kcg-code 0.0.0-stage → 0.2.0

package/src/server/routes/passkeys.routes.ts

@@ -0,0 +1,161 @@
+/**
+ * Tabel rute API passkey (WebAuthn).
+ *
+ * Publik (lock screen, sebelum login):
+ * - `GET  /api/auth/passkeys/availability`   `{ supported, count }` untuk alamat ini
+ * - `POST /api/auth/passkeys/login/options`  -> `{ challengeId, options }`
+ * - `POST /api/auth/passkeys/login`          `{ challengeId, response }` -> cookie sesi
+ *
+ * Wajib login — dijaga `guardRoutes`:
+ * - `GET    /api/auth/passkeys`                   daftar passkey
+ * - `POST   /api/auth/passkeys/register/options`  `{ current }` -> `{ challengeId, options }`
+ * - `POST   /api/auth/passkeys/register`          `{ challengeId, response, name? }`
+ * - `PATCH  /api/auth/passkeys/:id`               `{ name }`
+ * - `DELETE /api/auth/passkeys/:id`
+ */
+import type { BunRequest, Server } from "bun";
+import type { AuthService } from "../services/auth";
+import type { PasskeyService } from "../services/auth-passkeys";
+import { clientIp, sessionCookie } from "./auth-guard";
+import { errorStatus, json, readJson, serverError } from "./helpers";
+
+function rateLimited(code: string): number | null {
+  if (!code.startsWith("AUTH_RATE_LIMITED:")) return null;
+  const n = Number(code.slice("AUTH_RATE_LIMITED:".length));
+  return Number.isFinite(n) ? n : null;
+}
+
+function errorResponse(code: string): Response {
+  const wait = rateLimited(code);
+  if (wait !== null) {
+    return new Response(JSON.stringify({ error: "AUTH_RATE_LIMITED", retryAfterSec: wait }), {
+      status: 429,
+      headers: { "content-type": "application/json", "retry-after": String(wait) },
+    });
+  }
+  return json({ error: code }, errorStatus(code));
+}
+
+async function body(req: Request): Promise<Record<string, unknown> | null> {
+  const res = await readJson(req);
+  if (!res.ok || res.data === null || typeof res.data !== "object") return null;
+  return res.data as Record<string, unknown>;
+}
+
+export function passkeyRoutes(_auth: AuthService, passkeys: PasskeyService) {
+  return {
+    "/api/auth/passkeys/availability": {
+      GET: (req: Request) => {
+        try {
+          return json(passkeys.availability(req));
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+    },
+
+    "/api/auth/passkeys/login/options": {
+      POST: async (req: Request, server: Server<unknown>) => {
+        try {
+          const res = await passkeys.authenticationOptions(req, clientIp(req, server));
+          if (!res.ok) return errorResponse(res.error);
+          return json(res.data);
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+    },
+
+    "/api/auth/passkeys/login": {
+      POST: async (req: Request, server: Server<unknown>) => {
+        try {
+          const b = await body(req);
+          if (!b) return json({ error: "INVALID_JSON" }, 400);
+          const res = await passkeys.login(
+            req,
+            {
+              challengeId: typeof b.challengeId === "string" ? b.challengeId : "",
+              response: b.response as never,
+            },
+            { ip: clientIp(req, server), userAgent: req.headers.get("user-agent") },
+          );
+          if (!res.ok) return errorResponse(res.error);
+          const out = json({ ok: true });
+          out.headers.append("set-cookie", sessionCookie(req, res.data.token));
+          return out;
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+    },
+
+    "/api/auth/passkeys": {
+      GET: (req: Request) => {
+        try {
+          return json({ passkeys: passkeys.list(req) });
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+    },
+
+    "/api/auth/passkeys/register/options": {
+      POST: async (req: Request, server: Server<unknown>) => {
+        try {
+          const b = await body(req);
+          if (!b) return json({ error: "INVALID_JSON" }, 400);
+          const res = await passkeys.registrationOptions(
+            req,
+            typeof b.current === "string" ? b.current : "",
+            clientIp(req, server),
+          );
+          if (!res.ok) return errorResponse(res.error);
+          return json(res.data);
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+    },
+
+    "/api/auth/passkeys/register": {
+      POST: async (req: Request) => {
+        try {
+          const b = await body(req);
+          if (!b) return json({ error: "INVALID_JSON" }, 400);
+          const res = await passkeys.register(req, {
+            challengeId: typeof b.challengeId === "string" ? b.challengeId : "",
+            response: b.response as never,
+            name: typeof b.name === "string" ? b.name : undefined,
+          });
+          if (!res.ok) return errorResponse(res.error);
+          return json({ passkey: res.data });
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+    },
+
+    "/api/auth/passkeys/:id": {
+      PATCH: async (req: BunRequest<"/api/auth/passkeys/:id">) => {
+        try {
+          const b = await body(req);
+          if (!b) return json({ error: "INVALID_JSON" }, 400);
+          const res = passkeys.rename(req.params.id, typeof b.name === "string" ? b.name : "");
+          if (!res.ok) return errorResponse(res.error);
+          return json({ passkey: res.data });
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+      DELETE: (req: BunRequest<"/api/auth/passkeys/:id">) => {
+        try {
+          const res = passkeys.remove(req.params.id);
+          if (!res.ok) return errorResponse(res.error);
+          return json({ ok: true });
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+    },
+  };
+}

package/src/server/routes/projects.routes.ts

@@ -0,0 +1,167 @@
+/**
+ * Tabel rute API Project & Folder_Browser (Requirement 10).
+ *
+ * `/api/projects` (GET daftar / POST buat), `/api/projects/:id` (PATCH ubah
+ * custom instruction, DELETE hapus
+ * pendaftaran Project beserta seluruh Session-nya), `/api/fs` (GET list
+ * direktori untuk Folder_Browser), dan `/api/projects/:id/models` (GET model
+ * yang tersedia pada server headless Project). Dipasang composition root
+ * (`app.ts`) bersama tabel rute lain — pola kcgcode (`*.routes.ts`).
+ */
+import type { BunRequest } from "bun";
+import type { AgentType } from "../../types";
+import { errorStatus, json, readJson, serverError } from "./helpers";
+import type { ApiRouteContext } from "./types";
+
+/**
+ * Backend yang ditanyakan lewat `?agent=` (default opencode) — daftar model &
+ * agent berbeda antara opencode dan Claude Code.
+ */
+function agentTypeParam(req: Request): AgentType {
+  const agent = new URL(req.url).searchParams.get("agent");
+  return agent === "claude-code" ? "claude-code" : "opencode";
+}
+
+export function projectsRoutes(ctx: ApiRouteContext) {
+  const { projectManager, sessionManager, notifyDataChanged } = ctx;
+  return {
+    // ---- Project & Folder_Browser (Requirement 10) ----
+    "/api/projects": {
+      GET: () => {
+        try {
+          return json({ projects: projectManager.listProjects() });
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+      POST: async (req: Request) => {
+        try {
+          const body = await readJson(req);
+          if (!body.ok) return json({ error: "INVALID_JSON" }, 400);
+          const { name, path } = body.data as { name?: unknown; path?: unknown };
+          const res = projectManager.createProject(
+            typeof name === "string" ? name : "",
+            typeof path === "string" ? path : "",
+          );
+          if (!res.ok) return json({ error: res.error }, errorStatus(res.error));
+          notifyDataChanged();
+          return json({ project: res.data }, 201);
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+    },
+
+    "/api/projects/:id": {
+      /**
+       * Perbarui Project. Saat ini hanya `instructions` (custom instruction
+       * yang dikirim sebagai `system` di setiap prompt). String kosong =
+       * hapus instruksi.
+       */
+      PATCH: async (req: BunRequest<"/api/projects/:id">) => {
+        try {
+          const body = await readJson(req);
+          if (!body.ok) return json({ error: "INVALID_JSON" }, 400);
+          const { instructions } = (body.data ?? {}) as { instructions?: unknown };
+          if (instructions !== null && typeof instructions !== "string") {
+            return json({ error: "INVALID_INSTRUCTIONS" }, 400);
+          }
+          const res = projectManager.updateInstructions(req.params.id, instructions ?? "");
+          if (!res.ok) return json({ error: res.error }, errorStatus(res.error));
+          return json({ project: res.data });
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+      /**
+       * Hapus pendaftaran Project. Seluruh Session miliknya dihapus lebih dulu
+       * (`releaseProject`) sehingga sesi remote opencode dan lampiran gambar
+       * ikut bersih, lalu server headless Project dihentikan. Direktori kerja
+       * di filesystem TIDAK disentuh — Project hanyalah referensi ke folder.
+       *
+       * Kegagalan pembersihan Session -> error diteruskan, baris Project tetap
+       * ada supaya operasi bisa dicoba ulang tanpa meninggalkan sesi yatim.
+       */
+      DELETE: async (req: BunRequest<"/api/projects/:id">) => {
+        try {
+          const released = await sessionManager.releaseProject(req.params.id);
+          if (!released.ok) {
+            return json({ error: released.error ?? "ERROR" }, errorStatus(released.error ?? ""));
+          }
+          const res = projectManager.deleteProject(req.params.id);
+          if (!res.ok) {
+            return json({ error: res.error ?? "ERROR" }, errorStatus(res.error ?? ""));
+          }
+          notifyDataChanged();
+          return json({ ok: true });
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+    },
+
+    "/api/fs": {
+      GET: (req: Request) => {
+        try {
+          const url = new URL(req.url);
+          const res = projectManager.listDirectory(url.searchParams.get("path") ?? "");
+          if (!res.ok) return json({ error: res.error }, errorStatus(res.error));
+          return json({ entries: res.data.entries });
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+    },
+
+    // ---- Daftar model yang tersedia pada server headless Project ----
+    "/api/projects/:id/models": {
+      GET: async (req: BunRequest<"/api/projects/:id/models">) => {
+        try {
+          const res = await sessionManager.listModels(req.params.id, agentTypeParam(req));
+          if (!res.ok) return json({ error: res.error }, errorStatus(res.error));
+          return json({ models: res.data });
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+    },
+
+    // ---- MCP server & skill Project (panel samping halaman Project) ----
+    "/api/projects/:id/mcp": {
+      GET: async (req: BunRequest<"/api/projects/:id/mcp">) => {
+        try {
+          const res = await sessionManager.listMcp(req.params.id, agentTypeParam(req));
+          if (!res.ok) return json({ error: res.error }, errorStatus(res.error));
+          return json({ mcp: res.data });
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+    },
+
+    "/api/projects/:id/skills": {
+      GET: async (req: BunRequest<"/api/projects/:id/skills">) => {
+        try {
+          const res = await sessionManager.listSkills(req.params.id, agentTypeParam(req));
+          if (!res.ok) return json({ error: res.error }, errorStatus(res.error));
+          return json({ skills: res.data });
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+    },
+
+    // ---- Agent (mode) opencode: build/plan + agent kustom user ----
+    "/api/projects/:id/agents": {
+      GET: async (req: BunRequest<"/api/projects/:id/agents">) => {
+        try {
+          const res = await sessionManager.listAgents(req.params.id, agentTypeParam(req));
+          if (!res.ok) return json({ error: res.error }, errorStatus(res.error));
+          return json({ agents: res.data });
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+    },
+  };
+}

package/src/server/routes/sessions.routes.ts

@@ -0,0 +1,197 @@
+/**
+ * Tabel rute API Session (Requirement 1, 4): daftar/buat, hapus/resume/ganti
+ * model, stop, cari file (`@file`), dan upload lampiran gambar. Dipasang
+ * composition root (`app.ts`) — pola kcgcode (`*.routes.ts`).
+ */
+import type { BunRequest } from "bun";
+import type { AgentType } from "../../types";
+import { errorStatus, json, parseModelBody, readJson, serverError } from "./helpers";
+import type { ApiRouteContext } from "./types";
+
+export function sessionsRoutes(ctx: ApiRouteContext) {
+  const { sessionManager, attachments, notifyDataChanged } = ctx;
+  return {
+    // ---- Session (Requirement 1, 4) ----
+    "/api/sessions": {
+      GET: () => {
+        try {
+          return json({ sessions: sessionManager.listSessions() });
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+      POST: async (req: Request) => {
+        try {
+          const body = await readJson(req);
+          if (!body.ok) return json({ error: "INVALID_JSON" }, 400);
+          const { agentType, projectId, model, agent } = body.data as {
+            agentType?: unknown;
+            projectId?: unknown;
+            model?: unknown;
+            agent?: unknown;
+          };
+          const res = await sessionManager.createSession({
+            agentType: (typeof agentType === "string" ? agentType : "") as AgentType,
+            projectId: typeof projectId === "string" ? projectId : "",
+            model: parseModelBody(model),
+            agent: typeof agent === "string" && agent.trim() !== "" ? agent.trim() : null,
+          });
+          if (!res.ok) return json({ error: res.error }, errorStatus(res.error));
+          notifyDataChanged();
+          return json({ session: res.session }, 201);
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+    },
+
+    "/api/sessions/:id": {
+      /**
+       * Hapus Session permanen — juga menghapus session (dan riwayat
+       * pesannya) di server headless opencode: server di-spawn ulang bila
+       * mati agar data remote tidak tertinggal. Server tak bisa hidup /
+       * menolak hapus -> 5xx, data lokal utuh.
+       */
+      DELETE: async (req: BunRequest<"/api/sessions/:id">) => {
+        try {
+          const res = await sessionManager.deleteSession(req.params.id);
+          if (!res.ok) {
+            return json({ error: res.error ?? "ERROR" }, errorStatus(res.error ?? ""));
+          }
+          notifyDataChanged();
+          return json({ ok: true });
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+      /**
+       * Resume Session yang stopped/crashed (tombol "Start" di UI).
+       * Memakai ocSessionId lama bila masih dikenal server headless;
+       * bila tidak, sesi remote baru dibuat & disimpan ke Session.
+       */
+      POST: async (req: BunRequest<"/api/sessions/:id">) => {
+        try {
+          const res = await sessionManager.resumeSession(req.params.id);
+          if (!res.ok) {
+            return json({ error: res.error ?? "ERROR" }, errorStatus(res.error ?? ""));
+          }
+          const cur = sessionManager.getSession(req.params.id);
+          return json({ session: cur.ok ? cur.data : undefined, ok: true });
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+      /**
+       * Ganti model dan/atau agent (mode) pilihan Session — body
+       * `{ model: {providerID, modelID} | null, agent: string | null }`.
+       * `null` mengembalikan ke default opencode. Berlaku pada prompt
+       * berikutnya tanpa perlu restart Session.
+       */
+      PUT: async (req: BunRequest<"/api/sessions/:id">) => {
+        try {
+          const body = await readJson(req);
+          if (!body.ok) return json({ error: "INVALID_JSON" }, 400);
+          const { model: rawModel, agent: rawAgent } = body.data as {
+            model?: unknown;
+            agent?: unknown;
+          };
+          if (rawModel !== undefined) {
+            const model = rawModel === null ? null : parseModelBody(rawModel);
+            const res = sessionManager.setSessionModel(req.params.id, model);
+            if (!res.ok) {
+              return json({ error: res.error ?? "ERROR" }, errorStatus(res.error ?? ""));
+            }
+          }
+          if (rawAgent !== undefined) {
+            const agent =
+              typeof rawAgent === "string" && rawAgent.trim() !== "" ? rawAgent.trim() : null;
+            const res = sessionManager.setSessionAgent(req.params.id, agent);
+            if (!res.ok) {
+              return json({ error: res.error ?? "ERROR" }, errorStatus(res.error ?? ""));
+            }
+          }
+          const cur = sessionManager.getSession(req.params.id);
+          return json({ session: cur.ok ? cur.data : undefined, ok: true });
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+    },
+
+    // ---- Cari file Project (autocomplete referensi @file di composer) ----
+    "/api/sessions/:id/files": {
+      GET: async (req: BunRequest<"/api/sessions/:id/files">) => {
+        try {
+          const url = new URL(req.url);
+          const query = (url.searchParams.get("q") ?? "").slice(0, 200);
+          const cur = sessionManager.getSession(req.params.id);
+          if (!cur.ok)
+            return json({ error: "SESSION_NOT_FOUND" }, errorStatus("SESSION_NOT_FOUND"));
+          const res = await sessionManager.findFiles(cur.data.projectId, query, cur.data.agentType);
+          if (!res.ok) return json({ error: res.error }, errorStatus(res.error));
+          return json({ files: res.data });
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+    },
+
+    // ---- Konteks kerja Session (panel kanan: Environment / Task list) ----
+    "/api/sessions/:id/context": {
+      GET: async (req: BunRequest<"/api/sessions/:id/context">) => {
+        try {
+          const res = await sessionManager.sessionContext(req.params.id);
+          if (!res.ok) return json({ error: res.error }, errorStatus(res.error));
+          return json({ context: res.data });
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+    },
+
+    // ---- Lampiran gambar upload dari perangkat ----
+    "/api/sessions/:id/uploads": {
+      /**
+       * Simpan gambar upload ke Attachment_Store Session. Body multipart
+       * `file` (nama+mime+bytes). Ukuran & format divalidasi server.
+       */
+      POST: async (req: BunRequest<"/api/sessions/:id/uploads">) => {
+        try {
+          const cur = sessionManager.getSession(req.params.id);
+          if (!cur.ok) return json({ error: "SESSION_NOT_FOUND" }, 404);
+          let form: FormData;
+          try {
+            form = await req.formData();
+          } catch {
+            return json({ error: "INVALID_UPLOAD" }, 400);
+          }
+          const file = form.get("file");
+          if (!(file instanceof File)) {
+            return json({ error: "INVALID_UPLOAD" }, 400);
+          }
+          const bytes = new Uint8Array(await file.arrayBuffer());
+          const res = attachments.save(req.params.id, file.name, file.type, bytes);
+          if (!res.ok) return json({ error: res.error }, errorStatus(res.error));
+          return json({ upload: res.data }, 201);
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+    },
+
+    // ---- Stop Session (abort turn + status stopped, data tetap ada) ----
+    "/api/sessions/:id/stop": {
+      POST: (req: BunRequest<"/api/sessions/:id/stop">) => {
+        try {
+          const res = sessionManager.stopSession(req.params.id);
+          if (!res.ok) {
+            return json({ error: res.error ?? "ERROR" }, errorStatus(res.error ?? ""));
+          }
+          return json({ ok: true });
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+    },
+  };
+}

package/src/server/routes/skills.routes.ts

@@ -0,0 +1,136 @@
+/**
+ * Tabel rute API katalog & instalasi skill (skills.sh).
+ *
+ * - `GET  /api/skills/search?q=` — cari skill di skills.sh (proxy + cache).
+ * - `GET  /api/skills/audit?source=&skill=` — hasil audit keamanan skill.
+ * - `POST /api/projects/:id/skills/install` `{ source, skill, agents? }` —
+ *   mulai job instalasi (202 + job) untuk satu atau beberapa agent
+ *   (`opencode` default, `claude-code`). CLI `skills` berjalan di latar.
+ * - `GET  /api/skills/installs` — job berjalan & yang baru selesai.
+ * - `GET  /api/skills/installs/:jobId?from=<n>` — status job + baris log
+ *   mulai indeks `n` (polling bertahap untuk output live).
+ * - `POST /api/skills/installs/:jobId/cancel` — batalkan job berjalan.
+ *
+ * Daftar skill terpasang tetap lewat `GET /api/projects/:id/skills?agent=`
+ * di `projects.routes.ts`.
+ */
+import type { BunRequest } from "bun";
+import type { AgentType } from "../../types";
+import { errorStatus, json, readJson, serverError } from "./helpers";
+import type { ApiRouteContext } from "./types";
+
+const INSTALL_AGENTS: readonly AgentType[] = ["opencode", "claude-code"];
+
+/** `agents` body -> daftar unik terurut; `null` bila tidak valid / kosong. */
+function parseInstallAgents(raw: unknown): AgentType[] | null {
+  if (raw === undefined) return ["opencode"];
+  if (!Array.isArray(raw) || raw.length === 0) return null;
+  if (!raw.every((a) => INSTALL_AGENTS.includes(a as AgentType))) return null;
+  return INSTALL_AGENTS.filter((a) => raw.includes(a));
+}
+
+export function skillsRoutes(ctx: ApiRouteContext) {
+  const { projectManager, skillsRegistry, skillInstalls } = ctx;
+  return {
+    "/api/skills/search": {
+      GET: async (req: Request) => {
+        try {
+          const q = new URL(req.url).searchParams.get("q") ?? "";
+          const res = await skillsRegistry.search(q);
+          if (!res.ok) return json({ error: res.error }, errorStatus(res.error));
+          return json({ skills: res.data });
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+    },
+
+    "/api/skills/audit": {
+      GET: async (req: Request) => {
+        try {
+          const params = new URL(req.url).searchParams;
+          const res = await skillsRegistry.audit(
+            params.get("source") ?? "",
+            params.get("skill") ?? "",
+          );
+          if (!res.ok) return json({ error: res.error }, errorStatus(res.error));
+          return json({ audit: res.data });
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+    },
+
+    "/api/projects/:id/skills/install": {
+      POST: async (req: BunRequest<"/api/projects/:id/skills/install">) => {
+        try {
+          const body = await readJson(req);
+          if (!body.ok) return json({ error: "INVALID_JSON" }, 400);
+          const { source, skill, agents } = (body.data ?? {}) as {
+            source?: unknown;
+            skill?: unknown;
+            agents?: unknown;
+          };
+          if (typeof source !== "string" || typeof skill !== "string") {
+            return json({ error: "INVALID_SKILL_ID" }, 400);
+          }
+          const agentTypes = parseInstallAgents(agents);
+          if (agentTypes === null) return json({ error: "UNSUPPORTED_AGENT_TYPE" }, 400);
+          const project = projectManager.getProject(req.params.id);
+          if (!project.ok) return json({ error: project.error }, errorStatus(project.error));
+
+          const job = skillInstalls.start({
+            projectId: project.data.id,
+            projectName: project.data.name,
+            projectPath: project.data.path,
+            source,
+            skillId: skill,
+            agentTypes,
+          });
+          if (!job.ok) return json({ error: job.error }, errorStatus(job.error));
+          return json({ job: job.data }, 202);
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+    },
+
+    "/api/skills/installs": {
+      GET: () => {
+        try {
+          return json({ jobs: skillInstalls.list() });
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+    },
+
+    "/api/skills/installs/:jobId": {
+      GET: (req: BunRequest<"/api/skills/installs/:jobId">) => {
+        try {
+          const from = Number(new URL(req.url).searchParams.get("from") ?? "0");
+          const log = skillInstalls.get(req.params.jobId, Number.isFinite(from) ? from : 0);
+          if (!log) return json({ error: "INSTALL_JOB_NOT_FOUND" }, 404);
+          return json(log);
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+    },
+
+    "/api/skills/installs/:jobId/cancel": {
+      POST: (req: BunRequest<"/api/skills/installs/:jobId/cancel">) => {
+        try {
+          const log = skillInstalls.get(req.params.jobId);
+          if (!log) return json({ error: "INSTALL_JOB_NOT_FOUND" }, 404);
+          if (!skillInstalls.cancel(req.params.jobId)) {
+            return json({ error: "INSTALL_JOB_NOT_RUNNING" }, 409);
+          }
+          return json({ ok: true }, 202);
+        } catch (e) {
+          return serverError(e);
+        }
+      },
+    },
+  };
+}