feat(skills): install skills from a direct HTTP(S) URL (#16323)
* feat(skills): install skills from a direct HTTP(S) URL Adds UrlSource adapter so `hermes skills install <url-to-SKILL.md>` and `/skills install <url>` work as first-class operations — no more improvising with curl + patch + cp. - Claims identifiers that start with http(s):// and end in .md - Skips /.well-known/skills/ URLs (WellKnownSkillSource handles those) - Skill name from YAML frontmatter, URL-slug fallback - Single-file SKILL.md only (v1 scope — multi-file skills need a manifest) - Trust level 'community'; full security scan still runs - Lock file stores the URL as identifier so `hermes skills update` re-fetches from the same URL cleanly Scope matches real user need from @versun's docx feedback where `https://sharethis.chat/SKILL.md` had no first-class install path. * feat(skills): interactive name/category for URL installs + --name override Follow-up to the UrlSource adapter. The previous commit fell back to weak heuristics when frontmatter had no ``name:`` and could produce garbage names like ``SKILL`` or ``unnamed-skill``. Now: tools/skills_hub.py - ``UrlSource._is_valid_skill_name()`` — strict identifier check (``^[a-z][a-z0-9_-]*$``), rejects sentinel values (``SKILL``, ``README``, ``INDEX``, ``unnamed-skill``, empty, non-strings). - ``_resolve_skill_name()`` returns ``Optional[str]`` — ``None`` when nothing valid is resolvable. Also ignores unsafe frontmatter names (``../evil``) and falls through to URL slug instead of returning None immediately, so a URL with a bad frontmatter but a good path still works. - ``fetch()``/``inspect()`` carry an ``awaiting_name=True`` marker in metadata/extra when resolution fails, letting ``do_install`` decide whether to prompt, apply an override, or error out. hermes_cli/skills_hub.py - ``do_install`` gains a ``name_override`` parameter. - On URL-sourced bundles with ``awaiting_name=True``: 1. If ``name_override`` is valid → use it. 2. If ``name_override`` is invalid → refuse with a clear error. 3. Else if ``skip_confirm=True`` (non-interactive: slash / TUI / gateway / scripts) → refuse with an actionable retry hint pointing at ``--name <your-name>`` on both CLI and slash forms. 4. Else (interactive TTY) → prompt for the name. - Interactive TTY also prompts for a category when none is given for a URL-sourced install, hinting existing category buckets so users can reuse ``productivity``, ``devops``, etc. Empty input → flat install. - ``_existing_categories()`` scans ``~/.hermes/skills/`` for subdirs that look like category buckets (contain nested SKILL.md files); skips top-level skills and hidden dirs. - ``_prompt_for_skill_name()`` / ``_prompt_for_category()`` helpers (EOF/Ctrl-C-safe, match the existing ``Confirm [y/N]`` prompt style). hermes_cli/main.py - ``hermes skills install`` argparse gains ``--name <name>``. hermes_cli/skills_hub.py (slash) - ``/skills install <url> --name <x>`` parsing added. Tests - tests/tools/test_skills_hub.py: updated ``UrlSource`` tests to assert the new ``awaiting_name`` metadata; added 4 new tests for ``_is_valid_skill_name`` rejection sets and the awaiting-name marker. - tests/hermes_cli/test_skills_hub.py: 8 new tests covering --name override accept/reject, non-interactive error, interactive name prompt, interactive category prompt, cancel-aborts-install, and ``_existing_categories`` scan behavior (buckets vs flat skills). - E2E verified all four paths (no-name/no-override → error; --name override → install; frontmatter name → install; invalid --name → rejection). --------- Co-authored-by: teknium1 <teknium@noreply.github.com>
This commit is contained in:
Teknium
@@ -316,3 +316,211 @@ def test_do_install_scans_with_resolved_identifier(monkeypatch, tmp_path, hub_en
|
||||
do_install("skils-sh/anthropics/skills/frontend-design", console=console, skip_confirm=True)
|
||||
|
||||
assert scanned["source"] == canonical_identifier
|
||||
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# UrlSource-specific install paths: --name override, interactive prompts,
|
||||
# non-interactive error, existing-category scan.
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
|
||||
def _make_url_bundle_fetcher(name="", awaiting_name=True, url="https://example.com/SKILL.md"):
|
||||
"""Return a fake source that simulates ``UrlSource.fetch`` for a
|
||||
URL-sourced skill whose name hasn't been auto-resolved."""
|
||||
|
||||
class _UrlSource:
|
||||
def inspect(self, identifier):
|
||||
return type("Meta", (), {
|
||||
"extra": {"url": url, "awaiting_name": awaiting_name},
|
||||
"identifier": url,
|
||||
"name": name,
|
||||
"path": name,
|
||||
})()
|
||||
|
||||
def fetch(self, identifier):
|
||||
return type("Bundle", (), {
|
||||
"name": name,
|
||||
"files": {"SKILL.md": "---\ndescription: ok\n---\n# body\n"},
|
||||
"source": "url",
|
||||
"identifier": url,
|
||||
"trust_level": "community",
|
||||
"metadata": {"url": url, "awaiting_name": awaiting_name},
|
||||
})()
|
||||
|
||||
return _UrlSource
|
||||
|
||||
|
||||
def _install_mocks(monkeypatch, tmp_path, source_factory, category_hint=""):
|
||||
"""Wire the minimum set of monkeypatches for a do_install dry run."""
|
||||
import tools.skills_hub as hub
|
||||
import tools.skills_guard as guard
|
||||
|
||||
q_path = tmp_path / "skills" / ".hub" / "quarantine" / "pending"
|
||||
q_path.mkdir(parents=True)
|
||||
|
||||
install_calls: list = []
|
||||
|
||||
def _install_from_quarantine(q, name, category, bundle, result):
|
||||
install_calls.append({"name": name, "category": category})
|
||||
install_dir = tmp_path / "skills" / (f"{category}/" if category else "") / name
|
||||
install_dir.mkdir(parents=True, exist_ok=True)
|
||||
return install_dir
|
||||
|
||||
monkeypatch.setattr(hub, "ensure_hub_dirs", lambda: None)
|
||||
monkeypatch.setattr(hub, "create_source_router", lambda auth: [source_factory()])
|
||||
monkeypatch.setattr(hub, "quarantine_bundle", lambda bundle: q_path)
|
||||
monkeypatch.setattr(hub, "install_from_quarantine", _install_from_quarantine)
|
||||
monkeypatch.setattr(
|
||||
hub, "HubLockFile",
|
||||
lambda: type("Lock", (), {"get_installed": lambda self, n: None})(),
|
||||
)
|
||||
monkeypatch.setattr(
|
||||
guard, "scan_skill",
|
||||
lambda skill_path, source="community": guard.ScanResult(
|
||||
skill_name="pending", source=source, trust_level="community", verdict="safe",
|
||||
),
|
||||
)
|
||||
monkeypatch.setattr(guard, "format_scan_report", lambda result: "scan ok")
|
||||
monkeypatch.setattr(guard, "should_allow_install", lambda result, force=False: (True, "ok"))
|
||||
return install_calls
|
||||
|
||||
|
||||
def test_url_install_uses_name_override_on_non_interactive_surface(monkeypatch, tmp_path, hub_env):
|
||||
installs = _install_mocks(monkeypatch, tmp_path, _make_url_bundle_fetcher())
|
||||
|
||||
sink = StringIO()
|
||||
console = Console(file=sink, force_terminal=False, color_system=None)
|
||||
do_install(
|
||||
"https://example.com/SKILL.md",
|
||||
console=console, skip_confirm=True,
|
||||
name_override="my-url-skill",
|
||||
)
|
||||
|
||||
assert installs == [{"name": "my-url-skill", "category": ""}]
|
||||
|
||||
|
||||
def test_url_install_rejects_invalid_name_override(monkeypatch, tmp_path, hub_env):
|
||||
installs = _install_mocks(monkeypatch, tmp_path, _make_url_bundle_fetcher())
|
||||
|
||||
sink = StringIO()
|
||||
console = Console(file=sink, force_terminal=False, color_system=None)
|
||||
do_install(
|
||||
"https://example.com/SKILL.md",
|
||||
console=console, skip_confirm=True,
|
||||
name_override="SKILL", # rejected by _is_valid_installed_skill_name
|
||||
)
|
||||
|
||||
assert installs == [] # did NOT install
|
||||
assert "Invalid --name" in sink.getvalue()
|
||||
|
||||
|
||||
def test_url_install_actionable_error_on_non_interactive_with_no_name(monkeypatch, tmp_path, hub_env):
|
||||
installs = _install_mocks(monkeypatch, tmp_path, _make_url_bundle_fetcher())
|
||||
|
||||
sink = StringIO()
|
||||
console = Console(file=sink, force_terminal=False, color_system=None)
|
||||
do_install(
|
||||
"https://example.com/SKILL.md",
|
||||
console=console, skip_confirm=True,
|
||||
# No name_override — should error out with a retry hint.
|
||||
)
|
||||
|
||||
assert installs == []
|
||||
out = sink.getvalue()
|
||||
assert "Cannot install from URL" in out
|
||||
assert "--name <your-name>" in out
|
||||
|
||||
|
||||
def test_url_install_prompts_interactively_when_tty(monkeypatch, tmp_path, hub_env):
|
||||
installs = _install_mocks(monkeypatch, tmp_path, _make_url_bundle_fetcher())
|
||||
|
||||
# Simulate user typing "my-interactive" to name prompt, then "" to category.
|
||||
answers = iter(["my-interactive", ""])
|
||||
monkeypatch.setattr("builtins.input", lambda prompt="": next(answers))
|
||||
|
||||
sink = StringIO()
|
||||
console = Console(file=sink, force_terminal=False, color_system=None)
|
||||
do_install(
|
||||
"https://example.com/SKILL.md",
|
||||
console=console, skip_confirm=False, # interactive
|
||||
force=True, # skip the final confirm prompt (tested elsewhere)
|
||||
)
|
||||
|
||||
assert installs == [{"name": "my-interactive", "category": ""}]
|
||||
|
||||
|
||||
def test_url_install_prompts_category_and_uses_typed_value(monkeypatch, tmp_path, hub_env):
|
||||
import tools.skills_hub as hub
|
||||
installs = _install_mocks(
|
||||
monkeypatch, tmp_path,
|
||||
_make_url_bundle_fetcher(name="sharethis-chat", awaiting_name=False),
|
||||
)
|
||||
|
||||
# Stage an existing category bucket so _existing_categories finds it.
|
||||
(hub.SKILLS_DIR / "productivity" / "notion").mkdir(parents=True)
|
||||
(hub.SKILLS_DIR / "productivity" / "notion" / "SKILL.md").write_text("# notion")
|
||||
|
||||
# Name is already resolved (from frontmatter) → only category prompt fires.
|
||||
answers = iter(["productivity"])
|
||||
monkeypatch.setattr("builtins.input", lambda prompt="": next(answers))
|
||||
|
||||
sink = StringIO()
|
||||
console = Console(file=sink, force_terminal=False, color_system=None)
|
||||
do_install(
|
||||
"https://example.com/sharethis-chat/SKILL.md",
|
||||
console=console, skip_confirm=False, force=True,
|
||||
)
|
||||
|
||||
assert installs == [{"name": "sharethis-chat", "category": "productivity"}]
|
||||
assert "Existing: productivity" in sink.getvalue()
|
||||
|
||||
|
||||
def test_url_install_cancel_name_prompt_aborts(monkeypatch, tmp_path, hub_env):
|
||||
installs = _install_mocks(monkeypatch, tmp_path, _make_url_bundle_fetcher())
|
||||
|
||||
# Empty input with no default → name prompt returns None → abort.
|
||||
monkeypatch.setattr("builtins.input", lambda prompt="": "")
|
||||
|
||||
sink = StringIO()
|
||||
console = Console(file=sink, force_terminal=False, color_system=None)
|
||||
do_install(
|
||||
"https://example.com/SKILL.md",
|
||||
console=console, skip_confirm=False, force=True,
|
||||
)
|
||||
|
||||
assert installs == []
|
||||
assert "Installation cancelled" in sink.getvalue()
|
||||
|
||||
|
||||
# ── _existing_categories ────────────────────────────────────────────────────
|
||||
|
||||
|
||||
def test_existing_categories_skips_top_level_skills(monkeypatch, tmp_path, hub_env):
|
||||
import tools.skills_hub as hub
|
||||
from hermes_cli.skills_hub import _existing_categories
|
||||
|
||||
# Category bucket with nested skill.
|
||||
(hub.SKILLS_DIR / "productivity" / "notion").mkdir(parents=True)
|
||||
(hub.SKILLS_DIR / "productivity" / "notion" / "SKILL.md").write_text("# notion")
|
||||
|
||||
# Flat skill at top level (NOT a category).
|
||||
(hub.SKILLS_DIR / "my-flat-skill").mkdir()
|
||||
(hub.SKILLS_DIR / "my-flat-skill" / "SKILL.md").write_text("# flat")
|
||||
|
||||
# Empty dir (NOT a category — no SKILL.md below).
|
||||
(hub.SKILLS_DIR / "empty-dir").mkdir()
|
||||
|
||||
# Hidden dir (ignored).
|
||||
(hub.SKILLS_DIR / ".hub").mkdir(exist_ok=True)
|
||||
|
||||
cats = _existing_categories()
|
||||
assert cats == ["productivity"]
|
||||
|
||||
|
||||
def test_existing_categories_returns_empty_when_skills_dir_missing(monkeypatch, tmp_path, hub_env):
|
||||
# hub_env creates tmp_path/skills/.hub — we point SKILLS_DIR at a missing sibling.
|
||||
import tools.skills_hub as hub
|
||||
monkeypatch.setattr(hub, "SKILLS_DIR", tmp_path / "does-not-exist")
|
||||
|
||||
from hermes_cli.skills_hub import _existing_categories
|
||||
assert _existing_categories() == []
|
||||
|
||||
Reference in New Issue
Block a user