@maxiaochao/pi-toolkit 0.8.1 → 0.8.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +4 -0
- package/package.json +1 -1
- package/skills/tapd/SKILL.md +12 -0
package/CHANGELOG.md
CHANGED
|
@@ -1,3 +1,7 @@
|
|
|
1
|
+
## 2026-09-24 - v0.8.2
|
|
2
|
+
|
|
3
|
+
- tapd skill: document the safe attachment-download flow for the short-lived signed URLs (re-fetch the URL for every attempt, download to .part with curl --fail --location --retry 3, reject text/error bodies before resuming, accept only 206 with a matching Content-Range, then verify size and zip integrity before renaming); it is a local addition on top of the `tapd skill init` output, recorded in AGENTS.md
|
|
4
|
+
|
|
1
5
|
## 2026-09-24 - v0.8.1
|
|
2
6
|
|
|
3
7
|
- lowercase the herdr skill name in its description and H1 (a deliberate local edit over the upstream v0.9.1 copy, now recorded in NOTICE, README and AGENTS.md); drop the stale `herdr --skill` pointer from the agent-team skill
|
package/package.json
CHANGED
package/skills/tapd/SKILL.md
CHANGED
|
@@ -280,6 +280,18 @@ tapd attachment download --id=<必需> # 获取附件下载链接
|
|
|
280
280
|
tapd attachment upload --custom-field=<必需> --entry-id=<必需> --file=<必需> --type=<如 story_custom_field> # 上传附件
|
|
281
281
|
```
|
|
282
282
|
|
|
283
|
+
#### 安全下载附件
|
|
284
|
+
|
|
285
|
+
`attachment download` 返回的是带短期授权 token 的临时 URL，不是附件内容。下载大附件时必须遵循以下流程：
|
|
286
|
+
|
|
287
|
+
1. 先用 `attachment list` 记录附件文件名和预期大小；每次发起下载或续传前，重新执行 `attachment download` 获取新 URL。
|
|
288
|
+
2. 下载到 `<文件名>.part`，使用 `curl --fail --location --retry 3`；HTTP 失败时立即停止，禁止把响应正文直接写入最终文件。
|
|
289
|
+
3. 续传前检查 `.part` 开头不是 `token expire`、JSON/HTML 错误信息等文本响应。发现污染时删除 `.part` 并重新下载，不修补或继续追加。
|
|
290
|
+
4. 使用新 URL 和 `curl -C -` 续传。已有部分长度为 N 时，只接受状态 `206` 且 `Content-Range` 从 N 开始；返回 `200`、范围不符或服务器不支持 Range 时，删除 `.part` 后从头下载。
|
|
291
|
+
5. 下载完成后，文件大小必须等于 `attachment list` 的预期大小。ZIP 附件还必须通过 `unzip -t`；其他格式执行相应完整性检查。全部通过后才将 `.part` 重命名为最终文件。
|
|
292
|
+
|
|
293
|
+
临时 URL 过期只需重新获取链接，不能据此判断 TAPD 原附件损坏。
|
|
294
|
+
|
|
283
295
|
### baseline — 基线管理
|
|
284
296
|
|
|
285
297
|
```bash
|