-
Notifications
You must be signed in to change notification settings - Fork 29
feat: implement Skill management system for Claude Code #183
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Closed
Closed
Changes from all commits
Commits
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
40 changes: 40 additions & 0 deletions
40
backend/alembic/versions/a1b2c3d4e5f6_add_skill_binaries_table.py
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,40 @@ | ||
| """add skill binaries table | ||
|
|
||
| Revision ID: a1b2c3d4e5f6 | ||
| Revises: 0c086b93f8b9 | ||
| Create Date: 2025-01-20 10:00:00.000000 | ||
|
|
||
| """ | ||
| from typing import Sequence, Union | ||
|
|
||
| from alembic import op | ||
| import sqlalchemy as sa | ||
|
|
||
| # revision identifiers, used by Alembic. | ||
| revision: str = 'a1b2c3d4e5f6' | ||
| down_revision: Union[str, None] = '0c086b93f8b9' | ||
| branch_labels: Union[str, Sequence[str], None] = None | ||
| depends_on: Union[str, Sequence[str], None] = None | ||
|
|
||
|
|
||
| def upgrade() -> None: | ||
| """Add skill_binaries table for storing Skill ZIP packages.""" | ||
|
|
||
| op.execute(""" | ||
| CREATE TABLE IF NOT EXISTS skill_binaries ( | ||
| id INT NOT NULL AUTO_INCREMENT, | ||
| kind_id INT NOT NULL, | ||
| binary_data LONGBLOB NOT NULL COMMENT 'ZIP package binary data', | ||
| file_size INT NOT NULL COMMENT 'File size in bytes', | ||
| file_hash VARCHAR(64) NOT NULL COMMENT 'SHA256 hash', | ||
| created_at DATETIME DEFAULT CURRENT_TIMESTAMP, | ||
| PRIMARY KEY (id), | ||
| UNIQUE KEY idx_skill_binary_kind_id (kind_id), | ||
| CONSTRAINT fk_skill_binary_kind_id FOREIGN KEY (kind_id) REFERENCES kinds(id) ON DELETE CASCADE | ||
| ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci | ||
| """) | ||
|
|
||
|
|
||
| def downgrade() -> None: | ||
| """Drop skill_binaries table.""" | ||
| op.drop_table('skill_binaries') |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,176 @@ | ||
| # SPDX-FileCopyrightText: 2025 Weibo, Inc. | ||
| # | ||
| # SPDX-License-Identifier: Apache-2.0 | ||
|
|
||
| """ | ||
| Skills API endpoints for Claude Code Skills management | ||
| """ | ||
| from fastapi import APIRouter, Depends, UploadFile, File, Form, status | ||
| from fastapi.responses import StreamingResponse | ||
| from sqlalchemy.orm import Session | ||
| import io | ||
|
|
||
| from app.api.dependencies import get_db | ||
| from app.core import security | ||
| from app.models.user import User | ||
| from app.schemas.kind import Skill, SkillList | ||
| from app.services.skill_service import SkillService | ||
|
|
||
| router = APIRouter() | ||
|
|
||
|
|
||
| @router.post("/upload", response_model=Skill, status_code=status.HTTP_201_CREATED) | ||
| async def upload_skill( | ||
| file: UploadFile = File(...), | ||
| name: str = Form(...), | ||
| namespace: str = Form("default"), | ||
| current_user: User = Depends(security.get_current_user), | ||
| db: Session = Depends(get_db) | ||
| ): | ||
| """ | ||
| Upload and create a new Skill | ||
|
|
||
| - **file**: ZIP package containing SKILL.md (max 10MB) | ||
| - **name**: Unique Skill name | ||
| - **namespace**: Namespace (default: "default") | ||
| """ | ||
| # Validate file type | ||
| if not file.filename.endswith('.zip'): | ||
| from fastapi import HTTPException | ||
| raise HTTPException(status_code=400, detail="File must be a ZIP archive") | ||
|
|
||
| # Read file content | ||
| file_content = await file.read() | ||
|
|
||
| # Create skill | ||
| skill = SkillService.create_skill( | ||
| db=db, | ||
| user_id=current_user.id, | ||
| name=name.strip(), | ||
| namespace=namespace, | ||
| file_content=file_content | ||
| ) | ||
|
|
||
| return skill | ||
|
|
||
|
|
||
| @router.get("", response_model=SkillList) | ||
| def list_skills( | ||
| skip: int = 0, | ||
| limit: int = 100, | ||
| current_user: User = Depends(security.get_current_user), | ||
| db: Session = Depends(get_db) | ||
| ): | ||
| """ | ||
| List all Skills for the current user | ||
|
|
||
| - **skip**: Number of items to skip (for pagination) | ||
| - **limit**: Maximum number of items to return | ||
| """ | ||
| return SkillService.list_skills( | ||
| db=db, | ||
| user_id=current_user.id, | ||
| skip=skip, | ||
| limit=limit | ||
| ) | ||
|
|
||
|
|
||
| @router.get("/{skill_id}", response_model=Skill) | ||
| def get_skill( | ||
| skill_id: int, | ||
| current_user: User = Depends(security.get_current_user), | ||
| db: Session = Depends(get_db) | ||
| ): | ||
| """ | ||
| Get Skill details by ID | ||
| """ | ||
| return SkillService.get_skill( | ||
| db=db, | ||
| user_id=current_user.id, | ||
| skill_id=skill_id | ||
| ) | ||
|
|
||
|
|
||
| @router.get("/{skill_id}/download") | ||
| def download_skill( | ||
| skill_id: int, | ||
| current_user: User = Depends(security.get_current_user), | ||
| db: Session = Depends(get_db) | ||
| ): | ||
| """ | ||
| Download Skill ZIP package | ||
|
|
||
| Used by Executor to download Skills for deployment | ||
| """ | ||
| binary_data = SkillService.get_skill_binary( | ||
| db=db, | ||
| user_id=current_user.id, | ||
| skill_id=skill_id | ||
| ) | ||
|
|
||
| # Get skill name for filename | ||
| skill = SkillService.get_skill( | ||
| db=db, | ||
| user_id=current_user.id, | ||
| skill_id=skill_id | ||
| ) | ||
|
|
||
| return StreamingResponse( | ||
| io.BytesIO(binary_data), | ||
| media_type="application/zip", | ||
| headers={ | ||
| "Content-Disposition": f"attachment; filename={skill.metadata.name}.zip" | ||
| } | ||
| ) | ||
|
|
||
|
|
||
| @router.put("/{skill_id}", response_model=Skill) | ||
| async def update_skill( | ||
| skill_id: int, | ||
| file: UploadFile = File(...), | ||
| current_user: User = Depends(security.get_current_user), | ||
| db: Session = Depends(get_db) | ||
| ): | ||
| """ | ||
| Update Skill with new ZIP package | ||
|
|
||
| - **file**: New ZIP package containing SKILL.md (max 10MB) | ||
| """ | ||
| # Validate file type | ||
| if not file.filename.endswith('.zip'): | ||
| from fastapi import HTTPException | ||
| raise HTTPException(status_code=400, detail="File must be a ZIP archive") | ||
|
|
||
| # Read file content | ||
| file_content = await file.read() | ||
|
|
||
| # Update skill | ||
| skill = SkillService.update_skill( | ||
| db=db, | ||
| user_id=current_user.id, | ||
| skill_id=skill_id, | ||
| file_content=file_content | ||
| ) | ||
|
|
||
| return skill | ||
|
|
||
|
|
||
| @router.delete("/{skill_id}", status_code=status.HTTP_204_NO_CONTENT) | ||
| def delete_skill( | ||
| skill_id: int, | ||
| current_user: User = Depends(security.get_current_user), | ||
| db: Session = Depends(get_db) | ||
| ): | ||
| """ | ||
| Delete Skill | ||
|
|
||
| Will check if Skill is referenced by any Ghost. | ||
| If referenced, deletion will be rejected. | ||
| """ | ||
| SkillService.delete_skill( | ||
| db=db, | ||
| user_id=current_user.id, | ||
| skill_id=skill_id | ||
| ) | ||
|
|
||
| return None | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| # SPDX-FileCopyrightText: 2025 Weibo, Inc. | ||
| # | ||
| # SPDX-License-Identifier: Apache-2.0 | ||
|
|
||
| """ | ||
| Skill binary storage model for Claude Code Skills ZIP packages | ||
| """ | ||
| from sqlalchemy import Column, Integer, String, LargeBinary, ForeignKey, DateTime | ||
| from datetime import datetime | ||
| from app.db.base import Base | ||
|
|
||
|
|
||
| class SkillBinary(Base): | ||
| """Model for storing Skill ZIP package binary data""" | ||
| __tablename__ = "skill_binaries" | ||
|
|
||
| id = Column(Integer, primary_key=True, index=True) | ||
| kind_id = Column(Integer, ForeignKey("kinds.id", ondelete="CASCADE"), nullable=False, unique=True) | ||
| binary_data = Column(LargeBinary, nullable=False) # ZIP package binary data | ||
| file_size = Column(Integer, nullable=False) # File size in bytes | ||
| file_hash = Column(String(64), nullable=False) # SHA256 hash | ||
| created_at = Column(DateTime, default=datetime.now) | ||
|
|
||
| __table_args__ = ( | ||
| {"mysql_charset": "utf8mb4", "mysql_collate": "utf8mb4_unicode_ci"}, | ||
| ) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Sanitize filename in Content-Disposition header to prevent header injection.
The skill name is used directly in the
Content-Dispositionheader without sanitization. If the name contains special characters (quotes, newlines, semicolons), it could corrupt the header or enable HTTP response splitting.Note: The filename should also be wrapped in quotes per RFC 6266.
🤖 Prompt for AI Agents