mulmoclaude 0.6.2 → 0.6.4

package/server/api/routes/skills.ts

@@ -15,6 +15,20 @@
 import { Router, Request, Response } from "express";
 import { deleteProjectSkill, discoverSkills, saveProjectSkill, updateProjectSkill } from "../../workspace/skills/index.js";
 import type { Skill, SkillSummary } from "../../workspace/skills/index.js";
+import {
+  isCatalogSource,
+  listCatalogEntries,
+  readCatalogEntryDetail,
+  readExternalDetailAsCatalog,
+  starCatalogEntry,
+  starExternalAsCatalog,
+  type CatalogEntry,
+  type CatalogEntryDetail,
+  type CatalogDetailResult,
+  type StarResult,
+} from "../../workspace/skills/catalog.js";
+import { installExternalRepo, listInstalledRepos, uninstallExternalRepo, type InstalledRepo } from "../../workspace/skills/external/install.js";
+import { EXTERNAL_PRESETS, type ExternalPresetSuggestion } from "../../workspace/skills/external/presets.js";
 import { workspacePath } from "../../workspace/workspace.js";
 import { API_ROUTES } from "../../../src/config/apiRoutes.js";
 import { bindRoute } from "../../utils/router.js";
@@ -65,6 +79,255 @@ bindRoute(router, API_ROUTES.skills.list, async (_req: Request, res: Response<Sk
   });
 });
 
+// Catalog endpoints (#1335 PR-B). Reads from
+// `<workspace>/data/skills/catalog/<source>/<slug>/` (populated by
+// `syncPresetSkills`); the star endpoint copies catalog entries
+// into `.claude/skills/<slug>/` so Claude Code's discovery picks
+// them up. Catalog entries themselves are NOT in `.claude/skills/`
+// by design — that's the prompt-bloat fix from #1335.
+//
+// Route ordering matters: these `/catalog*` routes register
+// BEFORE `GET /:name` below because Express matches in
+// registration order. A request for `/catalog` would otherwise
+// land in the detail handler with `req.params.name = "catalog"`
+// and 404. Keep all `/catalog*` specifics ahead of any `:name`
+// parameter route in this file.
+
+interface CatalogListResponse {
+  entries: CatalogEntry[];
+}
+
+interface StarResponse {
+  starred: true;
+  slug: string;
+}
+
+bindRoute(router, API_ROUTES.skills.catalogList, async (_req: Request, res: Response<CatalogListResponse>) => {
+  const entries = await listCatalogEntries();
+  log.info("skills", "catalog list: ok", { count: entries.length });
+  res.json({ entries });
+});
+
+interface CatalogPreviewQuery {
+  source?: unknown;
+  slug?: unknown;
+  /** External-source only — repoId + skillFolder identify the entry
+   *  in place of `slug`. */
+  repoId?: unknown;
+  skillFolder?: unknown;
+}
+
+interface CatalogPreviewResponse {
+  detail: CatalogEntryDetail;
+}
+
+function previewResponse(result: CatalogDetailResult, source: string, ident: string, res: Response<CatalogPreviewResponse | ErrorResponse>): void {
+  if (result.kind === "ok") {
+    log.info("skills", "catalog preview: ok", { source, slug: result.detail.slug });
+    res.json({ detail: result.detail });
+    return;
+  }
+  if (result.kind === "not-found") {
+    log.warn("skills", "catalog preview: not found", { source, ident });
+    notFound(res, `catalog entry not found: ${result.source}/${result.slug}`);
+    return;
+  }
+  log.warn("skills", "catalog preview: invalid slug", { ident });
+  badRequest(res, `invalid slug: ${result.slug}`);
+}
+
+bindRoute(
+  router,
+  API_ROUTES.skills.catalogPreview,
+  async (req: Request<object, unknown, unknown, CatalogPreviewQuery>, res: Response<CatalogPreviewResponse | ErrorResponse>) => {
+    const { source, slug, repoId, skillFolder } = req.query;
+    if (!isCatalogSource(source)) {
+      badRequest(res, "source must be a known catalog source");
+      return;
+    }
+    if (source === "external") {
+      if (typeof repoId !== "string" || repoId.length === 0 || typeof skillFolder !== "string" || skillFolder.length === 0) {
+        badRequest(res, "repoId and skillFolder are required for external preview");
+        return;
+      }
+      const result = await readExternalDetailAsCatalog(repoId, skillFolder);
+      previewResponse(result, source, `${repoId}/${skillFolder}`, res);
+      return;
+    }
+    if (typeof slug !== "string" || slug.length === 0) {
+      badRequest(res, "slug is required");
+      return;
+    }
+    const result = await readCatalogEntryDetail(source, slug);
+    previewResponse(result, source, slug, res);
+  },
+);
+
+function starResponse(result: StarResult, source: string, ident: string, res: Response<StarResponse | ErrorResponse>): void {
+  if (result.kind === "starred") {
+    log.info("skills", "catalog star: ok", { source, slug: result.slug });
+    res.json({ starred: true, slug: result.slug });
+    return;
+  }
+  if (result.kind === "already-active") {
+    log.info("skills", "catalog star: already-active", { source, slug: result.slug });
+    conflict(res, `skill "${result.slug}" is already active`);
+    return;
+  }
+  if (result.kind === "not-found") {
+    log.warn("skills", "catalog star: not found", { source, ident });
+    notFound(res, `catalog entry not found: ${result.source}/${result.slug}`);
+    return;
+  }
+  log.warn("skills", "catalog star: invalid slug", { ident });
+  badRequest(res, `invalid slug: ${result.slug}`);
+}
+
+interface ExternalStarBody {
+  source?: unknown;
+  repoId?: unknown;
+  skillFolder?: unknown;
+  slug?: unknown;
+}
+
+bindRoute(router, API_ROUTES.skills.catalogStar, async (req: Request<object, unknown, ExternalStarBody>, res: Response<StarResponse | ErrorResponse>) => {
+  const { source, slug, repoId, skillFolder } = req.body;
+  if (!isCatalogSource(source)) {
+    badRequest(res, "source must be a known catalog source");
+    return;
+  }
+  if (source === "external") {
+    if (typeof repoId !== "string" || repoId.length === 0 || typeof skillFolder !== "string" || skillFolder.length === 0) {
+      badRequest(res, "repoId and skillFolder are required for external star");
+      return;
+    }
+    const result = await starExternalAsCatalog(repoId, skillFolder);
+    starResponse(result, source, `${repoId}/${skillFolder}`, res);
+    return;
+  }
+  if (typeof slug !== "string" || slug.length === 0) {
+    badRequest(res, "slug is required");
+    return;
+  }
+  const result = await starCatalogEntry(source, slug);
+  starResponse(result, source, slug, res);
+});
+
+// External-repo lifecycle endpoints (#1383 / #1335 PR-C). They live
+// under `/api/skills/external/*` so they sort cleanly alongside the
+// catalog endpoints AND register BEFORE the `/:name` detail handler
+// below. Express matches in registration order — a `:name` route
+// declared first would swallow `/external/...` as a skill named
+// "external".
+
+interface ExternalSuggestionsResponse {
+  suggestions: readonly ExternalPresetSuggestion[];
+}
+
+interface ExternalReposResponse {
+  repos: InstalledRepo[];
+}
+
+interface InstallRepoBody {
+  url?: unknown;
+  subpath?: unknown;
+  ref?: unknown;
+}
+
+interface InstallRepoResponse {
+  installed: true;
+  repoId: string;
+  url: string;
+  sha: string;
+  skillCount: number;
+}
+
+interface UninstallRepoResponse {
+  uninstalled: true;
+  repoId: string;
+}
+
+bindRoute(router, API_ROUTES.skills.externalSuggestions, (_req: Request, res: Response<ExternalSuggestionsResponse>) => {
+  res.json({ suggestions: EXTERNAL_PRESETS });
+});
+
+bindRoute(router, API_ROUTES.skills.externalReposList, async (_req: Request, res: Response<ExternalReposResponse>) => {
+  const repos = await listInstalledRepos();
+  log.info("skills", "external repos list: ok", { count: repos.length });
+  res.json({ repos });
+});
+
+bindRoute(
+  router,
+  API_ROUTES.skills.externalReposInstall,
+  async (req: Request<object, unknown, InstallRepoBody>, res: Response<InstallRepoResponse | ErrorResponse>) => {
+    const { url, subpath, ref } = req.body ?? {};
+    if (typeof url !== "string" || url.length === 0) {
+      badRequest(res, "url is required");
+      return;
+    }
+    if (subpath !== undefined && typeof subpath !== "string") {
+      badRequest(res, "subpath must be a string when provided");
+      return;
+    }
+    if (ref !== undefined && typeof ref !== "string") {
+      badRequest(res, "ref must be a string when provided");
+      return;
+    }
+    const result = await installExternalRepo({ url, subpath, ref });
+    if (result.kind === "installed") {
+      log.info("skills", "external install: ok", { repoId: result.detail.repoId, skillCount: result.detail.skillCount });
+      res.json({
+        installed: true,
+        repoId: result.detail.repoId,
+        url: result.detail.url,
+        sha: result.detail.sha,
+        skillCount: result.detail.skillCount,
+      });
+      return;
+    }
+    if (result.kind === "no-skills") {
+      log.warn("skills", "external install: no skills discovered", { repoId: result.repoId });
+      res.status(422).json({ error: `no SKILL.md found in repo (${result.repoId})` });
+      return;
+    }
+    if (result.kind === "invalid-url") {
+      log.warn("skills", "external install: invalid url", { url: result.url });
+      badRequest(res, "url must be a github.com HTTPS URL: https://github.com/<owner>/<repo>");
+      return;
+    }
+    if (result.kind === "invalid-subpath") {
+      log.warn("skills", "external install: invalid subpath", { subpath: result.subpath });
+      badRequest(res, "subpath must be a relative path with no '..', leading '/', or backslash segments");
+      return;
+    }
+    if (result.kind === "id-collision") {
+      log.warn("skills", "external install: repoId collision", { repoId: result.repoId, existingUrl: result.existingUrl });
+      conflict(res, `repo id "${result.repoId}" is already in use by ${result.existingUrl}. Uninstall it first if you intend to replace it.`);
+      return;
+    }
+    log.warn("skills", "external install: error", { reason: result.reason });
+    res.status(502).json({ error: `external install failed: ${result.reason}` });
+  },
+);
+
+bindRoute(router, API_ROUTES.skills.externalReposRemove, async (req: Request<{ repoId: string }>, res: Response<UninstallRepoResponse | ErrorResponse>) => {
+  const { repoId } = req.params;
+  const result = await uninstallExternalRepo(repoId);
+  if (result.kind === "uninstalled") {
+    log.info("skills", "external uninstall: ok", { repoId: result.repoId });
+    res.json({ uninstalled: true, repoId: result.repoId });
+    return;
+  }
+  if (result.kind === "not-found") {
+    log.warn("skills", "external uninstall: not found", { repoId: result.repoId });
+    notFound(res, `external repo not installed: ${result.repoId}`);
+    return;
+  }
+  log.warn("skills", "external uninstall: invalid repoId", { repoId: result.repoId });
+  badRequest(res, `invalid repoId: ${result.repoId}`);
+});
+
 bindRoute(router, API_ROUTES.skills.detail, async (req: Request<{ name: string }>, res: Response<SkillDetailResponse | ErrorResponse>) => {
   log.info("skills", "detail: start", { name: req.params.name });
   const skills = await discoverSkills({ workspaceRoot: workspacePath });

package/server/build/dispatcher.mjs

@@ -0,0 +1,299 @@
+#!/usr/bin/env node
+
+// server/workspace/hooks/shared/sidecar.ts
+import { readFileSync } from "node:fs";
+import path2 from "node:path";
+
+// server/utils/time.ts
+var ONE_SECOND_MS = 1e3;
+var ONE_MINUTE_MS = 6e4;
+var SUBPROCESS_PROBE_TIMEOUT_MS = 5 * ONE_SECOND_MS;
+var STARTUP_FAILURE_FORCE_EXIT_MS = 5 * ONE_SECOND_MS;
+var CLI_SUBPROCESS_TIMEOUT_MS = 5 * ONE_MINUTE_MS;
+
+// server/workspace/hooks/shared/workspace.ts
+import { homedir } from "node:os";
+import path from "node:path";
+function workspaceRoot() {
+  return process.env.CLAUDE_PROJECT_DIR ?? path.join(homedir(), "mulmoclaude");
+}
+
+// server/workspace/hooks/shared/sidecar.ts
+var TOKEN_FILE = ".session-token";
+var PORT_FILE = ".server-port";
+function serverHost() {
+  return process.env.MULMOCLAUDE_HOST ?? "127.0.0.1";
+}
+function readSidecar(rel) {
+  try {
+    return readFileSync(path2.join(workspaceRoot(), rel), "utf-8").trim();
+  } catch {
+    return "";
+  }
+}
+function readToken() {
+  return readSidecar(TOKEN_FILE);
+}
+function readPort() {
+  const raw = readSidecar(PORT_FILE);
+  if (!raw) return null;
+  const port = Number.parseInt(raw, 10);
+  return Number.isInteger(port) && port > 0 && port < 65536 ? port : null;
+}
+function buildAuthPost(pathname, body) {
+  const token = readToken();
+  const port = readPort();
+  if (!token || port === null) return null;
+  const headers = {
+    Authorization: `Bearer ${token}`
+  };
+  const init = { method: "POST", headers };
+  if (body !== void 0) {
+    headers["Content-Type"] = "application/json";
+    init.body = JSON.stringify(body);
+  }
+  return {
+    url: `http://${serverHost()}:${port}${pathname}`,
+    init
+  };
+}
+var DEFAULT_TIMEOUT_MS = 2 * ONE_SECOND_MS;
+async function safePost(req, timeoutMs = DEFAULT_TIMEOUT_MS) {
+  if (!req) return;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    await fetch(req.url, { ...req.init, signal: controller.signal });
+  } catch {
+  } finally {
+    clearTimeout(timer);
+  }
+}
+var LOG_TIMEOUT_MS = ONE_SECOND_MS;
+async function serverLog(namespace, message, options = {}) {
+  const body = {
+    namespace,
+    message,
+    level: options.level ?? "info",
+    ...options.data ? { data: options.data } : {}
+  };
+  const req = buildAuthPost("/api/hooks/log", body);
+  await safePost(req, LOG_TIMEOUT_MS);
+}
+
+// server/workspace/hooks/shared/stdin.ts
+async function readHookPayload() {
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+  }
+  const raw = Buffer.concat(chunks).toString("utf-8");
+  if (!raw.trim()) return null;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+function extractFilePath(payload) {
+  const fromInput = payload.tool_input?.file_path;
+  if (typeof fromInput === "string") return fromInput;
+  const fromResponse = payload.tool_response?.filePath;
+  if (typeof fromResponse === "string") return fromResponse;
+  return "";
+}
+function extractCommand(payload) {
+  const command = payload.tool_input?.command;
+  return typeof command === "string" ? command : "";
+}
+function extractToolName(payload) {
+  return typeof payload.tool_name === "string" ? payload.tool_name : "";
+}
+function extractSessionId(payload) {
+  const sessionId = payload.session_id;
+  return typeof sessionId === "string" && sessionId.length > 0 ? sessionId : void 0;
+}
+
+// server/workspace/hooks/handlers/configRefresh.ts
+var PATTERNS = [/[\\/]\.claude[\\/]skills[\\/][^\\/]+[\\/]SKILL\.md$/, /[\\/]config[\\/]scheduler[\\/]tasks\.json$/];
+async function handleConfigRefresh(payload) {
+  const tool = extractToolName(payload);
+  if (tool !== "Write" && tool !== "Edit") return;
+  const filePath = extractFilePath(payload);
+  if (!filePath) return;
+  if (!PATTERNS.some((pattern) => pattern.test(filePath))) return;
+  const req = buildAuthPost("/api/config/refresh");
+  await safePost(req);
+}
+
+// server/workspace/hooks/handlers/skillBridge.ts
+import { mkdirSync, readFileSync as readFileSync2, renameSync, rmSync, writeFileSync } from "node:fs";
+import path3 from "node:path";
+
+// server/utils/errors.ts
+function errorMessage(err, fallback) {
+  if (err instanceof Error) return err.message;
+  if (err !== null && typeof err === "object") {
+    const obj = err;
+    if (typeof obj.details === "string" && obj.details) return obj.details;
+    if (typeof obj.message === "string" && obj.message) return obj.message;
+  }
+  if (fallback !== void 0) return fallback;
+  return String(err);
+}
+
+// server/workspace/hooks/handlers/skillBridge.ts
+var DATA_SKILLS_DIR = path3.join("data", "skills");
+var CLAUDE_SKILLS_DIR = path3.join(".claude", "skills");
+var SKILL_FILENAME = "SKILL.md";
+var SLUG_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+var RM_RE = /^\s*rm\s+((?:-[a-zA-Z]+\s+)+)['"]?data\/skills\/([a-z0-9-]+)\/?['"]?\s*$/;
+var RECURSIVE_FLAG_RE = /[rR]/;
+function dataSkillDir(slug) {
+  return path3.join(workspaceRoot(), DATA_SKILLS_DIR, slug);
+}
+function dataSkillFilePath(slug) {
+  return path3.join(dataSkillDir(slug), SKILL_FILENAME);
+}
+function claudeSkillDir(slug) {
+  return path3.join(workspaceRoot(), CLAUDE_SKILLS_DIR, slug);
+}
+function claudeSkillFilePath(slug) {
+  return path3.join(claudeSkillDir(slug), SKILL_FILENAME);
+}
+function slugFromDataPath(filePath) {
+  const root = workspaceRoot();
+  const staging = path3.join(root, DATA_SKILLS_DIR);
+  const rel = path3.relative(staging, filePath);
+  if (!rel || rel.startsWith("..")) return null;
+  const segments = rel.split(path3.sep);
+  if (segments.length !== 2) return null;
+  const [slug, basename] = segments;
+  if (basename !== SKILL_FILENAME) return null;
+  return SLUG_RE.test(slug) ? slug : null;
+}
+function slugFromRmCommand(command) {
+  const match = RM_RE.exec(command);
+  if (!match) return null;
+  const [, flags, slug] = match;
+  if (!RECURSIVE_FLAG_RE.test(flags)) return null;
+  return SLUG_RE.test(slug) ? slug : null;
+}
+function mirrorWrite(slug) {
+  const content = readFileSync2(dataSkillFilePath(slug), "utf-8");
+  const destDir = claudeSkillDir(slug);
+  mkdirSync(destDir, { recursive: true });
+  const dest = claudeSkillFilePath(slug);
+  const tmp = path3.join(destDir, `.SKILL.md.${process.pid}.tmp`);
+  writeFileSync(tmp, content, "utf-8");
+  renameSync(tmp, dest);
+}
+function mirrorDelete(slug) {
+  rmSync(claudeSkillDir(slug), { recursive: true, force: true });
+}
+async function refreshConfig() {
+  await safePost(buildAuthPost("/api/config/refresh"));
+}
+async function handleWriteOrEdit(payload) {
+  const filePath = extractFilePath(payload);
+  if (!filePath) return;
+  const slug = slugFromDataPath(filePath);
+  if (slug === null) return;
+  try {
+    mirrorWrite(slug);
+    await refreshConfig();
+    await serverLog("skill-bridge", `mirrored ${dataSkillFilePath(slug)} \u2192 ${claudeSkillFilePath(slug)}`, { data: { slug, op: "write" } });
+  } catch (err) {
+    await serverLog("skill-bridge", `mirror write failed for slug=${slug}`, {
+      level: "error",
+      data: { slug, error: errorMessage(err) }
+    });
+  }
+}
+async function handleBash(payload) {
+  const command = extractCommand(payload);
+  if (!command) return;
+  const slug = slugFromRmCommand(command);
+  if (slug === null) return;
+  try {
+    mirrorDelete(slug);
+    await refreshConfig();
+    await serverLog("skill-bridge", `removed ${claudeSkillDir(slug)}`, { data: { slug, op: "delete" } });
+  } catch (err) {
+    await serverLog("skill-bridge", `mirror delete failed for slug=${slug}`, {
+      level: "error",
+      data: { slug, error: errorMessage(err) }
+    });
+  }
+}
+async function handleSkillBridge(payload) {
+  const tool = extractToolName(payload);
+  if (tool === "Write" || tool === "Edit") {
+    await handleWriteOrEdit(payload);
+    return;
+  }
+  if (tool === "Bash") {
+    await handleBash(payload);
+  }
+}
+
+// server/workspace/hooks/handlers/wikiSnapshot.ts
+import path5 from "node:path";
+
+// src/lib/wiki-page/paths.ts
+import path4 from "node:path";
+
+// src/lib/wiki-page/slug.ts
+function isSafeSlug(slug) {
+  if (slug.length === 0) return false;
+  if (slug === "." || slug === "..") return false;
+  if (slug.includes("/") || slug.includes("\\")) return false;
+  if (slug.includes("\0")) return false;
+  return true;
+}
+
+// src/lib/wiki-page/paths.ts
+function wikiSlugFromAbsPath(absPath, pagesDir) {
+  const rel = path4.relative(pagesDir, absPath);
+  if (rel.length === 0) return null;
+  if (path4.isAbsolute(rel)) return null;
+  if (rel.includes(path4.sep)) return null;
+  if (!rel.endsWith(".md")) return null;
+  const slug = rel.slice(0, -".md".length);
+  if (!isSafeSlug(slug)) return null;
+  return slug;
+}
+
+// server/workspace/hooks/handlers/wikiSnapshot.ts
+var WIKI_PAGES_REL = path5.join("data", "wiki", "pages");
+async function handleWikiSnapshot(payload) {
+  const tool = extractToolName(payload);
+  if (tool !== "Write" && tool !== "Edit") return;
+  const filePath = extractFilePath(payload);
+  if (!filePath) return;
+  const wikiPagesDir = path5.join(workspaceRoot(), WIKI_PAGES_REL);
+  const slug = wikiSlugFromAbsPath(filePath, wikiPagesDir);
+  if (slug === null) return;
+  const envChatSessionId = process.env.MULMOCLAUDE_CHAT_SESSION_ID;
+  const payloadSessionId = extractSessionId(payload);
+  const sessionId = envChatSessionId && envChatSessionId.length > 0 ? envChatSessionId : payloadSessionId;
+  const body = sessionId === void 0 ? { slug } : { slug, sessionId };
+  const req = buildAuthPost("/api/wiki/internal/snapshot", body);
+  await safePost(req);
+}
+
+// server/workspace/hooks/dispatcher.ts
+var HANDLERS = [handleWikiSnapshot, handleConfigRefresh, handleSkillBridge];
+async function runHandler(handler, payload) {
+  try {
+    await handler(payload);
+  } catch {
+  }
+}
+async function main() {
+  const payload = await readHookPayload();
+  if (!payload) return;
+  await Promise.all(HANDLERS.map((handler) => runHandler(handler, payload)));
+}
+main().catch(() => {
+});