vskill 1.0.15 → 1.0.18

package/dist/eval-server/api-routes.js

@@ -931,6 +931,12 @@ export const PROVIDER_MODELS = {
     // what models the user has loaded. The probe at probeLmStudio() populates
     // this dynamically from GET /v1/models.
     "lm-studio": [],
+    // 0857: `stub` is a deterministic TEST SEAM (src/eval/llm.ts createStubClient),
+    // NOT a user-facing provider. This empty list exists only to satisfy the
+    // `Record<ProviderName, ModelOption[]>` exhaustiveness check — `stub` is
+    // deliberately excluded from `detectAvailableProviders()` and
+    // `KNOWN_PROVIDER_NAMES`, so it never reaches /api/config or the picker.
+    "stub": [],
 };
 // ---------------------------------------------------------------------------
 // Local provider detection caches — avoid 500ms+ probes on every /api/config
@@ -2425,6 +2431,47 @@ export function registerRoutes(router, root, projectName) {
             sendJson(res, { error: "Invalid skill path", code: "invalid-path" }, 400, req);
             return;
         }
+        // 0786 AC-US3-03: lockfile-first gate. The previous flow attempted the
+        // lockfile delete first, then the dir trash, and only returned a generic
+        // 404 not-installed when both fell through — which surfaced as a
+        // cryptic "Couldn't uninstall <skill>: api…" toast on source-authored
+        // skills. Now: read the lockfile up front, and if the skill is not a
+        // lockfile-tracked installed plugin skill, return HTTP 422 with the
+        // structured `not-installed` code so the UI can render a friendly
+        // "use Delete instead" message (see App.tsx pendingUninstall onFailure).
+        //
+        // Response contract:
+        //   400 invalid-skill-name         — bad kebab regex
+        //   400 invalid-path               — path-traversal attempt
+        //   422 not-installed              — skill not in lockfile (this gate)
+        //   500 lockfile-read-failed       — readLockfile threw
+        //   500 lockfile-write-failed      — writeLockfile threw
+        //   500 trash-failed               — trash threw
+        //   200 ok                         — entry removed from lockfile, dir trashed
+        //
+        // 0786 review F-003: lockfile key is currently the bare skill name
+        // (`lock.skills[params.skill]`) — params.plugin is intentionally NOT part
+        // of the key because the on-disk layout `~/.claude/skills/<skill>/` is
+        // unscoped. If two installed skills ever share the same name across
+        // different plugins, this gate disambiguates the FIRST uninstall correctly
+        // (entry removed) and 422s the SECOND (no entry left). The pre-0786 flow
+        // had the same shape; documenting the limitation here so future contributors
+        // don't accidentally introduce a plugin-scoped check on one side without
+        // updating writeLockfile / skill-list (api-routes.ts:1940 same shape).
+        let lockfileEntryExists = false;
+        try {
+            const lockBefore = readLockfile(root);
+            lockfileEntryExists = !!(lockBefore?.skills &&
+                Object.prototype.hasOwnProperty.call(lockBefore.skills, params.skill));
+        }
+        catch (err) {
+            sendJson(res, { error: `Failed to read lockfile: ${err.message}`, code: "lockfile-read-failed" }, 500, req);
+            return;
+        }
+        if (!lockfileEntryExists) {
+            sendJson(res, { error: `${params.skill} is not installed`, code: "not-installed" }, 422, req);
+            return;
+        }
         let removedFromLockfile = false;
         try {
             const lock = readLockfile(root);
@@ -2454,10 +2501,6 @@ export function registerRoutes(router, root, projectName) {
                 return;
             }
         }
-        if (!removedFromLockfile && trashedDir === null) {
-            sendJson(res, { error: "Skill is not installed", code: "not-installed" }, 404, req);
-            return;
-        }
         sendJson(res, { ok: true, removedFromLockfile, trashedDir }, 200, req);
     });
     // Get skill description (for activation testing preview)
@@ -3469,14 +3512,171 @@ Return ONLY the JSON lines, no other text.`;
         }
         sendJson(res, { ok: true, command: launch.command, args: launch.args }, 200, req);
     });
-    // Handle CORS preflight
+    // -------------------------------------------------------------------------
+    // 0828 — POST /api/skills/clone
+    //
+    // Closes the gap left by 0822 (vskill-clone-skill-fork) which shipped the
+    // CLI but explicitly deferred Studio UI ("This increment is CLI-only" —
+    // 0822/spec.md:149). Forks an installed skill into the authoring scope by
+    // spawning the `vskill clone` binary with --target standalone --path
+    // <root>/skills/<skill-name>-fork --yes (auto-confirm, non-interactive).
+    //
+    // We shell out rather than calling runCloneOnce in-process because the
+    // CLI orchestrator uses `process.exit()` on errors (cloneCommand:580) and
+    // because spawning the same binary the user would run from terminal keeps
+    // a single source of truth — if the CLI gains new flags, this route
+    // automatically benefits.
+    //
+    // Body schema:
+    //   { source: string,            // skill name to clone
+    //     sourcePlugin?: string,     // plugin context (informational)
+    //     target?: "standalone",     // only standalone supported in v1
+    //     path?: string,             // optional override; defaults to <root>/skills/<name>-fork
+    //     author?: string,           // defaults to git config user.name
+    //     namespace?: string,        // defaults to slugified author
+    //     force?: boolean }          // overwrite existing target
+    //
+    // Returns:
+    //   200 { ok: true, target: <abs path>, files: <count>, stdout: <tail> }
+    //   400 { error: "invalid_body" | "invalid_source" }
+    //   500 { error: "clone_failed", message: <stderr tail>, exitCode }
+    // -------------------------------------------------------------------------
+    router.post("/api/skills/clone", async (req, res) => {
+        let body;
+        try {
+            body = (await readBody(req));
+        }
+        catch {
+            sendJson(res, { error: "invalid_body" }, 400, req);
+            return;
+        }
+        const source = typeof body.source === "string" ? body.source.trim() : "";
+        if (!source || !/^[a-z0-9][a-z0-9-]*$/i.test(source) || source.length > 64) {
+            sendJson(res, { error: "invalid_source" }, 400, req);
+            return;
+        }
+        const validTargets = ["standalone", "plugin", "new-plugin"];
+        const target = validTargets.includes(body.target)
+            ? body.target
+            : "standalone";
+        // Resolve the path inside `root`, with a path-traversal guard for any
+        // client-supplied path. We compute `targetPath` for the response payload;
+        // for plugin / new-plugin targets the CLI computes the actual skill dir
+        // from --plugin / --plugin-name.
+        const rootAbs = resolve(root);
+        function ensureInsideRoot(p) {
+            const abs = resolve(rootAbs, p);
+            if (abs !== rootAbs && !abs.startsWith(rootAbs + "/"))
+                return null;
+            return abs;
+        }
+        const slug = source.toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "");
+        let targetPath = "";
+        // Build CLI args. We always pass --yes to avoid hanging on a missing TTY.
+        const cliArgs = ["clone", source, "--yes", "--target", target];
+        if (target === "standalone") {
+            const defaultDir = join(rootAbs, "skills", `${slug}-fork`);
+            targetPath = defaultDir;
+            if (typeof body.path === "string" && body.path.trim()) {
+                const candidate = ensureInsideRoot(body.path);
+                if (!candidate) {
+                    sendJson(res, { error: "path_outside_root" }, 400, req);
+                    return;
+                }
+                targetPath = candidate;
+            }
+            cliArgs.push("--path", targetPath);
+        }
+        else if (target === "plugin") {
+            // Existing plugin — body.plugin is the plugin name OR an absolute path.
+            const plugin = typeof body.plugin === "string" ? body.plugin.trim() : "";
+            if (!plugin) {
+                sendJson(res, { error: "missing_plugin" }, 400, req);
+                return;
+            }
+            // If it looks like a path, validate it's inside root. Otherwise let the
+            // CLI resolve the plugin name from its registry.
+            if (plugin.startsWith("/") || plugin.startsWith(".") || plugin.includes("/")) {
+                const candidate = ensureInsideRoot(plugin);
+                if (!candidate) {
+                    sendJson(res, { error: "path_outside_root" }, 400, req);
+                    return;
+                }
+                cliArgs.push("--plugin", candidate);
+                targetPath = join(candidate, "skills", slug);
+            }
+            else {
+                cliArgs.push("--plugin", plugin);
+                targetPath = `<plugin:${plugin}>/skills/${slug}`; // informational
+            }
+        }
+        else {
+            // new-plugin — scaffold a fresh plugin folder.
+            const pluginName = typeof body.pluginName === "string" ? body.pluginName.trim() : "";
+            if (!pluginName || !/^[a-z][a-z0-9-]{0,62}[a-z0-9]$/.test(pluginName)) {
+                sendJson(res, { error: "invalid_plugin_name" }, 400, req);
+                return;
+            }
+            const pluginRoot = join(rootAbs, pluginName);
+            cliArgs.push("--plugin-name", pluginName);
+            cliArgs.push("--path", pluginRoot);
+            targetPath = join(pluginRoot, "skills", slug);
+        }
+        if (typeof body.author === "string" && body.author.trim()) {
+            cliArgs.push("--author", body.author.trim());
+        }
+        if (typeof body.namespace === "string" && body.namespace.trim()) {
+            cliArgs.push("--namespace", body.namespace.trim());
+        }
+        if (body.force === true)
+            cliArgs.push("--force");
+        // Spawn the `vskill` binary on PATH — same pattern used by
+        // install-skill-routes.ts:74 for `vskill install`. This keeps a single
+        // source of truth (whatever the user runs from terminal also runs here).
+        let stdout = "";
+        let stderr = "";
+        const exitCode = await new Promise((resolveCode) => {
+            const child = spawn("vskill", cliArgs, {
+                cwd: root,
+                stdio: ["ignore", "pipe", "pipe"],
+            });
+            child.stdout?.on("data", (c) => { stdout += c.toString(); });
+            child.stderr?.on("data", (c) => { stderr += c.toString(); });
+            child.on("error", () => resolveCode(127));
+            child.on("close", (code) => resolveCode(code));
+        });
+        if (exitCode !== 0) {
+            const tail = (stderr || stdout).trim().split("\n").slice(-6).join("\n");
+            sendJson(res, { error: "clone_failed", message: tail || "non-zero exit", exitCode }, 500, req);
+            return;
+        }
+        // Parse "files: N" from stdout for the response.
+        const filesMatch = stdout.match(/files:\s+(\d+)/);
+        const files = filesMatch ? parseInt(filesMatch[1], 10) : null;
+        sendJson(res, {
+            ok: true,
+            target: targetPath,
+            files,
+            stdout: stdout.trim().split("\n").slice(-8).join("\n"),
+        }, 200, req);
+    });
+    // Handle CORS preflight.
+    //
+    // 0836 US-002 (F-017 follow-up): every authenticated /api/* request now
+    // carries the `X-Studio-Token` custom header. Browser-initiated cross-origin
+    // fetches issue a CORS preflight; the response MUST list `X-Studio-Token`
+    // in `Access-Control-Allow-Headers` or the browser blocks the actual
+    // request. The desktop hot path is same-origin (WebView is navigated to
+    // `http://127.0.0.1:{port}/`) and skips preflight, but CLI users opening
+    // the studio in a regular browser tab — and any future cross-origin
+    // tooling — depend on this echo.
     router.options = (req, res) => {
         const origin = req.headers.origin;
         if (origin && /^https?:\/\/(localhost|127\.0\.0\.1)(:\d+)?$/.test(origin)) {
             res.writeHead(204, {
                 "Access-Control-Allow-Origin": origin,
                 "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
-                "Access-Control-Allow-Headers": "Content-Type",
+                "Access-Control-Allow-Headers": "Content-Type, X-Studio-Token",
                 "Access-Control-Max-Age": "3600",
             });
         }