agentinit 1.19.0 → 1.20.1

package/dist/core/skillsManager.js

@@ -6,9 +6,12 @@ import { createHash } from 'crypto';
 import { promisify } from 'util';
 import matter from 'gray-matter';
 import { createRelativeSymlink, fileExists, isDirectory, listFiles, readFileIfExists, resolveRealPathOrSelf, } from '../utils/fs.js';
+import { expandTilde } from '../utils/paths.js';
 import { AgentManager } from './agentManager.js';
 import { getConfiguredDefaultMarketplaceId, getMarketplace, getMarketplaceIds } from './marketplaceRegistry.js';
+import { SkillSecurityScanner } from './skillSecurityScanner.js';
 import { SHARED_SKILLS_TARGET_ID } from '../types/skills.js';
+import { InstallLock, hashDirectory, logLockWriteWarning } from './installLock.js';
 const execFileAsync = promisify(execFile);
 const DEFAULT_SKILLS_CATALOG = {
     owner: 'vercel-labs',
@@ -31,6 +34,7 @@ const SKILL_SEARCH_DIRS = [
 export class SkillsManager {
     agentManager;
     preparedSourceContexts = new Map();
+    skillScanner = new SkillSecurityScanner();
     constructor(agentManager) {
         this.agentManager = agentManager || new AgentManager();
     }
@@ -43,12 +47,16 @@ export class SkillsManager {
             return { type: 'local', path: source };
         }
         // Full GitHub URL
-        const githubUrlSource = this.parseGitHubHttpSource(source);
-        if (githubUrlSource) {
-            return githubUrlSource;
+        const httpSource = this.parseHttpRepositorySource(source);
+        if (httpSource) {
+            return httpSource;
         }
         // Full git URL
-        if (source.startsWith('git@') || source.endsWith('.git')) {
+        const sshSource = this.parseSshRepositorySource(source);
+        if (sshSource) {
+            return sshSource;
+        }
+        if (source.endsWith('.git')) {
             return { type: 'github', url: source };
         }
         if (options?.from) {
@@ -61,6 +69,14 @@ export class SkillsManager {
                 pluginName: source,
             };
         }
+        const gitLabShorthandSource = this.parseGitLabShorthandSource(source);
+        if (gitLabShorthandSource) {
+            return gitLabShorthandSource;
+        }
+        const bitbucketShorthandSource = this.parseBitbucketShorthandSource(source);
+        if (bitbucketShorthandSource) {
+            return bitbucketShorthandSource;
+        }
         const githubShorthandSource = this.parseGitHubShorthandSource(source);
         if (githubShorthandSource?.subpath) {
             return githubShorthandSource;
@@ -161,6 +177,110 @@ export class SkillsManager {
             return null;
         }
     }
+    parseGitLabHttpSource(source) {
+        if (!source.startsWith('https://gitlab.com/') && !source.startsWith('http://gitlab.com/')) {
+            return null;
+        }
+        try {
+            const parsedUrl = new URL(source);
+            const segments = parsedUrl.pathname.replace(/\/+$/, '').split('/').filter(Boolean);
+            const dashIndex = segments.indexOf('-');
+            const repoBoundary = dashIndex >= 0 ? dashIndex : segments.length;
+            if (repoBoundary < 2) {
+                return null;
+            }
+            const repo = segments[repoBoundary - 1];
+            const owner = segments.slice(0, repoBoundary - 1).join('/');
+            if (!owner || !repo) {
+                return null;
+            }
+            let subpath;
+            if (dashIndex >= 0) {
+                const marker = segments[dashIndex + 1];
+                if ((marker === 'tree' || marker === 'blob') && segments.length > dashIndex + 3) {
+                    subpath = segments.slice(dashIndex + 3).join('/');
+                }
+            }
+            return {
+                type: 'gitlab',
+                url: `https://gitlab.com/${owner}/${repo}.git`,
+                owner,
+                repo,
+                ...(subpath ? { subpath } : {}),
+            };
+        }
+        catch {
+            return null;
+        }
+    }
+    parseBitbucketHttpSource(source) {
+        if (!source.startsWith('https://bitbucket.org/') && !source.startsWith('http://bitbucket.org/')) {
+            return null;
+        }
+        try {
+            const parsedUrl = new URL(source);
+            const segments = parsedUrl.pathname.replace(/\/+$/, '').split('/').filter(Boolean);
+            if (segments.length < 2) {
+                return null;
+            }
+            const [owner, repo, marker, _commitish, ...rest] = segments;
+            if (!owner || !repo) {
+                return null;
+            }
+            let subpath;
+            if (marker === 'src' && rest.length > 0) {
+                subpath = rest.join('/');
+            }
+            return {
+                type: 'bitbucket',
+                url: `https://bitbucket.org/${owner}/${repo}.git`,
+                owner,
+                repo,
+                ...(subpath ? { subpath } : {}),
+            };
+        }
+        catch {
+            return null;
+        }
+    }
+    parseHttpRepositorySource(source) {
+        return this.parseGitHubHttpSource(source)
+            || this.parseGitLabHttpSource(source)
+            || this.parseBitbucketHttpSource(source);
+    }
+    parseSshRepositorySource(source) {
+        const githubMatch = source.match(/^git@github\.com:([^/]+)\/([^/]+?)(?:\.git)?$/);
+        if (githubMatch) {
+            const [, owner, repo] = githubMatch;
+            return {
+                type: 'github',
+                url: `git@github.com:${owner}/${repo}.git`,
+                owner,
+                repo,
+            };
+        }
+        const gitlabMatch = source.match(/^git@gitlab\.com:(.+)\/([^/]+?)(?:\.git)?$/);
+        if (gitlabMatch) {
+            const [, owner, repo] = gitlabMatch;
+            return {
+                type: 'gitlab',
+                url: `git@gitlab.com:${owner}/${repo}.git`,
+                owner,
+                repo,
+            };
+        }
+        const bitbucketMatch = source.match(/^git@bitbucket\.org:([^/]+)\/([^/]+?)(?:\.git)?$/);
+        if (bitbucketMatch) {
+            const [, owner, repo] = bitbucketMatch;
+            return {
+                type: 'bitbucket',
+                url: `git@bitbucket.org:${owner}/${repo}.git`,
+                owner,
+                repo,
+            };
+        }
+        return null;
+    }
     parseGitHubShorthandSource(source) {
         const githubShorthandMatch = source.match(/^([a-zA-Z0-9._-]+)\/([a-zA-Z0-9._-]+)(?:\/(.+))?$/);
         if (!githubShorthandMatch) {
@@ -175,6 +295,58 @@ export class SkillsManager {
             ...(subpath ? { subpath } : {}),
         };
     }
+    parseGitLabShorthandSource(source) {
+        const normalized = source.startsWith('gitlab:')
+            ? source.slice('gitlab:'.length)
+            : source.startsWith('gitlab.com/')
+                ? source.slice('gitlab.com/'.length)
+                : null;
+        if (!normalized) {
+            return null;
+        }
+        const [repoSpec = normalized, subpathSpec] = normalized.split('//', 2);
+        const segments = repoSpec.split('/').filter(Boolean);
+        if (segments.length < 2) {
+            return null;
+        }
+        const repo = segments[segments.length - 1];
+        const owner = segments.slice(0, segments.length - 1).join('/');
+        if (!owner || !repo) {
+            return null;
+        }
+        return {
+            type: 'gitlab',
+            url: `https://gitlab.com/${owner}/${repo}.git`,
+            owner,
+            repo,
+            ...(subpathSpec ? { subpath: subpathSpec } : {}),
+        };
+    }
+    parseBitbucketShorthandSource(source) {
+        const normalized = source.startsWith('bitbucket:')
+            ? source.slice('bitbucket:'.length)
+            : source.startsWith('bitbucket.org/')
+                ? source.slice('bitbucket.org/'.length)
+                : null;
+        if (!normalized) {
+            return null;
+        }
+        const segments = normalized.split('/').filter(Boolean);
+        if (segments.length < 2) {
+            return null;
+        }
+        const [owner, repo, ...rest] = segments;
+        if (!owner || !repo) {
+            return null;
+        }
+        return {
+            type: 'bitbucket',
+            url: `https://bitbucket.org/${owner}/${repo}.git`,
+            owner,
+            repo,
+            ...(rest.length > 0 ? { subpath: rest.join('/') } : {}),
+        };
+    }
     /**
      * Parse a SKILL.md file and extract name + description from frontmatter
      */
@@ -322,7 +494,7 @@ export class SkillsManager {
     }
     async resolveDiscoveryRoot(repoPath, source, sourceLabel) {
         const resolvedRepoPath = resolve(repoPath);
-        if (source.type !== 'github' || !source.subpath) {
+        if ((source.type !== 'github' && source.type !== 'gitlab' && source.type !== 'bitbucket') || !source.subpath) {
             return resolvedRepoPath;
         }
         const discoveryRoot = resolve(resolvedRepoPath, source.subpath);
@@ -367,7 +539,7 @@ export class SkillsManager {
                 };
             }
             let repoPath;
-            if (resolved.type === 'github') {
+            if (resolved.type === 'github' || resolved.type === 'gitlab' || resolved.type === 'bitbucket') {
                 if (!resolved.url) {
                     throw new Error(`Invalid source: ${source}`);
                 }
@@ -543,7 +715,7 @@ export class SkillsManager {
             ...(options.global !== undefined ? { global: options.global } : {}),
             ...(options.copy !== undefined ? { copy: options.copy } : {}),
         });
-        return this.compareSkillSnapshot(skill, plan.canonicalPath || plan.path);
+        return this.compareSkillInstallStatus(skill, plan);
     }
     async installSkillForAgent(skillPath, skillName, agent, projectPath, options = {}) {
         const plan = await this.getInstallPlan(skillName, agent, projectPath, options);
@@ -625,6 +797,76 @@ export class SkillsManager {
             mode: 'symlink',
         };
     }
+    normalizeSkillPrefix(prefix) {
+        const normalized = prefix?.trim() ?? '';
+        if (normalized.includes('/') || normalized.includes('\\')) {
+            throw new Error(`Invalid skill prefix: ${prefix}`);
+        }
+        return normalized;
+    }
+    withSkillPrefix(skillName, prefix) {
+        const normalizedPrefix = this.normalizeSkillPrefix(prefix);
+        return normalizedPrefix ? `${normalizedPrefix}${skillName}` : skillName;
+    }
+    async rewriteSkillFileName(filePath, skillName) {
+        const content = await fs.readFile(filePath, 'utf8');
+        const parsed = matter(content);
+        const nextContent = matter.stringify(parsed.content, {
+            ...parsed.data,
+            name: skillName,
+        });
+        await fs.writeFile(filePath, nextContent, 'utf8');
+    }
+    async applyPrefixToSkills(skills, prefix) {
+        const normalizedPrefix = this.normalizeSkillPrefix(prefix);
+        if (!normalizedPrefix) {
+            return { skills, cleanup: async () => { } };
+        }
+        const tempDirs = [];
+        try {
+            const prefixedSkills = await Promise.all(skills.map(async (skill) => {
+                const name = this.withSkillPrefix(skill.name, normalizedPrefix);
+                if (skill.generatedContent) {
+                    return {
+                        ...skill,
+                        name,
+                        generatedContent: matter.stringify(matter(skill.generatedContent).content, {
+                            ...matter(skill.generatedContent).data,
+                            name,
+                        }),
+                    };
+                }
+                const tempRoot = await fs.mkdtemp(join(tmpdir(), 'agentinit-prefixed-skill-'));
+                const tempSkillPath = join(tempRoot, basename(skill.path));
+                tempDirs.push(tempRoot);
+                await this.copyDir(skill.path, tempSkillPath);
+                const skillMdPath = join(tempSkillPath, 'SKILL.md');
+                const skillMdPathLower = join(tempSkillPath, 'skill.md');
+                const skillFile = (await fileExists(skillMdPath)) ? skillMdPath
+                    : (await fileExists(skillMdPathLower)) ? skillMdPathLower
+                        : null;
+                if (!skillFile) {
+                    throw new Error(`Skill "${skill.name}" is missing SKILL.md`);
+                }
+                await this.rewriteSkillFileName(skillFile, name);
+                return {
+                    ...skill,
+                    name,
+                    path: tempSkillPath,
+                };
+            }));
+            return {
+                skills: prefixedSkills,
+                cleanup: async () => {
+                    await Promise.all(tempDirs.map(dir => fs.rm(dir, { recursive: true, force: true }).catch(() => { })));
+                },
+            };
+        }
+        catch (error) {
+            await Promise.all(tempDirs.map(dir => fs.rm(dir, { recursive: true, force: true }).catch(() => { })));
+            throw error;
+        }
+    }
     normalizeSkillName(skillName) {
         const normalized = skillName.trim();
         if (!normalized) {
@@ -693,6 +935,23 @@ export class SkillsManager {
             return 'new';
         return existing === incoming ? 'unchanged' : 'changed';
     }
+    async compareSkillInstallStatus(skill, plan) {
+        const incoming = await this.getNewSkillSnapshot(skill);
+        if (incoming === null)
+            return 'new';
+        const existingAtTarget = await this.readExistingSkillSnapshot(plan.path);
+        if (existingAtTarget !== null) {
+            return existingAtTarget === incoming ? 'unchanged' : 'changed';
+        }
+        if (!plan.canonicalPath || plan.canonicalPath === plan.path) {
+            return 'new';
+        }
+        const existingAtCanonical = await this.readExistingSkillSnapshot(plan.canonicalPath);
+        if (existingAtCanonical === null) {
+            return 'new';
+        }
+        return existingAtCanonical === incoming ? 'new' : 'changed';
+    }
     async cleanAndCreateDirectory(path) {
         await fs.rm(path, { recursive: true, force: true }).catch(() => { });
         await fs.mkdir(path, { recursive: true });
@@ -713,11 +972,13 @@ export class SkillsManager {
      * Add skills from a source (GitHub repo or local path)
      */
     async addFromSource(source, projectPath, options = {}) {
+        const normalizedPrefix = this.normalizeSkillPrefix(options.prefix);
         const context = this.takePreparedSourceContext(source, projectPath, options.from)
             || await this.loadDiscoveredSkillsContext(source, projectPath, {
                 ...(options.from !== undefined ? { from: options.from } : {}),
                 ...(options.pluginName !== undefined ? { pluginName: options.pluginName } : {}),
             });
+        let prefixedCleanup = async () => { };
         try {
             let skills = context.skills;
             if (skills.length === 0) {
@@ -725,7 +986,37 @@ export class SkillsManager {
             }
             if (options.skills && options.skills.length > 0) {
                 const names = new Set(options.skills.map(skill => skill.toLowerCase()));
-                skills = skills.filter(skill => names.has(skill.name.toLowerCase()));
+                skills = skills.filter(skill => names.has(skill.name.toLowerCase())
+                    || names.has(this.withSkillPrefix(skill.name, normalizedPrefix).toLowerCase()));
+            }
+            const prefixed = await this.applyPrefixToSkills(skills, normalizedPrefix);
+            skills = prefixed.skills;
+            prefixedCleanup = prefixed.cleanup;
+            const result = { installed: [], updated: [], unchanged: [], skipped: [], warnings: [...context.warnings] };
+            if (options.scan !== false) {
+                const scannedWarnings = new Set();
+                const scannableSkills = [];
+                for (const skill of skills) {
+                    const scan = await this.skillScanner.scanSkill(skill);
+                    if (scan.findings.length === 0) {
+                        scannableSkills.push(skill);
+                        continue;
+                    }
+                    if (scan.blocked && !options.allowRisky) {
+                        result.skipped.push({
+                            skill,
+                            reason: this.skillScanner.formatBlockingReason(scan),
+                        });
+                        continue;
+                    }
+                    const summary = this.skillScanner.formatShortSummary(scan);
+                    scannedWarnings.add(scan.blocked
+                        ? `Proceeding with "${skill.name}" despite high-risk findings: ${summary}`
+                        : `Security warnings for "${skill.name}": ${summary}`);
+                    scannableSkills.push(skill);
+                }
+                skills = scannableSkills;
+                result.warnings.push(...scannedWarnings);
             }
             const installToSharedStore = options.agents?.includes(SHARED_SKILLS_TARGET_ID) ?? false;
             const agents = await this.getTargetAgents(projectPath, options);
@@ -734,13 +1025,15 @@ export class SkillsManager {
                     installed: [],
                     updated: [],
                     unchanged: [],
-                    skipped: skills.map(skill => ({ skill, reason: 'No target agents found' })),
-                    warnings: context.warnings,
+                    skipped: [
+                        ...result.skipped,
+                        ...skills.map(skill => ({ skill, reason: 'No target agents found' })),
+                    ],
+                    warnings: result.warnings,
                 };
             }
-            const result = { installed: [], updated: [], unchanged: [], skipped: [], warnings: context.warnings };
             const installableAgents = [];
-            // Cache comparison results by canonical path to avoid re-comparing for multiple agents
+            // Cache comparison results by install path to avoid re-comparing the same target
             const comparisonCache = new Map();
             // Collect pending updates to prompt user once for all of them
             const pendingUpdates = [];
@@ -795,10 +1088,10 @@ export class SkillsManager {
                             ...(options.copy !== undefined ? { copy: options.copy } : {}),
                         };
                         const plan = await this.getInstallPlan(skill.name, agent, projectPath, installOptions);
-                        const comparisonPath = plan.canonicalPath || plan.path;
+                        const comparisonPath = plan.path;
                         let comparison = comparisonCache.get(comparisonPath);
                         if (comparison === undefined) {
-                            comparison = await this.compareSkillSnapshot(skill, comparisonPath);
+                            comparison = await this.compareSkillInstallStatus(skill, plan);
                             comparisonCache.set(comparisonPath, comparison);
                         }
                         if (comparison === 'unchanged') {
@@ -857,9 +1150,50 @@ export class SkillsManager {
                     }
                 }
             }
+            // Record to global install lock
+            try {
+                const lock = new InstallLock();
+                const fromOption = options.from;
+                const { source: resolvedSource } = this.resolveSourceRequest(source, ...(fromOption ? [{ from: fromOption }] : []));
+                const lockSource = {
+                    type: resolvedSource.type,
+                    ...(resolvedSource.marketplace ? { marketplace: resolvedSource.marketplace } : {}),
+                    ...(resolvedSource.pluginName ? { pluginName: resolvedSource.pluginName } : {}),
+                    ...(normalizedPrefix ? { prefix: normalizedPrefix } : {}),
+                    ...(resolvedSource.url ? { url: resolvedSource.url } : {}),
+                    ...(resolvedSource.path ? { path: resolve(projectPath, expandTilde(resolvedSource.path)) } : {}),
+                    ...(resolvedSource.owner ? { owner: resolvedSource.owner } : {}),
+                    ...(resolvedSource.repo ? { repo: resolvedSource.repo } : {}),
+                    ...(resolvedSource.subpath ? { subpath: resolvedSource.subpath } : {}),
+                };
+                const recordEntries = async (entries, action) => {
+                    for (const entry of entries) {
+                        const hashPath = entry.canonicalPath || entry.path;
+                        const contentHash = await hashDirectory(hashPath);
+                        await lock.recordSkill({
+                            action,
+                            name: entry.skill.name,
+                            projectPath: resolve(projectPath),
+                            agents: [entry.agent],
+                            scope: options.global ? 'global' : 'project',
+                            source: lockSource,
+                            installPath: entry.path,
+                            mode: entry.mode,
+                            ...(entry.canonicalPath ? { canonicalPath: entry.canonicalPath } : {}),
+                            ...(contentHash ? { contentHash } : {}),
+                        });
+                    }
+                };
+                await recordEntries(result.installed, 'install');
+                await recordEntries(result.updated, 'update');
+            }
+            catch (error) {
+                logLockWriteWarning('Skills changed successfully', error);
+            }
             return result;
         }
         finally {
+            await prefixedCleanup();
             await context.cleanup();
         }
     }
@@ -1060,6 +1394,31 @@ export class SkillsManager {
                 notFound.push(name);
             }
         }
+        // Record removals to global install lock
+        try {
+            if (targetedEntries.length > 0) {
+                const lock = new InstallLock();
+                for (const entry of targetedEntries) {
+                    const entryKey = `${entry.agent}:${entry.name}`;
+                    if (!removed.includes(entryKey))
+                        continue;
+                    await lock.recordSkill({
+                        action: 'remove',
+                        name: entry.name,
+                        projectPath: resolve(projectPath),
+                        agents: [entry.agent],
+                        scope: entry.scope,
+                        source: { type: 'local', path: entry.path },
+                        installPath: entry.path,
+                        mode: entry.mode,
+                        ...(entry.canonicalPath ? { canonicalPath: entry.canonicalPath } : {}),
+                    });
+                }
+            }
+        }
+        catch (error) {
+            logLockWriteWarning('Skills removed successfully', error);
+        }
         return { removed, notFound, skipped };
     }
 }