feat: Skills extension phase 3 — CLI, TUI, directory reads, frontmatter check

Closes #2248.

Completes SEP-2640 support across all three clients, and closes the one
obligation #2234 deliberately left open.

- `checkSkillFrontmatterMatch` compares a served SKILL.md's own YAML
  frontmatter against the entry the listing advertised, field by field. No
  digest can cover this: a digest is taken over the bytes the server served,
  so it proves the file was not altered in transit and says nothing about
  whether the listing described it honestly. Needs a real YAML parser; `yaml`
  was already a root dependency, so this adds no package — but it does newly
  put it on core/'s import graph, hence the three bundler `external` lists.

- `resources/directory/read`: result schemas defined against the normative
  text, `InspectorClient.readResourceDirectory`, a Directory section on the
  Skills screen, and `--method resources/directory/read` in the CLI. The
  client refuses the call locally when the server did not declare
  `directoryRead`, which is the SEP's MUST NOT. A child the directory lists
  but the entry does not is marked `not listed` rather than merged into the
  manifest — the SEP calls a directory result a live observation and forbids
  treating it as extending the manifest.

- CLI: `skills/list`, `skills/get` and `resources/directory/read`, plus
  `--verify` — one NDJSON report per skill, a summary on stderr, exit 7 on a
  violation. Reads are sequential; a conforming manifest may declare 512
  entries.

- TUI: a Skills pane, shown only when the server declares the extension. Each
  row carries its conformance verdict as a glyph as well as a colour, since
  the pane is read over ssh and through script(1). Enter verifies.

- `verifySkills` re-throws `AuthRecoveryRequiredError` rather than recording
  it per file: it says the session's authorization expired, so absorbing it
  would report N identical read failures and swallow the error the TUI and
  the web commands key off to reauthorize.

Two open questions settled, both in code comments where they will be found:
`skills/get` carries no caching attributes because SEP-2640 leaves the
question open in as many words, so requiring them would fail a conforming
server; and there is no `PagedSkillsState` because every consumer of this
list is a whole-catalog verdict — computed over page one of three, "this
server's skills conform" is not merely partial but wrong.

The fixture grows two skills, both for checks that were otherwise
undemonstrable: `lying-listing` (listing and file disagree, digest still
verifies) and `stale-manifest` (serves a file its manifest does not declare).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ND46Ci64DC3tzBy9aG81Nc
Signed-off-by: cliffhall <cliff@futurescale.com>
This commit is contained in:
cliffhall 2026-09-07 18:10:37 -04:00
commit 9a8488681e

View file

@ -27,6 +27,7 @@ import {
ManagedResourcesState,
ManagedResourceTemplatesState,
ManagedPromptsState,
ManagedSkillsState,
MessageLogState,
FetchRequestLogState,
StderrLogState,
@ -40,6 +41,7 @@ import { useManagedTools } from "@inspector/core/react/useManagedTools.js";
import { useManagedResources } from "@inspector/core/react/useManagedResources.js";
import { useManagedResourceTemplates } from "@inspector/core/react/useManagedResourceTemplates.js";
import { useManagedPrompts } from "@inspector/core/react/useManagedPrompts.js";
import { useManagedSkills } from "@inspector/core/react/useManagedSkills.js";
import { useMessageLog } from "@inspector/core/react/useMessageLog.js";
import { useFetchRequestLog } from "@inspector/core/react/useFetchRequestLog.js";
import { useStderrLog } from "@inspector/core/react/useStderrLog.js";
@ -79,6 +81,7 @@ import { InfoTab } from "./components/InfoTab.js";
import { AuthTab } from "./components/AuthTab.js";
import { ResourcesTab } from "./components/ResourcesTab.js";
import { PromptsTab } from "./components/PromptsTab.js";
import { SkillsTab } from "./components/SkillsTab.js";
import { ToolsTab } from "./components/ToolsTab.js";
import { NotificationsTab } from "./components/NotificationsTab.js";
import { HistoryTab } from "./components/HistoryTab.js";
@ -153,6 +156,7 @@ function App({
info?: number;
resources?: number;
prompts?: number;
skills?: number;
tools?: number;
messages?: number;
requests?: number;
@ -244,6 +248,9 @@ function App({
const [managedPromptsStates, setManagedPromptsStates] = useState<
Record<string, ManagedPromptsState>
>({});
const [managedSkillsStates, setManagedSkillsStates] = useState<
Record<string, ManagedSkillsState>
>({});
const [messageLogStates, setMessageLogStates] = useState<
Record<string, MessageLogState>
>({});
@ -293,6 +300,7 @@ function App({
ManagedResourceTemplatesState
> = {};
const newManagedPromptsStates: Record<string, ManagedPromptsState> = {};
const newManagedSkillsStates: Record<string, ManagedSkillsState> = {};
const newMessageLogStates: Record<string, MessageLogState> = {};
const newFetchRequestLogStates: Record<string, FetchRequestLogState> = {};
const newStderrLogStates: Record<string, StderrLogState> = {};
@ -367,6 +375,7 @@ function App({
newManagedResourceTemplatesStates[serverName] =
new ManagedResourceTemplatesState(client);
newManagedPromptsStates[serverName] = new ManagedPromptsState(client);
newManagedSkillsStates[serverName] = new ManagedSkillsState(client);
newMessageLogStates[serverName] = new MessageLogState(client);
newFetchRequestLogStates[serverName] = new FetchRequestLogState(client);
newStderrLogStates[serverName] = new StderrLogState(client);
@ -387,6 +396,10 @@ function App({
...prev,
...newManagedPromptsStates,
}));
setManagedSkillsStates((prev) => ({
...prev,
...newManagedSkillsStates,
}));
setMessageLogStates((prev) => ({ ...prev, ...newMessageLogStates }));
setFetchRequestLogStates((prev) => ({
...prev,
@ -420,6 +433,9 @@ function App({
Object.values(managedPromptsStates).forEach((manager) => {
manager.destroy();
});
Object.values(managedSkillsStates).forEach((manager) => {
manager.destroy();
});
Object.values(messageLogStates).forEach((manager) => {
manager.destroy();
});
@ -441,6 +457,7 @@ function App({
managedResourcesStates,
managedResourceTemplatesStates,
managedPromptsStates,
managedSkillsStates,
messageLogStates,
fetchRequestLogStates,
stderrLogStates,
@ -586,10 +603,28 @@ function App({
selectedInspectorClient,
selectedManagedResourceTemplatesState,
);
const selectedManagedSkillsState = useMemo(
() =>
selectedServer && managedSkillsStates[selectedServer]
? managedSkillsStates[selectedServer]
: null,
[selectedServer, managedSkillsStates],
);
const { prompts: managedPrompts } = useManagedPrompts(
selectedInspectorClient,
selectedManagedPromptsState,
);
const {
skills: managedSkills,
pageCount: managedSkillsPageCount,
error: managedSkillsError,
} = useManagedSkills(selectedInspectorClient, selectedManagedSkillsState);
// A *server-declared* extension, so it is only knowable after connecting —
// unlike the transport-derived `showLoggingTab` / `showRequestsTab` above.
const showSkillsTab =
!!selectedServer &&
!!selectedInspectorClient?.getSkillsExtension() &&
inspectorStatus === "connected";
// Connect — on 401 or mid-session auth recovery, run OAuth then retry.
type TuiOAuthRunResult =
@ -1347,6 +1382,7 @@ function App({
setTabCounts({
resources: managedResources.length || 0,
prompts: managedPrompts.length || 0,
skills: managedSkills.length || 0,
tools: managedTools.length || 0,
messages: inspectorMessages.length || 0,
requests: inspectorFetchRequests.length || 0,
@ -1356,6 +1392,7 @@ function App({
selectedServer,
managedResources,
managedPrompts,
managedSkills,
managedTools,
inspectorMessages,
inspectorFetchRequests,
@ -1430,6 +1467,7 @@ function App({
if (tab.id === "auth" && !showAuthTab) return false;
if (tab.id === "logging" && !showLoggingTab) return false;
if (tab.id === "requests" && !showRequestsTab) return false;
if (tab.id === "skills" && !showSkillsTab) return false;
return true;
})
.map((tab: { id: TabType; label: string; accelerator: string }) => [
@ -1517,6 +1555,7 @@ function App({
"auth",
"resources",
"prompts",
"skills",
"tools",
"messages",
"requests",
@ -1526,6 +1565,7 @@ function App({
if (t === "auth" && !showAuthTab) return false;
if (t === "logging" && !showLoggingTab) return false;
if (t === "requests" && !showRequestsTab) return false;
if (t === "skills" && !showSkillsTab) return false;
return true;
});
const currentIndex = tabs.indexOf(activeTab);
@ -1763,6 +1803,7 @@ function App({
? inspectorClients[selectedServer].getServerType() === "stdio"
: false
}
showSkills={showSkillsTab}
showRequests={
selectedServer && inspectorClients[selectedServer]
? (() => {
@ -1967,6 +2008,34 @@ function App({
)
}
/>
) : activeTab === "skills" &&
currentServerState?.status === "connected" &&
selectedInspectorClient ? (
<SkillsTab
key={`skills-${selectedServer}`}
skills={managedSkills}
pageCount={managedSkillsPageCount}
loadError={managedSkillsError}
inspectorClient={selectedInspectorClient}
width={contentWidth}
height={contentHeight}
focusedPane={
focus === "tabContentDetails"
? "details"
: focus === "tabContentList"
? "list"
: null
}
onAuthRecoveryRequired={onAuthRecoveryRequired}
modalOpen={
!!(
toolTestModal ||
resourceTestModal ||
promptTestModal ||
detailsModal
)
}
/>
) : activeTab === "prompts" &&
currentServerState?.status === "connected" &&
selectedInspectorClient ? (