@godv61/dsh-task-engine 0.22.6 → 0.23.0

package/lib/resource-import.js

@@ -0,0 +1,210 @@
+/** Validate complete resource packages before exclusive installation. */
+import { createHash } from 'node:crypto';
+import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync, openSync, closeSync, unlinkSync } from 'node:fs';
+import { dirname, isAbsolute, join, resolve, relative, sep } from 'node:path';
+export const IMPORT_LIMITS = { files: 1000, bytes: 100 * 1024 * 1024, fileBytes: 20 * 1024 * 1024, depth: 20 };
+const SKIP = new Set(['node_modules', '.git', '__pycache__', '.venv', 'venv', '.cache', '.DS_Store']);
+/** Reject links in the path itself and every existing parent. */
+export function assertRealPath(path) {
+    let cursor = resolve(path);
+    for (;;) {
+        try {
+            if (lstatSync(cursor).isSymbolicLink())
+                throw new Error('不允许符号链接或目录联接：' + cursor);
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+        const parent = dirname(cursor);
+        if (parent === cursor)
+            break;
+        cursor = parent;
+    }
+}
+function safeRelative(path) {
+    const parts = path.split('/');
+    if (parts.length > IMPORT_LIMITS.depth || parts.some(p => !p || p === '.' || p === '..' || /[\\:\x00-\x1f<>"|?*]/u.test(p) || /[. ]$/u.test(p) || /^(con|prn|aux|nul|com[0-9]|lpt[0-9])(?:\.|$)/iu.test(p))) {
+        throw new Error('不安全的文件路径或目录超过 20 层：' + path);
+    }
+    return path;
+}
+function sourceEntries(source) {
+    if (!isAbsolute(source))
+        throw new Error('源目录必须是绝对路径');
+    assertRealPath(source);
+    if (!lstatSync(source).isDirectory())
+        throw new Error('请选择文件夹');
+    if (!existsSync(join(source, 'SKILL.md'))) {
+        const candidates = readdirSync(source, { withFileTypes: true }).filter(e => e.isDirectory() && !SKIP.has(e.name) && existsSync(join(source, e.name, 'SKILL.md')));
+        if (candidates.length !== 1)
+            throw new Error('缺少 SKILL.md 或存在多个带 SKILL.md 的子目录，请直接选择技能根目录');
+        source = join(source, candidates[0].name);
+    }
+    const entries = [];
+    let bytes = 0;
+    let nodes = 0;
+    const walk = (dir, depth) => {
+        if (depth > IMPORT_LIMITS.depth)
+            throw new Error('目录超过 20 层');
+        for (const item of readdirSync(dir, { withFileTypes: true })) {
+            if (SKIP.has(item.name))
+                continue;
+            if (++nodes > 3000)
+                throw new Error('目录项过多');
+            const path = join(dir, item.name);
+            const info = lstatSync(path);
+            if (info.isSymbolicLink())
+                throw new Error('不允许符号链接：' + path);
+            if (info.isDirectory()) {
+                walk(path, depth + 1);
+                continue;
+            }
+            if (!info.isFile())
+                throw new Error('不允许特殊文件：' + path);
+            if (info.size > IMPORT_LIMITS.fileBytes || bytes + info.size > IMPORT_LIMITS.bytes || entries.length >= IMPORT_LIMITS.files)
+                throw new Error('技能超限：1000 文件 / 100 MB / 单文件 20 MB');
+            assertRealPath(path);
+            const data = readFileSync(path);
+            bytes += data.length;
+            entries.push({ path: relative(source, path).replace(/\\/gu, '/'), data });
+        }
+    };
+    walk(source, 0);
+    return entries;
+}
+function decode(request) {
+    if (request.sourceDir !== undefined) {
+        if (request.kind !== 'skill' || request.files.length)
+            throw new Error('目录导入只接受技能，不能同时上传文件');
+        return sourceEntries(request.sourceDir);
+    }
+    if (!request.files.length || request.files.length > IMPORT_LIMITS.files)
+        throw new Error('请选择 1 至 1000 个文件');
+    let encoded = 0;
+    return request.files.map(file => {
+        encoded += file.base64.length;
+        if (file.base64.length > Math.ceil(IMPORT_LIMITS.fileBytes / 3) * 4 || encoded > Math.ceil(IMPORT_LIMITS.bytes / 3) * 4 + 4000)
+            throw new Error('上传超过大小限制');
+        safeRelative(file.path);
+        const data = Buffer.from(file.base64, 'base64');
+        if (data.length > IMPORT_LIMITS.fileBytes)
+            throw new Error('单文件超过 20 MB');
+        if (data.toString('base64') !== file.base64)
+            throw new Error('文件编码无效');
+        return { path: file.path, data };
+    }).filter(file => !file.path.split('/').some(part => SKIP.has(part)));
+}
+/** Build a preview from the exact bytes that a subsequent install will validate again. */
+export function prepareImport(request, base, bundled) {
+    let entries = decode(request);
+    let name;
+    let description = '';
+    let content;
+    if (request.kind === 'skill') {
+        const direct = entries.find(e => e.path === 'SKILL.md');
+        const roots = entries.filter(e => e.path.endsWith('/SKILL.md'));
+        if (!direct) {
+            if (roots.length !== 1)
+                throw new Error('缺少 SKILL.md 或包含多个技能，请选择一个技能文件夹');
+            const prefix = roots[0].path.slice(0, -'SKILL.md'.length);
+            entries = entries.filter(e => e.path.startsWith(prefix)).map(e => ({ ...e, path: e.path.slice(prefix.length) }));
+        }
+        const file = entries.find(e => e.path === 'SKILL.md');
+        if (file.data.length > 1024 * 1024)
+            throw new Error('SKILL.md 不能超过 1 MB');
+        content = new TextDecoder('utf-8', { fatal: true }).decode(file.data).replace(/^\uFEFF/u, '').replace(/\r\n/gu, '\n');
+        const front = content.match(/^---\n([\s\S]*?)\n---(?:\n|$)/u)?.[1];
+        const field = (key) => front?.match(new RegExp('^' + key + ':\\s*(.+)$', 'mu'))?.[1]?.trim().replace(/^(['"])(.*)\1$/u, '$2') ?? '';
+        name = field('name');
+        description = field('description');
+        if (!description)
+            throw new Error('SKILL.md 需要 name 和 description');
+        content = content.replace(/^---\n[\s\S]*?\n---(?:\n|$)/u, '');
+    }
+    else {
+        if (entries.length !== 1 || !/\.md$/iu.test(entries[0].path))
+            throw new Error('规则请选择一个 .md 文件');
+        const file = entries[0];
+        if (file.data.length > 1024 * 1024)
+            throw new Error('规则文件不能超过 1 MB');
+        name = file.path.split('/').at(-1).replace(/\.md$/iu, '');
+        content = new TextDecoder('utf-8', { fatal: true }).decode(file.data).replace(/^\uFEFF/u, '');
+        if (!content.trim())
+            throw new Error('规则文件不能为空');
+        entries = [{ path: name + '.md', data: file.data }];
+    }
+    if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/u.test(name))
+        throw new Error('名称需使用小写字母、数字和连字符；请修改源文件后重新选择');
+    if (bundled(name))
+        throw new Error('内置资源不可覆盖，请使用不同名称');
+    const seen = new Set();
+    let bytes = 0;
+    for (const entry of entries) {
+        safeRelative(entry.path);
+        const key = entry.path.toLowerCase();
+        if (seen.has(key))
+            throw new Error('存在重复或仅大小写不同的路径：' + entry.path);
+        seen.add(key);
+        bytes += entry.data.length;
+        if (entry.data.length > IMPORT_LIMITS.fileBytes)
+            throw new Error('单文件超过 20 MB');
+    }
+    for (const key of seen) {
+        const parts = key.split('/');
+        for (let i = 1; i < parts.length; i++) {
+            if (seen.has(parts.slice(0, i).join('/')))
+                throw new Error('文件与目录路径冲突：' + key);
+        }
+    }
+    if (entries.length > IMPORT_LIMITS.files || bytes > IMPORT_LIMITS.bytes)
+        throw new Error('技能超限：1000 文件 / 100 MB');
+    const target = join(base, request.kind === 'skill' ? name : name + '.md');
+    assertRealPath(target);
+    const conflict = existsSync(target) || (existsSync(base) && readdirSync(base).some(n => n.toLowerCase() === (request.kind === 'skill' ? name : name + '.md').toLowerCase()));
+    const digest = createHash('sha256').update(JSON.stringify([request.kind, request.level, resolve(target)]));
+    for (const entry of [...entries].sort((a, b) => a.path.localeCompare(b.path)))
+        digest.update(JSON.stringify([entry.path, entry.data.length])).update(entry.data);
+    return { preview: { ok: true, name, description, content, target, files: entries.length, bytes, hash: digest.digest('hex'), conflict }, entries };
+}
+/** Install only a reviewed package; never overwrite an existing destination. */
+export function commitImport(request, base, bundled) {
+    const { preview, entries } = prepareImport(request, base, bundled);
+    if (!request.expectedHash || request.expectedHash !== preview.hash)
+        throw new Error('预览后内容或目标发生变化，请重新预览');
+    if (preview.conflict)
+        throw new Error('目标已有同名资源，请先检查现有内容');
+    mkdirSync(base, { recursive: true });
+    assertRealPath(base);
+    if (request.kind === 'rule') {
+        const fd = openSync(preview.target, 'wx');
+        try {
+            writeFileSync(fd, entries[0].data);
+        }
+        catch (error) {
+            closeSync(fd);
+            unlinkSync(preview.target);
+            throw error;
+        }
+        closeSync(fd);
+        return preview;
+    }
+    mkdirSync(preview.target); // Exclusive ownership: cleanup below can only remove this call's new directory.
+    try {
+        for (const entry of entries) {
+            const target = join(preview.target, entry.path);
+            assertRealPath(target);
+            mkdirSync(dirname(target), { recursive: true });
+            writeFileSync(target, entry.data, { flag: 'wx' });
+        }
+    }
+    catch (error) {
+        assertRealPath(preview.target);
+        if (resolve(preview.target) === resolve(base) || !resolve(preview.target).startsWith(resolve(base) + sep))
+            throw error;
+        rmSync(preview.target, { recursive: true, force: true });
+        throw error;
+    }
+    return preview;
+}
+//# sourceMappingURL=resource-import.js.map

package/lib/resource-import.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-import.js","sourceRoot":"","sources":["../src/resource-import.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAC7I,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAG7E,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;AAC9G,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAA;AAGrG,iEAAiE;AACjE,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1B,SAAS,CAAC;QACR,IAAI,CAAC;YACH,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC,cAAc,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,eAAe,GAAG,MAAM,CAAC,CAAA;QACnF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAA;QACrE,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;QAC9B,IAAI,MAAM,KAAK,MAAM;YAAE,MAAK;QAC5B,MAAM,GAAG,MAAM,CAAA;IACjB,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC7B,IAAI,KAAK,CAAC,MAAM,GAAG,aAAa,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,gDAAgD,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5M,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAA;IAC/C,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAA;IACtD,cAAc,CAAC,MAAM,CAAC,CAAA;IACtB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAA;IAC/D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC;QAC1C,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAA;QACjK,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;QAC3F,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,CAAA;IAC5C,CAAC;IACD,MAAM,OAAO,GAAY,EAAE,CAAA;IAC3B,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,KAAa,EAAQ,EAAE;QAChD,IAAI,KAAK,GAAG,aAAa,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAA;QAC7D,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC7D,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAQ;YACjC,IAAI,EAAE,KAAK,GAAG,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAA;YAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;YACjC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;YAC5B,IAAI,IAAI,CAAC,cAAc,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,CAAA;YAC7D,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBAAC,SAAQ;YAAC,CAAC;YAC3D,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,CAAA;YACtD,IAAI,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC,SAAS,IAAI,KAAK,GAAG,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;YACjL,cAAc,CAAC,IAAI,CAAC,CAAA;YACpB,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;YAC/B,KAAK,IAAI,IAAI,CAAC,MAAM,CAAA;YACpB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;QAC3E,CAAC;IACH,CAAC,CAAA;IACD,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IACf,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,MAAM,CAAC,OAA8B;IAC5C,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;QAC3F,OAAO,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IACzC,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,aAAa,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;IAC5G,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QAC9B,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAA;QAC7B,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAA;QAC3J,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACvB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAC/C,IAAI,IAAI,CAAC,MAAM,GAAG,aAAa,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAA;QACzE,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAA;QACtE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAA;IAClC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACvE,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,aAAa,CAAC,OAA8B,EAAE,IAAY,EAAE,OAAkC;IAC5G,IAAI,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAA;IAC7B,IAAI,IAAY,CAAA;IAChB,IAAI,WAAW,GAAG,EAAE,CAAA;IACpB,IAAI,OAAe,CAAA;IACnB,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAA;QACvD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAA;QAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;YACzE,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;YAC1D,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;QAClH,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAE,CAAA;QACtD,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,GAAG,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;QACzE,OAAO,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QACrH,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QAClE,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,GAAG,GAAG,GAAG,GAAG,YAAY,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,iBAAiB,EAAE,IAAI,CAAC,IAAI,EAAE,CAAA;QAC3I,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QAAC,WAAW,GAAG,KAAK,CAAC,aAAa,CAAC,CAAA;QACxD,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;QACnE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,8BAA8B,EAAE,EAAE,CAAC,CAAA;IAC/D,CAAC;SAAM,CAAC;QACN,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAA;QAChG,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAE,CAAA;QACxB,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,GAAG,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAA;QACpE,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;QAC1D,OAAO,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;QAC7F,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAA;QAChD,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;IACrD,CAAC;IACD,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;IAC9F,IAAI,OAAO,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAA;IACtD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACxB,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAA;QACpC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,CAAA;QAClE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACb,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAA;QAC1B,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,aAAa,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAA;IACjF,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,YAAY,GAAG,GAAG,CAAC,CAAA;QAChF,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,aAAa,CAAC,KAAK,IAAI,KAAK,GAAG,aAAa,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;IACjH,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAA;IACzE,cAAc,CAAC,MAAM,CAAC,CAAA;IACtB,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;IAC5K,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1G,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAChK,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAA;AACnJ,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,YAAY,CAAC,OAA8B,EAAE,IAAY,EAAE,OAAkC;IAC3G,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IAClE,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,KAAK,OAAO,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAA;IACzG,IAAI,OAAO,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAA;IAC1D,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACpC,cAAc,CAAC,IAAI,CAAC,CAAA;IACpB,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC5B,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QACzC,IAAI,CAAC;YAAC,aAAa,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,CAAA;QAAC,CAAC;QAC3C,OAAO,KAAK,EAAE,CAAC;YAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAAC,MAAM,KAAK,CAAA;QAAC,CAAC;QACxE,SAAS,CAAC,EAAE,CAAC,CAAA;QACb,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA,CAAC,gFAAgF;IAC1G,IAAI,CAAC;QACH,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;YAC/C,cAAc,CAAC,MAAM,CAAC,CAAA;YACtB,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YAC/C,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QACnD,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAC9B,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;YAAE,MAAM,KAAK,CAAA;QACtH,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACxD,MAAM,KAAK,CAAA;IACb,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/lib/resource-types.d.ts

@@ -0,0 +1,25 @@
+/** Wire records shared by the resource importer and its browser UI. */
+export interface ResourceFile {
+    path: string;
+    base64: string;
+}
+export interface ResourceImportRequest {
+    kind: 'skill' | 'rule';
+    level: 'project' | 'user';
+    path: string;
+    files: ResourceFile[];
+    sourceDir?: string;
+    expectedHash?: string;
+}
+export interface ResourcePreview {
+    ok: boolean;
+    name: string;
+    description: string;
+    content: string;
+    target: string;
+    files: number;
+    bytes: number;
+    hash: string;
+    conflict: boolean;
+    error?: string;
+}

package/lib/resource-types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=resource-types.js.map

package/lib/resource-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-types.js","sourceRoot":"","sources":["../src/resource-types.ts"],"names":[],"mappings":""}

package/lib/workspace-access.d.ts

@@ -0,0 +1,6 @@
+/** Check workspace ownership against a mounted Harness registry when available. */
+export interface WorkspaceHost {
+    get(name: string): unknown;
+}
+/** Resolve the host's canonical workspace; legacy hosts retain their explicit guard. */
+export declare function authorizedWorkspace(host: WorkspaceHost, path: string, fallback: (path: string) => string): Promise<string>;

package/lib/workspace-access.js

@@ -0,0 +1,13 @@
+/** Resolve the host's canonical workspace; legacy hosts retain their explicit guard. */
+export async function authorizedWorkspace(host, path, fallback) {
+    const registry = host.get('workspaceRegistry');
+    if (!registry || typeof registry.resolveByPath !== 'function')
+        return fallback(path);
+    if (!path.trim())
+        throw new Error('请选择已在 Harness 注册的工作区');
+    const workspace = await registry.resolveByPath(path);
+    if (!workspace)
+        throw new Error('此目录未在 Harness 注册为工作区，请先添加工作区');
+    return workspace.path;
+}
+//# sourceMappingURL=workspace-access.js.map

package/lib/workspace-access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-access.js","sourceRoot":"","sources":["../src/workspace-access.ts"],"names":[],"mappings":"AAMA,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAmB,EAAE,IAAY,EAAE,QAAkC;IAC7G,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAyB,CAAA;IACtE,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,CAAC,aAAa,KAAK,UAAU;QAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAA;IACpF,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;IACzD,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;IACpD,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;IAC/D,OAAO,SAAS,CAAC,IAAI,CAAA;AACvB,CAAC"}

package/package.json

@@ -1,85 +1,94 @@
-{
-  "name": "@godv61/dsh-task-engine",
-  "version": "0.22.6",
-  "description": "Preset-workflow engineering delivery engine for DeepSeek Harness: a `dev_task` tool that hard-gates stage transitions and commit scope/message, per-node skill/rule bindings with progressive disclosure, a workbench to pick a flow preset and mount skills/rules, and preset-scoped activation — the tool and skills activate only for sessions on a preset that names the agent row.",
-  "type": "module",
-  "main": "lib/index.js",
-  "types": "lib/index.d.ts",
-  "bin": {
-    "dsh-task-engine-enable": "preset/enable.mjs"
-  },
-  "exports": {
-    ".": {
-      "types": "./lib/index.d.ts",
-      "default": "./lib/index.js"
-    },
-    "./agent": {
-      "types": "./lib/agent.d.ts",
-      "default": "./lib/agent.js"
-    },
-    "./client": {
-      "types": "./lib/client.d.ts",
-      "default": "./lib/client.js"
-    },
-    "./cordis.patch.yml": "./cordis.patch.yml",
-    "./defaults/eng.json": "./defaults/eng.json",
-    "./package.json": "./package.json"
-  },
-  "files": [
-    "lib/**",
-    "cordis.patch.yml",
-    "defaults/eng.json",
-    "hooks/**",
-    "skills/**",
-    "rules/**",
-    "preset/**",
-    "docs/**",
-    "README.md",
-    ".p0-test.mjs"
-  ],
-  "license": "MIT",
-  "publishConfig": {
-    "access": "public"
-  },
-  "dsh": {
-    "bundle": {
-      "patch": "./cordis.patch.yml"
-    },
-    "client": {
-      "platform": "web",
-      "inject": [
-        "@deepseek-ai/dsh-api-gateway"
-      ],
-      "external": []
-    }
-  },
-  "scripts": {
-    "build": "tsc -p tsconfig.json && node build-client.mjs && node build-hook.mjs",
-    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.client.json --noEmit",
-    "test": "node .p0-test.mjs",
-    "verify:package": "node scripts/verify-package.mjs",
-    "prepare": "npm run build"
-  },
-  "peerDependencies": {
-    "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-agent-presets": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-llm": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-tools": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-typert-protocol": "^0.1.2-rc.1"
-  },
-  "devDependencies": {
-    "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-agent-default-model": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-agent-presets": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-fs": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-llm": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-tools": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-typert-protocol": "^0.1.2-rc.1",
-    "@types/node": "^22.0.0",
-    "@types/react": "~18.3.1",
-    "esbuild": "^0.24.0",
-    "react": "^18.2.0",
-    "typescript": "^5.7.2",
-    "zod": "^3.23.8"
-  }
-}
+{
+  "name": "@godv61/dsh-task-engine",
+  "version": "0.23.0",
+  "description": "Preset-workflow engineering delivery engine for DeepSeek Harness: a `dev_task` tool that hard-gates stage transitions and commit scope/message, per-node skill/rule bindings with progressive disclosure, a workbench to pick a flow preset and mount skills/rules, and preset-scoped activation — the tool and skills activate only for sessions on a preset that names the agent row.",
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "bin": {
+    "dsh-task-engine-enable": "preset/enable.mjs"
+  },
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./agent": {
+      "types": "./lib/agent.d.ts",
+      "default": "./lib/agent.js"
+    },
+    "./client": {
+      "types": "./lib/client.d.ts",
+      "default": "./lib/client.js"
+    },
+    "./cordis.patch.yml": "./cordis.patch.yml",
+    "./defaults/eng.json": "./defaults/eng.json",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib/**",
+    "cordis.patch.yml",
+    "defaults/eng.json",
+    "hooks/**",
+    "skills/**",
+    "rules/**",
+    "preset/**",
+    "docs/**",
+    "README.md",
+    ".p0-test.mjs",
+    ".resource-test.mjs"
+  ],
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "inject": [
+        "@deepseek-ai/dsh-api-gateway"
+      ],
+      "external": []
+    }
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json && node build-client.mjs && node build-hook.mjs",
+    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.client.json --noEmit",
+    "test": "node .p0-test.mjs && node --test .resource-test.mjs",
+    "verify:package": "node scripts/verify-package.mjs",
+    "prepare": "npm run build"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.2",
+    "@deepseek-ai/dsh-agent-presets": "^0.1.2-rc.1 || ^0.1.3-alpha.1",
+    "@deepseek-ai/dsh-llm": "^0.1.2-rc.1 || ^0.1.3-alpha.1",
+    "@deepseek-ai/dsh-tools": "^0.1.2-rc.1 || ^0.1.3-alpha.1",
+    "@deepseek-ai/dsh-typert-protocol": "^0.1.2-rc.1 || ^0.1.3-alpha.1"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "^4.0.2",
+    "@deepseek-ai/dsh-agent-default-model": "^0.1.2-rc.1",
+    "@deepseek-ai/dsh-agent-presets": "^0.1.2-rc.1",
+    "@deepseek-ai/dsh-fs": "^0.1.2-rc.1",
+    "@deepseek-ai/dsh-llm": "^0.1.2-rc.1",
+    "@deepseek-ai/dsh-tools": "^0.1.2-rc.1",
+    "@deepseek-ai/dsh-typert-protocol": "^0.1.2-rc.1",
+    "@types/node": "^22.0.0",
+    "@types/react": "~18.3.1",
+    "esbuild": "^0.24.0",
+    "react": "^18.2.0",
+    "typescript": "^5.7.2",
+    "zod": "^3.23.8"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/godv61/dsh-task-engine.git"
+  },
+  "homepage": "https://github.com/godv61/dsh-task-engine#readme",
+  "bugs": {
+    "url": "https://github.com/godv61/dsh-task-engine/issues"
+  }
+}