hammoc 1.4.0 → 1.6.0

package/packages/server/dist/controllers/harnessShareScopeController.js

@@ -0,0 +1,120 @@
+/**
+ * Story 30.1 (Task 2.3): share-scope controller.
+ *
+ * Thin Express handler on top of `harnessShareScopeService`. Mirrors
+ * `harnessController` conventions exactly: Zod refine validation, inline
+ * `HARNESS_*` error mapping, common `{ error: { code, message, details? } }`
+ * envelope. No global Express error middleware in this codebase — see
+ * `harnessController.ts` for the reference pattern.
+ */
+import { z } from 'zod';
+import { HARNESS_ERRORS } from '@hammoc/shared';
+import { harnessShareScopeService } from '../services/harnessShareScopeService.js';
+/**
+ * `paths` is a comma-separated list because GET query strings cannot reliably
+ * carry arbitrary arrays. Each item is a project-relative POSIX path.
+ */
+const querySchema = z
+    .object({
+    scope: z.literal('project'),
+    projectSlug: z.string().min(1, 'projectSlug is required when scope is "project"'),
+    paths: z.string().optional().default(''),
+})
+    .strict();
+const MAPPED_CODES = [
+    'HARNESS_ROOT_MISSING',
+    'HARNESS_FORBIDDEN',
+    'HARNESS_PATH_DENIED',
+    'HARNESS_PARSE_ERROR',
+    'HARNESS_WRITE_ERROR',
+];
+const MESSAGE_KEY = {
+    HARNESS_ROOT_MISSING: 'harness.error.rootMissing',
+    HARNESS_FORBIDDEN: 'harness.error.forbidden',
+    HARNESS_PATH_DENIED: 'harness.error.pathDenied',
+    HARNESS_PARSE_ERROR: 'harness.error.parseError',
+    HARNESS_WRITE_ERROR: 'harness.error.writeError',
+};
+function handleError(req, res, error) {
+    const nodeError = error;
+    for (const key of MAPPED_CODES) {
+        const entry = HARNESS_ERRORS[key];
+        if (nodeError.code === entry.code) {
+            res.status(entry.httpStatus).json({
+                error: { code: entry.code, message: req.t(MESSAGE_KEY[key]) },
+            });
+            return;
+        }
+    }
+    res.status(HARNESS_ERRORS.HARNESS_WRITE_ERROR.httpStatus).json({
+        error: {
+            code: HARNESS_ERRORS.HARNESS_WRITE_ERROR.code,
+            message: req.t('harness.error.writeError'),
+        },
+    });
+}
+/**
+ * Story 30.7 (Task D.3): body schema for `appendGitignore` — the route takes
+ * the project slug from the URL (defense in depth: the helper rejects
+ * traversal-bearing slugs again) and the pattern from the body.
+ */
+const appendBodySchema = z
+    .object({
+    pattern: z.string().min(1, 'pattern is required'),
+})
+    .strict();
+export const harnessShareScopeController = {
+    /** GET /api/harness/share-scope?scope=project&projectSlug=<slug>&paths=<comma> */
+    async evaluate(req, res) {
+        const parsed = querySchema.safeParse(req.query);
+        if (!parsed.success) {
+            const msg = parsed.error.issues[0]?.message ?? 'invalid query';
+            res.status(400).json({ error: { code: 'INVALID_REQUEST', message: msg } });
+            return;
+        }
+        const relativePaths = parsed.data.paths
+            .split(',')
+            .map((p) => p.trim())
+            .filter((p) => p.length > 0);
+        try {
+            const result = await harnessShareScopeService.evaluate({
+                projectSlug: parsed.data.projectSlug,
+                relativePaths,
+            });
+            res.json(result);
+        }
+        catch (error) {
+            handleError(req, res, error);
+        }
+    },
+    /**
+     * POST /api/harness/share-scope/:projectSlug/append-gitignore
+     *
+     * Story 30.7 (Task D.3): append `body.pattern` to the project's
+     * `.gitignore`, creating the file when missing. Idempotent — when the
+     * pattern is already present, the response carries `appended: false` and
+     * the file is untouched.
+     */
+    async appendGitignore(req, res) {
+        const slug = req.params.projectSlug;
+        if (!slug || slug.length === 0) {
+            res.status(400).json({ error: { code: 'INVALID_REQUEST', message: 'projectSlug is required' } });
+            return;
+        }
+        const body = appendBodySchema.safeParse(req.body ?? {});
+        if (!body.success) {
+            res.status(400).json({
+                error: { code: 'INVALID_REQUEST', message: body.error.issues[0]?.message ?? 'invalid body' },
+            });
+            return;
+        }
+        try {
+            const result = await harnessShareScopeService.appendGitignorePattern(slug, body.data.pattern);
+            res.json(result);
+        }
+        catch (error) {
+            handleError(req, res, error);
+        }
+    },
+};
+//# sourceMappingURL=harnessShareScopeController.js.map

package/packages/server/dist/controllers/harnessShareScopeController.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"harnessShareScopeController.js","sourceRoot":"","sources":["../../src/controllers/harnessShareScopeController.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AAEnF;;;GAGG;AACH,MAAM,WAAW,GAAG,CAAC;KAClB,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,iDAAiD,CAAC;IACjF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;CACzC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,YAAY,GAAG;IACnB,sBAAsB;IACtB,mBAAmB;IACnB,qBAAqB;IACrB,qBAAqB;IACrB,qBAAqB;CACb,CAAC;AAEX,MAAM,WAAW,GAAgD;IAC/D,oBAAoB,EAAE,2BAA2B;IACjD,iBAAiB,EAAE,yBAAyB;IAC5C,mBAAmB,EAAE,0BAA0B;IAC/C,mBAAmB,EAAE,0BAA0B;IAC/C,mBAAmB,EAAE,0BAA0B;CAChD,CAAC;AAEF,SAAS,WAAW,CAAC,GAAY,EAAE,GAAa,EAAE,KAAc;IAC9D,MAAM,SAAS,GAAG,KAA8B,CAAC;IACjD,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,SAAS,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;YAClC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC;gBAChC,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE;aAC/D,CAAC,CAAC;YACH,OAAO;QACT,CAAC;IACH,CAAC;IACD,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC;QAC7D,KAAK,EAAE;YACL,IAAI,EAAE,cAAc,CAAC,mBAAmB,CAAC,IAAI;YAC7C,OAAO,EAAE,GAAG,CAAC,CAAE,CAAC,0BAA0B,CAAC;SAC5C;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,qBAAqB,CAAC;CAClD,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,kFAAkF;IAClF,KAAK,CAAC,QAAQ,CAAC,GAAY,EAAE,GAAa;QACxC,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,eAAe,CAAC;YAC/D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK;aACpC,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAE/B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,QAAQ,CAAC;gBACrD,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW;gBACpC,aAAa;aACd,CAAC,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,eAAe,CAAC,GAAY,EAAE,GAAa;QAC/C,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC;QACpC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,CAAC,CAAC;YACjG,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,cAAc,EAAE;aAC7F,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,sBAAsB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9F,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;CACF,CAAC"}

package/packages/server/dist/controllers/harnessSkillController.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Story 28.2: Harness skill list / read / update / copy controller.
+ *
+ * Mirrors the inline error-mapping pattern from `harnessPluginController` —
+ * each handler catches and walks the shared `HARNESS_ERRORS` table to emit
+ * the common `{ error: { code, message, details? } }` envelope. There is no
+ * global Express error middleware in this codebase.
+ *
+ * Route surface (mounted at /api/harness from routes/harness.ts):
+ *   GET    /skills?projectSlug=<slug>?
+ *   GET    /skills/:name?scope=<project|user|plugin>&projectSlug=...&pluginKey=...
+ *   PUT    /skills/:name?scope=<project|user>&projectSlug=...
+ *   POST   /skills/copy
+ *   GET    /skills/:name/bundle/<resourcePath>?scope=<project|user|plugin>&...
+ *   PUT    /skills/:name/bundle/<resourcePath>?scope=<project|user>&...
+ */
+import { Request, Response } from 'express';
+export declare const harnessSkillController: {
+    /** GET /skills */
+    list(req: Request, res: Response): Promise<void>;
+    /** GET /skills/:name */
+    read(req: Request, res: Response): Promise<void>;
+    /** PUT /skills/:name */
+    update(req: Request, res: Response): Promise<void>;
+    /** POST /skills/copy */
+    copy(req: Request, res: Response): Promise<void>;
+    /** GET /skills/:name/bundle/<resourcePath> */
+    readBundle(req: Request, res: Response): Promise<void>;
+    /** PUT /skills/:name/bundle/<resourcePath> */
+    writeBundle(req: Request, res: Response): Promise<void>;
+};
+//# sourceMappingURL=harnessSkillController.d.ts.map

package/packages/server/dist/controllers/harnessSkillController.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"harnessSkillController.d.ts","sourceRoot":"","sources":["../../src/controllers/harnessSkillController.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AA8Q5C,eAAO,MAAM,sBAAsB;IACjC,kBAAkB;cACF,OAAO,OAAO,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBtD,wBAAwB;cACR,OAAO,OAAO,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IA2BtD,wBAAwB;gBACN,OAAO,OAAO,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAiCxD,wBAAwB;cACR,OAAO,OAAO,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBtD,8CAA8C;oBACxB,OAAO,OAAO,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IA6C5D,8CAA8C;qBACvB,OAAO,OAAO,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CAoC9D,CAAC"}

package/packages/server/dist/controllers/harnessSkillController.js

@@ -0,0 +1,453 @@
+/**
+ * Story 28.2: Harness skill list / read / update / copy controller.
+ *
+ * Mirrors the inline error-mapping pattern from `harnessPluginController` —
+ * each handler catches and walks the shared `HARNESS_ERRORS` table to emit
+ * the common `{ error: { code, message, details? } }` envelope. There is no
+ * global Express error middleware in this codebase.
+ *
+ * Route surface (mounted at /api/harness from routes/harness.ts):
+ *   GET    /skills?projectSlug=<slug>?
+ *   GET    /skills/:name?scope=<project|user|plugin>&projectSlug=...&pluginKey=...
+ *   PUT    /skills/:name?scope=<project|user>&projectSlug=...
+ *   POST   /skills/copy
+ *   GET    /skills/:name/bundle/<resourcePath>?scope=<project|user|plugin>&...
+ *   PUT    /skills/:name/bundle/<resourcePath>?scope=<project|user>&...
+ */
+import path from 'path';
+import { z } from 'zod';
+import { HARNESS_ERRORS, } from '@hammoc/shared';
+import { harnessService } from '../services/harnessService.js';
+import { harnessSkillService } from '../services/harnessSkillService.js';
+import { projectService } from '../services/projectService.js';
+import { getUserHarnessRoot } from '../utils/harnessPaths.js';
+const skillScopeSchema = z.enum(['project', 'user', 'plugin']);
+const editableScopeSchema = z.enum(['project', 'user']);
+const listQuery = z.object({
+    projectSlug: z.string().min(1).optional(),
+});
+const readQuery = z.object({
+    scope: skillScopeSchema,
+    projectSlug: z.string().min(1).optional(),
+    pluginKey: z.string().min(1).optional(),
+});
+const updateQuery = z.object({
+    scope: editableScopeSchema,
+    projectSlug: z.string().min(1).optional(),
+});
+const updateBody = z
+    .object({
+    frontmatter: z
+        .object({
+        name: z.string().optional(),
+        description: z.string().optional(),
+        version: z.string().optional(),
+    })
+        .optional(),
+    body: z.string().optional(),
+    raw: z.string().optional(),
+    expectedMtime: z.string().optional(),
+})
+    .refine((v) => v.frontmatter !== undefined || v.body !== undefined || v.raw !== undefined, { message: 'one of frontmatter / body / raw is required' });
+const copyBody = z
+    .object({
+    sourceScope: skillScopeSchema,
+    sourceProjectSlug: z.string().min(1).optional(),
+    sourcePluginKey: z.string().min(1).optional(),
+    sourceName: z.string().min(1),
+    targetScope: editableScopeSchema, // plugin destinations are forbidden
+    targetProjectSlug: z.string().min(1).optional(),
+    targetName: z.string().min(1),
+    onConflict: z.enum(['overwrite', 'skip', 'rename']),
+})
+    .refine((v) => v.sourceScope !== 'project' || !!v.sourceProjectSlug, { message: 'sourceProjectSlug is required when sourceScope is project' })
+    .refine((v) => v.sourceScope !== 'plugin' || !!v.sourcePluginKey, { message: 'sourcePluginKey is required when sourceScope is plugin' })
+    .refine((v) => v.targetScope !== 'project' || !!v.targetProjectSlug, { message: 'targetProjectSlug is required when targetScope is project' })
+    .refine((v) => !RESERVED_NAME_RE.test(v.targetName), { message: 'targetName contains reserved characters' });
+// OS-reserved characters and trailing dot/space — blocked at validation time so
+// the rename UI can rely on inline errors. Also catches path-traversal segments
+// like `..` (trailing dot), `/foo`, `\foo`. Applied to both copy bodies (Zod
+// .refine) and read/update name params (validateSkillName).
+// eslint-disable-next-line no-control-regex
+const RESERVED_NAME_RE = /[\\/<>:"|?*\x00-\x1F]|[. ]$/;
+function validateSkillName(name) {
+    if (RESERVED_NAME_RE.test(name)) {
+        const err = new Error('skill name contains reserved or path-traversal characters');
+        err.code = HARNESS_ERRORS.HARNESS_PATH_DENIED.code;
+        throw err;
+    }
+}
+const bundleWriteBody = z.object({
+    content: z.string(),
+    expectedMtime: z.string().optional(),
+});
+const MAPPED_CODES = [
+    'HARNESS_PATH_DENIED',
+    'HARNESS_FORBIDDEN',
+    'HARNESS_PLUGIN_SCOPE_DENIED',
+    'HARNESS_FILE_NOT_FOUND',
+    'HARNESS_NOT_A_FILE',
+    'HARNESS_ROOT_MISSING',
+    'HARNESS_PARENT_NOT_FOUND',
+    'HARNESS_PLUGIN_NOT_FOUND',
+    'HARNESS_SKILL_NOT_FOUND',
+    'HARNESS_STALE_WRITE',
+    'HARNESS_SKILL_NAME_CONFLICT',
+    'HARNESS_PARSE_ERROR',
+];
+const MESSAGE_KEY = {
+    HARNESS_PATH_DENIED: 'harness.error.pathDenied',
+    HARNESS_FORBIDDEN: 'harness.error.forbidden',
+    HARNESS_PLUGIN_SCOPE_DENIED: 'harness.error.pluginScopeDenied',
+    HARNESS_FILE_NOT_FOUND: 'harness.error.fileNotFound',
+    HARNESS_NOT_A_FILE: 'harness.error.notAFile',
+    HARNESS_ROOT_MISSING: 'harness.error.rootMissing',
+    HARNESS_PARENT_NOT_FOUND: 'harness.error.parentNotFound',
+    HARNESS_PLUGIN_NOT_FOUND: 'harness.error.pluginNotFound',
+    HARNESS_SKILL_NOT_FOUND: 'harness.error.skillNotFound',
+    HARNESS_STALE_WRITE: 'harness.error.staleWrite',
+    HARNESS_SKILL_NAME_CONFLICT: 'harness.error.skillNameConflict',
+    HARNESS_PARSE_ERROR: 'harness.error.parseError',
+};
+function handleError(req, res, error) {
+    const nodeError = error;
+    for (const key of MAPPED_CODES) {
+        const entry = HARNESS_ERRORS[key];
+        if (nodeError.code === entry.code) {
+            const body = {
+                code: entry.code,
+                message: req.t ? req.t(MESSAGE_KEY[key]) : entry.code,
+            };
+            if (key === 'HARNESS_STALE_WRITE') {
+                body.details = { currentMtime: nodeError.currentMtime ?? '' };
+            }
+            res.status(entry.httpStatus).json({ error: body });
+            return;
+        }
+    }
+    // Fall-through: surface as HARNESS_WRITE_ERROR but preserve `cause` so the
+    // client can route to the cross-device toast (Risk Mitigation #2).
+    const body = {
+        code: HARNESS_ERRORS.HARNESS_WRITE_ERROR.code,
+        message: req.t ? req.t('harness.error.writeError') : HARNESS_ERRORS.HARNESS_WRITE_ERROR.code,
+    };
+    if (typeof nodeError.cause === 'string') {
+        body.details = { cause: nodeError.cause };
+    }
+    res.status(HARNESS_ERRORS.HARNESS_WRITE_ERROR.httpStatus).json({ error: body });
+}
+async function resolveSourceLocation(input) {
+    validateSkillName(input.name);
+    if (input.scope === 'project') {
+        if (!input.projectSlug) {
+            throwInvalid('projectSlug required for scope=project');
+        }
+        const projectRoot = await projectService.resolveOriginalPath(input.projectSlug);
+        return {
+            scope: 'project',
+            absoluteRoot: path.join(projectRoot, '.claude', 'skills', input.name),
+            projectSlug: input.projectSlug,
+        };
+    }
+    if (input.scope === 'user') {
+        return {
+            scope: 'user',
+            absoluteRoot: path.join(getUserHarnessRoot(), 'skills', input.name),
+        };
+    }
+    // plugin
+    if (!input.pluginKey) {
+        throwInvalid('pluginKey required for scope=plugin');
+    }
+    const installPath = await readPluginInstallPath(input.pluginKey);
+    if (!installPath) {
+        const err = new Error('plugin not installed');
+        err.code = HARNESS_ERRORS.HARNESS_PLUGIN_NOT_FOUND.code;
+        throw err;
+    }
+    return {
+        scope: 'plugin',
+        absoluteRoot: path.join(installPath, 'skills', input.name),
+        pluginKey: input.pluginKey,
+    };
+}
+function throwInvalid(message) {
+    const err = new Error(message);
+    err.code = 'INVALID_REQUEST';
+    throw err;
+}
+async function readPluginInstallPath(pluginKey) {
+    try {
+        const res = await harnessService.read({
+            scope: 'user',
+            relativePath: 'plugins/installed_plugins.json',
+        });
+        const trimmed = (res.content ?? '').trim();
+        if (!trimmed)
+            return undefined;
+        const parsed = JSON.parse(trimmed);
+        const raw = parsed.plugins?.[pluginKey];
+        const entries = Array.isArray(raw) ? raw : raw ? [raw] : [];
+        for (const e of entries) {
+            if (e && typeof e === 'object' && typeof e.installPath === 'string') {
+                return e.installPath;
+            }
+        }
+        return undefined;
+    }
+    catch (err) {
+        if (err.code === HARNESS_ERRORS.HARNESS_FILE_NOT_FOUND.code) {
+            return undefined;
+        }
+        throw err;
+    }
+}
+/**
+ * Resolve the bundle resource path inside a skill folder, enforcing that the
+ * resolved absolute path stays under the skill root. Returns the absolute path
+ * along with the relative path used to call harnessService.read/write.
+ */
+function resolveBundleRef(source, resourcePath) {
+    if (source.scope === 'plugin') {
+        const err = new Error('plugin scope is read-only');
+        err.code = HARNESS_ERRORS.HARNESS_FORBIDDEN.code;
+        throw err;
+    }
+    // Defensive normalization — Zod already filters `..` segments below but the
+    // explicit guard catches anything sneaking in via URL decoding.
+    const skillName = path.basename(source.absoluteRoot);
+    const normalized = resourcePath.replace(/\\/g, '/');
+    if (normalized.includes('..') || normalized.startsWith('/')) {
+        const err = new Error('path traversal blocked');
+        err.code = HARNESS_ERRORS.HARNESS_PATH_DENIED.code;
+        throw err;
+    }
+    if (source.scope === 'project') {
+        return {
+            ref: {
+                scope: 'project',
+                projectSlug: source.projectSlug,
+                relativePath: `skills/${skillName}/${normalized}`,
+            },
+        };
+    }
+    return {
+        ref: { scope: 'user', relativePath: `skills/${skillName}/${normalized}` },
+    };
+}
+export const harnessSkillController = {
+    /** GET /skills */
+    async list(req, res) {
+        const parsed = listQuery.safeParse(req.query);
+        if (!parsed.success) {
+            res.status(400).json({
+                error: { code: 'INVALID_REQUEST', message: parsed.error.issues[0]?.message ?? 'invalid query' },
+            });
+            return;
+        }
+        try {
+            const result = await harnessSkillService.listCards(parsed.data.projectSlug);
+            res.json(result);
+        }
+        catch (error) {
+            handleError(req, res, error);
+        }
+    },
+    /** GET /skills/:name */
+    async read(req, res) {
+        const query = readQuery.safeParse(req.query);
+        if (!query.success) {
+            res.status(400).json({
+                error: { code: 'INVALID_REQUEST', message: query.error.issues[0]?.message ?? 'invalid query' },
+            });
+            return;
+        }
+        const name = decodeURIComponent(req.params.name ?? '');
+        if (!name) {
+            res.status(400).json({ error: { code: 'INVALID_REQUEST', message: 'name is required' } });
+            return;
+        }
+        try {
+            const source = await resolveSourceLocation({
+                scope: query.data.scope,
+                name,
+                projectSlug: query.data.projectSlug,
+                pluginKey: query.data.pluginKey,
+            });
+            const result = await harnessSkillService.readSkill(source);
+            res.json(result);
+        }
+        catch (error) {
+            handleError(req, res, error);
+        }
+    },
+    /** PUT /skills/:name */
+    async update(req, res) {
+        const query = updateQuery.safeParse(req.query);
+        if (!query.success) {
+            res.status(400).json({
+                error: { code: 'INVALID_REQUEST', message: query.error.issues[0]?.message ?? 'invalid query' },
+            });
+            return;
+        }
+        const body = updateBody.safeParse(req.body ?? {});
+        if (!body.success) {
+            res.status(400).json({
+                error: { code: 'INVALID_REQUEST', message: body.error.issues[0]?.message ?? 'invalid body' },
+            });
+            return;
+        }
+        const name = decodeURIComponent(req.params.name ?? '');
+        if (!name) {
+            res.status(400).json({ error: { code: 'INVALID_REQUEST', message: 'name is required' } });
+            return;
+        }
+        try {
+            const source = await resolveSourceLocation({
+                scope: query.data.scope,
+                name,
+                projectSlug: query.data.projectSlug,
+            });
+            const result = await harnessSkillService.updateSkill(source, body.data);
+            res.json(result);
+        }
+        catch (error) {
+            handleError(req, res, error);
+        }
+    },
+    /** POST /skills/copy */
+    async copy(req, res) {
+        const body = copyBody.safeParse(req.body ?? {});
+        if (!body.success) {
+            res.status(400).json({
+                error: { code: 'INVALID_REQUEST', message: body.error.issues[0]?.message ?? 'invalid body' },
+            });
+            return;
+        }
+        try {
+            const result = await harnessSkillService.copySkill(body.data);
+            res.json(result);
+        }
+        catch (error) {
+            handleError(req, res, error);
+        }
+    },
+    /** GET /skills/:name/bundle/<resourcePath> */
+    async readBundle(req, res) {
+        const query = readQuery.safeParse(req.query);
+        if (!query.success) {
+            res.status(400).json({
+                error: { code: 'INVALID_REQUEST', message: query.error.issues[0]?.message ?? 'invalid query' },
+            });
+            return;
+        }
+        const name = decodeURIComponent(req.params.name ?? '');
+        const resourcePath = req.params[0] ?? ''; // express splat
+        if (!name || !resourcePath) {
+            res.status(400).json({
+                error: { code: 'INVALID_REQUEST', message: 'name and resource path are required' },
+            });
+            return;
+        }
+        try {
+            const source = await resolveSourceLocation({
+                scope: query.data.scope,
+                name,
+                projectSlug: query.data.projectSlug,
+                pluginKey: query.data.pluginKey,
+            });
+            if (source.scope === 'plugin') {
+                // Plugin bundle reads are allowed (read-only); short-circuit to direct fs.
+                const filePath = path.join(source.absoluteRoot, resourcePath);
+                const abs = path.resolve(filePath);
+                const root = path.resolve(source.absoluteRoot);
+                if (abs !== root && !abs.startsWith(root + path.sep)) {
+                    const err = new Error('path traversal blocked');
+                    err.code = HARNESS_ERRORS.HARNESS_PATH_DENIED.code;
+                    throw err;
+                }
+                const out = await readFileForResponse(abs, resourcePath);
+                res.json(out);
+                return;
+            }
+            const { ref } = resolveBundleRef(source, resourcePath);
+            const result = await harnessService.read(ref);
+            res.json(result);
+        }
+        catch (error) {
+            handleError(req, res, error);
+        }
+    },
+    /** PUT /skills/:name/bundle/<resourcePath> */
+    async writeBundle(req, res) {
+        const query = updateQuery.safeParse(req.query);
+        if (!query.success) {
+            res.status(400).json({
+                error: { code: 'INVALID_REQUEST', message: query.error.issues[0]?.message ?? 'invalid query' },
+            });
+            return;
+        }
+        const body = bundleWriteBody.safeParse(req.body ?? {});
+        if (!body.success) {
+            res.status(400).json({
+                error: { code: 'INVALID_REQUEST', message: body.error.issues[0]?.message ?? 'invalid body' },
+            });
+            return;
+        }
+        const name = decodeURIComponent(req.params.name ?? '');
+        const resourcePath = req.params[0] ?? '';
+        if (!name || !resourcePath) {
+            res.status(400).json({
+                error: { code: 'INVALID_REQUEST', message: 'name and resource path are required' },
+            });
+            return;
+        }
+        try {
+            const source = await resolveSourceLocation({
+                scope: query.data.scope,
+                name,
+                projectSlug: query.data.projectSlug,
+            });
+            const { ref } = resolveBundleRef(source, resourcePath);
+            const result = await harnessService.write(ref, body.data);
+            res.json(result);
+        }
+        catch (error) {
+            handleError(req, res, error);
+        }
+    },
+};
+// ---- helpers shared with the bundle plugin-read short-circuit ------------
+async function readFileForResponse(absolutePath, relPath) {
+    const fs = await import('fs/promises');
+    const { isBinaryFile, getMimeType, MAX_FILE_SIZE } = await import('../utils/pathUtils.js');
+    const stat = await fs.stat(absolutePath);
+    if (!stat.isFile()) {
+        const err = new Error('not a file');
+        err.code = HARNESS_ERRORS.HARNESS_NOT_A_FILE.code;
+        throw err;
+    }
+    const size = stat.size;
+    const mtime = stat.mtime.toISOString();
+    const mimeType = getMimeType(absolutePath);
+    const base = { scope: 'plugin', path: relPath, size, mtime, mimeType };
+    if (size > 0) {
+        const binary = await isBinaryFile(absolutePath);
+        if (binary)
+            return { ...base, content: null, isBinary: true, isTruncated: false };
+    }
+    if (size > MAX_FILE_SIZE) {
+        const handle = await fs.open(absolutePath, 'r');
+        try {
+            const buffer = Buffer.alloc(MAX_FILE_SIZE);
+            await handle.read(buffer, 0, MAX_FILE_SIZE, 0);
+            return { ...base, content: buffer.toString('utf-8'), isBinary: false, isTruncated: true };
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    const content = await fs.readFile(absolutePath, 'utf-8');
+    return { ...base, content, isBinary: false, isTruncated: false };
+}
+//# sourceMappingURL=harnessSkillController.js.map

package/packages/server/dist/controllers/harnessSkillController.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"harnessSkillController.js","sourceRoot":"","sources":["../../src/controllers/harnessSkillController.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,cAAc,GAIf,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC/D,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;AAExD,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IACzB,KAAK,EAAE,gBAAgB;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,KAAK,EAAE,mBAAmB;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,CAAC;KACjB,MAAM,CAAC;IACN,WAAW,EAAE,CAAC;SACX,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC/B,CAAC;SACD,QAAQ,EAAE;IACb,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC;KACD,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,EACjF,EAAE,OAAO,EAAE,6CAA6C,EAAE,CAC3D,CAAC;AAEJ,MAAM,QAAQ,GAAG,CAAC;KACf,MAAM,CAAC;IACN,WAAW,EAAE,gBAAgB;IAC7B,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,WAAW,EAAE,mBAAmB,EAAE,oCAAoC;IACtE,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;CACpD,CAAC;KACD,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAC3D,EAAE,OAAO,EAAE,2DAA2D,EAAE,CACzE;KACA,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,EACxD,EAAE,OAAO,EAAE,wDAAwD,EAAE,CACtE;KACA,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAC3D,EAAE,OAAO,EAAE,2DAA2D,EAAE,CACzE;KACA,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,EAC3C,EAAE,OAAO,EAAE,yCAAyC,EAAE,CACvD,CAAC;AAEJ,gFAAgF;AAChF,gFAAgF;AAChF,6EAA6E;AAC7E,4DAA4D;AAC5D,4CAA4C;AAC5C,MAAM,gBAAgB,GAAG,6BAA6B,CAAC;AAEvD,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,2DAA2D,CAA0B,CAAC;QAC5G,GAAG,CAAC,IAAI,GAAG,cAAc,CAAC,mBAAmB,CAAC,IAAI,CAAC;QACnD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG;IACnB,qBAAqB;IACrB,mBAAmB;IACnB,6BAA6B;IAC7B,wBAAwB;IACxB,oBAAoB;IACpB,sBAAsB;IACtB,0BAA0B;IAC1B,0BAA0B;IAC1B,yBAAyB;IACzB,qBAAqB;IACrB,6BAA6B;IAC7B,qBAAqB;CACb,CAAC;AAEX,MAAM,WAAW,GAAgD;IAC/D,mBAAmB,EAAE,0BAA0B;IAC/C,iBAAiB,EAAE,yBAAyB;IAC5C,2BAA2B,EAAE,iCAAiC;IAC9D,sBAAsB,EAAE,4BAA4B;IACpD,kBAAkB,EAAE,wBAAwB;IAC5C,oBAAoB,EAAE,2BAA2B;IACjD,wBAAwB,EAAE,8BAA8B;IACxD,wBAAwB,EAAE,8BAA8B;IACxD,uBAAuB,EAAE,6BAA6B;IACtD,mBAAmB,EAAE,0BAA0B;IAC/C,2BAA2B,EAAE,iCAAiC;IAC9D,mBAAmB,EAAE,0BAA0B;CAChD,CAAC;AAEF,SAAS,WAAW,CAAC,GAAY,EAAE,GAAa,EAAE,KAAc;IAC9D,MAAM,SAAS,GAAG,KAGjB,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,SAAS,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,IAAI,GAAyE;gBACjF,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI;aACtD,CAAC;YACF,IAAI,GAAG,KAAK,qBAAqB,EAAE,CAAC;gBAClC,IAAI,CAAC,OAAO,GAAG,EAAE,YAAY,EAAE,SAAS,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;YAChE,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;IACH,CAAC;IACD,2EAA2E;IAC3E,mEAAmE;IACnE,MAAM,IAAI,GAAyE;QACjF,IAAI,EAAE,cAAc,CAAC,mBAAmB,CAAC,IAAI;QAC7C,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,mBAAmB,CAAC,IAAI;KAC7F,CAAC;IACF,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,IAAI,CAAC,OAAO,GAAG,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;IAC5C,CAAC;IACD,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,KAKpC;IACC,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YACvB,YAAY,CAAC,wCAAwC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,mBAAmB,CAAC,KAAK,CAAC,WAAY,CAAC,CAAC;QACjF,OAAO;YACL,KAAK,EAAE,SAAS;YAChB,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC;YACrE,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO;YACL,KAAK,EAAE,MAAM;YACb,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC;SACpE,CAAC;IACJ,CAAC;IACD,SAAS;IACT,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACrB,YAAY,CAAC,qCAAqC,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,SAAU,CAAC,CAAC;IAClE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,sBAAsB,CAA0B,CAAC;QACvE,GAAG,CAAC,IAAI,GAAG,cAAc,CAAC,wBAAwB,CAAC,IAAI,CAAC;QACxD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,OAAO;QACL,KAAK,EAAE,QAAQ;QACf,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC;QAC1D,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9B,GAA6B,CAAC,IAAI,GAAG,iBAAiB,CAAC;IACxD,MAAM,GAAG,CAAC;AACZ,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,SAAiB;IACpD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC;YACpC,KAAK,EAAE,MAAM;YACb,YAAY,EAAE,gCAAgC;SAC/C,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAEhC,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAQ,CAA6B,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;gBACjG,OAAQ,CAA6B,CAAC,WAAW,CAAC;YACpD,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,cAAc,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAC;YACvF,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CACvB,MAAkC,EAClC,YAAoB;IAEpB,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,2BAA2B,CAA0B,CAAC;QAC5E,GAAG,CAAC,IAAI,GAAG,cAAc,CAAC,iBAAiB,CAAC,IAAI,CAAC;QACjD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,4EAA4E;IAC5E,gEAAgE;IAChE,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACpD,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5D,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,wBAAwB,CAA0B,CAAC;QACzE,GAAG,CAAC,IAAI,GAAG,cAAc,CAAC,mBAAmB,CAAC,IAAI,CAAC;QACnD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO;YACL,GAAG,EAAE;gBACH,KAAK,EAAE,SAAS;gBAChB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,YAAY,EAAE,UAAU,SAAS,IAAI,UAAU,EAAE;aAClD;SACF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,SAAS,IAAI,UAAU,EAAE,EAAE;KAC1E,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,kBAAkB;IAClB,KAAK,CAAC,IAAI,CAAC,GAAY,EAAE,GAAa;QACpC,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,eAAe,EAAE;aAChG,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC5E,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,KAAK,CAAC,IAAI,CAAC,GAAY,EAAE,GAAa;QACpC,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,eAAe,EAAE;aAC/F,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;YAC1F,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC;gBACzC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK;gBACvB,IAAI;gBACJ,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW;gBACnC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS;aAChC,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC3D,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,KAAK,CAAC,MAAM,CAAC,GAAY,EAAE,GAAa;QACtC,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,eAAe,EAAE;aAC/F,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,cAAc,EAAE;aAC7F,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;YAC1F,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC;gBACzC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK;gBACvB,IAAI;gBACJ,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW;aACpC,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACxE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,KAAK,CAAC,IAAI,CAAC,GAAY,EAAE,GAAa;QACpC,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,cAAc,EAAE;aAC7F,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,IAA+B,CAAC,CAAC;YACzF,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,8CAA8C;IAC9C,KAAK,CAAC,UAAU,CAAC,GAAY,EAAE,GAAa;QAC1C,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,eAAe,EAAE;aAC/F,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACvD,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,gBAAgB;QAC1D,IAAI,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC3B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,qCAAqC,EAAE;aACnF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC;gBACzC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK;gBACvB,IAAI;gBACJ,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW;gBACnC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS;aAChC,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,2EAA2E;gBAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;gBAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACnC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBAC/C,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBACrD,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,wBAAwB,CAA0B,CAAC;oBACzE,GAAG,CAAC,IAAI,GAAG,cAAc,CAAC,mBAAmB,CAAC,IAAI,CAAC;oBACnD,MAAM,GAAG,CAAC;gBACZ,CAAC;gBACD,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;gBACzD,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YACD,MAAM,EAAE,GAAG,EAAE,GAAG,gBAAgB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YACvD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC9C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,8CAA8C;IAC9C,KAAK,CAAC,WAAW,CAAC,GAAY,EAAE,GAAa;QAC3C,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,eAAe,EAAE;aAC/F,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,cAAc,EAAE;aAC7F,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACvD,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,IAAI,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC3B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,qCAAqC,EAAE;aACnF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC;gBACzC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK;gBACvB,IAAI;gBACJ,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW;aACpC,CAAC,CAAC;YACH,MAAM,EAAE,GAAG,EAAE,GAAG,gBAAgB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YACvD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1D,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;CACF,CAAC;AAEF,6EAA6E;AAE7E,KAAK,UAAU,mBAAmB,CAAC,YAAoB,EAAE,OAAe;IAUtE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACvC,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IAE3F,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,YAAY,CAA0B,CAAC;QAC7D,GAAG,CAAC,IAAI,GAAG,cAAc,CAAC,kBAAkB,CAAC,IAAI,CAAC;QAClD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,QAAiB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAEhF,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,MAAM;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IACpF,CAAC;IACD,IAAI,IAAI,GAAG,aAAa,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YAC3C,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;YAC/C,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QAC5F,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACzD,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AACnE,CAAC"}

package/packages/server/dist/controllers/marketplaceController.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Story 31.4: Plugin marketplace catalog controller (read-only).
+ *
+ * Thin Express handler on top of `marketplaceService`. Mirrors the inline
+ * `HARNESS_ERRORS` envelope mapping used by `harnessPluginController` — there
+ * is no global Express error middleware, so the handler catches and maps to
+ * the common `{ error: { code, message } }` envelope.
+ *
+ * Only a single GET endpoint exists: the catalog is read-only. Direct
+ * install / marketplace-add automation was dropped after Story 31.4 spike #2
+ * (negative) — installs are guided via copy-only command blocks, so there are
+ * no POST routes here. (See sdk-upstream-issues.md §18.)
+ */
+import { Request, Response } from 'express';
+export declare const marketplaceController: {
+    /** GET /api/harness/marketplace/:projectSlug/catalog */
+    catalog(req: Request, res: Response): Promise<void>;
+};
+//# sourceMappingURL=marketplaceController.d.ts.map