agenticros 0.3.5 → 0.4.1

package/runtime/packages/core/src/skill-refs.ts

@@ -0,0 +1,330 @@
+/**
+ * skillRefs → ~/.agenticros/skills-cache resolver (marketplace auto-fetch v1).
+ *
+ * Declarative refs like `agenticros/navigate-to` or `owner/skill@main` are
+ * resolved via the skills marketplace install API, cloned into the cache,
+ * built if needed, and returned as absolute skillPaths for capability
+ * reading / OpenClaw loading.
+ *
+ * Never auto-upgrades: if the cache dir for a pin already exists, reuse it
+ * (optional pull when AGENTICROS_SKILLS_CACHE_PULL=1).
+ */
+
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, join } from "node:path";
+import { execFileSync } from "node:child_process";
+import type { AgenticROSConfig } from "./config.js";
+
+export const DEFAULT_SKILLS_API = "https://skills.agenticros.com/api";
+export const DEFAULT_SKILLS_CACHE_DIR = join(homedir(), ".agenticros", "skills-cache");
+
+export interface ParsedSkillRef {
+  /** owner/skill (lowercase) */
+  marketplaceRef: string;
+  owner: string;
+  skill: string;
+  /** git ref / branch pin; default main */
+  gitRef: string;
+}
+
+export interface InstallDescriptor {
+  slug: string;
+  marketplaceRef?: string;
+  skillId: string;
+  packageName: string;
+  githubUrl: string;
+  ref: string;
+  buildCmd: string;
+}
+
+export interface ResolveSkillRefsOptions {
+  apiBase?: string;
+  cacheDir?: string;
+  /** When true, git pull --ff-only if cache already exists. */
+  pullIfPresent?: boolean;
+  /** Skip network / clone (return only paths that already exist in cache). */
+  offline?: boolean;
+  onLog?: (msg: string) => void;
+}
+
+export interface ResolveSkillRefsResult {
+  /** Absolute directories ready to merge into skillPaths. */
+  paths: string[];
+  errors: Array<{ ref: string; error: string }>;
+}
+
+/** Parse `owner/skill` or `owner/skill@branch`. */
+export function parseSkillRef(raw: string): ParsedSkillRef | null {
+  const trimmed = raw.trim();
+  if (!trimmed) return null;
+  const at = trimmed.lastIndexOf("@");
+  let body = trimmed;
+  let gitRef = "main";
+  if (at > 0) {
+    body = trimmed.slice(0, at);
+    gitRef = trimmed.slice(at + 1).trim() || "main";
+  }
+  const parts = body.split("/").filter(Boolean);
+  if (parts.length < 2) return null;
+  const owner = parts[0]!.toLowerCase();
+  const skill = parts.slice(1).join("/").toLowerCase();
+  if (!owner || !skill) return null;
+  return {
+    marketplaceRef: `${owner}/${skill}`,
+    owner,
+    skill,
+    gitRef,
+  };
+}
+
+export function skillsApiBase(override?: string): string {
+  return (override || process.env.AGENTICROS_SKILLS_API || DEFAULT_SKILLS_API).replace(
+    /\/+$/,
+    "",
+  );
+}
+
+export function skillsCacheDir(override?: string): string {
+  return override || process.env.AGENTICROS_SKILLS_CACHE || DEFAULT_SKILLS_CACHE_DIR;
+}
+
+function skillApiPath(apiBase: string, ref: string): string {
+  const [owner, ...rest] = ref.split("/");
+  const skill = rest.join("/");
+  return `${apiBase}/skills/${encodeURIComponent(owner!)}/${encodeURIComponent(skill)}`;
+}
+
+export async function fetchInstallDescriptor(
+  marketplaceRef: string,
+  apiBase?: string,
+): Promise<InstallDescriptor> {
+  const base = skillsApiBase(apiBase);
+  const url = `${skillApiPath(base, marketplaceRef)}/install`;
+  const res = await fetch(url, { headers: { Accept: "application/json" } });
+  if (!res.ok) {
+    const body = await res.text().catch(() => "");
+    throw new Error(`Marketplace install ${res.status}: ${body.slice(0, 200)}`);
+  }
+  const desc = (await res.json()) as InstallDescriptor;
+  if (!desc.githubUrl) {
+    throw new Error(`Install descriptor for ${marketplaceRef} has no githubUrl`);
+  }
+  return desc;
+}
+
+function cachePathFor(
+  cacheDir: string,
+  owner: string,
+  skill: string,
+  gitRef: string,
+): string {
+  const safeRef = gitRef.replace(/[^a-zA-Z0-9._-]+/g, "_");
+  return join(cacheDir, owner, skill, safeRef);
+}
+
+function hasBuiltEntry(dir: string): boolean {
+  try {
+    const pkg = JSON.parse(readFileSync(join(dir, "package.json"), "utf8")) as {
+      main?: string;
+    };
+    const main = pkg.main ?? "dist/index.js";
+    return existsSync(join(dir, main));
+  } catch {
+    return false;
+  }
+}
+
+function run(cmd: string, args: string[], cwd: string, log: (m: string) => void): void {
+  log(`$ ${cmd} ${args.join(" ")}  (in ${cwd})`);
+  execFileSync(cmd, args, { cwd, stdio: "inherit" });
+}
+
+function hasBin(name: string): boolean {
+  try {
+    execFileSync(name, ["--version"], { stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Ensure one skillRef is present under the cache. Returns absolute path or throws.
+ */
+export async function ensureSkillRefCached(
+  rawRef: string,
+  opts: ResolveSkillRefsOptions = {},
+): Promise<string> {
+  const parsed = parseSkillRef(rawRef);
+  if (!parsed) {
+    throw new Error(`Invalid skillRef "${rawRef}" (expected owner/skill or owner/skill@ref)`);
+  }
+  const log = opts.onLog ?? (() => undefined);
+  const cacheRoot = skillsCacheDir(opts.cacheDir);
+  const dir = cachePathFor(cacheRoot, parsed.owner, parsed.skill, parsed.gitRef);
+
+  if (existsSync(join(dir, "package.json"))) {
+    if (opts.pullIfPresent || process.env.AGENTICROS_SKILLS_CACHE_PULL === "1") {
+      try {
+        run("git", ["pull", "--ff-only"], dir, log);
+      } catch (e) {
+        log(`git pull failed (keeping cache): ${e instanceof Error ? e.message : String(e)}`);
+      }
+    }
+    if (!hasBuiltEntry(dir) && !opts.offline) {
+      await buildInPlace(dir, log);
+    }
+    return dir;
+  }
+
+  if (opts.offline) {
+    throw new Error(`skillRef ${parsed.marketplaceRef} not in cache (offline)`);
+  }
+
+  const descriptor = await fetchInstallDescriptor(parsed.marketplaceRef, opts.apiBase);
+  const gitRef = parsed.gitRef !== "main" ? parsed.gitRef : descriptor.ref || "main";
+  const repoUrl = descriptor.githubUrl.endsWith(".git")
+    ? descriptor.githubUrl
+    : `${descriptor.githubUrl}.git`;
+
+  mkdirSync(join(cacheRoot, parsed.owner, parsed.skill), { recursive: true });
+  if (!existsSync(join(dir, ".git"))) {
+    log(`Cloning ${repoUrl} (${gitRef}) → ${dir}`);
+    try {
+      run(
+        "git",
+        ["clone", "--branch", gitRef, "--single-branch", "--depth", "1", repoUrl, dir],
+        join(cacheRoot, parsed.owner, parsed.skill),
+        log,
+      );
+    } catch {
+      // Branch pin may be a tag or default branch name mismatch — full clone + checkout.
+      run("git", ["clone", "--depth", "1", repoUrl, dir], join(cacheRoot, parsed.owner, parsed.skill), log);
+      try {
+        run("git", ["checkout", gitRef], dir, log);
+      } catch {
+        /* stay on default branch */
+      }
+    }
+  }
+
+  // Marker for which marketplace ref produced this cache entry
+  try {
+    writeFileSync(
+      join(dir, ".agenticros-skill-ref.json"),
+      JSON.stringify(
+        {
+          marketplaceRef: parsed.marketplaceRef,
+          gitRef,
+          githubUrl: descriptor.githubUrl,
+          cachedAt: new Date().toISOString(),
+        },
+        null,
+        2,
+      ),
+    );
+  } catch {
+    /* ignore */
+  }
+
+  await buildInPlace(dir, log);
+  return dir;
+}
+
+async function buildInPlace(dir: string, log: (m: string) => void): Promise<void> {
+  if (hasBuiltEntry(dir)) return;
+  const useNpm = !hasBin("pnpm");
+  if (useNpm) {
+    run("npm", ["install"], dir, log);
+    run("npm", ["run", "build"], dir, log);
+  } else {
+    run("pnpm", ["install"], dir, log);
+    run("pnpm", ["run", "build"], dir, log);
+  }
+}
+
+/**
+ * Resolve all config.skillRefs into absolute directories.
+ * Does not mutate config — caller merges into skillPaths.
+ */
+export async function resolveSkillRefs(
+  refs: string[],
+  opts: ResolveSkillRefsOptions = {},
+): Promise<ResolveSkillRefsResult> {
+  const paths: string[] = [];
+  const errors: ResolveSkillRefsResult["errors"] = [];
+  const seen = new Set<string>();
+  for (const raw of refs) {
+    try {
+      const dir = await ensureSkillRefCached(raw, opts);
+      if (!seen.has(dir)) {
+        seen.add(dir);
+        paths.push(dir);
+      }
+    } catch (e) {
+      errors.push({
+        ref: raw,
+        error: e instanceof Error ? e.message : String(e),
+      });
+    }
+  }
+  return { paths, errors };
+}
+
+/**
+ * Return a config copy with skillRefs resolved into skillPaths (deduped).
+ * Sync-friendly path: if offline or empty refs, returns config unchanged
+ * except merging any already-cached paths when possible without network.
+ */
+export async function withResolvedSkillRefs(
+  config: AgenticROSConfig,
+  opts: ResolveSkillRefsOptions = {},
+): Promise<{ config: AgenticROSConfig; errors: ResolveSkillRefsResult["errors"] }> {
+  const refs = config.skillRefs ?? [];
+  if (refs.length === 0) {
+    return { config, errors: [] };
+  }
+  const { paths, errors } = await resolveSkillRefs(refs, opts);
+  const merged = [...(config.skillPaths ?? [])];
+  const have = new Set(merged.map((p) => p));
+  for (const p of paths) {
+    if (!have.has(p)) {
+      have.add(p);
+      merged.push(p);
+    }
+  }
+  return {
+    config: { ...config, skillPaths: merged },
+    errors,
+  };
+}
+
+/**
+ * Sync: merge skillRefs that are already present under the skills-cache
+ * into skillPaths. No network — use CLI install / ensureSkillRefCached to
+ * populate the cache first. Safe for OpenClaw's synchronous register().
+ */
+export function applyCachedSkillRefs(config: AgenticROSConfig): AgenticROSConfig {
+  const refs = config.skillRefs ?? [];
+  if (refs.length === 0) return config;
+  const cacheRoot = skillsCacheDir();
+  const merged = [...(config.skillPaths ?? [])];
+  const have = new Set(merged);
+  for (const raw of refs) {
+    const parsed = parseSkillRef(raw);
+    if (!parsed) continue;
+    const dir = cachePathFor(cacheRoot, parsed.owner, parsed.skill, parsed.gitRef);
+    if (existsSync(join(dir, "package.json")) && !have.has(dir)) {
+      have.add(dir);
+      merged.push(dir);
+    }
+  }
+  if (merged.length === (config.skillPaths ?? []).length) return config;
+  return { ...config, skillPaths: merged };
+}
+
+/** Repo name hint from github URL (for logging). */
+export function githubRepoBasename(githubUrl: string): string {
+  return basename(githubUrl.replace(/\.git$/, "").replace(/\/+$/, ""));
+}

package/runtime/pnpm-lock.yaml

@@ -65,6 +65,9 @@ importers:
 
   packages/agenticros-cli:
     dependencies:
+      '@agenticros/core':
+        specifier: ^0.7.0
+        version: 0.7.0
       '@inquirer/prompts':
         specifier: ^7.0.0
         version: 7.10.1(@types/node@20.19.35)
@@ -175,6 +178,10 @@ importers:
 
 packages:
 
+  '@agenticros/core@0.7.0':
+    resolution: {integrity: sha512-tbcKSf34DVD+pO51goHw1zbu/L12nP3oPvOHoFJK48qaZ4kuejEepljo5xUNB84AtA/QnH9quMPUZbc8rVF8zQ==}
+    engines: {node: '>=20'}
+
   '@eclipse-zenoh/zenoh-ts@1.9.0':
     resolution: {integrity: sha512-qG3VR9Yt81+KjH0WOybyKcNVS0vtBmmhyUJ7dCc5n+8AeAEYTpEvMBTh43Lwu8P+imzMYvFqjaMAO2HFK+x9hA==}
 
@@ -1974,6 +1981,23 @@ packages:
 
 snapshots:
 
+  '@agenticros/core@0.7.0':
+    dependencies:
+      '@eclipse-zenoh/zenoh-ts': 1.9.0(patch_hash=pdjq6ms3zvqwikn6vpqzasydsy)
+      '@foxglove/cdr': 3.5.0
+      '@foxglove/rosmsg': 4.2.2
+      '@foxglove/rosmsg2-serialization': 3.1.0
+      ws: 8.19.0
+      zod: 3.25.76
+    optionalDependencies:
+      node-datachannel: 0.12.0
+      rclnodejs: 1.8.2
+    transitivePeerDependencies:
+      - bufferutil
+      - jiti
+      - supports-color
+      - utf-8-validate
+
   '@eclipse-zenoh/zenoh-ts@1.9.0(patch_hash=pdjq6ms3zvqwikn6vpqzasydsy)':
     dependencies:
       '@thi.ng/leb128': 3.1.79

package/runtime/scripts/check-cli-tarball-install.mjs

@@ -32,7 +32,16 @@
  */
 
 import { execSync, spawnSync } from "node:child_process";
-import { existsSync, mkdirSync, mkdtempSync, readdirSync, rmSync } from "node:fs";
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readdirSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -132,6 +141,31 @@ try {
   }
   ok(`Extracted to ${pkgDir}`);
 
+  // 3a. published package.json must not contain pnpm workspace: protocol
+  // (npm / npx consumers cannot resolve workspace:* — broke agenticros@0.4.0).
+  step("Checking published package.json has no workspace: dependencies...");
+  const publishedPkg = JSON.parse(
+    readFileSync(join(pkgDir, "package.json"), "utf8"),
+  );
+  const badDeps = [];
+  for (const section of ["dependencies", "optionalDependencies", "peerDependencies"]) {
+    const block = publishedPkg[section];
+    if (!block || typeof block !== "object") continue;
+    for (const [name, range] of Object.entries(block)) {
+      if (typeof range === "string" && range.startsWith("workspace:")) {
+        badDeps.push(`${section}.${name}=${range}`);
+      }
+    }
+  }
+  if (badDeps.length > 0) {
+    fail(
+      `Published package.json still has workspace: protocol (npm cannot install this):\n    ${badDeps.join("\n    ")}\n` +
+        `Use a semver range against the published @agenticros/core (e.g. "^0.7.0").`,
+    );
+    process.exit(1);
+  }
+  ok("No workspace: protocol in published dependencies.");
+
   // 3. critical files present in the SHIPPED tarball
   step("Verifying critical runtime files are in the tarball...");
   const runtimeInTar = join(pkgDir, "runtime");
@@ -150,8 +184,7 @@ try {
 
   // 5. write inline .npmrc (mirrors init.ts writeInitNpmrcInline)
   step("Writing inline .npmrc (mirroring writeInitNpmrcInline)...");
-  const fs = await import("node:fs");
-  fs.writeFileSync(
+  writeFileSync(
     join(installDir, ".npmrc"),
     [
       "shamefully-hoist=false",
@@ -220,9 +253,9 @@ try {
   step("Simulating refresh over a pre-existing snapshot (regression test for 0.1.7)...");
   const fakeOld = join(work, "old-install");
   mkdirSync(fakeOld);
-  fs.writeFileSync(join(fakeOld, "tsconfig.base.json"), '{"old":"to-be-overwritten"}');
+  writeFileSync(join(fakeOld, "tsconfig.base.json"), '{"old":"to-be-overwritten"}');
   mkdirSync(join(fakeOld, "packages"), { recursive: true });
-  fs.writeFileSync(
+  writeFileSync(
     join(fakeOld, "packages", "preserved.txt"),
     "must survive overlay refresh",
   );
@@ -234,7 +267,7 @@ try {
     const src = join(runtimeInTar, rel);
     const dst = join(fakeOld, rel);
     if (!existsSync(src)) continue;
-    const srcIsDir = fs.statSync(src).isDirectory();
+    const srcIsDir = statSync(src).isDirectory();
     if (srcIsDir && existsSync(dst)) {
       run("cp", ["-a", `${src}/.`, `${dst}/`]);
     } else {
@@ -243,12 +276,12 @@ try {
     }
   }
 
-  const tsStat = fs.statSync(join(fakeOld, "tsconfig.base.json"));
+  const tsStat = statSync(join(fakeOld, "tsconfig.base.json"));
   if (!tsStat.isFile()) {
     fail("Refresh turned tsconfig.base.json into a non-file. cp branching is wrong.");
     process.exit(1);
   }
-  const tsContent = fs.readFileSync(join(fakeOld, "tsconfig.base.json"), "utf8");
+  const tsContent = readFileSync(join(fakeOld, "tsconfig.base.json"), "utf8");
   if (tsContent.includes('"old":"to-be-overwritten"')) {
     fail("Refresh failed to overwrite tsconfig.base.json with the bundle's version.");
     process.exit(1);