cowork-os 0.3.21

package/dist/electron/electron/agent/skill-eligibility.js

@@ -0,0 +1,281 @@
+"use strict";
+/**
+ * Skill Eligibility Checker
+ *
+ * Determines if a skill is eligible to run based on its requirements:
+ * - Required binaries (bins)
+ * - Any-of binaries (anyBins)
+ * - Environment variables (env)
+ * - Config paths (config)
+ * - Operating system (os)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SkillEligibilityChecker = void 0;
+exports.getSkillEligibilityChecker = getSkillEligibilityChecker;
+const child_process_1 = require("child_process");
+const util_1 = require("util");
+const execAsync = (0, util_1.promisify)(child_process_1.exec);
+// Regex for valid binary names: alphanumeric, hyphens, underscores, dots
+// This prevents command injection via malicious binary names
+const VALID_BINARY_NAME = /^[a-zA-Z0-9._-]+$/;
+/**
+ * Validate and sanitize a binary name to prevent command injection
+ * Returns null if the binary name is invalid/unsafe
+ */
+function sanitizeBinaryName(bin) {
+    if (!bin || typeof bin !== 'string') {
+        return null;
+    }
+    // Trim whitespace
+    const trimmed = bin.trim();
+    // Check length limits (reasonable binary name length)
+    if (trimmed.length === 0 || trimmed.length > 256) {
+        return null;
+    }
+    // Validate against allowed pattern
+    if (!VALID_BINARY_NAME.test(trimmed)) {
+        console.warn(`[SkillEligibilityChecker] Invalid binary name rejected: ${bin}`);
+        return null;
+    }
+    return trimmed;
+}
+class SkillEligibilityChecker {
+    constructor(config) {
+        this.binCache = new Map();
+        this.config = config;
+    }
+    /**
+     * Check if a binary exists in PATH
+     */
+    async checkBinary(bin) {
+        // Sanitize binary name to prevent command injection
+        const safeBin = sanitizeBinaryName(bin);
+        if (!safeBin) {
+            // Invalid binary name - treat as not found
+            return false;
+        }
+        // Check cache first
+        if (this.binCache.has(safeBin)) {
+            return this.binCache.get(safeBin);
+        }
+        try {
+            // Use 'which' on Unix-like systems, 'where' on Windows
+            const command = process.platform === 'win32' ? `where ${safeBin}` : `which ${safeBin}`;
+            await execAsync(command);
+            this.binCache.set(safeBin, true);
+            return true;
+        }
+        catch {
+            this.binCache.set(safeBin, false);
+            return false;
+        }
+    }
+    /**
+     * Check if all specified binaries exist
+     */
+    async checkAllBinaries(bins) {
+        const results = await Promise.all(bins.map(async (bin) => ({
+            bin,
+            exists: await this.checkBinary(bin),
+        })));
+        return {
+            found: results.filter((r) => r.exists).map((r) => r.bin),
+            missing: results.filter((r) => !r.exists).map((r) => r.bin),
+        };
+    }
+    /**
+     * Check if at least one of the specified binaries exists
+     */
+    async checkAnyBinary(bins) {
+        const results = await Promise.all(bins.map(async (bin) => ({
+            bin,
+            exists: await this.checkBinary(bin),
+        })));
+        const found = results.filter((r) => r.exists).map((r) => r.bin);
+        // If any binary is found, none are "missing" for anyBins requirement
+        // If none are found, all are missing
+        const missing = found.length > 0 ? [] : bins;
+        return { found, missing };
+    }
+    /**
+     * Check if an environment variable is set
+     */
+    checkEnvVar(envVar) {
+        const value = process.env[envVar];
+        return value !== undefined && value !== '';
+    }
+    /**
+     * Check if all specified environment variables are set
+     */
+    checkAllEnvVars(envVars) {
+        const found = [];
+        const missing = [];
+        for (const envVar of envVars) {
+            if (this.checkEnvVar(envVar)) {
+                found.push(envVar);
+            }
+            else {
+                missing.push(envVar);
+            }
+        }
+        return { found, missing };
+    }
+    /**
+     * Check if config path is truthy (placeholder for future config system)
+     */
+    checkConfigPath(configPath) {
+        // TODO: Implement config path checking when config system is available
+        // For now, always return false (missing)
+        return false;
+    }
+    /**
+     * Check if all specified config paths are truthy
+     */
+    checkAllConfigPaths(configPaths) {
+        const found = [];
+        const missing = [];
+        for (const configPath of configPaths) {
+            if (this.checkConfigPath(configPath)) {
+                found.push(configPath);
+            }
+            else {
+                missing.push(configPath);
+            }
+        }
+        return { found, missing };
+    }
+    /**
+     * Check if current OS matches required OS
+     */
+    checkOS(requiredOS) {
+        const current = process.platform;
+        const matches = requiredOS.length === 0 || requiredOS.includes(current);
+        return {
+            matches,
+            current,
+            missing: matches ? [] : requiredOS,
+        };
+    }
+    /**
+     * Check if a skill is blocked by allowlist/denylist
+     */
+    isBlockedByList(skillId) {
+        if (!this.config)
+            return false;
+        // Check denylist first
+        if (this.config.denylist?.includes(skillId)) {
+            return true;
+        }
+        // Check allowlist (if set, skill must be in it)
+        if (this.config.allowlist && this.config.allowlist.length > 0) {
+            return !this.config.allowlist.includes(skillId);
+        }
+        return false;
+    }
+    /**
+     * Check all requirements for a skill and return eligibility status
+     */
+    async checkEligibility(skill) {
+        const missing = {
+            bins: [],
+            anyBins: [],
+            env: [],
+            config: [],
+            os: [],
+        };
+        const requires = skill.requires;
+        // Check required binaries
+        if (requires?.bins && requires.bins.length > 0) {
+            const binCheck = await this.checkAllBinaries(requires.bins);
+            missing.bins = binCheck.missing;
+        }
+        // Check any-of binaries
+        if (requires?.anyBins && requires.anyBins.length > 0) {
+            const anyBinCheck = await this.checkAnyBinary(requires.anyBins);
+            missing.anyBins = anyBinCheck.missing;
+        }
+        // Check environment variables
+        if (requires?.env && requires.env.length > 0) {
+            const envCheck = this.checkAllEnvVars(requires.env);
+            missing.env = envCheck.missing;
+        }
+        // Check config paths
+        if (requires?.config && requires.config.length > 0) {
+            const configCheck = this.checkAllConfigPaths(requires.config);
+            missing.config = configCheck.missing;
+        }
+        // Check OS
+        if (requires?.os && requires.os.length > 0) {
+            const osCheck = this.checkOS(requires.os);
+            missing.os = osCheck.missing;
+        }
+        // Check if skill is disabled
+        const disabled = skill.enabled === false;
+        // Check if blocked by allowlist/denylist
+        const blockedByAllowlist = this.isBlockedByList(skill.id);
+        // Skill is eligible if not disabled, not blocked, and no missing requirements
+        const hasMissingRequirements = missing.bins.length > 0 ||
+            missing.anyBins.length > 0 ||
+            missing.env.length > 0 ||
+            missing.config.length > 0 ||
+            missing.os.length > 0;
+        const eligible = !disabled && !blockedByAllowlist && !hasMissingRequirements;
+        return {
+            eligible,
+            disabled,
+            blockedByAllowlist,
+            missing,
+        };
+    }
+    /**
+     * Build a full status entry for a skill
+     */
+    async buildStatusEntry(skill) {
+        const eligibility = await this.checkEligibility(skill);
+        const requires = skill.requires || {};
+        return {
+            ...skill,
+            eligible: eligibility.eligible,
+            disabled: eligibility.disabled,
+            blockedByAllowlist: eligibility.blockedByAllowlist,
+            requirements: {
+                bins: requires.bins || [],
+                anyBins: requires.anyBins || [],
+                env: requires.env || [],
+                config: requires.config || [],
+                os: requires.os || [],
+            },
+            missing: eligibility.missing,
+        };
+    }
+    /**
+     * Build status entries for multiple skills
+     */
+    async buildStatusEntries(skills) {
+        return Promise.all(skills.map((skill) => this.buildStatusEntry(skill)));
+    }
+    /**
+     * Clear the binary cache (useful after installations)
+     */
+    clearCache() {
+        this.binCache.clear();
+    }
+    /**
+     * Update config (for allowlist/denylist changes)
+     */
+    updateConfig(config) {
+        this.config = config;
+    }
+}
+exports.SkillEligibilityChecker = SkillEligibilityChecker;
+// Singleton instance
+let instance = null;
+function getSkillEligibilityChecker(config) {
+    if (!instance) {
+        instance = new SkillEligibilityChecker(config);
+    }
+    else if (config) {
+        instance.updateConfig(config);
+    }
+    return instance;
+}

package/dist/electron/electron/agent/skill-registry.js

@@ -0,0 +1,396 @@
+"use strict";
+/**
+ * Skill Registry Service
+ *
+ * Handles communication with the remote skill registry for:
+ * - Searching skills
+ * - Installing skills
+ * - Updating skills
+ * - Publishing skills (future)
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SkillRegistry = void 0;
+exports.getSkillRegistry = getSkillRegistry;
+exports.resetSkillRegistry = resetSkillRegistry;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const electron_1 = require("electron");
+// Default registry URL - can be overridden via SKILLHUB_REGISTRY env var
+const DEFAULT_REGISTRY_URL = process.env.SKILLHUB_REGISTRY || 'https://skill-hub.com/api';
+const SKILLS_FOLDER_NAME = 'skills';
+// Regex for valid skill IDs: lowercase alphanumeric, hyphens, underscores
+// This prevents path traversal attacks via malicious skill IDs
+const VALID_SKILL_ID = /^[a-z0-9_-]+$/;
+/**
+ * Validate and sanitize a skill ID to prevent path traversal
+ * Returns null if the skill ID is invalid/unsafe
+ */
+function sanitizeSkillId(skillId) {
+    if (!skillId || typeof skillId !== 'string') {
+        return null;
+    }
+    // Trim whitespace and convert to lowercase
+    const normalized = skillId.trim().toLowerCase();
+    // Check length limits
+    if (normalized.length === 0 || normalized.length > 128) {
+        return null;
+    }
+    // Reject path traversal attempts
+    if (normalized.includes('..') || normalized.includes('/') || normalized.includes('\\')) {
+        console.warn(`[SkillRegistry] Path traversal attempt rejected: ${skillId}`);
+        return null;
+    }
+    // Validate against allowed pattern
+    if (!VALID_SKILL_ID.test(normalized)) {
+        console.warn(`[SkillRegistry] Invalid skill ID rejected: ${skillId}`);
+        return null;
+    }
+    return normalized;
+}
+class SkillRegistry {
+    constructor(config) {
+        this.registryUrl = config?.registryUrl || DEFAULT_REGISTRY_URL;
+        this.managedSkillsDir =
+            config?.managedSkillsDir ||
+                path.join(electron_1.app.getPath('userData'), SKILLS_FOLDER_NAME);
+        // Ensure managed skills directory exists
+        this.ensureSkillsDirectory();
+    }
+    /**
+     * Ensure the managed skills directory exists
+     */
+    ensureSkillsDirectory() {
+        if (!fs.existsSync(this.managedSkillsDir)) {
+            fs.mkdirSync(this.managedSkillsDir, { recursive: true });
+            console.log(`[SkillRegistry] Created managed skills directory: ${this.managedSkillsDir}`);
+        }
+    }
+    /**
+     * Get the managed skills directory path
+     */
+    getManagedSkillsDir() {
+        return this.managedSkillsDir;
+    }
+    /**
+     * Search the registry for skills
+     */
+    async search(query, options) {
+        const page = options?.page ?? 1;
+        const pageSize = options?.pageSize ?? 20;
+        try {
+            const url = new URL(`${this.registryUrl}/skills/search`);
+            url.searchParams.set('q', query);
+            url.searchParams.set('page', String(page));
+            url.searchParams.set('pageSize', String(pageSize));
+            const response = await fetch(url.toString());
+            if (!response.ok) {
+                throw new Error(`Registry search failed: ${response.status} ${response.statusText}`);
+            }
+            const data = await response.json();
+            return data;
+        }
+        catch (error) {
+            console.error('[SkillRegistry] Search failed:', error);
+            // Return empty result on error
+            return {
+                query,
+                total: 0,
+                page,
+                pageSize,
+                results: [],
+            };
+        }
+    }
+    /**
+     * Get skill details from registry
+     */
+    async getSkillDetails(skillId) {
+        // Validate skill ID
+        const safeId = sanitizeSkillId(skillId);
+        if (!safeId) {
+            console.error(`[SkillRegistry] Invalid skill ID: ${skillId}`);
+            return null;
+        }
+        try {
+            const response = await fetch(`${this.registryUrl}/skills/${safeId}`);
+            if (!response.ok) {
+                if (response.status === 404) {
+                    return null;
+                }
+                throw new Error(`Failed to get skill details: ${response.status}`);
+            }
+            return (await response.json());
+        }
+        catch (error) {
+            console.error(`[SkillRegistry] Failed to get skill ${skillId}:`, error);
+            return null;
+        }
+    }
+    /**
+     * Install a skill from the registry
+     */
+    async install(skillId, version, onProgress) {
+        // Validate skill ID before any operations
+        const safeId = sanitizeSkillId(skillId);
+        if (!safeId) {
+            return { success: false, error: `Invalid skill ID: ${skillId}` };
+        }
+        const notify = (progress) => {
+            onProgress?.({
+                skillId: safeId,
+                status: 'downloading',
+                ...progress,
+            });
+        };
+        try {
+            notify({ status: 'downloading', progress: 0, message: 'Fetching skill from registry...' });
+            // Fetch skill data from registry
+            const url = version
+                ? `${this.registryUrl}/skills/${safeId}/download?version=${version}`
+                : `${this.registryUrl}/skills/${safeId}/download`;
+            const response = await fetch(url);
+            if (!response.ok) {
+                throw new Error(`Failed to download skill: ${response.status} ${response.statusText}`);
+            }
+            notify({ status: 'downloading', progress: 50, message: 'Downloading skill data...' });
+            const skillData = await response.json();
+            notify({ status: 'extracting', progress: 70, message: 'Processing skill...' });
+            // Validate skill data
+            if (!this.validateSkillData(skillData)) {
+                throw new Error('Invalid skill data received from registry');
+            }
+            notify({ status: 'installing', progress: 80, message: 'Installing skill...' });
+            // Save skill to managed skills directory (using validated safeId)
+            const skillPath = path.join(this.managedSkillsDir, `${safeId}.json`);
+            const skill = {
+                ...skillData,
+                source: 'managed',
+                filePath: skillPath,
+            };
+            fs.writeFileSync(skillPath, JSON.stringify(skill, null, 2), 'utf-8');
+            notify({ status: 'completed', progress: 100, message: 'Skill installed successfully' });
+            console.log(`[SkillRegistry] Installed skill: ${safeId} at ${skillPath}`);
+            return { success: true, skill };
+        }
+        catch (error) {
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            console.error(`[SkillRegistry] Install failed for ${safeId}:`, errorMessage);
+            notify({ status: 'failed', progress: 0, message: errorMessage, error: errorMessage });
+            return { success: false, error: errorMessage };
+        }
+    }
+    /**
+     * Update a managed skill to the latest version
+     */
+    async update(skillId, version, onProgress) {
+        // Validate skill ID
+        const safeId = sanitizeSkillId(skillId);
+        if (!safeId) {
+            return { success: false, error: `Invalid skill ID: ${skillId}` };
+        }
+        // Check if skill is installed
+        const skillPath = path.join(this.managedSkillsDir, `${safeId}.json`);
+        if (!fs.existsSync(skillPath)) {
+            return { success: false, error: `Skill ${safeId} is not installed` };
+        }
+        // Re-install with latest version
+        return this.install(safeId, version, onProgress);
+    }
+    /**
+     * Update all managed skills
+     */
+    async updateAll(onProgress) {
+        const updated = [];
+        const failed = [];
+        const managedSkills = this.listManagedSkills();
+        for (const skill of managedSkills) {
+            const result = await this.update(skill.id, undefined, (progress) => {
+                onProgress?.(skill.id, progress);
+            });
+            if (result.success) {
+                updated.push(skill.id);
+            }
+            else {
+                failed.push(skill.id);
+            }
+        }
+        return { updated, failed };
+    }
+    /**
+     * Uninstall a managed skill
+     */
+    uninstall(skillId) {
+        // Validate skill ID
+        const safeId = sanitizeSkillId(skillId);
+        if (!safeId) {
+            return { success: false, error: `Invalid skill ID: ${skillId}` };
+        }
+        const skillPath = path.join(this.managedSkillsDir, `${safeId}.json`);
+        if (!fs.existsSync(skillPath)) {
+            return { success: false, error: `Skill ${safeId} is not installed` };
+        }
+        try {
+            fs.unlinkSync(skillPath);
+            console.log(`[SkillRegistry] Uninstalled skill: ${safeId}`);
+            return { success: true };
+        }
+        catch (error) {
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            console.error(`[SkillRegistry] Uninstall failed for ${safeId}:`, errorMessage);
+            return { success: false, error: errorMessage };
+        }
+    }
+    /**
+     * List all managed (installed from registry) skills
+     */
+    listManagedSkills() {
+        const skills = [];
+        if (!fs.existsSync(this.managedSkillsDir)) {
+            return skills;
+        }
+        const files = fs.readdirSync(this.managedSkillsDir);
+        for (const file of files) {
+            if (!file.endsWith('.json'))
+                continue;
+            try {
+                const filePath = path.join(this.managedSkillsDir, file);
+                const content = fs.readFileSync(filePath, 'utf-8');
+                const skill = JSON.parse(content);
+                skill.filePath = filePath;
+                skill.source = 'managed';
+                skills.push(skill);
+            }
+            catch (error) {
+                console.error(`[SkillRegistry] Failed to load managed skill ${file}:`, error);
+            }
+        }
+        return skills;
+    }
+    /**
+     * Check if a skill is installed
+     */
+    isInstalled(skillId) {
+        // Validate skill ID
+        const safeId = sanitizeSkillId(skillId);
+        if (!safeId) {
+            return false;
+        }
+        const skillPath = path.join(this.managedSkillsDir, `${safeId}.json`);
+        return fs.existsSync(skillPath);
+    }
+    /**
+     * Get installed skill version
+     */
+    getInstalledVersion(skillId) {
+        // Validate skill ID
+        const safeId = sanitizeSkillId(skillId);
+        if (!safeId) {
+            return null;
+        }
+        const skillPath = path.join(this.managedSkillsDir, `${safeId}.json`);
+        if (!fs.existsSync(skillPath)) {
+            return null;
+        }
+        try {
+            const content = fs.readFileSync(skillPath, 'utf-8');
+            const skill = JSON.parse(content);
+            return skill.metadata?.version || null;
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Check for available updates
+     */
+    async checkForUpdates(skillId) {
+        // Validate skill ID (getInstalledVersion and getSkillDetails also validate, but check early)
+        const safeId = sanitizeSkillId(skillId);
+        if (!safeId) {
+            return { hasUpdate: false, currentVersion: null, latestVersion: null };
+        }
+        const currentVersion = this.getInstalledVersion(safeId);
+        const details = await this.getSkillDetails(safeId);
+        if (!details) {
+            return { hasUpdate: false, currentVersion, latestVersion: null };
+        }
+        const hasUpdate = currentVersion !== details.version;
+        return {
+            hasUpdate,
+            currentVersion,
+            latestVersion: details.version,
+        };
+    }
+    /**
+     * Validate skill data from registry
+     */
+    validateSkillData(data) {
+        if (!data || typeof data !== 'object')
+            return false;
+        const skill = data;
+        return (typeof skill.id === 'string' &&
+            typeof skill.name === 'string' &&
+            typeof skill.description === 'string' &&
+            typeof skill.prompt === 'string');
+    }
+    /**
+     * Update registry URL
+     */
+    setRegistryUrl(url) {
+        this.registryUrl = url;
+    }
+    /**
+     * Get current registry URL
+     */
+    getRegistryUrl() {
+        return this.registryUrl;
+    }
+}
+exports.SkillRegistry = SkillRegistry;
+// Singleton instance
+let instance = null;
+function getSkillRegistry(config) {
+    if (!instance) {
+        instance = new SkillRegistry(config);
+    }
+    return instance;
+}
+/**
+ * Reset the singleton instance (useful for testing)
+ */
+function resetSkillRegistry() {
+    instance = null;
+}