@michengai/dsh-skills-manager 0.1.20 → 0.1.22

package/README.md

@@ -115,7 +115,7 @@ dsh plugin --profile web add @michengai/dsh-skills-manager@latest --registry=htt
 dsh --profile web --dump-config
 ```
 
-To pin a release, replace `@latest` with a version such as `@0.1.20`.
+To pin a release, replace `@latest` with a version such as `@0.1.22`.
 
 The configuration output should contain `skills-manager`. Restart DSH Web and hard-refresh the browser. Do not copy client files manually: `dsh plugin add` also applies `cordis.patch.yml`.
 

package/README.zh-CN.md

@@ -115,7 +115,7 @@ dsh plugin --profile web add @michengai/dsh-skills-manager@latest --registry=htt
 dsh --profile web --dump-config
 ```
 
-需要钉死某一版时，把 `@latest` 换成具体版本，例如 `@0.1.20`。
+需要钉死某一版时，把 `@latest` 换成具体版本，例如 `@0.1.22`。
 
 配置输出中应包含 `skills-manager`。安装后重启 DSH Web 并在浏览器硬刷新。不要手工复制客户端文件，`dsh plugin add` 会同时应用 `cordis.patch.yml`。
 

package/lib/client.js

@@ -593,6 +593,7 @@ window.__ModuleLoader__.load({
           inflightRef.current = false;
           setBusy(null);
           setUploadOpen(false);
+          setSelected(null);
           setImportResult({ error: error });
         });
       }

package/lib/core.js

@@ -95,9 +95,9 @@ async function pathsOverlap(a, b) {
   return isSameOrDescendant(left, right) || isSameOrDescendant(right, left);
 }
 
-/** 真实落地路径必须仍在技能根内，避免符号链接写出根外。 */
-async function isInsideRoot(root, path) {
-  return isSameOrDescendant(await resolvedPath(root), await resolvedPath(path));
+/** 预解析技能根后的根内校验，供逐条目扫描复用同一次 realpath，减少重复 IO。 */
+async function isInsideResolvedRoot(rootReal, path) {
+  return isSameOrDescendant(rootReal, await resolvedPath(path));
 }
 
 async function lstatOrNull(path) {
@@ -248,18 +248,19 @@ export async function resolveEntry(root, name) {
   const bundlePath = entryPath(root, name);
   if (bundlePath === null) return null;
   const rootPath = resolve(root);
+  const rootReal = await resolvedPath(rootPath);
   const bundleStat = await lstatOrNull(bundlePath);
   if (bundleStat && bundleStat.isDirectory() && !bundleStat.isSymbolicLink()) {
     const bundleDoc = join(bundlePath, "SKILL.md");
     const docStat = await lstatOrNull(bundleDoc);
-    if (docStat && docStat.isFile() && !docStat.isSymbolicLink() && await isInsideRoot(rootPath, bundleDoc)) {
+    if (docStat && docStat.isFile() && !docStat.isSymbolicLink() && await isInsideResolvedRoot(rootReal, bundleDoc)) {
       return { kind: "bundle", docPath: bundleDoc, entryPath: bundlePath };
     }
   }
   const flatDoc = resolve(rootPath, `${name}.md`);
   if (!isSameOrDescendant(rootPath, flatDoc) || rootPath === flatDoc) return null;
   const flatStat = await lstatOrNull(flatDoc);
-  if (flatStat && flatStat.isFile() && !flatStat.isSymbolicLink() && await isInsideRoot(rootPath, flatDoc)) {
+  if (flatStat && flatStat.isFile() && !flatStat.isSymbolicLink() && await isInsideResolvedRoot(rootReal, flatDoc)) {
     return { kind: "flat", docPath: flatDoc, entryPath: flatDoc };
   }
   return null;
@@ -292,20 +293,21 @@ export async function scanEntries(root) {
     return { exists: false, entries: [] };
   }
   const byName = new Map();
+  const rootReal = await resolvedPath(root);
   for (const it of items) {
     try {
       if (it.isSymbolicLink()) continue;
       if (it.isDirectory() && entryPath(root, it.name) !== null) {
         const docPath = join(root, it.name, "SKILL.md");
         const st = await lstatOrNull(docPath);
-        if (!st || !st.isFile() || st.isSymbolicLink() || !(await isInsideRoot(root, docPath))) continue;
+        if (!st || !st.isFile() || st.isSymbolicLink() || !(await isInsideResolvedRoot(rootReal, docPath))) continue;
         const doc = parseSkillDoc(await fs.readFile(docPath, "utf8"));
         byName.set(it.name, entryOf(it.name, "bundle", docPath, doc));
       } else if (it.isFile() && it.name.toLowerCase().endsWith(".md") && it.name.toLowerCase() !== "skill.md" && entryPath(root, it.name.slice(0, -3)) !== null) {
         const skillName = it.name.slice(0, -3);
         if (byName.has(skillName)) continue;
         const docPath = join(root, it.name);
-        if (!(await isInsideRoot(root, docPath))) continue;
+        if (!(await isInsideResolvedRoot(rootReal, docPath))) continue;
         const doc = parseSkillDoc(await fs.readFile(docPath, "utf8"));
         byName.set(skillName, entryOf(skillName, "flat", docPath, doc));
       }
@@ -341,10 +343,9 @@ export async function deleteSkill(root, name, log) {
   const alternatePath = resolved.kind === "bundle" ? resolve(root, `${name}.md`) : bundlePath;
   const alternateDocPath = resolved.kind === "bundle" ? alternatePath : join(alternatePath, "SKILL.md");
   const targets = [{ path: resolved.entryPath, recursive: resolved.kind === "bundle" }];
-  try {
-    const st = await fs.stat(alternateDocPath);
-    if (st.isFile()) targets.push({ path: alternatePath, recursive: resolved.kind !== "bundle" });
-  } catch {}
+  // 链接形态的伴随条目也要清理本体；fs.rm 只删除链接本身，不会跟随写到根外。
+  const alternateStat = await lstatOrNull(alternateDocPath);
+  if (alternateStat && (alternateStat.isFile() || alternateStat.isSymbolicLink())) targets.push({ path: alternatePath, recursive: resolved.kind !== "bundle" });
   for (const target of targets) await fs.rm(target.path, { recursive: target.recursive, force: true });
   if (log) log("delete", `删除 ${targets.map((target) => target.path).join("、")}`);
   return { name };
@@ -362,13 +363,13 @@ async function analyzeSource(source) {
   }
   if (st.isSymbolicLink()) return { kind: "none", error: `不支持包含符号链接的 skill 来源: ${source}`, code: "error.source.symlink", params: { path: source } };
   if (st.isDirectory()) {
-    try {
-      const sk = join(source, "SKILL.md");
-      const skSt = await fs.stat(sk);
-      if (skSt.isFile()) {
-        return { kind: "single", rawName: basename(source), kebab: toKebab(basename(source)), source, isDir: true, skillFile: sk };
-      }
-    } catch {}
+    const sk = join(source, "SKILL.md");
+    const skSt = await lstatOrNull(sk);
+    // 预检与实际导入口径一致：SKILL.md 本身是链接时直接拒绝，避免 dry-run 通过、正式导入才失败。
+    if (skSt && skSt.isSymbolicLink()) return { kind: "none", error: `不支持包含符号链接的 skill 来源: ${sk}`, code: "error.source.symlink", params: { path: sk } };
+    if (skSt && skSt.isFile()) {
+      return { kind: "single", rawName: basename(source), kebab: toKebab(basename(source)), source, isDir: true, skillFile: sk };
+    }
     return { kind: "batch", rawName: basename(source), source, isDir: true };
   }
   if (st.isFile() && source.toLowerCase().endsWith(".md")) {
@@ -387,18 +388,16 @@ async function collectCandidates(dir) {
   const out = [];
   for (const it of items) {
     if (it.isSymbolicLink()) throw codedError(`不支持包含符号链接的 skill 来源: ${join(dir, it.name)}`, "error.source.symlink", { path: join(dir, it.name) });
-    try {
-      if (it.isDirectory()) {
-        const sk = join(dir, it.name, "SKILL.md");
-        const st = await fs.stat(sk);
-        if (st.isFile()) {
-          out.push({ source: join(dir, it.name), kebab: toKebab(it.name), rawName: it.name, isDir: true });
-        }
-      } else if (it.isFile() && it.name.toLowerCase().endsWith(".md") && it.name.toLowerCase() !== "skill.md") {
-        out.push({ source: join(dir, it.name), kebab: toKebab(it.name.slice(0, -3)), rawName: it.name.slice(0, -3), isDir: false });
+    if (it.isDirectory()) {
+      const sk = join(dir, it.name, "SKILL.md");
+      // lstatOrNull 吞掉 IO 异常（返回 null 即跳过）；symlink 必须抛出，不能被“跳过”逻辑掩盖。
+      const st = await lstatOrNull(sk);
+      if (st && st.isSymbolicLink()) throw codedError(`不支持包含符号链接的 skill 来源: ${sk}`, "error.source.symlink", { path: sk });
+      if (st && st.isFile()) {
+        out.push({ source: join(dir, it.name), kebab: toKebab(it.name), rawName: it.name, isDir: true });
       }
-    } catch {
-      /* 跳过 */
+    } else if (it.isFile() && it.name.toLowerCase().endsWith(".md") && it.name.toLowerCase() !== "skill.md") {
+      out.push({ source: join(dir, it.name), kebab: toKebab(it.name.slice(0, -3)), rawName: it.name.slice(0, -3), isDir: false });
     }
   }
   return out;
@@ -426,6 +425,22 @@ function temporaryPath(target, kind) {
   return join(dirname(target), `.${basename(target)}.dssm-${kind}-${randomUUID()}`);
 }
 
+/** dry-run 预检执行与正式导入相同的符号链接/深度检查，预检失败即结论，不再进入覆盖确认。
+ *  预检与实导之间来源被替换的竞态仍由实导阶段的复制后校验兜底。 */
+async function preflightCandidates(pending, conflicts, failed) {
+  for (const group of [pending, conflicts]) {
+    for (let i = group.length - 1; i >= 0; i--) {
+      const candidate = group[i];
+      try {
+        await assertNoSymbolicLinks(candidate.source);
+      } catch (error) {
+        failed.push(attachCode({ source: candidate.source, error: String(error && error.message ? error.message : error) }, error));
+        group.splice(i, 1);
+      }
+    }
+  }
+}
+
 /** 先复制到同目录临时路径，复制失败时不触碰现有技能。 */
 async function copyToTemporary(source, target, isDir) {
   const temp = temporaryPath(target, "stage");
@@ -565,7 +580,9 @@ export async function importSkill(source, log, options = {}) {
   if (pending.length === 0 && conflicts.length === 0) return failureResult();
 
   if (dryRun) {
-    if (failed.length && pending.length === 0 && conflicts.length === 0) return failureResult();
+    // 预检即结论：与正式导入同口径执行符号链接/深度检查，避免预检通过、确认覆盖后实导才失败。
+    await preflightCandidates(pending, conflicts, failed);
+    if (pending.length === 0 && conflicts.length === 0) return failureResult();
     return { kind: analysis.kind, pending, conflicts, failed };
   }
 

package/lib/index.js

@@ -90,7 +90,7 @@ function validateMutationRequest(req) {
   return null;
 }
 
-function json(res, code, payload) {
+function json(res, code, payload, headOnly) {
   if (!res || res.writableEnded || res.destroyed) return;
   res.once("error", () => {});
   try {
@@ -99,23 +99,24 @@ function json(res, code, payload) {
       "content-type": "application/json; charset=utf-8",
       "content-length": Buffer.byteLength(body),
     });
-    res.end(body);
+    // HEAD 按 RFC 语义返回与实体一致的 content-length，但不输出 body。
+    res.end(headOnly ? undefined : body);
   } catch {
     /* 客户端已断开 */
   }
 }
 
 /** 成功统一包成 { ok: true, data }；核心返回 { ok:false, error } 时透传为 400。 */
-function run(res, task, afterSuccess) {
+function run(res, task, afterSuccess, headOnly) {
   return Promise.resolve().then(task).then((r) => {
-    if (r && r.ok === false) json(res, 400, r);
+    if (r && r.ok === false) json(res, 400, r, headOnly);
     else {
       try {
         if (afterSuccess) afterSuccess();
       } catch {
         /* 目录刷新失败不影响已完成的文件操作 */
       }
-      json(res, 200, { ok: true, data: r });
+      json(res, 200, { ok: true, data: r }, headOnly);
     }
   }).catch((e) => {
     try {
@@ -123,7 +124,7 @@ function run(res, task, afterSuccess) {
         ok: false,
         ...(e && e.code ? { code: e.code } : {}),
         error: String(e && e.message ? e.message : e),
-      });
+      }, headOnly);
     } catch {
       /* response already closed */
     }
@@ -197,12 +198,9 @@ function apply(ctx) {
           return run(res, state);
         }
         if (req.method === "HEAD") {
-          res.writeHead(path === "/api/dsh-skills-manager/state" ? 200 : 405, {
-            "content-type": "application/json; charset=utf-8",
-            "content-length": 0,
-            allow: "GET, HEAD, POST",
-          });
-          res.end();
+          // HEAD 复用 GET/405 的载荷计算 content-length，保持与实体一致的响应头语义。
+          if (path === "/api/dsh-skills-manager/state") return run(res, state, undefined, true);
+          json(res, 405, { ok: false, code: "error.proto.method", error: `method not allowed: ${req.method}` }, true);
           return;
         }
         if (req.method !== "POST") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@michengai/dsh-skills-manager",
-  "version": "0.1.20",
+  "version": "0.1.22",
   "description": "NPM-installable DSH Web plugin for managing local skills and viewing shared Agent skills safely.",
   "license": "Apache-2.0",
   "repository": {