Function copyInto

src/skills/installer.ts:160–220

(srcRoot: string, originalSource: string, opts: { force?: boolean })

}

async function copyInto(srcRoot: string, originalSource: string, opts: { force?: boolean }): Promise<InstallResult> {
  const raw = await fs.readFile(path.join(srcRoot, 'SKILL.md'), 'utf-8');
  // Parse to get the canonical name. If frontmatter has `name:`, prefer that;
  // otherwise fall back to the directory name.
  const fmName = extractFrontmatterName(raw);
  const dirName = path.basename(srcRoot);
  const name = (fmName ?? dirName).toLowerCase();
  if (!NAME_RE.test(name)) {
    throw new Error(`Skill name "${name}" is invalid. Names must match /^[a-z][a-z0-9-]*$/.`);
  }
  // Validate it parses cleanly before we commit
  const parsed = parseSkill(raw, name, srcRoot, 'user');
  if (!parsed) throw new Error('SKILL.md is missing a `description:` field.');

  // Security scan BEFORE anything touches disk. A skill is instructions the agent
  // reads and acts on, so a malicious one is close to running untrusted code:
  // prompt injection, secret exfiltration, destructive shell, hidden unicode.
  // `dangerous` findings hard-block even with --force; `suspicious` can be
  // overridden with --force after the user reviews the report.
  const scanText = await gatherSkillText(srcRoot);
  const scan = scanSkillContent(scanText);
  if (scan.severity !== 'clean') {
    const report = formatScanReport(scan, name);
    if (scan.severity === 'dangerous') {
      throw new Error(
        `${report}\n\nInstall blocked. Dangerous findings cannot be overridden with --force. ` +
        `Inspect the skill source manually before trusting it.`,
      );
    }
    if (!opts.force) {
      throw new Error(
        `${report}\n\nInstall paused. Review the skill, then re-run with --force to install anyway.`,
      );
    }
    // suspicious + force → proceed, but the report was shown above by the caller path.
  }

  const target = path.join(userSkillsDir(), name);
  try {
    await fs.stat(target);
    if (!opts.force) {
      throw new Error(`Skill "${name}" is already installed at ${target}. Pass --force to overwrite, or use \`qodex skill remove ${name}\` first.`);
    }
    await fs.rm(target, { recursive: true, force: true });
  } catch (e: any) {
    // The ONLY case we swallow is a genuine "not installed yet": fs.stat threw
    // ENOENT because the target dir doesn't exist. Everything else must
    // propagate — the already-installed sentinel (so the caller sees it), and
    // any real IO error including a failed fs.rm during --force overwrite.
    // Swallowing an rm failure here would let us copy over a half-removed dir
    // and produce a corrupt skill.
    if (e?.code !== 'ENOENT') throw e;
  }
  await fs.mkdir(target, { recursive: true });
  await copyDir(srcRoot, target);

  // Stamp provenance into SKILL.md if not already present
  await stampSource(path.join(target, 'SKILL.md'), originalSource);