tokentracker-cli 0.42.0 → 0.43.0

package/src/lib/skills-manager.js

@@ -174,13 +174,22 @@ function sanitizePathSegment(value) {
 }
 
 function sanitizeRelativePath(value) {
-  const raw = String(value || "").replace(/\\/g, "/").trim();
-  if (!raw || raw.startsWith("/") || raw.includes("\0")) return null;
+  const input = String(value || "").trim();
+  const raw = input.replace(/\\/g, "/");
+  if (!raw || raw.includes("\0")) return null;
+  if (path.posix.isAbsolute(raw) || path.win32.isAbsolute(input) || path.win32.isAbsolute(raw)) return null;
   const parts = raw.split("/").filter(Boolean);
-  if (!parts.length || parts.some((part) => part === "." || part === "..")) return null;
+  if (!parts.length || parts.some((part) => part === "." || part === ".." || part.includes(":"))) return null;
   return parts.join("/");
 }
 
+function sanitizeLocalSkillPath(value) {
+  const safe = sanitizeRelativePath(value);
+  if (!safe) return null;
+  if (safe.split("/").some((part) => part.startsWith("."))) return null;
+  return safe;
+}
+
 function installNameFromDirectory(directory) {
   const safe = sanitizeRelativePath(directory);
   if (!safe) return null;
@@ -256,6 +265,36 @@ function findSkillMarker(dir) {
   return null;
 }
 
+const MAX_LOCAL_SKILL_SCAN_DEPTH = 3;
+
+function scanSkillDirectories(rootDir) {
+  const found = [];
+  const walk = (dir, relDir = "", depth = 0) => {
+    let entries = [];
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch (_e) {
+      return;
+    }
+    entries.sort((a, b) => a.name.localeCompare(b.name));
+    for (const entry of entries) {
+      if (!entry.isDirectory() && !entry.isSymbolicLink()) continue;
+      if (!entry.name || entry.name.startsWith(".")) continue;
+      const rel = relDir ? `${relDir}/${entry.name}` : entry.name;
+      const full = path.join(dir, entry.name);
+      if (findSkillMarker(full)) {
+        found.push(rel);
+        continue;
+      }
+      // Direct symlinked skills are accepted above, but symlinked group folders
+      // are not traversed so the scan stays within the target skills tree.
+      if (entry.isDirectory() && depth + 1 < MAX_LOCAL_SKILL_SCAN_DEPTH) walk(full, rel, depth + 1);
+    }
+  };
+  walk(rootDir);
+  return found;
+}
+
 const HASH_IGNORE = new Set([".git", ".DS_Store", "Thumbs.db", ".gitignore"]);
 
 // Stable content fingerprint of a skill directory: walk files in sorted order,
@@ -531,19 +570,67 @@ function isSymlink(targetPath) {
   }
 }
 
+function targetSkillPath(baseDir, directory) {
+  const safe = sanitizeRelativePath(directory);
+  if (!safe) return null;
+  const root = path.resolve(baseDir);
+  const targetPath = path.resolve(root, safe);
+  if (!pathStrictlyWithin(root, targetPath)) return null;
+  try {
+    const rootStat = fs.lstatSync(root);
+    if (rootStat.isSymbolicLink() || !rootStat.isDirectory()) return null;
+  } catch (e) {
+    if (e?.code !== "ENOENT") return null;
+  }
+  const parts = safe.split("/");
+  let current = root;
+  for (let i = 0; i < parts.length - 1; i += 1) {
+    current = path.join(current, parts[i]);
+    let stat;
+    try {
+      stat = fs.lstatSync(current);
+    } catch (e) {
+      if (e?.code === "ENOENT") continue;
+      return null;
+    }
+    if (stat.isSymbolicLink() || !stat.isDirectory()) return null;
+  }
+  return targetPath;
+}
+
+function managedSkillPath(directory) {
+  const skillPath = targetSkillPath(ssotDir(), directory);
+  if (!skillPath) throw new Error(`Invalid skill directory: ${directory}`);
+  return skillPath;
+}
+
 function copyDir(source, dest) {
   assertNotNested(source, dest);
   removePath(dest);
   fs.cpSync(source, dest, { recursive: true, force: true });
 }
 
+function removeEmptyAncestors(startDir, stopDir) {
+  let current = path.resolve(startDir);
+  const stop = path.resolve(stopDir);
+  while (pathStrictlyWithin(stop, current)) {
+    try {
+      fs.rmdirSync(current);
+    } catch (_e) {
+      return;
+    }
+    current = path.dirname(current);
+  }
+}
+
 function syncSkillToTarget(directory, targetId) {
   const target = TARGETS[targetId];
   if (!target) throw new Error(`Unsupported target: ${targetId}`);
-  const source = path.join(ssotDir(), directory);
+  const source = managedSkillPath(directory);
   if (!fs.existsSync(source)) throw new Error(`Managed skill not found: ${directory}`);
   for (const baseDir of targetDirs(target)) {
-    const dest = path.join(baseDir, directory);
+    const dest = targetSkillPath(baseDir, directory);
+    if (!dest) throw new Error(`Invalid skill directory: ${directory}`);
     assertNotNested(source, dest);
     ensureDir(path.dirname(dest));
     removePath(dest);
@@ -559,7 +646,10 @@ function removeSkillFromTarget(directory, targetId) {
   const target = TARGETS[targetId];
   if (!target) return;
   for (const baseDir of targetDirs(target)) {
-    removePath(path.join(baseDir, directory));
+    const targetPath = targetSkillPath(baseDir, directory);
+    if (!targetPath) continue;
+    removePath(targetPath);
+    removeEmptyAncestors(path.dirname(targetPath), baseDir);
   }
 }
 
@@ -567,7 +657,8 @@ function scanTargetSkill(directory, targetId) {
   const target = TARGETS[targetId];
   if (!target) return false;
   for (const baseDir of targetDirs(target)) {
-    const candidate = path.join(baseDir, directory);
+    const candidate = targetSkillPath(baseDir, directory);
+    if (!candidate) continue;
     if (fs.existsSync(candidate) || isSymlink(candidate)) return true;
   }
   return false;
@@ -582,7 +673,8 @@ function classifyTargetSkill(directory, targetId) {
   if (!target) return "off";
   let state = "off";
   for (const baseDir of targetDirs(target)) {
-    const candidate = path.join(baseDir, directory);
+    const candidate = targetSkillPath(baseDir, directory);
+    if (!candidate) continue;
     if (fs.existsSync(candidate)) return "synced";
     if (isSymlink(candidate)) state = "orphan";
   }
@@ -612,19 +704,11 @@ function listInstalledSkills() {
   const unmanaged = new Map();
   for (const target of Object.values(TARGETS)) {
     for (const dir of targetDirs(target)) {
-      let entries = [];
-      try {
-        entries = fs.readdirSync(dir, { withFileTypes: true });
-      } catch (_e) {
-        continue;
-      }
-      for (const entry of entries) {
-        if (!entry.isDirectory() && !entry.isSymbolicLink()) continue;
-        const directory = entry.name;
-        if (!directory || directory.startsWith(".") || managedDirs.has(directory.toLowerCase())) continue;
+      for (const directory of scanSkillDirectories(dir)) {
+        if (!directory || managedDirs.has(directory.toLowerCase())) continue;
         const skillPath = findSkillMarker(path.join(dir, directory));
         if (!skillPath) continue;
-        const metadata = readSkillMetadata(fs.readFileSync(skillPath, "utf8"), directory);
+        const metadata = readSkillMetadata(fs.readFileSync(skillPath, "utf8"), installNameFromDirectory(directory) || directory);
         const key = directory.toLowerCase();
         if (!unmanaged.has(key)) {
           unmanaged.set(key, {
@@ -670,6 +754,8 @@ async function installSkill(skillInput, targetIds = ["claude", "codex"]) {
   };
   if (!skill.repoOwner || !skill.repoName) throw new Error("Missing GitHub repository information");
   const sourceDir = sanitizeRelativePath(skill.directory);
+  // GitHub-sourced skills keep the historical flat install name even when
+  // sourceDirectory is nested; local nested-skill support uses importLocalSkill().
   const installName = installNameFromDirectory(sourceDir);
   if (!sourceDir || !installName) throw new Error("Invalid skill directory");
 
@@ -695,7 +781,7 @@ async function installSkill(skillInput, targetIds = ["claude", "codex"]) {
   );
   if (!files.some((entry) => /(^|\/)SKILL\.md$/i.test(entry.path))) throw new Error("SKILL.md not found in selected directory");
 
-  const dest = path.join(ssotDir(), installName);
+  const dest = managedSkillPath(installName);
   const temp = path.join(dataDir(), "tmp", `${installName}-${Date.now()}`);
   removePath(temp);
   ensureDir(temp);
@@ -751,16 +837,18 @@ function uninstallSkill(id) {
   const registry = readRegistry();
   const skill = registry.skills.find((entry) => entry.id === id || entry.key === id);
   if (!skill) throw new Error("Managed skill not found");
+  const ssotPath = managedSkillPath(skill.directory);
   for (const targetId of Object.keys(TARGETS)) removeSkillFromTarget(skill.directory, targetId);
   // Move SSOT copy into a trash bucket so it can be restored briefly. The
   // registry entry is retained but flagged so restoreSkill can re-link it.
-  const ssotPath = path.join(ssotDir(), skill.directory);
   if (fs.existsSync(ssotPath)) {
     ensureDir(trashDir());
     const stamp = Date.now();
-    const trashPath = path.join(trashDir(), `${skill.directory}-${stamp}`);
+    const trashName = `${Buffer.from(String(skill.directory || ""), "utf8").toString("base64url")}-${stamp}`;
+    const trashPath = path.join(trashDir(), trashName);
     try {
       fs.renameSync(ssotPath, trashPath);
+      removeEmptyAncestors(path.dirname(ssotPath), ssotDir());
       skill.trashedAt = stamp;
       skill.trashedDirectory = path.basename(trashPath);
       skill.previousTargets = skill.targets || [];
@@ -773,6 +861,7 @@ function uninstallSkill(id) {
       return { ok: true, trashed: true, restoreId: skill.id, ttlMs: TRASH_TTL_MS };
     } catch (_e) {
       removePath(ssotPath);
+      removeEmptyAncestors(path.dirname(ssotPath), ssotDir());
     }
   }
   registry.skills = registry.skills.filter((entry) => entry.id !== skill.id);
@@ -808,7 +897,7 @@ function restoreSkill(id) {
     throw new Error("Restore window expired");
   }
   const trashPath = path.join(trashDir(), skill.trashedDirectory || "");
-  const ssotPath = path.join(ssotDir(), skill.directory);
+  const ssotPath = managedSkillPath(skill.directory);
   if (!fs.existsSync(trashPath)) throw new Error("Trashed copy is missing");
   ensureDir(path.dirname(ssotPath));
   removePath(ssotPath);
@@ -840,11 +929,12 @@ function setSkillTargets(id, targetIds) {
 }
 
 function findLocalSkillSource(directory) {
-  const installName = sanitizePathSegment(directory);
-  if (!installName) return null;
+  const sourceDir = sanitizeLocalSkillPath(directory);
+  if (!sourceDir) return null;
   for (const target of Object.values(TARGETS)) {
     for (const baseDir of targetDirs(target)) {
-      const skillPath = path.join(baseDir, installName);
+      const skillPath = targetSkillPath(baseDir, sourceDir);
+      if (!skillPath) continue;
       if (findSkillMarker(skillPath)) {
         return { path: skillPath, targetId: target.id };
       }
@@ -854,33 +944,36 @@ function findLocalSkillSource(directory) {
 }
 
 function importLocalSkill(directory, targetIds = []) {
-  const installName = sanitizePathSegment(directory);
-  if (!installName) throw new Error("Invalid skill directory");
+  const sourceDir = sanitizeLocalSkillPath(directory);
+  if (!sourceDir) throw new Error("Invalid skill directory");
   const registry = readRegistry();
-  const existing = registry.skills.find((entry) => entry.directory.toLowerCase() === installName.toLowerCase());
+  const existing = registry.skills.find((entry) => String(entry.directory || "").toLowerCase() === sourceDir.toLowerCase());
   if (existing) {
+    if (!String(existing.id || existing.key || "").startsWith("local:")) {
+      throw new Error(`Skill directory "${sourceDir}" is already managed by another installed skill`);
+    }
     if (!targetIds || !targetIds.length) {
       return { ...existing, managed: true, targets: existing.targets || [] };
     }
     return setSkillTargets(existing.id, targetIds);
   }
 
-  const source = findLocalSkillSource(installName);
+  const source = findLocalSkillSource(sourceDir);
   if (!source) throw new Error("Local skill not found");
 
-  const dest = path.join(ssotDir(), installName);
+  const dest = managedSkillPath(sourceDir);
   copyDir(source.path, dest);
   const skillMarker = findSkillMarker(dest);
-  const metadata = readSkillMetadata(skillMarker ? fs.readFileSync(skillMarker, "utf8") : "", installName);
-  const discoveredTargets = Object.keys(TARGETS).filter((targetId) => scanTargetSkill(installName, targetId));
+  const metadata = readSkillMetadata(skillMarker ? fs.readFileSync(skillMarker, "utf8") : "", installNameFromDirectory(sourceDir));
+  const discoveredTargets = Object.keys(TARGETS).filter((targetId) => scanTargetSkill(sourceDir, targetId));
   const selectedTargets = (targetIds.length ? targetIds : discoveredTargets).filter((targetId) => TARGETS[targetId]);
   const skill = {
-    id: `local:${installName}`,
-    key: `local:${installName}`,
+    id: `local:${sourceDir}`,
+    key: `local:${sourceDir}`,
     name: metadata.name,
     description: metadata.description,
-    directory: installName,
-    sourceDirectory: installName,
+    directory: sourceDir,
+    sourceDirectory: sourceDir,
     readmeUrl: null,
     repoOwner: null,
     repoName: null,
@@ -893,15 +986,15 @@ function importLocalSkill(directory, targetIds = []) {
   registry.skills.push(skill);
   saveRegistry(registry);
   for (const targetId of Object.keys(TARGETS)) {
-    if (selectedTargets.includes(targetId)) syncSkillToTarget(installName, targetId);
-    else removeSkillFromTarget(installName, targetId);
+    if (selectedTargets.includes(targetId)) syncSkillToTarget(sourceDir, targetId);
+    else removeSkillFromTarget(sourceDir, targetId);
   }
-  appendActivity({ action: "import", name: skill.name, directory: installName, targets: selectedTargets });
+  appendActivity({ action: "import", name: skill.name, directory: sourceDir, targets: selectedTargets });
   return { ...skill, managed: true, targets: selectedTargets };
 }
 
 function deleteLocalSkill(directory, targetIds = []) {
-  const installName = sanitizePathSegment(directory);
+  const installName = sanitizeLocalSkillPath(directory);
   if (!installName) throw new Error("Invalid skill directory");
   const selectedTargets = targetIds.length ? targetIds : Object.keys(TARGETS);
   for (const targetId of selectedTargets) removeSkillFromTarget(installName, targetId);