aiden-runtime 3.16.0

package/dist/core/skillImporter.js

@@ -0,0 +1,303 @@
+"use strict";
+// ============================================================
+// DevOS — Autonomous AI Execution System
+// Copyright (c) 2026 Shiva Deore. All rights reserved.
+// ============================================================
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.importFromUrl = importFromUrl;
+exports.importFromGitHub = importFromGitHub;
+exports.importFromLocal = importFromLocal;
+exports.importSkill = importSkill;
+// core/skillImporter.ts — agentskills.io-compatible skill importer.
+//
+// Supports importing skills from:
+//   - GitHub repos:  importFromGitHub('owner/repo', [subpath])
+//   - HTTPS URLs:    importFromUrl('https://...')
+//   - Local paths:   importFromLocal('/path/to/skill-dir')
+//
+// Security gates (enforced unconditionally):
+//   1. HTTPS only for remote imports (http:// blocked)
+//   2. SKILL.md ≤ 100 KB
+//   3. Total skill dir ≤ 10 MB
+//   4. Scripts must live in scripts/ subdir
+//   5. Script extensions: .py .sh .js .ts .mjs only
+//   6. enabled: false always set on freshly imported skills
+//   7. No existing skill overwrite without { force: true }
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const skillLoader_1 = require("./skillLoader");
+const skillValidator_1 = require("./skillValidator");
+// ── Constants ──────────────────────────────────────────────────
+const MAX_SKILL_MD_BYTES = 100 * 1024; // 100 KB
+const MAX_TOTAL_BYTES = 10 * 1024 * 1024; // 10 MB
+const ALLOWED_EXTS = new Set(['.py', '.sh', '.js', '.ts', '.mjs']);
+const GITHUB_API_BASE = 'https://api.github.com';
+// ── Security helpers ───────────────────────────────────────────
+function assertHttps(url) {
+    if (!url.startsWith('https://')) {
+        throw new Error(`Security: only HTTPS imports are allowed (got: ${url.slice(0, 40)})`);
+    }
+}
+function assertSize(buf, max, label) {
+    const size = Buffer.isBuffer(buf) ? buf.length : Buffer.byteLength(buf, 'utf-8');
+    if (size > max) {
+        throw new Error(`Security: ${label} exceeds limit (${size} bytes > ${max} bytes)`);
+    }
+}
+function assertScriptExt(filename) {
+    const ext = path_1.default.extname(filename).toLowerCase();
+    if (ext && !ALLOWED_EXTS.has(ext)) {
+        throw new Error(`Security: script extension "${ext}" not allowed (permitted: .py .sh .js .ts .mjs)`);
+    }
+}
+// ── Fetch helper (Node 18 built-in fetch) ──────────────────────
+async function fetchText(url, headers) {
+    assertHttps(url);
+    const resp = await fetch(url, {
+        headers: { 'User-Agent': 'Aiden/3.8.1 (agentskills-importer)', ...headers },
+        signal: AbortSignal.timeout(15000),
+    });
+    if (!resp.ok)
+        throw new Error(`HTTP ${resp.status} fetching ${url}`);
+    const text = await resp.text();
+    assertSize(text, MAX_SKILL_MD_BYTES, `response from ${url}`);
+    return text;
+}
+// ── Determine install destination ─────────────────────────────
+function resolveDestDir(skillId, opts) {
+    if (opts.destDir)
+        return opts.destDir;
+    return path_1.default.join(process.cwd(), 'skills', 'installed', skillId);
+}
+// ── Inject/update import metadata in SKILL.md frontmatter ─────
+function injectImportMeta(raw, source, importedFrom) {
+    // Always set enabled: false, source, imported-from in the frontmatter
+    const fmMatch = raw.match(/^(---\s*\n)([\s\S]*?)(\n---\s*\n)/);
+    if (!fmMatch) {
+        // No frontmatter — prepend one
+        return `---\nenabled: false\nsource: ${source}\nimported-from: ${importedFrom}\n---\n\n${raw}`;
+    }
+    let fm = fmMatch[2];
+    // Remove any existing enabled / source / imported-from lines
+    fm = fm.replace(/^enabled:.*$/m, '').replace(/^source:.*$/m, '').replace(/^imported-from:.*$/m, '');
+    // Add controlled fields
+    fm = fm.trimEnd();
+    fm += `\nenabled: false\nsource: ${source}\nimported-from: ${importedFrom}`;
+    return `${fmMatch[1]}${fm}${fmMatch[3]}${raw.slice(fmMatch[0].length)}`;
+}
+// ── Extract skill name from SKILL.md frontmatter ──────────────
+function extractSkillName(raw, fallback) {
+    const m = raw.match(/^name:\s*(.+)$/m);
+    return m ? m[1].trim().replace(/^['"]|['"]$/g, '') : fallback;
+}
+// ── Write skill directory ──────────────────────────────────────
+function writeSkillFiles(destDir, skillMdContent, extraFiles = []) {
+    // Check total size
+    let totalSize = Buffer.byteLength(skillMdContent, 'utf-8');
+    for (const f of extraFiles) {
+        totalSize += Buffer.isBuffer(f.content) ? f.content.length : Buffer.byteLength(f.content, 'utf-8');
+    }
+    assertSize(Buffer.alloc(totalSize), MAX_TOTAL_BYTES, 'total skill package');
+    // Validate script extensions in extra files
+    for (const f of extraFiles) {
+        const parts = f.relPath.split('/');
+        const inSub = parts.length > 1;
+        const subdir = parts[0];
+        if (!inSub)
+            continue;
+        if (subdir === 'scripts')
+            assertScriptExt(parts[parts.length - 1]);
+        // Files in non-standard subdirs are fine (references/, assets/, etc.)
+    }
+    fs_1.default.mkdirSync(destDir, { recursive: true });
+    fs_1.default.writeFileSync(path_1.default.join(destDir, 'SKILL.md'), skillMdContent, 'utf-8');
+    for (const f of extraFiles) {
+        const fullPath = path_1.default.join(destDir, f.relPath);
+        fs_1.default.mkdirSync(path_1.default.dirname(fullPath), { recursive: true });
+        if (Buffer.isBuffer(f.content)) {
+            fs_1.default.writeFileSync(fullPath, f.content);
+        }
+        else {
+            fs_1.default.writeFileSync(fullPath, f.content, 'utf-8');
+        }
+    }
+}
+// ── Import from HTTPS URL (single SKILL.md file) ──────────────
+async function importFromUrl(url, opts = {}) {
+    try {
+        assertHttps(url);
+        const raw = await fetchText(url);
+        const fallbackId = url.split('/').pop()?.replace(/[^a-z0-9-]/gi, '-').toLowerCase() ?? 'imported';
+        const skillId = extractSkillName(raw, fallbackId);
+        const destDir = resolveDestDir(skillId, opts);
+        if (!opts.force && fs_1.default.existsSync(destDir)) {
+            return { success: false, error: `Skill "${skillId}" already exists. Use force:true to overwrite.` };
+        }
+        const patched = injectImportMeta(raw, opts.source ?? url, url);
+        writeSkillFiles(destDir, patched);
+        skillLoader_1.skillLoader.refresh();
+        const validation = (0, skillValidator_1.validateSkillDir)(destDir);
+        return { success: true, skillId, destPath: destDir, validation };
+    }
+    catch (e) {
+        return { success: false, error: e.message };
+    }
+}
+// ── Import from GitHub repo ────────────────────────────────────
+// Fetches SKILL.md (and optionally scripts/, references/, assets/) via GitHub API.
+async function importFromGitHub(ownerRepo, // "owner/repo"
+opts = {}) {
+    try {
+        const [owner, repo] = ownerRepo.split('/');
+        if (!owner || !repo)
+            throw new Error(`Invalid owner/repo format: "${ownerRepo}"`);
+        const branch = opts.branch ?? 'main';
+        const subpath = opts.subpath ?? '';
+        // Try raw.githubusercontent.com first (no rate limit header required)
+        const basePath = subpath ? `${subpath}/` : '';
+        const rawBase = `https://raw.githubusercontent.com/${owner}/${repo}/${branch}/${basePath}`;
+        const skillMdUrl = `${rawBase}SKILL.md`;
+        assertHttps(skillMdUrl);
+        let raw;
+        try {
+            raw = await fetchText(skillMdUrl);
+        }
+        catch {
+            // Try GitHub API as fallback (needed for non-default branch / private repos with token)
+            const apiUrl = `${GITHUB_API_BASE}/repos/${owner}/${repo}/contents/${basePath}SKILL.md?ref=${branch}`;
+            const apiRaw = await fetchText(apiUrl);
+            const parsed = JSON.parse(apiRaw);
+            if (parsed.encoding === 'base64' && parsed.content) {
+                raw = Buffer.from(parsed.content.replace(/\n/g, ''), 'base64').toString('utf-8');
+            }
+            else {
+                throw new Error('Could not decode SKILL.md from GitHub API response');
+            }
+        }
+        const fallbackId = repo.toLowerCase().replace(/[^a-z0-9-]/g, '-');
+        const skillId = extractSkillName(raw, fallbackId);
+        const destDir = resolveDestDir(skillId, opts);
+        if (!opts.force && fs_1.default.existsSync(destDir)) {
+            return { success: false, error: `Skill "${skillId}" already exists. Use force:true to overwrite.` };
+        }
+        // Also try to fetch scripts/  (best-effort — non-fatal if absent)
+        const extraFiles = [];
+        const EXTRA_SUBDIRS = ['scripts', 'references', 'assets'];
+        for (const subDir of EXTRA_SUBDIRS) {
+            const treeUrl = `${GITHUB_API_BASE}/repos/${owner}/${repo}/git/trees/${branch}?recursive=1`;
+            try {
+                const treeRaw = await fetchText(treeUrl);
+                const tree = JSON.parse(treeRaw);
+                const prefix = basePath + subDir + '/';
+                const entries = tree.tree.filter(e => e.type === 'blob' && e.path.startsWith(prefix));
+                for (const entry of entries) {
+                    const relPath = entry.path.replace(basePath, ''); // e.g. "scripts/main.py"
+                    const fileUrl = `${rawBase}${relPath}`;
+                    // Security: enforce extension for scripts/
+                    if (relPath.startsWith('scripts/'))
+                        assertScriptExt(path_1.default.basename(relPath));
+                    // Security: per-file size check (from tree metadata)
+                    if ((entry.size ?? 0) > MAX_SKILL_MD_BYTES)
+                        continue; // skip huge files silently
+                    try {
+                        const fileContent = await fetchText(fileUrl);
+                        extraFiles.push({ relPath, content: fileContent });
+                    }
+                    catch {
+                        // Non-fatal — skip this file
+                    }
+                }
+                break; // Only need one tree fetch
+            }
+            catch {
+                // Tree API unavailable or repo private — skip extra files
+                break;
+            }
+        }
+        const sourceRef = `github:${ownerRepo}`;
+        const patched = injectImportMeta(raw, opts.source ?? sourceRef, sourceRef);
+        writeSkillFiles(destDir, patched, extraFiles);
+        skillLoader_1.skillLoader.refresh();
+        const validation = (0, skillValidator_1.validateSkillDir)(destDir);
+        return { success: true, skillId, destPath: destDir, validation };
+    }
+    catch (e) {
+        return { success: false, error: e.message };
+    }
+}
+// ── Import from local directory ────────────────────────────────
+async function importFromLocal(srcDir, opts = {}) {
+    try {
+        if (!fs_1.default.existsSync(srcDir)) {
+            return { success: false, error: `Source directory not found: ${srcDir}` };
+        }
+        const skillMdPath = path_1.default.join(srcDir, 'SKILL.md');
+        if (!fs_1.default.existsSync(skillMdPath)) {
+            return { success: false, error: `No SKILL.md found in ${srcDir}` };
+        }
+        const raw = fs_1.default.readFileSync(skillMdPath, 'utf-8');
+        assertSize(raw, MAX_SKILL_MD_BYTES, 'SKILL.md');
+        const skillId = extractSkillName(raw, path_1.default.basename(srcDir));
+        const destDir = resolveDestDir(skillId, opts);
+        if (!opts.force && fs_1.default.existsSync(destDir)) {
+            return { success: false, error: `Skill "${skillId}" already exists. Use force:true to overwrite.` };
+        }
+        // Collect extra files (scripts/, references/, assets/)
+        const extraFiles = [];
+        let totalSize = Buffer.byteLength(raw, 'utf-8');
+        for (const subdir of ['scripts', 'references', 'assets']) {
+            const subdirPath = path_1.default.join(srcDir, subdir);
+            if (!fs_1.default.existsSync(subdirPath))
+                continue;
+            const files = fs_1.default.readdirSync(subdirPath);
+            for (const f of files) {
+                if (subdir === 'scripts')
+                    assertScriptExt(f);
+                const fullPath = path_1.default.join(subdirPath, f);
+                const stat = fs_1.default.statSync(fullPath);
+                if (!stat.isFile())
+                    continue;
+                totalSize += stat.size;
+                assertSize(Buffer.alloc(totalSize), MAX_TOTAL_BYTES, 'total skill package');
+                const content = fs_1.default.readFileSync(fullPath);
+                extraFiles.push({ relPath: `${subdir}/${f}`, content });
+            }
+        }
+        const patched = injectImportMeta(raw, opts.source ?? 'local', srcDir);
+        writeSkillFiles(destDir, patched, extraFiles);
+        skillLoader_1.skillLoader.refresh();
+        const validation = (0, skillValidator_1.validateSkillDir)(destDir);
+        return { success: true, skillId, destPath: destDir, validation };
+    }
+    catch (e) {
+        return { success: false, error: e.message };
+    }
+}
+// ── Smart import — detects type from source string ─────────────
+async function importSkill(source, opts = {}) {
+    source = source.trim();
+    // Strip explicit github: prefix (e.g. "github:owner/repo")
+    if (source.startsWith('github:')) {
+        source = source.slice(7);
+    }
+    // GitHub shorthand: "owner/repo" or "owner/repo/subpath"
+    if (/^[a-z0-9_.-]+\/[a-z0-9_.-]+(\/.*)?$/i.test(source) && !source.startsWith('http')) {
+        const parts = source.split('/');
+        const ownerRepo = `${parts[0]}/${parts[1]}`;
+        const subpath = parts.slice(2).join('/');
+        return importFromGitHub(ownerRepo, { ...opts, subpath: subpath || undefined });
+    }
+    // HTTPS URL
+    if (source.startsWith('https://')) {
+        return importFromUrl(source, opts);
+    }
+    // http:// — blocked
+    if (source.startsWith('http://')) {
+        return { success: false, error: 'Security: only HTTPS imports are allowed (http:// blocked)' };
+    }
+    // Local path
+    return importFromLocal(source, opts);
+}

package/dist/core/skillLibrary.js

@@ -0,0 +1,144 @@
+"use strict";
+// ============================================================
+// DevOS — Autonomous AI Execution System
+// Copyright (c) 2026 Shiva Deore. All rights reserved.
+// ============================================================
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fetchIndex = fetchIndex;
+exports.fetchSkillMarkdown = fetchSkillMarkdown;
+exports.scoreSkillsForTopic = scoreSkillsForTopic;
+exports.installSkill = installSkill;
+exports.invalidateCache = invalidateCache;
+// core/skillLibrary.ts — Browser against the taracodlabs/aiden-skills
+// library. Fetches INDEX.json, scores skills by topic relevance,
+// and installs selected skills to skills/installed/<id>/.
+const https_1 = __importDefault(require("https"));
+const http_1 = __importDefault(require("http"));
+const skillWriter_1 = require("./skillWriter");
+// ── Constants ─────────────────────────────────────────────────
+const LIBRARY_BASE_URL = process.env.AIDEN_SKILL_LIBRARY_URL ??
+    'https://raw.githubusercontent.com/taracodlabs/aiden-skills/main';
+const INDEX_CACHE_TTL_MS = 60 * 60 * 1000; // 1 hour
+// ── In-memory cache ───────────────────────────────────────────
+let _indexCache = null;
+let _indexCachedAt = 0;
+// ── fetchText ─────────────────────────────────────────────────
+// Minimal HTTPS/HTTP GET returning text. No external dependencies.
+function fetchText(url) {
+    return new Promise((resolve, reject) => {
+        const client = url.startsWith('https') ? https_1.default : http_1.default;
+        const req = client.get(url, { timeout: 10000 }, res => {
+            if (res.statusCode === 301 || res.statusCode === 302) {
+                fetchText(res.headers.location).then(resolve, reject);
+                return;
+            }
+            if (res.statusCode !== 200) {
+                reject(new Error(`HTTP ${res.statusCode} fetching ${url}`));
+                return;
+            }
+            const chunks = [];
+            res.on('data', (c) => chunks.push(c));
+            res.on('end', () => resolve(Buffer.concat(chunks).toString('utf-8')));
+            res.on('error', reject);
+        });
+        req.on('error', reject);
+        req.on('timeout', () => { req.destroy(); reject(new Error(`Timeout fetching ${url}`)); });
+    });
+}
+// ── fetchIndex ────────────────────────────────────────────────
+// GET INDEX.json from library, with 1-hour in-memory cache.
+async function fetchIndex() {
+    const now = Date.now();
+    if (_indexCache && now - _indexCachedAt < INDEX_CACHE_TTL_MS) {
+        return _indexCache;
+    }
+    const url = `${LIBRARY_BASE_URL}/INDEX.json`;
+    const text = await fetchText(url);
+    const idx = JSON.parse(text);
+    _indexCache = idx;
+    _indexCachedAt = now;
+    return idx;
+}
+// ── fetchSkillMarkdown ─────────────────────────────────────────
+// Fetch raw SKILL.md content for a specific skill ID.
+async function fetchSkillMarkdown(skillId) {
+    const idx = await fetchIndex();
+    const entry = idx.skills.find(s => s.id === skillId);
+    if (!entry)
+        throw new Error(`Skill "${skillId}" not found in library index`);
+    const url = `${LIBRARY_BASE_URL}/${entry.path}`;
+    return fetchText(url);
+}
+// ── scoreSkillsForTopic ────────────────────────────────────────
+// Returns library skills scored by relevance to a topic string.
+// Scoring: exact id/name match (+10), description word overlap (+3 each),
+// category match (+6), tag match (+5 each).
+function scoreSkillsForTopic(topic, index) {
+    const lower = topic.toLowerCase();
+    const words = lower.split(/\s+/).filter(w => w.length > 2);
+    return index.skills
+        .map(entry => {
+        let score = 0;
+        const name = entry.name.toLowerCase();
+        const desc = entry.description.toLowerCase();
+        const cat = entry.category.toLowerCase();
+        if (name.includes(lower) || lower.includes(name))
+            score += 10;
+        if (lower.includes(entry.id.toLowerCase()))
+            score += 10;
+        words.forEach(w => { if (desc.includes(w))
+            score += 3; });
+        if (cat.includes(lower) || lower.includes(cat))
+            score += 6;
+        entry.tags.forEach(tag => {
+            if (lower.includes(tag.toLowerCase()) || tag.toLowerCase().includes(lower))
+                score += 5;
+        });
+        words.forEach(w => {
+            entry.tags.forEach(tag => { if (tag.toLowerCase().includes(w))
+                score += 2; });
+        });
+        return { ...entry, score };
+    })
+        .filter(s => s.score > 0)
+        .sort((a, b) => b.score - a.score);
+}
+// ── installSkill ──────────────────────────────────────────────
+// Fetches a skill from the library and writes it to skills/installed/<id>/.
+// The skill is written with enabled: false — user must enable explicitly.
+async function installSkill(skillId) {
+    const idx = await fetchIndex();
+    const entry = idx.skills.find(s => s.id === skillId);
+    if (!entry)
+        throw new Error(`Skill "${skillId}" not found in library`);
+    const markdown = await fetchSkillMarkdown(skillId);
+    // Strip existing frontmatter and let writeSkillDraft rebuild it cleanly
+    const bodyMatch = markdown.match(/^---[\s\S]*?---\s*([\s\S]*)$/);
+    const body = bodyMatch ? bodyMatch[1].trim() : markdown.trim();
+    const written = await (0, skillWriter_1.writeSkillDraft)({
+        name: entry.name,
+        description: entry.description,
+        category: entry.category,
+        platform: entry.platform ?? 'any',
+        tags: entry.tags,
+        version: entry.version,
+        content: body,
+        source: 'library_install',
+        sourceDetails: {
+            libraryId: entry.id,
+            libraryUrl: LIBRARY_BASE_URL,
+            installedAt: new Date().toISOString(),
+            envRequired: entry.env_required,
+        },
+    }, 'installed');
+    return written;
+}
+// ── invalidateCache ───────────────────────────────────────────
+// Force-expire the index cache (e.g. after manual refresh).
+function invalidateCache() {
+    _indexCache = null;
+    _indexCachedAt = 0;
+}