mulmoterminal 8.3.0 → 8.4.0

package/README.md

@@ -1758,6 +1758,11 @@ narrow and tall for one record you are discussing — and each position keeps it
   each enabled plugin (skills shown as `plugin:skill`), and the `.claude/skills` of each folder a
   terminal has run in (folders with none are left out). A project skill with the same name as one
   of yours is marked as overriding it. The search (name, description or folder) narrows both lists.
+  Switch to **skills.sh** to search the public directory at [skills.sh](https://skills.sh) for
+  skills you do not have yet and read one before installing it: its `SKILL.md`, every file it would
+  bring, and a warning listing the files that can run code. Nothing is installed from the viewer —
+  it shows the `npx skills add …` line to copy and run yourself. Your search words go to skills.sh
+  only when you press **Search**.
 - **Grid of parallel sessions** — the ＋ Terminal / grid view runs many sessions at once,
   auto-sizing by count across pages. Cell borders signal state at a glance — **working**
   (pulsing blue), **blocked** (amber — needs a permission / answer), **done** (blue —

package/blueprints/local/checks/dev-proxy.mjs

@@ -0,0 +1,31 @@
+// Resolves the app's own Vite config through the app's own Vite, plugins included, as `yarn dev` would, and holds its proxy to
+// devProxyRules.mjs. Prints each problem and exits 1 when there is any; an app without a Vite config has no proxy. The
+// config is looked for at the root and in client/, where the scaffold keeps the screens.
+import { existsSync } from "node:fs";
+import { createRequire } from "node:module";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { proxyProblems } from "./devProxyRules.mjs";
+
+const CONFIG_NAMES = ["vite.config.ts", "vite.config.mts", "vite.config.cts", "vite.config.js", "vite.config.mjs", "vite.config.cjs"];
+const CONFIG_DIRS = [".", "client"];
+const configFiles = CONFIG_DIRS.flatMap((dir) => CONFIG_NAMES.map((name) => path.resolve(dir, name))).filter((file) => existsSync(file));
+if (configFiles.length === 0) process.exit(0);
+
+let vite;
+try {
+  vite = await import(pathToFileURL(createRequire(path.resolve("package.json")).resolve("vite")).href);
+} catch (error) {
+  console.error(`could not load this app's vite to read its config: ${error instanceof Error ? error.message : error}`);
+  process.exit(1);
+}
+const problemsOf = async (configFile) => {
+  // resolveConfig, not loadConfigFromFile: a plugin's config hook can add or change the proxy, and the dev server uses
+  // what the hooks leave.
+  const resolved = await vite.resolveConfig({ configFile, logLevel: "silent" }, "serve", "development");
+  const label = path.relative(process.cwd(), configFile);
+  return proxyProblems(resolved.server?.proxy).map((problem) => problem.replace("vite.config", label));
+};
+const problems = (await Promise.all(configFiles.map(problemsOf))).flat();
+problems.forEach((problem) => console.error(problem));
+process.exit(problems.length > 0 ? 1 : 0);

package/blueprints/local/checks/devProxyRules.d.mts

@@ -0,0 +1,2 @@
+// Types for devProxyRules.mjs, which the pack runs with plain node and the specs import.
+export declare function proxyProblems(proxy: Readonly<Record<string, unknown>> | null | undefined): string[];

package/blueprints/local/checks/devProxyRules.mjs

@@ -0,0 +1,28 @@
+// The dev server's proxy must hand the API the Host the browser used. The API refuses a change whose Origin is not its
+// own Host (skills/api), and under `yarn dev` the browser's Origin is the Vite port: a proxy that rewrites the Host to
+// the API's own port makes every change look cross-site. Vite rewrites it for a proxy written as a plain string (it
+// adds changeOrigin: true) and for one that sets changeOrigin: true itself.
+
+/** Every proxy entry of a resolved Vite config that rewrites the Host, as a problem the agent can act on. */
+export function proxyProblems(proxy) {
+  if (proxy === undefined || proxy === null) return [];
+  return Object.entries(proxy).flatMap(([context, options]) => {
+    const where = `vite.config server.proxy["${context}"]`;
+    if (typeof options === "string") {
+      return [
+        `${where} is the string ${JSON.stringify(options)}: Vite then rewrites the Host to the API's port, so the API refuses every change made in yarn dev as cross-site. Write { target: ${JSON.stringify(options)}, changeOrigin: false }`,
+      ];
+    }
+    const rewritten = Object.keys(options?.headers ?? {}).filter((name) => ["host", "origin"].includes(name.toLowerCase()));
+    return [
+      ...(options?.changeOrigin === true
+        ? [
+            `${where} sets changeOrigin: true: the API then sees its own port as the Host while the browser sends the Vite port as the Origin, and refuses every change made in yarn dev as cross-site. Set changeOrigin: false`,
+          ]
+        : []),
+      ...(rewritten.length > 0
+        ? [`${where} sets the ${rewritten.join(" and ")} header itself: the API compares Origin with Host, so leave both as the browser sent them`]
+        : []),
+    ];
+  });
+}

package/blueprints/local/checks/scaffold.sh

@@ -8,5 +8,6 @@ for d in server/migrations test; do
   [ -d "$d" ] || { echo "missing $d/" >&2; exit 1; }
 done
 grep -q '"start"' package.json || { echo "package.json has no start script" >&2; exit 1; }
+node --no-warnings "$(dirname "$0")/dev-proxy.mjs"
 yarn build
 yarn test

package/blueprints/local/checks/smoke.sh

@@ -1,7 +1,9 @@
 #!/bin/sh
 # Builds, starts the built server on a spare port with the default settings, and checks that
-# /api/health and / answer — and that, left at its defaults, it listens on this computer only.
+# /api/health and / answer — and that, left at its defaults, it listens on this computer only. First, that the dev
+# server's proxy keeps the Host, or every change made under yarn dev is refused as cross-site (dev-proxy.mjs).
 set -eu
+node --no-warnings "$(dirname "$0")/dev-proxy.mjs"
 . "$(dirname "$0")/serve.sh"
 curl -fsS --max-time 5 "http://127.0.0.1:$port/api/health" | grep -q '"ok":true' || { echo '/api/health did not answer {"ok":true}' >&2; exit 1; }
 curl -fsS --max-time 5 "http://127.0.0.1:$port/" | grep -q 'id="app"' || { echo "/ does not serve the app" >&2; exit 1; }

package/blueprints/local/skills/scaffold/SKILL.md

@@ -20,6 +20,10 @@ data/                the database file lives here; data/*.db is in .gitignore
   does not ship.
 - Scripts: `dev` (server + vite together), `build` (vite build to dist/client and the server with tsc or tsup to
   dist/server), `start` (runs the BUILT server: `node dist/server/index.js`), `test` (`vitest run`).
+- Under `yarn dev`, Vite forwards `/api` to the server. Write the proxy as an object with `changeOrigin: false`
+  (`"/api": { target: "http://127.0.0.1:3000", changeOrigin: false }`), never as a plain string: a string makes Vite
+  rewrite the `Host` to the server's port, and the API, which refuses a change whose `Origin` is not its own `Host`,
+  then refuses every change made in development. The check loads the Vite config and says so.
 - `GET /api/health` answers `{ "ok": true }`. In production the server serves `dist/client` and falls back to
   `index.html` for screen routes.
 - The server exports a function that builds the app for a given database path, so tests run against a

package/common/appActions.ts

@@ -14,6 +14,7 @@ export const SCREEN_ACTIONS = [
   "screen-rooms",
   "screen-blueprints",
   "screen-worklog",
+  "screen-skills",
 ] as const satisfies readonly KeymapAction[];
 
 export const ORDER_ACTIONS = ["order-auto", "order-manual", "order-priority"] as const satisfies readonly KeymapAction[];
@@ -52,6 +53,7 @@ const SCREEN_OF = {
   "screen-rooms": "rooms",
   "screen-blueprints": "blueprints",
   "screen-worklog": "worklog",
+  "screen-skills": "skills",
 } as const satisfies Record<ScreenAction, string>;
 
 /** The screen a screen action goes to. */

package/common/blueprint/personLanguage.ts

@@ -15,6 +15,15 @@ export const PERSON_LANGUAGES: Readonly<Record<PersonLanguage, string>> = {
   ko: "Korean",
 };
 
+/** Each language in its own words, for a choice the person makes whatever language the screen is in. */
+export const PERSON_LANGUAGE_NAMES: Readonly<Record<PersonLanguage, string>> = {
+  en: "English",
+  ja: "日本語",
+  "zh-CN": "简体中文",
+  "zh-TW": "繁體中文",
+  ko: "한국어",
+};
+
 export const isPersonLanguage = (raw: string): raw is PersonLanguage => personLanguageSchema.safeParse(raw).success;
 
 /** The prompt line that says it; none for a build started before the language was recorded. */

package/common/keymap.ts

@@ -61,6 +61,7 @@ export const KEYMAP_ACTIONS = [
   "screen-rooms",
   "screen-blueprints",
   "screen-worklog",
+  "screen-skills",
   "settings-open",
   "sound-toggle",
   "view-toggle",

package/common/resolveRelativeSegments.ts

@@ -0,0 +1,17 @@
+// Lexical only: no filesystem, no separator other than `/`. Callers normalise backslashes first,
+// and each decides for itself what root the result is relative to — this does not widen any.
+
+/** `rel` with `.` and empty segments dropped and `..` applied, `/`-joined — or null when it climbs
+ *  above its root, or resolves to the root itself (there is then no file to name). */
+export function resolveRelativeSegments(rel: string): string | null {
+  const out: string[] = [];
+  for (const segment of rel.split("/")) {
+    if (segment === "" || segment === ".") continue;
+    if (segment === "..") {
+      if (out.pop() === undefined) return null;
+      continue;
+    }
+    out.push(segment);
+  }
+  return out.length ? out.join("/") : null;
+}

package/common/skillsSh.ts

@@ -0,0 +1,49 @@
+// Searching skills.sh from the Skills viewer (#2835): the shapes the server hands the overlay, and the
+// rules both sides decide from. Read-only — nothing here installs a skill; the overlay offers the
+// `npx skills add` line for the user to run themselves.
+
+/** One search hit. `source` is the GitHub `owner/repo`, `skillId` the skill's directory name there. */
+export interface RemoteSkill {
+  source: string;
+  skillId: string;
+  name: string;
+  installs: number;
+}
+
+export interface RemoteSkillFile {
+  path: string;
+  bytes: number;
+}
+
+/** A skill as skills.sh serves it: its SKILL.md, and every file it would bring with it. */
+export interface RemoteSkillDoc {
+  markdown: string;
+  files: RemoteSkillFile[];
+}
+
+// GitHub's own character set for owner and repository names, and the skill-directory names skills.sh
+// serves. Anything else is refused before it is put into a URL.
+const OWNER_REPO_RE = /^[A-Za-z0-9-]+\/[A-Za-z0-9._-]+$/;
+const SKILL_ID_RE = /^[A-Za-z0-9._-]+$/;
+
+export const isRemoteSource = (value: string): boolean => OWNER_REPO_RE.test(value) && !value.split("/").some((part) => part === "." || part === "..");
+export const isRemoteSkillId = (value: string): boolean => SKILL_ID_RE.test(value) && value !== "." && value !== "..";
+
+/** The line that installs it with the official CLI, for the user to run — the viewer never runs it. */
+export const installCommand = (skill: Pick<RemoteSkill, "source" | "skillId">): string => `npx skills add ${skill.source} --skill ${skill.skillId}`;
+
+export const skillsShPageUrl = (skill: Pick<RemoteSkill, "source" | "skillId">): string => `https://skills.sh/${skill.source}/${skill.skillId}`;
+
+// A skill is instructions the agent follows with the user's permissions; files that RUN are the part
+// worth pointing out before anyone installs it.
+const EXECUTABLE_EXTENSIONS = new Set(["sh", "bash", "zsh", "py", "js", "mjs", "cjs", "ts", "rb", "pl", "php", "ps1", "bat", "cmd", "exe"]);
+
+export function isExecutableFile(path: string): boolean {
+  const name = path.split("/").pop() ?? "";
+  const dot = name.lastIndexOf(".");
+  return dot > 0 && EXECUTABLE_EXTENSIONS.has(name.slice(dot + 1).toLowerCase());
+}
+
+/** Whether a skill of this name is already on disk, so the hit can say so. Matched by name, the way
+ *  claude resolves `/name` — the same name from another repository still counts. */
+export const isInstalledLocally = (skill: Pick<RemoteSkill, "skillId">, localSlugs: ReadonlySet<string>): boolean => localSlugs.has(skill.skillId);

package/dist/assets/{abnfDiagram-O67JEVCF-CKlUuyns.js → abnfDiagram-O67JEVCF-BMJe_qSR.js}

@@ -1 +1 @@
-import{m as e,t}from"./mermaid-parser.core-jR7u2UoU.js";import{n}from"./chunk-Y2CYZVJY-DsF7k-Jl.js";import{m as r}from"./src-CllyRBe0.js";import"./chunk-O7XYJQB3-RWvzInqy.js";import{n as i,r as a,t as o}from"./chunk-GTNCS2PH-BN14lNpR.js";import{t as s}from"./chunk-JWPE2WC7-DVXcaiue.js";import"./mermaid.core-BRUnk_mY.js";var c=e().RailroadAbnf.parser.LangiumParser,l=n(e=>{let t=e.alternatives.map(u);return t.length===1?t[0]:{type:`choice`,alternatives:t}},`transformAlternation`),u=n(e=>{let t=e.elements.map(f);return t.length===1?t[0]:{type:`sequence`,elements:t}},`transformConcatenation`),d=n(e=>{if(e.includes(`*`)){let[t,n]=e.split(`*`);return{min:t?parseInt(t,10):0,max:n?parseInt(n,10):1/0}}let t=parseInt(e,10);return{min:t,max:t}},`parseRepeat`),f=n(e=>{let t=p(e.primary);if(!e.repeat)return t;let{min:n,max:r}=d(e.repeat);return n===0&&r===1?{type:`optional`,element:t}:{type:`repetition`,element:t,min:n,max:r}},`transformElement`),p=n(e=>{switch(e.$type){case`AbnfStringLiteral`:return{type:`terminal`,value:e.value};case`AbnfNumVal`:return{type:`terminal`,value:e.value};case`AbnfRuleName`:return{type:`nonterminal`,name:e.name};case`AbnfGroup`:return l(e.element);case`AbnfOptionalGroup`:return{type:`optional`,element:l(e.element)};default:throw Error(`Unsupported ABNF primary node: ${e.$type}`)}},`transformPrimary`),m=n(e=>({name:e.name,definition:l(e.definition)}),`transformRule`),h=n(e=>{s(e,o),e.title&&o.setTitle(e.title),e.rules.map(e=>o.addRule(m(e)))},`populateDb`),g={parser:{parse:n(e=>{o.clear(),r.debug(`[ABNF Parser] Starting Langium parse`);let n=c.parse(e);if(n.lexerErrors.length>0||n.parserErrors.length>0)throw new t(n);let i=n.value;r.debug(`[ABNF Parser] Parsed rules:`,i.rules.length),h(i),r.debug(`[ABNF Parser] Parse complete`)},`parse`),parser:{yy:o}},db:o,renderer:a,styles:i};export{g as diagram};
+import{m as e,t}from"./mermaid-parser.core-BglGjiX7.js";import{n}from"./chunk-Y2CYZVJY-DsF7k-Jl.js";import{m as r}from"./src-CllyRBe0.js";import"./chunk-O7XYJQB3-CqjPWB3Q.js";import{n as i,r as a,t as o}from"./chunk-GTNCS2PH-CSNeDal_.js";import{t as s}from"./chunk-JWPE2WC7-DVXcaiue.js";import"./mermaid.core-D_feebOp.js";var c=e().RailroadAbnf.parser.LangiumParser,l=n(e=>{let t=e.alternatives.map(u);return t.length===1?t[0]:{type:`choice`,alternatives:t}},`transformAlternation`),u=n(e=>{let t=e.elements.map(f);return t.length===1?t[0]:{type:`sequence`,elements:t}},`transformConcatenation`),d=n(e=>{if(e.includes(`*`)){let[t,n]=e.split(`*`);return{min:t?parseInt(t,10):0,max:n?parseInt(n,10):1/0}}let t=parseInt(e,10);return{min:t,max:t}},`parseRepeat`),f=n(e=>{let t=p(e.primary);if(!e.repeat)return t;let{min:n,max:r}=d(e.repeat);return n===0&&r===1?{type:`optional`,element:t}:{type:`repetition`,element:t,min:n,max:r}},`transformElement`),p=n(e=>{switch(e.$type){case`AbnfStringLiteral`:return{type:`terminal`,value:e.value};case`AbnfNumVal`:return{type:`terminal`,value:e.value};case`AbnfRuleName`:return{type:`nonterminal`,name:e.name};case`AbnfGroup`:return l(e.element);case`AbnfOptionalGroup`:return{type:`optional`,element:l(e.element)};default:throw Error(`Unsupported ABNF primary node: ${e.$type}`)}},`transformPrimary`),m=n(e=>({name:e.name,definition:l(e.definition)}),`transformRule`),h=n(e=>{s(e,o),e.title&&o.setTitle(e.title),e.rules.map(e=>o.addRule(m(e)))},`populateDb`),g={parser:{parse:n(e=>{o.clear(),r.debug(`[ABNF Parser] Starting Langium parse`);let n=c.parse(e);if(n.lexerErrors.length>0||n.parserErrors.length>0)throw new t(n);let i=n.value;r.debug(`[ABNF Parser] Parsed rules:`,i.rules.length),h(i),r.debug(`[ABNF Parser] Parse complete`)},`parse`),parser:{yy:o}},db:o,renderer:a,styles:i};export{g as diagram};

package/dist/assets/architecture-7GRP2DOG-CQYRVr5T.js

@@ -0,0 +1 @@
+import"./chunk-FOHPRMQF-DzxwRta7.js";import{M as e}from"./mermaid-parser.core-BglGjiX7.js";export{e as createArchitectureServices};