agent-loft 0.2.30 → 0.2.32

package/src/channels/web/skills-api.ts

@@ -0,0 +1,225 @@
+// 技能页面的接口：/api/skills。看得到的技能（自己的、公开的、指名给自己的）、安装 / 停用、变量、上传。
+// 只有作者能改；管理员能删别人公开或分享出来的（下架），但看不到、删不了别人私有的。
+import fs from "node:fs";
+import path from "node:path";
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { machineSkills, mentionTargets } from "../../core/skill-runtime.js";
+import {
+  canDelete,
+  canSee,
+  createSkill,
+  declaredHosts,
+  deleteSkill,
+  getSkill,
+  installCount,
+  installSkill,
+  listAllSkills,
+  listFiles,
+  parseSkillMd,
+  prepareUpload,
+  readSkillFile,
+  readSkillMd,
+  setSkillEnabled,
+  setSkillVars,
+  SKILL_LIMITS,
+  updateSkill,
+  userPrefs,
+  type Skill,
+  type SkillInput,
+} from "../../core/skills.js";
+import { readZip } from "../../core/zip.js";
+import { getUser, isAdmin, listUsers, type User } from "../../core/users.js";
+import { HttpError, readJsonBody, sendJson } from "./http.js";
+
+function view(s: Skill, user: User) {
+  const prefs = userPrefs(user.id);
+  const mine = s.owner === user.id;
+  return {
+    id: s.id,
+    name: s.name,
+    description: s.description,
+    owner: s.owner,
+    ownerName: getUser(s.owner)?.name ?? "（已删除的用户）",
+    mine,
+    visibility: s.visibility,
+    // 分享给了谁只有作者看得到
+    ...(mine ? { sharedWith: s.sharedWith, installs: installCount(s.id) } : {}),
+    vars: s.vars,
+    source: s.source,
+    createdAt: s.createdAt,
+    updatedAt: s.updatedAt,
+    installed: mine || prefs.installed.includes(s.id),
+    enabled: !prefs.disabled.includes(s.id),
+    canDelete: canDelete({ id: user.id, role: user.role }, s),
+  };
+}
+
+/**
+ * 变量：值按名字存；密钥（任何一个看得到的技能把它标成密钥）不回显，只说填没填。
+ * 受保护的密钥再带上确认过的地址（hosts），作者后来加了没确认过的地址就列在 pending 里。
+ */
+function varsView(user: User, skills: Skill[]) {
+  const secret = new Set(skills.flatMap((s) => s.vars.filter((v) => v.secret).map((v) => v.name)));
+  const prefs = userPrefs(user.id);
+  const mineOrInstalled = skills.filter((s) => s.owner === user.id || prefs.installed.includes(s.id));
+  return Object.fromEntries(
+    Object.entries(prefs.vars).map(([k, v]) => {
+      const declared = declaredHosts(mineOrInstalled, k);
+      const approved = prefs.approved[k] ?? [];
+      const pending = declared.filter((h) => !approved.includes(h));
+      return [
+        k,
+        {
+          set: true,
+          ...(secret.has(k) ? {} : { value: v }),
+          ...(declared.length ? { hosts: approved } : {}),
+          ...(pending.length ? { pending } : {}),
+        },
+      ];
+    }),
+  );
+}
+
+type UploadBody = { zip?: string; files?: { path?: string; data?: string }[] };
+
+/** 上传：zip（.zip / .skill）或者一堆文件（选文件夹 / 单个 SKILL.md），内容都是 base64 */
+function uploadOf(raw: UploadBody | undefined): ReturnType<typeof prepareUpload> | undefined {
+  if (!raw) return undefined;
+  if (typeof raw.zip === "string") {
+    const entries = readZip(Buffer.from(raw.zip, "base64"), SKILL_LIMITS.totalBytes * 2, SKILL_LIMITS.files * 2);
+    return prepareUpload(entries);
+  }
+  if (Array.isArray(raw.files)) {
+    if (raw.files.length > SKILL_LIMITS.files * 2) throw new Error(`文件太多（最多 ${SKILL_LIMITS.files} 个）`);
+    return prepareUpload(raw.files.map((f) => ({ path: String(f.path ?? ""), data: Buffer.from(String(f.data ?? ""), "base64") })));
+  }
+  throw new Error("上传的内容不对");
+}
+
+const bad = (err: unknown) => (err instanceof HttpError ? err : new HttpError(400, err instanceof Error ? err.message : String(err)));
+
+/** 处理了就返回 true */
+export async function handleSkillsApi(req: IncomingMessage, res: ServerResponse, url: URL, user: User): Promise<boolean> {
+  const method = req.method ?? "GET";
+  const p = url.pathname;
+  const viewer = { id: user.id, role: user.role };
+
+  if (p === "/api/skills" && method === "GET") {
+    const visible = listAllSkills().filter((s) => canSee(viewer, s));
+    sendJson(res, 200, {
+      skills: visible.map((s) => view(s, user)),
+      vars: varsView(user, visible),
+      // 分享给谁：列出其他还能登录的用户
+      users: listUsers()
+        .filter((u) => !u.disabled && u.id !== user.id)
+        .map((u) => ({ id: u.id, name: u.name })),
+      ...(isAdmin(user) ? { machine: machineSkills().map((m) => ({ name: m.name, description: m.description, dir: m.dir, agents: m.agents })) } : {}),
+      limits: SKILL_LIMITS,
+    });
+    return true;
+  }
+
+  // 输入框 @ 的补全：自己能用的（管理员加上机器上原有的）
+  if (p === "/api/skills/mention" && method === "GET") {
+    sendJson(res, 200, { skills: mentionTargets(user.id).map((t) => ({ name: t.name, description: t.description, kind: t.kind })) });
+    return true;
+  }
+
+  // 管理员看机器上原有技能的 SKILL.md
+  if (p === "/api/skills/machine" && method === "GET") {
+    if (!isAdmin(user)) throw new HttpError(403, "只有管理员能看机器上的技能");
+    const m = machineSkills().find((x) => x.name === url.searchParams.get("name"));
+    if (!m) throw new HttpError(404, "没有这个技能");
+    let md = "";
+    try {
+      md = fs.readFileSync(path.join(m.dir, "SKILL.md"), "utf8");
+    } catch {
+      md = "（读不到 SKILL.md）";
+    }
+    sendJson(res, 200, { ...m, skillMd: md });
+    return true;
+  }
+
+  if (p === "/api/skills/vars" && method === "PUT") {
+    const body = await readJsonBody<{ values?: Record<string, unknown>; approve?: unknown }>(req);
+    try {
+      setSkillVars(user.id, body.values ?? {}, Array.isArray(body.approve) ? body.approve.map(String) : []);
+    } catch (err) {
+      throw bad(err);
+    }
+    sendJson(res, 200, { vars: varsView(user, listAllSkills().filter((s) => canSee(viewer, s))) });
+    return true;
+  }
+
+  if (p === "/api/skills" && method === "POST") {
+    const body = await readJsonBody<SkillInput & { upload?: UploadBody }>(req, 16 * 1024 * 1024);
+    let skill: Skill;
+    try {
+      const upload = uploadOf(body.upload);
+      const { upload: _u, ...input } = body;
+      skill = createSkill(user.id, input, upload ? "upload" : "manual", upload);
+    } catch (err) {
+      throw bad(err);
+    }
+    sendJson(res, 200, view(skill, user));
+    return true;
+  }
+
+  const m = /^\/api\/skills\/(s_[a-f0-9]+)(?:\/(install|enable|file))?$/.exec(p);
+  if (!m) return false;
+  const skill = getSkill(m[1]!);
+  if (!skill || !canSee(viewer, skill)) throw new HttpError(404, "这个技能不存在");
+
+  if (!m[2] && method === "GET") {
+    const md = parseSkillMd(readSkillMd(skill.id));
+    sendJson(res, 200, { ...view(skill, user), body: md.body, extra: md.extra, files: listFiles(skill.id) });
+    return true;
+  }
+  if (m[2] === "file" && method === "GET") {
+    const data = readSkillFile(skill.id, url.searchParams.get("path") ?? "");
+    if (!data) throw new HttpError(404, "没有这个文件");
+    // 只当文本看：二进制的给个提示
+    const text = data.includes(0) ? null : data.toString("utf8");
+    sendJson(res, 200, { text, size: data.length });
+    return true;
+  }
+  if (m[2] === "install" && method === "POST") {
+    const body = await readJsonBody<{ on?: boolean }>(req);
+    try {
+      installSkill(user.id, skill.id, body.on !== false);
+    } catch (err) {
+      throw bad(err);
+    }
+    sendJson(res, 200, view(skill, user));
+    return true;
+  }
+  if (m[2] === "enable" && method === "POST") {
+    const body = await readJsonBody<{ on?: boolean }>(req);
+    setSkillEnabled(user.id, skill.id, body.on !== false);
+    sendJson(res, 200, view(skill, user));
+    return true;
+  }
+  if (!m[2] && method === "PATCH") {
+    const body = await readJsonBody<SkillInput & { upload?: UploadBody }>(req, 16 * 1024 * 1024);
+    let updated: Skill;
+    try {
+      const upload = uploadOf(body.upload);
+      const { upload: _u, name: _n, ...input } = body;
+      updated = updateSkill(user.id, skill.id, input, upload ? { upload } : {});
+    } catch (err) {
+      throw bad(err);
+    }
+    sendJson(res, 200, view(updated, user));
+    return true;
+  }
+  if (!m[2] && method === "DELETE") {
+    try {
+      deleteSkill(viewer, skill.id);
+    } catch (err) {
+      throw bad(err);
+    }
+    sendJson(res, 200, { ok: true });
+    return true;
+  }
+  return false;
+}

package/src/channels/web/tasks-api.ts

@@ -0,0 +1,94 @@
+// 定时任务页面的接口：/api/tasks。每个人只看得到、改得了自己的任务（别人的一律当不存在）。
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { config, resolveWorkspacePath } from "../../core/config.js";
+import { hub } from "../../core/hub.js";
+import { memoryOwnerOf } from "../../core/personal.js";
+import { getConversation } from "../../core/store.js";
+import { forgetTask, isTaskRunning, runTaskNow } from "../../core/task-runner.js";
+import { serverTimeZone } from "../../core/task-schedule.js";
+import { createTask, deleteTask, getTask, listTasks, updateTask, viewOf, type Task, type TaskInput } from "../../core/tasks.js";
+import type { User } from "../../core/users.js";
+import { HttpError, readJsonBody, sendJson } from "./http.js";
+
+function view(task: Task) {
+  const key = task.target.key;
+  const conv = key ? getConversation(key) : undefined;
+  return {
+    ...viewOf(task),
+    running: isTaskRunning(task.id),
+    // 结果在哪条对话里看（专用对话第一次运行前还没有）
+    ...(conv && !conv.hidden ? { convKey: conv.key, convTitle: conv.title ?? "" } : {}),
+  };
+}
+
+/** 表单 / 请求里的字段先在这里核一遍：agent 要启用着、目录要在工作区里、对话要是自己的 */
+function checkInput(user: User, body: TaskInput): TaskInput {
+  const out: TaskInput = { ...body };
+  if (body.agent !== undefined) {
+    const agent = String(body.agent);
+    if (!hub.enabledAgents().some((d) => d.id === agent)) throw new HttpError(400, `${hub.label(agent)} 没有启用`);
+  }
+  if (typeof body.cwd === "string" && body.cwd.trim()) {
+    const cwd = resolveWorkspacePath(body.cwd.trim());
+    if (!cwd) throw new HttpError(400, `目录必须存在，且在 ${config().workspaceRoot} 之内`);
+    out.cwd = cwd === config().workspaceRoot ? "" : cwd;
+  }
+  const target = body.target as { kind?: string; key?: string } | undefined;
+  if (target?.kind === "conv") {
+    const conv = target.key ? getConversation(target.key) : undefined;
+    if (!conv || conv.hidden || memoryOwnerOf(conv) !== user.id) throw new HttpError(400, "回复到的那条对话不存在了，改成专用对话吧");
+  }
+  return out;
+}
+
+const bad = (err: unknown) => (err instanceof HttpError ? err : new HttpError(400, err instanceof Error ? err.message : String(err)));
+
+/** 处理了就返回 true */
+export async function handleTasksApi(req: IncomingMessage, res: ServerResponse, p: string, user: User): Promise<boolean> {
+  const method = req.method ?? "GET";
+  if (p === "/api/tasks" && method === "GET") {
+    sendJson(res, 200, { tasks: listTasks(user.id).map(view), tz: serverTimeZone(), now: Date.now() });
+    return true;
+  }
+  if (p === "/api/tasks" && method === "POST") {
+    const body = await readJsonBody<TaskInput>(req);
+    // 没选 agent（只启用了一个时表单里不显示）：用第一个启用着的，不能默认成一个可能没启用的
+    if (body.agent === undefined || body.agent === "") body.agent = hub.enabledAgents()[0]?.id;
+    let task: Task;
+    try {
+      task = createTask(user.id, checkInput(user, body), "user");
+    } catch (err) {
+      throw bad(err);
+    }
+    sendJson(res, 200, view(task));
+    return true;
+  }
+  const m = /^\/api\/tasks\/([^/]+)(?:\/(run))?$/.exec(p);
+  if (!m) return false;
+  const task = getTask(user.id, decodeURIComponent(m[1]!));
+  if (!task) throw new HttpError(404, "这个任务不存在");
+  if (m[2] === "run" && method === "POST") {
+    const error = runTaskNow(task);
+    if (error) throw new HttpError(409, error);
+    sendJson(res, 200, view(task));
+    return true;
+  }
+  if (!m[2] && method === "PATCH") {
+    const body = await readJsonBody<TaskInput>(req);
+    let updated: Task;
+    try {
+      updated = updateTask(user.id, task.id, checkInput(user, body));
+    } catch (err) {
+      throw bad(err);
+    }
+    sendJson(res, 200, view(updated));
+    return true;
+  }
+  if (!m[2] && method === "DELETE") {
+    deleteTask(user.id, task.id);
+    forgetTask(task);
+    sendJson(res, 200, { ok: true });
+    return true;
+  }
+  return false;
+}

package/src/core/chat-mode.ts

@@ -36,27 +36,27 @@ export function chatSystemPrompt(search: string, memory?: string): string {
 const OPEN = "<agent-loft-context>";
 const CLOSE = "</agent-loft-context>";
 
-/** Codex：附在会话进程第一条消息后面的背景（模式 + 记忆） */
-export function contextBlock(mode: "chat" | "work", memory: string | undefined, search: string): string {
+/** Codex：附在会话进程第一条消息后面的背景（模式 + 记忆 + 工作模式下的技能清单） */
+export function contextBlock(mode: "chat" | "work", memory: string | undefined, search: string, skills: string[] = []): string {
   const head =
     mode === "chat"
       ? ["当前是「聊天模式」，你作为用户的私人 AI 助手和他聊天：", ...chatRules(search)]
       : ["当前是「工作模式」：可以执行命令、读写文件，按平常的方式干活。之前如果说过「聊天模式下不能做」，那个限制已经解除。"];
-  return [
-    OPEN,
-    "（这段是 agent-loft 自动附上的背景，不是用户写的。照着做，但不要在回复里提到它。）",
-    "",
-    ...head,
-    ...(memory ? ["", memory] : []),
-    CLOSE,
-  ].join("\n");
+  return wrapContext([...head, ...(memory ? ["", memory] : []), ...(mode === "work" && skills.length ? ["", ...skills] : [])]);
+}
+
+/** 包成 agent-loft 附上的背景：用户看不到（读历史、实时显示时都剥掉），agent 照着做 */
+export function wrapContext(lines: string[]): string {
+  return [OPEN, "（这段是 agent-loft 自动附上的背景，不是用户写的。照着做，但不要在回复里提到它。）", "", ...lines, CLOSE].join("\n");
 }
 
-/** 剥掉 contextBlock（读历史、列会话标题时用） */
+/** 剥掉 contextBlock（读历史、列会话标题时用）。一条消息里可能有好几段（定时任务的说明 + Codex 的模式说明） */
 export function stripContext(text: string): string {
-  const start = text.indexOf(OPEN);
-  if (start < 0) return text;
-  const end = text.indexOf(CLOSE, start);
-  const rest = end < 0 ? "" : text.slice(end + CLOSE.length);
-  return `${text.slice(0, start)}${rest}`.trim();
+  let out = text;
+  for (let start = out.indexOf(OPEN); start >= 0; start = out.indexOf(OPEN)) {
+    const end = out.indexOf(CLOSE, start);
+    const rest = end < 0 ? "" : out.slice(end + CLOSE.length);
+    out = `${out.slice(0, start)}${rest}`;
+  }
+  return out === text ? text : out.trim();
 }

package/src/core/command-catalog.ts

@@ -24,6 +24,7 @@ export const BUILTIN_COMMANDS: BuiltinSpec[] = [
   { name: "effort", args: "[程度]", description: "切换思考程度" },
   { name: "chat", description: "切到聊天模式：精简、只能联网搜索，每轮开销小很多" },
   { name: "work", description: "切到工作模式：agent 原装的全部能力" },
+  { name: "skills", description: "列出能用的技能（消息里写 @名字 点名使用）" },
   { name: "status", description: "查看当前会话、模型、目录、剩余额度" },
   { name: "sessions", args: "[all]", description: "列出历史会话，点按钮恢复；加 all 列所有目录" },
   { name: "resume", args: "<会话ID>", description: "恢复指定会话" },
@@ -42,7 +43,13 @@ export const BUILTIN_COMMANDS: BuiltinSpec[] = [
 ];
 
 /** agent 自己报上来的命令 */
-export type AgentCommand = { name: string; description: string; args?: string };
+export type AgentCommand = {
+  name: string;
+  description: string;
+  args?: string;
+  /** agent 自己带的（Claude Code 的 /compact、自带的技能），不是机器上另外装的 */
+  builtin?: boolean;
+};
 
 /**
  * 用户自定义命令。prompt 里的 $ARGUMENTS 换成命令后面跟的参数；

package/src/core/commands.ts

@@ -20,6 +20,7 @@ export type ParsedCommand =
   | { kind: "autoedit"; on?: boolean }
   | { kind: "mode"; mode: "chat" | "work" }
   | { kind: "help" }
+  | { kind: "skills" }
   /** 只发了一个「/」：列出可用命令 */
   | { kind: "commands" }
   | { kind: "approve"; requestId: string; decision: ApprovalDecision }
@@ -75,6 +76,8 @@ export function parseCommand(raw: string): ParsedCommand {
       return arg ? { kind: "chat", text } : { kind: "mode", mode: head.toLowerCase() as "chat" | "work" };
     case "help":
       return { kind: "help" };
+    case "skills":
+      return arg ? { kind: "chat", text } : { kind: "skills" };
     case "approve": {
       const [requestId, decision] = rest;
       if (!requestId || !decision) return { kind: "chat", text };