server = { name, command: raw.command };
+    if (Array.isArray(raw.args)) server.args = raw.args;
+    if (raw.env && typeof raw.env === 'object' && !Array.isArray(raw.env)) server.env = raw.env;
+    return { server, skipped: null };
+  }
+  if (typeof raw.url === 'string' || typeof raw.type === 'string') {
+    return { server: null, skipped: { name, reason: 'unsupported-transport', source } };
+  }
+  return { server: null, skipped: { name, reason: 'invalid-config', source } };
+}
 
-  const mcpPath = join(workDir, '.mcp.json');
-  if (!existsSync(mcpPath)) return empty;
+function loadClaudeMCPJsonFile(filePath, source) {
+  const empty = { servers: [], skipped: [] };
+  if (!filePath || !existsSync(filePath)) return empty;
 
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync(mcpPath, 'utf8'));
+    parsed = JSON.parse(readFileSync(filePath, 'utf8'));
   } catch {
     return empty;
   }
@@ -620,21 +615,189 @@ export function loadProjectMCPServers(workDir) {
   const servers = [];
   const skipped = [];
   for (const [name, raw] of Object.entries(mcpServers)) {
-    if (!name || !raw || typeof raw !== 'object') continue;
-    if (typeof raw.command === 'string' && raw.command.length > 0) {
-      // stdio server → adapt to yeaft shape
-      const server = { name, command: raw.command };
-      if (Array.isArray(raw.args)) server.args = raw.args;
-      if (raw.env && typeof raw.env === 'object') server.env = raw.env;
-      servers.push(server);
-    } else if (typeof raw.url === 'string' || typeof raw.type === 'string') {
-      // SSE/HTTP transport — not spawnable by current MCPManager.
-      skipped.push({ name, reason: 'unsupported-transport', source: '.mcp.json' });
+    const normalised = normaliseStdioMCPServer(name, raw, source);
+    if (normalised.server) servers.push(normalised.server);
+    if (normalised.skipped) skipped.push(normalised.skipped);
+  }
+  return { servers, skipped };
+}
+
+function stripTomlInlineComment(raw) {
+  const text = String(raw || '');
+  let inSingle = false;
+  let inDouble = false;
+  let escaped = false;
+  let depth = 0;
+
+  for (let i = 0; i < text.length; i++) {
+    const ch = text[i];
+    if (inDouble) {
+      if (escaped) {
+        escaped = false;
+      } else if (ch === '\\') {
+        escaped = true;
+      } else if (ch === '"') {
+        inDouble = false;
+      }
+      continue;
+    }
+    if (inSingle) {
+      if (ch === "'") inSingle = false;
+      continue;
+    }
+    if (ch === '"') {
+      inDouble = true;
+      continue;
+    }
+    if (ch === "'") {
+      inSingle = true;
+      continue;
+    }
+    if (ch === '[' || ch === '{') {
+      depth++;
+      continue;
+    }
+    if ((ch === ']' || ch === '}') && depth > 0) {
+      depth--;
+      continue;
+    }
+    if (ch === '#' && depth === 0) return text.slice(0, i).trim();
+  }
+  return text.trim();
+}
+
+function parseTomlValue(raw) {
+  const value = stripTomlInlineComment(raw);
+  if (value.startsWith('"') && value.endsWith('"')) {
+    try { return JSON.parse(value); } catch { return value.slice(1, -1); }
+  }
+  if (value.startsWith("'") && value.endsWith("'")) return value.slice(1, -1);
+  if (value.startsWith('[') && value.endsWith(']')) {
+    try { return JSON.parse(value.replace(/'/g, '"')); } catch { return undefined; }
+  }
+  if (value.startsWith('{') && value.endsWith('}')) {
+    const obj = {};
+    const inner = value.slice(1, -1).trim();
+    if (!inner) return obj;
+    for (const part of inner.split(',')) {
+      const eq = part.indexOf('=');
+      if (eq <= 0) return undefined;
+      const key = part.slice(0, eq).trim().replace(/^['"]|['"]$/g, '');
+      const parsed = parseTomlValue(part.slice(eq + 1));
+      if (!key || parsed === undefined) return undefined;
+      obj[key] = parsed;
+    }
+    return obj;
+  }
+  if (value === 'true') return true;
+  if (value === 'false') return false;
+  return value;
+}
+
+function parseCodexMCPServersToml(content, source) {
+  const rawServers = {};
+  let current = null;
+  for (const line of String(content || '').split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('#')) continue;
+    const section = trimmed.match(/^\[mcp_servers\.("[^"]+"|'[^']+'|[^\].]+)(?:\.(env))?\]$/);
+    if (section) {
+      const name = section[1].replace(/^['"]|['"]$/g, '');
+      rawServers[name] ||= {};
+      current = { name, env: section[2] === 'env' };
+      continue;
+    }
+    if (!current) continue;
+    const eq = trimmed.indexOf('=');
+    if (eq <= 0) continue;
+    const key = trimmed.slice(0, eq).trim();
+    const value = parseTomlValue(trimmed.slice(eq + 1));
+    if (value === undefined) continue;
+    if (current.env) {
+      rawServers[current.name].env ||= {};
+      rawServers[current.name].env[key] = String(value);
+    } else if (key === 'env' && value && typeof value === 'object' && !Array.isArray(value)) {
+      rawServers[current.name].env = Object.fromEntries(Object.entries(value).map(([k, v]) => [k, String(v)]));
     } else {
-      // No command and no url/type — malformed entry.
-      skipped.push({ name, reason: 'invalid-config', source: '.mcp.json' });
+      rawServers[current.name][key] = value;
     }
   }
 
+  const servers = [];
+  const skipped = [];
+  for (const [name, raw] of Object.entries(rawServers)) {
+    const normalised = normaliseStdioMCPServer(name, raw, source);
+    if (normalised.server) servers.push(normalised.server);
+    if (normalised.skipped) skipped.push(normalised.skipped);
+  }
+  return { servers, skipped };
+}
+
+function loadCodexMCPConfigFile(filePath, source) {
+  const empty = { servers: [], skipped: [] };
+  if (!filePath || !existsSync(filePath)) return empty;
+  try {
+    return parseCodexMCPServersToml(readFileSync(filePath, 'utf8'), source);
+  } catch {
+    return empty;
+  }
+}
+
+function mergeMCPConfigResults(results) {
+  const servers = [];
+  const skipped = [];
+  const seen = new Set();
+  for (const result of results) {
+    for (const s of result.servers || []) {
+      if (!s?.name || seen.has(s.name)) continue;
+      seen.add(s.name);
+      servers.push(s);
+    }
+    skipped.push(...(result.skipped || []));
+  }
   return { servers, skipped };
 }
+
+function loadExternalUserMCPServers() {
+  const home = homedir();
+  if (!home) return { servers: [], skipped: [] };
+  return mergeMCPConfigResults([
+    loadClaudeMCPJsonFile(join(home, '.claude.json'), '~/.claude.json'),
+    loadCodexMCPConfigFile(join(home, '.codex', 'config.toml'), '~/.codex/config.toml'),
+  ]);
+}
+
+/**
+ * Parse project-level borrowed MCP configs from `<workDir>/.mcp.json` (Claude
+ * Code) and `<workDir>/.codex/config.toml` (Codex).
+ *
+ * Claude Code format:
+ *   { "mcpServers": { "<name>": { command, args?, env?, url?, type? } } }
+ *
+ * Codex format subset:
+ *   [mcp_servers.<name>]
+ *   command = "..."
+ *   args = ["..."]
+ *
+ * Only stdio servers (those with a `command`) are adapted into yeaft's
+ * { name, command, args?, env? } shape. SSE/HTTP servers (url/type, no
+ * command) cannot be spawned by the current MCPManager, so they're reported
+ * in `skipped` with reason 'unsupported-transport' rather than silently
+ * dropped or surfaced later as spawn failures.
+ *
+ * Robust by design: missing files, malformed JSON/TOML, or non-object
+ * `mcpServers` fields all return gracefully with empty arrays — broken borrowed
+ * configs must never fail session creation.
+ *
+ * @param {string} workDir — project working directory
+ * @returns {{ servers: object[], skipped: { name: string, reason: string, source: string }[] }}
+ */
+export function loadProjectMCPServers(workDir) {
+  const empty = { servers: [], skipped: [] };
+  if (!workDir || typeof workDir !== 'string') return empty;
+
+  return mergeMCPConfigResults([
+    loadClaudeMCPJsonFile(join(workDir, '.mcp.json'), '.mcp.json'),
+    loadCodexMCPConfigFile(join(workDir, '.codex', 'config.toml'), '.codex/config.toml'),
+  ]);
+}

package/yeaft/skills.js

@@ -31,17 +31,23 @@
  *   tier 1 (bundled): wherever yeaft-skills is installed on disk — typically
  *           ~/.claude/skills/yeaft-skills/skills/. Read-only — `save()` and
  *           `remove()` never target this tier.
- *   tier 2 (user):    <yeaftDir>/skills (e.g. ~/.yeaft/skills). User edits
+ *   tier 2 (user-claude): ~/.claude/skills. User-level Claude Code assets,
+ *           loaded read-only for cross-tool compatibility.
+ *   tier 3 (user-codex): ~/.codex/skills. User-level Codex assets, loaded
+ *           read-only for cross-tool compatibility.
+ *   tier 4 (user):    <yeaftDir>/skills (e.g. ~/.yeaft/skills). User edits
  *           land here. `save()` writes here. `init.js` seeds it from tier 1
  *           on first boot so users start with the full bundled set.
- *   tier 3 (project-claude): <workDir>/.claude/skills (if provided). Claude
+ *   tier 5 (project-claude): <workDir>/.claude/skills (if provided). Claude
  *           Code project assets, loaded so a Claude-Code-integrated project
  *           works out of the box. Higher than user (project-local beats
  *           user-global), lower than the yeaft-native project tier.
- *   tier 4 (project): <workDir>/.yeaft/skills (if provided). Highest
+ *   tier 6 (project-codex): <workDir>/.agents/skills (if provided). Codex
+ *           project assets, loaded with the same project-local precedence.
+ *   tier 7 (project): <workDir>/.yeaft/skills (if provided). Highest
  *           priority — a project can pin a skill version without affecting
  *           the user's other projects, and overrides a borrowed
- *           `.claude/skills` skill of the same name.
+ *           `.claude/skills` / `.agents/skills` skill of the same name.
  *
  * Reference: yeaft-yeaft-design.md §8, yeaft-yeaft-core-systems.md
  */
@@ -207,8 +213,19 @@ function listSubdirFiles(dir) {
  * @param {string} [subPath] — relative path from root (for category derivation)
  * @returns {{ skills: Skill[], errors: string[] }}
  */
-function discoverSkills(rootDir, subPath = '') {
+function pathIsInside(childPath, parentPath) {
+  const child = resolve(childPath);
+  const parent = resolve(parentPath);
+  return child === parent || child.startsWith(parent + sep);
+}
+
+function shouldIgnorePath(candidatePath, ignorePaths) {
+  return ignorePaths.some(ignorePath => pathIsInside(candidatePath, ignorePath));
+}
+
+function discoverSkills(rootDir, subPath = '', opts = {}) {
   const dir = subPath ? join(rootDir, subPath) : rootDir;
+  const ignorePaths = Array.isArray(opts.ignorePaths) ? opts.ignorePaths : [];
   const skills = [];
   const errors = [];
 
@@ -226,6 +243,8 @@ function discoverSkills(rootDir, subPath = '') {
     const entryPath = join(dir, entry.name);
     const relPath = subPath ? join(subPath, entry.name) : entry.name;
 
+    if (shouldIgnorePath(entryPath, ignorePaths)) continue;
+
     if (entry.isFile() && entry.name.endsWith('.md') && entry.name !== 'SKILL.md') {
       // Single-file skill (legacy format)
       try {
@@ -272,7 +291,7 @@ function discoverSkills(rootDir, subPath = '') {
         }
       } else {
         // No SKILL.md — treat as category directory, recurse
-        const sub = discoverSkills(rootDir, relPath);
+        const sub = discoverSkills(rootDir, relPath, opts);
         skills.push(...sub.skills);
         errors.push(...sub.errors);
       }
@@ -362,17 +381,22 @@ export class SkillManager {
   /** @type {Map<string, string>} — dir path → tier label */
   #tierByDir;
 
+  /** @type {Map<string, string[]>} — dir path → resolved ignore paths */
+  #ignorePathsByDir;
+
   /**
    * @param {string | string[]} dirs — single directory (back-compat) or array of
    *   directories in priority order (lowest → highest). Falsy entries are
    *   filtered out so callers can write `[bundled, user, projectOrNull]`.
-   * @param {{ userDir?: string, tierByDir?: Record<string, string> }} [opts]
+   * @param {{ userDir?: string, tierByDir?: Record<string, string>, ignorePathsByDir?: Record<string, string[]> }} [opts]
    *   userDir: directory where `save()` and `remove()` write. Defaults to the
    *     last entry in `dirs` (typical case: user dir is highest priority that
    *     isn't a per-project layer).
    *   tierByDir: optional label map — dir path → 'bundled' | 'user' | 'project'.
    *     Decorates each discovered Skill with `_tier` for diagnostics (Settings
    *     UI uses this to show "where this skill came from").
+   *   ignorePathsByDir: optional map of scan dir → subtrees to skip while
+   *     recursively discovering skills in that dir.
    */
   constructor(dirs, opts = {}) {
     const list = Array.isArray(dirs)
@@ -393,6 +417,13 @@ export class SkillManager {
         }
       }
     }
+    this.#ignorePathsByDir = new Map();
+    if (opts && opts.ignorePathsByDir && typeof opts.ignorePathsByDir === 'object') {
+      for (const [d, ignorePaths] of Object.entries(opts.ignorePathsByDir)) {
+        if (typeof d !== 'string' || !Array.isArray(ignorePaths)) continue;
+        this.#ignorePathsByDir.set(d, ignorePaths.filter(p => typeof p === 'string' && p.length > 0).map(p => resolve(p)));
+      }
+    }
   }
 
   /** The user-writable skills directory (save/remove target). */
@@ -425,7 +456,7 @@ export class SkillManager {
 
     for (const dir of this.#skillsDirs) {
       if (!existsSync(dir)) continue;
-      const { skills, errors } = discoverSkills(dir);
+      const { skills, errors } = discoverSkills(dir, '', { ignorePaths: this.#ignorePathsByDir.get(dir) || [] });
       const tier = this.#tierByDir.get(dir) || basename(dir);
       for (const skill of skills) {
         // Platform filtering at load time
@@ -701,14 +732,19 @@ export class SkillManager {
  * Tier order (lowest → highest priority):
  *   1. bundled        — the yeaft-skills package on disk, located via
  *      `bundledYeaftSkillsDir()` (typically ~/.claude/skills/yeaft-skills/skills/).
- *   2. user           — `<yeaftDir>/skills` (e.g. ~/.yeaft/skills). User edits + saves.
- *   3. project-claude — `<workDir>/.claude/skills` when a workDir is provided.
+ *   2. user-claude    — `~/.claude/skills`, read-only borrowed Claude Code assets.
+ *   3. user-codex     — `~/.codex/skills`, read-only borrowed Codex assets.
+ *   4. user           — `<yeaftDir>/skills` (e.g. ~/.yeaft/skills). User edits + saves.
+ *   5. project-claude — `<workDir>/.claude/skills` when a workDir is provided.
  *      Claude Code project assets, loaded so a project that integrates Claude
  *      Code works out of the box. Ranks above `user` (project-local beats
  *      user-global) but below the yeaft-native project tier.
- *   4. project        — `<workDir>/.yeaft/skills` when a workDir is provided.
+ *   6. project-codex  — `<workDir>/.agents/skills` when a workDir is provided.
+ *      Codex project assets, loaded so Codex-integrated repositories work out
+ *      of the box. Same precedence band as project Claude Code assets.
+ *   7. project        — `<workDir>/.yeaft/skills` when a workDir is provided.
  *      Highest priority: a yeaft-native skill pinned in the project overrides
- *      a borrowed `.claude/skills` skill of the same name.
+ *      a borrowed `.claude/skills` / `.agents/skills` skill of the same name.
  *
  * `save()` / `remove()` always target the USER tier, matching Claude Code.
  *
@@ -718,18 +754,32 @@ export class SkillManager {
  */
 export function createSkillManager(yeaftDir, workDir) {
   const bundled = bundledYeaftSkillsDir();
+  const home = homedir();
+  const claudeUserDir = home ? join(home, '.claude', 'skills') : null;
+  const codexUserDir = home ? join(home, '.codex', 'skills') : null;
   const userDir = join(yeaftDir, 'skills');
   const claudeProjectDir = workDir ? join(workDir, '.claude', 'skills') : null;
+  const codexProjectDir = workDir ? join(workDir, '.agents', 'skills') : null;
   const projectDir = workDir ? join(workDir, '.yeaft', 'skills') : null;
 
-  const dirs = [bundled, userDir, claudeProjectDir, projectDir].filter(Boolean);
+  const dirs = [bundled, claudeUserDir, codexUserDir, userDir, claudeProjectDir, codexProjectDir, projectDir].filter(Boolean);
   const tierByDir = {};
   if (bundled) tierByDir[bundled] = 'bundled';
+  if (claudeUserDir) tierByDir[claudeUserDir] = 'user-claude';
+  if (codexUserDir) tierByDir[codexUserDir] = 'user-codex';
   tierByDir[userDir] = 'user';
   if (claudeProjectDir) tierByDir[claudeProjectDir] = 'project-claude';
+  if (codexProjectDir) tierByDir[codexProjectDir] = 'project-codex';
   if (projectDir) tierByDir[projectDir] = 'project';
 
-  const manager = new SkillManager(dirs, { userDir, tierByDir });
+  const ignorePathsByDir = {};
+  if (claudeUserDir && bundled && pathIsInside(bundled, claudeUserDir)) {
+    // Borrowed ~/.claude/skills must not recurse into the Yeaft bundled plugin
+    // package; bundled skills have their own lower-priority tier/provenance.
+    ignorePathsByDir[claudeUserDir] = [join(claudeUserDir, 'yeaft-skills')];
+  }
+
+  const manager = new SkillManager(dirs, { userDir, tierByDir, ignorePathsByDir });
   manager.load();
   return manager;
 }