coding-tool-x 3.8.4 → 3.8.6

package/src/server/api/skills.js

@@ -4,6 +4,11 @@
 
 const express = require('express');
 const { SkillService } = require('../services/skill-service');
+const { ControlManifestStore } = require('../services/control-manifest-store');
+const { EffectiveControlService } = require('../services/effective-control-service');
+const { SkillProjectionService } = require('../services/skill-projection-service');
+const { SkillRefreshTaskService } = require('../services/skill-refresh-task-service');
+const { PATHS } = require('../../config/paths');
 const { maskToken } = require('../services/oauth-utils');
 const { sendApiError } = require('./validation-errors');
 const { resolveManagedPlatform } = require('../services/platform-resolution');
@@ -11,10 +16,14 @@ const { validateKnownProjectCwd } = require('../services/project-path-validation
 const {
   readOmpSkillSettings,
   updateOmpSkillSettings
-} = require('../services/omp-skill-settings-service');
+} = require('../../platforms/drivers/omp/skill-settings');
+const { getPlatformContext } = require('../platform-context');
 
 const router = express.Router();
 const skillServices = new Map();
+let routerOptions = {};
+let defaultControlService;
+let defaultRefreshTasks;
 
 function resolvePlatform(rawPlatform) {
   return resolveManagedPlatform(rawPlatform);
@@ -24,19 +33,81 @@ function getPlatform(req) {
   return resolvePlatform(req.query?.platform || req.body?.platform);
 }
 
-function getSkillService(req) {
-  const resolution = getPlatform(req);
-  const platform = resolution.platform;
+function getSkillServiceForPlatform(platform) {
+  if (typeof routerOptions.skillServiceFactory === 'function') {
+    return routerOptions.skillServiceFactory(platform);
+  }
   if (!skillServices.has(platform)) {
     skillServices.set(platform, new SkillService(platform));
   }
+  return skillServices.get(platform);
+}
+
+function getSkillService(req) {
+  const resolution = getPlatform(req);
   return {
-    platform,
-    service: skillServices.get(platform),
+    platform: resolution.platform,
+    service: getSkillServiceForPlatform(resolution.platform),
     warning: resolution.warning
   };
 }
 
+function getControlService() {
+  if (routerOptions.controlService) return routerOptions.controlService;
+  if (!defaultControlService && PATHS.effectiveControlManifest) {
+    const registry = getPlatformContext().registry;
+    defaultControlService = new EffectiveControlService({
+      store: new ControlManifestStore({
+        userPath: PATHS.effectiveControlManifest,
+        projectPathResolver: ({ projectPath }) => require('path').join(projectPath, '.ctx-control.json')
+      }),
+      projection: new SkillProjectionService({ registry })
+    });
+  }
+  return defaultControlService;
+}
+
+function getRefreshTasks() {
+  if (routerOptions.refreshTasks) return routerOptions.refreshTasks;
+  if (!defaultRefreshTasks && PATHS.skillRefreshTasks) {
+    defaultRefreshTasks = new SkillRefreshTaskService({
+      persistencePath: PATHS.skillRefreshTasks,
+      worker: context => getSkillServiceForPlatform(context.platform).refreshRemoteSkills(context)
+    });
+  }
+  return defaultRefreshTasks;
+}
+
+function createRouter(options = {}) {
+  routerOptions = options;
+  return router;
+}
+
+async function getScopeOptions(source = {}) {
+  const scope = source.scope;
+  if (scope && scope !== 'user' && scope !== 'project') {
+    throw new Error('Invalid scope: expected "user" or "project"');
+  }
+
+  const cwd = await validateKnownProjectCwd(source.cwd);
+  if (scope === 'project' && !cwd) {
+    throw new Error('Project scope requires a valid cwd');
+  }
+
+  return {
+    ...(cwd ? { cwd } : {}),
+    ...(scope ? { scope } : {})
+  };
+}
+
+function toControlScopeOptions(options = {}) {
+  const scope = options.scope || 'user';
+  return {
+    scope,
+    projectPath: scope === 'project' ? options.cwd : null
+  };
+}
+
 function extractRepoPayload(source = {}) {
   const repo = source.repo && typeof source.repo === 'object' ? source.repo : source;
   return {
@@ -45,7 +116,7 @@ function extractRepoPayload(source = {}) {
     host: repo.host || source.host || '',
     owner: repo.owner || source.owner || '',
     name: repo.name || source.name || '',
-    branch: repo.branch || source.branch || 'main',
+    branch: repo.branch || source.branch || '',
     directory: repo.directory || source.directory || '',
     projectPath: repo.projectPath || source.projectPath || '',
     localPath: repo.localPath || source.localPath || '',
@@ -73,26 +144,44 @@ function sanitizeRepos(service, repos = []) {
 }
 
 /**
- * 获取技能列表
+ * 获取本地 Skill 列表
  * GET /api/skills
- * Query: refresh=1 强制刷新缓存
+ *
+ * `refresh=1` is intentionally ignored here. Remote work only starts through
+ * POST /refresh.
  */
 router.get('/', async (req, res) => {
   try {
     const { platform, service, warning } = getSkillService(req);
-    const forceRefresh = req.query.refresh === '1';
-    const cwd = await validateKnownProjectCwd(req.query.cwd);
-    if (forceRefresh) {
-      console.log(`[Skills API] Refreshing skills for ${platform}...`);
+    const options = { ...(await getScopeOptions(req.query)), scope: req.query.scope || 'user' };
+    const snapshot = typeof service.scanSkills === 'function'
+      ? await service.scanSkills(options)
+      : {
+        skills: await service.listSkills(false, options),
+        refresh: { state: 'never_fetched', taskId: null, fetchedAt: null, error: null }
+      };
+    const skills = Array.isArray(snapshot.skills) ? snapshot.skills : [];
+    const refreshService = getRefreshTasks();
+    const refreshOptions = {
+      platform,
+      scope: options.scope || 'user',
+      projectPath: options.scope === 'project' ? options.cwd : null
+    };
+    const activeTask = refreshService?.getActive?.(refreshOptions);
+    const latestTask = activeTask || refreshService?.listRecent?.(refreshOptions)?.[0];
+    if (latestTask) {
+      snapshot.refresh = {
+        ...(snapshot.refresh || {}),
+        state: latestTask.status,
+        taskId: latestTask.id,
+        error: latestTask.error || snapshot.refresh?.error || null
+      };
     }
-    const skills = await service.listSkills(forceRefresh, { cwd });
-    console.log(`[Skills API] ${platform}: ${skills.length} skills loaded (refresh=${forceRefresh})`);
     res.json({
       success: true,
       platform,
-      skills,
+      ...snapshot,
       total: skills.length,
-      installed: skills.filter(s => s.installed).length,
       ...(warning ? { warnings: [warning] } : {})
     });
   } catch (err) {
@@ -101,6 +190,93 @@ router.get('/', async (req, res) => {
   }
 });
 
+router.post('/refresh', async (req, res) => {
+  try {
+    const { platform } = getSkillService(req);
+    const options = await getScopeOptions(req.body);
+    const refreshTasks = getRefreshTasks();
+    if (!refreshTasks) throw new Error('Skill refresh task service is unavailable');
+    const task = refreshTasks.enqueue({
+      platform,
+      scope: options.scope || 'user',
+      projectPath: options.scope === 'project' ? options.cwd : null,
+      reason: 'manual'
+    });
+    res.status(202).json({ success: true, platform, task });
+  } catch (err) {
+    console.error('[Skills API] Refresh skills error:', err);
+    sendApiError(res, err);
+  }
+});
+
+router.get('/refresh/:taskId', async (req, res) => {
+  try {
+    const { platform } = getSkillService(req);
+    const options = await getScopeOptions(req.query);
+    const refreshTasks = getRefreshTasks();
+    const task = refreshTasks?.get(req.params.taskId);
+    if (!task) return res.status(404).json({ success: false, message: 'Refresh task not found' });
+    const taskScope = task.scope || 'user';
+    const taskProjectPath = taskScope === 'project' ? (task.projectPath || null) : null;
+    const requestedProjectPath = options.scope === 'project' ? (options.cwd || null) : null;
+    if (
+      task.platform !== platform
+      || taskScope !== (options.scope || 'user')
+      || taskProjectPath !== requestedProjectPath
+    ) {
+      return res.status(404).json({ success: false, message: 'Refresh task not found' });
+    }
+    return res.json({ success: true, task });
+  } catch (err) {
+    console.error('[Skills API] Get refresh task error:', err);
+    return sendApiError(res, err);
+  }
+});
+
+router.put('/toggle', async (req, res) => {
+  try {
+    const { platform } = getSkillService(req);
+    if (!req.body?.controlKey) {
+      return res.status(400).json({ success: false, message: 'Missing controlKey' });
+    }
+    const options = await getScopeOptions(req.body);
+    const controlService = getControlService();
+    if (!controlService) throw new Error('Effective control service is unavailable');
+    const result = controlService.setSkillEnabled({
+      platform,
+      controlKey: req.body.controlKey,
+      enabled: req.body.enabled,
+      ...toControlScopeOptions(options)
+    });
+    return res.json({ success: true, platform, ...result });
+  } catch (err) {
+    console.error('[Skills API] Toggle skill error:', err);
+    return sendApiError(res, err);
+  }
+});
+
+router.put('/trust', async (req, res) => {
+  try {
+    const { platform } = getSkillService(req);
+    if (!req.body?.controlKey) {
+      return res.status(400).json({ success: false, message: 'Missing controlKey' });
+    }
+    const options = await getScopeOptions(req.body);
+    const controlService = getControlService();
+    if (!controlService) throw new Error('Effective control service is unavailable');
+    const result = controlService.setSkillTrust({
+      platform,
+      controlKey: req.body.controlKey,
+      trust: req.body.trust,
+      ...toControlScopeOptions(options)
+    });
+    return res.json({ success: true, platform, ...result });
+  } catch (err) {
+    console.error('[Skills API] Set Skill trust error:', err);
+    return sendApiError(res, err);
+  }
+});
+
 /**
  * 获取 OMP 技能设置
  * GET /api/skills/omp-settings
@@ -144,9 +320,21 @@ router.get('/detail/*', async (req, res) => {
       });
     }
 
+    const options = await getScopeOptions(req.query);
     const repoHint = extractRepoPayload(req.query || {});
     const hasRepoHint = Object.values(repoHint).some(Boolean);
-    const result = await service.getSkillDetail(directory, hasRepoHint ? repoHint : null, req.query.fullDirectory || '');
+    const result = Object.keys(options).length > 0
+      ? await service.getSkillDetail(
+        directory,
+        hasRepoHint ? repoHint : null,
+        req.query.fullDirectory || '',
+        options
+      )
+      : await service.getSkillDetail(
+        directory,
+        hasRepoHint ? repoHint : null,
+        req.query.fullDirectory || ''
+      );
     res.json({
       success: true,
       platform,
@@ -162,14 +350,16 @@ router.get('/detail/*', async (req, res) => {
  * 获取已安装的技能
  * GET /api/skills/installed
  */
-router.get('/installed', (req, res) => {
+router.get('/installed', async (req, res) => {
   try {
     const { platform, service } = getSkillService(req);
-    const skills = service.getInstalledSkills();
+    const options = await getScopeOptions(req.query);
+    const snapshot = await service.scanSkills(options);
     res.json({
       success: true,
       platform,
-      skills
+      ...snapshot,
+      total: Array.isArray(snapshot.skills) ? snapshot.skills.length : 0
     });
   } catch (err) {
     console.error('[Skills API] Get installed skills error:', err);
@@ -178,68 +368,23 @@ router.get('/installed', (req, res) => {
 });
 
 /**
- * 安装技能
- * POST /api/skills/install
- * Body: { directory, fullDirectory, repo }
- * - directory: 本地安装目录（相对路径）
- * - fullDirectory: 仓库中的完整路径（当指定了仓库子目录时使用）
+ * 旧安装入口已被 Skill control plane 取代。
  */
-router.post('/install', async (req, res) => {
-  try {
-    const { platform, service } = getSkillService(req);
-    const { directory, fullDirectory, repo } = req.body;
-
-    if (!directory) {
-      return res.status(400).json({
-        success: false,
-        message: 'Missing directory'
-      });
-    }
-
-    if (!repo) {
-      return res.status(400).json({
-        success: false,
-        message: 'Missing repo info'
-      });
-    }
-
-    const result = await service.installSkill(
-      directory,
-      extractRepoPayload({ repo }),
-      fullDirectory || null  // 传递 fullDirectory 用于从仓库子目录下载
-    );
-
-    res.json({
-      success: true,
-      platform,
-      ...result
-    });
-  } catch (err) {
-    console.error('[Skills API] Install skill error:', err);
-    sendApiError(res, err);
-  }
+router.post('/install', (req, res) => {
+  res.status(410).json({
+    success: false,
+    message: 'Skill installation is replaced by POST /api/skills/refresh and PUT /api/skills/toggle'
+  });
 });
 
 /**
- * 安装本地 cc-tool 托管的技能
- * POST /api/skills/install-local
- * Body: { directory }
+ * 旧本地安装入口已被 Skill control plane 取代。
  */
 router.post('/install-local', (req, res) => {
-  try {
-    const { platform, service } = getSkillService(req);
-    const { directory } = req.body;
-
-    if (!directory) {
-      return res.status(400).json({ success: false, message: 'Missing directory' });
-    }
-
-    const result = service.installLocalSkill(directory);
-    res.json({ success: true, platform, ...result });
-  } catch (err) {
-    console.error('[Skills API] Install local skill error:', err);
-    sendApiError(res, err);
-  }
+  res.status(410).json({
+    success: false,
+    message: 'Skill installation is replaced by PUT /api/skills/toggle'
+  });
 });
 
 /**
@@ -247,10 +392,11 @@ router.post('/install-local', (req, res) => {
  * POST /api/skills/create
  * Body: { name, directory, description, content }
  */
-router.post('/create', (req, res) => {
+router.post('/create', async (req, res) => {
   try {
     const { platform, service } = getSkillService(req);
     const { name, directory, description, content } = req.body;
+    const options = await getScopeOptions(req.body);
 
     if (!directory) {
       return res.status(400).json({
@@ -273,12 +419,12 @@ router.post('/create', (req, res) => {
         message: '请输入技能内容'
       });
     }
-
-    const result = service.createCustomSkill({
+    const result = await service.createCustomSkill({
       name: name || directory,
       directory,
       description: description || '',
-      content
+      content,
+      ...options
     });
 
     res.json({
@@ -293,46 +439,13 @@ router.post('/create', (req, res) => {
 });
 
 /**
- * 卸载技能
- * POST /api/skills/uninstall
- * Body: { directory }
+ * 旧卸载入口已被 Skill toggle 取代。
  */
-router.post('/uninstall', async (req, res) => {
-  try {
-    const { platform, service } = getSkillService(req);
-    const { directory, scope } = req.body;
-
-    if (!directory) {
-      return res.status(400).json({
-        success: false,
-        message: 'Missing directory'
-      });
-    }
-
-    const cwd = await validateKnownProjectCwd(req.body.cwd);
-    if (scope && scope !== 'user' && scope !== 'project') {
-      throw new Error('Invalid scope: expected "user" or "project"');
-    }
-    if (scope === 'project' && !cwd) {
-      throw new Error('Project scope requires a valid cwd');
-    }
-    const options = {
-      ...(cwd ? { cwd } : {}),
-      ...(scope ? { scope } : {})
-    };
-    const result = platform === 'omp' && Object.keys(options).length > 0
-      ? service.uninstallSkill(directory, options)
-      : service.uninstallSkill(directory);
-
-    res.json({
-      success: true,
-      platform,
-      ...result
-    });
-  } catch (err) {
-    console.error('[Skills API] Uninstall skill error:', err);
-    sendApiError(res, err);
-  }
+router.post('/uninstall', (req, res) => {
+  res.status(410).json({
+    success: false,
+    message: 'Skill uninstallation is replaced by PUT /api/skills/toggle'
+  });
 });
 
 /**
@@ -508,10 +621,11 @@ router.put('/repos/:owner/:name/toggle', (req, res) => {
  * POST /api/skills/create-with-files
  * Body: { directory, files: [{path, content, isBase64?}] }
  */
-router.post('/create-with-files', (req, res) => {
+router.post('/create-with-files', async (req, res) => {
   try {
     const { platform, service } = getSkillService(req);
     const { directory, files } = req.body;
+    const options = await getScopeOptions(req.body);
 
     if (!directory) {
       return res.status(400).json({
@@ -535,7 +649,7 @@ router.post('/create-with-files', (req, res) => {
       });
     }
 
-    const result = service.createSkillWithFiles({ directory, files });
+    const result = await service.createSkillWithFiles({ directory, files, ...options });
 
     res.json({
       success: true,
@@ -552,12 +666,14 @@ router.post('/create-with-files', (req, res) => {
  * 获取技能文件列表
  * GET /api/skills/:directory/files
  */
-router.get('/:directory/files', (req, res) => {
+router.get('/:directory/files', async (req, res) => {
   try {
     const { platform, service } = getSkillService(req);
     const { directory } = req.params;
-    const files = service.getSkillFiles(directory);
-
+    const options = await getScopeOptions(req.query);
+    const files = Object.keys(options).length > 0
+      ? service.getSkillFiles(directory, options)
+      : service.getSkillFiles(directory);
     res.json({
       success: true,
       platform,
@@ -575,10 +691,11 @@ router.get('/:directory/files', (req, res) => {
  * GET /api/skills/:directory/files/:filePath
  * 注意：filePath 可能包含子目录，使用通配符
  */
-router.get('/:directory/file/*', (req, res) => {
+router.get('/:directory/file/*', async (req, res) => {
   try {
     const { platform, service } = getSkillService(req);
     const { directory } = req.params;
+    const options = await getScopeOptions(req.query);
     const filePath = req.params[0];
 
     if (!filePath) {
@@ -588,7 +705,9 @@ router.get('/:directory/file/*', (req, res) => {
       });
     }
 
-    const result = service.getSkillFileContent(directory, filePath);
+    const result = Object.keys(options).length > 0
+      ? service.getSkillFileContent(directory, filePath, options)
+      : service.getSkillFileContent(directory, filePath);
 
     res.json({
       success: true,
@@ -606,11 +725,12 @@ router.get('/:directory/file/*', (req, res) => {
  * POST /api/skills/:directory/files
  * Body: { files: [{path, content, isBase64?}] }
  */
-router.post('/:directory/files', (req, res) => {
+router.post('/:directory/files', async (req, res) => {
   try {
     const { platform, service } = getSkillService(req);
     const { directory } = req.params;
     const { files } = req.body;
+    const options = await getScopeOptions(req.body);
 
     if (!files || !Array.isArray(files) || files.length === 0) {
       return res.status(400).json({
@@ -619,7 +739,9 @@ router.post('/:directory/files', (req, res) => {
       });
     }
 
-    const result = service.addSkillFiles(directory, files);
+    const result = Object.keys(options).length > 0
+      ? service.addSkillFiles(directory, files, options)
+      : service.addSkillFiles(directory, files);
 
     res.json({
       success: true,
@@ -636,10 +758,11 @@ router.post('/:directory/files', (req, res) => {
  * 删除技能中的文件
  * DELETE /api/skills/:directory/file/*
  */
-router.delete('/:directory/file/*', (req, res) => {
+router.delete('/:directory/file/*', async (req, res) => {
   try {
     const { platform, service } = getSkillService(req);
     const { directory } = req.params;
+    const options = await getScopeOptions(req.query);
     const filePath = req.params[0];
 
     if (!filePath) {
@@ -649,7 +772,9 @@ router.delete('/:directory/file/*', (req, res) => {
       });
     }
 
-    const result = service.deleteSkillFile(directory, filePath);
+    const result = Object.keys(options).length > 0
+      ? service.deleteSkillFile(directory, filePath, options)
+      : service.deleteSkillFile(directory, filePath);
 
     res.json({
       success: true,
@@ -667,10 +792,11 @@ router.delete('/:directory/file/*', (req, res) => {
  * PUT /api/skills/:directory/file/*
  * Body: { content, isBase64? }
  */
-router.put('/:directory/file/*', (req, res) => {
+router.put('/:directory/file/*', async (req, res) => {
   try {
     const { platform, service } = getSkillService(req);
     const { directory } = req.params;
+    const options = await getScopeOptions(req.body);
     const filePath = req.params[0];
     const { content, isBase64 = false } = req.body;
 
@@ -688,7 +814,9 @@ router.put('/:directory/file/*', (req, res) => {
       });
     }
 
-    const result = service.updateSkillFile(directory, filePath, content, isBase64);
+    const result = Object.keys(options).length > 0
+      ? service.updateSkillFile(directory, filePath, content, isBase64, options)
+      : service.updateSkillFile(directory, filePath, content, isBase64);
 
     res.json({
       success: true,
@@ -701,4 +829,5 @@ router.put('/:directory/file/*', (req, res) => {
   }
 });
 
+router.createRouter = createRouter;
 module.exports = router;

package/src/server/api/ui-config.js

@@ -30,8 +30,8 @@ router.post('/', (req, res) => {
     if (!config) {
       return res.status(400).json({ error: 'Missing config' });
     }
-    saveUIConfig(config);
-    res.json({ success: true, config });
+    const normalizedConfig = saveUIConfig(config);
+    res.json({ success: true, config: normalizedConfig });
   } catch (error) {
     console.error('Error saving UI config:', error);
     res.status(500).json({ error: error.message });

package/src/server/api/validation-errors.js

@@ -11,7 +11,10 @@ const VALIDATION_ERROR_PATTERNS = [
   /required/i,
   /escapes/i,
   /not support/i,
-  /不支持/
+  /不支持/,
+  /symlink/i,
+  /string/i,
+  /MCP server ID/i,
 ];
 
 function isValidationError(error) {
@@ -20,12 +23,23 @@ function isValidationError(error) {
 }
 
 function sendApiError(res, error, fallbackStatus = 500, extra = {}) {
-  const status = isValidationError(error) ? 400 : fallbackStatus;
-  return res.status(status).json({
+  const status = ['not_found', 'unsupported'].includes(error?.code)
+    ? 404
+    : error?.code === 'invalid'
+      ? 400
+      : error?.code === 'failed'
+        ? 500
+        : (isValidationError(error) ? 400 : fallbackStatus);
+  const payload = {
     success: false,
     message: error?.message || String(error),
     ...extra
-  });
+  };
+  if (error?.code) payload.code = error.code;
+  if (error?.platform) payload.platform = error.platform;
+  if (error?.capability) payload.capability = error.capability;
+  if (error?.operation) payload.operation = error.operation;
+  return res.status(status).json(payload);
 }
 
 module.exports = {