coding-tool-x 3.6.6 → 3.6.8

package/src/server/services/commands-service.js

@@ -1,24 +1,32 @@
 /**
  * Commands 服务
  *
- * 管理 Claude/OpenCode 自定义命令的 CRUD 操作
+ * 管理 Claude/Codex/Gemini/OpenCode 自定义命令的 CRUD 操作
  * 支持从 GitHub 仓库扫描和安装命令
  */
 
 const fs = require('fs');
 const path = require('path');
+const toml = require('toml');
+const tomlStringify = require('@iarna/toml').stringify;
 const { RepoScannerBase } = require('./repo-scanner-base');
 const { NATIVE_PATHS } = require('../../config/paths');
 const {
-  parseCommandContent,
   parseFrontmatter
 } = require('./format-converter');
+const {
+  normalizeSafeFileStem,
+  normalizeSafeRelativePath,
+  resolveInsideRoot
+} = require('./config-artifact-paths');
 
 // 默认仓库源
 const DEFAULT_REPOS = [];
-const SUPPORTED_PLATFORMS = ['claude', 'opencode'];
+const SUPPORTED_PLATFORMS = ['claude', 'codex', 'gemini', 'opencode'];
 const OPENCODE_CONFIG_DIR = NATIVE_PATHS.opencode.config;
 const CLAUDE_COMMANDS_DIR = path.join(path.dirname(NATIVE_PATHS.claude.settings), 'commands');
+const CODEX_COMMANDS_DIR = path.join(path.dirname(NATIVE_PATHS.codex.config), 'commands');
+const GEMINI_COMMANDS_DIR = path.join(NATIVE_PATHS.gemini.dir, 'commands');
 
 const PLATFORM_CONFIG = {
   claude: {
@@ -26,6 +34,11 @@ const PLATFORM_CONFIG = {
     projectCommandsDir: (projectPath) => path.join(projectPath, '.claude', 'commands'),
     repoType: 'commands'
   },
+  codex: {
+    userCommandsDir: CODEX_COMMANDS_DIR,
+    projectCommandsDir: (projectPath) => path.join(projectPath, '.codex', 'commands'),
+    repoType: 'codex-commands'
+  },
   opencode: {
     userCommandsDir: path.join(OPENCODE_CONFIG_DIR, 'commands'),
     legacyUserCommandsDir: path.join(OPENCODE_CONFIG_DIR, 'command'),
@@ -38,6 +51,12 @@ const PLATFORM_CONFIG = {
       return modern;
     },
     repoType: 'opencode-commands'
+  },
+  gemini: {
+    userCommandsDir: GEMINI_COMMANDS_DIR,
+    projectCommandsDir: (projectPath) => path.join(projectPath, '.gemini', 'commands'),
+    repoType: 'gemini-commands',
+    fileExtension: '.toml'
   }
 };
 
@@ -86,11 +105,75 @@ function generateCommandFrontmatter(data) {
   return lines.join('\n');
 }
 
+function getCommandFileExtension(platform) {
+  return PLATFORM_CONFIG[platform]?.fileExtension || '.md';
+}
+
+function getCommandTargetName(name, platform) {
+  return `${name}${getCommandFileExtension(platform)}`;
+}
+
+function normalizeCommandName(name) {
+  if (!name || !String(name).trim()) {
+    throw new Error('命令名称不能为空');
+  }
+
+  try {
+    return normalizeSafeFileStem(name, 'command name', {
+      allowDots: false,
+      pattern: /^[a-zA-Z0-9_-]+$/
+    });
+  } catch {
+    throw new Error('命令名只能包含字母、数字、横杠和下划线');
+  }
+}
+
+function normalizeCommandNamespace(namespace) {
+  return normalizeSafeRelativePath(namespace || '', 'command namespace', {
+    allowEmpty: true,
+    allowHiddenSegments: false
+  });
+}
+
+function buildCommandRelativePath(name, namespace, platform) {
+  const safeName = normalizeCommandName(name);
+  const safeNamespace = normalizeCommandNamespace(namespace);
+  const fileName = getCommandTargetName(safeName, platform);
+  return safeNamespace ? path.posix.join(safeNamespace, fileName) : fileName;
+}
+
+function parseGeminiCommandToml(content) {
+  try {
+    const parsed = toml.parse(content);
+    return {
+      description: parsed.description || '',
+      body: parsed.prompt || ''
+    };
+  } catch (err) {
+    return {
+      description: '',
+      body: content,
+      parseError: err.message
+    };
+  }
+}
+
+function generateGeminiCommandToml({ description, body }) {
+  const data = {
+    prompt: body || ''
+  };
+  if (description) {
+    data.description = description;
+  }
+  return tomlStringify(data);
+}
+
 /**
  * 递归扫描目录获取命令文件
  */
-function scanCommandsDir(dir, basePath, scope) {
+function scanCommandsDir(dir, basePath, scope, platform = 'claude') {
   const commands = [];
+  const fileExtension = getCommandFileExtension(platform);
 
   if (!fs.existsSync(dir)) {
     return commands;
@@ -104,17 +187,19 @@ function scanCommandsDir(dir, basePath, scope) {
 
       if (entry.isDirectory() && !entry.name.startsWith('.')) {
         // 递归扫描子目录
-        const subCommands = scanCommandsDir(fullPath, basePath, scope);
+        const subCommands = scanCommandsDir(fullPath, basePath, scope, platform);
         commands.push(...subCommands);
-      } else if (entry.isFile() && entry.name.endsWith('.md')) {
+      } else if (entry.isFile() && entry.name.endsWith(fileExtension)) {
         // 解析命令文件
         try {
           const content = fs.readFileSync(fullPath, 'utf-8');
-          const { frontmatter, body } = parseFrontmatter(content);
+          const parsed = platform === 'gemini'
+            ? { frontmatter: {}, body: '', gemini: parseGeminiCommandToml(content) }
+            : { ...parseFrontmatter(content), gemini: null };
 
           // 计算相对路径和命令名
           const relativePath = path.relative(basePath, fullPath);
-          const commandName = entry.name.replace(/\.md$/, '');
+          const commandName = entry.name.slice(0, -fileExtension.length);
           const namespace = path.dirname(relativePath);
 
           commands.push({
@@ -123,13 +208,14 @@ function scanCommandsDir(dir, basePath, scope) {
             scope,
             path: relativePath,
             fullPath,
-            description: frontmatter.description || '',
-            allowedTools: frontmatter['allowed-tools'] || '',
-            argumentHint: frontmatter['argument-hint'] || '',
-            agent: frontmatter.agent || '',
-            model: frontmatter.model || '',
-            subtask: frontmatter.subtask || '',
-            body,
+            description: parsed.gemini?.description || parsed.frontmatter.description || '',
+            allowedTools: parsed.frontmatter['allowed-tools'] || '',
+            argumentHint: parsed.frontmatter['argument-hint'] || '',
+            agent: parsed.frontmatter.agent || '',
+            model: parsed.frontmatter.model || '',
+            subtask: parsed.frontmatter.subtask || '',
+            body: parsed.gemini?.body ?? parsed.body,
+            parseError: parsed.gemini?.parseError || '',
             fullContent: content,
             updatedAt: fs.statSync(fullPath).mtime.getTime()
           });
@@ -150,13 +236,15 @@ function scanCommandsDir(dir, basePath, scope) {
  */
 class CommandsRepoScanner extends RepoScannerBase {
   constructor(platform, installDir) {
+    const normalizedPlatform = normalizePlatform(platform);
     super({
-      type: PLATFORM_CONFIG[platform]?.repoType || 'commands',
+      type: PLATFORM_CONFIG[normalizedPlatform]?.repoType || 'commands',
       installDir,
       markerFile: null, // 直接扫描 .md 文件
-      fileExtension: '.md',
+      fileExtension: getCommandFileExtension(normalizedPlatform),
       defaultRepos: DEFAULT_REPOS
     });
+    this.platform = normalizedPlatform;
   }
 
   /**
@@ -166,12 +254,15 @@ class CommandsRepoScanner extends RepoScannerBase {
     try {
       // 计算相对路径
       const relativePath = baseDir ? file.path.slice(baseDir.length + 1) : file.path;
-      const fileName = path.basename(file.path, '.md');
+      const fileExtension = getCommandFileExtension(this.platform);
+      const fileName = path.basename(file.path, fileExtension);
       const namespace = path.dirname(relativePath);
 
       // 获取文件内容
       const content = await this.fetchRawContent(repo, file.path);
-      const { frontmatter, body } = this.parseFrontmatter(content);
+      const parsed = this.platform === 'gemini'
+        ? { frontmatter: {}, body: '', gemini: parseGeminiCommandToml(content) }
+        : { ...this.parseFrontmatter(content), gemini: null };
 
       return {
         key: `${repo.owner}/${repo.name}:${relativePath}`,
@@ -180,13 +271,14 @@ class CommandsRepoScanner extends RepoScannerBase {
         scope: 'remote',
         path: relativePath,
         repoPath: file.path,
-        description: frontmatter.description || '',
-        allowedTools: frontmatter['allowed-tools'] || '',
-        argumentHint: frontmatter['argument-hint'] || '',
-        agent: frontmatter.agent || '',
-        model: frontmatter.model || '',
-        subtask: frontmatter.subtask || '',
-        body,
+        description: parsed.gemini?.description || parsed.frontmatter.description || '',
+        allowedTools: parsed.frontmatter['allowed-tools'] || '',
+        argumentHint: parsed.frontmatter['argument-hint'] || '',
+        agent: parsed.frontmatter.agent || '',
+        model: parsed.frontmatter.model || '',
+        subtask: parsed.frontmatter.subtask || '',
+        body: parsed.gemini?.body ?? parsed.body,
+        parseError: parsed.gemini?.parseError || '',
         fullContent: content,
         installed: this.isInstalled(relativePath),
         readmeUrl: `https://github.com/${repo.owner}/${repo.name}/blob/${repo.branch}/${file.path}`,
@@ -205,8 +297,13 @@ class CommandsRepoScanner extends RepoScannerBase {
    * 检查命令是否已安装
    */
   isInstalled(relativePath) {
-    const fullPath = path.join(this.installDir, relativePath);
-    return fs.existsSync(fullPath);
+    try {
+      const safeRelativePath = normalizeSafeRelativePath(relativePath, 'command path');
+      const fullPath = resolveInsideRoot(this.installDir, safeRelativePath, 'Command path');
+      return fs.existsSync(fullPath);
+    } catch {
+      return false;
+    }
   }
 
   /**
@@ -257,6 +354,44 @@ class CommandsService {
     return this.projectCommandsDir(projectPath);
   }
 
+  _getBaseDir(scope, projectPath = null) {
+    return scope === 'user'
+      ? this.userCommandsDir
+      : this.getProjectCommandsDir(projectPath);
+  }
+
+  _resolveCommandPath(baseDir, name, namespace = null) {
+    if (!baseDir) {
+      throw new Error('项目路径不能为空');
+    }
+    const relativePath = buildCommandRelativePath(name, namespace, this.platform);
+    const fullPath = resolveInsideRoot(baseDir, relativePath, 'Command path');
+    return { relativePath, fullPath };
+  }
+
+  _generateCommandContent({ description, allowedTools, argumentHint, agent, model, subtask, body }) {
+    if (this.platform === 'gemini') {
+      return generateGeminiCommandToml({ description, body });
+    }
+
+    const frontmatterData = {};
+    if (description) frontmatterData.description = description;
+    if (this.platform !== 'opencode') {
+      if (allowedTools) frontmatterData['allowed-tools'] = allowedTools;
+      if (argumentHint) frontmatterData['argument-hint'] = argumentHint;
+    }
+    if (agent) frontmatterData.agent = agent;
+    if (model) frontmatterData.model = model;
+    if (typeof subtask === 'boolean') frontmatterData.subtask = subtask;
+
+    let content = '';
+    if (Object.keys(frontmatterData).length > 0) {
+      content = generateCommandFrontmatter(frontmatterData) + '\n\n';
+    }
+    content += body || '';
+    return content;
+  }
+
   /**
    * 获取所有命令列表
    * @param {string} projectPath - 项目路径（可选，用于获取项目级命令）
@@ -265,13 +400,13 @@ class CommandsService {
     const commands = [];
 
     // 获取用户级命令
-    const userCommands = scanCommandsDir(this.userCommandsDir, this.userCommandsDir, 'user');
+    const userCommands = scanCommandsDir(this.userCommandsDir, this.userCommandsDir, 'user', this.platform);
     commands.push(...userCommands);
 
     // 获取项目级命令（如果提供了项目路径）
     if (projectPath) {
       const projectCommandsDir = this.getProjectCommandsDir(projectPath);
-      const projectCommands = scanCommandsDir(projectCommandsDir, projectCommandsDir, 'project');
+      const projectCommands = scanCommandsDir(projectCommandsDir, projectCommandsDir, 'project', this.platform);
       commands.push(...projectCommands);
     }
 
@@ -336,36 +471,34 @@ class CommandsService {
    * 获取单个命令详情
    */
   getCommand(name, scope, projectPath = null, namespace = null) {
-    const baseDir = scope === 'user'
-      ? this.userCommandsDir
-      : this.getProjectCommandsDir(projectPath);
-
-    const relativePath = namespace
-      ? path.join(namespace, `${name}.md`)
-      : `${name}.md`;
-
-    const fullPath = path.join(baseDir, relativePath);
+    const safeName = normalizeCommandName(name);
+    const safeNamespace = normalizeCommandNamespace(namespace);
+    const baseDir = this._getBaseDir(scope, projectPath);
+    const { relativePath, fullPath } = this._resolveCommandPath(baseDir, safeName, safeNamespace);
 
     if (!fs.existsSync(fullPath)) {
       return null;
     }
 
     const content = fs.readFileSync(fullPath, 'utf-8');
-    const { frontmatter, body } = parseFrontmatter(content);
+    const parsed = this.platform === 'gemini'
+      ? { frontmatter: {}, body: '', gemini: parseGeminiCommandToml(content) }
+      : { ...parseFrontmatter(content), gemini: null };
 
     return {
-      name,
-      namespace,
+      name: safeName,
+      namespace: safeNamespace || null,
       scope,
       path: relativePath,
       fullPath,
-      description: frontmatter.description || '',
-      allowedTools: frontmatter['allowed-tools'] || '',
-      argumentHint: frontmatter['argument-hint'] || '',
-      agent: frontmatter.agent || '',
-      model: frontmatter.model || '',
-      subtask: frontmatter.subtask || '',
-      body,
+      description: parsed.gemini?.description || parsed.frontmatter.description || '',
+      allowedTools: parsed.frontmatter['allowed-tools'] || '',
+      argumentHint: parsed.frontmatter['argument-hint'] || '',
+      agent: parsed.frontmatter.agent || '',
+      model: parsed.frontmatter.model || '',
+      subtask: parsed.frontmatter.subtask || '',
+      body: parsed.gemini?.body ?? parsed.body,
+      parseError: parsed.gemini?.parseError || '',
       fullContent: content,
       updatedAt: fs.statSync(fullPath).mtime.getTime()
     };
@@ -375,104 +508,53 @@ class CommandsService {
    * 创建命令
    */
   createCommand({ name, scope, projectPath, namespace, description, allowedTools, argumentHint, agent, model, subtask, body }) {
-    if (!name || !name.trim()) {
-      throw new Error('命令名称不能为空');
-    }
-
-    // 验证命令名：只允许字母、数字、横杠、下划线
-    if (!/^[a-zA-Z0-9_-]+$/.test(name)) {
-      throw new Error('命令名只能包含字母、数字、横杠和下划线');
-    }
-
-    const baseDir = scope === 'user'
-      ? this.userCommandsDir
-      : this.getProjectCommandsDir(projectPath);
-
-    const targetDir = namespace ? path.join(baseDir, namespace) : baseDir;
+    const safeName = normalizeCommandName(name);
+    const safeNamespace = normalizeCommandNamespace(namespace);
+    const baseDir = this._getBaseDir(scope, projectPath);
+    const { fullPath: filePath } = this._resolveCommandPath(baseDir, safeName, safeNamespace);
+    const targetDir = path.dirname(filePath);
     ensureDir(targetDir);
 
-    const filePath = path.join(targetDir, `${name}.md`);
-
     // 检查是否已存在
     if (fs.existsSync(filePath)) {
-      throw new Error(`命令 "${name}" 已存在`);
+      throw new Error(`命令 "${safeName}" 已存在`);
     }
 
-    // 生成文件内容
-    const frontmatterData = {};
-    if (description) frontmatterData.description = description;
-    if (this.platform !== 'opencode') {
-      if (allowedTools) frontmatterData['allowed-tools'] = allowedTools;
-      if (argumentHint) frontmatterData['argument-hint'] = argumentHint;
-    }
-    if (agent) frontmatterData.agent = agent;
-    if (model) frontmatterData.model = model;
-    if (typeof subtask === 'boolean') frontmatterData.subtask = subtask;
-
-    let content = '';
-    if (Object.keys(frontmatterData).length > 0) {
-      content = generateCommandFrontmatter(frontmatterData) + '\n\n';
-    }
-    content += body || '';
+    const content = this._generateCommandContent({ description, allowedTools, argumentHint, agent, model, subtask, body });
 
     fs.writeFileSync(filePath, content, 'utf-8');
 
-    return this.getCommand(name, scope, projectPath, namespace);
+    return this.getCommand(safeName, scope, projectPath, safeNamespace);
   }
 
   /**
    * 更新命令
    */
   updateCommand({ name, scope, projectPath, namespace, description, allowedTools, argumentHint, agent, model, subtask, body }) {
-    const baseDir = scope === 'user'
-      ? this.userCommandsDir
-      : this.getProjectCommandsDir(projectPath);
-
-    const relativePath = namespace
-      ? path.join(namespace, `${name}.md`)
-      : `${name}.md`;
-
-    const filePath = path.join(baseDir, relativePath);
+    const safeName = normalizeCommandName(name);
+    const safeNamespace = normalizeCommandNamespace(namespace);
+    const baseDir = this._getBaseDir(scope, projectPath);
+    const { fullPath: filePath } = this._resolveCommandPath(baseDir, safeName, safeNamespace);
 
     if (!fs.existsSync(filePath)) {
-      throw new Error(`命令 "${name}" 不存在`);
+      throw new Error(`命令 "${safeName}" 不存在`);
     }
 
-    // 生成文件内容
-    const frontmatterData = {};
-    if (description) frontmatterData.description = description;
-    if (this.platform !== 'opencode') {
-      if (allowedTools) frontmatterData['allowed-tools'] = allowedTools;
-      if (argumentHint) frontmatterData['argument-hint'] = argumentHint;
-    }
-    if (agent) frontmatterData.agent = agent;
-    if (model) frontmatterData.model = model;
-    if (typeof subtask === 'boolean') frontmatterData.subtask = subtask;
-
-    let content = '';
-    if (Object.keys(frontmatterData).length > 0) {
-      content = generateCommandFrontmatter(frontmatterData) + '\n\n';
-    }
-    content += body || '';
+    const content = this._generateCommandContent({ description, allowedTools, argumentHint, agent, model, subtask, body });
 
     fs.writeFileSync(filePath, content, 'utf-8');
 
-    return this.getCommand(name, scope, projectPath, namespace);
+    return this.getCommand(safeName, scope, projectPath, safeNamespace);
   }
 
   /**
    * 删除命令
    */
   deleteCommand(name, scope, projectPath = null, namespace = null) {
-    const baseDir = scope === 'user'
-      ? this.userCommandsDir
-      : this.getProjectCommandsDir(projectPath);
-
-    const relativePath = namespace
-      ? path.join(namespace, `${name}.md`)
-      : `${name}.md`;
-
-    const filePath = path.join(baseDir, relativePath);
+    const safeName = normalizeCommandName(name);
+    const safeNamespace = normalizeCommandNamespace(namespace);
+    const baseDir = this._getBaseDir(scope, projectPath);
+    const { fullPath: filePath } = this._resolveCommandPath(baseDir, safeName, safeNamespace);
 
     if (!fs.existsSync(filePath)) {
       return { success: false, message: '命令不存在' };
@@ -481,8 +563,8 @@ class CommandsService {
     fs.unlinkSync(filePath);
 
     // 如果目录为空，删除目录
-    if (namespace) {
-      const namespaceDir = path.join(baseDir, namespace);
+    if (safeNamespace) {
+      const namespaceDir = resolveInsideRoot(baseDir, safeNamespace, 'Command namespace');
       try {
         const remaining = fs.readdirSync(namespaceDir);
         if (remaining.length === 0) {

package/src/server/services/config-artifact-paths.js

@@ -0,0 +1,116 @@
+const path = require('path');
+
+function isWindowsAbsolutePath(input = '') {
+  return path.win32.isAbsolute(String(input || '')) || /^[a-zA-Z]:[\\/]/.test(String(input || ''));
+}
+
+function normalizeSafeRelativePath(input, label = 'path', options = {}) {
+  const {
+    allowEmpty = false,
+    allowHiddenSegments = false,
+    allowBackslash = true
+  } = options;
+
+  const rawInput = String(input ?? '').trim();
+  if (!rawInput) {
+    if (allowEmpty) return '';
+    throw new Error(`Invalid ${label}`);
+  }
+  if (rawInput.includes('\0')) {
+    throw new Error(`Invalid ${label}`);
+  }
+  if (path.isAbsolute(rawInput) || isWindowsAbsolutePath(rawInput) || rawInput.startsWith('//') || rawInput.startsWith('\\\\')) {
+    throw new Error(`Invalid ${label}`);
+  }
+  if (!allowBackslash && rawInput.includes('\\')) {
+    throw new Error(`Invalid ${label}`);
+  }
+
+  const normalizedInput = rawInput.replace(/\\/g, '/');
+  const normalized = path.posix.normalize(normalizedInput).replace(/^(\.\/)+/, '');
+  if (!normalized || normalized === '.') {
+    if (allowEmpty) return '';
+    throw new Error(`Invalid ${label}`);
+  }
+  if (
+    normalized === '..' ||
+    normalized.startsWith('../') ||
+    normalized.includes('/../') ||
+    path.posix.isAbsolute(normalized)
+  ) {
+    throw new Error(`Invalid ${label}`);
+  }
+
+  const segments = normalized.split('/').filter(Boolean);
+  if (!allowHiddenSegments && segments.some(segment => segment.startsWith('.'))) {
+    throw new Error(`Invalid ${label}`);
+  }
+
+  return normalized;
+}
+
+function normalizeSafeFileStem(input, label = 'name', options = {}) {
+  const {
+    allowDots = true,
+    allowHidden = false,
+    pattern = allowDots
+      ? /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/
+      : /^[a-zA-Z0-9][a-zA-Z0-9_-]*$/
+  } = options;
+  const rawInput = String(input ?? '').trim();
+  if (!rawInput || rawInput.includes('\0')) {
+    throw new Error(`Invalid ${label}`);
+  }
+  if (rawInput.includes('/') || rawInput.includes('\\') || rawInput.includes('..')) {
+    throw new Error(`Invalid ${label}`);
+  }
+  if (!allowHidden && rawInput.startsWith('.')) {
+    throw new Error(`Invalid ${label}`);
+  }
+  if (pattern && !pattern.test(rawInput)) {
+    throw new Error(`Invalid ${label}`);
+  }
+  return rawInput;
+}
+
+function resolveInsideRoot(rootDir, relativePath, label = 'path', options = {}) {
+  const { allowRoot = false } = options;
+  const resolvedRoot = path.resolve(rootDir);
+  const safeRelativePath = normalizeSafeRelativePath(relativePath, label, options);
+  const resolvedPath = path.resolve(resolvedRoot, safeRelativePath);
+  const isInside = resolvedPath === resolvedRoot || resolvedPath.startsWith(`${resolvedRoot}${path.sep}`);
+  if (!isInside || (!allowRoot && resolvedPath === resolvedRoot)) {
+    throw new Error(`${label} escapes target directory`);
+  }
+  return resolvedPath;
+}
+
+function assertInsideAllowedRoots(targetPath, roots = [], label = 'path', options = {}) {
+  const { allowRoot = false } = options;
+  const resolvedTarget = path.resolve(String(targetPath || ''));
+  const allowed = roots.some(root => {
+    if (!root) return false;
+    const resolvedRoot = path.resolve(root);
+    if (!allowRoot && resolvedTarget === resolvedRoot) return false;
+    return resolvedTarget === resolvedRoot || resolvedTarget.startsWith(`${resolvedRoot}${path.sep}`);
+  });
+  if (!allowed) {
+    throw new Error(`${label} escapes allowed directories`);
+  }
+  return resolvedTarget;
+}
+
+function pathHasProtectedSegment(relativePath, protectedSegments = []) {
+  const normalized = normalizeSafeRelativePath(relativePath, 'path', { allowHiddenSegments: true });
+  const segments = normalized.split('/').filter(Boolean);
+  return protectedSegments.some(segment => segments.includes(segment));
+}
+
+module.exports = {
+  assertInsideAllowedRoots,
+  isWindowsAbsolutePath,
+  normalizeSafeFileStem,
+  normalizeSafeRelativePath,
+  pathHasProtectedSegment,
+  resolveInsideRoot
+};

package/src/server/services/config-export-service.js

@@ -45,8 +45,8 @@ const CC_SECURITY_PATH = PATHS.security;
 const LEGACY_UI_CONFIG_PATH = PATHS.uiConfig;
 const LEGACY_NOTIFY_HOOK_PATH = PATHS.notifyHook;
 const GEMINI_SETTINGS_PATH = path.join(path.dirname(NATIVE_PATHS.gemini.env), 'settings.json');
-const AGENT_PLATFORMS = ['claude', 'codex', 'opencode'];
-const COMMAND_PLATFORMS = ['claude', 'opencode'];
+const AGENT_PLATFORMS = ['claude', 'codex', 'gemini', 'opencode'];
+const COMMAND_PLATFORMS = ['claude', 'gemini', 'opencode'];
 const SKILL_PLATFORMS = ['claude', 'codex', 'gemini', 'opencode'];
 
 function getOpenCodeConfigPaths() {
@@ -386,14 +386,15 @@ function resolveAgentRelativePath(agent, platform) {
   return platform === 'codex' ? `${baseName}.toml` : `${baseName}.md`;
 }
 
-function resolveCommandRelativePath(command) {
+function resolveCommandRelativePath(command, platform = 'claude') {
   if (typeof command?.path === 'string' && command.path.trim()) {
     return command.path.trim();
   }
+  const extension = platform === 'gemini' ? '.toml' : '.md';
   if (command?.namespace) {
-    return path.join(command.namespace, `${command.name}.md`);
+    return path.join(command.namespace, `${command.name}${extension}`);
   }
-  return command?.name ? `${command.name}.md` : null;
+  return command?.name ? `${command.name}${extension}` : null;
 }
 
 function pickPrimaryChannel(channels = []) {
@@ -1399,7 +1400,7 @@ async function importConfigs(importData, options = {}) {
           const baseDir = commandsService.userCommandsDir;
 
           for (const command of platformCommands) {
-            const relativePath = resolveCommandRelativePath(command);
+            const relativePath = resolveCommandRelativePath(command, platform);
             const content = command.fullContent || command.content || buildCommandContent(command);
 
             const status = relativePath ? writeTextFile(baseDir, relativePath, content, overwrite) : 'failed';

package/src/server/services/config-registry-service.js

@@ -31,8 +31,8 @@ const SUPPORTED_PLATFORMS = ['claude', 'codex', 'gemini', 'opencode'];
 
 const PLATFORM_SUPPORT = {
   skills: { claude: true, codex: true, gemini: true, opencode: true },
-  commands: { claude: true, codex: true, gemini: false, opencode: true },
-  agents: { claude: true, codex: true, gemini: false, opencode: true },
+  commands: { claude: true, codex: true, gemini: true, opencode: true },
+  agents: { claude: true, codex: true, gemini: true, opencode: true },
   plugins: { claude: true, codex: false, gemini: false, opencode: true }
 };