@yottameta/yotta-skills-plugin 0.19.16 → 0.19.18

package/skills/yotta-skills/lib/install-snapshot.js

@@ -0,0 +1,245 @@
+'use strict';
+const crypto = require('crypto');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const scanLib = require('./skills-scan');
+
+function nowTag() {
+  return new Date().toISOString().replace(/[:.]/g, '-');
+}
+
+function snapshotRoot(homeDir, slug) {
+  return path.join(homeDir || os.homedir(), '.yottaskills', 'snapshots', slug);
+}
+
+function copyTree(src, dst) {
+  fs.rmSync(dst, { recursive: true, force: true });
+  fs.mkdirSync(dst, { recursive: true });
+  for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
+    const from = path.join(src, entry.name);
+    const to = path.join(dst, entry.name);
+    if (entry.isDirectory()) copyTree(from, to);
+    else if (entry.isFile()) fs.copyFileSync(from, to);
+  }
+}
+
+function renameWithRetry(from, to, options) {
+  const rename = (options && options.rename) || fs.renameSync;
+  let lastError;
+  for (let attempt = 0; attempt < 5; attempt++) {
+    try {
+      return rename(from, to);
+    } catch (error) {
+      lastError = error;
+      if (!['EPERM', 'EACCES', 'EBUSY'].includes(error.code) || attempt === 4) throw error;
+    }
+  }
+  throw lastError;
+}
+
+function walkFiles(root, current, output) {
+  const dir = current || root;
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) walkFiles(root, full, output);
+    else if (entry.isFile()) output.push(full);
+  }
+}
+
+function computeTreeDigest(root) {
+  const files = [];
+  walkFiles(path.resolve(root), null, files);
+  files.sort((a, b) => path.relative(root, a).localeCompare(path.relative(root, b)));
+  const hash = crypto.createHash('sha256');
+  for (const file of files) {
+    const relative = path.relative(root, file).replace(/\\/g, '/');
+    hash.update(relative, 'utf8');
+    hash.update('\0', 'utf8');
+    hash.update(fs.readFileSync(file));
+    hash.update('\0', 'utf8');
+  }
+  return { digest: hash.digest('hex'), files };
+}
+
+function writeJsonAtomic(file, value) {
+  const tmp = file + '.tmp-' + process.pid;
+  fs.writeFileSync(tmp, JSON.stringify(value, null, 2) + '\n', 'utf8');
+  fs.renameSync(tmp, file);
+}
+
+function readVersion(root) {
+  try {
+    const fm = scanLib.parseFrontmatter(fs.readFileSync(path.join(root, 'SKILL.md'), 'utf8'));
+    return fm && fm.version ? String(fm.version).trim() : null;
+  } catch (_) {
+    return null;
+  }
+}
+
+function validateSnapshot(snapshot) {
+  const root = path.resolve(snapshot || '');
+  if (!snapshot || !fs.existsSync(root)) {
+    return { ok: false, version: null, digest: null, legacy: false, reason: '快照目录不存在' };
+  }
+  if (!fs.statSync(root).isDirectory()) {
+    return { ok: false, version: null, digest: null, legacy: false, reason: '快照不是目录' };
+  }
+  const metaFile = root + '.meta.json';
+  if (fs.existsSync(metaFile)) {
+    let metadata;
+    try {
+      metadata = JSON.parse(fs.readFileSync(metaFile, 'utf8'));
+    } catch (error) {
+      return { ok: false, version: null, digest: null, legacy: false, reason: '快照元数据无法解析: ' + error.message };
+    }
+    let current;
+    try {
+      current = computeTreeDigest(root);
+    } catch (error) {
+      return { ok: false, version: metadata.version || null, digest: metadata.digest || null, legacy: false, reason: '快照不可读: ' + error.message };
+    }
+    if (!metadata.digest || current.digest !== metadata.digest) {
+      return {
+        ok: false,
+        version: metadata.version || readVersion(root),
+        digest: metadata.digest || null,
+        legacy: false,
+        reason: '快照摘要不一致，可能已被修改',
+      };
+    }
+    return {
+      ok: true,
+      version: metadata.version || readVersion(root),
+      digest: metadata.digest,
+      legacy: false,
+      reason: null,
+    };
+  }
+
+  const version = readVersion(root);
+  if (!fs.existsSync(path.join(root, 'SKILL.md'))) {
+    return { ok: false, version, digest: null, legacy: true, reason: '旧快照缺少 SKILL.md' };
+  }
+  return { ok: true, version, digest: null, legacy: true, reason: null };
+}
+
+function createSnapshot(target, options) {
+  const opts = options || {};
+  if (!target || !fs.existsSync(target) || !fs.statSync(target).isDirectory()) {
+    throw new Error('无法创建快照：目标目录不存在');
+  }
+  const slug = opts.slug || path.basename(target);
+  const root = snapshotRoot(opts.homeDir, slug);
+  fs.mkdirSync(root, { recursive: true });
+  const version = opts.version || readVersion(target) || 'unknown';
+  const snapshot = fs.mkdtempSync(path.join(root, nowTag() + '-' + version + '-'));
+  const copyDir = opts.copyDir || copyTree;
+  try {
+    copyDir(target, snapshot);
+    const integrity = computeTreeDigest(snapshot);
+    const metadata = {
+      schema: 1,
+      slug,
+      version,
+      created_at: new Date().toISOString(),
+      source: path.resolve(target),
+      digest: integrity.digest,
+      files: integrity.files.length,
+    };
+    writeJsonAtomic(snapshot + '.meta.json', metadata);
+    return {
+      path: snapshot,
+      version,
+      digest: integrity.digest,
+      files: integrity.files.length,
+      metadata,
+    };
+  } catch (error) {
+    fs.rmSync(snapshot, { recursive: true, force: true });
+    throw error;
+  }
+}
+
+function listSnapshots(homeDir, slug) {
+  const roots = [];
+  if (slug) {
+    roots.push({ slug, dir: snapshotRoot(homeDir, slug) });
+  } else {
+    const base = path.join(homeDir || os.homedir(), '.yottaskills', 'snapshots');
+    if (fs.existsSync(base)) {
+      for (const entry of fs.readdirSync(base, { withFileTypes: true })) {
+        if (entry.isDirectory()) roots.push({ slug: entry.name, dir: path.join(base, entry.name) });
+      }
+    }
+  }
+
+  const rows = [];
+  for (const root of roots) {
+    if (!fs.existsSync(root.dir)) continue;
+    for (const entry of fs.readdirSync(root.dir, { withFileTypes: true })) {
+      if (!entry.isDirectory()) continue;
+      const snapshot = path.join(root.dir, entry.name);
+      const validation = validateSnapshot(snapshot);
+      let mtimeMs = 0;
+      try { mtimeMs = fs.statSync(snapshot).mtimeMs; } catch (_) { /* keep 0 */ }
+      rows.push({
+        path: snapshot,
+        name: entry.name,
+        slug: root.slug,
+        valid: validation.ok,
+        version: validation.version,
+        legacy: validation.legacy,
+        reason: validation.reason,
+        mtime_ms: mtimeMs,
+      });
+    }
+  }
+  rows.sort((a, b) => (b.mtime_ms - a.mtime_ms) || b.name.localeCompare(a.name));
+  return rows;
+}
+
+function restoreSnapshot(snapshot, target, options) {
+  const validation = validateSnapshot(snapshot);
+  if (!validation.ok) {
+    return { ok: false, version: validation.version, error: validation.reason || '快照校验失败' };
+  }
+  const opts = options || {};
+  const destination = path.dirname(path.resolve(target));
+  const base = path.basename(path.resolve(target));
+  const copyDir = opts.copyDir || copyTree;
+  const staging = path.join(destination, '.yottaskills-rollback-' + base + '-' + process.pid + '-' + Date.now());
+  const backup = path.join(destination, '.yottaskills-rollback-backup-' + base + '-' + process.pid + '-' + Date.now());
+  let movedCurrent = false;
+  try {
+    fs.mkdirSync(destination, { recursive: true });
+    copyDir(snapshot, staging);
+    if (fs.existsSync(target)) {
+      renameWithRetry(target, backup, opts);
+      movedCurrent = true;
+    }
+    renameWithRetry(staging, target, opts);
+    if (movedCurrent && fs.existsSync(backup)) fs.rmSync(backup, { recursive: true, force: true });
+    return { ok: true, version: validation.version, error: null, snapshot };
+  } catch (error) {
+    try {
+      if (fs.existsSync(target) && movedCurrent) fs.rmSync(target, { recursive: true, force: true });
+      if (movedCurrent && fs.existsSync(backup)) renameWithRetry(backup, target, opts);
+    } catch (_) {
+      // Preserve both the failure and any recovered tree for manual inspection.
+    }
+    if (fs.existsSync(staging)) fs.rmSync(staging, { recursive: true, force: true });
+    return { ok: false, version: validation.version, error: error.message, snapshot };
+  }
+}
+
+module.exports = {
+  snapshotRoot,
+  copyTree,
+  computeTreeDigest,
+  createSnapshot,
+  validateSnapshot,
+  listSnapshots,
+  restoreSnapshot,
+  renameWithRetry,
+};

package/skills/yotta-skills/lib/manifest.js

@@ -0,0 +1,136 @@
+'use strict';
+const fs = require('fs');
+const path = require('path');
+
+const MANIFEST_FILE = 'skill-manifest.json';
+
+function defaultManifest(skill) {
+  return {
+    manifestVersion: 1,
+    slug: skill.slug,
+    name: skill.name,
+    package: skill.pkg,
+    version: skill.version,
+    trust: 'yottameta',
+    install: {
+      idempotent: true,
+      network: 'registry',
+    },
+    permissions: {
+      filesystem: 'user-skills-dir',
+      network: 'registry',
+      process: 'child-process',
+      note: '仅调用本包内安装与自检脚本；默认无自定义脚本。',
+    },
+    auto_apply: {
+      mode: 'route',
+      note: '元阁只给路由建议；安装与调用均由用户确认后执行，不自动调用。',
+    },
+  };
+}
+
+function readJson(file) {
+  return JSON.parse(fs.readFileSync(file, 'utf8'));
+}
+
+function readSkillVersion(pkgDir) {
+  try {
+    const text = fs.readFileSync(path.join(pkgDir, 'SKILL.md'), 'utf8');
+    const match = text.match(/^version:\s*([0-9]+\.[0-9]+\.[0-9]+)/m);
+    return match ? match[1] : null;
+  } catch (_) {
+    return null;
+  }
+}
+
+function isSafeRelativePath(value) {
+  if (typeof value !== 'string' || value.trim() === '') return false;
+  if (path.isAbsolute(value) || /^[A-Za-z]:[\\/]/.test(value)) return false;
+  const parts = value.split(/[\\/]+/);
+  return !parts.includes('..');
+}
+
+function validateManifest(manifest, context) {
+  const errors = [];
+  const skill = context.skill;
+  const pkgDir = context.pkgDir;
+  const required = ['manifestVersion', 'slug', 'name', 'package', 'version', 'trust', 'install', 'permissions'];
+  for (const key of required) {
+    if (manifest[key] === undefined) errors.push('缺少字段: ' + key);
+  }
+  if (manifest.manifestVersion !== 1) errors.push('manifestVersion 必须为 1');
+  if (manifest.slug !== skill.slug) errors.push('slug 与清单不一致');
+  if (manifest.package !== skill.pkg) errors.push('package 与清单不一致');
+  if (!/^[a-z0-9][a-z0-9-]*$/.test(String(manifest.slug || ''))) errors.push('slug 格式非法');
+  if (!/^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?$/.test(String(manifest.version || ''))) {
+    errors.push('version 格式非法');
+  }
+  if (!['yottameta', 'third-party-verified', 'unknown'].includes(manifest.trust)) errors.push('trust 非法');
+  if (!manifest.install || manifest.install.idempotent !== true) errors.push('install.idempotent 必须为 true');
+  if (!manifest.permissions || typeof manifest.permissions !== 'object') errors.push('permissions 缺失');
+  if (manifest.permissions && !['none', 'user-skills-dir', 'project-dir', 'user-config', 'other'].includes(manifest.permissions.filesystem)) {
+    errors.push('permissions.filesystem 非法');
+  }
+  if (manifest.permissions && !['none', 'registry', 'allowlist', 'other'].includes(manifest.permissions.network)) {
+    errors.push('permissions.network 非法');
+  }
+
+  let packageMeta = null;
+  const packageJsonPath = path.join(pkgDir, 'package.json');
+  if (fs.existsSync(packageJsonPath)) {
+    try {
+      packageMeta = readJson(packageJsonPath);
+    } catch (error) {
+      errors.push('无法读取 package.json: ' + error.message);
+    }
+  } else if (context.requirePackageJson !== false) {
+    errors.push('无法读取 package.json: 文件不存在');
+  }
+  if (packageMeta && packageMeta.name !== skill.pkg) errors.push('package.json.name 与清单不一致');
+  if (packageMeta && packageMeta.version !== manifest.version) {
+    errors.push('package.json.version 与 manifest.version 不一致');
+  }
+  const skillVersion = readSkillVersion(pkgDir);
+  if (skillVersion !== manifest.version) errors.push('SKILL.md.version 与 manifest.version 不一致');
+  for (const key of ['setup', 'doctor', 'rollback']) {
+    const rel = manifest.install && manifest.install[key];
+    if (rel !== undefined && !isSafeRelativePath(rel)) errors.push('install.' + key + ' 路径不安全');
+  }
+  return { ok: errors.length === 0, errors };
+}
+
+function loadManifest(context) {
+  const file = path.join(context.pkgDir, MANIFEST_FILE);
+  if (!fs.existsSync(file)) {
+    return {
+      manifest: defaultManifest(context.skill),
+      source: 'family-default',
+      errors: [],
+    };
+  }
+
+  let value;
+  try {
+    value = readJson(file);
+  } catch (error) {
+    return {
+      manifest: null,
+      source: 'package',
+      errors: ['无法解析 skill-manifest.json: ' + error.message],
+    };
+  }
+  const validation = validateManifest(value, context);
+  return {
+    manifest: value,
+    source: 'package',
+    errors: validation.errors,
+  };
+}
+
+module.exports = {
+  MANIFEST_FILE,
+  defaultManifest,
+  loadManifest,
+  validateManifest,
+  isSafeRelativePath,
+};

package/skills/yotta-skills/lib/route.js

@@ -0,0 +1,240 @@
+'use strict';
+
+const PLAYBOOKS = [
+  {
+    id: 'output-standard',
+    name: '输出呈现标准',
+    intent: '让输出先判型渲染为可复制格式，再去除 AI 味。',
+    keywords: ['输出', '呈现', '渲染', '排版', '可复制', 'AI味', 'AI 味', '润色', '文档', '报告'],
+    skills: [
+      { slug: 'yotta-present', order: 1, role: '判断内容形态并渲染为可复制 Markdown / 纯文本。' },
+      { slug: 'yotta-humanize', order: 2, role: '检测中文 AI 腔，并按用户原意做确定性改写。' },
+    ],
+  },
+  {
+    id: 'long-lived-agent',
+    name: '长生命周期智能体',
+    intent: '让智能体跨会话恢复状态、记忆、经验与历史。',
+    keywords: ['长期', '跨会话', '忘了我', '别忘了我', '记忆', '上下文', '状态', '历史'],
+    skills: [
+      { slug: 'yotta-workflow', order: 1, role: '开工读取项目状态，会话结束更新状态并留下次接续记录。' },
+      { slug: 'yotta-memory', order: 2, role: '按权限边界保存与恢复跨会话记忆。' },
+      { slug: 'yotta-learn', order: 3, role: '沉淀错误、纠正与洞见，供后续会话复用。' },
+      { slug: 'yotta-logs', order: 4, role: '按需检索历史会话与日志记录。' },
+    ],
+  },
+  {
+    id: 'delivery-quality-gate',
+    name: '交付质量门',
+    intent: '交付前做防敷衍、代码质量与发布守门检查。',
+    keywords: ['检查', '代码', '质量', '别糊弄', '敷衍', '评审', '发布', '守门', '交付'],
+    skills: [
+      { slug: 'yotta-anti-shallow', order: 1, role: '强制先分析、再执行、后自检，防止表面化交付。' },
+      { slug: 'yotta-code-quality', order: 2, role: '按十二类腐化风险做结对式代码质量评审。' },
+      { slug: 'yotta-publish-guard', order: 3, role: '发布前校验版本、发布件与分发通道一致性。' },
+    ],
+  },
+  {
+    id: 'preinstall-security-gate',
+    name: '装前安全门',
+    intent: '安装其他来源技能、插件或 MCP 前做安全判定。',
+    keywords: ['安装', '装前', '其他来源', '技能', '插件', 'MCP', '安全扫描'],
+    skills: [
+      { slug: 'yotta-verify', order: 1, role: '执行确定性装前扫描并给出安全判定。' },
+      { slug: 'yotta-vetter', order: 2, role: '按四阶段协议审查来源、代码、权限与风险。' },
+      { slug: 'yotta-security-audit', order: 3, role: '做深度静态检测与安全基线兜底。' },
+    ],
+  },
+  {
+    id: 'skill-build-publish',
+    name: '造技能 / 发版',
+    intent: '创建合规技能包，并在发布前完成守门检查。',
+    keywords: ['造一个', '新 skill', '新技能', '脚手架', '发版', '发布技能', '技能包'],
+    skills: [
+      { slug: 'yotta-skill-creator', order: 1, role: '生成符合规范的技能目录与发布件结构。' },
+      { slug: 'yotta-publish-guard', order: 2, role: '校验版本四件、发布件与分发通道。' },
+    ],
+  },
+  {
+    id: 'security-incident-response',
+    name: '安全事件响应',
+    intent: '从日志、情报、样本、密钥、供应链与资产侦察看清事件链路。',
+    keywords: ['日志', '攻击', '安全事件', '入侵', 'IOC', '威胁情报', '样本', '密钥泄露', '供应链', '资产', '侦察'],
+    skills: [
+      { slug: 'yotta-logwatch', order: 1, role: '分析安全日志并识别攻击链与告警聚合。' },
+      { slug: 'yotta-intel', order: 2, role: '提取、去武器化并规范化威胁情报 IOC。' },
+      { slug: 'yotta-triage', order: 3, role: '对可疑样本做静态初筛。' },
+      { slug: 'yotta-secret', order: 4, role: '扫描密钥与凭据泄露源头。' },
+      { slug: 'yotta-chain', order: 5, role: '校验依赖供应链与 lockfile 一致性。' },
+      { slug: 'yotta-recon', order: 6, role: '在授权范围内做端口、服务与版本指纹侦察。' },
+    ],
+  },
+  {
+    id: 'entry-install',
+    name: '入口 + 安装',
+    intent: '需求方向不明确时先澄清意图，再按需安装合适技能。',
+    keywords: ['不知道用哪个', '需求模糊', '该用哪个', '怎么说', '技能该用哪个'],
+    skills: [
+      { slug: 'yotta-prompt', order: 1, role: '澄清需求意图并串联到合适的技能方向。' },
+      { slug: 'yotta-skills', order: 2, role: '按场景组合安装所需技能，不默认安装全家。' },
+    ],
+  },
+];
+
+const OTHER_SKILLS_NOTE = '其他已装技能仅作并列候选提示：机械匹配 frontmatter description，未做语义推理、未读取全文指令、未自动调用；数据不出本机。';
+const OTHER_SKILL_NOTE = '非元阁家族技能：仅按 frontmatter description 本地机械匹配；不读取全文指令、不自动调用；使用/安装前请先做装前安全扫描。';
+const EN_STOPWORDS = new Set([
+  'a', 'an', 'the', 'and', 'or', 'of', 'to', 'in', 'on', 'for', 'with', 'from',
+  'this', 'that', 'is', 'are', 'was', 'were', 'be', 'been', 'your', 'you', 'our',
+  'we', 'it', 'at', 'by', 'as', 'not', 'no', 'so', 'do', 'does',
+]);
+
+/** 元阁家族 slug 集合：playbook 引用 + 已知不入 playbook 的元技能（如 yotta-chart）。 */
+function defaultYottaSlugs() {
+  const set = new Set(['yotta-chart']);
+  for (const playbook of PLAYBOOKS) {
+    for (const skill of playbook.skills) set.add(skill.slug);
+  }
+  return Array.from(set);
+}
+
+/** 英文词项：≥3 字母的单词，过滤停用词（保留出现顺序、去重）。 */
+function enTokens(text) {
+  const tokens = [];
+  const seen = new Set();
+  for (const m of String(text || '').toLowerCase().match(/[a-z][a-z0-9]{2,}/g) || []) {
+    if (EN_STOPWORDS.has(m) || seen.has(m)) continue;
+    seen.add(m);
+    tokens.push(m);
+  }
+  return tokens;
+}
+
+/** 中文词项：CJK 连续片段内相邻两字 bigram（零依赖确定性分词）。 */
+function cjkBigrams(text) {
+  const bigrams = [];
+  const seen = new Set();
+  for (const m of String(text || '').match(/[\u4e00-\u9fff]+/g) || []) {
+    for (let i = 0; i < m.length - 1; i++) {
+      const g = m.slice(i, i + 2);
+      if (seen.has(g)) continue;
+      seen.add(g);
+      bigrams.push(g);
+    }
+  }
+  return bigrams;
+}
+
+/** 需求与候选文本的词项匹配：英文 token + 中文 bigram 交集，按需求侧出现顺序输出。 */
+function scoreOtherSkill(request, record) {
+  const candidateText = [record.description, record.slug].filter(Boolean).join(' ');
+  const reqTokens = enTokens(request);
+  const reqBigrams = cjkBigrams(request);
+  const candTokens = new Set(enTokens(candidateText));
+  const candBigrams = new Set(cjkBigrams(candidateText));
+  const matched = [];
+  for (const item of reqTokens) if (candTokens.has(item)) matched.push(item);
+  for (const item of reqBigrams) if (candBigrams.has(item)) matched.push(item);
+  return { score: matched.length, matched_terms: matched };
+}
+
+function normalizeText(text) {
+  return String(text || '').toLowerCase().replace(/\s+/g, '');
+}
+
+function scorePlaybook(request, playbook) {
+  const text = normalizeText(request);
+  const matchedKeywords = [];
+  let score = 0;
+  for (const keyword of playbook.keywords) {
+    if (text.includes(normalizeText(keyword))) {
+      matchedKeywords.push(keyword);
+      score += normalizeText(keyword).length >= 3 ? 2 : 1;
+    }
+  }
+  return { score, matchedKeywords };
+}
+
+function routeRequest(request, options) {
+  const registry = (options && options.registry) || { skills: {} };
+  const installed = registry.skills || {};
+  const yottaSlugs = new Set((options && options.yottaSlugs) || defaultYottaSlugs());
+  const otherSkillsTopN = (options && options.otherSkillsTopN) || 3;
+  const ranked = PLAYBOOKS
+    .map((playbook) => ({ playbook, ...scorePlaybook(request, playbook) }))
+    .sort((a, b) => b.score - a.score || a.playbook.id.localeCompare(b.playbook.id));
+  const best = ranked[0];
+  const runnerUp = ranked[1];
+  const fallback = !best || best.score === 0;
+  const playbook = fallback
+    ? PLAYBOOKS.find((item) => item.id === 'entry-install')
+    : best.playbook;
+  const matchedKeywords = fallback ? [] : best.matchedKeywords;
+  const margin = fallback ? 0 : best.score - (runnerUp ? runnerUp.score : 0);
+  const confidence = !fallback && best.score >= 3 && margin >= 1
+    ? 'high'
+    : (!fallback && best.score >= 1 ? 'medium' : 'low');
+
+  const skills = playbook.skills.map((skill) => {
+    const record = installed[skill.slug];
+    const isInstalled = Boolean(record && record.status !== 'gone');
+    return {
+      ...skill,
+      installed: isInstalled,
+      version: isInstalled ? record.version || '' : '',
+      sources: isInstalled ? record.sources || [] : [],
+      variants: isInstalled && Array.isArray(record.variants) ? record.variants : [],
+      conflicts: isInstalled && Array.isArray(record.conflicts) ? record.conflicts : [],
+    };
+  });
+  const missingSkills = skills
+    .filter((skill) => !skill.installed)
+    .map((skill) => ({ slug: skill.slug, scan_required: true }));
+  const installCommand = missingSkills.length
+    ? 'npx -y @yottameta/yotta-skills install '
+      + missingSkills.map((skill) => skill.slug).join(' ')
+      + ' --dir <skills-dir>'
+    : null;
+
+  const otherCandidates = Object.values(installed)
+    .filter((record) => record && record.status !== 'gone' && !yottaSlugs.has(record.slug))
+    .map((record) => ({ record, ...scoreOtherSkill(request, record) }))
+    .filter((item) => item.score > 0)
+    .sort((a, b) => b.score - a.score || a.record.slug.localeCompare(b.record.slug))
+    .slice(0, otherSkillsTopN)
+    .map(({ record, score, matched_terms }) => ({
+      slug: record.slug,
+      version: record.version || '',
+      sources: record.sources || [],
+      description: record.description || '',
+      score,
+      matched_terms,
+      scan_status: 'not_scanned',
+      note: OTHER_SKILL_NOTE,
+    }));
+
+  return {
+    request,
+    playbook: {
+      id: playbook.id,
+      name: playbook.name,
+      intent: playbook.intent,
+    },
+    confidence,
+    matched_keywords: matchedKeywords,
+    skills,
+    missing_skills: missingSkills,
+    install_command: installCommand,
+    auto_install: false,
+    application_mode: {
+      default: 'explicit',
+      options: ['explicit', 'scene-auto'],
+      note: '默认用户显式调用；切换为按场景自动调用需要用户确认。',
+    },
+    disclaimer: '路由建议不保证完全正确；关键动作应由用户确认，数据不出本机。',
+    other_skill_candidates: otherCandidates,
+    other_skills_note: OTHER_SKILLS_NOTE,
+  };
+}
+
+module.exports = { PLAYBOOKS, defaultYottaSlugs, routeRequest };