neko-harness 0.2.2 → 0.2.3

package/dist/gateway.js

@@ -105,9 +105,9 @@ function parseGatewayArgs(argv) {
 }
 
 // packages/gateway/src/gateway.ts
-import { randomUUID } from "crypto";
-import { mkdir as mkdir2, readFile as readFile5, writeFile as writeFile2 } from "fs/promises";
-import { basename as basename4, dirname as dirname6, join as join9 } from "path";
+import { randomUUID as randomUUID2 } from "crypto";
+import { mkdir as mkdir3, readFile as readFile5, writeFile as writeFile3 } from "fs/promises";
+import { basename as basename4, dirname as dirname7, join as join10 } from "path";
 import { BACKGROUND_CONTEXT as BACKGROUND_CONTEXT2 } from "@earendil-works/chord/context";
 import { isServerId } from "@earendil-works/pi-protocol";
 import { Server, SessionNotFoundError } from "@earendil-works/pi-server";
@@ -226,6 +226,7 @@ class CompactionManager {
 import { existsSync, readFileSync } from "fs";
 import { homedir } from "os";
 import { dirname, join, resolve } from "path";
+var DEFAULT_SKILL_MARKET_URL = "https://skill.kirineko.tech";
 var NEKO_CONFIG_BASENAME = "neko.config.json";
 function findNekoConfigFile(startDir = process.cwd()) {
   let dir = resolve(startDir);
@@ -328,6 +329,16 @@ function validate(config, source) {
   if (theme !== undefined && theme !== "light" && theme !== "dark" && theme !== "auto") {
     throw new Error(`neko config: ${source}: "theme" must be "light", "dark", or "auto".`);
   }
+  const skills = config.skills;
+  if (skills !== undefined) {
+    if (typeof skills !== "object" || skills === null) {
+      throw new Error(`neko config: ${source}: "skills" must be an object.`);
+    }
+    const { marketUrl } = skills;
+    if (marketUrl !== undefined && typeof marketUrl !== "string") {
+      throw new Error(`neko config: ${source}: "skills.marketUrl" must be a string.`);
+    }
+  }
 }
 // packages/core/src/credentials.ts
 import { chmod, mkdir, open, readFile, rename, unlink } from "fs/promises";
@@ -936,6 +947,32 @@ function contextTokens(entries) {
   }
   return null;
 }
+// packages/core/src/prompt/frontmatter.ts
+import { parse } from "yaml";
+var normalizeNewlines = (value) => value.replace(/\r\n/g, `
+`).replace(/\r/g, `
+`);
+var extractFrontmatter = (content) => {
+  const normalized = normalizeNewlines(content.replace(/^\uFEFF/, ""));
+  const opening = /^---[ \t]*\n/.exec(normalized);
+  if (!opening)
+    return { yamlString: null, body: normalized };
+  const rest = normalized.slice(opening[0].length);
+  const closing = /^---[ \t]*(?:\n|$)/m.exec(rest);
+  if (!closing)
+    return { yamlString: null, body: normalized };
+  return { yamlString: rest.slice(0, closing.index), body: rest.slice(closing.index + closing[0].length).trim() };
+};
+var parseFrontmatter = (content) => {
+  const { yamlString, body } = extractFrontmatter(content);
+  if (!yamlString)
+    return { frontmatter: {}, body };
+  const parsed = parse(yamlString);
+  if (parsed !== null && (typeof parsed !== "object" || Array.isArray(parsed)))
+    throw new Error("Frontmatter must be a YAML mapping.");
+  return { frontmatter: parsed ?? {}, body };
+};
+var stripFrontmatter = (content) => extractFrontmatter(content).body;
 // packages/core/src/runtime.ts
 import { homedir as homedir4 } from "os";
 import { join as join5 } from "path";
@@ -965,33 +1002,6 @@ var warnPromptDiagnostic = ({ path, message }) => {
 };
 var isMissing = (error) => typeof error === "object" && error !== null && ("code" in error) && (error.code === "ENOENT" || error.code === "ENOTDIR");
 
-// packages/core/src/prompt/frontmatter.ts
-import { parse } from "yaml";
-var normalizeNewlines = (value) => value.replace(/\r\n/g, `
-`).replace(/\r/g, `
-`);
-var extractFrontmatter = (content) => {
-  const normalized = normalizeNewlines(content.replace(/^\uFEFF/, ""));
-  const opening = /^---[ \t]*\n/.exec(normalized);
-  if (!opening)
-    return { yamlString: null, body: normalized };
-  const rest = normalized.slice(opening[0].length);
-  const closing = /^---[ \t]*(?:\n|$)/m.exec(rest);
-  if (!closing)
-    return { yamlString: null, body: normalized };
-  return { yamlString: rest.slice(0, closing.index), body: rest.slice(closing.index + closing[0].length).trim() };
-};
-var parseFrontmatter = (content) => {
-  const { yamlString, body } = extractFrontmatter(content);
-  if (!yamlString)
-    return { frontmatter: {}, body };
-  const parsed = parse(yamlString);
-  if (parsed !== null && (typeof parsed !== "object" || Array.isArray(parsed)))
-    throw new Error("Frontmatter must be a YAML mapping.");
-  return { frontmatter: parsed ?? {}, body };
-};
-var stripFrontmatter = (content) => extractFrontmatter(content).body;
-
 // packages/core/src/prompt/skills.ts
 import { readdir, readFile as readFile2 } from "fs/promises";
 import { basename, dirname as dirname3, join as join3 } from "path";
@@ -1185,11 +1195,13 @@ ${text}
 import { readFile as readFile3 } from "fs/promises";
 import { homedir as homedir3 } from "os";
 import { join as join4 } from "path";
+import { fileURLToPath } from "url";
 var userAgentsFile = (home) => join4(home, ".agents", "AGENTS.md");
 var userSkillsDir = (home) => join4(home, ".agents", "skills");
 var workspaceAgentsFile = (workspace) => join4(workspace, "AGENTS.md");
 var workspaceSkillsDir = (workspace) => join4(workspace, ".agents", "skills");
-var readResources = async (workspace, home, report, invocationName) => {
+var BUILTIN_SKILLS_DIR = fileURLToPath(new URL("../../skills/", import.meta.url));
+var readResources = async (workspace, home, builtinDir, report, invocationName) => {
   const contextFiles = [];
   for (const path of [userAgentsFile(home), workspaceAgentsFile(workspace)]) {
     try {
@@ -1210,11 +1222,13 @@ var readResources = async (workspace, home, report, invocationName) => {
     if (skill.name === invocationName)
       candidates.set(skill.filePath, content);
   } : undefined;
-  const [user, project] = await Promise.all([
-    scanSkillsDir(userSkillsDir(home), report, capture),
-    scanSkillsDir(workspaceSkillsDir(workspace), report, capture)
+  const scan = async (dir, level) => (await scanSkillsDir(dir, report, capture)).map((skill) => ({ ...skill, level }));
+  const [builtin, user, project] = await Promise.all([
+    builtinDir === null ? Promise.resolve([]) : scan(builtinDir, "builtin"),
+    scan(userSkillsDir(home), "user"),
+    scan(workspaceSkillsDir(workspace), "project")
   ]);
-  const skills = mergeSkills([user, project]);
+  const skills = mergeSkills([builtin, user, project]);
   const winner = invocationName === undefined ? undefined : skills.find((skill) => skill.name === invocationName);
   if (winner && candidates) {
     const content = candidates.get(winner.filePath);
@@ -1223,11 +1237,12 @@ var readResources = async (workspace, home, report, invocationName) => {
   }
   return { contextFiles, skills };
 };
-var createResourceLoader = (home = homedir3(), report = warnPromptDiagnostic) => {
+var createResourceLoader = (home = homedir3(), report = warnPromptDiagnostic, options) => {
+  const builtinDir = options?.builtinDir === undefined ? BUILTIN_SKILLS_DIR : options.builtinDir;
   const previous = new Map;
   return async (workspace, invocationName) => {
     const diagnostics = [];
-    const resources = await readResources(workspace, home, (d) => diagnostics.push(d), invocationName);
+    const resources = await readResources(workspace, home, builtinDir, (d) => diagnostics.push(d), invocationName);
     const known = previous.get(workspace);
     const current = new Set;
     for (const diagnostic of diagnostics) {
@@ -1243,6 +1258,15 @@ var createResourceLoader = (home = homedir3(), report = warnPromptDiagnostic) =>
     return resources;
   };
 };
+var scanSkillsByLevel = async (workspace, home = homedir3(), builtinDir = BUILTIN_SKILLS_DIR, report = warnPromptDiagnostic) => {
+  const scan = async (dir, level) => (await scanSkillsDir(dir, report)).map((skill) => ({ ...skill, level }));
+  const [builtin, user, project] = await Promise.all([
+    builtinDir === null ? [] : scan(builtinDir, "builtin"),
+    scan(userSkillsDir(home), "user"),
+    scan(workspaceSkillsDir(workspace), "project")
+  ]);
+  return [...project, ...user, ...builtin];
+};
 
 // packages/core/src/prompt/snapshots.ts
 var createResourceSnapshots = (load, submission) => {
@@ -2416,7 +2440,21 @@ async function createNekoRuntime(options = {}) {
       const session = await sessionFor(id);
       const agent = await session.conversation.agent(context);
       const { skills } = await loadResources(savedWorkspace(agent.cwd));
-      return skills.map((skill) => ({ name: skill.name, description: skill.description, location: skill.filePath }));
+      return skills.map((skill) => ({
+        name: skill.name,
+        description: skill.description,
+        location: skill.filePath,
+        level: skill.level
+      }));
+    },
+    async listSkillsByLevel(cwd) {
+      const skills = await scanSkillsByLevel(normalizeWorkspace(cwd ?? defaultCwd), options.promptHome ?? homedir4());
+      return skills.map((skill) => ({
+        name: skill.name,
+        description: skill.description,
+        location: skill.filePath,
+        level: skill.level
+      }));
     },
     installExtension(extension) {
       registry.install(extension);
@@ -2585,6 +2623,7 @@ var NekoChat = defineService("neko.chat");
 var NekoWorkspaces = defineService("neko.workspaces");
 var NekoCredentials = defineService("neko.credentials");
 var NekoWorkspaceFiles = defineService("neko.workspace-files");
+var NekoSkillMarket = defineService("neko.skill-market");
 
 // packages/gateway/src/file-search-help.ts
 function fileSearchInstallHelp(platform = process.platform) {
@@ -2606,10 +2645,644 @@ function fileSearchInstallHelp(platform = process.platform) {
   return `\u672A\u627E\u5230 fd \u6216 fdfind\uFF0C\u6682\u65F6\u65E0\u6CD5\u4F7F\u7528 @ \u6587\u4EF6\u8865\u5168\u3002\u8BF7\u5728\u8FD0\u884C neko \u7684\u7535\u8111\u4E0A\u5B89\u88C5\u3002${install}\u5B89\u88C5\u540E\u91CD\u65B0\u6253\u5F00\u7EC8\u7AEF\u5E76\u91CD\u542F neko\u3002`;
 }
 
+// packages/gateway/src/skill-market.ts
+import { createHash as createHash2, randomUUID } from "crypto";
+import { mkdir as mkdir2, readdir as readdir2, rename as rename2, rm as rm2, stat as stat2, writeFile as writeFile2 } from "fs/promises";
+import { homedir as homedir5 } from "os";
+import { dirname as dirname5, join as join8 } from "path";
+
+// node_modules/fflate/esm/index.mjs
+import { createRequire } from "module";
+var require2 = createRequire("/");
+var _a;
+var Worker;
+var isMarkedAsUntransferable;
+try {
+  _a = require2("worker_threads"), Worker = _a.Worker, isMarkedAsUntransferable = _a.isMarkedAsUntransferable;
+} catch (e) {}
+var u8 = Uint8Array;
+var u16 = Uint16Array;
+var i32 = Int32Array;
+var fleb = new u8([0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 2, 2, 2, 2, 3, 3, 3, 3, 4, 4, 4, 4, 5, 5, 5, 5, 0, 0, 0, 0]);
+var fdeb = new u8([0, 0, 0, 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6, 7, 7, 8, 8, 9, 9, 10, 10, 11, 11, 12, 12, 13, 13, 0, 0]);
+var clim = new u8([16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15]);
+var freb = function(eb, start) {
+  var b = new u16(31);
+  for (var i = 0;i < 31; ++i) {
+    b[i] = start += 1 << eb[i - 1];
+  }
+  var r = new i32(b[30]);
+  for (var i = 1;i < 30; ++i) {
+    for (var j = b[i];j < b[i + 1]; ++j) {
+      r[j] = j - b[i] << 5 | i;
+    }
+  }
+  return { b, r };
+};
+var _a = freb(fleb, 2);
+var fl = _a.b;
+var revfl = _a.r;
+fl[28] = 258, revfl[258] = 28;
+var _b = freb(fdeb, 0);
+var fd = _b.b;
+var revfd = _b.r;
+var rev = new u16(32768);
+for (i = 0;i < 32768; ++i) {
+  x = (i & 43690) >> 1 | (i & 21845) << 1;
+  x = (x & 52428) >> 2 | (x & 13107) << 2;
+  x = (x & 61680) >> 4 | (x & 3855) << 4;
+  rev[i] = ((x & 65280) >> 8 | (x & 255) << 8) >> 1;
+}
+var x;
+var i;
+var hMap = function(cd, mb, r) {
+  var s = cd.length;
+  var i = 0;
+  var l = new u16(mb);
+  for (;i < s; ++i) {
+    if (cd[i])
+      ++l[cd[i] - 1];
+  }
+  var le = new u16(mb);
+  for (i = 1;i < mb; ++i) {
+    le[i] = le[i - 1] + l[i - 1] << 1;
+  }
+  var co;
+  if (r) {
+    co = new u16(1 << mb);
+    var rvb = 15 - mb;
+    for (i = 0;i < s; ++i) {
+      if (cd[i]) {
+        var sv = i << 4 | cd[i];
+        var r_1 = mb - cd[i];
+        var v = le[cd[i] - 1]++ << r_1;
+        for (var m = v | (1 << r_1) - 1;v <= m; ++v) {
+          co[rev[v] >> rvb] = sv;
+        }
+      }
+    }
+  } else {
+    co = new u16(s);
+    for (i = 0;i < s; ++i) {
+      if (cd[i]) {
+        co[i] = rev[le[cd[i] - 1]++] >> 15 - cd[i];
+      }
+    }
+  }
+  return co;
+};
+var flt = new u8(288);
+for (i = 0;i < 144; ++i)
+  flt[i] = 8;
+var i;
+for (i = 144;i < 256; ++i)
+  flt[i] = 9;
+var i;
+for (i = 256;i < 280; ++i)
+  flt[i] = 7;
+var i;
+for (i = 280;i < 288; ++i)
+  flt[i] = 8;
+var i;
+var fdt = new u8(32);
+for (i = 0;i < 32; ++i)
+  fdt[i] = 5;
+var i;
+var flrm = /* @__PURE__ */ hMap(flt, 9, 1);
+var fdrm = /* @__PURE__ */ hMap(fdt, 5, 1);
+var max = function(a) {
+  var m = a[0];
+  for (var i = 1;i < a.length; ++i) {
+    if (a[i] > m)
+      m = a[i];
+  }
+  return m;
+};
+var bits = function(d, p, m) {
+  var o = p / 8 | 0;
+  return (d[o] | d[o + 1] << 8) >> (p & 7) & m;
+};
+var bits16 = function(d, p) {
+  var o = p / 8 | 0;
+  return (d[o] | d[o + 1] << 8 | d[o + 2] << 16) >> (p & 7);
+};
+var shft = function(p) {
+  return (p + 7) / 8 | 0;
+};
+var slc = function(v, s, e) {
+  if (s == null || s < 0)
+    s = 0;
+  if (e == null || e > v.length)
+    e = v.length;
+  return new u8(v.subarray(s, e));
+};
+var ec = [
+  "unexpected EOF",
+  "invalid block type",
+  "invalid length/literal",
+  "invalid distance",
+  "stream finished",
+  "no stream handler",
+  ,
+  "no callback",
+  "invalid UTF-8 data",
+  "extra field too long",
+  "date not in range 1980-2099",
+  "filename too long",
+  "stream finishing",
+  "invalid zip data"
+];
+var err = function(ind, msg, nt) {
+  var e = new Error(msg || ec[ind]);
+  e.code = ind;
+  if (Error.captureStackTrace)
+    Error.captureStackTrace(e, err);
+  if (!nt)
+    throw e;
+  return e;
+};
+var inflt = function(dat, st, buf, dict) {
+  var sl = dat.length, dl = dict ? dict.length : 0;
+  if (!sl || st.f && !st.l)
+    return buf || new u8(0);
+  var noBuf = !buf;
+  var resize = noBuf || st.i != 2;
+  var noSt = st.i;
+  if (noBuf)
+    buf = new u8(sl * 3);
+  var cbuf = function(l) {
+    var bl = buf.length;
+    if (l > bl) {
+      var nbuf = new u8(Math.max(bl * 2, l));
+      nbuf.set(buf);
+      buf = nbuf;
+    }
+  };
+  var final = st.f || 0, pos = st.p || 0, bt = st.b || 0, { l: lm, d: dm, m: lbt, n: dbt } = st;
+  var tbts = sl * 8;
+  do {
+    if (!lm) {
+      final = bits(dat, pos, 1);
+      var type = bits(dat, pos + 1, 3);
+      pos += 3;
+      if (!type) {
+        var s = shft(pos) + 4, l = dat[s - 4] | dat[s - 3] << 8, t = s + l;
+        if (t > sl) {
+          if (noSt)
+            err(0);
+          break;
+        }
+        if (resize)
+          cbuf(bt + l);
+        buf.set(dat.subarray(s, t), bt);
+        st.b = bt += l, st.p = pos = t * 8, st.f = final;
+        continue;
+      } else if (type == 1)
+        lm = flrm, dm = fdrm, lbt = 9, dbt = 5;
+      else if (type == 2) {
+        var hLit = bits(dat, pos, 31) + 257, hcLen = bits(dat, pos + 10, 15) + 4;
+        var tl = hLit + bits(dat, pos + 5, 31) + 1;
+        pos += 14;
+        var ldt = new u8(tl);
+        var clt = new u8(19);
+        for (var i = 0;i < hcLen; ++i) {
+          clt[clim[i]] = bits(dat, pos + i * 3, 7);
+        }
+        pos += hcLen * 3;
+        var clb = max(clt), clbmsk = (1 << clb) - 1;
+        var clm = hMap(clt, clb, 1);
+        for (var i = 0;i < tl; ) {
+          var r = clm[bits(dat, pos, clbmsk)];
+          pos += r & 15;
+          var s = r >> 4;
+          if (s < 16) {
+            ldt[i++] = s;
+          } else {
+            var c = 0, n = 0;
+            if (s == 16)
+              n = 3 + bits(dat, pos, 3), pos += 2, c = ldt[i - 1];
+            else if (s == 17)
+              n = 3 + bits(dat, pos, 7), pos += 3;
+            else if (s == 18)
+              n = 11 + bits(dat, pos, 127), pos += 7;
+            while (n--)
+              ldt[i++] = c;
+          }
+        }
+        var lt = ldt.subarray(0, hLit), dt = ldt.subarray(hLit);
+        lbt = max(lt);
+        dbt = max(dt);
+        lm = hMap(lt, lbt, 1);
+        dm = hMap(dt, dbt, 1);
+      } else
+        err(1);
+      if (pos > tbts) {
+        if (noSt)
+          err(0);
+        break;
+      }
+    }
+    if (resize)
+      cbuf(bt + 131072);
+    var lms = (1 << lbt) - 1, dms = (1 << dbt) - 1;
+    var lpos = pos;
+    for (;; lpos = pos) {
+      var c = lm[bits16(dat, pos) & lms], sym = c >> 4;
+      pos += c & 15;
+      if (pos > tbts) {
+        if (noSt)
+          err(0);
+        break;
+      }
+      if (!c)
+        err(2);
+      if (sym < 256)
+        buf[bt++] = sym;
+      else if (sym == 256) {
+        lpos = pos, lm = null;
+        break;
+      } else {
+        var add = sym - 254;
+        if (sym > 264) {
+          var i = sym - 257, b = fleb[i];
+          add = bits(dat, pos, (1 << b) - 1) + fl[i];
+          pos += b;
+        }
+        var d = dm[bits16(dat, pos) & dms], dsym = d >> 4;
+        if (!d)
+          err(3);
+        pos += d & 15;
+        var dt = fd[dsym];
+        if (dsym > 3) {
+          var b = fdeb[dsym];
+          dt += bits16(dat, pos) & (1 << b) - 1, pos += b;
+        }
+        if (pos > tbts) {
+          if (noSt)
+            err(0);
+          break;
+        }
+        if (resize)
+          cbuf(bt + 131072);
+        var end = bt + add;
+        if (bt < dt) {
+          var shift = dl - dt, dend = Math.min(dt, end);
+          if (shift + bt < 0)
+            err(3);
+          for (;bt < dend; ++bt)
+            buf[bt] = dict[shift + bt];
+        }
+        for (;bt < end; ++bt)
+          buf[bt] = buf[bt - dt];
+      }
+    }
+    st.l = lm, st.p = lpos, st.b = bt, st.f = final;
+    if (lm)
+      final = 1, st.m = lbt, st.d = dm, st.n = dbt;
+  } while (!final);
+  return bt != buf.length && noBuf ? slc(buf, 0, bt) : buf.subarray(0, bt);
+};
+var et = /* @__PURE__ */ new u8(0);
+var b2 = function(d, b) {
+  return d[b] | d[b + 1] << 8;
+};
+var b4 = function(d, b) {
+  return (d[b] | d[b + 1] << 8 | d[b + 2] << 16 | d[b + 3] << 24) >>> 0;
+};
+var b8 = function(d, b) {
+  return b4(d, b) + b4(d, b + 4) * 4294967296;
+};
+function inflateSync(data, opts) {
+  return inflt(data, { i: 2 }, opts && opts.out, opts && opts.dictionary);
+}
+var td = typeof TextDecoder != "undefined" && /* @__PURE__ */ new TextDecoder;
+var tds = 0;
+try {
+  td.decode(et, { stream: true });
+  tds = 1;
+} catch (e) {}
+var dutf8 = function(d) {
+  for (var r = "", i = 0;; ) {
+    var c = d[i++];
+    var eb = (c > 127) + (c > 223) + (c > 239);
+    if (i + eb > d.length)
+      return { s: r, r: slc(d, i - 1) };
+    if (!eb)
+      r += String.fromCharCode(c);
+    else if (eb == 3) {
+      c = ((c & 15) << 18 | (d[i++] & 63) << 12 | (d[i++] & 63) << 6 | d[i++] & 63) - 65536, r += String.fromCharCode(55296 | c >> 10, 56320 | c & 1023);
+    } else if (eb & 1)
+      r += String.fromCharCode((c & 31) << 6 | d[i++] & 63);
+    else
+      r += String.fromCharCode((c & 15) << 12 | (d[i++] & 63) << 6 | d[i++] & 63);
+  }
+};
+function strFromU8(dat, latin1) {
+  if (latin1) {
+    var r = "";
+    for (var i = 0;i < dat.length; i += 16384)
+      r += String.fromCharCode.apply(null, dat.subarray(i, i + 16384));
+    return r;
+  } else if (td) {
+    return td.decode(dat);
+  } else {
+    var _a = dutf8(dat), { s, r } = _a;
+    if (r.length)
+      err(8);
+    return s;
+  }
+}
+var slzh = function(d, b) {
+  return b + 30 + b2(d, b + 26) + b2(d, b + 28);
+};
+var zh = function(d, b, z) {
+  var fnl = b2(d, b + 28), efl = b2(d, b + 30), fn = strFromU8(d.subarray(b + 46, b + 46 + fnl), !(b2(d, b + 8) & 2048)), es = b + 46 + fnl;
+  var _a = z64hs(d, es, efl, z, b4(d, b + 20), b4(d, b + 24), b4(d, b + 42)), sc = _a[0], su = _a[1], off = _a[2];
+  return [b2(d, b + 10), sc, su, fn, es + efl + b2(d, b + 32), off];
+};
+var z64hs = function(d, b, l, z, sc, su, off) {
+  var nsc = sc == 4294967295, nsu = su == 4294967295, noff = off == 4294967295, e = b + l;
+  var nf = nsc + nsu + noff;
+  if (z && nf) {
+    for (;b + 4 < e; b += 4 + b2(d, b + 2)) {
+      if (b2(d, b) == 1) {
+        return [
+          nsc ? b8(d, b + 4 + 8 * nsu) : sc,
+          nsu ? b8(d, b + 4) : su,
+          noff ? b8(d, b + 4 + 8 * (nsu + nsc)) : off,
+          1
+        ];
+      }
+    }
+    if (z < 2)
+      err(13);
+  }
+  return [sc, su, off, 0];
+};
+function unzipSync(data, opts) {
+  var files = {};
+  var e = data.length - 22;
+  for (;b4(data, e) != 101010256; --e) {
+    if (!e || data.length - e > 65558)
+      err(13);
+  }
+  var c = b2(data, e + 8);
+  if (!c)
+    return {};
+  var o = b4(data, e + 16);
+  var z = b4(data, e - 20) == 117853008;
+  if (z) {
+    var ze = b4(data, e - 12);
+    z = b4(data, ze) == 101075792;
+    if (z) {
+      c = b4(data, ze + 32);
+      o = b4(data, ze + 48);
+    }
+  }
+  var fltr = opts && opts.filter;
+  for (var i = 0;i < c; ++i) {
+    var _a = zh(data, o, z), c_2 = _a[0], sc = _a[1], su = _a[2], fn = _a[3], no = _a[4], off = _a[5], b = slzh(data, off);
+    o = no;
+    if (!fltr || fltr({
+      name: fn,
+      size: sc,
+      originalSize: su,
+      compression: c_2
+    })) {
+      if (!c_2)
+        files[fn] = slc(data, b, b + sc);
+      else if (c_2 == 8)
+        files[fn] = inflateSync(data.subarray(b, b + sc), { out: new u8(su) });
+      else
+        err(14, "unknown compression type " + c_2);
+    }
+  }
+  return files;
+}
+
+// packages/gateway/src/skill-market.ts
+class SkillMarketError extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "SkillMarketError";
+    this.code = code;
+  }
+}
+var CATALOG_TTL_MS = 60000;
+var ZIP_CACHE_MAX = 16;
+var MAX_PACKAGE_BYTES = 32 * 1024 * 1024;
+var userSkillsDir2 = (home) => join8(home, ".agents", "skills");
+var projectSkillsDir = (workspaceRoot) => join8(workspaceRoot, ".agents", "skills");
+var activeLevelOf = (state) => state.project ? "project" : state.user ? "user" : state.builtin ? "builtin" : null;
+var normalizeEntry = (raw) => {
+  const row = raw ?? {};
+  const metadata = row.metadata;
+  const source = metadata !== null && typeof metadata === "object" ? metadata.source : undefined;
+  return {
+    name: String(row.name ?? ""),
+    description: String(row.description ?? ""),
+    category: typeof row.category === "string" && row.category !== "" ? row.category : "uncategorized",
+    source: typeof source === "string" && source !== "" ? source : "unknown",
+    license: String(row.license ?? ""),
+    version: String(row.version ?? ""),
+    sha256: String(row.sha256 ?? ""),
+    sizeBytes: Number(row.size_bytes ?? 0),
+    uploadedAt: String(row.uploaded_at ?? "")
+  };
+};
+function createSkillMarketClient(options) {
+  const home = options.home ?? homedir5();
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const now = options.now ?? Date.now;
+  let base;
+  try {
+    base = new URL(options.marketUrl);
+    if (base.protocol !== "https:" && base.protocol !== "http:")
+      throw new Error("unsupported protocol");
+  } catch {
+    throw new SkillMarketError("market_invalid_url", `Invalid skill market URL: ${options.marketUrl}`);
+  }
+  base = new URL(base.toString().replace(/\/+$/, ""));
+  let catalog;
+  const zipCache = new Map;
+  const request = async (path) => {
+    let response;
+    try {
+      response = await fetchImpl(new URL(path, `${base}/`).toString());
+    } catch (error) {
+      throw new SkillMarketError("market_unavailable", `Skill market unreachable: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    return response;
+  };
+  const refreshCatalog = async () => {
+    const response = await request("api/skills");
+    if (!response.ok)
+      throw new SkillMarketError("market_unavailable", `Skill list failed with HTTP ${response.status}`);
+    const data = await response.json();
+    const skills = Array.isArray(data.skills) ? data.skills.map(normalizeEntry) : [];
+    catalog = { at: now(), skills };
+    return skills;
+  };
+  const listSkills = async () => catalog !== undefined && now() - catalog.at < CATALOG_TTL_MS ? catalog.skills : refreshCatalog();
+  const detail = async (name) => {
+    let hit = (await listSkills()).find((skill) => skill.name === name);
+    if (hit === undefined)
+      hit = (await refreshCatalog()).find((skill) => skill.name === name);
+    if (hit === undefined)
+      throw new SkillMarketError("skill_not_found", `Skill not found on market: ${name}`);
+    return hit;
+  };
+  const download = async (skill) => {
+    const cached = zipCache.get(skill.sha256);
+    if (cached !== undefined) {
+      zipCache.delete(skill.sha256);
+      zipCache.set(skill.sha256, cached);
+      return cached;
+    }
+    if (skill.sizeBytes > MAX_PACKAGE_BYTES)
+      throw new SkillMarketError("skill_too_large", `Package ${skill.name} is ${skill.sizeBytes} bytes (limit ${MAX_PACKAGE_BYTES})`);
+    const response = await request(`api/skills/${encodeURIComponent(skill.name)}/download`);
+    if (!response.ok)
+      throw new SkillMarketError(response.status === 404 ? "skill_not_found" : "market_unavailable", `Download of ${skill.name} failed with HTTP ${response.status}`);
+    const bytes = new Uint8Array(await response.arrayBuffer());
+    if (bytes.byteLength > MAX_PACKAGE_BYTES)
+      throw new SkillMarketError("skill_too_large", `Package ${skill.name} exceeds ${MAX_PACKAGE_BYTES} bytes`);
+    const digest = createHash2("sha256").update(bytes).digest("hex");
+    if (digest !== skill.sha256)
+      throw new SkillMarketError("skill_hash_mismatch", `SHA-256 mismatch for ${skill.name}: catalog says ${skill.sha256}, got ${digest}`);
+    zipCache.set(skill.sha256, bytes);
+    while (zipCache.size > ZIP_CACHE_MAX) {
+      const oldest = zipCache.keys().next().value;
+      if (oldest === undefined)
+        break;
+      zipCache.delete(oldest);
+    }
+    return bytes;
+  };
+  const unpack = (skill, zip) => {
+    let entries;
+    try {
+      entries = unzipSync(zip);
+    } catch {
+      throw new SkillMarketError("skill_invalid_package", `Package ${skill.name} is not a valid zip archive`);
+    }
+    const files = new Map;
+    const skillMds = [];
+    for (const name of Object.keys(entries)) {
+      if (name.endsWith("/"))
+        continue;
+      if (name.includes("\\") || name.startsWith("/"))
+        throw new SkillMarketError("skill_invalid_package", `Unsafe path in package: ${name}`);
+      const segments = name.split("/");
+      if (segments.some((s) => s === ".." || s === ""))
+        throw new SkillMarketError("skill_invalid_package", `Unsafe path in package: ${name}`);
+      if (segments[segments.length - 1] === "SKILL.md")
+        skillMds.push(name);
+      files.set(name, entries[name]);
+    }
+    if (skillMds.length !== 1)
+      throw new SkillMarketError("skill_invalid_package", skillMds.length === 0 ? `Package ${skill.name} contains no SKILL.md` : `Package ${skill.name} contains multiple SKILL.md files`);
+    const root = skillMds[0].slice(0, -"SKILL.md".length);
+    const inner = new Map;
+    for (const [name, bytes] of files) {
+      if (!name.startsWith(root))
+        continue;
+      inner.set(name.slice(root.length), bytes);
+    }
+    return inner;
+  };
+  const skillsDirFor = (scope, workspaceRoot) => {
+    if (scope === "user")
+      return userSkillsDir2(home);
+    if (workspaceRoot === undefined || workspaceRoot === "")
+      throw new SkillMarketError("market_unavailable", "Project-scope install needs a workspaceRoot");
+    return projectSkillsDir(workspaceRoot);
+  };
+  const sweepTempDirs = async (skillsDir) => {
+    const parent = dirname5(skillsDir);
+    let names = [];
+    try {
+      names = await readdir2(parent);
+    } catch {
+      return;
+    }
+    await Promise.all(names.filter((n) => n.startsWith(".tmp-")).map((n) => rm2(join8(parent, n), { recursive: true, force: true }).catch(() => {})));
+  };
+  const install = async ({ name, scope, workspaceRoot, overwrite }) => {
+    const skillsDir = skillsDirFor(scope, workspaceRoot);
+    const target = join8(skillsDir, name);
+    const exists = await stat2(target).catch(() => {
+      return;
+    }) !== undefined;
+    if (exists && overwrite !== true)
+      throw new SkillMarketError("skill_exists", `Skill ${name} already exists at ${scope} level (${target})`);
+    const skill = await detail(name);
+    const files = unpack(skill, await download(skill));
+    await sweepTempDirs(skillsDir);
+    const temp = join8(dirname5(skillsDir), `.tmp-${randomUUID()}`);
+    try {
+      for (const [relative, bytes] of files) {
+        const dest = join8(temp, ...relative.split("/"));
+        await mkdir2(dirname5(dest), { recursive: true });
+        await writeFile2(dest, bytes);
+      }
+      if (exists)
+        await rm2(target, { recursive: true, force: true });
+      await mkdir2(skillsDir, { recursive: true });
+      await rename2(temp, target);
+    } finally {
+      await rm2(temp, { recursive: true, force: true }).catch(() => {});
+    }
+    let shadowedBy;
+    if (scope === "user" && workspaceRoot !== undefined && workspaceRoot !== "") {
+      const projectDir = join8(projectSkillsDir(workspaceRoot), name);
+      if (await stat2(projectDir).catch(() => {
+        return;
+      }) !== undefined)
+        shadowedBy = "project";
+    }
+    return { name, scope, path: target, ...shadowedBy !== undefined ? { shadowedBy } : {} };
+  };
+  const uninstall = async ({ name, scope, workspaceRoot }) => {
+    const skillsDir = skillsDirFor(scope, workspaceRoot);
+    const target = join8(skillsDir, name);
+    if (await stat2(target).catch(() => {
+      return;
+    }) === undefined)
+      throw new SkillMarketError("skill_not_installed", `Skill ${name} is not installed at ${scope} level`);
+    await rm2(target, { recursive: true, force: true });
+  };
+  return {
+    async list(query) {
+      if (query !== undefined && query.trim() !== "") {
+        const response = await request(`api/skills?q=${encodeURIComponent(query.trim())}`);
+        if (!response.ok)
+          throw new SkillMarketError("market_unavailable", `Skill search failed with HTTP ${response.status}`);
+        const data = await response.json();
+        return Array.isArray(data.skills) ? data.skills.map(normalizeEntry) : [];
+      }
+      return listSkills();
+    },
+    detail,
+    async preview(name) {
+      const skill = await detail(name);
+      const inner = unpack(skill, await download(skill));
+      const bodyBytes = inner.get("SKILL.md");
+      if (bodyBytes === undefined)
+        throw new SkillMarketError("skill_invalid_package", `Package ${name} lost its SKILL.md`);
+      const body = stripFrontmatter(new TextDecoder().decode(bodyBytes));
+      return { body, files: [...inner.keys()].sort() };
+    },
+    install,
+    uninstall
+  };
+}
+
 // packages/gateway/src/workspaces.ts
 import { constants as constants3 } from "fs";
-import { access, readdir as readdir2, stat as stat2 } from "fs/promises";
-import { dirname as dirname5, isAbsolute as isAbsolute3, join as join8 } from "path";
+import { access, readdir as readdir3, stat as stat3 } from "fs/promises";
+import { dirname as dirname6, isAbsolute as isAbsolute3, join as join9 } from "path";
 async function browseWorkspaces(options) {
   const requested = options.path.replace(/^\/+([A-Za-z]:[\\/])/, "$1");
   if (process.platform === "win32" && (requested === "/" || requested === "\\")) {
@@ -2631,16 +3304,16 @@ async function browseWorkspaces(options) {
       throw new Error("\u76EE\u5F55\u5206\u9875\u5DF2\u5931\u6548\uFF0C\u8BF7\u5237\u65B0\u5217\u8868");
     }
   }
-  const entries = (await readdir2(path, { withFileTypes: true })).filter((entry) => (options.showHidden || !entry.name.startsWith(".")) && entry.name.toLowerCase().includes(query)).sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+  const entries = (await readdir3(path, { withFileTypes: true })).filter((entry) => (options.showHidden || !entry.name.startsWith(".")) && entry.name.toLowerCase().includes(query)).sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
   const directories = [];
   let next = offset;
   for (;next < entries.length && directories.length < 100; next++) {
     const entry = entries[next];
-    const target = join8(path, entry.name);
+    const target = join9(path, entry.name);
     if (!entry.isDirectory() && !entry.isSymbolicLink())
       continue;
     try {
-      if (!(await stat2(target)).isDirectory())
+      if (!(await stat3(target)).isDirectory())
         continue;
       await access(target, constants3.R_OK | constants3.X_OK);
       directories.push({ name: entry.name, path: target });
@@ -2650,7 +3323,7 @@ async function browseWorkspaces(options) {
   }
   return {
     path,
-    parent: dirname5(path) === path ? null : dirname5(path),
+    parent: dirname6(path) === path ? null : dirname6(path),
     entries: directories,
     next: next < entries.length ? JSON.stringify({ key, offset: next }) : null
   };
@@ -2670,6 +3343,26 @@ async function listDrives() {
 // packages/gateway/src/server-services.ts
 async function createNekoServerServices(options) {
   const { runtime, context } = options;
+  const market = createSkillMarketClient({
+    marketUrl: options.marketUrl,
+    ...options.promptHome !== undefined ? { home: options.promptHome } : {}
+  });
+  const toRemote = (error) => {
+    if (error instanceof SkillMarketError) {
+      const code = error.code === "skill_not_found" || error.code === "skill_not_installed" ? "service_not_found" : "service_invalid_value";
+      throw new RemoteServiceError(code, `[${error.code}] ${error.message}`);
+    }
+    throw error;
+  };
+  const withInstallState = async (skill, workspaceRoot) => {
+    const locals = await runtime.listSkillsByLevel(workspaceRoot);
+    const installed = {
+      project: locals.some((s) => s.name === skill.name && s.level === "project"),
+      user: locals.some((s) => s.name === skill.name && s.level === "user"),
+      builtin: locals.some((s) => s.name === skill.name && s.level === "builtin")
+    };
+    return { ...skill, installed, activeLevel: activeLevelOf(installed) };
+  };
   const list = async () => (await runtime.listConversations()).map((info) => ({
     id: String(info.id),
     workspaceRoot: info.workspaceRoot,
@@ -2725,7 +3418,8 @@ async function createNekoServerServices(options) {
           { service: NekoModels, mode: "singleton" },
           { service: NekoCredentials, mode: "singleton" },
           { service: NekoWorkspaces, mode: "singleton" },
-          { service: NekoWorkspaceFiles, mode: "singleton" }
+          { service: NekoWorkspaceFiles, mode: "singleton" },
+          { service: NekoSkillMarket, mode: "singleton" }
         ]);
         provider.provide(NekoSessionDirectory, { state: directory });
         const updateCredentials = (operation) => serialize(async () => {
@@ -2775,6 +3469,13 @@ async function createNekoServerServices(options) {
           }
         });
         provider.provide(NekoModels, { list: async () => runtime.listModels() });
+        provider.provide(NekoSkillMarket, {
+          list: (input) => market.list(input.query).then((skills) => Promise.all(skills.map((skill) => withInstallState(skill, input.workspaceRoot)))).catch(toRemote),
+          detail: (input) => market.detail(input.name).then((skill) => withInstallState(skill, input.workspaceRoot)).catch(toRemote),
+          preview: (input) => market.preview(input.name).catch(toRemote),
+          install: (input) => serialize(() => market.install(input).then((result) => ({ ...result })).catch(toRemote)),
+          uninstall: (input) => serialize(() => market.uninstall(input).catch(toRemote))
+        });
         provider.provide(NekoSessionManagement, {
           create: (createOptions) => serialize(async () => {
             const created = await runtime.createConversation(createOptions.model !== undefined || createOptions.thinkingLevel !== undefined || createOptions.cwd !== undefined ? {
@@ -3293,9 +3994,10 @@ async function startGateway(options = {}) {
   const storagePath = options.storagePath ?? fileConfig.storagePath ?? DEFAULT_STORAGE_PATH;
   const host = options.host ?? fileConfig.gateway?.host ?? DEFAULT_HOST;
   const port = options.port !== undefined ? options.port : fileConfig.gateway?.port ?? (process.platform === "win32" ? 0 : DEFAULT_PORT);
-  const nekoDir = dirname6(storagePath);
+  const marketUrl = options.marketUrl ?? fileConfig.skills?.marketUrl ?? DEFAULT_SKILL_MARKET_URL;
+  const nekoDir = dirname7(storagePath);
   const serverId = options.serverId ?? await loadOrCreateServerId(nekoDir);
-  const socketPath = options.socketPath !== undefined ? options.socketPath : fileConfig.gateway?.socketPath !== undefined ? fileConfig.gateway.socketPath : process.platform === "win32" ? null : join9(nekoDir, `${serverId}.sock`);
+  const socketPath = options.socketPath !== undefined ? options.socketPath : fileConfig.gateway?.socketPath !== undefined ? fileConfig.gateway.socketPath : process.platform === "win32" ? null : join10(nekoDir, `${serverId}.sock`);
   const runtime = await createNekoRuntime({
     context,
     storage: options.storage ?? "sqlite",
@@ -3318,6 +4020,8 @@ async function startGateway(options = {}) {
       serverId,
       nekoDir,
       model,
+      marketUrl,
+      promptHome: options.promptHome,
       onError: options.onError
     });
   } catch (error) {
@@ -3328,7 +4032,12 @@ async function startGateway(options = {}) {
 async function bindGateway(runtime, options) {
   const { context, host, port, socketPath, serverId, nekoDir, model } = options;
   const modelLabel = `${model.provider}/${model.modelId}`;
-  const serverServices = await createNekoServerServices({ runtime, context });
+  const serverServices = await createNekoServerServices({
+    runtime,
+    context,
+    marketUrl: options.marketUrl,
+    ...options.promptHome !== undefined ? { promptHome: options.promptHome } : {}
+  });
   let wsListener;
   const listeners = [];
   if (socketPath !== null) {
@@ -3406,15 +4115,15 @@ function serverIdFromSocketPath(socketPath) {
   return isServerId(candidate) ? candidate : undefined;
 }
 async function loadOrCreateServerId(nekoDir) {
-  const file = join9(nekoDir, SERVER_ID_FILENAME);
+  const file = join10(nekoDir, SERVER_ID_FILENAME);
   try {
     const existing = (await readFile5(file, "utf8")).trim();
     if (existing !== "")
       return existing;
   } catch {}
-  const created = randomUUID();
-  await mkdir2(nekoDir, { recursive: true, mode: 448 });
-  await writeFile2(file, `${created}
+  const created = randomUUID2();
+  await mkdir3(nekoDir, { recursive: true, mode: 448 });
+  await writeFile3(file, `${created}
 `, { mode: 384 });
   return created;
 }