openworkgraph 0.2.12 → 0.3.0

package/dist/skills-management-api.js

@@ -0,0 +1,139 @@
+import { Auth } from './auth.js';
+import { ServiceError } from './errors.js';
+import { readJson } from './http.js';
+export class SkillsManagementApi {
+    auth;
+    runtime;
+    constructor(auth, runtime) {
+        this.auth = auth;
+        this.runtime = runtime;
+    }
+    async decorate(item) {
+        if (!item.installed)
+            return item;
+        const entry = await this.runtime.skills.packageEntry(item.skillId, item.packageVersion);
+        if (!entry.config.environment.length)
+            return { ...item, configuration: 'none' };
+        const config = await this.runtime.skillConfigs.read(item.skillId, entry.config);
+        const ready = entry.config.environment.filter(field => field.required).every(field => config.values.some(value => value.name === field.name && value.configured));
+        return { ...item, configuration: ready ? 'ready' : 'required' };
+    }
+    async handle(request, rawPath, token, origin) {
+        const pathname = rawPath.split('?')[0];
+        if (pathname !== '/v1/skills' && !pathname.startsWith('/v1/skills/'))
+            return { handled: false };
+        this.auth.withSession(token, origin, () => undefined);
+        const url = new URL(rawPath, 'http://localhost');
+        const match = /^\/v1\/skills(?:\/([^/]+)(?:\/(install|update|uninstall|config|files))?)?$/.exec(pathname);
+        if (!match)
+            throw new ServiceError('NOT_FOUND', '技能管理接口不存在。');
+        let id;
+        if (match[1]) {
+            try {
+                id = decodeURIComponent(match[1]);
+            }
+            catch {
+                throw new ServiceError('INVALID_REQUEST', '技能身份编码无效。');
+            }
+            if (!id || id.length > 1024 || /[\x00-\x1f\x7f]/.test(id))
+                throw new ServiceError('INVALID_REQUEST', '技能身份无效。');
+        }
+        const action = match[2];
+        const allowed = !id ? ['refresh', 'offset', 'limit', 'installed', 'query'] : !action ? ['locale'] : action === 'files' ? ['version', 'path'] : [];
+        if ([...url.searchParams.keys()].some(key => !allowed.includes(key) || url.searchParams.getAll(key).length !== 1))
+            throw new ServiceError('INVALID_REQUEST', '技能查询参数无效。');
+        let result;
+        if (request.method === 'GET' && !id) {
+            if (url.searchParams.has('refresh') && url.searchParams.get('refresh') !== '1')
+                throw new ServiceError('INVALID_REQUEST', 'refresh 必须为 1。');
+            const integer = (name, fallback, minimum, maximum) => {
+                const raw = url.searchParams.get(name);
+                if (raw === null)
+                    return fallback;
+                const value = Number(raw);
+                if (!/^(0|[1-9][0-9]*)$/.test(raw) || !Number.isSafeInteger(value) || value < minimum || value > maximum)
+                    throw new ServiceError('INVALID_REQUEST', '技能分页参数无效。');
+                return value;
+            };
+            const offset = integer('offset', 0, 0, Number.MAX_SAFE_INTEGER);
+            const limit = integer('limit', 100, 1, offset === 0 ? 100 : 50);
+            const installed = url.searchParams.get('installed');
+            if (installed !== null && installed !== '1')
+                throw new ServiceError('INVALID_REQUEST', 'installed 必须为 1。');
+            if (installed && (url.searchParams.has('offset') || url.searchParams.has('limit')))
+                throw new ServiceError('INVALID_REQUEST', '已安装技能列表不接受分页参数。');
+            const query = (url.searchParams.get('query') ?? '').trim().toLocaleLowerCase();
+            if (query.length > 1024)
+                throw new ServiceError('INVALID_REQUEST', '技能搜索内容过长。');
+            const catalog = await this.runtime.skills.catalog(url.searchParams.get('refresh') === '1');
+            const filtered = catalog.items.filter(item => (!installed || item.installed) && (item.name + ' ' + item.description).toLocaleLowerCase().includes(query));
+            // Unpaged calls remain compatible with welcome setup and skill suggestions.
+            const paged = !installed && (url.searchParams.has('offset') || url.searchParams.has('limit'));
+            const items = paged ? filtered.slice(offset, offset + limit) : filtered;
+            const installedSignature = JSON.stringify(catalog.items.filter(item => item.installed).map(item => [item.skillId, item.packageVersion, item.revision]).sort());
+            result = { ...catalog, installedSignature, total: filtered.length, ...(paged && offset + items.length < filtered.length ? { nextOffset: offset + items.length } : {}), items: await Promise.all(items.map(async (item) => {
+                    try {
+                        return await this.decorate(item);
+                    }
+                    catch {
+                        return { ...item, error: '已安装技能或配置不可用，请检查工作空间。' };
+                    }
+                })) };
+        }
+        else if (request.method === 'GET' && id && !action) {
+            const detail = await this.runtime.skills.detail(id, url.searchParams.get('locale') ?? 'en');
+            result = { ...detail, item: await this.decorate(detail.item) };
+        }
+        else if (request.method === 'GET' && id && action === 'files') {
+            const version = url.searchParams.get('version');
+            const path = url.searchParams.get('path');
+            if (!version || !path)
+                throw new ServiceError('INVALID_REQUEST', '技能资源需要固定版本与包内路径。');
+            const bytes = await this.runtime.skills.readPackageFile(id, version, path);
+            this.auth.withSession(token, origin, () => undefined);
+            const mime = { png: 'image/png', jpg: 'image/jpeg', jpeg: 'image/jpeg', gif: 'image/gif', webp: 'image/webp', avif: 'image/avif' };
+            const type = mime[path.split('.').pop().toLowerCase()];
+            return { handled: true, binary: bytes, headers: { 'Content-Type': type ?? 'application/octet-stream', 'Content-Disposition': (type ? 'inline' : 'attachment'), 'Cache-Control': 'private, no-store', 'X-Content-Type-Options': 'nosniff', 'Content-Security-Policy': "sandbox; default-src 'none'" } };
+        }
+        else if (id && action === 'config' && ['GET', 'PUT', 'DELETE'].includes(request.method ?? '')) {
+            if (request.method === 'DELETE') {
+                const body = await readJson(request, 256 * 1024);
+                this.revisionBody(body);
+                this.auth.withSession(token, origin, () => undefined);
+                result = await this.runtime.skillConfigs.clear(id, body.expectedRevision);
+            }
+            else {
+                if (request.method === 'GET') {
+                    const entry = await this.runtime.skills.packageEntry(id);
+                    result = { ...await this.runtime.skillConfigs.read(id, entry.config), packageVersion: entry.item.packageVersion };
+                }
+                else {
+                    const body = await readJson(request, 256 * 1024);
+                    if (typeof body.expectedPackageVersion !== 'string' || !/^[a-f0-9]{64}$/.test(body.expectedPackageVersion) || Object.keys(body).some(key => !['expectedPackageVersion', 'expectedRevision', 'values'].includes(key)))
+                        throw new ServiceError('INVALID_REQUEST', '保存技能配置需要固定的 expectedPackageVersion。');
+                    this.auth.withSession(token, origin, () => undefined);
+                    const { expectedPackageVersion, ...write } = body;
+                    result = await this.runtime.skills.withPackageEntry(id, expectedPackageVersion, async (entry) => ({
+                        ...await this.runtime.skillConfigs.write(id, entry.config, write), packageVersion: entry.item.packageVersion,
+                    }));
+                }
+            }
+        }
+        else if (request.method === 'POST' && id && ['install', 'update', 'uninstall'].includes(action ?? '')) {
+            const body = await readJson(request, 16 * 1024);
+            this.revisionBody(body);
+            this.auth.withSession(token, origin, () => undefined);
+            const item = action === 'uninstall' ? await this.runtime.skills.uninstall(id, body.expectedRevision) : await this.runtime.skills.install(id, body.expectedRevision);
+            result = await this.decorate(item);
+        }
+        else
+            throw new ServiceError('NOT_FOUND', '技能管理接口不存在。');
+        this.auth.withSession(token, origin, () => undefined);
+        return { handled: true, body: result };
+    }
+    revisionBody(body) {
+        if (Object.keys(body).length !== 1 || !Number.isSafeInteger(body.expectedRevision) || Number(body.expectedRevision) < 0)
+            throw new ServiceError('INVALID_REQUEST', '技能操作只接受有效的 expectedRevision。');
+    }
+}
+//# sourceMappingURL=skills-management-api.js.map

package/dist/vendor/protocol/index.d.ts

@@ -5,7 +5,7 @@ export * from './execution-chain.js';
 export * from './graph-title.js';
 export * from './graph-binary.js';
 export declare const PROTOCOL_VERSION: '1.0';
-export declare const SERVICE_VERSION: '0.2.12';
+export declare const SERVICE_VERSION: '0.3.0';
 /** Work Graph uploads use the UI's binary MB convention. */
 export declare const WORKGRAPH_UPLOAD_MAX_BYTES: number;
 export declare const WORKGRAPH_TRANSFER_TOTAL_BYTES: number;
@@ -458,6 +458,7 @@ export interface InputSnapshotBase {
     prompt: string;
     resources: ResourceEnvelope[];
     projectFiles?: ProjectFileInput[];
+    skills?: import('./skills.js').FrozenSkill[];
 }
 export type InputSnapshot = InputSnapshotBase & ({
     model: ModelSelection;
@@ -615,3 +616,4 @@ export interface LocalRestoreControl {
     restore(path: string, expectedSha256: string): Promise<void>;
 }
 export { previewEdgeError } from "./preview.js";
+export * from './skills.js';

package/dist/vendor/protocol/index.js

@@ -5,7 +5,7 @@ export * from './execution-chain.js';
 export * from './graph-title.js';
 export * from './graph-binary.js';
 export const PROTOCOL_VERSION = '1.0';
-export const SERVICE_VERSION = '0.2.12';
+export const SERVICE_VERSION = '0.3.0';
 /** Work Graph uploads use the UI's binary MB convention. */
 export const WORKGRAPH_UPLOAD_MAX_BYTES = 300 * 1024 * 1024;
 export const WORKGRAPH_TRANSFER_TOTAL_BYTES = 1024 * 1024 * 1024;
@@ -17,4 +17,5 @@ export function isTerminalRunStatus(status) { return TERMINAL_RUN_STATUSES.inclu
 export const ERROR_CODES = ['INVALID_REQUEST', 'UNAUTHENTICATED', 'ORIGIN_DENIED', 'HOST_DENIED', 'PAIRING_CODE_INVALID', 'PAIRING_CODE_EXPIRED', 'PAIRING_CODE_USED', 'SESSION_EXPIRED', 'SESSION_REVOKED', 'PAYLOAD_TOO_LARGE', 'UNSUPPORTED_MEDIA_TYPE', 'SERVICE_NOT_RUNNING', 'SERVICE_MISMATCH', 'PROTOCOL_INCOMPATIBLE', 'NOT_FOUND', 'NOT_IMPLEMENTED', 'CONFLICT', 'IDEMPOTENCY_CONFLICT', 'PROJECT_INACTIVE', 'PROJECT_UNAVAILABLE', 'ACTIVE_RUN', 'REVISION_CONFLICT', 'NODE_LOCKED', 'INVALID_EDGE', 'INPUT_BLOCKED', 'INPUT_BUDGET_EXCEEDED', 'PLUGIN_UNAVAILABLE', 'MODEL_UNAVAILABLE', 'ALREADY_HANDLED', 'CURSOR_EXPIRED', 'MAINTENANCE', 'SCHEMA_UNSUPPORTED', 'MIGRATION_FAILED', 'INTERNAL_ERROR'];
 export function isProtocolCompatible(version) { return /^1\.\d+$/.test(version); }
 export { previewEdgeError } from "./preview.js";
+export * from './skills.js';
 //# sourceMappingURL=index.js.map

package/dist/vendor/protocol/skills.d.ts

@@ -0,0 +1,107 @@
+/** Skill identities are portable; paths and configuration values never belong in graph packages. */
+export declare const SKILL_NAME_PATTERN = "[A-Za-z0-9_.:-]+";
+export declare function isSkillName(value: unknown): value is string;
+/** Exact catalog names win, including names ending in dots. Otherwise trailing
+ * dots are sentence punctuation; internal dots remain part of the name. */
+export declare function legacySkillMentions(prompt: string, knownNames?: readonly string[]): {
+    name: string;
+    start: number;
+    end: number;
+}[];
+export interface SkillReference {
+    skillId: string;
+    source: 'openworkgraph' | 'codex';
+    name: string;
+    start: number;
+    end: number;
+}
+export interface SkillCandidate {
+    skillId: string;
+    source: 'openworkgraph' | 'codex';
+    name: string;
+    description: string;
+}
+export interface SkillEnvironmentField {
+    name: string;
+    label: string;
+    description: string;
+    required: boolean;
+    secret: boolean;
+    default?: string;
+    translations?: Record<string, {
+        label: string;
+        description: string;
+    }>;
+}
+export interface SkillConfigSchema {
+    version: 1;
+    environment: SkillEnvironmentField[];
+}
+export interface SkillSource {
+    id: string;
+    repository: string;
+    branch: string;
+    directory: string;
+}
+export interface SkillCatalogItem {
+    skillId: string;
+    source: SkillSource;
+    directory: string;
+    name: string;
+    description: string;
+    installed: boolean;
+    revision: number;
+    packageVersion?: string;
+    commitSha?: string;
+    updateAvailable: boolean;
+    configuration: 'none' | 'required' | 'ready';
+    error?: string;
+}
+export interface SkillCatalogQuery {
+    offset?: number;
+    limit?: number;
+    installedOnly?: boolean;
+    query?: string;
+}
+export interface SkillCatalog {
+    items: SkillCatalogItem[];
+    stale: boolean;
+    error?: string;
+    total?: number;
+    nextOffset?: number;
+    installedSignature?: string;
+}
+export interface SkillDetail {
+    item: SkillCatalogItem;
+    readme: string;
+    config: SkillConfigSchema;
+}
+export interface SkillConfigValue {
+    name: string;
+    configured: boolean;
+    value?: string;
+}
+export interface SkillConfiguration {
+    skillId: string;
+    revision: number;
+    schema: SkillConfigSchema;
+    values: SkillConfigValue[];
+    packageVersion?: string;
+}
+export interface SkillConfigurationWrite {
+    expectedRevision: number;
+    values: Record<string, string | null>;
+    expectedPackageVersion?: string;
+}
+/** Frozen public metadata. Credentials are resolved separately from protected revisions at launch. */
+export interface FrozenSkill {
+    skillId: string;
+    source: 'openworkgraph' | 'codex';
+    name: string;
+    description: string;
+    path: string;
+    packageVersion?: string;
+    configRevision?: number;
+    explicit: boolean;
+    requiresConfiguration: boolean;
+}

package/dist/vendor/protocol/skills.js

@@ -0,0 +1,33 @@
+/** Skill identities are portable; paths and configuration values never belong in graph packages. */
+export const SKILL_NAME_PATTERN = '[A-Za-z0-9_.:-]+';
+const skillName = new RegExp('^' + SKILL_NAME_PATTERN + '$');
+export function isSkillName(value) {
+    return typeof value === 'string' && value.length <= 128 && skillName.test(value);
+}
+/** Exact catalog names win, including names ending in dots. Otherwise trailing
+ * dots are sentence punctuation; internal dots remain part of the name. */
+export function legacySkillMentions(prompt, knownNames = []) {
+    const known = new Set(knownNames);
+    const result = [];
+    for (const match of prompt.matchAll(new RegExp('(?:^|[^\\w$])\\$(' + SKILL_NAME_PATTERN + ')', 'g'))) {
+        const raw = match[1];
+        const base = raw.replace(/\.+$/, '');
+        let name = raw;
+        if (!known.has(raw)) {
+            name = base || raw;
+            for (let length = Math.min(raw.length - 1, 128); length > base.length; length--) {
+                const candidate = raw.slice(0, length);
+                if (known.has(candidate)) {
+                    name = candidate;
+                    break;
+                }
+            }
+        }
+        if (!isSkillName(name))
+            continue;
+        const start = match.index + match[0].lastIndexOf('$');
+        result.push({ name, start, end: start + name.length + 1 });
+    }
+    return result;
+}
+//# sourceMappingURL=skills.js.map

package/package.json

@@ -1,9 +1,9 @@
 {
-  "name": "openworkgraph", "version": "0.2.12", "type": "module",
+  "name": "openworkgraph", "version": "0.3.0", "type": "module",
   "publishConfig": { "access": "public" },
   "engines": { "node": ">=24.0.0" },
   "bin": { "openworkgraph": "dist/cli.js" },
   "files": ["dist/**/*.js", "dist/**/*.d.ts", "README.md"],
   "scripts": { "prebuild": "node ../scripts/check-versions.mjs --quiet", "build": "tsc -p tsconfig.json && node scripts/vendor-protocol.mjs", "prepack": "node scripts/prepare-pack.mjs", "typecheck": "tsc -p tsconfig.json --noEmit", "start": "node dist/cli.js", "test": "node --test test/*.test.mjs" },
-  "dependencies": { "sharp": "^0.35.4" }
+  "dependencies": { "sharp": "^0.35.4", "yaml": "^2.9.1" }
 }