loom-agent 1.2.0

package/src/skills/skill-matcher.js

@@ -0,0 +1,133 @@
+// Skill matcher — Phase 2.2. Finds installed skills whose keywords overlap with
+// the user's current message. Cheap: zero model calls, pure heuristics on
+// frontmatter + skill dir names + file-type keywords.
+//
+// The idea: a skill is "triggered" when its name, filename, or description
+// mentions a token in the message (normalized to lowercase, word-boundary).
+// The list is deterministic and sorted by match count (strongest first).
+const fs = require('fs');
+const path = require('path');
+const { listSkills } = require('./skills-manager');
+
+// Keyword aliases: user-typed word -> keyword that matches in the skill name/description.
+const KEYWORD_ALIASES = {
+  gcode: ['gcode', 'slice', 'slicer', 'print', 'fdm', '3d print'],
+  cad: ['cad', '3d', 'step', 'stp', 'dxf', 'stl', 'glb', 'parametric', 'model'],
+  bambulab: ['bambu', 'print', 'prusa', 'lan', '3d print'],
+  sring: ['srdf', 'urdf', 'robot', 'ros', 'gazebo', 'joint', 'link', 'moveit'],
+  gcodeviewer: ['gcode', 'slice', 'viewer'],
+  stepviewer: ['step', 'stp', 'cad', 'viewer'],
+  stlviewer: ['stl', '3d', 'viewer'],
+  payment: ['payment', 'pay', 'checkout', 'stripe', 'sepay', 'license', 'billing'],
+  theme: ['theme', 'color scheme', 'palette', 'dark', 'light'],
+};
+
+function normalizeWord(w) {
+  return w.toLowerCase().replace(/[^a-z0-9._-]/g, '');
+}
+
+function buildAliasMap() {
+  const aliases = {};
+  for (const [skillName, keywords] of Object.entries(KEYWORD_ALIASES)) {
+    for (const kw of keywords) {
+      if (!aliases[kw]) aliases[kw] = new Set();
+      aliases[kw].add(skillName);
+    }
+  }
+  // also map aliases for dir names
+  for (const [skillName, keywords] of Object.entries(KEYWORD_ALIASES)) {
+    const dir = skillName;
+    for (const kw of keywords) {
+      if (!aliases[kw]) aliases[kw] = new Set();
+      aliases[kw].add(dir);
+    }
+  }
+  return aliases;
+}
+
+const ALIASES = buildAliasMap();
+
+// Split the user message into normalized "words" (strip punctuation, lowercase,
+// split on whitespace). Common stop words are dropped so "a" or "this" can't trigger.
+const STOP_WORDS = new Set(['a', 'an', 'the', 'this', 'that', 'these', 'those', 'i', 'you', 'he', 'she', 'we', 'they', 'it', 'to', 'in', 'on', 'at', 'for', 'with', 'and', 'or', 'of', 'is', 'are', 'be', 'my', 'me', 'your', 'that\'s', 'i\'m', 'how', 'what', 'why', 'when', 'where', 'show', 'tell', 'please', 'can', 'do', 'does', 'will', 'need', 'want', 'make', 'use', 'get']);
+
+function tokenize(text) {
+  if (!text) return [];
+  return String(text)
+    .split(/\s+/)
+    .map(normalizeWord)
+    .filter((w) => w.length >= 3 && !STOP_WORDS.has(w));
+}
+
+// Score a single skill against a word list. Higher = stronger match.
+function scoreSkill(skill, wordSet) {
+  const name = String(skill.name || '').toLowerCase();
+  const desc = String(skill.description || '').toLowerCase();
+  const dirName = path.basename(String(skill.dir || '')).toLowerCase();
+  const haystack = name + ' ' + desc + ' ' + dirName;
+  let score = 0;
+  let matched = [];
+  for (const w of wordSet) {
+    // direct containment check (substring covers plurals: "slicing" contains "slice")
+    if (haystack.includes(w)) {
+      score += 1;
+      matched.push(w);
+      continue;
+    }
+    // alias-word -> skill matches via alias expansion
+    if (ALIASES[w]) {
+      for (const alias of ALIASES[w]) {
+        if (haystack.includes(alias)) {
+          score += 1.5; // alias match > generic word
+          matched.push(`${w}→${alias}`);
+          break;
+        }
+      }
+    }
+  }
+  if (score === 0) return null;
+  return { skill, score, matched };
+}
+
+// Cache SKILL.md instructions keyed by dir path (with mtime invalidation) so we
+// only re-read when the file changes.
+const _instrCache = new Map();
+function loadInstructions(dir) {
+  try {
+    const key = String(dir);
+    const p = path.join(dir, 'SKILL.md');
+    const stat = fs.statSync(p);
+    const mtime = stat.mtimeMs;
+    const cached = _instrCache.get(key);
+    if (cached && cached.mtime === mtime) return cached.instructions;
+    const instructions = fs.readFileSync(p, 'utf8').slice(0, 8000);
+    _instrCache.set(key, { mtime, instructions });
+    return instructions;
+  } catch { return ''; }
+}
+
+// Return the top-N triggered skills for a user message.
+// `skillsList` can inject a fake set for testing.
+function match(message, skillsList) {
+  const words = tokenize(message);
+  const wordSet = new Set(words);
+  const skills = skillsList || listSkills();
+  const out = [];
+  for (const s of skills) {
+    const hit = scoreSkill(s, wordSet);
+    if (!hit) continue;
+    // Require at least 2 matching words to avoid spurious one-word triggers like "print"
+    if (hit.score < 2) continue;
+    out.push(hit);
+  }
+  out.sort((a, b) => b.score - a.score);
+  // Attach the full SKILL.md instructions to each winner so the session can
+  // inject them into the system prompt. Lazy-load + mtime-cache per dir.
+  const top = out.slice(0, 3);
+  for (const hit of top) {
+    if (hit.skill.instructions === undefined) hit.skill.instructions = loadInstructions(hit.skill.dir);
+  }
+  return top.map((h) => h.skill);
+}
+
+module.exports = { match, tokenize, scoreSkill };

package/src/skills/skills-manager.js

@@ -0,0 +1,213 @@
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const { execSync } = require('child_process');
+
+function validateUrl(url) {
+  try {
+    const u = new URL(url);
+    if (!['git:', 'http:', 'https:'].includes(u.protocol)) return false;
+    return true;
+  } catch { return false; }
+}
+
+const LOOM_DIR = path.join(os.homedir(), '.loom');
+
+function globalSkillsDir() {
+  return path.join(process.env.LOOM_CONFIG_DIR || LOOM_DIR, 'skills');
+}
+
+// Third-party agent skills installed elsewhere on the machine (read-only):
+// skills the user already has in ~/.agents/skills show up in the browser and
+// can be toggled, but install/remove always target ~/.loom/skills.
+function agentsSkillsDir() {
+  return path.join(process.env.LOOM_AGENTS_DIR || os.homedir(), '.agents', 'skills');
+}
+
+function trustFile() {
+  return path.join(process.env.LOOM_CONFIG_DIR || LOOM_DIR, 'skills-trust.json');
+}
+
+function loadTrust() {
+  try {
+    return JSON.parse(fs.readFileSync(trustFile(), 'utf8')) || {};
+  } catch {
+    return {};
+  }
+}
+
+function saveTrust(trust) {
+  fs.mkdirSync(path.dirname(trustFile()), { recursive: true });
+  fs.writeFileSync(trustFile(), JSON.stringify(trust, null, 2));
+}
+
+// Remote skills are injected into the system prompt and their instructions run
+// with full tool access, so the first install from a source must be explicitly
+// approved and the approval is pinned to the exact commit that was reviewed.
+// Re-installing the same URL with different content requires re-approval.
+const defaultGit = {
+  clone(url, tmp) {
+    execSync('git clone --depth 1 ' + url + ' ' + tmp, { stdio: 'ignore', windowsHide: true });
+  },
+  revParse(tmp) {
+    return execSync('git -C ' + tmp + ' rev-parse HEAD', { encoding: 'utf8', windowsHide: true }).trim();
+  },
+};
+
+function projectSkillsDir() {
+  return path.join(process.cwd(), '.loom', 'skills');
+}
+
+function skillDirs() {
+  const dirs = [globalSkillsDir(), agentsSkillsDir(), projectSkillsDir()];
+  const seen = new Set();
+  const out = [];
+  for (const d of dirs) {
+    if (seen.has(d)) continue;
+    seen.add(d);
+    if (fs.existsSync(d)) out.push(d);
+  }
+  return out;
+}
+
+function parseFrontmatter(text) {
+  const nameMatch = text.match(/^name:\s*(.+)$/m);
+  const descMatch = text.match(/^description:\s*(.+)$/m);
+  return {
+    name: nameMatch ? nameMatch[1].trim() : null,
+    description: descMatch ? descMatch[1].trim() : '',
+  };
+}
+
+function listSkills() {
+  const found = [];
+  for (const dir of skillDirs()) {
+    let entries;
+    try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { continue; }
+    for (const e of entries) {
+      if (!e.isDirectory()) continue;
+      const skillMd = path.join(dir, e.name, 'SKILL.md');
+      if (!fs.existsSync(skillMd)) continue;
+      let raw = '';
+      try { raw = fs.readFileSync(skillMd, 'utf8').slice(0, 4000); } catch { continue; }
+      const meta = parseFrontmatter(raw);
+      found.push({
+        name: meta.name || e.name,
+        dir: path.join(dir, e.name),
+        description: meta.description || '(no description)',
+        source: dir === globalSkillsDir() ? 'global' : (dir === agentsSkillsDir() ? 'agents' : 'project'),
+      });
+    }
+  }
+  return found;
+}
+
+function isInstalled(name) {
+  return listSkills().some((s) => s.name === name || path.basename(s.dir) === name);
+}
+
+function installFrom(srcDir, targetName) {
+  const src = path.resolve(srcDir);
+  if (!fs.existsSync(path.join(src, 'SKILL.md'))) {
+    return { error: `No SKILL.md in ${src}` };
+  }
+  const name = targetName || path.basename(src);
+  const dest = path.join(globalSkillsDir(), name);
+  if (fs.existsSync(dest)) {
+    fs.rmSync(dest, { recursive: true, force: true });
+  }
+  fs.mkdirSync(path.dirname(dest), { recursive: true });
+  fs.cpSync(src, dest, { recursive: true });
+  return { installed: true, name: name, dir: dest };
+}
+
+function findSkillIn(root) {
+  const candidates = [path.join(root, 'SKILL.md')];
+  const subs = ['skill', 'skills', '.loom/skills', 'packages'];
+  for (const sub of subs) candidates.push(path.join(root, sub, 'SKILL.md'));
+  const existing = candidates.find((c) => fs.existsSync(c));
+  if (existing) return path.dirname(existing);
+  for (const name of fs.readdirSync(root, { withFileTypes: true })) {
+    if (!name.isDirectory()) continue;
+    const p = path.join(root, name.name, 'SKILL.md');
+    if (fs.existsSync(p)) return path.dirname(p);
+  }
+  return root;
+}
+
+function cloneFromGit(url, targetName, opts, git) {
+  if (!validateUrl(url)) throw new Error(`Invalid git URL: ${url}`);
+  const base = url.split('/').pop().replace(/\.git$/, '');
+  const name = targetName || base;
+  const tmp = path.join(os.tmpdir(), 'loom-skill-' + Date.now());
+  const impl = git || defaultGit;
+  try {
+    impl.clone(url, tmp);
+    const commit = impl.revParse(tmp);
+    const trust = loadTrust();
+    const record = trust[url];
+    // A string trust value is an approval bound to one specific commit (the
+    // one the user was shown). If HEAD moved since, refuse — re-review needed.
+    if (typeof opts.trust === 'string' && opts.trust !== commit) {
+      return {
+        error: 'Remote content changed since it was presented for approval',
+        trustRequired: { url, commit, previous: opts.trust },
+      };
+    }
+    if (!opts || !opts.trust) {
+      if (!record) {
+        return {
+          error: 'Untrusted remote skill: ' + url,
+          trustRequired: { url, commit },
+        };
+      }
+      if (record.commit !== commit) {
+        return {
+          error: 'Skill content changed since it was approved',
+          trustRequired: { url, commit, previous: record.commit, approvedAt: record.approvedAt },
+        };
+      }
+    }
+    const found = findSkillIn(tmp);
+    const res = installFrom(found, name);
+    if (res.error) return res;
+    trust[url] = { commit, approvedAt: new Date().toISOString() };
+    saveTrust(trust);
+    return res;
+  } finally {
+    if (fs.existsSync(tmp)) fs.rmSync(tmp, { recursive: true, force: true });
+  }
+}
+
+function installSkill(name, targetName, opts, git) {
+  if (!fs.existsSync(globalSkillsDir())) fs.mkdirSync(globalSkillsDir(), { recursive: true });
+  let src = name;
+  if (src.startsWith('file:')) src = src.slice(5);
+  if (src.startsWith('git') || src.startsWith('http')) {
+    return cloneFromGit(src, targetName, opts, git);
+  }
+  const found = findSkillIn(path.resolve(src));
+  return installFrom(found, targetName || path.basename(path.resolve(src)));
+}
+
+function removeSkill(name) {
+  // Only ~/.loom/skills is writable; agents-dir and project-dir skills are
+  // read-only and must never be deleted from here.
+  const p = path.join(globalSkillsDir(), name);
+  if (fs.existsSync(p)) {
+    fs.rmSync(p, { recursive: true, force: true });
+    return { removed: p };
+  }
+  return { error: 'Skill not installed: ' + name };
+}
+
+module.exports = {
+  listSkills,
+  isInstalled,
+  installSkill,
+  installFrom,
+  removeSkill,
+  globalSkillsDir,
+  agentsSkillsDir,
+  projectSkillsDir,
+};