agent-skillboard 0.2.14 → 0.2.16

package/src/source-profiles.mjs

@@ -1,26 +1,26 @@
-import { readdir, readFile } from "node:fs/promises";
-import { basename, dirname, join, relative, resolve } from "node:path";
-import YAML from "yaml";
+import { readdir, readFile } from "node:fs/promises";
+import { basename, dirname, join, relative, resolve } from "node:path";
+import YAML from "yaml";
 import { readString, requireRecord } from "./config-helpers.mjs";
 import { textChangePlan } from "./change-plan.mjs";
 import { loadSourceProfile } from "./source-profile-loader.mjs";
-
-export { loadSourceProfile };
-
-export async function importSource(options) {
-  const sourceRoot = resolve(options.sourceRoot);
-  const profile = options.profile;
-  const files = await findSkillFiles(sourceRoot);
-  const matchedFiles = files
-    .map((file) => ({
-      file,
+
+export { loadSourceProfile };
+
+export async function importSource(options) {
+  const sourceRoot = resolve(options.sourceRoot);
+  const profile = options.profile;
+  const files = await findSkillFiles(sourceRoot);
+  const matchedFiles = files
+    .map((file) => ({
+      file,
       relativeFile: relative(sourceRoot, file).replace(/\\/g, "/")
-    }))
-    .filter((entry) => matchesAnyProfilePattern(entry.relativeFile, profile.skillPaths))
-    .sort((left, right) => left.relativeFile.localeCompare(right.relativeFile));
-  const skills = [];
-  const warnings = [];
-
+    }))
+    .filter((entry) => matchesAnyProfilePattern(entry.relativeFile, profile.skillPaths))
+    .sort((left, right) => left.relativeFile.localeCompare(right.relativeFile));
+  const skills = [];
+  const warnings = [];
+
   for (const entry of matchedFiles) {
     const frontmatter = parseSkillFrontmatter(await readFile(entry.file, "utf8"));
     const pathRule = matchingPathRule(entry.relativeFile, profile);
@@ -37,17 +37,17 @@ export async function importSource(options) {
       ownerInstallUnit: profile.id,
       description: frontmatter.description
     });
-  }
-
-  if (skills.length === 0) {
-    warnings.push(`No SKILL.md files matched profile ${profile.id} under ${sourceRoot}`);
-  }
-
-  return {
-    profile,
-    sourceRoot,
-    skills,
-    installUnit: {
+  }
+
+  if (skills.length === 0) {
+    warnings.push(`No SKILL.md files matched profile ${profile.id} under ${sourceRoot}`);
+  }
+
+  return {
+    profile,
+    sourceRoot,
+    skills,
+    installUnit: {
       id: profile.id,
       kind: profile.kind,
       sourceClass: profile.sourceClass,
@@ -58,31 +58,31 @@ export async function importSource(options) {
       publicKey: profile.publicKey,
       verifiedAt: profile.verifiedAt,
       source: profile.source || sourceRoot,
-      scope: profile.scope,
-      manifestPath: profile.manifestPath,
-      cachePath: profile.cachePath,
-      providedComponents: profile.providedComponents,
-      components: {
-        skills: skills.map((skill) => skill.id),
-        commands: profile.components.commands,
-        hooks: profile.components.hooks,
-        mcpServers: profile.components.mcpServers
-      },
-      modifiedConfigFiles: profile.modifiedConfigFiles,
-      autoUpdate: profile.autoUpdate,
-      enabled: profile.enabled,
-      workflowDependencies: profile.workflowDependencies,
-      permissionRisk: profile.permissionRisk,
-      rollback: profile.rollback
-    },
-    warnings
-  };
-}
-
-export function renderImportFragment(imported) {
-  return YAML.stringify(importFragment(imported));
-}
-
+      scope: profile.scope,
+      manifestPath: profile.manifestPath,
+      cachePath: profile.cachePath,
+      providedComponents: profile.providedComponents,
+      components: {
+        skills: skills.map((skill) => skill.id),
+        commands: profile.components.commands,
+        hooks: profile.components.hooks,
+        mcpServers: profile.components.mcpServers
+      },
+      modifiedConfigFiles: profile.modifiedConfigFiles,
+      autoUpdate: profile.autoUpdate,
+      enabled: profile.enabled,
+      workflowDependencies: profile.workflowDependencies,
+      permissionRisk: profile.permissionRisk,
+      rollback: profile.rollback
+    },
+    warnings
+  };
+}
+
+export function renderImportFragment(imported) {
+  return YAML.stringify(importFragment(imported));
+}
+
 export function mergeImportFragment(configText, imported, options = {}) {
   const document = YAML.parseDocument(configText);
   if (document.errors.length > 0) {
@@ -117,7 +117,7 @@ export function mergeImportFragment(configText, imported, options = {}) {
     addedSkills: skillIds,
     addedInstallUnits: unitIds,
     replacedSkills: duplicateSkills,
-    replacedInstallUnits: duplicateUnits
+    replacedInstallUnits: duplicateUnits
   };
 }
 
@@ -141,20 +141,20 @@ function requireYamlMap(value, label) {
 function preserveLineEndings(text, reference) {
   return reference.includes("\r\n") ? text.replace(/\n/g, "\r\n") : text;
 }
-
+
 function importFragment(imported) {
-  const skills = {};
-  for (const skill of imported.skills) {
-    skills[skill.id] = {
-      path: skill.path,
-      status: skill.status,
-      invocation: skill.invocation,
-      exposure: skill.exposure,
-      category: skill.category,
-      owner_install_unit: skill.ownerInstallUnit
-    };
-  }
-  const unit = imported.installUnit;
+  const skills = {};
+  for (const skill of imported.skills) {
+    skills[skill.id] = {
+      path: skill.path,
+      status: skill.status,
+      invocation: skill.invocation,
+      exposure: skill.exposure,
+      category: skill.category,
+      owner_install_unit: skill.ownerInstallUnit
+    };
+  }
+  const unit = imported.installUnit;
   return stripUndefined({
     skills,
     install_units: {
@@ -168,64 +168,64 @@ function importFragment(imported) {
         public_key: unit.publicKey,
         verified_at: unit.verifiedAt,
         source: unit.source,
-        scope: unit.scope,
-        manifest_path: unit.manifestPath,
-        cache_path: unit.cachePath,
-        provided_components: unit.providedComponents,
-        components: {
-          skills: unit.components.skills,
-          commands: unit.components.commands,
-          hooks: unit.components.hooks,
-          mcp_servers: unit.components.mcpServers
-        },
-        modified_config_files: unit.modifiedConfigFiles,
-        auto_update: unit.autoUpdate,
-        enabled: unit.enabled,
-        workflow_dependencies: unit.workflowDependencies,
-        permission_risk: unit.permissionRisk,
+        scope: unit.scope,
+        manifest_path: unit.manifestPath,
+        cache_path: unit.cachePath,
+        provided_components: unit.providedComponents,
+        components: {
+          skills: unit.components.skills,
+          commands: unit.components.commands,
+          hooks: unit.components.hooks,
+          mcp_servers: unit.components.mcpServers
+        },
+        modified_config_files: unit.modifiedConfigFiles,
+        auto_update: unit.autoUpdate,
+        enabled: unit.enabled,
+        workflow_dependencies: unit.workflowDependencies,
+        permission_risk: unit.permissionRisk,
         rollback: unit.rollback
       }
     }
   });
 }
-
-function duplicateMessage(skillIds, unitIds) {
-  const parts = [];
-  if (skillIds.length > 0) {
-    parts.push(`skills already exist: ${skillIds.join(", ")}`);
-  }
-  if (unitIds.length > 0) {
-    parts.push(`install units already exist: ${unitIds.join(", ")}`);
-  }
-  return `${parts.join("; ")}. Re-run with --replace to overwrite.`;
-}
-
-async function findSkillFiles(root) {
-  const files = [];
-  const entries = await readdir(root, { withFileTypes: true }).catch(() => []);
-  for (const entry of entries) {
-    const path = join(root, entry.name);
-    if (entry.isDirectory()) {
-      files.push(...(await findSkillFiles(path)));
-    } else if (entry.isFile() && entry.name === "SKILL.md") {
-      files.push(path);
-    }
-  }
-  return files;
-}
-
-function parseSkillFrontmatter(text) {
-  const match = /^---[ \t]*\r?\n(?<body>[\s\S]*?)\r?\n---[ \t]*(?:\r?\n|$)/.exec(text);
-  if (match?.groups === undefined) {
-    throw new Error("SKILL.md is missing YAML frontmatter");
-  }
-  const raw = requireRecord(YAML.parse(match.groups.body), "SKILL.md frontmatter");
-  return {
-    name: readString(raw, "name", ""),
-    description: readString(raw, "description", "")
-  };
-}
-
+
+function duplicateMessage(skillIds, unitIds) {
+  const parts = [];
+  if (skillIds.length > 0) {
+    parts.push(`skills already exist: ${skillIds.join(", ")}`);
+  }
+  if (unitIds.length > 0) {
+    parts.push(`install units already exist: ${unitIds.join(", ")}`);
+  }
+  return `${parts.join("; ")}. Re-run with --replace to overwrite.`;
+}
+
+async function findSkillFiles(root) {
+  const files = [];
+  const entries = await readdir(root, { withFileTypes: true }).catch(() => []);
+  for (const entry of entries) {
+    const path = join(root, entry.name);
+    if (entry.isDirectory()) {
+      files.push(...(await findSkillFiles(path)));
+    } else if (entry.isFile() && entry.name === "SKILL.md") {
+      files.push(path);
+    }
+  }
+  return files;
+}
+
+function parseSkillFrontmatter(text) {
+  const match = /^---[ \t]*\r?\n(?<body>[\s\S]*?)\r?\n---[ \t]*(?:\r?\n|$)/.exec(text);
+  if (match?.groups === undefined) {
+    throw new Error("SKILL.md is missing YAML frontmatter");
+  }
+  const raw = requireRecord(YAML.parse(match.groups.body), "SKILL.md frontmatter");
+  return {
+    name: readString(raw, "name", ""),
+    description: readString(raw, "description", "")
+  };
+}
+
 function matchesAnyProfilePattern(file, patterns) {
   const activePatterns = patterns.length === 0 ? ["**/SKILL.md"] : patterns;
   return activePatterns.some((pattern) => patternToRegExp(pattern).test(file));
@@ -234,30 +234,31 @@ function matchesAnyProfilePattern(file, patterns) {
 function matchingPathRule(file, profile) {
   return (profile.pathRules ?? []).find((rule) => patternToRegExp(rule.pattern).test(file));
 }
-
-function patternToRegExp(pattern) {
-  const escaped = pattern
-    .replace(/[.+^${}()|[\]\\]/g, "\\$&")
+
+function patternToRegExp(pattern) {
+  const escaped = pattern
+    .replace(/[.+^${}()|[\]\\]/g, "\\$&")
     .split("**").join("\0")
     .split("*").join("[^/]*")
     .split("\0").join(".*");
-  return new RegExp(`^${escaped}$`);
-}
-
-function skillSlug(relativeFile, frontmatter, profile) {
-  if (profile.idStrategy === "frontmatter-name" && frontmatter.name.length > 0) {
-    return normalizeSlug(frontmatter.name.split(".").at(-1));
-  }
-  return normalizeSlug(basename(dirname(relativeFile)));
-}
-
-function skillId(slug, frontmatter, profile) {
-  if (profile.idStrategy === "frontmatter-name" && frontmatter.name.includes(".")) {
-    return frontmatter.name;
-  }
-  return profile.namespace.length === 0 ? slug : `${profile.namespace}.${slug}`;
-}
-
+  return new RegExp(`^${escaped}$`);
+}
+
+function skillSlug(relativeFile, frontmatter, profile) {
+  if (profile.idStrategy === "frontmatter-name" && frontmatter.name.length > 0) {
+    const segments = frontmatter.name.split(".");
+    return normalizeSlug(segments[segments.length - 1]);
+  }
+  return normalizeSlug(basename(dirname(relativeFile)));
+}
+
+function skillId(slug, frontmatter, profile) {
+  if (profile.idStrategy === "frontmatter-name" && frontmatter.name.includes(".")) {
+    return frontmatter.name;
+  }
+  return profile.namespace.length === 0 ? slug : `${profile.namespace}.${slug}`;
+}
+
 function skillTargetPath(slug, profile) {
   return profile.targetPathPrefix.length === 0 ? slug : `${profile.targetPathPrefix}/${slug}`;
 }
@@ -275,13 +276,13 @@ function categoryFromPath(relativeFile, profile) {
 }
 
 function normalizeSlug(value) {
-  return value
-    .trim()
-    .toLowerCase()
-    .replace(/[^a-z0-9._-]+/g, "-")
-    .replace(/^-+|-+$/g, "");
-}
-
+  return value
+    .trim()
+    .toLowerCase()
+    .replace(/[^a-z0-9._-]+/g, "-")
+    .replace(/^-+|-+$/g, "");
+}
+
 function safeDefaultInvocation(invocation) {
   return invocation === "global-auto" ? "blocked" : invocation;
 }

package/src/uninstall.mjs

@@ -1,11 +1,12 @@
 // allow: SIZE_OK - uninstall lifecycle split is deferred from the 0.2.7 release gate.
 import { access, lstat, readFile, readdir, rm, rmdir, writeFile } from "node:fs/promises";
-import { join } from "node:path";
+import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { BRIDGE_END, BRIDGE_START, defaultConfig, hookReadme, profileReadme } from "./lifecycle-content.mjs";
 
 export async function uninstallProject(options) {
   const root = options.root;
   const dryRun = options.dryRun === true;
+  const keepBridge = options.keepBridge === true;
   const removed = [];
   const updated = [];
   const preserved = [];
@@ -13,7 +14,7 @@ export async function uninstallProject(options) {
 
   for (const filename of ["AGENTS.md", "CLAUDE.md"]) {
     const path = join(root, filename);
-    const result = await removeBridge(path, dryRun);
+    const result = keepBridge ? await preserveExisting(path) : await removeBridge(path, dryRun);
     if (result === "removed") {
       plannedRemovedPaths.add(path);
     }
@@ -47,7 +48,7 @@ export async function uninstallProject(options) {
     recordFileResult(".skillboard", result, { removed, updated, preserved });
   } else {
     for (const entry of generatedFiles(root)) {
-      const result = await removeGeneratedFile(entry.path, entry.expected, dryRun);
+      const result = await removeGeneratedFile(entry.path, entry.expected, dryRun, root);
       if (result === "removed") {
         plannedRemovedPaths.add(entry.path);
       }
@@ -57,7 +58,7 @@ export async function uninstallProject(options) {
 
   if (options.removeReports === true && options.removeProjectState !== true) {
     const path = join(root, ".skillboard", "reports");
-    const result = await removeGeneratedDir(path, dryRun);
+    const result = await removeGeneratedDir(path, dryRun, root);
     if (result === "removed") {
       plannedRemovedPaths.add(path);
     }
@@ -66,7 +67,7 @@ export async function uninstallProject(options) {
 
   if (options.removeHooks === true && options.removeProjectState !== true) {
     const path = join(root, ".skillboard", "hooks");
-    const result = await removeGeneratedDir(path, dryRun);
+    const result = await removeGeneratedDir(path, dryRun, root);
     if (result === "removed") {
       plannedRemovedPaths.add(path);
     }
@@ -79,7 +80,7 @@ export async function uninstallProject(options) {
       skipHooks: options.removeHooks === true,
       skipSkillboard: options.removeProjectState === true
     })) {
-      const result = await removeEmptyDir(dir.path, dryRun, plannedRemovedPaths);
+      const result = await removeEmptyDir(dir.path, dryRun, plannedRemovedPaths, root);
       if (result === "removed") {
         plannedRemovedPaths.add(dir.path);
       }
@@ -178,7 +179,10 @@ function withoutBridgeBlock(text) {
   return `${before}${after}`;
 }
 
-async function removeGeneratedFile(path, expected, dryRun) {
+async function removeGeneratedFile(path, expected, dryRun, root = null) {
+  if (root !== null && await hasUnsafeAncestor(path, root)) {
+    return "preserved";
+  }
   const stats = await pathStats(path);
   if (stats === null) {
     return "absent";
@@ -210,7 +214,10 @@ async function removeConfigFile(path, dryRun) {
   return "removed";
 }
 
-async function removeGeneratedDir(path, dryRun) {
+async function removeGeneratedDir(path, dryRun, root = null) {
+  if (root !== null && await hasUnsafeAncestor(path, root)) {
+    return "preserved";
+  }
   const stats = await pathStats(path);
   if (stats === null) {
     return "absent";
@@ -244,7 +251,10 @@ async function removeProjectStateDir(path, dryRun) {
   return "removed";
 }
 
-async function removeEmptyDir(path, dryRun, plannedRemovedPaths) {
+async function removeEmptyDir(path, dryRun, plannedRemovedPaths, root = null) {
+  if (root !== null && await hasUnsafeAncestor(path, root)) {
+    return "preserved";
+  }
   const stats = await pathStats(path);
   if (stats === null) {
     return "absent";
@@ -280,6 +290,43 @@ async function exists(path) {
   return access(path).then(() => true, () => false);
 }
 
+async function preserveExisting(path) {
+  return await exists(path) ? "preserved" : "absent";
+}
+
+async function hasUnsafeAncestor(path, root) {
+  const resolvedRoot = resolve(root);
+  const resolvedPath = resolve(path);
+  if (resolvedPath !== resolvedRoot && !isInside(resolvedPath, resolvedRoot)) {
+    return true;
+  }
+  const ancestors = [];
+  let current = dirname(resolvedPath);
+  while (current !== resolvedRoot) {
+    ancestors.push(current);
+    const parent = dirname(current);
+    if (parent === current) {
+      break;
+    }
+    current = parent;
+  }
+  for (const ancestor of ancestors.reverse()) {
+    const stats = await pathStats(ancestor);
+    if (stats === null) {
+      return false;
+    }
+    if (stats.isSymbolicLink() || !stats.isDirectory()) {
+      return true;
+    }
+  }
+  return false;
+}
+
+function isInside(path, parent) {
+  const relativePath = relative(parent, path);
+  return relativePath !== "" && !relativePath.startsWith("..") && !isAbsolute(relativePath);
+}
+
 async function pathStats(path) {
   try {
     return await lstat(path);