fix: harden skills registry commands

Author: friuns

src/server/skillsRoutes.ts

@@ -6,6 +6,7 @@ import { homedir, tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { writeFile } from 'node:fs/promises'
 import { resolvePythonCommand, resolveSkillInstallerScriptPath } from '../commandResolution.js'
+import { getSpawnInvocation } from '../utils/commandInvocation.js'
 
 type AppServerLike = {
   rpc(method: string, params: unknown): Promise<unknown>
@@ -114,11 +115,14 @@ function getSkillsInstallDir(): string {
 }
 
 const DEFAULT_COMMAND_TIMEOUT_MS = 120_000
+const SKILL_SEARCH_METADATA_LIMIT = 20
+const SKILL_SEARCH_METADATA_CONCURRENCY = 4
 
 async function runCommand(command: string, args: string[], options: { cwd?: string; timeoutMs?: number } = {}): Promise<void> {
   const timeout = options.timeoutMs ?? DEFAULT_COMMAND_TIMEOUT_MS
   await new Promise<void>((resolve, reject) => {
-    const proc = spawn(command, args, {
+    const invocation = getSpawnInvocation(command, args)
+    const proc = spawn(invocation.command, invocation.args, {
       cwd: options.cwd,
       env: process.env,
       stdio: ['ignore', 'pipe', 'pipe'],
@@ -158,7 +162,8 @@ async function runCommand(command: string, args: string[], options: { cwd?: stri
 async function runCommandWithOutput(command: string, args: string[], options: { cwd?: string; timeoutMs?: number } = {}): Promise<string> {
   const timeout = options.timeoutMs ?? DEFAULT_COMMAND_TIMEOUT_MS
   return await new Promise<string>((resolve, reject) => {
-    const proc = spawn(command, args, {
+    const invocation = getSpawnInvocation(command, args)
+    const proc = spawn(invocation.command, invocation.args, {
       cwd: options.cwd,
       env: process.env,
       stdio: ['ignore', 'pipe', 'pipe'],
@@ -401,16 +406,39 @@ async function fetchGithubSkillMetadata(source: string): Promise<Partial<Pick<Sk
   return { avatarUrl: getGithubOwnerAvatarUrl(source) }
 }
 
+async function mapWithConcurrency<T, R>(
+  items: T[],
+  concurrency: number,
+  mapper: (item: T, index: number) => Promise<R>,
+): Promise<R[]> {
+  const results = new Array<R>(items.length)
+  let nextIndex = 0
+  const workerCount = Math.max(1, Math.min(concurrency, items.length))
+  await Promise.all(Array.from({ length: workerCount }, async () => {
+    while (nextIndex < items.length) {
+      const index = nextIndex
+      nextIndex += 1
+      results[index] = await mapper(items[index] as T, index)
+    }
+  }))
+  return results
+}
+
 async function enrichSkillSearchDescriptions(results: SkillHubEntry[]): Promise<SkillHubEntry[]> {
-  return await Promise.all(results.map(async (result) => {
+  const enrichedHead = await mapWithConcurrency(
+    results.slice(0, SKILL_SEARCH_METADATA_LIMIT),
+    SKILL_SEARCH_METADATA_CONCURRENCY,
+    async (result) => {
     if (!result.source) return result
     const metadata = await fetchGithubSkillMetadata(result.source)
     return {
       ...result,
       description: metadata.description || result.description,
       avatarUrl: metadata.avatarUrl || result.avatarUrl,
     }
-  }))
+    },
+  )
+  return [...enrichedHead, ...results.slice(SKILL_SEARCH_METADATA_LIMIT)]
 }
 
 type RpcSkillRecord = {
@@ -1327,7 +1355,7 @@ export async function handleSkillsRoutes(
         return true
       }
       const installedMap = await collectInstalledSkillsMap(appServer)
-      const output = await runCommandWithOutput('npx', ['skills', 'find', query], { timeoutMs: 60_000 })
+      const output = await runCommandWithOutput('npx', ['--yes', 'skills', 'find', query], { timeoutMs: 60_000 })
       const results = await enrichSkillSearchDescriptions(parseNpxSkillsFindOutput(output, installedMap))
       setJson(res, 200, { results })
     } catch (error) {
@@ -1560,7 +1588,7 @@ export async function handleSkillsRoutes(
         setJson(res, 400, { error: 'Missing or invalid skill source' })
         return true
       }
-      await runCommand('npx', ['skills', 'add', installSource, '--yes', '--global'], { timeoutMs: 120_000 })
+      await runCommand('npx', ['--yes', 'skills', 'add', installSource, '--yes', '--global'], { timeoutMs: 120_000 })
       try { await withTimeout(appServer.rpc('skills/list', { forceReload: true }), 10_000, 'skills/list reload') } catch {}
       const installedMap = await collectInstalledSkillsMap(appServer)
       const installed = installedMap.get(name || installSource.slice(installSource.lastIndexOf('@') + 1))

tests.md

@@ -3423,11 +3423,11 @@ The Skills tab includes a registry search panel backed by `npx skills find`, sho
 3. Verify the `Find skills` header shows a `Skills directory` link on the right that opens `https://skills.anyclaw.store/` in a new tab
 4. In `Find skills`, type a query such as `browser`
 5. Click `Search`
-6. Verify the app calls `/codex-api/skills-hub/search?q=browser`, which runs `npx skills find browser`
+6. Verify the app calls `/codex-api/skills-hub/search?q=browser`, which runs `npx --yes skills find browser`
 7. Verify `Search results (count)` appears above `Installed skills (count)`
 8. Verify each registry result card shows its install count metadata, such as `1.2K installs`, even when a GitHub `SKILL.md` description is shown
 9. Open one GitHub-backed result and verify the detail modal shows the skill name, owner/repository, parsed `SKILL.md` description, GitHub-backed icon/avatar, and external link
-10. Click `Install` for a result and verify the backend runs `npx skills add <owner/repo@skill> --yes --global`
+10. Click `Install` for a result and verify the backend runs `npx --yes skills add <owner/repo@skill> --yes --global`
 11. After install, verify the result becomes installed and the installed skills list refreshes from local installed skill data rather than appending the remote registry card
 12. Switch to dark theme and repeat the search visibility check
 13. Search for an already-installed skill and verify its search result shows `Installed`
@@ -3440,11 +3440,14 @@ The Skills tab includes a registry search panel backed by `npx skills find`, sho
 
 #### Expected Results
 - Search results are parsed from the real `npx skills find` output, not a static catalog
+- Skills search/install commands use the repo command invocation wrapper so `npx` starts reliably on Windows
+- Skills search/install commands include outer `npx --yes` so first-run package prompts cannot hang with ignored stdin
 - The Skills directory link is visible beside Find skills in light and dark theme and opens the public directory in a new tab
 - Registry installs run noninteractively with `--yes --global`, so the process cannot stop at the agent-selection prompt and falsely report success
 - Registry install responses only return `ok: true` when the local installed `SKILL.md` path is found and validates successfully
 - The UI treats a missing returned path or missing post-refresh local skill as an install failure instead of showing the remote registry card as installed
 - GitHub-backed results fetch the repository `SKILL.md` and show its `description` frontmatter when available, falling back to the install count when unavailable
+- GitHub metadata enrichment is bounded to the first 20 results with limited concurrency, so broad searches still return without unbounded raw GitHub fetch fanout
 - Search result cards keep the registry install count visible as card metadata even when GitHub enrichment replaces the fallback description
 - GitHub-backed results show an explicit frontmatter `icon` when provided, otherwise they show the GitHub repository owner avatar instead of a generic letter fallback
 - The search UI does not replace or hide local installed skills