cognova 0.2.0 → 0.2.3

package/server/api/skills/[name]/files/read.post.ts

@@ -0,0 +1,41 @@
+import { readFile, stat } from 'fs/promises'
+import { join, normalize } from 'path'
+import { getSkillsDir, getInactiveSkillsDir } from '~~/server/utils/skills-path'
+
+export default defineEventHandler(async (event) => {
+  const name = getRouterParam(event, 'name')
+  if (!name)
+    throw createError({ statusCode: 400, message: 'Skill name required' })
+
+  const body = await readBody<{ path: string }>(event)
+  if (!body?.path)
+    throw createError({ statusCode: 400, message: 'File path is required' })
+
+  const skillDir = await findSkillDir(name)
+  if (!skillDir)
+    throw createError({ statusCode: 404, message: `Skill '${name}' not found` })
+
+  // Prevent path traversal
+  const filePath = normalize(join(skillDir, body.path))
+  if (!filePath.startsWith(skillDir))
+    throw createError({ statusCode: 403, message: 'Path traversal not allowed' })
+
+  const fileStat = await stat(filePath).catch(() => null)
+  if (!fileStat?.isFile())
+    throw createError({ statusCode: 404, message: 'File not found' })
+
+  const content = await readFile(filePath, 'utf-8')
+  return { data: { path: body.path, content } }
+})
+
+async function findSkillDir(name: string): Promise<string | null> {
+  const activeDir = join(getSkillsDir(), name)
+  const activeStat = await stat(activeDir).catch(() => null)
+  if (activeStat?.isDirectory()) return activeDir
+
+  const inactiveDir = join(getInactiveSkillsDir(), name)
+  const inactiveStat = await stat(inactiveDir).catch(() => null)
+  if (inactiveStat?.isDirectory()) return inactiveDir
+
+  return null
+}

package/server/api/skills/[name]/files/write.post.ts

@@ -0,0 +1,42 @@
+import { writeFile, mkdir, stat } from 'fs/promises'
+import { join, normalize, dirname } from 'path'
+import { getSkillsDir, getInactiveSkillsDir } from '~~/server/utils/skills-path'
+
+export default defineEventHandler(async (event) => {
+  const name = getRouterParam(event, 'name')
+  if (!name)
+    throw createError({ statusCode: 400, message: 'Skill name required' })
+
+  const body = await readBody<{ path: string, content: string }>(event)
+  if (!body?.path)
+    throw createError({ statusCode: 400, message: 'File path is required' })
+  if (typeof body.content !== 'string')
+    throw createError({ statusCode: 400, message: 'Content is required' })
+
+  const skillDir = await findSkillDir(name)
+  if (!skillDir)
+    throw createError({ statusCode: 404, message: `Skill '${name}' not found` })
+
+  // Prevent path traversal
+  const filePath = normalize(join(skillDir, body.path))
+  if (!filePath.startsWith(skillDir))
+    throw createError({ statusCode: 403, message: 'Path traversal not allowed' })
+
+  // Ensure parent directory exists
+  await mkdir(dirname(filePath), { recursive: true })
+  await writeFile(filePath, body.content, 'utf-8')
+
+  return { data: { path: body.path, saved: true } }
+})
+
+async function findSkillDir(name: string): Promise<string | null> {
+  const activeDir = join(getSkillsDir(), name)
+  const activeStat = await stat(activeDir).catch(() => null)
+  if (activeStat?.isDirectory()) return activeDir
+
+  const inactiveDir = join(getInactiveSkillsDir(), name)
+  const inactiveStat = await stat(inactiveDir).catch(() => null)
+  if (inactiveStat?.isDirectory()) return inactiveDir
+
+  return null
+}

package/server/api/skills/[name]/index.get.ts

@@ -0,0 +1,54 @@
+import { readFile, stat } from 'fs/promises'
+import { join } from 'path'
+import { getSkillsDir, getInactiveSkillsDir, parseSkillFrontmatter, buildSkillFileTree, isCoreSkill } from '~~/server/utils/skills-path'
+import type { SkillDetail } from '~~/shared/types'
+
+export default defineEventHandler(async (event) => {
+  const name = getRouterParam(event, 'name')
+  if (!name)
+    throw createError({ statusCode: 400, message: 'Skill name required' })
+
+  // Check active first, then inactive
+  const activeDir = join(getSkillsDir(), name)
+  const inactiveDir = join(getInactiveSkillsDir(), name)
+
+  let skillDir = ''
+  let active = false
+
+  const activeStat = await stat(activeDir).catch(() => null)
+  if (activeStat?.isDirectory()) {
+    skillDir = activeDir
+    active = true
+  } else {
+    const inactiveStat = await stat(inactiveDir).catch(() => null)
+    if (inactiveStat?.isDirectory()) {
+      skillDir = inactiveDir
+      active = false
+    }
+  }
+
+  if (!skillDir)
+    throw createError({ statusCode: 404, message: `Skill '${name}' not found` })
+
+  const skillMdPath = join(skillDir, 'SKILL.md')
+  const content = await readFile(skillMdPath, 'utf-8').catch(() => '')
+  const meta = parseSkillFrontmatter(content)
+  const files = await buildSkillFileTree(skillDir)
+
+  const detail: SkillDetail = {
+    name: meta.name || name,
+    description: meta.description || '',
+    version: meta.version || '',
+    author: meta.author || '',
+    active,
+    core: isCoreSkill(name),
+    allowedTools: meta.allowedTools,
+    requiresSecrets: meta.requiresSecrets,
+    installedFrom: meta.installedFrom || '',
+    fileCount: files.filter(f => f.type === 'file').length,
+    meta,
+    files
+  }
+
+  return { data: detail }
+})

package/server/api/skills/[name]/rename.post.ts

@@ -0,0 +1,64 @@
+import { stat, rename, readFile, writeFile } from 'fs/promises'
+import { join } from 'path'
+import { getSkillsDir, getInactiveSkillsDir, isCoreSkill, validateSkillName } from '~~/server/utils/skills-path'
+
+export default defineEventHandler(async (event) => {
+  const name = getRouterParam(event, 'name')
+  if (!name)
+    throw createError({ statusCode: 400, message: 'Skill name required' })
+
+  if (isCoreSkill(name))
+    throw createError({ statusCode: 403, message: `'${name}' is a core skill and cannot be renamed` })
+
+  const body = await readBody<{ newName: string }>(event)
+  if (!body?.newName)
+    throw createError({ statusCode: 400, message: 'newName is required' })
+
+  const nameError = validateSkillName(body.newName)
+  if (nameError)
+    throw createError({ statusCode: 400, message: nameError })
+
+  // Find where the skill currently lives
+  const activeDir = join(getSkillsDir(), name)
+  const inactiveDir = join(getInactiveSkillsDir(), name)
+
+  let currentDir = ''
+  let baseDir = ''
+
+  const activeStat = await stat(activeDir).catch(() => null)
+  if (activeStat?.isDirectory()) {
+    currentDir = activeDir
+    baseDir = getSkillsDir()
+  } else {
+    const inactiveStat = await stat(inactiveDir).catch(() => null)
+    if (inactiveStat?.isDirectory()) {
+      currentDir = inactiveDir
+      baseDir = getInactiveSkillsDir()
+    }
+  }
+
+  if (!currentDir)
+    throw createError({ statusCode: 404, message: `Skill '${name}' not found` })
+
+  const newDir = join(baseDir, body.newName)
+  const newDirStat = await stat(newDir).catch(() => null)
+  if (newDirStat)
+    throw createError({ statusCode: 409, message: `Skill '${body.newName}' already exists` })
+
+  // Rename directory
+  await rename(currentDir, newDir)
+
+  // Update name in SKILL.md frontmatter if it exists
+  const skillMdPath = join(newDir, 'SKILL.md')
+  const content = await readFile(skillMdPath, 'utf-8').catch(() => '')
+  if (content) {
+    const updated = content.replace(
+      /^(name:\s*).+$/m,
+      `$1${body.newName}`
+    )
+    if (updated !== content)
+      await writeFile(skillMdPath, updated, 'utf-8')
+  }
+
+  return { data: { name: body.newName } }
+})

package/server/api/skills/[name]/toggle.post.ts

@@ -0,0 +1,32 @@
+import { stat, mkdir, rename } from 'fs/promises'
+import { join } from 'path'
+import { getSkillsDir, getInactiveSkillsDir, isCoreSkill } from '~~/server/utils/skills-path'
+
+export default defineEventHandler(async (event) => {
+  const name = getRouterParam(event, 'name')
+  if (!name)
+    throw createError({ statusCode: 400, message: 'Skill name required' })
+
+  if (isCoreSkill(name))
+    throw createError({ statusCode: 403, message: `'${name}' is a core skill and cannot be disabled` })
+
+  const activeDir = join(getSkillsDir(), name)
+  const inactiveDir = join(getInactiveSkillsDir(), name)
+
+  const activeStat = await stat(activeDir).catch(() => null)
+  if (activeStat?.isDirectory()) {
+    // Move active -> inactive
+    await mkdir(getInactiveSkillsDir(), { recursive: true })
+    await rename(activeDir, inactiveDir)
+    return { data: { name, active: false } }
+  }
+
+  const inactiveStat = await stat(inactiveDir).catch(() => null)
+  if (inactiveStat?.isDirectory()) {
+    // Move inactive -> active
+    await rename(inactiveDir, activeDir)
+    return { data: { name, active: true } }
+  }
+
+  throw createError({ statusCode: 404, message: `Skill '${name}' not found` })
+})

package/server/api/skills/create.post.ts

@@ -0,0 +1,51 @@
+import { mkdir, writeFile, stat } from 'fs/promises'
+import { join } from 'path'
+import { getSkillsDir, validateSkillName } from '~~/server/utils/skills-path'
+
+export default defineEventHandler(async (event) => {
+  const body = await readBody<{ name: string, description?: string }>(event)
+  if (!body?.name)
+    throw createError({ statusCode: 400, message: 'Skill name is required' })
+
+  const nameError = validateSkillName(body.name)
+  if (nameError)
+    throw createError({ statusCode: 400, message: nameError })
+
+  const skillDir = join(getSkillsDir(), body.name)
+
+  // Check if already exists
+  const existing = await stat(skillDir).catch(() => null)
+  if (existing)
+    throw createError({ statusCode: 409, message: `Skill '${body.name}' already exists` })
+
+  await mkdir(skillDir, { recursive: true })
+
+  const description = body.description || `Description for ${body.name}`
+
+  const skillMd = `---
+name: ${body.name}
+description: ${description}
+allowed-tools: Bash, Read
+metadata:
+  version: "1.0.0"
+  requires-secrets: []
+  author: ""
+  repository: ""
+  installed-from: ""
+---
+
+# ${body.name}
+
+${description}
+
+## Commands
+
+\`\`\`bash
+python3 ~/.claude/skills/${body.name}/${body.name}.py <command>
+\`\`\`
+`
+
+  await writeFile(join(skillDir, 'SKILL.md'), skillMd, 'utf-8')
+
+  return { data: { name: body.name, path: skillDir } }
+})

package/server/api/skills/generate.post.ts

@@ -0,0 +1,126 @@
+import { mkdir, readdir, rm, stat } from 'fs/promises'
+import { join } from 'path'
+import { query } from '@anthropic-ai/claude-agent-sdk'
+import { getInactiveSkillsDir, validateSkillName } from '~~/server/utils/skills-path'
+import { logTokenUsage } from '~~/server/utils/log-token-usage'
+
+export default defineEventHandler(async (event) => {
+  const body = await readBody<{ name: string, description: string }>(event)
+  if (!body?.name || !body?.description)
+    throw createError({ statusCode: 400, message: 'name and description are required' })
+
+  const nameError = validateSkillName(body.name)
+  if (nameError)
+    throw createError({ statusCode: 400, message: nameError })
+
+  // Create in inactive-skills so user can review before enabling
+  const skillDir = join(getInactiveSkillsDir(), body.name)
+
+  const existing = await stat(skillDir).catch(() => null)
+  if (existing)
+    throw createError({ statusCode: 409, message: `Skill '${body.name}' already exists` })
+
+  await mkdir(skillDir, { recursive: true })
+
+  const appendInstructions = `You are creating a Claude Code skill called "${body.name}".
+Description: ${body.description}
+
+Use the Write tool to create files in the current directory. You MUST create:
+1. SKILL.md with proper frontmatter (name, description, allowed-tools, metadata with version/requires-secrets/author)
+2. A Python script if the skill needs to call APIs or run logic
+
+CRITICAL RULES:
+- Use the Write tool to create each file
+- NEVER hardcode API keys, tokens, or secrets. Use get_secret() from the shared library.
+- If the skill needs external API keys, list them in metadata.requires-secrets
+- Import the shared client: sys.path.insert(0, str(Path(__file__).parent.parent)); from _lib.api import get, post, get_secret
+- Use argparse for CLI interface
+- Follow existing skill patterns (task.py, memory.py, etc.)
+
+SKILL.md frontmatter format:
+---
+name: ${body.name}
+description: ${body.description}
+allowed-tools: Bash, Read
+metadata:
+  version: "1.0.0"
+  requires-secrets: []
+  author: ""
+  repository: ""
+  installed-from: ""
+---`
+
+  const startTime = Date.now()
+  let totalInput = 0
+  let totalOutput = 0
+  let totalCost = 0
+  let turns = 0
+
+  try {
+    const conversation = query({
+      prompt: `Create the "${body.name}" skill: ${body.description}`,
+      options: {
+        systemPrompt: {
+          type: 'preset',
+          preset: 'claude_code',
+          append: appendInstructions
+        },
+        cwd: skillDir,
+        settingSources: ['user'],
+        permissionMode: 'bypassPermissions',
+        allowDangerouslySkipPermissions: true,
+        maxTurns: 30
+      }
+    })
+
+    for await (const event of conversation) {
+      if (event.type === 'result') {
+        // Cast to access usage fields the SDK provides but aren't in the TS types
+        const msg = event as unknown as {
+          total_cost_usd: number
+          num_turns: number
+          usage: { input_tokens: number, output_tokens: number }
+        }
+        totalInput = msg.usage?.input_tokens || 0
+        totalOutput = msg.usage?.output_tokens || 0
+        totalCost = msg.total_cost_usd || 0
+        turns = msg.num_turns || 0
+      }
+    }
+  } catch (e) {
+    console.error('[skills/generate] SDK error:', e)
+    // Clean up empty directory on failure
+    await rm(skillDir, { recursive: true }).catch(() => {})
+    throw createError({ statusCode: 500, message: 'Skill generation failed' })
+  }
+
+  // Verify files were actually created
+  const files = await readdir(skillDir).catch(() => [])
+  if (files.length === 0) {
+    await rm(skillDir, { recursive: true }).catch(() => {})
+    throw createError({ statusCode: 500, message: 'Skill generation produced no files' })
+  }
+
+  const durationMs = Date.now() - startTime
+
+  // Log token usage
+  await logTokenUsage({
+    source: 'agent',
+    sourceName: 'Skill Generator',
+    inputTokens: totalInput,
+    outputTokens: totalOutput,
+    costUsd: totalCost,
+    durationMs,
+    numTurns: turns
+  })
+
+  return {
+    data: {
+      name: body.name,
+      path: skillDir,
+      active: false,
+      costUsd: totalCost,
+      durationMs
+    }
+  }
+})

package/server/api/skills/import.post.ts

@@ -0,0 +1,87 @@
+import { stat, mkdir, writeFile } from 'fs/promises'
+import { join, normalize } from 'path'
+import AdmZip from 'adm-zip'
+import { getSkillsDir, getInactiveSkillsDir, validateSkillName } from '~~/server/utils/skills-path'
+
+export default defineEventHandler(async (event) => {
+  const form = await readMultipartFormData(event)
+  if (!form)
+    throw createError({ statusCode: 400, message: 'Multipart form data required' })
+
+  const fileField = form.find(f => f.name === 'file')
+  if (!fileField?.data)
+    throw createError({ statusCode: 400, message: 'No file uploaded' })
+
+  const zip = new AdmZip(Buffer.from(fileField.data))
+  const entries = zip.getEntries()
+
+  if (entries.length === 0)
+    throw createError({ statusCode: 400, message: 'Zip file is empty' })
+
+  // Determine skill name from root folder or filename
+  const firstEntry = entries[0].entryName
+  const rootFolder = firstEntry.includes('/') ? firstEntry.split('/')[0] : null
+  const fileName = fileField.filename?.replace(/\.zip$/i, '') || ''
+  const skillName = rootFolder || fileName
+
+  if (!skillName)
+    throw createError({ statusCode: 400, message: 'Could not determine skill name from zip' })
+
+  const nameError = validateSkillName(skillName)
+  if (nameError)
+    throw createError({ statusCode: 400, message: `Invalid skill name: ${nameError}` })
+
+  // Check skill doesn't already exist
+  const activeDir = join(getSkillsDir(), skillName)
+  const inactiveDir = join(getInactiveSkillsDir(), skillName)
+
+  const activeExists = await stat(activeDir).catch(() => null)
+  const inactiveExists = await stat(inactiveDir).catch(() => null)
+
+  if (activeExists || inactiveExists)
+    throw createError({ statusCode: 409, message: `Skill '${skillName}' already exists` })
+
+  // Validate zip contains SKILL.md
+  const hasSkillMd = entries.some((e) => {
+    const parts = e.entryName.split('/')
+    // SKILL.md at root or inside one-level folder
+    return parts[parts.length - 1] === 'SKILL.md'
+      || (parts.length === 2 && parts[1] === 'SKILL.md')
+  })
+  if (!hasSkillMd)
+    throw createError({ statusCode: 400, message: 'Zip must contain a SKILL.md file' })
+
+  // Extract to skills dir with path traversal protection
+  const targetDir = activeDir
+  await mkdir(targetDir, { recursive: true })
+
+  let fileCount = 0
+  for (const entry of entries) {
+    if (entry.isDirectory) continue
+
+    // Strip root folder prefix if present
+    let relativePath = entry.entryName
+    if (rootFolder && relativePath.startsWith(rootFolder + '/'))
+      relativePath = relativePath.slice(rootFolder.length + 1)
+
+    if (!relativePath) continue
+
+    // Skip __pycache__ and .pyc files
+    if (relativePath.includes('__pycache__') || relativePath.endsWith('.pyc'))
+      continue
+
+    // Path traversal check
+    const fullPath = normalize(join(targetDir, relativePath))
+    if (!fullPath.startsWith(targetDir))
+      throw createError({ statusCode: 400, message: 'Path traversal detected in zip entry' })
+
+    // Ensure parent directory exists
+    const parentDir = join(fullPath, '..')
+    await mkdir(parentDir, { recursive: true })
+
+    await writeFile(fullPath, entry.getData())
+    fileCount++
+  }
+
+  return { data: { name: skillName, fileCount } }
+})

package/server/api/skills/index.get.ts

@@ -0,0 +1,57 @@
+import { readdir, readFile, stat } from 'fs/promises'
+import { join } from 'path'
+import { getSkillsDir, getInactiveSkillsDir, parseSkillFrontmatter, isCoreSkill } from '~~/server/utils/skills-path'
+import type { SkillListItem } from '~~/shared/types'
+
+export default defineEventHandler(async () => {
+  const skills: SkillListItem[] = []
+
+  // Scan active skills
+  await scanDir(getSkillsDir(), true, skills)
+
+  // Scan inactive skills
+  await scanDir(getInactiveSkillsDir(), false, skills)
+
+  // Sort: core first, then alphabetical
+  skills.sort((a, b) => {
+    if (a.core !== b.core) return a.core ? -1 : 1
+    return a.name.localeCompare(b.name)
+  })
+
+  return { data: skills }
+})
+
+async function scanDir(dir: string, active: boolean, skills: SkillListItem[]): Promise<void> {
+  const entries = await readdir(dir).catch(() => [])
+
+  for (const entry of entries) {
+    // Skip _lib and hidden dirs
+    if (entry.startsWith('_') || entry.startsWith('.'))
+      continue
+
+    const skillDir = join(dir, entry)
+    const stats = await stat(skillDir).catch(() => null)
+    if (!stats?.isDirectory()) continue
+
+    const skillMdPath = join(skillDir, 'SKILL.md')
+    const content = await readFile(skillMdPath, 'utf-8').catch(() => '')
+    const meta = parseSkillFrontmatter(content)
+
+    // Count files (excluding __pycache__)
+    const files = await readdir(skillDir).catch(() => [])
+    const fileCount = files.filter(f => f !== '__pycache__' && !f.endsWith('.pyc')).length
+
+    skills.push({
+      name: meta.name || entry,
+      description: meta.description || '',
+      version: meta.version || '',
+      author: meta.author || '',
+      active,
+      core: isCoreSkill(entry),
+      allowedTools: meta.allowedTools,
+      requiresSecrets: meta.requiresSecrets,
+      installedFrom: meta.installedFrom || '',
+      fileCount
+    })
+  }
+}

package/server/api/skills/library/check-updates.get.ts

@@ -0,0 +1,46 @@
+import { readFile, readdir, stat } from 'fs/promises'
+import { join } from 'path'
+import { getDb } from '~~/server/db'
+import { getSkillsDir, getInactiveSkillsDir, parseSkillFrontmatter } from '~~/server/utils/skills-path'
+
+export default defineEventHandler(async () => {
+  const db = getDb()
+  const catalogItems = await db.query.skillsCatalog.findMany()
+
+  if (catalogItems.length === 0)
+    return { data: { updates: [] } }
+
+  const catalogByName = new Map(catalogItems.map(c => [c.name, c]))
+  const updates: { name: string, installed: string, latest: string }[] = []
+
+  // Scan both active and inactive skill dirs
+  for (const dir of [getSkillsDir(), getInactiveSkillsDir()]) {
+    const dirStat = await stat(dir).catch(() => null)
+    if (!dirStat) continue
+
+    const entries = await readdir(dir, { withFileTypes: true })
+    for (const entry of entries) {
+      if (!entry.isDirectory()) continue
+
+      const skillMdPath = join(dir, entry.name, 'SKILL.md')
+      const content = await readFile(skillMdPath, 'utf-8').catch(() => '')
+      if (!content) continue
+
+      const meta = parseSkillFrontmatter(content)
+      if (!meta.installedFrom) continue
+
+      const catalogEntry = catalogByName.get(entry.name)
+      if (!catalogEntry) continue
+
+      if (meta.version && meta.version !== catalogEntry.version) {
+        updates.push({
+          name: entry.name,
+          installed: meta.version,
+          latest: catalogEntry.version
+        })
+      }
+    }
+  }
+
+  return { data: { updates } }
+})

package/server/api/skills/library/index.get.ts

@@ -0,0 +1,56 @@
+import { readFile, stat } from 'fs/promises'
+import { join } from 'path'
+import { getDb } from '~~/server/db'
+import { getSkillsDir, getInactiveSkillsDir, parseSkillFrontmatter } from '~~/server/utils/skills-path'
+
+export default defineEventHandler(async () => {
+  const db = getDb()
+  const catalogItems = await db.query.skillsCatalog.findMany()
+
+  // Check which skills are already installed
+  const skillsDir = getSkillsDir()
+  const inactiveDir = getInactiveSkillsDir()
+
+  const items = await Promise.all(catalogItems.map(async (item) => {
+    const activePath = join(skillsDir, item.name, 'SKILL.md')
+    const inactivePath = join(inactiveDir, item.name, 'SKILL.md')
+
+    let installed = false
+    let installedVersion: string | undefined
+
+    // Check active skills
+    const activeStat = await stat(activePath).catch(() => null)
+    if (activeStat) {
+      installed = true
+      const content = await readFile(activePath, 'utf-8').catch(() => '')
+      const meta = parseSkillFrontmatter(content)
+      installedVersion = meta.version
+    } else {
+      // Check inactive skills
+      const inactiveStat = await stat(inactivePath).catch(() => null)
+      if (inactiveStat) {
+        installed = true
+        const content = await readFile(inactivePath, 'utf-8').catch(() => '')
+        const meta = parseSkillFrontmatter(content)
+        installedVersion = meta.version
+      }
+    }
+
+    return {
+      id: item.id,
+      name: item.name,
+      description: item.description,
+      version: item.version,
+      author: item.author,
+      tags: item.tags || [],
+      requiresSecrets: item.requiresSecrets || [],
+      files: item.files || [],
+      updatedAt: item.updatedAt.toISOString(),
+      installed,
+      installedVersion,
+      hasUpdate: installed && installedVersion ? installedVersion !== item.version : false
+    }
+  }))
+
+  return { data: items }
+})