vskill 1.0.16 → 1.0.19

package/dist/eval-server/install-jobs.js

@@ -0,0 +1,161 @@
+// ---------------------------------------------------------------------------
+// install-jobs — shared spawn-job runtime for install-skill / install-engine
+// ---------------------------------------------------------------------------
+// Both install-skill-routes and install-engine-routes were ~90% duplicate code:
+//   - InstallJob interface (proc, buffers, subscribers, pastEvents)
+//   - JOBS Map per route (UUID → job)
+//   - localhost-only guard
+//   - stdout/stderr ring-buffered into per-line "progress" events
+//   - SIGTERM on timeout, "done" event on exit/error
+//   - SSE replay-then-subscribe `/:jobId/stream` route
+//
+// Extracting that here means an SSE / timeout / replay bug fix lands once,
+// not twice. Each route file now declares only:
+//   - its argv builder + body validation
+//   - its prefix and metadata shape (TMeta)
+// ---------------------------------------------------------------------------
+import { spawn } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { sendJson } from "./router.js";
+import { initSSE, sendSSE, sendSSEDone } from "./sse-helpers.js";
+import { buildSpawnEnv } from "./utils/spawn-env.js";
+export const STDOUT_BUFFER_CAP = 1024 * 1024; // 1 MiB ring per stream.
+export function isLocalhost(req) {
+    const addr = req.socket.remoteAddress ?? "";
+    return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
+}
+export function trimRing(buf, cap) {
+    return buf.length <= cap ? buf : buf.slice(buf.length - cap);
+}
+function emitToJob(job, event, data) {
+    job.pastEvents.push({ event, data });
+    for (const sub of job.subscribers) {
+        try {
+            sub(event, data);
+        }
+        catch { /* subscriber failed — ignore */ }
+    }
+}
+/**
+ * Spawn `command` with `args`, wire stdout/stderr to per-line "progress"
+ * events, register the job in `jobs`, and emit "done" on exit / error /
+ * timeout. Returns the registered job synchronously so the HTTP handler
+ * can reply with `{ jobId }` immediately.
+ */
+export function startSpawnJob(opts) {
+    const proc = spawn(opts.command, opts.args, {
+        stdio: ["ignore", "pipe", "pipe"],
+        // Scrub env — provider keys / studio overrides are not needed by the
+        // installer command and shouldn't leak to subprocess descendants.
+        env: buildSpawnEnv(),
+    });
+    const job = {
+        id: randomUUID(),
+        meta: opts.meta,
+        proc,
+        stdoutBuffer: "",
+        stderrBuffer: "",
+        exitCode: null,
+        done: false,
+        subscribers: new Set(),
+        pastEvents: [],
+    };
+    proc.stdout?.on("data", (chunk) => {
+        const text = chunk.toString();
+        job.stdoutBuffer = trimRing(job.stdoutBuffer + text, STDOUT_BUFFER_CAP);
+        for (const line of text.split(/\r?\n/)) {
+            if (line.length > 0)
+                emitToJob(job, "progress", { stream: "stdout", line });
+        }
+    });
+    proc.stderr?.on("data", (chunk) => {
+        const text = chunk.toString();
+        job.stderrBuffer = trimRing(job.stderrBuffer + text, STDOUT_BUFFER_CAP);
+        for (const line of text.split(/\r?\n/)) {
+            if (line.length > 0)
+                emitToJob(job, "progress", { stream: "stderr", line });
+        }
+    });
+    let timedOut = false;
+    const timer = setTimeout(() => {
+        timedOut = true;
+        try {
+            proc.kill("SIGTERM");
+        }
+        catch { /* process already gone */ }
+    }, opts.timeoutMs);
+    proc.on("exit", (code) => {
+        clearTimeout(timer);
+        job.exitCode = timedOut ? -1 : code;
+        job.done = true;
+        const stderr = timedOut ? "timeout" : job.stderrBuffer.trim();
+        emitToJob(job, "done", {
+            success: !timedOut && code === 0,
+            exitCode: timedOut ? -1 : code,
+            stderr,
+        });
+    });
+    proc.on("error", (err) => {
+        clearTimeout(timer);
+        job.exitCode = -1;
+        job.done = true;
+        emitToJob(job, "done", {
+            success: false,
+            exitCode: -1,
+            stderr: err.message || "spawn failed",
+        });
+    });
+    opts.jobs.set(job.id, job);
+    return job;
+}
+/**
+ * Mount `GET <prefix>/:jobId/stream` on `router`. The handler enforces the
+ * localhost gate, replays buffered events, then subscribes the SSE response
+ * to live "progress"/"done" events until disconnect.
+ */
+export function mountSpawnStreamRoute(router, prefix, jobs) {
+    router.get(`${prefix}/:jobId/stream`, async (req, res, params) => {
+        if (!isLocalhost(req)) {
+            sendJson(res, { error: "localhost-only endpoint" }, 403, req);
+            return;
+        }
+        const job = jobs.get(params.jobId);
+        if (!job) {
+            sendJson(res, { error: "unknown jobId" }, 404, req);
+            return;
+        }
+        initSSE(res, req);
+        // Replay any events that fired before this stream connected.
+        for (const ev of job.pastEvents) {
+            try {
+                sendSSE(res, ev.event, ev.data);
+            }
+            catch { /* stream closed */ }
+        }
+        if (job.done) {
+            try {
+                res.end();
+            }
+            catch { /* already closed */ }
+            return;
+        }
+        const subscriber = (event, data) => {
+            try {
+                if (event === "done")
+                    sendSSEDone(res, data);
+                else
+                    sendSSE(res, event, data);
+            }
+            catch {
+                // Stream write failed — eagerly drop this subscriber so we don't
+                // accumulate dead listeners on half-open sockets.
+                job.subscribers.delete(subscriber);
+            }
+        };
+        job.subscribers.add(subscriber);
+        const cleanup = () => { job.subscribers.delete(subscriber); };
+        req.on("close", cleanup);
+        req.on("aborted", cleanup);
+    });
+}
+//# sourceMappingURL=install-jobs.js.map

package/dist/eval-server/install-jobs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-jobs.js","sourceRoot":"","sources":["../../src/eval-server/install-jobs.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,gFAAgF;AAChF,oEAAoE;AACpE,sCAAsC;AACtC,2BAA2B;AAC3B,kEAAkE;AAClE,qDAAqD;AACrD,uDAAuD;AACvD,EAAE;AACF,2EAA2E;AAC3E,gDAAgD;AAChD,yCAAyC;AACzC,4CAA4C;AAC5C,8EAA8E;AAG9E,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,yBAAyB;AAwBvE,MAAM,UAAU,WAAW,CAAC,GAAyB;IACnD,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC;IAC5C,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,kBAAkB,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAW,EAAE,GAAW;IAC/C,OAAO,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,SAAS,CAChB,GAAoB,EACpB,KAAe,EACf,IAAa;IAEb,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrC,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;QAClC,IAAI,CAAC;YAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,gCAAgC,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAiC;IAEjC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE;QAC1C,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;QACjC,qEAAqE;QACrE,kEAAkE;QAClE,GAAG,EAAE,aAAa,EAAE;KACrB,CAAC,CAAC;IAEH,MAAM,GAAG,GAAoB;QAC3B,EAAE,EAAE,UAAU,EAAE;QAChB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI;QACJ,YAAY,EAAE,EAAE;QAChB,YAAY,EAAE,EAAE;QAChB,QAAQ,EAAE,IAAI;QACd,IAAI,EAAE,KAAK;QACX,WAAW,EAAE,IAAI,GAAG,EAAE;QACtB,UAAU,EAAE,EAAE;KACf,CAAC;IAEF,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QACxC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC9B,GAAG,CAAC,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,YAAY,GAAG,IAAI,EAAE,iBAAiB,CAAC,CAAC;QACxE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QACxC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC9B,GAAG,CAAC,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,YAAY,GAAG,IAAI,EAAE,iBAAiB,CAAC,CAAC;QACxE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;QAC5B,QAAQ,GAAG,IAAI,CAAC;QAChB,IAAI,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,0BAA0B,CAAC,CAAC;IACpE,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAEnB,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;QACvB,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAChB,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAC9D,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE;YACrB,OAAO,EAAE,CAAC,QAAQ,IAAI,IAAI,KAAK,CAAC;YAChC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;YAC9B,MAAM;SACP,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QACvB,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;QAClB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAChB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE;YACrB,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,CAAC,CAAC;YACZ,MAAM,EAAG,GAAa,CAAC,OAAO,IAAI,cAAc;SACjD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC3B,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAc,EACd,MAAc,EACd,IAAkC;IAElC,MAAM,CAAC,GAAG,CACR,GAAG,MAAM,gBAAgB,EACzB,KAAK,EAAE,GAAyB,EAAE,GAAwB,EAAE,MAA8B,EAAE,EAAE;QAC5F,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,QAAQ,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,QAAQ,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAElB,6DAA6D;QAC7D,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;YAChC,IAAI,CAAC;gBAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,mBAAmB,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACb,IAAI,CAAC;gBAAC,GAAG,CAAC,GAAG,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,CAAC,KAAe,EAAE,IAAa,EAAE,EAAE;YACpD,IAAI,CAAC;gBACH,IAAI,KAAK,KAAK,MAAM;oBAAE,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;;oBACxC,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YACjC,CAAC;YAAC,MAAM,CAAC;gBACP,iEAAiE;gBACjE,kDAAkD;gBAClD,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACrC,CAAC;QACH,CAAC,CAAC;QACF,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAEhC,MAAM,OAAO,GAAG,GAAG,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9D,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACzB,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC7B,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/eval-server/install-skill-routes.d.ts

@@ -1,28 +1,91 @@
-import { type ChildProcess } from "node:child_process";
 import type { Router } from "./router.js";
+import { type SpawnJob, type JobEvent } from "./install-jobs.js";
+import { type AgentInstallResult } from "../installer/multi-install.js";
+import type { ParsedSkill } from "../installer/transformers/index.js";
 type InstallScope = "project" | "user" | "global";
-interface InstallJob {
-    id: string;
+type MultiInstallScope = "project" | "user";
+interface SkillJobMeta {
     skill: string;
     scope: InstallScope;
-    proc: ChildProcess;
-    stdoutBuffer: string;
-    stderrBuffer: string;
-    exitCode: number | null;
+}
+interface MultiInstallJob {
+    id: string;
     done: boolean;
-    subscribers: Set<(event: "progress" | "done", data: unknown) => void>;
+    subscribers: Set<(event: MultiInstallJobEvent, data: unknown) => void>;
     pastEvents: Array<{
-        event: "progress" | "done";
+        event: MultiInstallJobEvent;
         data: unknown;
     }>;
 }
+type MultiInstallJobEvent = JobEvent | "result";
 declare function buildArgs(skill: string, scope: InstallScope): string[];
-export declare function registerInstallSkillRoutes(router: Router): void;
+declare function normalizeInstallScope(scope: InstallScope): MultiInstallScope;
+declare function isValidParsedSkill(s: unknown): s is ParsedSkill;
+type FetchLike = typeof fetch;
+interface ResolveSkillOptions {
+    cwd?: string;
+    home?: string;
+    fetchImpl?: FetchLike;
+    platformBaseUrl?: string;
+    githubTokenProvider?: () => string | null;
+}
+declare function fetchSkillMdFromGitHub(opts: {
+    repoUrl: string;
+    skillPath: string;
+    refs: string[];
+    fetchImpl: FetchLike;
+    token: string | null;
+}): Promise<string | null>;
+declare function resolveParsedSkillFromPlatform(identifier: string, opts?: ResolveSkillOptions): Promise<ParsedSkill | null>;
+/**
+ * Server-side fallback: when the frontend posts a multi-agent install
+ * without `parsedSkill`, locate the skill on disk (project / personal /
+ * plugin cache via {@link locateSkill}), read its SKILL.md, and build a
+ * minimal {@link ParsedSkill}. Keeps the POST payload trivial — the
+ * frontend doesn't need to fetch, parse, and re-marshal SKILL.md itself.
+ *
+ * Returns `null` when no on-disk skill matches the identifier (the route
+ * surfaces this as a 404 so the caller can retry with an explicit
+ * `parsedSkill`).
+ */
+export declare function resolveParsedSkillFromIdentifier(identifier: string, opts?: ResolveSkillOptions): Promise<ParsedSkill | null>;
+declare function validateAgentIds(ids: unknown): {
+    ok: true;
+    ids: string[];
+} | {
+    ok: false;
+    error: string;
+};
+declare function writeMultiInstallLockfile(opts: {
+    identifier: string;
+    skill: ParsedSkill;
+    scope: "project" | "user";
+    projectRoot: string;
+    results: AgentInstallResult[];
+}): void;
+declare function runMultiInstallJob(opts: {
+    identifier: string;
+    skill: ParsedSkill;
+    agentIds: string[];
+    scope: "project" | "user";
+    projectRoot: string;
+}): Promise<MultiInstallJob>;
+export declare function registerInstallSkillRoutes(router: Router, rootArg?: string | (() => string)): void;
 export declare const __test__: {
-    JOBS: Map<string, InstallJob>;
+    JOBS: Map<string, SpawnJob<SkillJobMeta>>;
+    MULTI_JOBS: Map<string, MultiInstallJob>;
     SAFE_NAME: RegExp;
+    SAFE_AGENT_ID: RegExp;
     VALID_SCOPES: ReadonlySet<string>;
     INSTALL_TIMEOUT_MS: number;
     buildArgs: typeof buildArgs;
+    normalizeInstallScope: typeof normalizeInstallScope;
+    validateAgentIds: typeof validateAgentIds;
+    isValidParsedSkill: typeof isValidParsedSkill;
+    resolveParsedSkillFromIdentifier: typeof resolveParsedSkillFromIdentifier;
+    resolveParsedSkillFromPlatform: typeof resolveParsedSkillFromPlatform;
+    fetchSkillMdFromGitHub: typeof fetchSkillMdFromGitHub;
+    runMultiInstallJob: typeof runMultiInstallJob;
+    writeMultiInstallLockfile: typeof writeMultiInstallLockfile;
 };
 export {};