From 947a3be90541d681525573536682b6e07308e094 Mon Sep 17 00:00:00 2001 From: SurviveM <254925152+SurviveM@users.noreply.github.com> Date: Tue, 31 Mar 2026 17:50:50 +0800 Subject: [PATCH 01/19] feat: add local skills market and LAN web defaults --- README.en.md | 34 ++- README.md | 34 ++- cli.js | 245 ++++++++++++---- site/guide/getting-started.md | 2 +- tests/unit/config-tabs-ui.test.mjs | 45 +++ tests/unit/run.mjs | 2 + .../session-tab-switch-performance.test.mjs | 21 ++ tests/unit/skills-market-runtime.test.mjs | 127 ++++++++ tests/unit/skills-modal-ui.test.mjs | 13 + tests/unit/web-run-host.test.mjs | 147 ++++++++++ web-ui/app.js | 6 +- web-ui/index.html | 276 +++++++++++++++++- web-ui/modules/config-mode.computed.mjs | 1 + web-ui/modules/skills.computed.mjs | 27 +- web-ui/modules/skills.methods.mjs | 108 +++++-- web-ui/session-helpers.mjs | 5 + web-ui/styles.css | 158 ++++++++++ 17 files changed, 1143 insertions(+), 108 deletions(-) create mode 100644 tests/unit/skills-market-runtime.test.mjs create mode 100644 tests/unit/web-run-host.test.mjs diff --git a/README.en.md b/README.en.md index 4ed73ee..fb35085 100644 --- a/README.en.md +++ b/README.en.md @@ -23,9 +23,10 @@ Codex Mate is a local-first CLI + Web UI for unified management of: - Codex provider/model switching and config writes - Claude Code profiles (writes to `~/.claude/settings.json`) - OpenClaw JSON5 profiles and workspace `AGENTS.md` +- Local skills market for Codex / Claude Code (target switching, local skills management, cross-app import, ZIP distribution) - Local Codex/Claude sessions (list/filter/export/delete) -It works on local files directly and does not require cloud hosting. +It works on local files directly and does not require cloud hosting. The skills market is also local-first: it operates on local directories and does not depend on a remote marketplace. ## Why Codex Mate? @@ -34,6 +35,7 @@ It works on local files directly and does not require cloud hosting. | Multi-tool management | Codex + Claude Code + OpenClaw in one entry | Different files and folders per tool | | Operation mode | CLI + local Web UI | Manual TOML/JSON/JSON5 edits | | Session handling | Browse/export/batch cleanup | Manual file location and processing | +| Skills reuse | Local skills market + cross-app import + ZIP distribution | Manual folder copy and reconciliation | | Rollback readiness | Backup before first takeover | Easy to overwrite by mistake | | Automation integration | MCP stdio (read-only by default) | Requires custom scripting | @@ -52,6 +54,12 @@ It works on local files directly and does not require cloud hosting. - Markdown export - Session-level and message-level delete (supports batch) +**Skills Market** +- Switch the skills install target between Codex and Claude Code +- Inspect local installed skills, root paths, and status +- Scan importable sources from `Codex` / `Claude Code` / `Agents` +- Support cross-app import, ZIP import/export, and batch delete + **Engineering Utilities** - MCP stdio domains (`tools`, `resources`, `prompts`) - Built-in proxy controls (`proxy`) @@ -74,15 +82,16 @@ flowchart TB API["Local HTTP API"] MCPS["MCP stdio Server"] PROXY["Built-in Proxy"] - SERVICES["Config / Sessions / Skills / Workflow"] + SERVICES["Config / Sessions / Skills Market / Workflow"] CORE["File IO / Network / Diff / Session Utils"] end subgraph Data["Local Files"] - CODEX["~/.codex"] - CLAUDE["~/.claude"] - OPENCLAW["~/.openclaw"] - STATE["sessions / trash / workflow runs"] + CODEX["~/.codex/config + auth + models"] + CLAUDE["~/.claude/settings.json"] + OPENCLAW["~/.openclaw/*.json5 + workspace/AGENTS.md"] + SKILLS["~/.codex/skills / ~/.claude/skills / ~/.agents/skills"] + STATE["sessions / trash / workflow runs / skill exports"] end CLI --> ENTRY @@ -100,6 +109,7 @@ flowchart TB CORE --> CODEX CORE --> CLAUDE CORE --> OPENCLAW + CORE --> SKILLS CORE --> STATE ``` @@ -114,7 +124,7 @@ codexmate status codexmate run ``` -Default listen address is `127.0.0.1:3737`, and browser auto-open is enabled by default. +Default listen address is `0.0.0.0:3737` for LAN access, and browser auto-open is enabled by default. ### Run from source @@ -170,8 +180,6 @@ codexmate codex --model gpt-5.3-codex --follow-up "step1" --follow-up "step2" - Provider/model switching - Model list management - `~/.codex/AGENTS.md` editing -- `~/.codex/skills` management (filter, batch delete, cross-app import) - ### Claude Code Mode - Multi-profile management @@ -188,6 +196,12 @@ codexmate codex --model gpt-5.3-codex --follow-up "step1" --follow-up "step2" - Local pin/unpin with persistent storage and pinned-first ordering - Search, filter, export, delete, batch cleanup +### Skills Market Tab +- Switch the skills install target between `Codex` and `Claude Code` +- Show the current local skills root, installed items, and importable items +- Scan unmanaged skills under `Codex` / `Claude Code` / `Agents` +- Support cross-app import, ZIP import/export, and batch delete + ## MCP > Transport: `stdio` @@ -218,7 +232,7 @@ codexmate mcp serve --allow-write | Variable | Default | Description | | --- | --- | --- | | `CODEXMATE_PORT` | `3737` | Web server port | -| `CODEXMATE_HOST` | `127.0.0.1` | Web listen host | +| `CODEXMATE_HOST` | `0.0.0.0` | Web listen host | | `CODEXMATE_NO_BROWSER` | unset | Set `1` to disable browser auto-open | | `CODEXMATE_MCP_ALLOW_WRITE` | unset | Set `1` to allow MCP write tools by default | | `CODEXMATE_FORCE_RESET_EXISTING_CONFIG` | `0` | Set `1` to force bootstrap reset of existing config | diff --git a/README.md b/README.md index e5dab80..71bd9e7 100644 --- a/README.md +++ b/README.md @@ -23,9 +23,10 @@ Codex Mate 提供一套本地优先的 CLI + Web UI，用于统一管理： - Codex 的 provider / model 切换与配置写入 - Claude Code 配置方案（写入 `~/.claude/settings.json`） - OpenClaw JSON5 配置与 Workspace `AGENTS.md` +- Codex / Claude Code Skills 市场（安装目标切换、本地 skills 管理、跨应用导入、ZIP 分发） - Codex / Claude 本地会话浏览、筛选、导出、删除 -项目不依赖云端托管，配置写入你的本地文件，便于审计和回滚。 +项目不依赖云端托管，配置写入你的本地文件，便于审计和回滚。Skills 市场同样坚持本地优先，只操作本地目录，不依赖远程在线市场。 ## 为什么选择 Codex Mate？ @@ -34,6 +35,7 @@ Codex Mate 提供一套本地优先的 CLI + Web UI，用于统一管理： | 多工具管理 | Codex + Claude Code + OpenClaw 统一入口 | 多文件、多目录分散修改 | | 使用方式 | CLI + 本地 Web UI | 纯手改 TOML / JSON / JSON5 | | 会话处理 | 支持浏览、导出、批量清理 | 需要手动定位和处理文件 | +| Skills 复用 | 本地 Skills 市场 + 跨应用导入 + ZIP 分发 | 目录手动复制，容易遗漏 | | 可回滚性 | 首次接管前自动备份 | 易误覆盖、回滚成本高 | | 自动化接入 | 提供 MCP stdio（默认只读） | 需自行封装脚本 | @@ -52,6 +54,12 @@ Codex Mate 提供一套本地优先的 CLI + Web UI，用于统一管理： - 会话导出 Markdown - 会话与消息级删除（支持批量） +**Skills 市场** +- 在 Codex 与 Claude Code 之间切换 skills 安装目标 +- 查看本地已安装 skills、根目录与状态 +- 扫描 `Codex` / `Claude Code` / `Agents` 可导入来源 +- 支持跨应用导入、ZIP 导入 / 导出、批量删除 + **工程能力** - MCP stdio 能力（tools/resources/prompts） - 内建代理配置与状态控制（`proxy`） @@ -74,15 +82,16 @@ flowchart TB API["Local HTTP API"] MCPS["MCP stdio Server"] PROXY["Built-in Proxy"] - SERVICES["Config / Sessions / Skills / Workflow"] + SERVICES["Config / Sessions / Skills Market / Workflow"] CORE["File IO / Network / Diff / Session Utils"] end subgraph State["Local State"] - CODEX["~/.codex"] - CLAUDE["~/.claude"] - OPENCLAW["~/.openclaw"] - STATE["sessions / trash / workflow runs"] + CODEX["~/.codex/config + auth + models"] + CLAUDE["~/.claude/settings.json"] + OPENCLAW["~/.openclaw/*.json5 + workspace/AGENTS.md"] + SKILLS["~/.codex/skills / ~/.claude/skills / ~/.agents/skills"] + STATE["sessions / trash / workflow runs / skill exports"] end CLI --> ENTRY @@ -100,6 +109,7 @@ flowchart TB CORE --> CODEX CORE --> CLAUDE CORE --> OPENCLAW + CORE --> SKILLS CORE --> STATE ``` @@ -114,7 +124,7 @@ codexmate status codexmate run ``` -默认监听 `127.0.0.1:3737`，并尝试自动打开浏览器。 +默认监听 `0.0.0.0:3737`，支持局域网访问，并尝试自动打开浏览器。 ### 从源码运行 @@ -170,8 +180,6 @@ codexmate codex --model gpt-5.3-codex --follow-up "步骤1" --follow-up "步骤2 - provider / model 切换 - 模型管理 - `~/.codex/AGENTS.md` 编辑 -- `~/.codex/skills` 管理（筛选、批量删除、跨应用导入） - ### Claude Code 配置模式 - 多配置方案管理 @@ -188,6 +196,12 @@ codexmate codex --model gpt-5.3-codex --follow-up "步骤1" --follow-up "步骤2 - 支持本地会话置顶、持久化保存与置顶优先排序 - 搜索、筛选、导出、删除、批量清理 +### Skills 市场标签页 +- 在 `Codex` 与 `Claude Code` 之间切换 skills 安装目标 +- 展示当前目标的本地 skills 根目录、已安装项和可导入项 +- 扫描 `Codex` / `Claude Code` / `Agents` 目录下未托管的 skills +- 支持跨应用导入、ZIP 导入 / 导出、批量删除 + ## MCP > 传输：`stdio` @@ -219,7 +233,7 @@ codexmate mcp serve --allow-write | 变量 | 默认值 | 说明 | | --- | --- | --- | | `CODEXMATE_PORT` | `3737` | Web 服务端口 | -| `CODEXMATE_HOST` | `127.0.0.1` | Web 服务监听地址 | +| `CODEXMATE_HOST` | `0.0.0.0` | Web 服务监听地址 | | `CODEXMATE_NO_BROWSER` | 未设置 | 设为 `1` 后不自动打开浏览器 | | `CODEXMATE_MCP_ALLOW_WRITE` | 未设置 | 设为 `1` 后默认允许 MCP 写工具 | | `CODEXMATE_FORCE_RESET_EXISTING_CONFIG` | `0` | 设为 `1` 时首次可强制重建托管配置 | diff --git a/cli.js b/cli.js index 3e2a30d..7bb795e 100644 --- a/cli.js +++ b/cli.js @@ -64,7 +64,8 @@ const { } = require('./lib/workflow-engine'); const DEFAULT_WEB_PORT = 3737; -const DEFAULT_WEB_HOST = '127.0.0.1'; +const DEFAULT_WEB_HOST = '0.0.0.0'; +const DEFAULT_WEB_OPEN_HOST = '127.0.0.1'; // ============================================================================ // 配置 @@ -116,8 +117,12 @@ const AGENTS_FILE_NAME = 'AGENTS.md'; const CODEX_SKILLS_DIR = path.join(CONFIG_DIR, 'skills'); const CLAUDE_SKILLS_DIR = path.join(CLAUDE_DIR, 'skills'); const AGENTS_SKILLS_DIR = path.join(os.homedir(), '.agents', 'skills'); +const SKILL_TARGETS = Object.freeze([ + Object.freeze({ app: 'codex', label: 'Codex', dir: CODEX_SKILLS_DIR }), + Object.freeze({ app: 'claude', label: 'Claude Code', dir: CLAUDE_SKILLS_DIR }) +]); const SKILL_IMPORT_SOURCES = Object.freeze([ - { app: 'claude', label: 'Claude Code', dir: CLAUDE_SKILLS_DIR }, + ...SKILL_TARGETS, { app: 'agents', label: 'Agents', dir: AGENTS_SKILLS_DIR } ]); const MODELS_CACHE_TTL_MS = 60 * 1000; @@ -1390,8 +1395,29 @@ function normalizeCodexSkillName(name) { return { name: value }; } -function isSkillDirectoryEntry(entryName) { - const targetPath = path.join(CODEX_SKILLS_DIR, entryName); +function normalizeSkillTargetApp(app) { + const value = typeof app === 'string' ? app.trim().toLowerCase() : ''; + return SKILL_TARGETS.some((item) => item.app === value) ? value : ''; +} + +function getSkillTargetByApp(app) { + const normalizedApp = normalizeSkillTargetApp(app); + if (!normalizedApp) return null; + return SKILL_TARGETS.find((item) => item.app === normalizedApp) || null; +} + +function resolveSkillTarget(params = {}, defaultApp = 'codex') { + const raw = params && typeof params === 'object' + ? (params.targetApp || params.target || '') + : ''; + return getSkillTargetByApp(raw) + || getSkillTargetByApp(defaultApp) + || SKILL_TARGETS[0] + || null; +} + +function isSkillDirectoryEntryAtRoot(rootDir, entryName) { + const targetPath = path.join(rootDir, entryName); try { const stat = fs.statSync(targetPath); return stat.isDirectory(); @@ -1560,13 +1586,13 @@ function readCodexSkillMetadata(skillPath) { } } -function getCodexSkillEntryInfoByName(entryName) { - const targetPath = path.join(CODEX_SKILLS_DIR, entryName); +function getSkillEntryInfoByName(rootDir, entryName) { + const targetPath = path.join(rootDir, entryName); const normalized = normalizeCodexSkillName(entryName); if (normalized.error) { return null; } - const relativePath = path.relative(CODEX_SKILLS_DIR, targetPath); + const relativePath = path.relative(rootDir, targetPath); if (relativePath.startsWith('..') || path.isAbsolute(relativePath)) { return null; } @@ -1577,7 +1603,7 @@ function getCodexSkillEntryInfoByName(entryName) { if (!lstat.isDirectory() && !isSymbolicLink) { return null; } - if (isSymbolicLink && !isSkillDirectoryEntry(entryName)) { + if (isSymbolicLink && !isSkillDirectoryEntryAtRoot(rootDir, entryName)) { return null; } const metadata = readCodexSkillMetadata(targetPath); @@ -1595,26 +1621,34 @@ function getCodexSkillEntryInfoByName(entryName) { } } -function listCodexSkills() { - if (!fs.existsSync(CODEX_SKILLS_DIR)) { +function listSkills(params = {}) { + const target = resolveSkillTarget(params); + if (!target) { + return { error: '目标宿主不支持' }; + } + if (!fs.existsSync(target.dir)) { return { - root: CODEX_SKILLS_DIR, + targetApp: target.app, + targetLabel: target.label, + root: target.dir, exists: false, items: [] }; } try { - const entries = fs.readdirSync(CODEX_SKILLS_DIR, { withFileTypes: true }); + const entries = fs.readdirSync(target.dir, { withFileTypes: true }); const items = entries .map((entry) => { const name = entry && entry.name ? entry.name : ''; if (!name || name.startsWith('.')) return null; - return getCodexSkillEntryInfoByName(name); + return getSkillEntryInfoByName(target.dir, name); }) .filter(Boolean) .sort((a, b) => a.displayName.localeCompare(b.displayName, 'zh-Hans-CN')); return { - root: CODEX_SKILLS_DIR, + targetApp: target.app, + targetLabel: target.label, + root: target.dir, exists: true, items }; @@ -1623,6 +1657,10 @@ function listCodexSkills() { } } +function listCodexSkills() { + return listSkills({ targetApp: 'codex' }); +} + function listSkillEntriesByRoot(rootDir) { if (!rootDir || !fs.existsSync(rootDir)) { return []; @@ -1668,8 +1706,12 @@ function listSkillEntriesByRoot(rootDir) { } } -function scanUnmanagedCodexSkills() { - const existing = listCodexSkills(); +function scanUnmanagedSkills(params = {}) { + const target = resolveSkillTarget(params); + if (!target) { + return { error: '目标宿主不支持' }; + } + const existing = listSkills({ targetApp: target.app }); if (existing.error) { return { error: existing.error }; } @@ -1678,7 +1720,8 @@ function scanUnmanagedCodexSkills() { .filter(Boolean)); const items = []; - for (const source of SKILL_IMPORT_SOURCES) { + const sources = SKILL_IMPORT_SOURCES.filter((source) => source.app !== target.app); + for (const source of sources) { const sourceEntries = listSkillEntriesByRoot(source.dir); for (const entry of sourceEntries) { if (existingNames.has(entry.name)) { @@ -1706,9 +1749,11 @@ function scanUnmanagedCodexSkills() { }); return { - root: CODEX_SKILLS_DIR, + targetApp: target.app, + targetLabel: target.label, + root: target.dir, items, - sources: SKILL_IMPORT_SOURCES.map((source) => ({ + sources: sources.map((source) => ({ app: source.app, label: source.label, path: source.dir, @@ -1717,13 +1762,21 @@ function scanUnmanagedCodexSkills() { }; } -function importCodexSkills(params = {}) { +function scanUnmanagedCodexSkills() { + return scanUnmanagedSkills({ targetApp: 'codex' }); +} + +function importSkills(params = {}) { + const target = resolveSkillTarget(params); + if (!target) { + return { error: '目标宿主不支持' }; + } const rawItems = Array.isArray(params.items) ? params.items : []; if (!rawItems.length) { return { error: '请先选择要导入的 skill' }; } - ensureDir(CODEX_SKILLS_DIR); + ensureDir(target.dir); const imported = []; const failed = []; @@ -1749,6 +1802,14 @@ function importCodexSkills(params = {}) { }); continue; } + if (source.app === target.app) { + failed.push({ + name: normalizedName.name, + sourceApp: source.app, + error: '来源与目标相同，无需导入' + }); + continue; + } const dedupKey = `${source.app}:${normalizedName.name}`; if (dedup.has(dedupKey)) { continue; @@ -1774,8 +1835,8 @@ function importCodexSkills(params = {}) { continue; } - const targetPath = path.join(CODEX_SKILLS_DIR, normalizedName.name); - const targetRelative = path.relative(CODEX_SKILLS_DIR, targetPath); + const targetPath = path.join(target.dir, normalizedName.name); + const targetRelative = path.relative(target.dir, targetPath); if (targetRelative.startsWith('..') || path.isAbsolute(targetRelative)) { failed.push({ name: normalizedName.name, @@ -1788,7 +1849,7 @@ function importCodexSkills(params = {}) { failed.push({ name: normalizedName.name, sourceApp: source.app, - error: 'Codex 中已存在同名 skill' + error: `${target.label} 中已存在同名 skill` }); continue; } @@ -1825,6 +1886,8 @@ function importCodexSkills(params = {}) { name: normalizedName.name, sourceApp: source.app, sourceLabel: source.label, + targetApp: target.app, + targetLabel: target.label, path: targetPath }); } catch (e) { @@ -1845,10 +1908,16 @@ function importCodexSkills(params = {}) { success: failed.length === 0, imported, failed, - root: CODEX_SKILLS_DIR + targetApp: target.app, + targetLabel: target.label, + root: target.dir }; } +function importCodexSkills(params = {}) { + return importSkills({ ...(params || {}), targetApp: 'codex' }); +} + function collectSkillDirectoriesFromRoot(rootDir, limit = MAX_SKILLS_ZIP_ENTRY_COUNT) { const results = []; let truncated = false; @@ -1902,7 +1971,11 @@ function resolveSkillNameFromImportedDirectory(skillDir, extractionRoot, fallbac return normalizeCodexSkillName(candidate); } -async function importCodexSkillsFromZipFile(zipPath, options = {}) { +async function importSkillsFromZipFile(zipPath, options = {}) { + const target = resolveSkillTarget(options, 'codex'); + if (!target) { + return { error: '目标宿主不支持' }; + } const fallbackName = typeof options.fallbackName === 'string' ? options.fallbackName : ''; const tempDir = typeof options.tempDir === 'string' ? options.tempDir : ''; const imported = []; @@ -1926,7 +1999,7 @@ async function importCodexSkillsFromZipFile(zipPath, options = {}) { return { error: '压缩包中的技能目录数量超出导入上限' }; } - ensureDir(CODEX_SKILLS_DIR); + ensureDir(target.dir); for (const skillDir of discoveredDirs) { const normalizedName = resolveSkillNameFromImportedDirectory(skillDir, extractionRoot, fallbackName); if (normalizedName.error) { @@ -1942,8 +2015,8 @@ async function importCodexSkillsFromZipFile(zipPath, options = {}) { } dedupNames.add(dedupKey); - const targetPath = path.join(CODEX_SKILLS_DIR, normalizedName.name); - const targetRelative = path.relative(CODEX_SKILLS_DIR, targetPath); + const targetPath = path.join(target.dir, normalizedName.name); + const targetRelative = path.relative(target.dir, targetPath); if (targetRelative.startsWith('..') || path.isAbsolute(targetRelative)) { failed.push({ name: normalizedName.name, @@ -1954,7 +2027,7 @@ async function importCodexSkillsFromZipFile(zipPath, options = {}) { if (fs.existsSync(targetPath)) { failed.push({ name: normalizedName.name, - error: 'Codex 中已存在同名 skill' + error: `${target.label} 中已存在同名 skill` }); continue; } @@ -1979,6 +2052,8 @@ async function importCodexSkillsFromZipFile(zipPath, options = {}) { copiedToTarget = true; imported.push({ name: normalizedName.name, + targetApp: target.app, + targetLabel: target.label, path: targetPath }); } catch (e) { @@ -1999,7 +2074,9 @@ async function importCodexSkillsFromZipFile(zipPath, options = {}) { error: failed[0].error || '导入失败', imported, failed, - root: CODEX_SKILLS_DIR + targetApp: target.app, + targetLabel: target.label, + root: target.dir }; } @@ -2007,7 +2084,9 @@ async function importCodexSkillsFromZipFile(zipPath, options = {}) { success: failed.length === 0, imported, failed, - root: CODEX_SKILLS_DIR + targetApp: target.app, + targetLabel: target.label, + root: target.dir }; } catch (e) { return { @@ -2026,7 +2105,11 @@ async function importCodexSkillsFromZipFile(zipPath, options = {}) { } } -async function importCodexSkillsFromZip(payload = {}) { +async function importCodexSkillsFromZipFile(zipPath, options = {}) { + return importSkillsFromZipFile(zipPath, { ...(options || {}), targetApp: 'codex' }); +} + +async function importSkillsFromZip(payload = {}) { if (!payload || typeof payload.fileBase64 !== 'string' || !payload.fileBase64.trim()) { return { error: '缺少技能压缩包内容' }; } @@ -2034,13 +2117,22 @@ async function importCodexSkillsFromZip(payload = {}) { if (upload.error) { return { error: upload.error }; } - return importCodexSkillsFromZipFile(upload.zipPath, { + return importSkillsFromZipFile(upload.zipPath, { tempDir: upload.tempDir, - fallbackName: payload.fileName || '' + fallbackName: payload.fileName || '', + targetApp: payload.targetApp || payload.target || 'codex' }); } -async function exportCodexSkills(params = {}) { +async function importCodexSkillsFromZip(payload = {}) { + return importSkillsFromZip({ ...(payload || {}), targetApp: 'codex' }); +} + +async function exportSkills(params = {}) { + const target = resolveSkillTarget(params); + if (!target) { + return { error: '目标宿主不支持' }; + } const rawNames = Array.isArray(params.names) ? params.names : []; const uniqueNames = Array.from(new Set(rawNames .map((item) => (typeof item === 'string' ? item.trim() : '')) @@ -2062,8 +2154,8 @@ async function exportCodexSkills(params = {}) { failed.push({ name: rawName, error: normalizedName.error }); continue; } - const sourcePath = path.join(CODEX_SKILLS_DIR, normalizedName.name); - const sourceRelative = path.relative(CODEX_SKILLS_DIR, sourcePath); + const sourcePath = path.join(target.dir, normalizedName.name); + const sourceRelative = path.relative(target.dir, sourcePath); if (sourceRelative.startsWith('..') || path.isAbsolute(sourceRelative)) { failed.push({ name: normalizedName.name, error: '来源路径非法' }); continue; @@ -2109,12 +2201,14 @@ async function exportCodexSkills(params = {}) { error: failed[0] && failed[0].error ? failed[0].error : '无可导出的 skill', exported, failed, - root: CODEX_SKILLS_DIR + targetApp: target.app, + targetLabel: target.label, + root: target.dir }; } const randomToken = crypto.randomBytes(12).toString('hex'); - const zipFileName = `codex-skills-${randomToken}.zip`; + const zipFileName = `${target.app}-skills-${randomToken}.zip`; const zipFilePath = path.join(os.tmpdir(), zipFileName); if (fs.existsSync(zipFilePath)) { try { @@ -2133,14 +2227,18 @@ async function exportCodexSkills(params = {}) { downloadPath: artifact.downloadPath, exported, failed, - root: CODEX_SKILLS_DIR + targetApp: target.app, + targetLabel: target.label, + root: target.dir }; } catch (e) { return { error: `导出失败：${e && e.message ? e.message : '未知错误'}`, exported, failed, - root: CODEX_SKILLS_DIR + targetApp: target.app, + targetLabel: target.label, + root: target.dir }; } finally { try { @@ -2149,6 +2247,10 @@ async function exportCodexSkills(params = {}) { } } +async function exportCodexSkills(params = {}) { + return exportSkills({ ...(params || {}), targetApp: 'codex' }); +} + function removeDirectoryRecursive(targetPath) { if (typeof fs.rmSync === 'function') { fs.rmSync(targetPath, { recursive: true, force: false }); @@ -2157,7 +2259,11 @@ function removeDirectoryRecursive(targetPath) { fs.rmdirSync(targetPath, { recursive: true }); } -function deleteCodexSkills(params = {}) { +function deleteSkills(params = {}) { + const target = resolveSkillTarget(params); + if (!target) { + return { error: '目标宿主不支持' }; + } const rawList = Array.isArray(params.names) ? params.names : []; const uniqueNames = Array.from(new Set(rawList .map((item) => (typeof item === 'string' ? item.trim() : '')) @@ -2175,8 +2281,8 @@ function deleteCodexSkills(params = {}) { continue; } - const skillPath = path.join(CODEX_SKILLS_DIR, normalized.name); - const relativePath = path.relative(CODEX_SKILLS_DIR, skillPath); + const skillPath = path.join(target.dir, normalized.name); + const relativePath = path.relative(target.dir, skillPath); if (relativePath.startsWith('..') || path.isAbsolute(relativePath)) { failed.push({ name: normalized.name, error: '技能路径非法' }); continue; @@ -2206,10 +2312,16 @@ function deleteCodexSkills(params = {}) { success: failed.length === 0, deleted, failed, - root: CODEX_SKILLS_DIR + targetApp: target.app, + targetLabel: target.label, + root: target.dir }; } +function deleteCodexSkills(params = {}) { + return deleteSkills({ ...(params || {}), targetApp: 'codex' }); +} + function readAgentsFile(params = {}) { const filePath = resolveAgentsFilePath(params); const dirCheck = validateAgentsBaseDir(filePath); @@ -9633,12 +9745,23 @@ function resolveUploadFileNameFromRequest(req, fallbackName = 'codex-skills.zip' return normalized || fallback; } -async function handleImportCodexSkillsZipUpload(req, res) { +function resolveSkillTargetAppFromRequest(req, fallbackApp = 'codex') { + const fallback = normalizeSkillTargetApp(fallbackApp) || 'codex'; + try { + const parsed = new URL(req.url || '/', 'http://localhost'); + return normalizeSkillTargetApp(parsed.searchParams.get('targetApp')) || fallback; + } catch (_) { + return fallback; + } +} + +async function handleImportSkillsZipUpload(req, res, options = {}) { if (req.method !== 'POST') { writeJsonResponse(res, 405, { error: 'Method Not Allowed' }); return; } try { + const targetApp = resolveSkillTargetAppFromRequest(req, options && options.targetApp ? options.targetApp : 'codex'); const fileName = resolveUploadFileNameFromRequest(req, 'codex-skills.zip'); const upload = await writeUploadZipStream( req, @@ -9646,9 +9769,10 @@ async function handleImportCodexSkillsZipUpload(req, res) { fileName, MAX_SKILLS_ZIP_UPLOAD_SIZE ); - const result = await importCodexSkillsFromZipFile(upload.zipPath, { + const result = await importSkillsFromZipFile(upload.zipPath, { tempDir: upload.tempDir, - fallbackName: fileName + fallbackName: fileName, + targetApp }); writeJsonResponse(res, 200, result || {}); } catch (e) { @@ -9662,8 +9786,12 @@ function createWebServer({ htmlPath, assetsDir, webDir, host, port, openBrowser const server = http.createServer((req, res) => { const requestPath = (req.url || '/').split('?')[0]; + if (requestPath === '/api/import-skills-zip') { + void handleImportSkillsZipUpload(req, res); + return; + } if (requestPath === '/api/import-codex-skills-zip') { - void handleImportCodexSkillsZipUpload(req, res); + void handleImportSkillsZipUpload(req, res, { targetApp: 'codex' }); return; } if (requestPath === '/api') { @@ -9795,6 +9923,21 @@ function createWebServer({ htmlPath, assetsDir, webDir, host, port, openBrowser case 'preview-agents-diff': result = buildAgentsDiff(params || {}); break; + case 'list-skills': + result = listSkills(params || {}); + break; + case 'delete-skills': + result = deleteSkills(params || {}); + break; + case 'scan-unmanaged-skills': + result = scanUnmanagedSkills(params || {}); + break; + case 'import-skills': + result = importSkills(params || {}); + break; + case 'export-skills': + result = await exportSkills(params || {}); + break; case 'list-codex-skills': result = listCodexSkills(); break; @@ -10154,7 +10297,7 @@ function createWebServer({ htmlPath, assetsDir, webDir, host, port, openBrowser process.exit(1); }); - const openHost = isAnyAddressHost(host) ? DEFAULT_WEB_HOST : host; + const openHost = isAnyAddressHost(host) ? DEFAULT_WEB_OPEN_HOST : host; const openUrl = `http://${formatHostForUrl(openHost)}:${port}`; server.listen(port, host, () => { console.log('\n✓ Web UI 已启动:', openUrl); diff --git a/site/guide/getting-started.md b/site/guide/getting-started.md index 373f8a7..77c8c38 100644 --- a/site/guide/getting-started.md +++ b/site/guide/getting-started.md @@ -27,7 +27,7 @@ codexmate status codexmate run ``` -默认监听 `127.0.0.1:3737`，并尝试自动打开浏览器。 +默认监听 `0.0.0.0:3737`，支持局域网访问，并尝试自动打开浏览器。 仅启动服务（测试 / CI）： diff --git a/tests/unit/config-tabs-ui.test.mjs b/tests/unit/config-tabs-ui.test.mjs index 3af9f01..7755f5e 100644 --- a/tests/unit/config-tabs-ui.test.mjs +++ b/tests/unit/config-tabs-ui.test.mjs @@ -34,6 +34,31 @@ test('config template keeps expected config tabs in top and side navigation', () assert.match(html, /settingsTab === 'backup'/); assert.match(html, /settingsTab === 'trash'/); assert.match(html, /sessionTrashCount/); + assert.match(html, /id="side-tab-market"/); + assert.match(html, /id="tab-market"/); + assert.match(html, /data-main-tab="market"/); + assert.match(html, /onMainTabPointerDown\('market', \$event\)/); + assert.match(html, /onMainTabClick\('market', \$event\)/); + assert.match(html, /aria-controls="panel-market"/); + assert.match(html, /:aria-selected="mainTab === 'market'"/); + assert.match(html, /id="panel-market"/); + assert.match(html, /v-show="mainTab === 'market'"/); + assert.match(html, /loadSkillsMarketOverview\(\{ forceRefresh: true, silent: false \}\)/); + assert.match(html, /class="market-grid"/); + assert.match(html, /class="market-action-grid"/); + assert.match(html, /skillsTargetApp === 'codex'/); + assert.match(html, /skillsTargetApp === 'claude'/); + assert.match(html, /setSkillsTargetApp\('codex', \{ silent: false \}\)/); + assert.match(html, /setSkillsTargetApp\('claude', \{ silent: false \}\)/); + assert.match(html, /skillsDefaultRootPath/); + assert.match(html, /可直接导入/); + assert.match(html, /不再展示任何 MCP 在线目录或外部市场/); + assert.match(html, /本地 skills 视图和导入分发流程/); + assert.doesNotMatch(html, /skillsMarketRemoteCount/); + assert.doesNotMatch(html, /loadOnlineSkillsMarket\(\{ forceRefresh: true, silent: false \}\)/); + assert.doesNotMatch(html, /resetOnlineSkillsMarketSearch/); + assert.doesNotMatch(html, /class="market-online-list"/); + assert.doesNotMatch(html, /class="market-ecosystem-grid"/); assert.match(html, /id="settings-tab-backup"/); assert.match(html, /id="settings-tab-trash"/); assert.match(html, /role="tab"/); @@ -59,8 +84,10 @@ test('config template keeps expected config tabs in top and side navigation', () assert.match(html, /@click="loadMoreSessionTrashItems"/); assert.match(html, /回收站列表加载失败，请刷新重试/); assert.match(html, /data-main-tab=\"sessions\"/); + assert.match(html, /data-main-tab=\"market\"/); assert.match(html, /data-config-mode=\"codex\"/); assert.match(html, /isMainTabNavActive\('settings'\)/); + assert.match(html, /isMainTabNavActive\('market'\)/); assert.match(html, /isConfigModeNavActive\('codex'\)/); assert.match(html, /:aria-pressed="isSessionPinned\(session\)"/); assert.match(html, /class="session-item-copy session-item-pin"/); @@ -145,6 +172,15 @@ test('web ui script defines provider mode metadata for codex only', () => { assert.match(appScript, /const SESSION_TRASH_LIST_LIMIT = 500;/); assert.match(appScript, /const SESSION_TRASH_PAGE_SIZE = 200;/); assert.match(appScript, /settingsTab:\s*'backup'/); + assert.match(appScript, /skillsTargetApp:\s*'codex'/); + assert.match(appScript, /skillsMarketLoading:\s*false/); + assert.match(appScript, /skillsMarketLocalLoadedOnce:\s*false/); + assert.match(appScript, /skillsMarketImportLoadedOnce:\s*false/); + assert.doesNotMatch(appScript, /skillsMarketRemoteLoading:\s*false/); + assert.doesNotMatch(appScript, /skillsMarketRemoteLoadedOnce:\s*false/); + assert.doesNotMatch(appScript, /skillsMarketRemoteItems:\s*\[\]/); + assert.doesNotMatch(appScript, /skillsMarketRemoteLatestOnly:\s*true/); + assert.doesNotMatch(appScript, /skillsMarketEcosystems:\s*\[\]/); assert.match(appScript, /sessionTrashItems:\s*\[\]/); assert.match(appScript, /sessionTrashVisibleCount:\s*SESSION_TRASH_PAGE_SIZE/); assert.match(appScript, /sessionTrashTotalCount:\s*0/); @@ -194,6 +230,8 @@ test('session helper deferred claude refresh validates live tab and mode before assert.match(helperScript, /this\.settingsTab !== 'trash'/); assert.match(helperScript, /this\.sessionTrashLoadedOnce = false;/); assert.match(helperScript, /this\.loadSessionTrashCount\(\{ silent: true \}\);/); + assert.match(helperScript, /const shouldLoadSkillsMarketOnEnter = nextTab === 'market'/); + assert.match(helperScript, /this\.loadSkillsMarketOverview\(\{ silent: true \}\);/); }); test('trash item styles stay aligned with session card layout and keep mobile usability', () => { @@ -231,4 +269,11 @@ test('settings tab header actions keep compact tool buttons inline on wider scre styles, /\.settings-tab-actions \.btn-tool,\s*\.settings-tab-actions \.btn-tool-compact\s*\{[\s\S]*width:\s*auto;/ ); + assert.match(styles, /\.market-grid\s*\{[\s\S]*grid-template-columns:\s*repeat\(2,\s*minmax\(0,\s*1fr\)\);/); + assert.match(styles, /\.market-action-grid\s*\{[\s\S]*grid-template-columns:\s*repeat\(3,\s*minmax\(0,\s*1fr\)\);/); + assert.match(styles, /\.market-target-switch\s*\{/); + assert.match(styles, /\.market-target-chip\.active\s*\{/); + assert.match(styles, /\.market-panel-wide\s*\{/); + assert.doesNotMatch(styles, /\.market-online-list\s*\{/); + assert.doesNotMatch(styles, /\.market-ecosystem-grid\s*\{/); }); diff --git a/tests/unit/run.mjs b/tests/unit/run.mjs index ae69545..06b9b8e 100644 --- a/tests/unit/run.mjs +++ b/tests/unit/run.mjs @@ -13,6 +13,7 @@ await import(pathToFileURL(path.join(__dirname, 'session-query.test.mjs'))); await import(pathToFileURL(path.join(__dirname, 'mcp-stdio.test.mjs'))); await import(pathToFileURL(path.join(__dirname, 'workflow-engine.test.mjs'))); await import(pathToFileURL(path.join(__dirname, 'skills-modal-ui.test.mjs'))); +await import(pathToFileURL(path.join(__dirname, 'skills-market-runtime.test.mjs'))); await import(pathToFileURL(path.join(__dirname, 'config-tabs-ui.test.mjs'))); await import(pathToFileURL(path.join(__dirname, 'compact-layout-ui.test.mjs'))); await import(pathToFileURL(path.join(__dirname, 'agents-diff-ui.test.mjs'))); @@ -25,6 +26,7 @@ await import(pathToFileURL(path.join(__dirname, 'coderabbit-workflows.test.mjs') await import(pathToFileURL(path.join(__dirname, 'session-tab-switch-performance.test.mjs'))); await import(pathToFileURL(path.join(__dirname, 'session-trash-state.test.mjs'))); await import(pathToFileURL(path.join(__dirname, 'web-ui-restart.test.mjs'))); +await import(pathToFileURL(path.join(__dirname, 'web-run-host.test.mjs'))); let failures = 0; for (const { name, fn } of tests) { diff --git a/tests/unit/session-tab-switch-performance.test.mjs b/tests/unit/session-tab-switch-performance.test.mjs index a2ec755..a682c52 100644 --- a/tests/unit/session-tab-switch-performance.test.mjs +++ b/tests/unit/session-tab-switch-performance.test.mjs @@ -127,6 +127,27 @@ test('switchMainTab primes trash badge count and invalidates the cached trash li assert.deepStrictEqual(calls, [{ silent: true }]); }); +test('switchMainTab loads skills market overview when entering market', () => { + const calls = []; + const vm = { + mainTab: 'config', + configMode: 'codex', + sessionsLoadedOnce: true, + teardownSessionTabRender() {}, + prepareSessionTabRender() {}, + loadSessions() {}, + loadSkillsMarketOverview(options) { + calls.push(options); + }, + refreshClaudeModelContext() {} + }; + + switchMainTab.call(vm, 'market'); + + assert.strictEqual(vm.mainTab, 'market'); + assert.deepStrictEqual(calls, [{ silent: true }]); +}); + test('switchMainTab defers session teardown when scheduler exists to keep tab selection responsive', () => { let deferredTask = null; let teardownCount = 0; diff --git a/tests/unit/skills-market-runtime.test.mjs b/tests/unit/skills-market-runtime.test.mjs new file mode 100644 index 0000000..d661b0a --- /dev/null +++ b/tests/unit/skills-market-runtime.test.mjs @@ -0,0 +1,127 @@ +import assert from 'assert'; +import path from 'path'; +import { fileURLToPath, pathToFileURL } from 'url'; + +const __filename = fileURLToPath(import.meta.url); +const __dirname = path.dirname(__filename); + +const { createSkillsMethods } = await import(pathToFileURL(path.join(__dirname, '..', '..', 'web-ui', 'modules', 'skills.methods.mjs'))); +const { createSkillsComputed } = await import(pathToFileURL(path.join(__dirname, '..', '..', 'web-ui', 'modules', 'skills.computed.mjs'))); + +function buildVm(apiImpl, overrides = {}) { + const methods = createSkillsMethods({ api: apiImpl }); + const vm = { + skillsTargetApp: 'codex', + skillsRootPath: '', + skillsList: [], + skillsSelectedNames: [], + skillsLoading: false, + skillsDeleting: false, + skillsKeyword: '', + skillsStatusFilter: 'all', + skillsImportList: [], + skillsImportSelectedKeys: [], + skillsScanningImports: false, + skillsImporting: false, + skillsZipImporting: false, + skillsExporting: false, + skillsMarketLoading: false, + skillsMarketLocalLoadedOnce: false, + skillsMarketImportLoadedOnce: false, + showSkillsModal: false, + messageLog: [], + showMessage(message, type) { + this.messageLog.push({ message, type }); + }, + requestConfirmDialog: async () => true, + $refs: {}, + ...methods, + ...overrides + }; + + const computed = createSkillsComputed(); + for (const [key, getter] of Object.entries(computed)) { + Object.defineProperty(vm, key, { + configurable: true, + enumerable: true, + get() { + return getter.call(vm); + } + }); + } + + return vm; +} + +test('refreshSkillsList requests generic skills API for current host target', async () => { + const calls = []; + const vm = buildVm(async (action, params) => { + calls.push({ action, params }); + return { + exists: true, + root: '/tmp/claude-skills', + items: [{ name: 'demo-skill', hasSkillFile: true }] + }; + }, { + skillsTargetApp: 'claude' + }); + + const ok = await vm.refreshSkillsList({ silent: true }); + + assert.strictEqual(ok, true); + assert.deepStrictEqual(calls, [{ + action: 'list-skills', + params: { targetApp: 'claude' } + }]); + assert.strictEqual(vm.skillsRootPath, '/tmp/claude-skills'); + assert.strictEqual(vm.skillsList.length, 1); +}); + +test('setSkillsTargetApp resets local state and reloads local market slices only', async () => { + let receivedOptions = null; + const vm = buildVm(async () => ({}), { + skillsTargetApp: 'codex', + skillsRootPath: '/tmp/codex-skills', + skillsList: [{ name: 'alpha', hasSkillFile: true }], + skillsImportList: [{ name: 'beta', sourceApp: 'claude' }] + }); + vm.loadSkillsMarketOverview = async (options) => { + receivedOptions = options; + return true; + }; + + const ok = await vm.setSkillsTargetApp('claude', { silent: false }); + + assert.strictEqual(ok, true); + assert.strictEqual(vm.skillsTargetApp, 'claude'); + assert.deepStrictEqual(vm.skillsList, []); + assert.deepStrictEqual(vm.skillsImportList, []); + assert.deepStrictEqual(receivedOptions, { + forceRefresh: true, + silent: false + }); +}); + +test('loadSkillsMarketOverview refreshes installed skills and importable sources only', async () => { + const steps = []; + const vm = buildVm(async () => ({})); + vm.refreshSkillsList = async (options) => { + steps.push(['refresh', options]); + vm.skillsMarketLocalLoadedOnce = true; + return true; + }; + vm.scanImportableSkills = async (options) => { + steps.push(['scan', options]); + vm.skillsMarketImportLoadedOnce = true; + return true; + }; + + const ok = await vm.loadSkillsMarketOverview({ forceRefresh: true, silent: true }); + + assert.strictEqual(ok, true); + assert.deepStrictEqual(steps, [ + ['refresh', { silent: true }], + ['scan', { silent: true }] + ]); + assert.strictEqual(vm.skillsMarketLoading, false); +}); diff --git a/tests/unit/skills-modal-ui.test.mjs b/tests/unit/skills-modal-ui.test.mjs index f5b59c4..3abebf9 100644 --- a/tests/unit/skills-modal-ui.test.mjs +++ b/tests/unit/skills-modal-ui.test.mjs @@ -40,13 +40,23 @@ test('skills modal script is modularized and exposes computed/methods from skill assert.match(skillsComputed, /skillsImportConfiguredCount\(\)/); assert.match(skillsComputed, /skillsImportMissingSkillFileCount\(\)/); assert.match(skillsComputed, /skillsFilterDirty\(\)/); + assert.match(skillsComputed, /skillsTargetLabel\(\)/); + assert.match(skillsComputed, /skillsDefaultRootPath\(\)/); + assert.doesNotMatch(skillsComputed, /skillsMarketRemoteCount\(\)/); + assert.match(skillsMethods, /setSkillsTargetApp\(app,\s*options = \{\}\)/); assert.match(skillsMethods, /resetSkillsFilters\(\)/); assert.match(skillsMethods, /skillsZipImporting/); assert.match(skillsMethods, /skillsExporting/); assert.match(skillsMethods, /importSkillsFromZipFile/); assert.match(skillsMethods, /exportSelectedSkills\(\)/); assert.match(skillsMethods, /requestConfirmDialog\(/); + assert.match(skillsMethods, /api\('list-skills'/); + assert.match(skillsMethods, /api\('scan-unmanaged-skills'/); + assert.match(skillsMethods, /api\('import-skills'/); + assert.match(skillsMethods, /api\('export-skills'/); + assert.match(skillsMethods, /api\('delete-skills'/); + assert.doesNotMatch(skillsMethods, /api\('list-online-skills-market'/); assert.doesNotMatch(skillsMethods, /window\.confirm\(/); }); @@ -62,4 +72,7 @@ test('skills modal styles define summary and panel layout hooks', () => { assert.match(styles, /\.skill-list::\-webkit-scrollbar-thumb/); assert.match(styles, /\.confirm-dialog/); assert.match(styles, /\.confirm-dialog-message/); + assert.match(styles, /\.market-target-chip/); + assert.doesNotMatch(styles, /\.market-online-toolbar/); + assert.doesNotMatch(styles, /\.market-ecosystem-card/); }); diff --git a/tests/unit/web-run-host.test.mjs b/tests/unit/web-run-host.test.mjs new file mode 100644 index 0000000..d97e2c4 --- /dev/null +++ b/tests/unit/web-run-host.test.mjs @@ -0,0 +1,147 @@ +import assert from 'assert'; +import path from 'path'; +import { fileURLToPath } from 'url'; +import { createRequire } from 'module'; + +const __filename = fileURLToPath(import.meta.url); +const __dirname = path.dirname(__filename); +const require = createRequire(import.meta.url); +const fs = require('fs'); + +const cliPath = path.join(__dirname, '..', '..', 'cli.js'); +const cliContent = fs.readFileSync(cliPath, 'utf-8'); + +function findMatchingBrace(source, startIndex) { + let depth = 0; + let quote = ''; + let escape = false; + let inLineComment = false; + let inBlockComment = false; + let templateDepth = 0; + + for (let index = startIndex; index < source.length; index += 1) { + const char = source[index]; + const next = source[index + 1]; + const prev = source[index - 1]; + + if (inLineComment) { + if (char === '\n') inLineComment = false; + continue; + } + if (inBlockComment) { + if (prev === '*' && char === '/') inBlockComment = false; + continue; + } + if (quote) { + if (escape) { + escape = false; + continue; + } + if (char === '\\') { + escape = true; + continue; + } + if (quote === '`') { + if (char === '$' && next === '{') { + templateDepth += 1; + depth += 1; + index += 1; + continue; + } + if (char === '}' && templateDepth > 0) { + templateDepth -= 1; + depth -= 1; + continue; + } + } + if (char === quote && templateDepth === 0) { + quote = ''; + } + continue; + } + + if (char === '/' && next === '/') { + inLineComment = true; + index += 1; + continue; + } + if (char === '/' && next === '*') { + inBlockComment = true; + index += 1; + continue; + } + if (char === '\'' || char === '"' || char === '`') { + quote = char; + continue; + } + if (char === '{') { + depth += 1; + continue; + } + if (char === '}') { + depth -= 1; + if (depth === 0) { + return index; + } + } + } + + throw new Error('Matching brace not found'); +} + +function extractFunctionBySignature(source, signature, funcName) { + const startIndex = source.indexOf(signature); + if (startIndex === -1) { + throw new Error(`Signature not found: ${signature}`); + } + const signatureBraceOffset = signature.lastIndexOf('{'); + const braceStart = signatureBraceOffset >= 0 + ? (startIndex + signatureBraceOffset) + : source.indexOf('{', startIndex + signature.length); + const endIndex = findMatchingBrace(source, braceStart); + const block = source.slice(startIndex, endIndex + 1).trim(); + return `${block}\nreturn ${funcName};`; +} + +function instantiateFunction(funcSource, funcName, bindings = {}) { + const bindingNames = Object.keys(bindings); + const bindingValues = Object.values(bindings); + return Function(...bindingNames, `${funcSource}\nreturn ${funcName};`)(...bindingValues); +} + +const defaultHostMatch = cliContent.match(/const DEFAULT_WEB_HOST = '([^']+)';/); +if (!defaultHostMatch) { + throw new Error('DEFAULT_WEB_HOST not found'); +} +const resolveWebHostSource = extractFunctionBySignature( + cliContent, + 'function resolveWebHost(options = {}) {', + 'resolveWebHost' +); +const resolveWebHost = instantiateFunction(resolveWebHostSource, 'resolveWebHost', { + DEFAULT_WEB_HOST: defaultHostMatch[1], + process: { env: {} } +}); + +test('resolveWebHost defaults to all interfaces for LAN access', () => { + assert.strictEqual(resolveWebHost({}), '0.0.0.0'); + assert.strictEqual(resolveWebHost(), '0.0.0.0'); +}); + +test('resolveWebHost still prefers CLI host over environment and default host', () => { + const withEnv = instantiateFunction(resolveWebHostSource, 'resolveWebHost', { + DEFAULT_WEB_HOST: defaultHostMatch[1], + process: { env: { CODEXMATE_HOST: '192.168.1.10' } } + }); + + assert.strictEqual(withEnv({ host: '10.0.0.8' }), '10.0.0.8'); +}); + +test('resolveWebHost still prefers environment host over default host', () => { + const withEnv = instantiateFunction(resolveWebHostSource, 'resolveWebHost', { + DEFAULT_WEB_HOST: defaultHostMatch[1], + process: { env: { CODEXMATE_HOST: '192.168.1.10' } } + }); + + assert.strictEqual(withEnv({}), '192.168.1.10'); +}); diff --git a/web-ui/app.js b/web-ui/app.js index ad61d1c..b75867b 100644 --- a/web-ui/app.js +++ b/web-ui/app.js @@ -170,6 +170,7 @@ import { createSkillsMethods } from './modules/skills.methods.mjs'; agentsContext: 'codex', agentsModalTitle: 'AGENTS.md 编辑器', agentsModalHint: '保存后会写入目标 AGENTS.md（与 config.toml 同级）。', + skillsTargetApp: 'codex', skillsRootPath: '', skillsList: [], skillsSelectedNames: [], @@ -183,6 +184,9 @@ import { createSkillsMethods } from './modules/skills.methods.mjs'; skillsImporting: false, skillsZipImporting: false, skillsExporting: false, + skillsMarketLoading: false, + skillsMarketLocalLoadedOnce: false, + skillsMarketImportLoadedOnce: false, sessionPinnedMap: {}, sessionsList: [], sessionsLoadedOnce: false, @@ -5768,5 +5772,3 @@ import { createSkillsMethods } from './modules/skills.methods.mjs'; app.mount('#app'); }); - - diff --git a/web-ui/index.html b/web-ui/index.html index 4147841..ba57fd7 100644 --- a/web-ui/index.html +++ b/web-ui/index.html @@ -96,6 +96,16 @@ :class="{ active: isMainTabNavActive('sessions') }" @pointerdown="onMainTabPointerDown('sessions', $event)" @click="onMainTabClick('sessions', $event)">会话浏览 + + +
设置
+
+
+ 当前目标 + {{ skillsTargetLabel }} +
+
+ 本地 Skills + {{ skillsList.length }} +
+
+ 可导入 + {{ skillsImportList.length }} +
+
+ 可直接导入 + {{ skillsImportConfiguredCount }} +
+
@@ -430,8 +481,8 @@

Skills 管理
-
管理 ~/.codex/skills 自定义 skills，弹窗提供统计概览、筛选检索、多选删除、ZIP 导入与导出。
-

@@ -1231,6 +1282,180 @@

+
+
+
+
+ Skills 市场概览 +
当前市场页只保留本地 skills 能力：切换 Codex / Claude Code 安装目标，查看已安装项，执行跨应用导入与 ZIP 分发。
+
+
+ + +
+
+ +
+ + +
+ +
{{ skillsRootPath || skillsDefaultRootPath }}
+ +
+
+ 安装目标 + {{ skillsTargetLabel }} +
+
+ 本地总数 + {{ skillsList.length }} +
+
+ 含 SKILL.md + {{ skillsConfiguredCount }} +
+
+ 缺少 SKILL.md + {{ skillsMissingSkillFileCount }} +
+
+ 可导入 + {{ skillsImportList.length }} +
+
+ 可直接导入 + {{ skillsImportConfiguredCount }} +
+
+
+ +
+
+
+
+
已安装 Skills
+
展示当前已落地到 {{ skillsRootPath || skillsDefaultRootPath }} 的前 6 个目录，可继续进入管理弹窗做筛选、导出和删除。
+
+ +
+
正在加载本地 Skills...
+
当前还没有已安装 skill，可通过 ZIP 或跨应用导入补充。
+
+
+
+
{{ skill.displayName || skill.name }}
+
{{ skill.description || skill.path }}
+
+ + {{ skill.hasSkillFile ? '已验证' : '待补 SKILL.md' }} + +
+
+
+ +
+
+
+
可导入来源
+
扫描其他应用下未托管的 skill，先确认来源和目录，再批量导入到当前 {{ skillsTargetLabel }} skills 目录。
+
+ +
+
正在扫描可导入 skill...
+
还没有扫描到可导入 skill，可点击“扫描来源”重新读取。
+
+
+
+
{{ skill.displayName || skill.name }}
+
{{ skill.sourceLabel }} · {{ skill.sourcePath }}
+
+ + {{ skill.hasSkillFile ? '可直接导入' : '缺少 SKILL.md' }} + +
+
+
+ +
+
+
+
分发入口
+
市场页聚焦本地落地：本地管理、跨应用导入、ZIP 分发，全部作用到当前安装目标。
+
+
+
+ + + +
+
+ +
+
+
+
市场说明
+
这里不再展示任何 MCP 在线目录或外部市场，只保留当前项目自己的本地 skills 视图和导入分发流程。
+
+
+
+
+
+
目标宿主切换
+
在 Codex 和 Claude Code 之间切换后，后续扫描、导入、导出、删除都会落到当前 {{ skillsTargetLabel }} 目录。
+
+
+
+
+
跨应用导入
+
扫描 `Codex`、`Claude Code` 与 `Agents` 目录里的未托管 skills，筛选后批量导入到当前宿主。
+
+
+
+
+
ZIP 分发
+
通过压缩包在不同环境间分发技能目录，保持本地可控，不依赖外部目录服务。
+
+
+
+
+
+
+
加载配置中... @@ -1905,9 +2130,25 @@

Skills 管理
-
集中管理本地技能目录，支持检索筛选、多选删除、跨应用导入、ZIP 导入与导出。
+
集中管理当前宿主的本地技能目录，支持检索筛选、多选删除、跨应用导入、ZIP 导入与导出。
+
+ + +
@@ -1915,11 +2156,15 @@

- -
{{ skillsRootPath || '~/.codex/skills' }}
+ +
{{ skillsRootPath || skillsDefaultRootPath }}
+
+ 安装目标 + {{ skillsTargetLabel }} +
本地总数 {{ skillsList.length }} @@ -1942,7 +2187,7 @@

本地 Skills
-
支持关键词检索与状态筛选，勾选后可批量删除。
+
支持关键词检索与状态筛选，勾选后可批量删除当前 {{ skillsTargetLabel }} 本地 skill。
-

+ +
!(item && item.hasSkillFile)).length; + }, + skillsMarketBusy() { + return !!( + this.skillsMarketLoading + || this.skillsLoading + || this.skillsDeleting + || this.skillsScanningImports + || this.skillsImporting + || this.skillsZipImporting + || this.skillsExporting + ); + }, + skillsMarketInstalledPreview() { + const list = Array.isArray(this.skillsList) ? this.skillsList : []; + return list.slice(0, 6); + }, + skillsMarketImportPreview() { + const list = Array.isArray(this.skillsImportList) ? this.skillsImportList : []; + return list.slice(0, 6); } }; -} \ No newline at end of file +} diff --git a/web-ui/modules/skills.methods.mjs b/web-ui/modules/skills.methods.mjs index 737cc5f..6b53d77 100644 --- a/web-ui/modules/skills.methods.mjs +++ b/web-ui/modules/skills.methods.mjs @@ -1,11 +1,44 @@ export function createSkillsMethods({ api }) { return { - async openSkillsManager() { + normalizeSkillsTargetApp(app) { + return app === 'claude' ? 'claude' : 'codex'; + }, + + resetSkillsTargetState() { this.skillsSelectedNames = []; this.skillsKeyword = ''; this.skillsStatusFilter = 'all'; + this.skillsRootPath = ''; + this.skillsList = []; this.skillsImportList = []; this.skillsImportSelectedKeys = []; + this.skillsMarketLocalLoadedOnce = false; + this.skillsMarketImportLoadedOnce = false; + }, + + async setSkillsTargetApp(app, options = {}) { + const nextTarget = this.normalizeSkillsTargetApp(app); + const refresh = !(options && options.refresh === false); + const silent = !!(options && options.silent); + if (nextTarget !== this.skillsTargetApp) { + this.skillsTargetApp = nextTarget; + this.resetSkillsTargetState(); + } + if (!refresh) { + return true; + } + return await this.loadSkillsMarketOverview({ + forceRefresh: true, + silent + }); + }, + + async openSkillsManager(options = {}) { + const targetApp = this.normalizeSkillsTargetApp(options && options.targetApp ? options.targetApp : this.skillsTargetApp); + if (targetApp !== this.skillsTargetApp) { + this.skillsTargetApp = targetApp; + } + this.resetSkillsTargetState(); this.showSkillsModal = true; await this.refreshSkillsList({ silent: false }); }, @@ -28,23 +61,25 @@ async refreshSkillsList(options = {}) { this.skillsLoading = true; try { - const res = await api('list-codex-skills'); + const res = await api('list-skills', { + targetApp: this.skillsTargetApp + }); if (res.error) { this.skillsRootPath = ''; this.skillsList = []; this.skillsSelectedNames = []; this.showMessage(res.error, 'error'); - return; + return false; } const exists = res.exists !== false; if (!exists) { - this.skillsRootPath = ''; + this.skillsRootPath = res.root || ''; this.skillsList = []; this.skillsSelectedNames = []; if (!options.silent) { - this.showMessage('skills 目录不存在，已按空列表显示', 'info'); + this.showMessage(`${this.skillsTargetLabel} skills 目录不存在，已按空列表显示`, 'info'); } - return; + return true; } this.skillsRootPath = res.root || ''; this.skillsList = Array.isArray(res.items) ? res.items : []; @@ -53,16 +88,40 @@ .filter(Boolean)); this.skillsSelectedNames = (Array.isArray(this.skillsSelectedNames) ? this.skillsSelectedNames : []) .filter((name) => currentNames.has(name)); + return true; } catch (e) { this.skillsRootPath = ''; this.skillsList = []; this.skillsSelectedNames = []; this.showMessage('加载 skills 失败', 'error'); + return false; } finally { this.skillsLoading = false; } }, + async loadSkillsMarketOverview(options = {}) { + if (this.skillsMarketLoading) return false; + const silent = !!(options && options.silent); + const forceRefresh = !!(options && options.forceRefresh); + this.skillsMarketLoading = true; + let localLoaded = this.skillsMarketLocalLoadedOnce === true; + let importLoaded = this.skillsMarketImportLoadedOnce === true; + try { + if (forceRefresh || !localLoaded) { + localLoaded = await this.refreshSkillsList({ silent }); + this.skillsMarketLocalLoadedOnce = localLoaded; + } + if (forceRefresh || !importLoaded) { + importLoaded = await this.scanImportableSkills({ silent }); + this.skillsMarketImportLoadedOnce = importLoaded; + } + return !!(localLoaded && importLoaded); + } finally { + this.skillsMarketLoading = false; + } + }, + resetSkillsFilters() { this.skillsKeyword = ''; this.skillsStatusFilter = 'all'; @@ -103,14 +162,16 @@ const silent = !!(options && options.silent); this.skillsScanningImports = true; try { - const res = await api('scan-unmanaged-codex-skills'); + const res = await api('scan-unmanaged-skills', { + targetApp: this.skillsTargetApp + }); if (res.error) { this.skillsImportList = []; this.skillsImportSelectedKeys = []; if (!silent) { this.showMessage(res.error, 'error'); } - return; + return false; } this.skillsImportList = Array.isArray(res.items) ? res.items : []; const availableKeys = new Set(this.skillsImportSelectableKeys); @@ -121,12 +182,14 @@ } else if (!silent) { this.showMessage(`扫描到 ${this.skillsImportList.length} 个可导入 skill`, 'success'); } + return true; } catch (e) { this.skillsImportList = []; this.skillsImportSelectedKeys = []; if (!silent) { this.showMessage('扫描可导入 skill 失败', 'error'); } + return false; } finally { this.skillsScanningImports = false; } @@ -148,7 +211,10 @@ this.skillsImporting = true; try { - const res = await api('import-codex-skills', { items: selectedItems }); + const res = await api('import-skills', { + targetApp: this.skillsTargetApp, + items: selectedItems + }); if (res.error) { this.showMessage(res.error, 'error'); return; @@ -161,7 +227,7 @@ const first = res.failed[0] && res.failed[0].error ? res.failed[0].error : '导入失败'; this.showMessage(first, 'error'); } else { - this.showMessage(`已导入 ${importedCount} 个 skill`, 'success'); + this.showMessage(`已导入 ${importedCount} 个 skill 到 ${this.skillsTargetLabel}`, 'success'); } await this.refreshSkillsList({ silent: true }); } catch (e) { @@ -197,8 +263,8 @@ async uploadSkillsZipStream(file) { const fileName = (file && typeof file.name === 'string' && file.name.trim()) ? file.name.trim() - : 'codex-skills.zip'; - const response = await fetch('/api/import-codex-skills-zip', { + : `${this.skillsTargetApp}-skills.zip`; + const response = await fetch(`/api/import-skills-zip?targetApp=${encodeURIComponent(this.skillsTargetApp)}`, { method: 'POST', headers: { 'x-codexmate-file-name': encodeURIComponent(fileName) @@ -244,7 +310,7 @@ const first = res.failed[0] && res.failed[0].error ? res.failed[0].error : '导入失败'; this.showMessage(first, 'error'); } else { - this.showMessage(`已导入 ${importedCount} 个 skill`, 'success'); + this.showMessage(`已导入 ${importedCount} 个 skill 到 ${this.skillsTargetLabel}`, 'success'); } await this.refreshSkillsList({ silent: true }); } catch (e) { @@ -267,7 +333,10 @@ } this.skillsExporting = true; try { - const res = await api('export-codex-skills', { names: selected }); + const res = await api('export-skills', { + targetApp: this.skillsTargetApp, + names: selected + }); if (res && res.error) { this.showMessage(res.error, 'error'); return; @@ -290,7 +359,7 @@ if (failedCount > 0) { this.showMessage(`已导出 ${exportedCount} 个，失败 ${failedCount} 个`, 'error'); } else { - this.showMessage(`已导出 ${exportedCount} 个 skill`, 'success'); + this.showMessage(`已从 ${this.skillsTargetLabel} 导出 ${exportedCount} 个 skill`, 'success'); } } catch (e) { this.showMessage('导出 skill 失败', 'error'); @@ -310,7 +379,7 @@ } const confirmed = await this.requestConfirmDialog({ title: '删除 Skills', - message: `确认删除 ${selected.length} 个 skill 吗？此操作不可撤销。`, + message: `确认从 ${this.skillsTargetLabel} 删除 ${selected.length} 个 skill 吗？此操作不可撤销。`, confirmText: '删除', cancelText: '取消', danger: true @@ -321,7 +390,10 @@ this.skillsDeleting = true; try { - const res = await api('delete-codex-skills', { names: selected }); + const res = await api('delete-skills', { + targetApp: this.skillsTargetApp, + names: selected + }); if (res.error) { this.showMessage(res.error, 'error'); return; @@ -336,7 +408,7 @@ const first = failedList[0] && failedList[0].error ? failedList[0].error : '删除失败'; this.showMessage(first, 'error'); } else { - this.showMessage(`已删除 ${deletedCount} 个 skill`, 'success'); + this.showMessage(`已从 ${this.skillsTargetLabel} 删除 ${deletedCount} 个 skill`, 'success'); } await this.refreshSkillsList({ silent: true }); } catch (e) { diff --git a/web-ui/session-helpers.mjs b/web-ui/session-helpers.mjs index 4e53996..60410d5 100644 --- a/web-ui/session-helpers.mjs +++ b/web-ui/session-helpers.mjs @@ -61,6 +61,11 @@ export function switchMainTab(tab) { this.sessionTrashLoadedOnce = false; this.loadSessionTrashCount({ silent: true }); } + const shouldLoadSkillsMarketOnEnter = nextTab === 'market' + && typeof this.loadSkillsMarketOverview === 'function'; + if (shouldLoadSkillsMarketOnEnter) { + this.loadSkillsMarketOverview({ silent: true }); + } if (nextTab === 'config' && this.configMode === 'claude') { const expectedTab = nextTab; const expectedConfigMode = this.configMode; diff --git a/web-ui/styles.css b/web-ui/styles.css index 295f710..b650f1f 100644 --- a/web-ui/styles.css +++ b/web-ui/styles.css @@ -3668,6 +3668,152 @@ body::after { line-height: 1.45; } +.market-overview-section { + margin-bottom: var(--spacing-sm); +} + +.market-overview-header { + gap: var(--spacing-sm); + align-items: flex-start; +} + +.market-header-actions { + flex-wrap: wrap; +} + +.market-target-switch { + display: flex; + flex-wrap: wrap; + gap: 8px; + margin-bottom: var(--spacing-sm); +} + +.market-target-switch-compact { + justify-content: flex-end; + margin-bottom: 0; +} + +.market-target-chip { + border: 1px solid rgba(160, 145, 130, 0.28); + border-radius: 999px; + background: rgba(255, 255, 255, 0.92); + color: var(--color-text-secondary); + padding: 8px 14px; + font-size: var(--font-size-caption); + font-weight: var(--font-weight-secondary); + cursor: pointer; + transition: border-color var(--transition-fast) var(--ease-smooth), background var(--transition-fast) var(--ease-smooth), color var(--transition-fast) var(--ease-smooth), box-shadow var(--transition-fast) var(--ease-smooth); +} + +.market-target-chip.active { + border-color: rgba(208, 88, 58, 0.4); + background: linear-gradient(to bottom, rgba(255, 243, 236, 0.98) 0%, rgba(255, 232, 220, 0.86) 100%); + color: #8c3a1f; + box-shadow: var(--shadow-subtle); +} + +.market-root-box { + margin-bottom: var(--spacing-sm); +} + +.market-grid { + display: grid; + grid-template-columns: repeat(2, minmax(0, 1fr)); + gap: var(--spacing-sm); +} + +.market-panel { + margin-bottom: 0; + min-width: 0; +} + +.market-actions-panel { + grid-column: 1 / -1; +} + +.market-panel-wide { + grid-column: 1 / -1; +} + +.market-preview-list { + display: grid; + gap: 10px; +} + +.market-preview-item { + display: flex; + align-items: flex-start; + justify-content: space-between; + gap: var(--spacing-xs); + padding: 10px 12px; + border: 1px solid rgba(160, 145, 130, 0.18); + border-radius: var(--radius-sm); + background: rgba(255, 255, 255, 0.64); +} + +.market-preview-main { + min-width: 0; + display: flex; + flex-direction: column; + gap: 4px; +} + +.market-preview-title { + font-size: var(--font-size-body); + font-weight: var(--font-weight-secondary); + color: var(--color-text-secondary); + overflow-wrap: anywhere; +} + +.market-preview-meta { + font-size: var(--font-size-caption); + color: var(--color-text-tertiary); + line-height: 1.45; + overflow-wrap: anywhere; +} + +.market-action-grid { + display: grid; + grid-template-columns: repeat(3, minmax(0, 1fr)); + gap: var(--spacing-xs); +} + +.market-action-card { + border: 1px solid rgba(160, 145, 130, 0.24); + border-radius: var(--radius-sm); + background: linear-gradient(to bottom, rgba(255, 255, 255, 0.96) 0%, rgba(255, 248, 242, 0.84) 100%); + color: var(--color-text-secondary); + text-align: left; + padding: 14px; + display: flex; + flex-direction: column; + gap: 6px; + cursor: pointer; + transition: transform var(--transition-fast) var(--ease-smooth), box-shadow var(--transition-fast) var(--ease-smooth), border-color var(--transition-fast) var(--ease-smooth); +} + +.market-action-card:hover:not(:disabled) { + transform: translateY(-1px); + border-color: rgba(208, 88, 58, 0.34); + box-shadow: var(--shadow-subtle); +} + +.market-action-card:disabled { + cursor: not-allowed; + opacity: 0.64; +} + +.market-action-title { + font-size: var(--font-size-body); + font-weight: var(--font-weight-secondary); +} + +.market-action-copy { + font-size: var(--font-size-caption); + color: var(--color-text-tertiary); + line-height: 1.45; +} + .skills-filter-row { display: flex; gap: var(--spacing-xs); @@ -4176,6 +4322,10 @@ textarea:focus-visible { .skills-modal-actions { align-items: flex-start; } + + .market-target-switch-compact { + justify-content: flex-start; + } } @media (max-width: 720px) { @@ -4202,6 +4352,14 @@ textarea:focus-visible { flex-wrap: wrap; } + .market-grid { + grid-template-columns: 1fr; + } + + .market-action-grid { + grid-template-columns: 1fr; + } + .status-chip { flex: 1 1 100%; } From d3b39ee89ca23b9a833cb09f41aa6bf3472901d0 Mon Sep 17 00:00:00 2001 From: SurviveM <254925152+SurviveM@users.noreply.github.com> Date: Tue, 31 Mar 2026 18:15:31 +0800 Subject: [PATCH 02/19] fix: harden web host and skill target defaults --- README.md | 6 ++- cli.js | 18 +++++++- tests/unit/web-run-host.test.mjs | 72 ++++++++++++++++++++++++++++++-- 3 files changed, 89 insertions(+), 7 deletions(-) diff --git a/README.md b/README.md index 71bd9e7..ade30eb 100644 --- a/README.md +++ b/README.md @@ -124,7 +124,9 @@ codexmate status codexmate run ``` -默认监听 `0.0.0.0:3737`，支持局域网访问，并尝试自动打开浏览器。 +默认监听 `127.0.0.1:3737`，仅本机可访问，并尝试自动打开浏览器。 + +> 安全提示：若显式使用 `--host 0.0.0.0` 或设置 `CODEXMATE_HOST=0.0.0.0`，会在当前网络暴露未鉴权的管理界面。若包含 API Key、provider 配置或 skills 管理，请优先使用 `127.0.0.1`，仅在可信网络中开启局域网访问。 ### 从源码运行 @@ -233,7 +235,7 @@ codexmate mcp serve --allow-write | 变量 | 默认值 | 说明 | | --- | --- | --- | | `CODEXMATE_PORT` | `3737` | Web 服务端口 | -| `CODEXMATE_HOST` | `0.0.0.0` | Web 服务监听地址 | +| `CODEXMATE_HOST` | `127.0.0.1` | Web 服务监听地址（局域网访问需显式设为 `0.0.0.0`） | | `CODEXMATE_NO_BROWSER` | 未设置 | 设为 `1` 后不自动打开浏览器 | | `CODEXMATE_MCP_ALLOW_WRITE` | 未设置 | 设为 `1` 后默认允许 MCP 写工具 | | `CODEXMATE_FORCE_RESET_EXISTING_CONFIG` | `0` | 设为 `1` 时首次可强制重建托管配置 | diff --git a/cli.js b/cli.js index 7bb795e..2b4b96f 100644 --- a/cli.js +++ b/cli.js @@ -64,7 +64,7 @@ const { } = require('./lib/workflow-engine'); const DEFAULT_WEB_PORT = 3737; -const DEFAULT_WEB_HOST = '0.0.0.0'; +const DEFAULT_WEB_HOST = '127.0.0.1'; const DEFAULT_WEB_OPEN_HOST = '127.0.0.1'; // ============================================================================ @@ -1407,9 +1407,16 @@ function getSkillTargetByApp(app) { } function resolveSkillTarget(params = {}, defaultApp = 'codex') { + const hasExplicitTarget = !!(params && typeof params === 'object' && ( + Object.prototype.hasOwnProperty.call(params, 'targetApp') + || Object.prototype.hasOwnProperty.call(params, 'target') + )); const raw = params && typeof params === 'object' ? (params.targetApp || params.target || '') : ''; + if (hasExplicitTarget && raw && !getSkillTargetByApp(raw)) { + return null; + } return getSkillTargetByApp(raw) || getSkillTargetByApp(defaultApp) || SKILL_TARGETS[0] @@ -9749,7 +9756,10 @@ function resolveSkillTargetAppFromRequest(req, fallbackApp = 'codex') { const fallback = normalizeSkillTargetApp(fallbackApp) || 'codex'; try { const parsed = new URL(req.url || '/', 'http://localhost'); - return normalizeSkillTargetApp(parsed.searchParams.get('targetApp')) || fallback; + if (parsed.searchParams.has('targetApp')) { + return normalizeSkillTargetApp(parsed.searchParams.get('targetApp')) || null; + } + return fallback; } catch (_) { return fallback; } @@ -9762,6 +9772,10 @@ async function handleImportSkillsZipUpload(req, res, options = {}) { } try { const targetApp = resolveSkillTargetAppFromRequest(req, options && options.targetApp ? options.targetApp : 'codex'); + if (!targetApp) { + writeJsonResponse(res, 400, { error: '目标宿主不支持' }); + return; + } const fileName = resolveUploadFileNameFromRequest(req, 'codex-skills.zip'); const upload = await writeUploadZipStream( req, diff --git a/tests/unit/web-run-host.test.mjs b/tests/unit/web-run-host.test.mjs index d97e2c4..27ae2be 100644 --- a/tests/unit/web-run-host.test.mjs +++ b/tests/unit/web-run-host.test.mjs @@ -123,9 +123,9 @@ const resolveWebHost = instantiateFunction(resolveWebHostSource, 'resolveWebHost process: { env: {} } }); -test('resolveWebHost defaults to all interfaces for LAN access', () => { - assert.strictEqual(resolveWebHost({}), '0.0.0.0'); - assert.strictEqual(resolveWebHost(), '0.0.0.0'); +test('resolveWebHost defaults to loopback host', () => { + assert.strictEqual(resolveWebHost({}), '127.0.0.1'); + assert.strictEqual(resolveWebHost(), '127.0.0.1'); }); test('resolveWebHost still prefers CLI host over environment and default host', () => { @@ -145,3 +145,69 @@ test('resolveWebHost still prefers environment host over default host', () => { assert.strictEqual(withEnv({}), '192.168.1.10'); }); + +const SKILL_TARGETS = [ + { app: 'codex', label: 'Codex', dir: '/tmp/codex-skills' }, + { app: 'claude', label: 'Claude', dir: '/tmp/claude-skills' } +]; +const normalizeSkillTargetAppSource = extractFunctionBySignature( + cliContent, + 'function normalizeSkillTargetApp(app) {', + 'normalizeSkillTargetApp' +); +const normalizeSkillTargetApp = instantiateFunction(normalizeSkillTargetAppSource, 'normalizeSkillTargetApp', { + SKILL_TARGETS +}); +const getSkillTargetByAppSource = extractFunctionBySignature( + cliContent, + 'function getSkillTargetByApp(app) {', + 'getSkillTargetByApp' +); +const getSkillTargetByApp = instantiateFunction(getSkillTargetByAppSource, 'getSkillTargetByApp', { + SKILL_TARGETS, + normalizeSkillTargetApp +}); +const resolveSkillTargetSource = extractFunctionBySignature( + cliContent, + 'function resolveSkillTarget(params = {}, defaultApp = \'codex\') {', + 'resolveSkillTarget' +); +const resolveSkillTarget = instantiateFunction(resolveSkillTargetSource, 'resolveSkillTarget', { + SKILL_TARGETS, + getSkillTargetByApp, + Object +}); +const resolveSkillTargetAppFromRequestSource = extractFunctionBySignature( + cliContent, + 'function resolveSkillTargetAppFromRequest(req, fallbackApp = \'codex\') {', + 'resolveSkillTargetAppFromRequest' +); +const resolveSkillTargetAppFromRequest = instantiateFunction( + resolveSkillTargetAppFromRequestSource, + 'resolveSkillTargetAppFromRequest', + { + URL, + normalizeSkillTargetApp + } +); + +test('resolveSkillTarget still falls back to default target when target is omitted', () => { + assert.deepStrictEqual(resolveSkillTarget({}), SKILL_TARGETS[0]); + assert.deepStrictEqual(resolveSkillTarget({ items: [] }), SKILL_TARGETS[0]); +}); + +test('resolveSkillTarget rejects explicit unsupported targets instead of falling back', () => { + assert.strictEqual(resolveSkillTarget({ targetApp: 'claud' }), null); + assert.strictEqual(resolveSkillTarget({ target: 'unknown' }, 'codex'), null); +}); + +test('resolveSkillTargetAppFromRequest rejects explicit unsupported query target', () => { + assert.strictEqual( + resolveSkillTargetAppFromRequest({ url: '/api/import-skills-zip?targetApp=claud' }, 'codex'), + null + ); + assert.strictEqual( + resolveSkillTargetAppFromRequest({ url: '/api/import-skills-zip' }, 'claude'), + 'claude' + ); +}); From 564b9cdc44db09ac13e307dbd9d0d6c13edac08f Mon Sep 17 00:00:00 2001 From: SurviveM <254925152+SurviveM@users.noreply.github.com> Date: Tue, 31 Mar 2026 19:53:20 +0800 Subject: [PATCH 03/19] fix: address coderabbit skills review issues --- README.en.md | 4 +- README.md | 6 +- cli.js | 5 +- site/guide/getting-started.md | 1 + tests/unit/config-tabs-ui.test.mjs | 3 + .../session-tab-switch-performance.test.mjs | 21 +++++++ tests/unit/skills-market-runtime.test.mjs | 63 +++++++++++++++++++ tests/unit/web-run-host.test.mjs | 19 ++++-- web-ui/index.html | 4 +- web-ui/modules/skills.methods.mjs | 23 ++++++- web-ui/session-helpers.mjs | 1 + 11 files changed, 135 insertions(+), 15 deletions(-) diff --git a/README.en.md b/README.en.md index fb35085..6a6626b 100644 --- a/README.en.md +++ b/README.en.md @@ -126,6 +126,8 @@ codexmate run Default listen address is `0.0.0.0:3737` for LAN access, and browser auto-open is enabled by default. +> Safety note: the unauthenticated management UI is exposed to your current LAN by default. Use trusted networks only; for local-only access, set `CODEXMATE_HOST=127.0.0.1` or pass `--host 127.0.0.1`. + ### Run from source ```bash @@ -232,7 +234,7 @@ codexmate mcp serve --allow-write | Variable | Default | Description | | --- | --- | --- | | `CODEXMATE_PORT` | `3737` | Web server port | -| `CODEXMATE_HOST` | `0.0.0.0` | Web listen host | +| `CODEXMATE_HOST` | `0.0.0.0` | Web listen host (set `127.0.0.1` for local-only access) | | `CODEXMATE_NO_BROWSER` | unset | Set `1` to disable browser auto-open | | `CODEXMATE_MCP_ALLOW_WRITE` | unset | Set `1` to allow MCP write tools by default | | `CODEXMATE_FORCE_RESET_EXISTING_CONFIG` | `0` | Set `1` to force bootstrap reset of existing config | diff --git a/README.md b/README.md index ade30eb..36de192 100644 --- a/README.md +++ b/README.md @@ -124,9 +124,9 @@ codexmate status codexmate run ``` -默认监听 `127.0.0.1:3737`，仅本机可访问，并尝试自动打开浏览器。 +默认监听 `0.0.0.0:3737`，支持局域网访问，并尝试自动打开浏览器。 -> 安全提示：若显式使用 `--host 0.0.0.0` 或设置 `CODEXMATE_HOST=0.0.0.0`，会在当前网络暴露未鉴权的管理界面。若包含 API Key、provider 配置或 skills 管理，请优先使用 `127.0.0.1`，仅在可信网络中开启局域网访问。 +> 安全提示：默认监听会在当前局域网暴露未鉴权的管理界面。若包含 API Key、provider 配置或 skills 管理，请仅在可信网络中使用；如需仅本机访问，可设置 `CODEXMATE_HOST=127.0.0.1` 或启动时传入 `--host 127.0.0.1`。 ### 从源码运行 @@ -235,7 +235,7 @@ codexmate mcp serve --allow-write | 变量 | 默认值 | 说明 | | --- | --- | --- | | `CODEXMATE_PORT` | `3737` | Web 服务端口 | -| `CODEXMATE_HOST` | `127.0.0.1` | Web 服务监听地址（局域网访问需显式设为 `0.0.0.0`） | +| `CODEXMATE_HOST` | `0.0.0.0` | Web 服务监听地址（如需仅本机访问，显式设为 `127.0.0.1`） | | `CODEXMATE_NO_BROWSER` | 未设置 | 设为 `1` 后不自动打开浏览器 | | `CODEXMATE_MCP_ALLOW_WRITE` | 未设置 | 设为 `1` 后默认允许 MCP 写工具 | | `CODEXMATE_FORCE_RESET_EXISTING_CONFIG` | `0` | 设为 `1` 时首次可强制重建托管配置 | diff --git a/cli.js b/cli.js index 2b4b96f..4edfc5c 100644 --- a/cli.js +++ b/cli.js @@ -64,7 +64,7 @@ const { } = require('./lib/workflow-engine'); const DEFAULT_WEB_PORT = 3737; -const DEFAULT_WEB_HOST = '127.0.0.1'; +const DEFAULT_WEB_HOST = '0.0.0.0'; const DEFAULT_WEB_OPEN_HOST = '127.0.0.1'; // ============================================================================ @@ -9771,7 +9771,8 @@ async function handleImportSkillsZipUpload(req, res, options = {}) { return; } try { - const targetApp = resolveSkillTargetAppFromRequest(req, options && options.targetApp ? options.targetApp : 'codex'); + const forcedTargetApp = normalizeSkillTargetApp(options && options.targetApp ? options.targetApp : ''); + const targetApp = forcedTargetApp || resolveSkillTargetAppFromRequest(req, 'codex'); if (!targetApp) { writeJsonResponse(res, 400, { error: '目标宿主不支持' }); return; diff --git a/site/guide/getting-started.md b/site/guide/getting-started.md index 77c8c38..bca5594 100644 --- a/site/guide/getting-started.md +++ b/site/guide/getting-started.md @@ -28,6 +28,7 @@ codexmate run ``` 默认监听 `0.0.0.0:3737`，支持局域网访问，并尝试自动打开浏览器。 +如需仅本机访问，可设置 `CODEXMATE_HOST=127.0.0.1`，或启动时传入 `--host 127.0.0.1`。 仅启动服务（测试 / CI）： diff --git a/tests/unit/config-tabs-ui.test.mjs b/tests/unit/config-tabs-ui.test.mjs index 7755f5e..a0f2d83 100644 --- a/tests/unit/config-tabs-ui.test.mjs +++ b/tests/unit/config-tabs-ui.test.mjs @@ -54,6 +54,8 @@ test('config template keeps expected config tabs in top and side navigation', () assert.match(html, /可直接导入/); assert.match(html, /不再展示任何 MCP 在线目录或外部市场/); assert.match(html, /本地 skills 视图和导入分发流程/); + assert.doesNotMatch(html, /在线生态目录/); + assert.doesNotMatch(html, /查看在线目录/); assert.doesNotMatch(html, /skillsMarketRemoteCount/); assert.doesNotMatch(html, /loadOnlineSkillsMarket\(\{ forceRefresh: true, silent: false \}\)/); assert.doesNotMatch(html, /resetOnlineSkillsMarketSearch/); @@ -231,6 +233,7 @@ test('session helper deferred claude refresh validates live tab and mode before assert.match(helperScript, /this\.sessionTrashLoadedOnce = false;/); assert.match(helperScript, /this\.loadSessionTrashCount\(\{ silent: true \}\);/); assert.match(helperScript, /const shouldLoadSkillsMarketOnEnter = nextTab === 'market'/); + assert.match(helperScript, /previousTab !== 'market'/); assert.match(helperScript, /this\.loadSkillsMarketOverview\(\{ silent: true \}\);/); }); diff --git a/tests/unit/session-tab-switch-performance.test.mjs b/tests/unit/session-tab-switch-performance.test.mjs index a682c52..42e84c5 100644 --- a/tests/unit/session-tab-switch-performance.test.mjs +++ b/tests/unit/session-tab-switch-performance.test.mjs @@ -148,6 +148,27 @@ test('switchMainTab loads skills market overview when entering market', () => { assert.deepStrictEqual(calls, [{ silent: true }]); }); +test('switchMainTab does not reload skills market overview when already on market', () => { + const calls = []; + const vm = { + mainTab: 'market', + configMode: 'codex', + sessionsLoadedOnce: true, + teardownSessionTabRender() {}, + prepareSessionTabRender() {}, + loadSessions() {}, + loadSkillsMarketOverview(options) { + calls.push(options); + }, + refreshClaudeModelContext() {} + }; + + switchMainTab.call(vm, 'market'); + + assert.strictEqual(vm.mainTab, 'market'); + assert.deepStrictEqual(calls, []); +}); + test('switchMainTab defers session teardown when scheduler exists to keep tab selection responsive', () => { let deferredTask = null; let teardownCount = 0; diff --git a/tests/unit/skills-market-runtime.test.mjs b/tests/unit/skills-market-runtime.test.mjs index d661b0a..d0c6d15 100644 --- a/tests/unit/skills-market-runtime.test.mjs +++ b/tests/unit/skills-market-runtime.test.mjs @@ -102,6 +102,54 @@ test('setSkillsTargetApp resets local state and reloads local market slices only }); }); +test('setSkillsTargetApp returns false while any skills action is in flight', async () => { + let loadCalled = false; + const vm = buildVm(async () => ({}), { + skillsTargetApp: 'codex', + skillsImporting: true + }); + vm.loadSkillsMarketOverview = async () => { + loadCalled = true; + return true; + }; + + const ok = await vm.setSkillsTargetApp('claude', { silent: false }); + + assert.strictEqual(ok, false); + assert.strictEqual(vm.skillsTargetApp, 'codex'); + assert.strictEqual(loadCalled, false); +}); + +test('openSkillsManager keeps market overview state when reopening same target', async () => { + const refreshCalls = []; + const vm = buildVm(async () => ({}), { + skillsTargetApp: 'codex', + skillsSelectedNames: ['alpha'], + skillsKeyword: 'demo', + skillsStatusFilter: 'missing', + skillsImportList: [{ name: 'beta', sourceApp: 'claude' }], + skillsImportSelectedKeys: ['claude:beta'], + skillsMarketLocalLoadedOnce: true, + skillsMarketImportLoadedOnce: true + }); + vm.refreshSkillsList = async (options) => { + refreshCalls.push(options); + return true; + }; + + await vm.openSkillsManager({ targetApp: 'codex' }); + + assert.strictEqual(vm.showSkillsModal, true); + assert.deepStrictEqual(vm.skillsImportList, [{ name: 'beta', sourceApp: 'claude' }]); + assert.strictEqual(vm.skillsMarketLocalLoadedOnce, true); + assert.strictEqual(vm.skillsMarketImportLoadedOnce, true); + assert.deepStrictEqual(vm.skillsSelectedNames, []); + assert.deepStrictEqual(vm.skillsImportSelectedKeys, []); + assert.strictEqual(vm.skillsKeyword, ''); + assert.strictEqual(vm.skillsStatusFilter, 'all'); + assert.deepStrictEqual(refreshCalls, [{ silent: false }]); +}); + test('loadSkillsMarketOverview refreshes installed skills and importable sources only', async () => { const steps = []; const vm = buildVm(async () => ({})); @@ -125,3 +173,18 @@ test('loadSkillsMarketOverview refreshes installed skills and importable sources ]); assert.strictEqual(vm.skillsMarketLoading, false); }); + +test('scanImportableSkills returns false when another skills action is already running', async () => { + let apiCalls = 0; + const vm = buildVm(async () => { + apiCalls += 1; + return {}; + }, { + skillsImporting: true + }); + + const ok = await vm.scanImportableSkills({ silent: true }); + + assert.strictEqual(ok, false); + assert.strictEqual(apiCalls, 0); +}); diff --git a/tests/unit/web-run-host.test.mjs b/tests/unit/web-run-host.test.mjs index 27ae2be..0fe2adb 100644 --- a/tests/unit/web-run-host.test.mjs +++ b/tests/unit/web-run-host.test.mjs @@ -109,7 +109,7 @@ function instantiateFunction(funcSource, funcName, bindings = {}) { return Function(...bindingNames, `${funcSource}\nreturn ${funcName};`)(...bindingValues); } -const defaultHostMatch = cliContent.match(/const DEFAULT_WEB_HOST = '([^']+)';/); +const defaultHostMatch = cliContent.match(/const\s+DEFAULT_WEB_HOST\s*=\s*['"]([^'"]+)['"]\s*;?/); if (!defaultHostMatch) { throw new Error('DEFAULT_WEB_HOST not found'); } @@ -123,9 +123,9 @@ const resolveWebHost = instantiateFunction(resolveWebHostSource, 'resolveWebHost process: { env: {} } }); -test('resolveWebHost defaults to loopback host', () => { - assert.strictEqual(resolveWebHost({}), '127.0.0.1'); - assert.strictEqual(resolveWebHost(), '127.0.0.1'); +test('resolveWebHost defaults to LAN host', () => { + assert.strictEqual(resolveWebHost({}), '0.0.0.0'); + assert.strictEqual(resolveWebHost(), '0.0.0.0'); }); test('resolveWebHost still prefers CLI host over environment and default host', () => { @@ -211,3 +211,14 @@ test('resolveSkillTargetAppFromRequest rejects explicit unsupported query target 'claude' ); }); + +test('codex-only zip upload route pins target app before request fallback resolution', () => { + assert.match( + cliContent, + /const forcedTargetApp = normalizeSkillTargetApp\(options && options\.targetApp \? options\.targetApp : ''\);/ + ); + assert.match( + cliContent, + /const targetApp = forcedTargetApp \|\| resolveSkillTargetAppFromRequest\(req, 'codex'\);/ + ); +}); diff --git a/web-ui/index.html b/web-ui/index.html index ba57fd7..72ddb92 100644 --- a/web-ui/index.html +++ b/web-ui/index.html @@ -277,7 +277,7 @@

浏览、导出或独立查看 Codex / Claude 会话记录。

- 统一管理 Codex / Claude Skills，并接入在线生态目录。 + 统一管理 Codex / Claude Skills，并聚焦本地导入与分发。

@@ -481,7 +481,7 @@

Skills 管理
-
默认打开 Codex skills 管理；市场页已支持切换到 Claude Code 并查看在线目录。
+
默认打开 Codex skills 管理；市场页已支持切换到 Claude Code 并查看本地概览与导入来源。
diff --git a/web-ui/modules/skills.methods.mjs b/web-ui/modules/skills.methods.mjs index 6b53d77..e6864f0 100644 --- a/web-ui/modules/skills.methods.mjs +++ b/web-ui/modules/skills.methods.mjs @@ -17,6 +17,17 @@ }, async setSkillsTargetApp(app, options = {}) { + if ( + this.skillsLoading + || this.skillsDeleting + || this.skillsScanningImports + || this.skillsImporting + || this.skillsZipImporting + || this.skillsExporting + || this.skillsMarketLoading + ) { + return false; + } const nextTarget = this.normalizeSkillsTargetApp(app); const refresh = !(options && options.refresh === false); const silent = !!(options && options.silent); @@ -35,10 +46,16 @@ async openSkillsManager(options = {}) { const targetApp = this.normalizeSkillsTargetApp(options && options.targetApp ? options.targetApp : this.skillsTargetApp); - if (targetApp !== this.skillsTargetApp) { + const targetChanged = targetApp !== this.skillsTargetApp; + if (targetChanged) { this.skillsTargetApp = targetApp; + this.resetSkillsTargetState(); + } else { + this.skillsSelectedNames = []; + this.skillsKeyword = ''; + this.skillsStatusFilter = 'all'; + this.skillsImportSelectedKeys = []; } - this.resetSkillsTargetState(); this.showSkillsModal = true; await this.refreshSkillsList({ silent: false }); }, @@ -158,7 +175,7 @@ }, async scanImportableSkills(options = {}) { - if (this.skillsScanningImports || this.skillsImporting || this.skillsZipImporting || this.skillsExporting) return; + if (this.skillsScanningImports || this.skillsImporting || this.skillsZipImporting || this.skillsExporting) return false; const silent = !!(options && options.silent); this.skillsScanningImports = true; try { diff --git a/web-ui/session-helpers.mjs b/web-ui/session-helpers.mjs index 60410d5..c668de5 100644 --- a/web-ui/session-helpers.mjs +++ b/web-ui/session-helpers.mjs @@ -62,6 +62,7 @@ export function switchMainTab(tab) { this.loadSessionTrashCount({ silent: true }); } const shouldLoadSkillsMarketOnEnter = nextTab === 'market' + && previousTab !== 'market' && typeof this.loadSkillsMarketOverview === 'function'; if (shouldLoadSkillsMarketOnEnter) { this.loadSkillsMarketOverview({ silent: true }); From 46a0b581297ab2a30dc1d85436ae63a00bf56e5b Mon Sep 17 00:00:00 2001 From: SurviveM <254925152+SurviveM@users.noreply.github.com> Date: Tue, 31 Mar 2026 20:15:40 +0800 Subject: [PATCH 04/19] fix: honor skills target paths and zip fallback names --- cli.js | 40 ++++++++- tests/unit/web-run-host.test.mjs | 137 +++++++++++++++++++++++++++++++ 2 files changed, 173 insertions(+), 4 deletions(-) diff --git a/cli.js b/cli.js index 4edfc5c..ae748c0 100644 --- a/cli.js +++ b/cli.js @@ -118,12 +118,12 @@ const CODEX_SKILLS_DIR = path.join(CONFIG_DIR, 'skills'); const CLAUDE_SKILLS_DIR = path.join(CLAUDE_DIR, 'skills'); const AGENTS_SKILLS_DIR = path.join(os.homedir(), '.agents', 'skills'); const SKILL_TARGETS = Object.freeze([ - Object.freeze({ app: 'codex', label: 'Codex', dir: CODEX_SKILLS_DIR }), - Object.freeze({ app: 'claude', label: 'Claude Code', dir: CLAUDE_SKILLS_DIR }) + Object.freeze({ app: 'codex', label: 'Codex', dir: getCodexSkillsDir() }), + Object.freeze({ app: 'claude', label: 'Claude Code', dir: getClaudeSkillsDir() }) ]); const SKILL_IMPORT_SOURCES = Object.freeze([ ...SKILL_TARGETS, - { app: 'agents', label: 'Agents', dir: AGENTS_SKILLS_DIR } + Object.freeze({ app: 'agents', label: 'Agents', dir: AGENTS_SKILLS_DIR }) ]); const MODELS_CACHE_TTL_MS = 60 * 1000; const MODELS_NEGATIVE_CACHE_TTL_MS = 5 * 1000; @@ -172,6 +172,38 @@ const CLI_INSTALL_TARGETS = Object.freeze([ const HTTP_KEEP_ALIVE_AGENT = new http.Agent({ keepAlive: true }); const HTTPS_KEEP_ALIVE_AGENT = new https.Agent({ keepAlive: true }); +function getCodexSkillsDir() { + const envCodexHome = typeof process.env.CODEX_HOME === 'string' ? process.env.CODEX_HOME.trim() : ''; + if (envCodexHome) { + return path.join(envCodexHome, 'skills'); + } + const xdgConfig = typeof process.env.XDG_CONFIG_HOME === 'string' ? process.env.XDG_CONFIG_HOME.trim() : ''; + if (xdgConfig) { + return path.join(xdgConfig, 'codex', 'skills'); + } + const resolvedConfigDir = resolveExistingDir([ + path.join(os.homedir(), '.config', 'codex') + ], CONFIG_DIR); + return path.join(resolvedConfigDir, 'skills'); +} + +function getClaudeSkillsDir() { + const envClaudeHome = typeof process.env.CLAUDE_HOME === 'string' && process.env.CLAUDE_HOME.trim() + ? process.env.CLAUDE_HOME.trim() + : (typeof process.env.CLAUDE_CONFIG_DIR === 'string' ? process.env.CLAUDE_CONFIG_DIR.trim() : ''); + if (envClaudeHome) { + return path.join(envClaudeHome, 'skills'); + } + const xdgConfig = typeof process.env.XDG_CONFIG_HOME === 'string' ? process.env.XDG_CONFIG_HOME.trim() : ''; + if (xdgConfig) { + return path.join(xdgConfig, 'claude', 'skills'); + } + const resolvedConfigDir = resolveExistingDir([ + path.join(os.homedir(), '.config', 'claude') + ], CLAUDE_DIR); + return path.join(resolvedConfigDir, 'skills'); +} + function resolveWebPort() { const raw = process.env.CODEXMATE_PORT; if (!raw) return DEFAULT_WEB_PORT; @@ -9777,7 +9809,7 @@ async function handleImportSkillsZipUpload(req, res, options = {}) { writeJsonResponse(res, 400, { error: '目标宿主不支持' }); return; } - const fileName = resolveUploadFileNameFromRequest(req, 'codex-skills.zip'); + const fileName = resolveUploadFileNameFromRequest(req, `${targetApp}-skills.zip`); const upload = await writeUploadZipStream( req, 'codex-skills-import', diff --git a/tests/unit/web-run-host.test.mjs b/tests/unit/web-run-host.test.mjs index 0fe2adb..e8a57a2 100644 --- a/tests/unit/web-run-host.test.mjs +++ b/tests/unit/web-run-host.test.mjs @@ -146,6 +146,49 @@ test('resolveWebHost still prefers environment host over default host', () => { assert.strictEqual(withEnv({}), '192.168.1.10'); }); +const getCodexSkillsDirSource = extractFunctionBySignature( + cliContent, + 'function getCodexSkillsDir() {', + 'getCodexSkillsDir' +); +const getClaudeSkillsDirSource = extractFunctionBySignature( + cliContent, + 'function getClaudeSkillsDir() {', + 'getClaudeSkillsDir' +); + +test('getCodexSkillsDir honors CODEX_HOME before legacy defaults', () => { + const getCodexSkillsDir = instantiateFunction(getCodexSkillsDirSource, 'getCodexSkillsDir', { + path, + os: { homedir: () => '/home/demo' }, + process: { env: { CODEX_HOME: '/tmp/custom-codex-home' } }, + resolveExistingDir: () => '/home/demo/.codex', + CONFIG_DIR: '/home/demo/.codex', + CODEX_SKILLS_DIR: '/home/demo/.codex/skills' + }); + + assert.strictEqual(getCodexSkillsDir(), '/tmp/custom-codex-home/skills'); +}); + +test('getClaudeSkillsDir honors CLAUDE_CONFIG_DIR before legacy defaults', () => { + const getClaudeSkillsDir = instantiateFunction(getClaudeSkillsDirSource, 'getClaudeSkillsDir', { + path, + os: { homedir: () => '/home/demo' }, + process: { env: { CLAUDE_CONFIG_DIR: '/tmp/custom-claude-home' } }, + resolveExistingDir: () => '/home/demo/.claude', + CLAUDE_DIR: '/home/demo/.claude', + CLAUDE_SKILLS_DIR: '/home/demo/.claude/skills' + }); + + assert.strictEqual(getClaudeSkillsDir(), '/tmp/custom-claude-home/skills'); +}); + +test('skills target tables use env-aware skills dir resolvers', () => { + assert.match(cliContent, /dir:\s*getCodexSkillsDir\(\)/); + assert.match(cliContent, /dir:\s*getClaudeSkillsDir\(\)/); + assert.match(cliContent, /Object\.freeze\(\{\s*app:\s*'agents',\s*label:\s*'Agents',\s*dir:\s*AGENTS_SKILLS_DIR\s*\}\)/s); +}); + const SKILL_TARGETS = [ { app: 'codex', label: 'Codex', dir: '/tmp/codex-skills' }, { app: 'claude', label: 'Claude', dir: '/tmp/claude-skills' } @@ -190,6 +233,11 @@ const resolveSkillTargetAppFromRequest = instantiateFunction( normalizeSkillTargetApp } ); +const handleImportSkillsZipUploadSource = extractFunctionBySignature( + cliContent, + 'async function handleImportSkillsZipUpload(req, res, options = {}) {', + 'handleImportSkillsZipUpload' +); test('resolveSkillTarget still falls back to default target when target is omitted', () => { assert.deepStrictEqual(resolveSkillTarget({}), SKILL_TARGETS[0]); @@ -212,6 +260,95 @@ test('resolveSkillTargetAppFromRequest rejects explicit unsupported query target ); }); +test('handleImportSkillsZipUpload keeps forced target app on the codex-only route', async () => { + let resolverCalls = 0; + let importedOptions = null; + const handleImportSkillsZipUpload = instantiateFunction( + handleImportSkillsZipUploadSource, + 'handleImportSkillsZipUpload', + { + normalizeSkillTargetApp(app) { + const value = typeof app === 'string' ? app.trim().toLowerCase() : ''; + return value === 'codex' || value === 'claude' ? value : ''; + }, + resolveSkillTargetAppFromRequest() { + resolverCalls += 1; + return 'claude'; + }, + resolveUploadFileNameFromRequest() { + return 'codex-skills.zip'; + }, + writeUploadZipStream: async () => ({ zipPath: '/tmp/codex.zip', tempDir: '/tmp/codex-upload' }), + importSkillsFromZipFile: async (_zipPath, options) => { + importedOptions = options; + return { imported: [] }; + }, + writeJsonResponse(res, statusCode, payload) { + res.statusCode = statusCode; + res.payload = payload; + }, + MAX_SKILLS_ZIP_UPLOAD_SIZE: 20 * 1024 * 1024 + } + ); + + const res = {}; + await handleImportSkillsZipUpload({ + method: 'POST', + url: '/api/import-codex-skills-zip?targetApp=claude', + headers: {} + }, res, { targetApp: 'codex' }); + + assert.strictEqual(resolverCalls, 0); + assert(importedOptions, 'importSkillsFromZipFile should receive options'); + assert.strictEqual(importedOptions.targetApp, 'codex'); + assert.strictEqual(res.statusCode, 200); +}); + +test('handleImportSkillsZipUpload derives fallback zip name from the resolved target app', async () => { + let fallbackName = ''; + let importedOptions = null; + const handleImportSkillsZipUpload = instantiateFunction( + handleImportSkillsZipUploadSource, + 'handleImportSkillsZipUpload', + { + normalizeSkillTargetApp(app) { + const value = typeof app === 'string' ? app.trim().toLowerCase() : ''; + return value === 'codex' || value === 'claude' ? value : ''; + }, + resolveSkillTargetAppFromRequest() { + return 'claude'; + }, + resolveUploadFileNameFromRequest(_req, nextFallbackName) { + fallbackName = nextFallbackName; + return nextFallbackName; + }, + writeUploadZipStream: async () => ({ zipPath: '/tmp/claude.zip', tempDir: '/tmp/claude-upload' }), + importSkillsFromZipFile: async (_zipPath, options) => { + importedOptions = options; + return { imported: [] }; + }, + writeJsonResponse(res, statusCode, payload) { + res.statusCode = statusCode; + res.payload = payload; + }, + MAX_SKILLS_ZIP_UPLOAD_SIZE: 20 * 1024 * 1024 + } + ); + + const res = {}; + await handleImportSkillsZipUpload({ + method: 'POST', + url: '/api/import-skills-zip?targetApp=claude', + headers: {} + }, res); + + assert.strictEqual(fallbackName, 'claude-skills.zip'); + assert(importedOptions, 'importSkillsFromZipFile should receive options'); + assert.strictEqual(importedOptions.targetApp, 'claude'); + assert.strictEqual(importedOptions.fallbackName, 'claude-skills.zip'); + assert.strictEqual(res.statusCode, 200); +}); + test('codex-only zip upload route pins target app before request fallback resolution', () => { assert.match( cliContent, From 77f3f400956fd31eeef0f21935a53bbd8500196b Mon Sep 17 00:00:00 2001 From: SurviveM <254925152+SurviveM@users.noreply.github.com> Date: Tue, 31 Mar 2026 20:21:21 +0800 Subject: [PATCH 05/19] fix: address coderabbit ipv6 and aria findings --- cli.js | 4 +++- tests/unit/config-tabs-ui.test.mjs | 4 ++++ tests/unit/web-run-host.test.mjs | 7 +++++++ web-ui/index.html | 4 ++-- 4 files changed, 16 insertions(+), 3 deletions(-) diff --git a/cli.js b/cli.js index ae748c0..514ea49 100644 --- a/cli.js +++ b/cli.js @@ -10344,7 +10344,9 @@ function createWebServer({ htmlPath, assetsDir, webDir, host, port, openBrowser process.exit(1); }); - const openHost = isAnyAddressHost(host) ? DEFAULT_WEB_OPEN_HOST : host; + const openHost = host === '::' + ? '::1' + : (host === '0.0.0.0' ? DEFAULT_WEB_OPEN_HOST : host); const openUrl = `http://${formatHostForUrl(openHost)}:${port}`; server.listen(port, host, () => { console.log('\n✓ Web UI 已启动:', openUrl); diff --git a/tests/unit/config-tabs-ui.test.mjs b/tests/unit/config-tabs-ui.test.mjs index a0f2d83..95206ac 100644 --- a/tests/unit/config-tabs-ui.test.mjs +++ b/tests/unit/config-tabs-ui.test.mjs @@ -50,6 +50,10 @@ test('config template keeps expected config tabs in top and side navigation', () assert.match(html, /skillsTargetApp === 'claude'/); assert.match(html, /setSkillsTargetApp\('codex', \{ silent: false \}\)/); assert.match(html, /setSkillsTargetApp\('claude', \{ silent: false \}\)/); + assert.match(html, /class="market-target-switch" role="group" aria-label="选择 Skills 安装目标"/); + assert.match(html, /class="market-target-switch market-target-switch-compact" role="group" aria-label="选择 Skills 管理目标"/); + assert.doesNotMatch(html, /class="market-target-switch" role="tablist" aria-label="选择 Skills 安装目标"/); + assert.doesNotMatch(html, /class="market-target-switch market-target-switch-compact" role="tablist" aria-label="选择 Skills 管理目标"/); assert.match(html, /skillsDefaultRootPath/); assert.match(html, /可直接导入/); assert.match(html, /不再展示任何 MCP 在线目录或外部市场/); diff --git a/tests/unit/web-run-host.test.mjs b/tests/unit/web-run-host.test.mjs index e8a57a2..ed8c23f 100644 --- a/tests/unit/web-run-host.test.mjs +++ b/tests/unit/web-run-host.test.mjs @@ -146,6 +146,13 @@ test('resolveWebHost still prefers environment host over default host', () => { assert.strictEqual(withEnv({}), '192.168.1.10'); }); +test('web auto-open uses IPv6 loopback when binding to IPv6 any address', () => { + assert.match( + cliContent, + /const openHost = host === '::'\s*\?\s*'::1'\s*:\s*\(host === '0\.0\.0\.0' \? DEFAULT_WEB_OPEN_HOST : host\);/ + ); +}); + const getCodexSkillsDirSource = extractFunctionBySignature( cliContent, 'function getCodexSkillsDir() {', diff --git a/web-ui/index.html b/web-ui/index.html index 72ddb92..454c8f7 100644 --- a/web-ui/index.html +++ b/web-ui/index.html @@ -1304,7 +1304,7 @@

-
+
-
+
@@ -1316,6 +1317,7 @@

type="button" :class="['market-target-chip', { active: skillsTargetApp === 'claude' }]" :aria-pressed="skillsTargetApp === 'claude'" + :disabled="skillsMarketBusy" @click="setSkillsTargetApp('claude', { silent: false })"> Claude Code @@ -2138,6 +2140,7 @@

type="button" :class="['market-target-chip', { active: skillsTargetApp === 'codex' }]" :aria-pressed="skillsTargetApp === 'codex'" + :disabled="skillsMarketBusy" @click="setSkillsTargetApp('codex', { silent: false })"> Codex @@ -2145,6 +2148,7 @@

type="button" :class="['market-target-chip', { active: skillsTargetApp === 'claude' }]" :aria-pressed="skillsTargetApp === 'claude'" + :disabled="skillsMarketBusy" @click="setSkillsTargetApp('claude', { silent: false })"> Claude Code diff --git a/web-ui/modules/skills.methods.mjs b/web-ui/modules/skills.methods.mjs index e6864f0..f2caa2c 100644 --- a/web-ui/modules/skills.methods.mjs +++ b/web-ui/modules/skills.methods.mjs @@ -175,7 +175,7 @@ }, async scanImportableSkills(options = {}) { - if (this.skillsScanningImports || this.skillsImporting || this.skillsZipImporting || this.skillsExporting) return false; + if (this.skillsDeleting || this.skillsScanningImports || this.skillsImporting || this.skillsZipImporting || this.skillsExporting) return false; const silent = !!(options && options.silent); this.skillsScanningImports = true; try { @@ -213,7 +213,7 @@ }, async importSelectedSkills() { - if (this.skillsImporting || this.skillsZipImporting || this.skillsExporting) return; + if (this.skillsDeleting || this.skillsImporting || this.skillsZipImporting || this.skillsExporting) return; const selectedSet = new Set(Array.isArray(this.skillsImportSelectedKeys) ? this.skillsImportSelectedKeys : []); const selectedItems = (Array.isArray(this.skillsImportList) ? this.skillsImportList : []) .filter((item) => selectedSet.has(this.buildSkillImportKey(item))) @@ -305,7 +305,7 @@ }, async importSkillsFromZipFile(file) { - if (this.skillsZipImporting || this.skillsImporting || this.skillsExporting) return; + if (this.skillsDeleting || this.skillsZipImporting || this.skillsImporting || this.skillsExporting) return; const maxSize = 20 * 1024 * 1024; if (file.size > maxSize) { this.showMessage('ZIP 文件过大，限制 20MB', 'error'); @@ -340,7 +340,7 @@ }, async exportSelectedSkills() { - if (this.skillsExporting || this.skillsZipImporting || this.skillsImporting) return; + if (this.skillsDeleting || this.skillsExporting || this.skillsZipImporting || this.skillsImporting) return; const selected = Array.isArray(this.skillsSelectedNames) ? Array.from(new Set(this.skillsSelectedNames.map((item) => String(item || '').trim()).filter(Boolean))) : []; diff --git a/web-ui/session-helpers.mjs b/web-ui/session-helpers.mjs index c668de5..7529af5 100644 --- a/web-ui/session-helpers.mjs +++ b/web-ui/session-helpers.mjs @@ -65,7 +65,7 @@ export function switchMainTab(tab) { && previousTab !== 'market' && typeof this.loadSkillsMarketOverview === 'function'; if (shouldLoadSkillsMarketOnEnter) { - this.loadSkillsMarketOverview({ silent: true }); + void Promise.resolve(this.loadSkillsMarketOverview({ silent: true })).catch(() => {}); } if (nextTab === 'config' && this.configMode === 'claude') { const expectedTab = nextTab; diff --git a/web-ui/styles.css b/web-ui/styles.css index b650f1f..8b3b8f9 100644 --- a/web-ui/styles.css +++ b/web-ui/styles.css @@ -37,11 +37,13 @@ --font-size-display: 52px; --font-size-title: 18px; + --font-size-large: 20px; --font-size-body: 15px; --font-size-secondary: 13px; --font-size-caption: 11px; --font-weight-display: 600; + --font-weight-primary: 600; --font-weight-title: 600; --font-weight-body: 400; --font-weight-secondary: 500; @@ -59,6 +61,7 @@ /* 圆角系统 */ --radius-sm: 8px; + --radius-md: 10px; --radius-lg: 12px; --radius-xl: 18px; --radius-full: 50px; From b501f302f52fd1fb7fdd67b13c6b17f788aff4f0 Mon Sep 17 00:00:00 2001 From: SurviveM <254925152+SurviveM@users.noreply.github.com> Date: Tue, 31 Mar 2026 21:31:19 +0800 Subject: [PATCH 08/19] test: cover readme en openclaw config entry --- README.en.md | 2 +- tests/unit/readme-docs-consistency.test.mjs | 5 +++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/README.en.md b/README.en.md index 6a6626b..bde4fb0 100644 --- a/README.en.md +++ b/README.en.md @@ -89,7 +89,7 @@ flowchart TB subgraph Data["Local Files"] CODEX["~/.codex/config + auth + models"] CLAUDE["~/.claude/settings.json"] - OPENCLAW["~/.openclaw/*.json5 + workspace/AGENTS.md"] + OPENCLAW["~/.openclaw/*.json5 + ~/.openclaw/openclaw.json + workspace/AGENTS.md"] SKILLS["~/.codex/skills / ~/.claude/skills / ~/.agents/skills"] STATE["sessions / trash / workflow runs / skill exports"] end diff --git a/tests/unit/readme-docs-consistency.test.mjs b/tests/unit/readme-docs-consistency.test.mjs index 59481bf..87ab643 100644 --- a/tests/unit/readme-docs-consistency.test.mjs +++ b/tests/unit/readme-docs-consistency.test.mjs @@ -13,8 +13,13 @@ function readProjectFile(relativePath) { test('README OpenClaw state diagram includes the documented runtime config file', () => { const readme = readProjectFile('README.md'); + const readmeEn = readProjectFile('README.en.md'); assert.match( readme, /OPENCLAW\["~\/\.openclaw\/\*\.json5 \+ ~\/\.openclaw\/openclaw\.json \+ workspace\/AGENTS\.md"\]/ ); + assert.match( + readmeEn, + /OPENCLAW\["~\/\.openclaw\/\*\.json5 \+ ~\/\.openclaw\/openclaw\.json \+ workspace\/AGENTS\.md"\]/ + ); }); From 7316e3997d0169b2b2d4b019f739ca9379a7f2b7 Mon Sep 17 00:00:00 2001 From: SurviveM <254925152+SurviveM@users.noreply.github.com> Date: Tue, 31 Mar 2026 21:57:09 +0800 Subject: [PATCH 09/19] fix: reject invalid web skills targets --- tests/unit/skills-market-runtime.test.mjs | 56 +++++++++++++++++++++++ web-ui/modules/skills.methods.mjs | 34 ++++++++++++-- 2 files changed, 86 insertions(+), 4 deletions(-) diff --git a/tests/unit/skills-market-runtime.test.mjs b/tests/unit/skills-market-runtime.test.mjs index 48221a8..056cc48 100644 --- a/tests/unit/skills-market-runtime.test.mjs +++ b/tests/unit/skills-market-runtime.test.mjs @@ -120,6 +120,62 @@ test('setSkillsTargetApp returns false while any skills action is in flight', as assert.strictEqual(loadCalled, false); }); +test('normalizeSkillsTargetApp rejects unsupported explicit targets', () => { + const vm = buildVm(async () => ({})); + + assert.strictEqual(vm.normalizeSkillsTargetApp(undefined), 'codex'); + assert.strictEqual(vm.normalizeSkillsTargetApp('codex'), 'codex'); + assert.strictEqual(vm.normalizeSkillsTargetApp('claude'), 'claude'); + assert.throws(() => vm.normalizeSkillsTargetApp('Claude'), /Unsupported skills target app/); + assert.throws(() => vm.normalizeSkillsTargetApp(' claude '), /Unsupported skills target app/); +}); + +test('setSkillsTargetApp rejects invalid explicit target without mutating state', async () => { + let loadCalled = false; + const vm = buildVm(async () => ({}), { + skillsTargetApp: 'codex', + skillsRootPath: '/tmp/codex-skills', + skillsList: [{ name: 'alpha', hasSkillFile: true }] + }); + vm.loadSkillsMarketOverview = async () => { + loadCalled = true; + return true; + }; + + const ok = await vm.setSkillsTargetApp('Claude', { silent: false }); + + assert.strictEqual(ok, false); + assert.strictEqual(vm.skillsTargetApp, 'codex'); + assert.deepStrictEqual(vm.skillsList, [{ name: 'alpha', hasSkillFile: true }]); + assert.strictEqual(loadCalled, false); + assert.deepStrictEqual(vm.messageLog, [{ + message: '不支持的 Skills 安装目标：Claude', + type: 'error' + }]); +}); + +test('openSkillsManager rejects invalid explicit target without reopening the modal', async () => { + let refreshCalls = 0; + const vm = buildVm(async () => ({}), { + skillsTargetApp: 'codex', + showSkillsModal: false + }); + vm.refreshSkillsList = async () => { + refreshCalls += 1; + return true; + }; + + await vm.openSkillsManager({ targetApp: 'Claude' }); + + assert.strictEqual(vm.skillsTargetApp, 'codex'); + assert.strictEqual(vm.showSkillsModal, false); + assert.strictEqual(refreshCalls, 0); + assert.deepStrictEqual(vm.messageLog, [{ + message: '不支持的 Skills 安装目标：Claude', + type: 'error' + }]); +}); + test('openSkillsManager keeps market overview state when reopening same target', async () => { const refreshCalls = []; const vm = buildVm(async () => ({}), { diff --git a/web-ui/modules/skills.methods.mjs b/web-ui/modules/skills.methods.mjs index f2caa2c..4ffd50f 100644 --- a/web-ui/modules/skills.methods.mjs +++ b/web-ui/modules/skills.methods.mjs @@ -1,7 +1,21 @@ -export function createSkillsMethods({ api }) { +function createUnsupportedSkillsTargetAppError(app) { + return new Error(`Unsupported skills target app: ${String(app)}`); +} + +function showUnsupportedSkillsTargetMessage(vm, app) { + vm.showMessage(`不支持的 Skills 安装目标：${String(app)}`, 'error'); +} + +export function createSkillsMethods({ api }) { return { normalizeSkillsTargetApp(app) { - return app === 'claude' ? 'claude' : 'codex'; + if (app == null) { + return 'codex'; + } + if (app === 'codex' || app === 'claude') { + return app; + } + throw createUnsupportedSkillsTargetAppError(app); }, resetSkillsTargetState() { @@ -28,7 +42,13 @@ ) { return false; } - const nextTarget = this.normalizeSkillsTargetApp(app); + let nextTarget; + try { + nextTarget = this.normalizeSkillsTargetApp(app); + } catch (error) { + showUnsupportedSkillsTargetMessage(this, app); + return false; + } const refresh = !(options && options.refresh === false); const silent = !!(options && options.silent); if (nextTarget !== this.skillsTargetApp) { @@ -45,7 +65,13 @@ }, async openSkillsManager(options = {}) { - const targetApp = this.normalizeSkillsTargetApp(options && options.targetApp ? options.targetApp : this.skillsTargetApp); + let targetApp; + try { + targetApp = this.normalizeSkillsTargetApp(options && options.targetApp ? options.targetApp : this.skillsTargetApp); + } catch (error) { + showUnsupportedSkillsTargetMessage(this, options && options.targetApp); + return false; + } const targetChanged = targetApp !== this.skillsTargetApp; if (targetChanged) { this.skillsTargetApp = targetApp; From 2ee159f1f1821146511928ee893db69a6aac19f3 Mon Sep 17 00:00:00 2001 From: SurviveM <254925152+SurviveM@users.noreply.github.com> Date: Tue, 31 Mar 2026 22:30:31 +0800 Subject: [PATCH 10/19] fix: harden skills import guards --- cli.js | 40 +++-- tests/unit/skills-market-runtime.test.mjs | 24 +++ tests/unit/web-run-host.test.mjs | 179 ++++++++++++++++++++++ web-ui/modules/skills.methods.mjs | 4 +- 4 files changed, 234 insertions(+), 13 deletions(-) diff --git a/cli.js b/cli.js index ac0a7ab..797c1c4 100644 --- a/cli.js +++ b/cli.js @@ -1810,13 +1810,12 @@ function importSkills(params = {}) { if (!target) { return { error: '目标宿主不支持' }; } + const targetRoot = path.resolve(target.dir); const rawItems = Array.isArray(params.items) ? params.items : []; if (!rawItems.length) { return { error: '请先选择要导入的 skill' }; } - ensureDir(target.dir); - const imported = []; const failed = []; const dedup = new Set(); @@ -1874,8 +1873,8 @@ function importSkills(params = {}) { continue; } - const targetPath = path.join(target.dir, normalizedName.name); - const targetRelative = path.relative(target.dir, targetPath); + const targetPath = path.join(targetRoot, normalizedName.name); + const targetRelative = path.relative(targetRoot, targetPath); if (targetRelative.startsWith('..') || path.isAbsolute(targetRelative)) { failed.push({ name: normalizedName.name, @@ -1914,6 +1913,15 @@ function importSkills(params = {}) { }); continue; } + if (isPathInside(targetRoot, sourceDirForCopy)) { + failed.push({ + name: normalizedName.name, + sourceApp: source.app, + error: '目标路径不能位于来源 skill 目录内' + }); + continue; + } + ensureDir(targetRoot); const visitedRealPaths = new Set([sourceDirForCopy]); copyDirRecursive(sourceDirForCopy, targetPath, { dereferenceSymlinks: true, @@ -2011,18 +2019,21 @@ function resolveSkillNameFromImportedDirectory(skillDir, extractionRoot, fallbac } async function importSkillsFromZipFile(zipPath, options = {}) { - const target = resolveSkillTarget(options, 'codex'); - if (!target) { - return { error: '目标宿主不支持' }; - } const fallbackName = typeof options.fallbackName === 'string' ? options.fallbackName : ''; const tempDir = typeof options.tempDir === 'string' ? options.tempDir : ''; const imported = []; const failed = []; const dedupNames = new Set(); const extractionRoot = path.join(tempDir || path.dirname(zipPath), 'extract'); + let target = null; + let targetRoot = ''; try { + target = resolveSkillTarget(options, 'codex'); + if (!target) { + return { error: '目标宿主不支持' }; + } + targetRoot = path.resolve(target.dir); await inspectZipArchiveLimits(zipPath, { maxEntryCount: MAX_SKILLS_ZIP_ENTRY_COUNT, maxUncompressedBytes: MAX_SKILLS_ZIP_UNCOMPRESSED_BYTES @@ -2038,7 +2049,6 @@ async function importSkillsFromZipFile(zipPath, options = {}) { return { error: '压缩包中的技能目录数量超出导入上限' }; } - ensureDir(target.dir); for (const skillDir of discoveredDirs) { const normalizedName = resolveSkillNameFromImportedDirectory(skillDir, extractionRoot, fallbackName); if (normalizedName.error) { @@ -2054,8 +2064,8 @@ async function importSkillsFromZipFile(zipPath, options = {}) { } dedupNames.add(dedupKey); - const targetPath = path.join(target.dir, normalizedName.name); - const targetRelative = path.relative(target.dir, targetPath); + const targetPath = path.join(targetRoot, normalizedName.name); + const targetRelative = path.relative(targetRoot, targetPath); if (targetRelative.startsWith('..') || path.isAbsolute(targetRelative)) { failed.push({ name: normalizedName.name, @@ -2082,6 +2092,14 @@ async function importSkillsFromZipFile(zipPath, options = {}) { }); continue; } + if (isPathInside(targetRoot, sourceRealPath)) { + failed.push({ + name: normalizedName.name, + error: '目标路径不能位于来源 skill 目录内' + }); + continue; + } + ensureDir(targetRoot); const visitedRealPaths = new Set([sourceRealPath]); copyDirRecursive(sourceRealPath, targetPath, { dereferenceSymlinks: true, diff --git a/tests/unit/skills-market-runtime.test.mjs b/tests/unit/skills-market-runtime.test.mjs index 056cc48..23c20f9 100644 --- a/tests/unit/skills-market-runtime.test.mjs +++ b/tests/unit/skills-market-runtime.test.mjs @@ -285,3 +285,27 @@ test('skills import and export entrypoints return early while delete is in progr assert.strictEqual(uploadCalls, 0); assert.deepStrictEqual(vm.messageLog, []); }); + +test('skills import entrypoints return early while scan is in progress', async () => { + let apiCalls = 0; + let uploadCalls = 0; + const vm = buildVm(async () => { + apiCalls += 1; + return {}; + }, { + skillsScanningImports: true, + skillsImportList: [{ name: 'beta', sourceApp: 'claude' }], + skillsImportSelectedKeys: ['claude:beta'] + }); + vm.uploadSkillsZipStream = async () => { + uploadCalls += 1; + return {}; + }; + + await vm.importSelectedSkills(); + await vm.importSkillsFromZipFile({ name: 'skills.zip', size: 1024 }); + + assert.strictEqual(apiCalls, 0); + assert.strictEqual(uploadCalls, 0); + assert.deepStrictEqual(vm.messageLog, []); +}); diff --git a/tests/unit/web-run-host.test.mjs b/tests/unit/web-run-host.test.mjs index 42bf6ef..db9664c 100644 --- a/tests/unit/web-run-host.test.mjs +++ b/tests/unit/web-run-host.test.mjs @@ -286,6 +286,16 @@ const resolveSkillTargetAppFromRequest = instantiateFunction( normalizeSkillTargetApp } ); +const importSkillsSource = extractFunctionBySignature( + cliContent, + 'function importSkills(params = {}) {', + 'importSkills' +); +const importSkillsFromZipFileSource = extractFunctionBySignature( + cliContent, + 'async function importSkillsFromZipFile(zipPath, options = {}) {', + 'importSkillsFromZipFile' +); const handleImportSkillsZipUploadSource = extractFunctionBySignature( cliContent, 'async function handleImportSkillsZipUpload(req, res, options = {}) {', @@ -402,6 +412,175 @@ test('handleImportSkillsZipUpload derives fallback zip name from the resolved ta assert.strictEqual(res.statusCode, 200); }); +test('importSkills rejects target roots nested inside the source skill before ensuring the destination root', () => { + let copyCalls = 0; + const ensureDirCalls = []; + const importSkills = instantiateFunction(importSkillsSource, 'importSkills', { + resolveSkillTarget() { + return { app: 'codex', label: 'Codex', dir: '/tmp/source/nested' }; + }, + normalizeCodexSkillName(name) { + return { name: String(name || '') }; + }, + getSkillImportSourceByApp() { + return { app: 'claude', label: 'Claude', dir: '/tmp' }; + }, + ensureDir(dir) { + ensureDirCalls.push(dir); + }, + path, + fs: { + existsSync(targetPath) { + return targetPath === '/tmp/source'; + }, + lstatSync() { + return { + isDirectory: () => true, + isSymbolicLink: () => false + }; + }, + statSync() { + return { + isDirectory: () => true + }; + } + }, + copyDirRecursive() { + copyCalls += 1; + }, + removeDirectoryRecursive() {}, + isPathInside(targetPath, rootPath) { + return targetPath === '/tmp/source/nested' && rootPath === '/tmp/source'; + } + }); + + const result = importSkills({ + targetApp: 'codex', + items: [{ name: 'source', sourceApp: 'claude' }] + }); + + assert.strictEqual(copyCalls, 0); + assert.deepStrictEqual(ensureDirCalls, []); + assert.deepStrictEqual(result.imported, []); + assert.strictEqual(result.failed.length, 1); + assert.strictEqual(result.failed[0].error, '目标路径不能位于来源 skill 目录内'); +}); + +test('importSkillsFromZipFile rejects target roots nested inside extracted skills before ensuring the destination root', async () => { + let copyCalls = 0; + const ensureDirCalls = []; + const cleanupCalls = []; + const importSkillsFromZipFile = instantiateFunction(importSkillsFromZipFileSource, 'importSkillsFromZipFile', { + resolveSkillTarget() { + return { app: 'codex', label: 'Codex', dir: '/tmp/upload/extract/source/nested' }; + }, + path, + fs: { + realpathSync(targetPath) { + return targetPath; + }, + statSync() { + return { + isDirectory: () => true + }; + }, + existsSync() { + return false; + }, + rmSync(targetPath, options) { + cleanupCalls.push({ targetPath, options }); + } + }, + inspectZipArchiveLimits: async () => {}, + extractUploadZip: async () => {}, + collectSkillDirectoriesFromRoot() { + return { + results: ['/tmp/upload/extract/source'], + truncated: false + }; + }, + resolveSkillNameFromImportedDirectory() { + return { name: 'source' }; + }, + ensureDir(dir) { + ensureDirCalls.push(dir); + }, + copyDirRecursive() { + copyCalls += 1; + }, + removeDirectoryRecursive() {}, + isPathInside(targetPath, rootPath) { + return targetPath === '/tmp/upload/extract/source/nested' && rootPath === '/tmp/upload/extract/source'; + }, + MAX_SKILLS_ZIP_ENTRY_COUNT: 100, + MAX_SKILLS_ZIP_UNCOMPRESSED_BYTES: 1024 + }); + + const result = await importSkillsFromZipFile('/tmp/upload/archive.zip', { + tempDir: '/tmp/upload', + targetApp: 'codex' + }); + + assert.strictEqual(copyCalls, 0); + assert.deepStrictEqual(ensureDirCalls, []); + assert.deepStrictEqual(result.imported, []); + assert.strictEqual(result.failed.length, 1); + assert.strictEqual(result.failed[0].error, '目标路径不能位于来源 skill 目录内'); + assert.deepStrictEqual(cleanupCalls, [{ + targetPath: '/tmp/upload', + options: { recursive: true, force: true } + }]); +}); + +test('importSkillsFromZipFile still cleans tempDir when target app is unsupported', async () => { + const cleanupCalls = []; + const importSkillsFromZipFile = instantiateFunction(importSkillsFromZipFileSource, 'importSkillsFromZipFile', { + resolveSkillTarget() { + return null; + }, + path, + fs: { + existsSync() { + return false; + }, + rmSync(targetPath, options) { + cleanupCalls.push({ targetPath, options }); + } + }, + inspectZipArchiveLimits: async () => { + throw new Error('inspectZipArchiveLimits should not run'); + }, + extractUploadZip: async () => { + throw new Error('extractUploadZip should not run'); + }, + collectSkillDirectoriesFromRoot() { + return { results: [], truncated: false }; + }, + resolveSkillNameFromImportedDirectory() { + return { name: 'demo' }; + }, + ensureDir() {}, + copyDirRecursive() {}, + removeDirectoryRecursive() {}, + isPathInside() { + return false; + }, + MAX_SKILLS_ZIP_ENTRY_COUNT: 100, + MAX_SKILLS_ZIP_UNCOMPRESSED_BYTES: 1024 + }); + + const result = await importSkillsFromZipFile('/tmp/upload/archive.zip', { + tempDir: '/tmp/upload', + targetApp: 'invalid' + }); + + assert.deepStrictEqual(result, { error: '目标宿主不支持' }); + assert.deepStrictEqual(cleanupCalls, [{ + targetPath: '/tmp/upload', + options: { recursive: true, force: true } + }]); +}); + test('codex-only zip upload route pins target app before request fallback resolution', () => { assert.match( cliContent, diff --git a/web-ui/modules/skills.methods.mjs b/web-ui/modules/skills.methods.mjs index 4ffd50f..da6a541 100644 --- a/web-ui/modules/skills.methods.mjs +++ b/web-ui/modules/skills.methods.mjs @@ -239,7 +239,7 @@ export function createSkillsMethods({ api }) { }, async importSelectedSkills() { - if (this.skillsDeleting || this.skillsImporting || this.skillsZipImporting || this.skillsExporting) return; + if (this.skillsDeleting || this.skillsScanningImports || this.skillsImporting || this.skillsZipImporting || this.skillsExporting) return; const selectedSet = new Set(Array.isArray(this.skillsImportSelectedKeys) ? this.skillsImportSelectedKeys : []); const selectedItems = (Array.isArray(this.skillsImportList) ? this.skillsImportList : []) .filter((item) => selectedSet.has(this.buildSkillImportKey(item))) @@ -331,7 +331,7 @@ export function createSkillsMethods({ api }) { }, async importSkillsFromZipFile(file) { - if (this.skillsDeleting || this.skillsZipImporting || this.skillsImporting || this.skillsExporting) return; + if (this.skillsDeleting || this.skillsScanningImports || this.skillsZipImporting || this.skillsImporting || this.skillsExporting) return; const maxSize = 20 * 1024 * 1024; if (file.size > maxSize) { this.showMessage('ZIP 文件过大，限制 20MB', 'error'); From 6f79ebdc45f4a5a5e8d2478706ba92e3f31af3ab Mon Sep 17 00:00:00 2001 From: SurviveM <254925152+SurviveM@users.noreply.github.com> Date: Tue, 31 Mar 2026 22:42:04 +0800 Subject: [PATCH 11/19] fix: normalize skills import targets --- cli.js | 39 ++++++++++++---- tests/unit/web-run-host.test.mjs | 77 ++++++++++++++++++++++++++++++++ 2 files changed, 108 insertions(+), 8 deletions(-) diff --git a/cli.js b/cli.js index 797c1c4..e96e938 100644 --- a/cli.js +++ b/cli.js @@ -1810,7 +1810,7 @@ function importSkills(params = {}) { if (!target) { return { error: '目标宿主不支持' }; } - const targetRoot = path.resolve(target.dir); + const targetRoot = resolveCopyTargetRoot(target.dir); const rawItems = Array.isArray(params.items) ? params.items : []; if (!rawItems.length) { return { error: '请先选择要导入的 skill' }; @@ -1957,7 +1957,7 @@ function importSkills(params = {}) { failed, targetApp: target.app, targetLabel: target.label, - root: target.dir + root: targetRoot }; } @@ -2033,7 +2033,7 @@ async function importSkillsFromZipFile(zipPath, options = {}) { if (!target) { return { error: '目标宿主不支持' }; } - targetRoot = path.resolve(target.dir); + targetRoot = resolveCopyTargetRoot(target.dir); await inspectZipArchiveLimits(zipPath, { maxEntryCount: MAX_SKILLS_ZIP_ENTRY_COUNT, maxUncompressedBytes: MAX_SKILLS_ZIP_UNCOMPRESSED_BYTES @@ -2133,7 +2133,7 @@ async function importSkillsFromZipFile(zipPath, options = {}) { failed, targetApp: target.app, targetLabel: target.label, - root: target.dir + root: targetRoot }; } @@ -2143,7 +2143,7 @@ async function importSkillsFromZipFile(zipPath, options = {}) { failed, targetApp: target.app, targetLabel: target.label, - root: target.dir + root: targetRoot }; } catch (e) { return { @@ -2170,14 +2170,16 @@ async function importSkillsFromZip(payload = {}) { if (!payload || typeof payload.fileBase64 !== 'string' || !payload.fileBase64.trim()) { return { error: '缺少技能压缩包内容' }; } - const upload = writeUploadZip(payload.fileBase64, 'codex-skills-import', payload.fileName || 'codex-skills.zip'); + const targetApp = normalizeSkillTargetApp(payload.targetApp || payload.target) || 'codex'; + const fallbackName = payload.fileName || `${targetApp}-skills.zip`; + const upload = writeUploadZip(payload.fileBase64, 'codex-skills-import', fallbackName); if (upload.error) { return { error: upload.error }; } return importSkillsFromZipFile(upload.zipPath, { tempDir: upload.tempDir, - fallbackName: payload.fileName || '', - targetApp: payload.targetApp || payload.target || 'codex' + fallbackName, + targetApp }); } @@ -3794,6 +3796,27 @@ function isPathInside(targetPath, rootPath) { return resolvedTarget.startsWith(rootWithSlash); } +function resolveCopyTargetRoot(targetDir) { + const suffixSegments = []; + let current = path.resolve(targetDir || ''); + while (current && !fs.existsSync(current)) { + const parent = path.dirname(current); + if (!parent || parent === current) { + break; + } + suffixSegments.unshift(path.basename(current)); + current = parent; + } + let resolvedRoot = normalizePathForCompare(current || targetDir); + if (!resolvedRoot) { + resolvedRoot = path.resolve(targetDir || ''); + } + for (const segment of suffixSegments) { + resolvedRoot = path.join(resolvedRoot, segment); + } + return resolvedRoot; +} + function collectJsonlFiles(rootDir, maxFiles = 5000) { if (!fs.existsSync(rootDir)) { return []; diff --git a/tests/unit/web-run-host.test.mjs b/tests/unit/web-run-host.test.mjs index db9664c..573c3af 100644 --- a/tests/unit/web-run-host.test.mjs +++ b/tests/unit/web-run-host.test.mjs @@ -286,6 +286,11 @@ const resolveSkillTargetAppFromRequest = instantiateFunction( normalizeSkillTargetApp } ); +const resolveCopyTargetRootSource = extractFunctionBySignature( + cliContent, + 'function resolveCopyTargetRoot(targetDir) {', + 'resolveCopyTargetRoot' +); const importSkillsSource = extractFunctionBySignature( cliContent, 'function importSkills(params = {}) {', @@ -296,6 +301,11 @@ const importSkillsFromZipFileSource = extractFunctionBySignature( 'async function importSkillsFromZipFile(zipPath, options = {}) {', 'importSkillsFromZipFile' ); +const importSkillsFromZipSource = extractFunctionBySignature( + cliContent, + 'async function importSkillsFromZip(payload = {}) {', + 'importSkillsFromZip' +); const handleImportSkillsZipUploadSource = extractFunctionBySignature( cliContent, 'async function handleImportSkillsZipUpload(req, res, options = {}) {', @@ -323,6 +333,22 @@ test('resolveSkillTargetAppFromRequest rejects explicit unsupported query target ); }); +test('resolveCopyTargetRoot resolves through the nearest existing parent path', () => { + const resolveCopyTargetRoot = instantiateFunction(resolveCopyTargetRootSource, 'resolveCopyTargetRoot', { + path, + fs: { + existsSync(targetPath) { + return targetPath === '/link-target' || targetPath === '/'; + } + }, + normalizePathForCompare(targetPath) { + return targetPath === '/link-target' ? '/real/source' : targetPath; + } + }); + + assert.strictEqual(resolveCopyTargetRoot('/link-target/nested/skills'), '/real/source/nested/skills'); +}); + test('handleImportSkillsZipUpload keeps forced target app on the codex-only route', async () => { let resolverCalls = 0; let importedOptions = null; @@ -415,10 +441,15 @@ test('handleImportSkillsZipUpload derives fallback zip name from the resolved ta test('importSkills rejects target roots nested inside the source skill before ensuring the destination root', () => { let copyCalls = 0; const ensureDirCalls = []; + let resolvedTargetDir = ''; const importSkills = instantiateFunction(importSkillsSource, 'importSkills', { resolveSkillTarget() { return { app: 'codex', label: 'Codex', dir: '/tmp/source/nested' }; }, + resolveCopyTargetRoot(targetDir) { + resolvedTargetDir = targetDir; + return '/tmp/source/nested'; + }, normalizeCodexSkillName(name) { return { name: String(name || '') }; }, @@ -460,6 +491,7 @@ test('importSkills rejects target roots nested inside the source skill before en }); assert.strictEqual(copyCalls, 0); + assert.strictEqual(resolvedTargetDir, '/tmp/source/nested'); assert.deepStrictEqual(ensureDirCalls, []); assert.deepStrictEqual(result.imported, []); assert.strictEqual(result.failed.length, 1); @@ -470,10 +502,15 @@ test('importSkillsFromZipFile rejects target roots nested inside extracted skill let copyCalls = 0; const ensureDirCalls = []; const cleanupCalls = []; + let resolvedTargetDir = ''; const importSkillsFromZipFile = instantiateFunction(importSkillsFromZipFileSource, 'importSkillsFromZipFile', { resolveSkillTarget() { return { app: 'codex', label: 'Codex', dir: '/tmp/upload/extract/source/nested' }; }, + resolveCopyTargetRoot(targetDir) { + resolvedTargetDir = targetDir; + return '/tmp/upload/extract/source/nested'; + }, path, fs: { realpathSync(targetPath) { @@ -522,6 +559,7 @@ test('importSkillsFromZipFile rejects target roots nested inside extracted skill }); assert.strictEqual(copyCalls, 0); + assert.strictEqual(resolvedTargetDir, '/tmp/upload/extract/source/nested'); assert.deepStrictEqual(ensureDirCalls, []); assert.deepStrictEqual(result.imported, []); assert.strictEqual(result.failed.length, 1); @@ -538,6 +576,9 @@ test('importSkillsFromZipFile still cleans tempDir when target app is unsupporte resolveSkillTarget() { return null; }, + resolveCopyTargetRoot(targetDir) { + return targetDir; + }, path, fs: { existsSync() { @@ -581,6 +622,42 @@ test('importSkillsFromZipFile still cleans tempDir when target app is unsupporte }]); }); +test('importSkillsFromZip reuses a target-specific fallback zip name for base64 imports', async () => { + let uploadArgs = null; + let importedOptions = null; + const importSkillsFromZip = instantiateFunction(importSkillsFromZipSource, 'importSkillsFromZip', { + normalizeSkillTargetApp(app) { + const value = typeof app === 'string' ? app.trim().toLowerCase() : ''; + return value === 'codex' || value === 'claude' ? value : ''; + }, + writeUploadZip(fileBase64, prefix, fileName) { + uploadArgs = { fileBase64, prefix, fileName }; + return { zipPath: '/tmp/claude.zip', tempDir: '/tmp/claude-upload' }; + }, + importSkillsFromZipFile: async (_zipPath, options) => { + importedOptions = options; + return { imported: [] }; + } + }); + + const result = await importSkillsFromZip({ + fileBase64: 'QUJD', + target: 'claude' + }); + + assert.deepStrictEqual(uploadArgs, { + fileBase64: 'QUJD', + prefix: 'codex-skills-import', + fileName: 'claude-skills.zip' + }); + assert.deepStrictEqual(importedOptions, { + tempDir: '/tmp/claude-upload', + fallbackName: 'claude-skills.zip', + targetApp: 'claude' + }); + assert.deepStrictEqual(result, { imported: [] }); +}); + test('codex-only zip upload route pins target app before request fallback resolution', () => { assert.match( cliContent, From 820b029c2dff699462808eed699eb4c17304f331 Mon Sep 17 00:00:00 2001 From: SurviveM <254925152+SurviveM@users.noreply.github.com> Date: Tue, 31 Mar 2026 22:52:52 +0800 Subject: [PATCH 12/19] fix: honor configured skills targets --- cli.js | 37 +++++++++------- tests/unit/web-run-host.test.mjs | 76 ++++++++++++++++++++++++++------ 2 files changed, 82 insertions(+), 31 deletions(-) diff --git a/cli.js b/cli.js index e96e938..9798fa6 100644 --- a/cli.js +++ b/cli.js @@ -173,35 +173,35 @@ const HTTP_KEEP_ALIVE_AGENT = new http.Agent({ keepAlive: true }); const HTTPS_KEEP_ALIVE_AGENT = new https.Agent({ keepAlive: true }); function getCodexSkillsDir() { - const candidates = []; const envCodexHome = typeof process.env.CODEX_HOME === 'string' ? process.env.CODEX_HOME.trim() : ''; if (envCodexHome) { - candidates.push(path.join(envCodexHome, 'skills')); + const target = path.join(envCodexHome, 'skills'); + return resolveExistingDir([target], target); } const xdgConfig = typeof process.env.XDG_CONFIG_HOME === 'string' ? process.env.XDG_CONFIG_HOME.trim() : ''; if (xdgConfig) { - candidates.push(path.join(xdgConfig, 'codex', 'skills')); + const target = path.join(xdgConfig, 'codex', 'skills'); + return resolveExistingDir([target], target); } - candidates.push(path.join(os.homedir(), '.config', 'codex', 'skills')); - candidates.push(CODEX_SKILLS_DIR); - return resolveExistingDir(candidates, CODEX_SKILLS_DIR); + const homeConfigDir = path.join(os.homedir(), '.config', 'codex', 'skills'); + return resolveExistingDir([homeConfigDir], CODEX_SKILLS_DIR); } function getClaudeSkillsDir() { - const candidates = []; const envClaudeHome = typeof process.env.CLAUDE_HOME === 'string' && process.env.CLAUDE_HOME.trim() ? process.env.CLAUDE_HOME.trim() : (typeof process.env.CLAUDE_CONFIG_DIR === 'string' ? process.env.CLAUDE_CONFIG_DIR.trim() : ''); if (envClaudeHome) { - candidates.push(path.join(envClaudeHome, 'skills')); + const target = path.join(envClaudeHome, 'skills'); + return resolveExistingDir([target], target); } const xdgConfig = typeof process.env.XDG_CONFIG_HOME === 'string' ? process.env.XDG_CONFIG_HOME.trim() : ''; if (xdgConfig) { - candidates.push(path.join(xdgConfig, 'claude', 'skills')); + const target = path.join(xdgConfig, 'claude', 'skills'); + return resolveExistingDir([target], target); } - candidates.push(path.join(os.homedir(), '.config', 'claude', 'skills')); - candidates.push(CLAUDE_SKILLS_DIR); - return resolveExistingDir(candidates, CLAUDE_SKILLS_DIR); + const homeConfigDir = path.join(os.homedir(), '.config', 'claude', 'skills'); + return resolveExistingDir([homeConfigDir], CLAUDE_SKILLS_DIR); } function resolveWebPort() { @@ -2170,8 +2170,9 @@ async function importSkillsFromZip(payload = {}) { if (!payload || typeof payload.fileBase64 !== 'string' || !payload.fileBase64.trim()) { return { error: '缺少技能压缩包内容' }; } - const targetApp = normalizeSkillTargetApp(payload.targetApp || payload.target) || 'codex'; - const fallbackName = payload.fileName || `${targetApp}-skills.zip`; + const rawTargetApp = payload.targetApp || payload.target || 'codex'; + const fallbackTargetApp = normalizeSkillTargetApp(rawTargetApp) || 'codex'; + const fallbackName = payload.fileName || `${fallbackTargetApp}-skills.zip`; const upload = writeUploadZip(payload.fileBase64, 'codex-skills-import', fallbackName); if (upload.error) { return { error: upload.error }; @@ -2179,7 +2180,7 @@ async function importSkillsFromZip(payload = {}) { return importSkillsFromZipFile(upload.zipPath, { tempDir: upload.tempDir, fallbackName, - targetApp + targetApp: rawTargetApp }); } @@ -9829,8 +9830,10 @@ function resolveSkillTargetAppFromRequest(req, fallbackApp = 'codex') { const fallback = normalizeSkillTargetApp(fallbackApp) || 'codex'; try { const parsed = new URL(req.url || '/', 'http://localhost'); - if (parsed.searchParams.has('targetApp')) { - return normalizeSkillTargetApp(parsed.searchParams.get('targetApp')) || null; + if (parsed.searchParams.has('target') || parsed.searchParams.has('targetApp')) { + return normalizeSkillTargetApp( + parsed.searchParams.get('target') || parsed.searchParams.get('targetApp') + ) || null; } return fallback; } catch (_) { diff --git a/tests/unit/web-run-host.test.mjs b/tests/unit/web-run-host.test.mjs index 573c3af..624d84b 100644 --- a/tests/unit/web-run-host.test.mjs +++ b/tests/unit/web-run-host.test.mjs @@ -165,27 +165,43 @@ const getClaudeSkillsDirSource = extractFunctionBySignature( ); test('getCodexSkillsDir honors CODEX_HOME before legacy defaults', () => { + let received = null; const getCodexSkillsDir = instantiateFunction(getCodexSkillsDirSource, 'getCodexSkillsDir', { path, os: { homedir: () => '/home/demo' }, process: { env: { CODEX_HOME: '/tmp/custom-codex-home' } }, - resolveExistingDir: (candidates, fallback) => candidates[0] || fallback, + resolveExistingDir: (candidates, fallback) => { + received = { candidates, fallback }; + return fallback; + }, CODEX_SKILLS_DIR: '/home/demo/.codex/skills' }); assert.strictEqual(getCodexSkillsDir(), '/tmp/custom-codex-home/skills'); + assert.deepStrictEqual(received, { + candidates: ['/tmp/custom-codex-home/skills'], + fallback: '/tmp/custom-codex-home/skills' + }); }); test('getClaudeSkillsDir honors CLAUDE_CONFIG_DIR before legacy defaults', () => { + let received = null; const getClaudeSkillsDir = instantiateFunction(getClaudeSkillsDirSource, 'getClaudeSkillsDir', { path, os: { homedir: () => '/home/demo' }, process: { env: { CLAUDE_CONFIG_DIR: '/tmp/custom-claude-home' } }, - resolveExistingDir: (candidates, fallback) => candidates[0] || fallback, + resolveExistingDir: (candidates, fallback) => { + received = { candidates, fallback }; + return fallback; + }, CLAUDE_SKILLS_DIR: '/home/demo/.claude/skills' }); assert.strictEqual(getClaudeSkillsDir(), '/tmp/custom-claude-home/skills'); + assert.deepStrictEqual(received, { + candidates: ['/tmp/custom-claude-home/skills'], + fallback: '/tmp/custom-claude-home/skills' + }); }); test('getCodexSkillsDir resolves concrete skills directories instead of parent config dirs', () => { @@ -203,12 +219,8 @@ test('getCodexSkillsDir resolves concrete skills directories instead of parent c assert.strictEqual(getCodexSkillsDir(), '/resolved/codex-skills'); assert.deepStrictEqual(received, { - candidates: [ - '/tmp/xdg-home/codex/skills', - '/home/demo/.config/codex/skills', - '/home/demo/.codex/skills' - ], - fallback: '/home/demo/.codex/skills' + candidates: ['/tmp/xdg-home/codex/skills'], + fallback: '/tmp/xdg-home/codex/skills' }); }); @@ -227,12 +239,8 @@ test('getClaudeSkillsDir resolves concrete skills directories instead of parent assert.strictEqual(getClaudeSkillsDir(), '/resolved/claude-skills'); assert.deepStrictEqual(received, { - candidates: [ - '/tmp/xdg-home/claude/skills', - '/home/demo/.config/claude/skills', - '/home/demo/.claude/skills' - ], - fallback: '/home/demo/.claude/skills' + candidates: ['/tmp/xdg-home/claude/skills'], + fallback: '/tmp/xdg-home/claude/skills' }); }); @@ -327,6 +335,10 @@ test('resolveSkillTargetAppFromRequest rejects explicit unsupported query target resolveSkillTargetAppFromRequest({ url: '/api/import-skills-zip?targetApp=claud' }, 'codex'), null ); + assert.strictEqual( + resolveSkillTargetAppFromRequest({ url: '/api/import-skills-zip?target=claude' }, 'codex'), + 'claude' + ); assert.strictEqual( resolveSkillTargetAppFromRequest({ url: '/api/import-skills-zip' }, 'claude'), 'claude' @@ -658,6 +670,42 @@ test('importSkillsFromZip reuses a target-specific fallback zip name for base64 assert.deepStrictEqual(result, { imported: [] }); }); +test('importSkillsFromZip keeps the raw explicit target for downstream validation', async () => { + let uploadArgs = null; + let importedOptions = null; + const importSkillsFromZip = instantiateFunction(importSkillsFromZipSource, 'importSkillsFromZip', { + normalizeSkillTargetApp(app) { + const value = typeof app === 'string' ? app.trim().toLowerCase() : ''; + return value === 'codex' || value === 'claude' ? value : ''; + }, + writeUploadZip(fileBase64, prefix, fileName) { + uploadArgs = { fileBase64, prefix, fileName }; + return { zipPath: '/tmp/upload.zip', tempDir: '/tmp/upload-dir' }; + }, + importSkillsFromZipFile: async (_zipPath, options) => { + importedOptions = options; + return { error: '目标宿主不支持' }; + } + }); + + const result = await importSkillsFromZip({ + fileBase64: 'QUJD', + target: 'claud' + }); + + assert.deepStrictEqual(uploadArgs, { + fileBase64: 'QUJD', + prefix: 'codex-skills-import', + fileName: 'codex-skills.zip' + }); + assert.deepStrictEqual(importedOptions, { + tempDir: '/tmp/upload-dir', + fallbackName: 'codex-skills.zip', + targetApp: 'claud' + }); + assert.deepStrictEqual(result, { error: '目标宿主不支持' }); +}); + test('codex-only zip upload route pins target app before request fallback resolution', () => { assert.match( cliContent, From afe641bee29aea78643efca28acd3ecf4556e73c Mon Sep 17 00:00:00 2001 From: SurviveM <254925152+SurviveM@users.noreply.github.com> Date: Tue, 31 Mar 2026 23:17:00 +0800 Subject: [PATCH 13/19] fix: harden skills market delete flow --- tests/e2e/run.js | 4 +++ tests/unit/skills-market-runtime.test.mjs | 44 +++++++++++++++++++++++ tests/unit/skills-modal-ui.test.mjs | 5 +++ web-ui/app.js | 17 +++++++++ web-ui/index.html | 1 + web-ui/modules/skills.methods.mjs | 5 +++ 6 files changed, 76 insertions(+) diff --git a/tests/e2e/run.js b/tests/e2e/run.js index 3c1b702..da94065 100644 --- a/tests/e2e/run.js +++ b/tests/e2e/run.js @@ -40,6 +40,10 @@ async function main() { ...process.env, HOME: tmpHome, USERPROFILE: tmpHome, + CODEX_HOME: '', + CLAUDE_HOME: '', + CLAUDE_CONFIG_DIR: '', + XDG_CONFIG_HOME: '', CODEXMATE_FORCE_RESET_EXISTING_CONFIG: '1', CODEXMATE_NO_BROWSER: '1' }; diff --git a/tests/unit/skills-market-runtime.test.mjs b/tests/unit/skills-market-runtime.test.mjs index 23c20f9..592f944 100644 --- a/tests/unit/skills-market-runtime.test.mjs +++ b/tests/unit/skills-market-runtime.test.mjs @@ -309,3 +309,47 @@ test('skills import entrypoints return early while scan is in progress', async ( assert.strictEqual(uploadCalls, 0); assert.deepStrictEqual(vm.messageLog, []); }); + +test('deleteSelectedSkills reports busy state while import sources scan is running', async () => { + let confirmCalls = 0; + let apiCalls = 0; + const vm = buildVm(async () => { + apiCalls += 1; + return {}; + }, { + skillsScanningImports: true, + skillsSelectedNames: ['alpha'], + requestConfirmDialog: async () => { + confirmCalls += 1; + return true; + } + }); + + await vm.deleteSelectedSkills(); + + assert.strictEqual(confirmCalls, 0); + assert.strictEqual(apiCalls, 0); + assert.deepStrictEqual(vm.messageLog, [{ + message: '正在扫描导入源，请稍后再试', + type: 'error' + }]); +}); + +test('deleteSelectedSkills wires confirm dialog disabled state to live scan status', async () => { + let confirmOptions = null; + const vm = buildVm(async () => ({}), { + skillsSelectedNames: ['alpha'], + requestConfirmDialog: async (options) => { + confirmOptions = options; + return false; + } + }); + + await vm.deleteSelectedSkills(); + + assert(confirmOptions, 'confirm dialog should be opened'); + assert.strictEqual(typeof confirmOptions.confirmDisabled, 'function'); + assert.strictEqual(confirmOptions.confirmDisabled.call(vm), false); + vm.skillsScanningImports = true; + assert.strictEqual(confirmOptions.confirmDisabled.call(vm), true); +}); diff --git a/tests/unit/skills-modal-ui.test.mjs b/tests/unit/skills-modal-ui.test.mjs index 3abebf9..6ea04a4 100644 --- a/tests/unit/skills-modal-ui.test.mjs +++ b/tests/unit/skills-modal-ui.test.mjs @@ -32,7 +32,10 @@ test('skills modal script is modularized and exposes computed/methods from skill assert.match(appScript, /\.\.\.createSkillsComputed\(\)/); assert.match(appScript, /\.\.\.createSkillsMethods\(\{ api \}\)/); assert.match(appScript, /showConfirmDialog:\s*false/); + assert.match(appScript, /confirmDialogConfirmDisabled:\s*false/); + assert.match(appScript, /confirmDialogDisableWhen:\s*null/); assert.match(appScript, /requestConfirmDialog\(/); + assert.match(appScript, /isConfirmDialogDisabled\(\)/); assert.match(appScript, /resolveConfirmDialog\(/); assert.match(skillsComputed, /skillsConfiguredCount\(\)/); @@ -62,6 +65,7 @@ test('skills modal script is modularized and exposes computed/methods from skill test('skills modal styles define summary and panel layout hooks', () => { const styles = readProjectFile('web-ui/styles.css'); + const html = readProjectFile('web-ui/index.html'); assert.match(styles, /\.form-select/); assert.match(styles, /\.skills-summary-strip/); assert.match(styles, /\.skills-summary-item/); @@ -75,4 +79,5 @@ test('skills modal styles define summary and panel layout hooks', () => { assert.match(styles, /\.market-target-chip/); assert.doesNotMatch(styles, /\.market-online-toolbar/); assert.doesNotMatch(styles, /\.market-ecosystem-card/); + assert.match(html, /:disabled="isConfirmDialogDisabled\(\)"/); }); diff --git a/web-ui/app.js b/web-ui/app.js index b75867b..0fc930b 100644 --- a/web-ui/app.js +++ b/web-ui/app.js @@ -144,6 +144,8 @@ import { createSkillsMethods } from './modules/skills.methods.mjs'; confirmDialogConfirmText: '确认', confirmDialogCancelText: '取消', confirmDialogDanger: false, + confirmDialogConfirmDisabled: false, + confirmDialogDisableWhen: null, confirmDialogResolver: null, configTemplateContent: '', configTemplateApplying: false, @@ -3554,6 +3556,7 @@ import { createSkillsMethods } from './modules/skills.methods.mjs'; if (typeof this.confirmDialogResolver === 'function') { this.confirmDialogResolver(false); } + const confirmDisabled = options.confirmDisabled; this.confirmDialogTitle = typeof options.title === 'string' && options.title.trim() ? options.title.trim() : '请确认操作'; @@ -3565,11 +3568,23 @@ import { createSkillsMethods } from './modules/skills.methods.mjs'; ? options.cancelText.trim() : '取消'; this.confirmDialogDanger = !!options.danger; + this.confirmDialogConfirmDisabled = typeof confirmDisabled === 'function' ? false : !!confirmDisabled; + this.confirmDialogDisableWhen = typeof confirmDisabled === 'function' ? confirmDisabled : null; this.showConfirmDialog = true; return new Promise((resolve) => { this.confirmDialogResolver = resolve; }); }, + isConfirmDialogDisabled() { + if (typeof this.confirmDialogDisableWhen === 'function') { + try { + return !!this.confirmDialogDisableWhen.call(this); + } catch (_) { + return false; + } + } + return !!this.confirmDialogConfirmDisabled; + }, resolveConfirmDialog(confirmed) { const resolver = typeof this.confirmDialogResolver === 'function' ? this.confirmDialogResolver @@ -3580,6 +3595,8 @@ import { createSkillsMethods } from './modules/skills.methods.mjs'; this.confirmDialogConfirmText = '确认'; this.confirmDialogCancelText = '取消'; this.confirmDialogDanger = false; + this.confirmDialogConfirmDisabled = false; + this.confirmDialogDisableWhen = null; this.confirmDialogResolver = null; if (resolver) { resolver(!!confirmed); diff --git a/web-ui/index.html b/web-ui/index.html index e98b5ba..f3d6037 100644 --- a/web-ui/index.html +++ b/web-ui/index.html @@ -2326,6 +2326,7 @@

diff --git a/web-ui/modules/skills.methods.mjs b/web-ui/modules/skills.methods.mjs index da6a541..7c06d52 100644 --- a/web-ui/modules/skills.methods.mjs +++ b/web-ui/modules/skills.methods.mjs @@ -413,6 +413,10 @@ export function createSkillsMethods({ api }) { async deleteSelectedSkills() { if (this.skillsDeleting || this.skillsZipImporting || this.skillsExporting || this.skillsImporting) return; + if (this.skillsScanningImports) { + this.showMessage('正在扫描导入源，请稍后再试', 'error'); + return; + } const selected = Array.isArray(this.skillsSelectedNames) ? Array.from(new Set(this.skillsSelectedNames.map((item) => String(item || '').trim()).filter(Boolean))) : []; @@ -425,6 +429,7 @@ export function createSkillsMethods({ api }) { message: `确认从 ${this.skillsTargetLabel} 删除 ${selected.length} 个 skill 吗？此操作不可撤销。`, confirmText: '删除', cancelText: '取消', + confirmDisabled: () => this.skillsDeleting || this.skillsScanningImports, danger: true }); if (!confirmed) { From 71603f4c35d358b2e7558404335eeabf99296a59 Mon Sep 17 00:00:00 2001 From: SurviveM <254925152+SurviveM@users.noreply.github.com> Date: Tue, 31 Mar 2026 23:24:33 +0800 Subject: [PATCH 14/19] fix: align skills scan with import collisions --- cli.js | 5 +++ tests/unit/web-run-host.test.mjs | 62 ++++++++++++++++++++++++++++++++ 2 files changed, 67 insertions(+) diff --git a/cli.js b/cli.js index 9798fa6..f1d007f 100644 --- a/cli.js +++ b/cli.js @@ -1750,6 +1750,7 @@ function scanUnmanagedSkills(params = {}) { if (!target) { return { error: '目标宿主不支持' }; } + const targetRoot = resolveCopyTargetRoot(target.dir); const existing = listSkills({ targetApp: target.app }); if (existing.error) { return { error: existing.error }; @@ -1763,6 +1764,10 @@ function scanUnmanagedSkills(params = {}) { for (const source of sources) { const sourceEntries = listSkillEntriesByRoot(source.dir); for (const entry of sourceEntries) { + const targetCandidate = path.join(targetRoot, entry.name); + if (fs.existsSync(targetCandidate)) { + continue; + } if (existingNames.has(entry.name)) { continue; } diff --git a/tests/unit/web-run-host.test.mjs b/tests/unit/web-run-host.test.mjs index 624d84b..cc62a82 100644 --- a/tests/unit/web-run-host.test.mjs +++ b/tests/unit/web-run-host.test.mjs @@ -309,6 +309,11 @@ const importSkillsFromZipFileSource = extractFunctionBySignature( 'async function importSkillsFromZipFile(zipPath, options = {}) {', 'importSkillsFromZipFile' ); +const scanUnmanagedSkillsSource = extractFunctionBySignature( + cliContent, + 'function scanUnmanagedSkills(params = {}) {', + 'scanUnmanagedSkills' +); const importSkillsFromZipSource = extractFunctionBySignature( cliContent, 'async function importSkillsFromZip(payload = {}) {', @@ -330,6 +335,63 @@ test('resolveSkillTarget rejects explicit unsupported targets instead of falling assert.strictEqual(resolveSkillTarget({ target: 'unknown' }, 'codex'), null); }); +test('scanUnmanagedSkills skips entries when the resolved target path is already occupied', () => { + const scanUnmanagedSkills = instantiateFunction(scanUnmanagedSkillsSource, 'scanUnmanagedSkills', { + resolveSkillTarget() { + return { app: 'codex', label: 'Codex', dir: '/tmp/codex-skills' }; + }, + resolveCopyTargetRoot() { + return '/tmp/codex-skills'; + }, + listSkills() { + return { + targetApp: 'codex', + targetLabel: 'Codex', + root: '/tmp/codex-skills', + exists: true, + items: [] + }; + }, + SKILL_IMPORT_SOURCES: [ + { app: 'codex', label: 'Codex', dir: '/tmp/codex-skills' }, + { app: 'claude', label: 'Claude', dir: '/tmp/claude-skills' } + ], + listSkillEntriesByRoot() { + return [ + { name: 'alpha', path: '/tmp/claude-skills/alpha', sourceType: 'directory' }, + { name: 'beta', path: '/tmp/claude-skills/beta', sourceType: 'directory' } + ]; + }, + readCodexSkillMetadata(skillPath) { + return { + displayName: path.basename(skillPath), + description: '', + hasSkillFile: true + }; + }, + path, + fs: { + existsSync(targetPath) { + return targetPath === '/tmp/codex-skills/alpha'; + } + } + }); + + const result = scanUnmanagedSkills({ targetApp: 'codex' }); + + assert.deepStrictEqual(result.items, [{ + key: 'claude:beta', + name: 'beta', + displayName: 'beta', + description: '', + sourceApp: 'claude', + sourceLabel: 'Claude', + sourcePath: '/tmp/claude-skills/beta', + sourceType: 'directory', + hasSkillFile: true + }]); +}); + test('resolveSkillTargetAppFromRequest rejects explicit unsupported query target', () => { assert.strictEqual( resolveSkillTargetAppFromRequest({ url: '/api/import-skills-zip?targetApp=claud' }, 'codex'), From 4edb22d15795e567a142c3aab07c78cdf1c4f7db Mon Sep 17 00:00:00 2001 From: SurviveM <254925152+SurviveM@users.noreply.github.com> Date: Tue, 31 Mar 2026 23:29:12 +0800 Subject: [PATCH 15/19] fix: keep skills target precedence consistent --- cli.js | 4 ++-- tests/unit/web-run-host.test.mjs | 11 +++++++++++ 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/cli.js b/cli.js index f1d007f..6d68d3a 100644 --- a/cli.js +++ b/cli.js @@ -9835,9 +9835,9 @@ function resolveSkillTargetAppFromRequest(req, fallbackApp = 'codex') { const fallback = normalizeSkillTargetApp(fallbackApp) || 'codex'; try { const parsed = new URL(req.url || '/', 'http://localhost'); - if (parsed.searchParams.has('target') || parsed.searchParams.has('targetApp')) { + if (parsed.searchParams.has('targetApp') || parsed.searchParams.has('target')) { return normalizeSkillTargetApp( - parsed.searchParams.get('target') || parsed.searchParams.get('targetApp') + parsed.searchParams.get('targetApp') || parsed.searchParams.get('target') ) || null; } return fallback; diff --git a/tests/unit/web-run-host.test.mjs b/tests/unit/web-run-host.test.mjs index cc62a82..9f1b952 100644 --- a/tests/unit/web-run-host.test.mjs +++ b/tests/unit/web-run-host.test.mjs @@ -407,6 +407,17 @@ test('resolveSkillTargetAppFromRequest rejects explicit unsupported query target ); }); +test('resolveSkillTargetAppFromRequest keeps targetApp precedence over target', () => { + assert.strictEqual( + resolveSkillTargetAppFromRequest({ url: '/api/import-skills-zip?target=claude&targetApp=codex' }, 'claude'), + 'codex' + ); + assert.strictEqual( + resolveSkillTargetAppFromRequest({ url: '/api/import-skills-zip?target=claude&targetApp=claud' }, 'codex'), + null + ); +}); + test('resolveCopyTargetRoot resolves through the nearest existing parent path', () => { const resolveCopyTargetRoot = instantiateFunction(resolveCopyTargetRootSource, 'resolveCopyTargetRoot', { path, From d789f631f2e0f7409aee9406f4d9e330f1edda70 Mon Sep 17 00:00:00 2001 From: SurviveM <254925152+SurviveM@users.noreply.github.com> Date: Tue, 31 Mar 2026 23:33:15 +0800 Subject: [PATCH 16/19] test: cover skill target precedence for zip imports --- tests/unit/web-run-host.test.mjs | 51 +++++++++++++++++++++++++++++++- 1 file changed, 50 insertions(+), 1 deletion(-) diff --git a/tests/unit/web-run-host.test.mjs b/tests/unit/web-run-host.test.mjs index 9f1b952..89c49b6 100644 --- a/tests/unit/web-run-host.test.mjs +++ b/tests/unit/web-run-host.test.mjs @@ -1,4 +1,4 @@ -import assert from 'assert'; +import assert from 'assert'; import path from 'path'; import { fileURLToPath } from 'url'; import { createRequire } from 'module'; @@ -332,9 +332,21 @@ test('resolveSkillTarget still falls back to default target when target is omitt test('resolveSkillTarget rejects explicit unsupported targets instead of falling back', () => { assert.strictEqual(resolveSkillTarget({ targetApp: 'claud' }), null); + assert.strictEqual(resolveSkillTarget({ targetApp: 'claud', target: 'claude' }), null); assert.strictEqual(resolveSkillTarget({ target: 'unknown' }, 'codex'), null); }); +test('resolveSkillTarget keeps targetApp precedence over target', () => { + assert.deepStrictEqual( + resolveSkillTarget({ targetApp: 'claude', target: 'codex' }, 'codex'), + SKILL_TARGETS[1] + ); + assert.deepStrictEqual( + resolveSkillTarget({ targetApp: 'codex', target: 'claude' }, 'claude'), + SKILL_TARGETS[0] + ); +}); + test('scanUnmanagedSkills skips entries when the resolved target path is already occupied', () => { const scanUnmanagedSkills = instantiateFunction(scanUnmanagedSkillsSource, 'scanUnmanagedSkills', { resolveSkillTarget() { @@ -779,6 +791,43 @@ test('importSkillsFromZip keeps the raw explicit target for downstream validatio assert.deepStrictEqual(result, { error: '目标宿主不支持' }); }); +test('importSkillsFromZip keeps targetApp precedence over target', async () => { + let uploadArgs = null; + let importedOptions = null; + const importSkillsFromZip = instantiateFunction(importSkillsFromZipSource, 'importSkillsFromZip', { + normalizeSkillTargetApp(app) { + const value = typeof app === 'string' ? app.trim().toLowerCase() : ''; + return value === 'codex' || value === 'claude' ? value : ''; + }, + writeUploadZip(fileBase64, prefix, fileName) { + uploadArgs = { fileBase64, prefix, fileName }; + return { zipPath: '/tmp/claude.zip', tempDir: '/tmp/claude-upload' }; + }, + importSkillsFromZipFile: async (_zipPath, options) => { + importedOptions = options; + return { imported: [] }; + } + }); + + const result = await importSkillsFromZip({ + fileBase64: 'QUJD', + targetApp: 'claude', + target: 'codex' + }); + + assert.deepStrictEqual(uploadArgs, { + fileBase64: 'QUJD', + prefix: 'codex-skills-import', + fileName: 'claude-skills.zip' + }); + assert.deepStrictEqual(importedOptions, { + tempDir: '/tmp/claude-upload', + fallbackName: 'claude-skills.zip', + targetApp: 'claude' + }); + assert.deepStrictEqual(result, { imported: [] }); +}); + test('codex-only zip upload route pins target app before request fallback resolution', () => { assert.match( cliContent, From 0e22e4f80fa23100cabdddca508cf55ee25526f9 Mon Sep 17 00:00:00 2001 From: SurviveM <254925152+SurviveM@users.noreply.github.com> Date: Tue, 31 Mar 2026 23:33:49 +0800 Subject: [PATCH 17/19] fix: clarify skills target precedence --- cli.js | 17 +++++++++-------- site/guide/getting-started.md | 1 + 2 files changed, 10 insertions(+), 8 deletions(-) diff --git a/cli.js b/cli.js index 6d68d3a..9739fd3 100644 --- a/cli.js +++ b/cli.js @@ -1439,14 +1439,15 @@ function getSkillTargetByApp(app) { } function resolveSkillTarget(params = {}, defaultApp = 'codex') { - const hasExplicitTarget = !!(params && typeof params === 'object' && ( - Object.prototype.hasOwnProperty.call(params, 'targetApp') - || Object.prototype.hasOwnProperty.call(params, 'target') - )); - const raw = params && typeof params === 'object' - ? (params.targetApp || params.target || '') - : ''; - if (hasExplicitTarget && raw && !getSkillTargetByApp(raw)) { + const hasExplicitTargetApp = !!(params && typeof params === 'object' + && Object.prototype.hasOwnProperty.call(params, 'targetApp')); + const hasExplicitTarget = !!(params && typeof params === 'object' + && Object.prototype.hasOwnProperty.call(params, 'target')); + const hasAnyExplicitTarget = hasExplicitTargetApp || hasExplicitTarget; + const rawTargetApp = hasExplicitTargetApp ? params.targetApp : ''; + const rawTarget = hasExplicitTarget ? params.target : ''; + const raw = rawTargetApp || rawTarget || ''; + if (hasAnyExplicitTarget && raw && !getSkillTargetByApp(raw)) { return null; } return getSkillTargetByApp(raw) diff --git a/site/guide/getting-started.md b/site/guide/getting-started.md index bca5594..f220d18 100644 --- a/site/guide/getting-started.md +++ b/site/guide/getting-started.md @@ -29,6 +29,7 @@ codexmate run 默认监听 `0.0.0.0:3737`，支持局域网访问，并尝试自动打开浏览器。 如需仅本机访问，可设置 `CODEXMATE_HOST=127.0.0.1`，或启动时传入 `--host 127.0.0.1`。 +> 安全提示：默认监听会在当前局域网暴露未鉴权管理界面。请仅在可信网络使用；如涉及 API Key、配置或 skills 管理，建议改用 `127.0.0.1`。 仅启动服务（测试 / CI）： From 327160fa7f0511e4d61fc2186f886cbb1036eff5 Mon Sep 17 00:00:00 2001 From: SurviveM <254925152+SurviveM@users.noreply.github.com> Date: Tue, 31 Mar 2026 23:47:11 +0800 Subject: [PATCH 18/19] fix: unify skills zip target resolution --- cli.js | 32 ++++++++++------- tests/unit/web-run-host.test.mjs | 59 +++++++++++++++++++++++--------- 2 files changed, 63 insertions(+), 28 deletions(-) diff --git a/cli.js b/cli.js index 9739fd3..53cb304 100644 --- a/cli.js +++ b/cli.js @@ -2176,18 +2176,21 @@ async function importSkillsFromZip(payload = {}) { if (!payload || typeof payload.fileBase64 !== 'string' || !payload.fileBase64.trim()) { return { error: '缺少技能压缩包内容' }; } - const rawTargetApp = payload.targetApp || payload.target || 'codex'; - const fallbackTargetApp = normalizeSkillTargetApp(rawTargetApp) || 'codex'; + const fallbackTarget = resolveSkillTarget(payload, 'codex'); + const fallbackTargetApp = fallbackTarget ? fallbackTarget.app : 'codex'; const fallbackName = payload.fileName || `${fallbackTargetApp}-skills.zip`; const upload = writeUploadZip(payload.fileBase64, 'codex-skills-import', fallbackName); if (upload.error) { return { error: upload.error }; } - return importSkillsFromZipFile(upload.zipPath, { - tempDir: upload.tempDir, - fallbackName, - targetApp: rawTargetApp - }); + const importOptions = { tempDir: upload.tempDir, fallbackName }; + if (Object.prototype.hasOwnProperty.call(payload, 'targetApp')) { + importOptions.targetApp = payload.targetApp; + } + if (Object.prototype.hasOwnProperty.call(payload, 'target')) { + importOptions.target = payload.target; + } + return importSkillsFromZipFile(upload.zipPath, importOptions); } async function importCodexSkillsFromZip(payload = {}) { @@ -9833,13 +9836,18 @@ function resolveUploadFileNameFromRequest(req, fallbackName = 'codex-skills.zip' } function resolveSkillTargetAppFromRequest(req, fallbackApp = 'codex') { - const fallback = normalizeSkillTargetApp(fallbackApp) || 'codex'; + const fallbackTarget = resolveSkillTarget({}, fallbackApp); + const fallback = fallbackTarget ? fallbackTarget.app : 'codex'; try { const parsed = new URL(req.url || '/', 'http://localhost'); - if (parsed.searchParams.has('targetApp') || parsed.searchParams.has('target')) { - return normalizeSkillTargetApp( - parsed.searchParams.get('targetApp') || parsed.searchParams.get('target') - ) || null; + const hasTargetApp = parsed.searchParams.has('targetApp'); + const hasTarget = parsed.searchParams.has('target'); + if (hasTargetApp || hasTarget) { + const target = resolveSkillTarget({ + ...(hasTargetApp ? { targetApp: parsed.searchParams.get('targetApp') } : {}), + ...(hasTarget ? { target: parsed.searchParams.get('target') } : {}) + }, fallback); + return target ? target.app : null; } return fallback; } catch (_) { diff --git a/tests/unit/web-run-host.test.mjs b/tests/unit/web-run-host.test.mjs index 89c49b6..67bda95 100644 --- a/tests/unit/web-run-host.test.mjs +++ b/tests/unit/web-run-host.test.mjs @@ -291,7 +291,7 @@ const resolveSkillTargetAppFromRequest = instantiateFunction( 'resolveSkillTargetAppFromRequest', { URL, - normalizeSkillTargetApp + resolveSkillTarget } ); const resolveCopyTargetRootSource = extractFunctionBySignature( @@ -723,10 +723,7 @@ test('importSkillsFromZip reuses a target-specific fallback zip name for base64 let uploadArgs = null; let importedOptions = null; const importSkillsFromZip = instantiateFunction(importSkillsFromZipSource, 'importSkillsFromZip', { - normalizeSkillTargetApp(app) { - const value = typeof app === 'string' ? app.trim().toLowerCase() : ''; - return value === 'codex' || value === 'claude' ? value : ''; - }, + resolveSkillTarget, writeUploadZip(fileBase64, prefix, fileName) { uploadArgs = { fileBase64, prefix, fileName }; return { zipPath: '/tmp/claude.zip', tempDir: '/tmp/claude-upload' }; @@ -750,7 +747,7 @@ test('importSkillsFromZip reuses a target-specific fallback zip name for base64 assert.deepStrictEqual(importedOptions, { tempDir: '/tmp/claude-upload', fallbackName: 'claude-skills.zip', - targetApp: 'claude' + target: 'claude' }); assert.deepStrictEqual(result, { imported: [] }); }); @@ -759,10 +756,7 @@ test('importSkillsFromZip keeps the raw explicit target for downstream validatio let uploadArgs = null; let importedOptions = null; const importSkillsFromZip = instantiateFunction(importSkillsFromZipSource, 'importSkillsFromZip', { - normalizeSkillTargetApp(app) { - const value = typeof app === 'string' ? app.trim().toLowerCase() : ''; - return value === 'codex' || value === 'claude' ? value : ''; - }, + resolveSkillTarget, writeUploadZip(fileBase64, prefix, fileName) { uploadArgs = { fileBase64, prefix, fileName }; return { zipPath: '/tmp/upload.zip', tempDir: '/tmp/upload-dir' }; @@ -786,7 +780,7 @@ test('importSkillsFromZip keeps the raw explicit target for downstream validatio assert.deepStrictEqual(importedOptions, { tempDir: '/tmp/upload-dir', fallbackName: 'codex-skills.zip', - targetApp: 'claud' + target: 'claud' }); assert.deepStrictEqual(result, { error: '目标宿主不支持' }); }); @@ -795,10 +789,7 @@ test('importSkillsFromZip keeps targetApp precedence over target', async () => { let uploadArgs = null; let importedOptions = null; const importSkillsFromZip = instantiateFunction(importSkillsFromZipSource, 'importSkillsFromZip', { - normalizeSkillTargetApp(app) { - const value = typeof app === 'string' ? app.trim().toLowerCase() : ''; - return value === 'codex' || value === 'claude' ? value : ''; - }, + resolveSkillTarget, writeUploadZip(fileBase64, prefix, fileName) { uploadArgs = { fileBase64, prefix, fileName }; return { zipPath: '/tmp/claude.zip', tempDir: '/tmp/claude-upload' }; @@ -823,11 +814,47 @@ test('importSkillsFromZip keeps targetApp precedence over target', async () => { assert.deepStrictEqual(importedOptions, { tempDir: '/tmp/claude-upload', fallbackName: 'claude-skills.zip', - targetApp: 'claude' + targetApp: 'claude', + target: 'codex' }); assert.deepStrictEqual(result, { imported: [] }); }); +test('importSkillsFromZip preserves conflicting explicit target keys for downstream rejection', async () => { + let uploadArgs = null; + let importedOptions = null; + const importSkillsFromZip = instantiateFunction(importSkillsFromZipSource, 'importSkillsFromZip', { + resolveSkillTarget, + writeUploadZip(fileBase64, prefix, fileName) { + uploadArgs = { fileBase64, prefix, fileName }; + return { zipPath: '/tmp/upload.zip', tempDir: '/tmp/upload-dir' }; + }, + importSkillsFromZipFile: async (_zipPath, options) => { + importedOptions = options; + return { error: '目标宿主不支持' }; + } + }); + + const result = await importSkillsFromZip({ + fileBase64: 'QUJD', + targetApp: 'claud', + target: 'claude' + }); + + assert.deepStrictEqual(uploadArgs, { + fileBase64: 'QUJD', + prefix: 'codex-skills-import', + fileName: 'codex-skills.zip' + }); + assert.deepStrictEqual(importedOptions, { + tempDir: '/tmp/upload-dir', + fallbackName: 'codex-skills.zip', + targetApp: 'claud', + target: 'claude' + }); + assert.deepStrictEqual(result, { error: '目标宿主不支持' }); +}); + test('codex-only zip upload route pins target app before request fallback resolution', () => { assert.match( cliContent, From 4792d7f1797e6e9920f96bee1d1244ce1934d1ae Mon Sep 17 00:00:00 2001 From: SurviveM <254925152+SurviveM@users.noreply.github.com> Date: Wed, 1 Apr 2026 08:17:03 +0800 Subject: [PATCH 19/19] fix: harden skills market guardrails --- README.en.md | 2 +- README.md | 2 +- cli.js | 11 ++- tests/unit/config-tabs-ui.test.mjs | 11 ++- .../session-tab-switch-performance.test.mjs | 20 ++++ tests/unit/skills-market-runtime.test.mjs | 20 ++++ tests/unit/skills-modal-ui.test.mjs | 2 + tests/unit/web-run-host.test.mjs | 96 +++++++++++++++++++ web-ui/app.js | 2 +- web-ui/index.html | 22 ++--- web-ui/modules/skills.methods.mjs | 11 +++ web-ui/session-helpers.mjs | 8 +- web-ui/styles.css | 8 ++ 13 files changed, 197 insertions(+), 18 deletions(-) diff --git a/README.en.md b/README.en.md index bde4fb0..369f425 100644 --- a/README.en.md +++ b/README.en.md @@ -201,7 +201,7 @@ codexmate codex --model gpt-5.3-codex --follow-up "step1" --follow-up "step2" ### Skills Market Tab - Switch the skills install target between `Codex` and `Claude Code` - Show the current local skills root, installed items, and importable items -- Scan unmanaged skills under `Codex` / `Claude Code` / `Agents` +- Scan importable sources under `Codex` / `Claude Code` / `Agents` - Support cross-app import, ZIP import/export, and batch delete ## MCP diff --git a/README.md b/README.md index 3dbf5b4..4e7af9b 100644 --- a/README.md +++ b/README.md @@ -201,7 +201,7 @@ codexmate codex --model gpt-5.3-codex --follow-up "步骤1" --follow-up "步骤2 ### Skills 市场标签页 - 在 `Codex` 与 `Claude Code` 之间切换 skills 安装目标 - 展示当前目标的本地 skills 根目录、已安装项和可导入项 -- 扫描 `Codex` / `Claude Code` / `Agents` 目录下未托管的 skills +- 扫描 `Codex` / `Claude Code` / `Agents` 目录中的可导入来源 - 支持跨应用导入、ZIP 导入 / 导出、批量删除 ## MCP diff --git a/cli.js b/cli.js index 53cb304..f8328b5 100644 --- a/cli.js +++ b/cli.js @@ -1447,7 +1447,10 @@ function resolveSkillTarget(params = {}, defaultApp = 'codex') { const rawTargetApp = hasExplicitTargetApp ? params.targetApp : ''; const rawTarget = hasExplicitTarget ? params.target : ''; const raw = rawTargetApp || rawTarget || ''; - if (hasAnyExplicitTarget && raw && !getSkillTargetByApp(raw)) { + if (hasAnyExplicitTarget && raw === '') { + return null; + } + if (hasAnyExplicitTarget && !getSkillTargetByApp(raw)) { return null; } return getSkillTargetByApp(raw) @@ -9857,6 +9860,9 @@ function resolveSkillTargetAppFromRequest(req, fallbackApp = 'codex') { async function handleImportSkillsZipUpload(req, res, options = {}) { if (req.method !== 'POST') { + if (req && typeof req.resume === 'function') { + req.resume(); + } writeJsonResponse(res, 405, { error: 'Method Not Allowed' }); return; } @@ -9864,6 +9870,9 @@ async function handleImportSkillsZipUpload(req, res, options = {}) { const forcedTargetApp = normalizeSkillTargetApp(options && options.targetApp ? options.targetApp : ''); const targetApp = forcedTargetApp || resolveSkillTargetAppFromRequest(req, 'codex'); if (!targetApp) { + if (req && typeof req.resume === 'function') { + req.resume(); + } writeJsonResponse(res, 400, { error: '目标宿主不支持' }); return; } diff --git a/tests/unit/config-tabs-ui.test.mjs b/tests/unit/config-tabs-ui.test.mjs index 93bfb99..2904d68 100644 --- a/tests/unit/config-tabs-ui.test.mjs +++ b/tests/unit/config-tabs-ui.test.mjs @@ -55,8 +55,12 @@ test('config template keeps expected config tabs in top and side navigation', () )]; assert.strictEqual(targetSwitchButtons.length, 4); for (const [buttonMarkup] of targetSwitchButtons) { - assert.match(buttonMarkup, /:disabled="skillsMarketBusy"/); + assert.match(buttonMarkup, /:disabled="loading \|\| !!initError \|\| skillsMarketBusy"/); } + assert.match(html, /@click="loadSkillsMarketOverview\(\{ forceRefresh: true, silent: false \}\)" :disabled="loading \|\| !!initError \|\| skillsMarketBusy"/); + assert.match(html, /

- -
@@ -1309,7 +1309,7 @@

type="button" :class="['market-target-chip', { active: skillsTargetApp === 'codex' }]" :aria-pressed="skillsTargetApp === 'codex'" - :disabled="skillsMarketBusy" + :disabled="loading || !!initError || skillsMarketBusy" @click="setSkillsTargetApp('codex', { silent: false })"> Codex @@ -1317,7 +1317,7 @@

type="button" :class="['market-target-chip', { active: skillsTargetApp === 'claude' }]" :aria-pressed="skillsTargetApp === 'claude'" - :disabled="skillsMarketBusy" + :disabled="loading || !!initError || skillsMarketBusy" @click="setSkillsTargetApp('claude', { silent: false })"> Claude Code @@ -1360,7 +1360,7 @@

已安装 Skills
展示当前已落地到 {{ skillsRootPath || skillsDefaultRootPath }} 的前 6 个目录，可继续进入管理弹窗做筛选、导出和删除。

-
@@ -1385,7 +1385,7 @@

可导入来源
扫描其他应用下未托管的 skill，先确认来源和目录，再批量导入到当前 {{ skillsTargetLabel }} skills 目录。

-

@@ -1412,15 +1412,15 @@

- - - @@ -2140,7 +2140,7 @@

type="button" :class="['market-target-chip', { active: skillsTargetApp === 'codex' }]" :aria-pressed="skillsTargetApp === 'codex'" - :disabled="skillsMarketBusy" + :disabled="loading || !!initError || skillsMarketBusy" @click="setSkillsTargetApp('codex', { silent: false })"> Codex @@ -2148,7 +2148,7 @@

type="button" :class="['market-target-chip', { active: skillsTargetApp === 'claude' }]" :aria-pressed="skillsTargetApp === 'claude'" - :disabled="skillsMarketBusy" + :disabled="loading || !!initError || skillsMarketBusy" @click="setSkillsTargetApp('claude', { silent: false })"> Claude Code diff --git a/web-ui/modules/skills.methods.mjs b/web-ui/modules/skills.methods.mjs index 7c06d52..f78b404 100644 --- a/web-ui/modules/skills.methods.mjs +++ b/web-ui/modules/skills.methods.mjs @@ -65,6 +65,17 @@ export function createSkillsMethods({ api }) { }, async openSkillsManager(options = {}) { + if ( + this.skillsLoading + || this.skillsDeleting + || this.skillsScanningImports + || this.skillsImporting + || this.skillsZipImporting + || this.skillsExporting + || this.skillsMarketLoading + ) { + return false; + } let targetApp; try { targetApp = this.normalizeSkillsTargetApp(options && options.targetApp ? options.targetApp : this.skillsTargetApp); diff --git a/web-ui/session-helpers.mjs b/web-ui/session-helpers.mjs index 7529af5..bbc2149 100644 --- a/web-ui/session-helpers.mjs +++ b/web-ui/session-helpers.mjs @@ -65,7 +65,13 @@ export function switchMainTab(tab) { && previousTab !== 'market' && typeof this.loadSkillsMarketOverview === 'function'; if (shouldLoadSkillsMarketOnEnter) { - void Promise.resolve(this.loadSkillsMarketOverview({ silent: true })).catch(() => {}); + let marketOverviewLoad = null; + try { + marketOverviewLoad = this.loadSkillsMarketOverview({ silent: true }); + } catch (_) { + marketOverviewLoad = null; + } + void Promise.resolve(marketOverviewLoad).catch(() => {}); } if (nextTab === 'config' && this.configMode === 'claude') { const expectedTab = nextTab; diff --git a/web-ui/styles.css b/web-ui/styles.css index 8b3b8f9..cfacdde 100644 --- a/web-ui/styles.css +++ b/web-ui/styles.css @@ -3708,6 +3708,14 @@ body::after { transition: border-color var(--transition-fast) var(--ease-smooth), background var(--transition-fast) var(--ease-smooth), color var(--transition-fast) var(--ease-smooth), box-shadow var(--transition-fast) var(--ease-smooth); } +.market-target-chip:disabled, +.market-target-chip[disabled] { + cursor: not-allowed; + opacity: 0.64; + pointer-events: none; + box-shadow: none; +} + .market-target-chip.active { border-color: rgba(208, 88, 58, 0.4); background: linear-gradient(to bottom, rgba(255, 243, 236, 0.98) 0%, rgba(255, 232, 220, 0.86) 100%);