feat: add local skill store and targets

internal/skillstore/store.go

@@ -0,0 +1,114 @@
+package skillstore
+
+import (
+	"encoding/json"
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"sgg-ai-skill-manager/internal/domain"
+)
+
+type Store struct {
+	statePath string
+	reposRoot string
+}
+
+func New(statePath, reposRoot string) *Store {
+	return &Store{statePath: statePath, reposRoot: reposRoot}
+}
+
+func (s *Store) Load() (domain.State, error) {
+	state := domain.State{Skills: []domain.SkillState{}}
+	raw, err := os.ReadFile(s.statePath)
+	if errors.Is(err, os.ErrNotExist) {
+		return state, nil
+	}
+	if err != nil {
+		return state, err
+	}
+	if strings.TrimSpace(string(raw)) == "" {
+		return state, nil
+	}
+	if err := json.Unmarshal(raw, &state); err != nil {
+		return state, err
+	}
+	if state.Skills == nil {
+		state.Skills = []domain.SkillState{}
+	}
+	return state, nil
+}
+
+func (s *Store) Save(state domain.State) error {
+	if state.Skills == nil {
+		state.Skills = []domain.SkillState{}
+	}
+	if err := os.MkdirAll(filepath.Dir(s.statePath), 0o755); err != nil {
+		return err
+	}
+	raw, err := json.MarshalIndent(state, "", "  ")
+	if err != nil {
+		return err
+	}
+	return os.WriteFile(s.statePath, append(raw, '\n'), 0o600)
+}
+
+func (s *Store) LocalRepoPath(org, repo string) string {
+	return filepath.Join(s.reposRoot, org, repo)
+}
+
+func (s *Store) SafeLocalRepoPath(org, repo string) (string, error) {
+	if err := validateName(org); err != nil {
+		return "", err
+	}
+	if err := validateName(repo); err != nil {
+		return "", err
+	}
+	return s.LocalRepoPath(org, repo), nil
+}
+
+func UpsertSkill(state domain.State, skill domain.SkillState) domain.State {
+	for i, existing := range state.Skills {
+		if existing.Org == skill.Org && existing.Repo == skill.Repo {
+			state.Skills[i] = skill
+			return state
+		}
+	}
+	state.Skills = append(state.Skills, skill)
+	return state
+}
+
+func RemoveSkill(state domain.State, org, repo string) domain.State {
+	next := state.Skills[:0]
+	for _, skill := range state.Skills {
+		if skill.Org == org && skill.Repo == repo {
+			continue
+		}
+		next = append(next, skill)
+	}
+	state.Skills = next
+	return state
+}
+
+func FindSkill(state domain.State, org, repo string) (domain.SkillState, bool) {
+	for _, skill := range state.Skills {
+		if skill.Org == org && skill.Repo == repo {
+			return skill, true
+		}
+	}
+	return domain.SkillState{}, false
+}
+
+func validateName(name string) error {
+	if strings.TrimSpace(name) == "" {
+		return errors.New("name is required")
+	}
+	if name == "." || name == ".." {
+		return errors.New("name cannot be . or ..")
+	}
+	if strings.ContainsAny(name, `/\`) {
+		return errors.New("name cannot contain path separators")
+	}
+	return nil
+}

internal/skillstore/store_test.go

@@ -0,0 +1,75 @@
+package skillstore
+
+import (
+	"path/filepath"
+	"testing"
+
+	"sgg-ai-skill-manager/internal/domain"
+)
+
+func TestStoreRoundTrip(t *testing.T) {
+	dir := t.TempDir()
+	store := New(filepath.Join(dir, "state.json"), filepath.Join(dir, "repos"))
+	state := domain.State{
+		Skills: []domain.SkillState{
+			{
+				Org:       "skills",
+				Repo:      "demo",
+				LocalPath: store.LocalRepoPath("skills", "demo"),
+			},
+		},
+	}
+
+	if err := store.Save(state); err != nil {
+		t.Fatalf("Save returned error: %v", err)
+	}
+
+	got, err := store.Load()
+	if err != nil {
+		t.Fatalf("Load returned error: %v", err)
+	}
+	if len(got.Skills) != 1 || got.Skills[0].Repo != "demo" {
+		t.Fatalf("state = %+v", got)
+	}
+}
+
+func TestUpsertFindAndRemoveSkill(t *testing.T) {
+	state := domain.State{}
+	first := domain.SkillState{Org: "skills", Repo: "demo", CurrentCommit: "abc"}
+	second := domain.SkillState{Org: "skills", Repo: "demo", CurrentCommit: "def"}
+
+	state = UpsertSkill(state, first)
+	state = UpsertSkill(state, second)
+
+	if len(state.Skills) != 1 {
+		t.Fatalf("skill count = %d, want 1", len(state.Skills))
+	}
+	found, ok := FindSkill(state, "skills", "demo")
+	if !ok {
+		t.Fatal("FindSkill did not find demo")
+	}
+	if found.CurrentCommit != "def" {
+		t.Fatalf("CurrentCommit = %q, want def", found.CurrentCommit)
+	}
+
+	state = RemoveSkill(state, "skills", "demo")
+	if _, ok := FindSkill(state, "skills", "demo"); ok {
+		t.Fatal("FindSkill found removed skill")
+	}
+}
+
+func TestLocalRepoPathRejectsUnsafeNames(t *testing.T) {
+	dir := t.TempDir()
+	store := New(filepath.Join(dir, "state.json"), filepath.Join(dir, "repos"))
+
+	if got := store.LocalRepoPath("skills", "demo"); got != filepath.Join(dir, "repos", "skills", "demo") {
+		t.Fatalf("LocalRepoPath = %q", got)
+	}
+
+	if _, err := store.SafeLocalRepoPath("skills/evil", "demo"); err == nil {
+		t.Fatal("SafeLocalRepoPath accepted org with path separator")
+	}
+	if _, err := store.SafeLocalRepoPath("skills", ".."); err == nil {
+		t.Fatal("SafeLocalRepoPath accepted parent traversal")
+	}
+}