coding-tool-x 3.8.4 → 3.8.5

package/src/server/services/skill-projection-service.js

@@ -0,0 +1,323 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+const { NATIVE_PATHS, PATHS } = require('../../config/paths');
+const { getOmpPaths } = require('../../platforms/drivers/omp/config');
+const { normalizeSafeRelativePath, resolveInsideRoot } = require('../../shared/config-artifact-paths');
+const { assertNoSymlinkComponents } = require('../../shared/project-config');
+
+const SUPPORTED_MODES = new Set(['native-copy', 'native-filter']);
+
+function clone(value) {
+  return JSON.parse(JSON.stringify(value));
+}
+
+function removePath(fsImpl, target) {
+  if (!fsImpl.existsSync(target)) return;
+  const stat = fsImpl.lstatSync(target);
+  if (stat.isSymbolicLink() || !stat.isDirectory()) {
+    fsImpl.unlinkSync(target);
+    return;
+  }
+  fsImpl.rmSync(target, { recursive: true, force: true });
+}
+
+class SkillProjectionService {
+  constructor({ registry, nativeRoots = {}, artifactRoot = PATHS.skillArtifacts, fsImpl = fs } = {}) {
+    if (!registry || typeof registry.resolve !== 'function') {
+      throw new Error('SkillProjectionService requires a platform registry');
+    }
+    this.registry = registry;
+    this.nativeRoots = nativeRoots;
+    this.artifactRoot = artifactRoot ? path.resolve(artifactRoot) : null;
+    this.fs = fsImpl;
+  }
+
+  getCapability(platform, scope = 'user') {
+    const manifest = this.registry.resolve(platform);
+    const capability = manifest?.skillActivation?.[scope];
+    if (!capability || !SUPPORTED_MODES.has(capability.mode)) {
+      return { mode: 'unsupported', format: capability?.format || null };
+    }
+    return {
+      mode: capability.mode,
+      format: capability.format || null
+    };
+  }
+
+  _assertNativeRoot(root) {
+    const resolved = path.resolve(root);
+    try {
+      const rootStat = this.fs.lstatSync(resolved);
+      if (rootStat.isSymbolicLink()) {
+        throw new Error('Native Skill root contains a symlink');
+      }
+      if (!rootStat.isDirectory()) {
+        throw new Error('Native Skill root is not a directory');
+      }
+      return resolved;
+    } catch (error) {
+      if (error.code !== 'ENOENT') throw error;
+    }
+    let existing = path.dirname(resolved);
+    while (!this.fs.existsSync(existing)) {
+      const parent = path.dirname(existing);
+      if (parent === existing) break;
+      existing = parent;
+    }
+    const stat = this.fs.lstatSync(existing);
+    if (stat.isSymbolicLink()) {
+      throw new Error('Native Skill root contains a symlink');
+    }
+    return resolved;
+  }
+
+  _userRoot(platform) {
+    let root;
+    if (this.nativeRoots[platform]) root = this.nativeRoots[platform];
+    else {
+      let pathContext = null;
+      try {
+        if (typeof this.registry.resolvePathContext === 'function') {
+          pathContext = this.registry.resolvePathContext(platform);
+        }
+      } catch {
+        pathContext = null;
+      }
+      const native = pathContext?.customized
+        ? (pathContext.native || {})
+        : (NATIVE_PATHS[platform] || {});
+      root = native.skills || (native.dir ? path.join(native.dir, 'skills') : null);
+      if (!root && platform === 'omp') root = getOmpPaths().skills;
+    }
+    if (!root) throw new Error(`Unsupported Skill platform: ${platform}`);
+    return this._assertNativeRoot(root);
+  }
+
+  _projectRoot(entry) {
+    if (typeof entry.projectPath !== 'string' || !path.isAbsolute(entry.projectPath)) {
+      throw new Error('Project Skill projection requires an absolute projectPath');
+    }
+    const root = path.resolve(entry.projectPath);
+    if (!this.fs.existsSync(root) || !this.fs.statSync(root).isDirectory()) {
+      throw new Error('Project Skill projection requires an existing projectPath');
+    }
+    const canonical = this.fs.realpathSync(root);
+    if (canonical !== root) {
+      throw new Error('Project Skill projection requires a canonical projectPath');
+    }
+    this._assertNativeRoot(root);
+    return canonical;
+  }
+
+  _targetPath(entry) {
+    const platform = String(entry.platform || '').trim().toLowerCase();
+    const scope = entry.scope || 'user';
+    const capability = this.getCapability(platform, scope);
+    if (capability.mode === 'unsupported') {
+      return { capability, target: null, root: null };
+    }
+    if (capability.mode !== 'native-copy') {
+      return { capability, target: null, root: null };
+    }
+
+    const root = scope === 'project'
+      ? (() => {
+        const manifest = this.registry.resolve(platform);
+        const relativeRoot = manifest?.projectResources?.skills?.canonicalRoot;
+        if (!relativeRoot) throw new Error(`Project Skills are not supported for ${platform}`);
+        const projectRoot = this._projectRoot(entry);
+        return resolveInsideRoot(projectRoot, relativeRoot, 'project skill root', {
+          allowHiddenSegments: true,
+          allowRoot: true
+        });
+      })()
+      : this._userRoot(platform);
+    this._assertNativeRoot(root);
+    const safeDirectory = normalizeSafeRelativePath(entry.targetDirectory, 'Skill target directory', {
+      allowHiddenSegments: true
+    });
+    const target = resolveInsideRoot(root, safeDirectory, 'Skill target directory', {
+      allowHiddenSegments: true
+    });
+    assertNoSymlinkComponents(root, target, this.fs);
+    return { capability, target, root };
+  }
+
+  _copyTree(source, destination) {
+    const sourceStat = this.fs.lstatSync(source);
+    if (sourceStat.isSymbolicLink()) throw new Error(`Skill artifact contains symlink: ${source}`);
+    if (sourceStat.isDirectory()) {
+      this.fs.mkdirSync(destination, { recursive: true });
+      assertNoSymlinkComponents(destination, destination, this.fs);
+      for (const entry of this.fs.readdirSync(source, { withFileTypes: true })) {
+        if (entry.isSymbolicLink()) throw new Error(`Skill artifact contains symlink: ${path.join(source, entry.name)}`);
+        this._copyTree(path.join(source, entry.name), path.join(destination, entry.name));
+      }
+      return;
+    }
+    if (!sourceStat.isFile()) throw new Error(`Unsupported Skill artifact entry: ${source}`);
+    const parent = path.dirname(destination);
+    this.fs.mkdirSync(parent, { recursive: true });
+    assertNoSymlinkComponents(path.dirname(destination), destination, this.fs);
+    this.fs.copyFileSync(source, destination);
+  }
+
+  _artifactRoot(entry) {
+    const root = entry.artifact?.root;
+    if (!root || !path.isAbsolute(root) || !this.fs.existsSync(root)) {
+      throw new Error('Skill artifact is not available');
+    }
+    const resolved = path.resolve(root);
+    if (this.artifactRoot) {
+      this._assertNativeRoot(this.artifactRoot);
+      const relative = path.relative(this.artifactRoot, resolved);
+      if (relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+        throw new Error('Skill artifact root escapes the artifact store');
+      }
+      assertNoSymlinkComponents(this.artifactRoot, resolved, this.fs);
+    }
+    const stat = this.fs.lstatSync(resolved);
+    if (stat.isSymbolicLink() || !stat.isDirectory()) {
+      throw new Error('Skill artifact root is not a directory');
+    }
+    const skillMd = path.join(resolved, 'SKILL.md');
+    if (!this.fs.existsSync(skillMd) || this.fs.lstatSync(skillMd).isSymbolicLink()) {
+      throw new Error('Skill artifact must contain a root SKILL.md');
+    }
+    return resolved;
+  }
+
+  _atomicCopy(source, target) {
+    const parent = path.dirname(target);
+    this.fs.mkdirSync(parent, { recursive: true });
+    const temp = `${target}.tmp-${process.pid}-${crypto.randomBytes(5).toString('hex')}`;
+    const backup = `${target}.bak-${process.pid}-${crypto.randomBytes(5).toString('hex')}`;
+    let movedExisting = false;
+    try {
+      assertNoSymlinkComponents(parent, parent, this.fs);
+      this._copyTree(source, temp);
+      if (this.fs.existsSync(target)) {
+        if (this.fs.lstatSync(target).isSymbolicLink()) throw new Error(`Skill projection target contains symlink: ${target}`);
+        this.fs.renameSync(target, backup);
+        movedExisting = true;
+      }
+      this.fs.renameSync(temp, target);
+      if (movedExisting) removePath(this.fs, backup);
+    } catch (error) {
+      removePath(this.fs, temp);
+      if (movedExisting && this.fs.existsSync(backup) && !this.fs.existsSync(target)) {
+        this.fs.renameSync(backup, target);
+      } else {
+        removePath(this.fs, backup);
+      }
+      throw error;
+    }
+    return target;
+  }
+
+  enable(entry) {
+    if (entry?.protected || entry?.projection?.mode === 'unsupported') {
+      return { ...(entry?.projection || {}), mode: 'unsupported', state: 'unsupported', status: 'unsupported', requiresRestart: false };
+    }
+    const { capability, target } = this._targetPath(entry);
+    if (capability.mode === 'unsupported') {
+      return { ...(entry.projection || {}), mode: 'unsupported', state: 'unsupported', status: 'unsupported', requiresRestart: false };
+    }
+    if (capability.mode !== 'native-copy') {
+      return { ...(entry.projection || {}), mode: capability.mode, state: 'unsupported', status: 'unsupported', requiresRestart: false };
+    }
+    if (this.fs.existsSync(target) && entry.projection?.sourceKey !== entry.sourceKey) {
+      return {
+        ...(entry.projection || {}),
+        state: 'conflict',
+        status: 'conflict',
+        conflictWith: entry.projection?.sourceKey || 'unknown'
+      };
+    }
+    const source = this._artifactRoot(entry);
+    this._atomicCopy(source, target);
+    return {
+      ...(entry.projection || {}),
+      mode: capability.mode,
+      state: 'enabled',
+      status: 'enabled',
+      path: target,
+      sourceKey: entry.sourceKey || null,
+      updatedAt: Date.now(),
+      requiresRestart: true
+    };
+  }
+
+  disable(entry) {
+    if (entry?.protected || entry?.projection?.mode === 'unsupported') {
+      return { ...(entry?.projection || {}), mode: 'unsupported', state: 'unsupported', status: 'unsupported', requiresRestart: false };
+    }
+    const { capability, target } = this._targetPath(entry);
+    if (capability.mode === 'unsupported') {
+      return { ...(entry.projection || {}), mode: 'unsupported', state: 'unsupported', status: 'unsupported', requiresRestart: false };
+    }
+    if (capability.mode !== 'native-copy') {
+      return { ...(entry.projection || {}), mode: capability.mode, state: 'unsupported', status: 'unsupported', requiresRestart: false };
+    }
+    if (this.fs.existsSync(target) && entry.projection?.sourceKey !== entry.sourceKey) {
+      return {
+        ...(entry.projection || {}),
+        state: 'conflict',
+        status: 'conflict',
+        conflictWith: entry.projection?.sourceKey || 'unknown'
+      };
+    }
+    if (this.fs.existsSync(target)) {
+      if (this.fs.lstatSync(target).isSymbolicLink()) throw new Error(`Skill projection target contains symlink: ${target}`);
+      removePath(this.fs, target);
+    }
+    return {
+      ...(entry.projection || {}),
+      mode: capability.mode,
+      state: 'disabled',
+      status: 'disabled',
+      sourceKey: entry.sourceKey || null,
+      updatedAt: Date.now(),
+      requiresRestart: true
+    };
+  }
+
+  async reconcile(entries = []) {
+    const results = [];
+    const targets = new Map();
+    for (const entry of entries) {
+      if (!entry?.managed || !entry.enabled || entry.trust !== 'approved' || entry.artifact?.state !== 'ready') continue;
+      const targetKey = [
+        entry.platform || '',
+        entry.targetDirectory || ''
+      ].join(':');
+      if (targets.has(targetKey)) {
+        results.push({
+          controlKey: entry.controlKey,
+          status: 'conflict',
+          conflictWith: targets.get(targetKey)
+        });
+        continue;
+      }
+      try {
+        const projection = await this.enable(entry);
+        if (projection.status === 'unsupported' || projection.state === 'unsupported') {
+          results.push({ controlKey: entry.controlKey, status: 'unsupported' });
+          continue;
+        }
+        targets.set(targetKey, entry.controlKey);
+        results.push({ controlKey: entry.controlKey, projection });
+      } catch (error) {
+        results.push({ controlKey: entry.controlKey, status: 'failed', error: error.message });
+      }
+    }
+    return results;
+  }
+}
+
+module.exports = {
+  SkillProjectionService
+};

package/src/server/services/skill-refresh-task-service.js

@@ -0,0 +1,275 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+
+const ACTIVE_STATES = new Set(['queued', 'running']);
+const TERMINAL_STATES = new Set(['succeeded', 'partial', 'failed', 'interrupted']);
+const RESULT_STATES = new Set(['succeeded', 'partial', 'failed']);
+
+function clone(value) {
+  return JSON.parse(JSON.stringify(value));
+}
+
+function sanitizeText(value) {
+  return String(value || '')
+    .replace(/(https?:\/\/[^\s?]+)\?[^\s]+/gi, '$1?[REDACTED]')
+    .replace(/([?&](?:access[_-]?token|api[_-]?key|token|password|secret|key)=)[^&\s]+/gi, '$1[REDACTED]')
+    .replace(/(Bearer\s+)[^\s]+/gi, '$1[REDACTED]')
+    .replace(/(authorization\s*[:=]\s*)[^,\s}]+/gi, '$1[REDACTED]');
+}
+
+function sanitizeRepoProgress(progress = {}) {
+  if (!progress || typeof progress !== 'object') return {};
+  return Object.fromEntries(Object.entries(progress).map(([repoId, value]) => {
+    if (!value || typeof value !== 'object') return [repoId, { status: sanitizeText(value) }];
+    return [repoId, {
+      status: sanitizeText(value.status),
+      ...(value.error ? { error: sanitizeText(value.error) } : {}),
+      ...(Number.isFinite(value.skillCount) ? { skillCount: value.skillCount } : {})
+    }];
+  }));
+}
+
+function sanitizeFailedRepos(repos) {
+  if (!Array.isArray(repos)) return [];
+  return repos.map(repo => ({
+    repoId: sanitizeText(repo?.repoId || repo?.id || 'unknown'),
+    ...(repo?.error ? { error: sanitizeText(repo.error) } : {}),
+    ...(repo?.status ? { status: sanitizeText(repo.status) } : {})
+  }));
+}
+
+class SkillRefreshTaskService {
+  constructor({ worker, persistencePath = null, fsImpl = fs, clock = () => Date.now() } = {}) {
+    if (typeof worker !== 'function') throw new Error('SkillRefreshTaskService worker is required');
+    this.worker = worker;
+    this.persistencePath = persistencePath;
+    this.fs = fsImpl;
+    this.clock = clock;
+    this.tasks = new Map();
+    this.waiters = new Map();
+    this._load();
+  }
+
+  _canonicalProjectPath(scope, projectPath) {
+    if (scope === 'user') return null;
+    if (scope !== 'project' || typeof projectPath !== 'string' || !path.isAbsolute(projectPath)) {
+      throw new Error('Project refresh requires a canonical absolute projectPath');
+    }
+    try {
+      return this.fs.realpathSync(path.resolve(projectPath));
+    } catch (error) {
+      throw new Error('Project refresh requires an existing projectPath', { cause: error });
+    }
+  }
+
+  _taskKey({ platform, scope, projectPath }) {
+    return `${platform}:${scope}:${projectPath || ''}`;
+  }
+
+  _readPersisted() {
+    if (!this.persistencePath || !this.fs.existsSync(this.persistencePath)) return [];
+    try {
+      const parsed = JSON.parse(this.fs.readFileSync(this.persistencePath, 'utf8'));
+      return Array.isArray(parsed?.tasks) ? parsed.tasks : [];
+    } catch {
+      return [];
+    }
+  }
+
+  _load() {
+    const persisted = this._readPersisted();
+    let changed = false;
+    for (const item of persisted) {
+      if (!item || typeof item !== 'object' || !item.id) continue;
+      const task = this._sanitizeTask(item);
+      if (ACTIVE_STATES.has(task.status)) {
+        task.status = 'interrupted';
+        task.finishedAt = this.clock();
+        changed = true;
+      }
+      this.tasks.set(task.id, task);
+    }
+    if (changed) this._persist();
+  }
+
+  _sanitizeTask(task) {
+    const safe = {
+      id: sanitizeText(task.id),
+      key: sanitizeText(task.key),
+      platform: sanitizeText(task.platform),
+      scope: task.scope === 'project' ? 'project' : 'user',
+      projectPath: task.projectPath ? path.resolve(String(task.projectPath)) : null,
+      reason: sanitizeText(task.reason || 'manual'),
+      status: TERMINAL_STATES.has(task.status) || ACTIVE_STATES.has(task.status) ? task.status : 'failed',
+      createdAt: Number(task.createdAt || 0) || this.clock(),
+      startedAt: task.startedAt ? Number(task.startedAt) : null,
+      finishedAt: task.finishedAt ? Number(task.finishedAt) : null,
+      ...(task.fetchedRepos !== undefined ? { fetchedRepos: task.fetchedRepos } : {}),
+      ...(task.fetchedSkills !== undefined ? { fetchedSkills: task.fetchedSkills } : {}),
+      failedRepos: sanitizeFailedRepos(task.failedRepos),
+      updatedControlKeys: Array.isArray(task.updatedControlKeys)
+        ? task.updatedControlKeys.map(value => sanitizeText(value))
+        : [],
+      repoProgress: sanitizeRepoProgress(task.repoProgress),
+      error: task.error ? sanitizeText(task.error) : null
+    };
+    return safe;
+  }
+
+  _persist() {
+    if (!this.persistencePath) return;
+    const tasks = Array.from(this.tasks.values());
+    const terminal = tasks.filter(task => TERMINAL_STATES.has(task.status));
+    const active = tasks.filter(task => ACTIVE_STATES.has(task.status));
+    const retained = [...active, ...terminal.slice(-50)];
+    const retainedIds = new Set(retained.map(task => task.id));
+    for (const id of this.tasks.keys()) {
+      if (!retainedIds.has(id)) this.tasks.delete(id);
+    }
+
+    const directory = path.dirname(this.persistencePath);
+    const tempPath = `${this.persistencePath}.tmp-${process.pid}-${crypto.randomBytes(5).toString('hex')}`;
+    try {
+      this.fs.mkdirSync(directory, { recursive: true });
+      this.fs.writeFileSync(tempPath, `${JSON.stringify({ version: 1, tasks: retained }, null, 2)}\n`, {
+        encoding: 'utf8',
+        mode: 0o600
+      });
+      if (typeof this.fs.chmodSync === 'function') this.fs.chmodSync(tempPath, 0o600);
+      this.fs.renameSync(tempPath, this.persistencePath);
+      if (typeof this.fs.chmodSync === 'function') this.fs.chmodSync(this.persistencePath, 0o600);
+    } catch (error) {
+      try {
+        if (this.fs.existsSync(tempPath)) this.fs.unlinkSync(tempPath);
+      } catch (_) {}
+      throw error;
+    }
+  }
+
+  _publicTask(task, extra = {}) {
+    return { ...clone(task), ...extra };
+  }
+
+  enqueue({ platform, scope = 'user', projectPath = null, reason = 'manual' } = {}) {
+    const normalizedPlatform = String(platform || '').trim().toLowerCase();
+    if (!normalizedPlatform) throw new Error('Refresh platform is required');
+    const canonicalProjectPath = this._canonicalProjectPath(scope, projectPath);
+    const key = this._taskKey({ platform: normalizedPlatform, scope, projectPath: canonicalProjectPath });
+    const active = Array.from(this.tasks.values()).find(task => task.key === key && ACTIVE_STATES.has(task.status));
+    if (active) return this._publicTask(active, { deduplicated: true });
+
+    const task = this._sanitizeTask({
+      id: crypto.randomUUID(),
+      key,
+      platform: normalizedPlatform,
+      scope,
+      projectPath: canonicalProjectPath,
+      reason,
+      status: 'queued',
+      createdAt: this.clock(),
+      startedAt: null,
+      finishedAt: null,
+      failedRepos: [],
+      updatedControlKeys: [],
+      repoProgress: {},
+      error: null
+    });
+    this.tasks.set(task.id, task);
+    this._persist();
+    queueMicrotask(() => {
+      this._run(task.id);
+    });
+    return this._publicTask(task);
+  }
+
+  async _run(taskId) {
+    const task = this.tasks.get(taskId);
+    if (!task || task.status !== 'queued') return;
+    task.status = 'running';
+    task.startedAt = this.clock();
+    this._persist();
+    const reportProgress = progress => {
+      if (!this.tasks.has(taskId)) return;
+      task.repoProgress = sanitizeRepoProgress({ ...task.repoProgress, ...(progress || {}) });
+      this._persist();
+    };
+
+    try {
+      const result = await this.worker({
+        platform: task.platform,
+        scope: task.scope,
+        projectPath: task.projectPath,
+        taskId: task.id,
+        reportProgress
+      });
+      const status = RESULT_STATES.has(result?.status) ? result.status : 'succeeded';
+      task.status = status;
+      if (result?.fetchedRepos !== undefined) task.fetchedRepos = result.fetchedRepos;
+      if (result?.fetchedSkills !== undefined) task.fetchedSkills = result.fetchedSkills;
+      task.failedRepos = sanitizeFailedRepos(result?.failedRepos);
+      task.updatedControlKeys = Array.isArray(result?.updatedControlKeys)
+        ? result.updatedControlKeys.map(value => sanitizeText(value))
+        : [];
+      if (result?.error) task.error = sanitizeText(result.error);
+    } catch (error) {
+      task.status = 'failed';
+      task.error = sanitizeText(error?.message || error);
+    } finally {
+      task.finishedAt = this.clock();
+      this._persist();
+      const waiters = this.waiters.get(taskId) || [];
+      this.waiters.delete(taskId);
+      waiters.forEach(resolve => resolve(this._publicTask(task)));
+    }
+  }
+
+  get(taskId) {
+    const task = this.tasks.get(String(taskId || ''));
+    return task ? this._publicTask(task) : null;
+  }
+
+  getActive({ platform, scope = 'user', projectPath = null } = {}) {
+    const canonicalProjectPath = this._canonicalProjectPath(scope, projectPath);
+    const key = this._taskKey({
+      platform: String(platform || '').trim().toLowerCase(),
+      scope,
+      projectPath: canonicalProjectPath
+    });
+    const task = Array.from(this.tasks.values()).find(item => item.key === key && ACTIVE_STATES.has(item.status));
+    return task ? this._publicTask(task) : null;
+  }
+
+  listRecent({ platform, scope = 'user', projectPath = null, limit = 10 } = {}) {
+    const canonicalProjectPath = this._canonicalProjectPath(scope, projectPath);
+    const key = this._taskKey({
+      platform: String(platform || '').trim().toLowerCase(),
+      scope,
+      projectPath: canonicalProjectPath
+    });
+    return Array.from(this.tasks.values())
+      .filter(task => task.key === key)
+      .sort((a, b) => b.createdAt - a.createdAt)
+      .slice(0, Math.max(0, Number(limit) || 10))
+      .map(task => this._publicTask(task));
+  }
+
+  waitFor(taskId) {
+    const task = this.tasks.get(String(taskId || ''));
+    if (!task) return Promise.reject(new Error('Refresh task not found'));
+    if (TERMINAL_STATES.has(task.status)) return Promise.resolve(this._publicTask(task));
+    return new Promise(resolve => {
+      const waiters = this.waiters.get(task.id) || [];
+      waiters.push(resolve);
+      this.waiters.set(task.id, waiters);
+    });
+  }
+}
+
+module.exports = {
+  SkillRefreshTaskService,
+  ACTIVE_STATES,
+  TERMINAL_STATES
+};