cli-jaw 1.4.4 → 1.4.7

package/dist/lib/mcp-sync.js

@@ -250,79 +250,171 @@ export function syncToAll(config) {
     }
     return results;
 }
-// ─── Skills symlink helper ─────────────────────────
+function buildLinkReport(links, extra) {
+    const summary = links.reduce((acc, item) => {
+        const key = item.action || 'unknown';
+        acc[key] = (acc[key] || 0) + 1;
+        return acc;
+    }, {});
+    return { links, summary, ...extra };
+}
 /**
- * Ensure {workingDir}/.agents/skills → ~/.cli-jaw/skills
- * Also ensure ~/.agent/skills → ~/.agents/skills (compat)
- * Also ensure {workingDir}/.claude/skills + ~/.claude/skills (Claude Code CLI)
+ * Working-dir only: {workingDir}/.agents/skills, optionally .claude/skills.
+ * NEVER touches home shared paths (~/.agents, ~/.agent, ~/.claude).
  */
-export function ensureSkillsSymlinks(workingDir, opts = {}) {
-    const onConflict = opts.onConflict === 'skip' ? 'skip' : 'backup';
-    const skillsSource = join(JAW_HOME, 'skills');
+export function ensureWorkingDirSkillsLinks(workingDir, opts = {}) {
+    const { _homedir = os.homedir(), _jawHome = JAW_HOME, onConflict = 'skip', includeClaude = false } = opts;
+    const skillsSource = join(_jawHome, 'skills');
     fs.mkdirSync(skillsSource, { recursive: true });
-    const backupContext = createBackupContext();
+    // CRITICAL: workingDir === homedir → skip to prevent implicit shared path creation
+    const resolvedWd = resolve(workingDir);
+    if (resolvedWd === resolve(_homedir)) {
+        return buildLinkReport([], {
+            skipped: true,
+            reason: 'workingDir is homedir — use ensureSharedHomeSkillsLinks() for explicit opt-in',
+            source: skillsSource,
+        });
+    }
+    const { allowReplaceManaged = false } = opts;
+    const backupContext = createBackupContext(_jawHome);
+    const safeOpts = { onConflict, backupContext, allowReplaceManaged, jawHome: _jawHome };
     const links = [];
-    // 1. {workingDir}/.agents/skills → ~/.cli-jaw/skills
+    // 1. {workingDir}/.agents/skills → skills source
     const wdLink = join(workingDir, '.agents', 'skills');
-    links.push(ensureSymlinkSafe(skillsSource, wdLink, { onConflict, backupContext, name: 'wdAgents' }));
-    // 2. Home fallback: ~/.agents/skills (if different from workingDir)
-    const homeLink = join(os.homedir(), '.agents', 'skills');
-    if (homeLink !== wdLink) {
+    links.push(ensureSymlinkSafe(skillsSource, wdLink, { ...safeOpts, name: 'wdAgents' }));
+    // 2. Optionally {workingDir}/.claude/skills → skills source
+    if (includeClaude) {
+        const wdClaudeSkills = join(workingDir, '.claude', 'skills');
+        links.push(ensureSymlinkSafe(skillsSource, wdClaudeSkills, { ...safeOpts, name: 'wdClaude' }));
+    }
+    return buildLinkReport(links, {
+        skipped: false,
+        source: skillsSource,
+        strategy: onConflict,
+        backupRoot: backupContext.root,
+    });
+}
+/**
+ * Opt-in only: create shared home symlinks (~/.agents/skills, ~/.agent/skills, ~/.claude/skills).
+ * Must NEVER be called by default — only via explicit env flag or CLI command.
+ */
+export function ensureSharedHomeSkillsLinks(opts = {}) {
+    const { _homedir = os.homedir(), _jawHome = JAW_HOME, onConflict = 'backup', includeAgents = true, includeCompatAgent = true, includeClaude = true, } = opts;
+    const skillsSource = join(_jawHome, 'skills');
+    fs.mkdirSync(skillsSource, { recursive: true });
+    const backupContext = createBackupContext(_jawHome);
+    const links = [];
+    if (includeAgents) {
+        const homeLink = join(_homedir, '.agents', 'skills');
         links.push(ensureSymlinkSafe(skillsSource, homeLink, { onConflict, backupContext, name: 'homeAgents' }));
     }
-    else {
-        links.push({
-            status: 'skip',
-            action: 'same_path',
-            name: 'homeAgents',
-            linkPath: homeLink,
-            target: skillsSource,
-        });
+    if (includeCompatAgent) {
+        const homeAgents = join(_homedir, '.agents', 'skills');
+        const compatLink = join(_homedir, '.agent', 'skills');
+        links.push(ensureSymlinkSafe(homeAgents, compatLink, { onConflict, backupContext, name: 'compatAgent' }));
     }
-    // 3. Compat: ~/.agent/skills → ~/.agents/skills
-    const compatLink = join(os.homedir(), '.agent', 'skills');
-    links.push(ensureSymlinkSafe(homeLink, compatLink, { onConflict, backupContext, name: 'compatAgent' }));
-    // 4. Claude Code CLI: {workingDir}/.claude/skills → ~/.cli-jaw/skills
-    const wdClaudeSkills = join(workingDir, '.claude', 'skills');
-    links.push(ensureSymlinkSafe(skillsSource, wdClaudeSkills, { onConflict, backupContext, name: 'wdClaude' }));
-    // 5. Home Claude Code: ~/.claude/skills → ~/.cli-jaw/skills
-    const homeClaudeSkills = join(os.homedir(), '.claude', 'skills');
-    if (homeClaudeSkills !== wdClaudeSkills) {
+    if (includeClaude) {
+        const homeClaudeSkills = join(_homedir, '.claude', 'skills');
         links.push(ensureSymlinkSafe(skillsSource, homeClaudeSkills, { onConflict, backupContext, name: 'homeClaude' }));
     }
-    else {
-        links.push({
-            status: 'skip',
-            action: 'same_path',
-            name: 'homeClaude',
-            linkPath: homeClaudeSkills,
-            target: skillsSource,
-        });
-    }
-    const summary = links.reduce((acc, item) => {
-        const key = item.action || 'unknown';
-        acc[key] = (acc[key] || 0) + 1;
-        return acc;
-    }, {});
-    return {
+    return buildLinkReport(links, {
         source: skillsSource,
         strategy: onConflict,
         backupRoot: backupContext.root,
-        links,
-        summary,
-    };
+    });
+}
+/**
+ * Detect shared path contamination: check if cli-jaw has taken over home shared paths.
+ */
+export function detectSharedPathContamination(opts) {
+    const homedir = opts?._homedir ?? os.homedir();
+    const jawHome = opts?._jawHome ?? JAW_HOME;
+    const skillsTarget = join(jawHome, 'skills');
+    const sharedPaths = [
+        join(homedir, '.agents', 'skills'),
+        join(homedir, '.agent', 'skills'),
+        join(homedir, '.claude', 'skills'),
+    ];
+    const paths = sharedPaths.map(p => {
+        const exists = fs.existsSync(p);
+        let isSymlink = false;
+        let target = null;
+        let isCliJaw = false;
+        if (exists) {
+            try {
+                const stat = fs.lstatSync(p);
+                isSymlink = stat.isSymbolicLink();
+                if (isSymlink) {
+                    const rawTarget = fs.readlinkSync(p);
+                    target = resolveSymlinkTarget(p, rawTarget);
+                    isCliJaw = resolve(target) === resolve(skillsTarget);
+                }
+            }
+            catch { /* ignore */ }
+        }
+        return { path: p, exists, isSymlink, target, isCliJaw };
+    });
+    // Check backup traces
+    const backupDir = join(jawHome, 'backups', 'skills-conflicts');
+    const backupTraces = [];
+    if (fs.existsSync(backupDir)) {
+        try {
+            backupTraces.push(...fs.readdirSync(backupDir).map(f => join(backupDir, f)));
+        }
+        catch { /* ignore */ }
+    }
+    const contaminated = paths.filter(p => p.isCliJaw);
+    let status = 'clean';
+    let summary = 'No shared path contamination detected';
+    if (contaminated.length > 0) {
+        status = 'contaminated';
+        const pathList = contaminated.map(p => p.path).join(', ');
+        summary = `cli-jaw symlinks found at shared paths: ${pathList}`;
+    }
+    else if (backupTraces.length > 0) {
+        // Backup traces without active symlinks = previously resolved, not active contamination
+        status = 'resolved';
+        summary = `No active symlinks; backup traces preserved for rollback (${backupTraces.length} file(s))`;
+    }
+    return { status, paths, backupTraces, summary };
+}
+/**
+ * @deprecated Use ensureWorkingDirSkillsLinks or ensureSharedHomeSkillsLinks instead.
+ * Kept only for backward compatibility during transition — delegates to new helpers.
+ */
+export function ensureSkillsSymlinks(workingDir, opts = {}) {
+    // Delegate to working-dir-only helper (isolated-by-default)
+    return ensureWorkingDirSkillsLinks(workingDir, {
+        onConflict: opts.onConflict === 'skip' ? 'skip' : 'backup',
+        includeClaude: true,
+    });
 }
-function createBackupContext() {
+function createBackupContext(jawHome) {
     const stamp = new Date().toISOString().replace(/[:.]/g, '-');
-    return { root: join(JAW_HOME, 'backups', 'skills-conflicts', stamp) };
+    return { root: join(jawHome ?? JAW_HOME, 'backups', 'skills-conflicts', stamp) };
 }
 function resolveSymlinkTarget(linkPath, rawTarget) {
     return isAbsolute(rawTarget)
         ? resolve(rawTarget)
         : resolve(dirname(linkPath), rawTarget);
 }
+function isCliJawManaged(linkPath, jawHome) {
+    try {
+        const stat = fs.lstatSync(linkPath);
+        if (stat.isSymbolicLink()) {
+            const rawTarget = fs.readlinkSync(linkPath);
+            const currentTarget = resolveSymlinkTarget(linkPath, rawTarget);
+            // Symlink pointing into any .cli-jaw directory is managed
+            return jawHome ? currentTarget.startsWith(resolve(jawHome)) : currentTarget.includes('.cli-jaw');
+        }
+    }
+    catch { /* not a symlink or doesn't exist */ }
+    return false;
+}
 function ensureSymlinkSafe(target, linkPath, opts = {}) {
     const onConflict = opts.onConflict === 'skip' ? 'skip' : 'backup';
+    const allowReplaceManaged = opts.allowReplaceManaged === true;
+    const jawHome = opts.jawHome;
     const backupContext = opts.backupContext || createBackupContext();
     const absTarget = resolve(target);
     const baseResult = {
@@ -338,18 +430,31 @@ function ensureSymlinkSafe(target, linkPath, opts = {}) {
             if (currentTarget === absTarget) {
                 return { ...baseResult, status: 'ok', action: 'noop' };
             }
-            fs.unlinkSync(linkPath);
-            fs.mkdirSync(dirname(linkPath), { recursive: true });
-            fs.symlinkSync(target, linkPath);
-            console.log(`[skills] symlink(updated): ${linkPath} → ${target}`);
-            return {
-                ...baseResult,
-                status: 'ok',
-                action: 'replace_symlink',
-                previousTarget: rawTarget,
-            };
+            // Stale symlink: only replace if managed by cli-jaw AND caller opts in
+            const managed = isCliJawManaged(linkPath, jawHome);
+            if (managed && allowReplaceManaged) {
+                fs.unlinkSync(linkPath);
+                fs.mkdirSync(dirname(linkPath), { recursive: true });
+                fs.symlinkSync(target, linkPath);
+                console.log(`[skills] symlink(updated): ${linkPath} → ${target}`);
+                return {
+                    ...baseResult,
+                    status: 'ok',
+                    action: 'replace_symlink',
+                    previousTarget: rawTarget,
+                    managed,
+                };
+            }
+            // Not managed, respect onConflict
+            if (onConflict === 'skip') {
+                console.warn(`[skills] conflict(skip): ${linkPath} (unmanaged symlink preserved)`);
+                return { ...baseResult, status: 'skip', action: 'conflict_skip' };
+            }
+            // backup mode: fall through to backup_replace below
         }
         if (onConflict === 'skip') {
+            // Non-symlink path: check if allowReplaceManaged applies
+            // (real dirs are never "managed" — only symlinks can be reliably attributed to cli-jaw)
             console.warn(`[skills] conflict(skip): ${linkPath} (existing path preserved)`);
             return { ...baseResult, status: 'skip', action: 'conflict_skip' };
         }
@@ -543,7 +648,7 @@ const CODEX_ACTIVE = new Set([
 const OPENCLAW_ACTIVE = new Set([
     'browser', 'notion', 'memory', 'vision-click',
     'screen-capture', 'docx', 'xlsx', 'pptx', 'hwp', 'github', 'telegram-send',
-    'video',
+    'video', 'pdf-vision',
 ]);
 function getSkillVersion(id, registry) {
     return registry?.skills?.[id]?.version ?? null;
@@ -610,31 +715,41 @@ export function copyDefaultSkills() {
         console.log(`[skills] Codex: not installed, using bundled fallback`);
     }
     // ─── 2. Populate skills_ref/ ─────────────────────
-    // Priority: bundled (dev) → git clone (npm install) → offline fallback
+    // Priority: git clone (always latest) → bundled fallback (dev) → offline
     const packageRefDir = join(findPackageRoot(), 'skills_ref');
     const SKILLS_REPO = 'https://github.com/lidge-jun/cli-jaw-skills.git';
-    if (fs.existsSync(packageRefDir)) {
-        // Dev / local: copy from bundled skills_ref/ (version-aware)
-        const srcReg = loadRegistry(packageRefDir);
+    let skillsSourceResolved = false;
+    // 2a. Try GitHub clone first (public repo, no auth needed)
+    try {
+        const tmpClone = join(JAW_HOME, '.skills_clone_tmp');
+        if (fs.existsSync(tmpClone))
+            fs.rmSync(tmpClone, { recursive: true });
+        console.log(`[skills] fetching latest skills from GitHub...`);
+        execSync(`git clone --depth 1 ${SKILLS_REPO} "${tmpClone}"`, {
+            stdio: 'pipe', timeout: 120000,
+        });
+        // Version-aware merge from clone
+        const srcReg = loadRegistry(tmpClone);
         const dstReg = loadRegistry(refDir);
-        const entries = fs.readdirSync(packageRefDir, { withFileTypes: true });
-        let refCopied = 0, refUpdated = 0;
-        for (const entry of entries) {
-            const src = join(packageRefDir, entry.name);
+        const cloned = fs.readdirSync(tmpClone, { withFileTypes: true });
+        let cloneNew = 0, cloneUpdated = 0;
+        for (const entry of cloned) {
+            if (entry.name === '.git')
+                continue;
+            const src = join(tmpClone, entry.name);
             const dst = join(refDir, entry.name);
             if (entry.isDirectory()) {
                 if (!fs.existsSync(dst)) {
                     copyDirRecursive(src, dst);
-                    refCopied++;
+                    cloneNew++;
                 }
                 else {
                     const sv = getSkillVersion(entry.name, srcReg);
                     const dv = getSkillVersion(entry.name, dstReg);
-                    // Migration: dv===null means pre-version install → always update
                     if (sv && (!dv || semverGt(sv, dv))) {
                         fs.rmSync(dst, { recursive: true, force: true });
                         copyDirRecursive(src, dst);
-                        refUpdated++;
+                        cloneUpdated++;
                         console.log(`[skills] updated: ${entry.name} ${dv ?? '(none)'} → ${sv}`);
                     }
                 }
@@ -643,36 +758,28 @@ export function copyDefaultSkills() {
                 fs.copyFileSync(src, dst);
             }
         }
-        if (refCopied > 0)
-            console.log(`[skills] Bundled: ${refCopied} new skills → ref`);
-        if (refUpdated > 0)
-            console.log(`[skills] Bundled: ${refUpdated} skills updated`);
+        fs.rmSync(tmpClone, { recursive: true, force: true });
+        console.log(`[skills] ✅ GitHub: ${cloneNew} new, ${cloneUpdated} updated`);
+        skillsSourceResolved = true;
     }
-    else {
-        // npm install (no bundled dir) → clone or update from GitHub
-        const needsClone = !fs.existsSync(join(refDir, 'registry.json'));
-        try {
-            console.log(`[skills] ${needsClone ? 'cloning' : 'updating'} skills from ${SKILLS_REPO}...`);
-            const tmpClone = join(JAW_HOME, '.skills_clone_tmp');
-            if (fs.existsSync(tmpClone))
-                fs.rmSync(tmpClone, { recursive: true });
-            execSync(`git clone --depth 1 ${SKILLS_REPO} "${tmpClone}"`, {
-                stdio: 'pipe', timeout: 120000,
-            });
-            // Version-aware merge (same logic as bundled path)
-            const srcReg = loadRegistry(tmpClone);
+    catch (e) {
+        console.log(`[skills] GitHub clone skipped: ${e.message?.slice(0, 60)}`);
+    }
+    // 2b. Fallback: bundled skills_ref/ (dev mode with initialized submodule)
+    if (!skillsSourceResolved) {
+        const bundledHasContent = fs.existsSync(packageRefDir) && fs.existsSync(join(packageRefDir, 'registry.json'));
+        if (bundledHasContent) {
+            const srcReg = loadRegistry(packageRefDir);
             const dstReg = loadRegistry(refDir);
-            const cloned = fs.readdirSync(tmpClone, { withFileTypes: true });
-            let cloneNew = 0, cloneUpdated = 0;
-            for (const entry of cloned) {
-                if (entry.name === '.git')
-                    continue;
-                const src = join(tmpClone, entry.name);
+            const entries = fs.readdirSync(packageRefDir, { withFileTypes: true });
+            let refCopied = 0, refUpdated = 0;
+            for (const entry of entries) {
+                const src = join(packageRefDir, entry.name);
                 const dst = join(refDir, entry.name);
                 if (entry.isDirectory()) {
                     if (!fs.existsSync(dst)) {
                         copyDirRecursive(src, dst);
-                        cloneNew++;
+                        refCopied++;
                     }
                     else {
                         const sv = getSkillVersion(entry.name, srcReg);
@@ -680,7 +787,7 @@ export function copyDefaultSkills() {
                         if (sv && (!dv || semverGt(sv, dv))) {
                             fs.rmSync(dst, { recursive: true, force: true });
                             copyDirRecursive(src, dst);
-                            cloneUpdated++;
+                            refUpdated++;
                             console.log(`[skills] updated: ${entry.name} ${dv ?? '(none)'} → ${sv}`);
                         }
                     }
@@ -689,17 +796,18 @@ export function copyDefaultSkills() {
                     fs.copyFileSync(src, dst);
                 }
             }
-            fs.rmSync(tmpClone, { recursive: true, force: true });
-            console.log(`[skills] ✅ ${cloneNew} new, ${cloneUpdated} updated → ${refDir}`);
+            if (refCopied > 0)
+                console.log(`[skills] Bundled fallback: ${refCopied} new skills → ref`);
+            if (refUpdated > 0)
+                console.log(`[skills] Bundled fallback: ${refUpdated} skills updated`);
+            skillsSourceResolved = true;
         }
-        catch (e) {
-            if (needsClone) {
-                console.warn(`[skills] ⚠️ clone failed: ${e.message?.slice(0, 80)}`);
-                console.warn(`[skills] offline mode — skills will be available after 'jaw init'`);
-            }
-            else {
-                console.log(`[skills] update check skipped: ${e.message?.slice(0, 60)}`);
-            }
+    }
+    if (!skillsSourceResolved) {
+        const hasExisting = fs.existsSync(join(refDir, 'registry.json'));
+        if (!hasExisting) {
+            console.warn(`[skills] ⚠️ no source available (no network + no bundled skills)`);
+            console.warn(`[skills] offline mode — skills will be available after 'jaw init'`);
         }
     }
     // ─── 3. Auto-activate from refDir ───────────────
@@ -757,45 +865,56 @@ export function softResetSkills() {
     const activeDir = join(JAW_HOME, 'skills');
     const refDir = join(JAW_HOME, 'skills_ref');
     const packageRefDir = join(findPackageRoot(), 'skills_ref');
-    // 1. Source for ref update: bundled (dev) or git clone (npm install)
-    let sourceDir = packageRefDir;
+    // 1. Source for ref update: GitHub clone (latest) → bundled fallback (dev)
+    const SKILLS_REPO = 'https://github.com/lidge-jun/cli-jaw-skills.git';
+    let sourceDir = null;
     let tmpCloneDir = null;
-    if (!fs.existsSync(packageRefDir)) {
-        // npm install — skills_ref excluded from package, clone from GitHub
-        const SKILLS_REPO = 'https://github.com/lidge-jun/cli-jaw-skills.git';
+    // 1a. Try GitHub clone first (public repo, always latest)
+    try {
         tmpCloneDir = join(JAW_HOME, '.skills_clone_tmp');
-        try {
-            if (fs.existsSync(tmpCloneDir))
-                fs.rmSync(tmpCloneDir, { recursive: true });
-            console.log(`[skills:soft-reset] cloning latest skills from ${SKILLS_REPO}...`);
-            execSync(`git clone --depth 1 ${SKILLS_REPO} "${tmpCloneDir}"`, {
-                stdio: 'pipe', timeout: 120000,
-            });
-            sourceDir = tmpCloneDir;
+        if (fs.existsSync(tmpCloneDir))
+            fs.rmSync(tmpCloneDir, { recursive: true });
+        console.log(`[skills:soft-reset] fetching latest skills from GitHub...`);
+        execSync(`git clone --depth 1 ${SKILLS_REPO} "${tmpCloneDir}"`, {
+            stdio: 'pipe', timeout: 120000,
+        });
+        sourceDir = tmpCloneDir;
+    }
+    catch (e) {
+        console.log(`[skills:soft-reset] GitHub clone skipped: ${e.message?.slice(0, 60)}`);
+        tmpCloneDir = null;
+    }
+    // 1b. Fallback: bundled skills_ref/ (dev mode with initialized submodule)
+    if (!sourceDir) {
+        const bundledReady = fs.existsSync(packageRefDir) && fs.existsSync(join(packageRefDir, 'registry.json'));
+        if (bundledReady) {
+            sourceDir = packageRefDir;
+            console.log(`[skills:soft-reset] using bundled fallback`);
         }
-        catch (e) {
-            console.warn(`[skills:soft-reset] ⚠️ clone failed: ${e.message?.slice(0, 80)}`);
-            console.warn(`[skills:soft-reset] keeping current skills unchanged`);
+        else {
+            console.warn(`[skills:soft-reset] ⚠️ no source available — keeping current skills unchanged`);
             return { restored: 0, added: 0 };
         }
     }
     // 2. skills_ref/ 전체를 소스에서 다시 복사 (덮어쓰기)
-    if (fs.existsSync(sourceDir)) {
-        for (const entry of fs.readdirSync(sourceDir, { withFileTypes: true })) {
-            if (entry.name === '.git')
-                continue;
-            const src = join(sourceDir, entry.name);
-            const dst = join(refDir, entry.name);
-            if (entry.isDirectory()) {
-                if (fs.existsSync(dst))
-                    fs.rmSync(dst, { recursive: true, force: true });
-                copyDirRecursive(src, dst);
-            }
-            else if (entry.isFile()) {
-                fs.copyFileSync(src, dst);
-            }
+    for (const entry of fs.readdirSync(sourceDir, { withFileTypes: true })) {
+        if (entry.name === '.git')
+            continue;
+        const src = join(sourceDir, entry.name);
+        const dst = join(refDir, entry.name);
+        if (entry.isDirectory()) {
+            if (fs.existsSync(dst))
+                fs.rmSync(dst, { recursive: true, force: true });
+            copyDirRecursive(src, dst);
+        }
+        else if (entry.isFile()) {
+            fs.copyFileSync(src, dst);
         }
     }
+    // Cleanup temp clone
+    if (tmpCloneDir && fs.existsSync(tmpCloneDir)) {
+        fs.rmSync(tmpCloneDir, { recursive: true, force: true });
+    }
     // 3. active skills → ref에 같은 이름이 있으면 무조건 덮어쓰기
     let restored = 0;
     if (fs.existsSync(activeDir)) {