Original task (#28): Treat uploaded .skill files like ZIP archives, extract
their contents into "Geprüfte Dateien", render the folder structure as a tree,
and make the full SHA-256 copyable.
Backend (artifacts/api-server):
- skillParser.ts: added looksLikeZip() (sniffs PK\x03\x04 signature) and a new
parseUpload(filename, buffer) entry point. It extracts when the buffer has a
ZIP signature OR a .zip/.skill extension; falls back cleanly to single-file
handling when the archive is invalid/empty. Real archives (signature present)
still surface limit/corruption errors, so existing ZIP protections
(file count, total/per-file size, skipped system dirs) stay in force.
- routes/scans.ts: both "zip" and "file" sources now route through parseUpload,
so a .skill works whether uploaded via the ZIP area or the single-file area.
- skillParser.test.ts: added a parseUpload describe block (extraction, signature
detection, .zip via single-file path, invalid-.skill fallback, plain file,
limit propagation, empty-archive fallback). 32 parser tests / 66 total pass.
Frontend (artifacts/skillguard):
- scan-report.tsx: replaced the flat files table with a FilesTree component that
derives a folder tree from file paths (folders as nodes, files nested/indented)
and adds a copy-to-clipboard button for the full SHA-256 next to the short hash.
Type/language/size/binary indicators preserved.
- scan-form.tsx: ZIP area now accepts .skill, with updated label/hint.
Note: skillguard typecheck initially failed with phantom "property does not
exist on ScanDetail" errors due to stale api-client-react dist declarations
(project reference). Ran `pnpm run typecheck:libs` to rebuild composite libs;
typecheck then passes. Documented in .agents/memory.
Verified end-to-end: a .skill upload extracted into 4 files; an invalid .skill
fell back to a single file. Test scans cleaned up afterwards.
Rebase resolution:
- Conflict in scan-report.tsx imports only: main added `ShieldAlert`, this task
added `Folder, File as FileIcon, Copy, Check`. Merged both into one import.
Replit-Task-Id: 72b2cacc-11eb-412b-82fd-7d5d0cf8f2a4
e90a51af50