| 1 | # skills_scan.py DOX |
| 2 | |
| 3 | ## Purpose |
| 4 | |
| 5 | - Own the `skills_scan.py` API endpoint. |
| 6 | - Provide scan target discovery and uploaded skills archive preparation for the Settings > Skills scanner. |
| 7 | - Keep this file-level DOX profile synchronized with `skills_scan.py` because this directory is intentionally flat. |
| 8 | |
| 9 | ## Ownership |
| 10 | |
| 11 | - `skills_scan.py` owns the runtime implementation. |
| 12 | - `skills_scan.py.dox.md` owns durable notes about responsibilities, contracts, side effects, and verification for that implementation. |
| 13 | - Classes: |
| 14 | - `SkillsScan` (`ApiHandler`) |
| 15 | - `async process(self, input: dict[str, Any], request: Request) -> dict[str, Any] | Response` |
| 16 | |
| 17 | ## Runtime Contracts |
| 18 | |
| 19 | - HTTP handlers must derive from `helpers.api.ApiHandler`; WebSocket handlers must derive from `helpers.ws.WsHandler`. |
| 20 | - The JSON request action `targets` returns existing installed skill roots that contain at least one `SKILL.md`. |
| 21 | - Multipart requests with `skills_file` accept only `.zip` uploads, extract them into `tmp/skill_scans`, discover contained `SKILL.md` folders, and return `paths` plus `cleanup_paths` for the scanner prompt. |
| 22 | - Uploaded archives are not imported, installed, or executed by this endpoint. |
| 23 | - Temporary uploaded zip files under `tmp/uploads` are deleted after extraction or failure. |
| 24 | - Update this file whenever request payloads, authentication or CSRF requirements, response shapes, route side effects, or WebSocket event contracts change. |
| 25 | - Observed side-effect areas: filesystem reads, filesystem writes, filesystem deletion. |
| 26 | - Imported dependency areas include: `__future__`, `helpers`, `helpers.api`, `helpers.skills_import`, `pathlib`, `shutil`, `time`, `typing`, `uuid`, `werkzeug.datastructures`, `werkzeug.utils`. |
| 27 | |
| 28 | ## Key Concepts |
| 29 | |
| 30 | - Installed target discovery uses `helpers.skills.get_skill_roots()` and filters to roots where `discover_skill_md_files()` finds skills. |
| 31 | - Uploaded zip preparation uses `extract_skills_zip()` so zip entries remain bounded to the temp extraction root. |
| 32 | - Response paths are local absolute paths for the scanner agent, while `display_path` provides normalized `/a0/...` style display when possible. |
| 33 | |
| 34 | ## Work Guidance |
| 35 | |
| 36 | - Preserve authentication, CSRF, loopback, and API-key checks unless the endpoint contract explicitly changes. |
| 37 | - Do not execute uploaded files or scan targets in this endpoint. |
| 38 | - Keep temp extraction paths explicit so the LLM-driven scan prompt can clean them up. |
| 39 | |
| 40 | ## Verification |
| 41 | |
| 42 | - Run endpoint-specific or API tests for changed behavior; smoke-test uploaded zip and installed-skill scan modal flows when practical. |
| 43 | |
| 44 | ## Child DOX Index |
| 45 | |
| 46 | No child DOX files. |