@morehao/dsh-skills-console 0.2.4 → 0.3.1

package/lib/core/skill-md.js

@@ -0,0 +1,49 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+/**
+ * SKILL.md 的极简 frontmatter 解析：只取安装与清单需要的 `name` / `description`，
+ * 不引入 YAML 依赖。支持 `|` / `>` 块与单/双引号，解析失败按“没有 frontmatter”处理。
+ *
+ * Service（探测补名）与 Installer（落盘发现）共用同一份实现，避免两处规则漂移。
+ */
+export function parseSkillFrontmatter(text) {
+  const match = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/.exec(String(text || ''));
+  if (!match) return {};
+  const lines = match[1].split(/\r?\n/);
+  const fields = {};
+  for (let index = 0; index < lines.length; index += 1) {
+    const line = lines[index];
+    if (!line || /^\s/.test(line)) continue;
+    const colon = line.indexOf(':');
+    if (colon <= 0) continue;
+    const key = line.slice(0, colon).trim();
+    if (key !== 'name' && key !== 'description') continue;
+    let value = line.slice(colon + 1).trim();
+    const block = /^([|>])[+-]?$/.exec(value);
+    if (block) {
+      const folded = block[1] === '>';
+      const rows = [];
+      while (index + 1 < lines.length && /^\s+/.test(lines[index + 1])) {
+        rows.push(lines[index + 1].replace(/^\s+/, ''));
+        index += 1;
+      }
+      value = folded ? rows.join(' ') : rows.join('\n');
+    } else if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) {
+      const quote = value[0];
+      value = value.slice(1, -1);
+      if (quote === '"') value = value.replace(/\\"/g, '"').replace(/\\n/g, '\n');
+    }
+    fields[key] = value.trim();
+  }
+  return fields;
+}
+
+/** 读取某目录下的 SKILL.md frontmatter；读不到或解析不出就返回空对象。 */
+export function readSkillFrontmatter(skillDir) {
+  try {
+    return parseSkillFrontmatter(fs.readFileSync(path.join(skillDir, 'SKILL.md'), 'utf8'));
+  } catch {
+    return {};
+  }
+}

package/lib/core/trash.js

@@ -42,13 +42,13 @@ export function newKey(skill) {
  * 备份落 `skills-console/backups/<key>/`，**绝不进 `skills/`**：
  * 任何含 `SKILL.md` 的子目录都会被原生当成技能扫到（F13）。
  */
-export function createBackup({ paths, skill, fromDir, hash = null }) {
+export function createBackup({ paths, skill, fromDir, hash = null, prune = true }) {
   const key = newKey(skill);
   const target = path.join(paths.backupsDir, key);
   copyTree(fromDir, path.join(target, 'content'));
   const meta = { key, skill, hash, from: fromDir, createdAt: new Date().toISOString() };
   fs.writeFileSync(path.join(target, 'meta.json'), `${JSON.stringify(meta, null, 2)}\n`, 'utf8');
-  pruneBackups({ paths });
+  if (prune) pruneBackups({ paths });
   return { key, dir: target, ...meta };
 }
 

package/lib/index.js

@@ -1,4 +1,4 @@
-import { createCli } from './core/cli.js';
+import { createInstaller } from './core/installer.js';
 import { createLogger } from './core/log.js';
 import { createPaths } from './core/paths.js';
 import { createRegistry } from './core/agents.js';
@@ -22,7 +22,7 @@ export function apply(ctx, config = {}) {
   if (store.readOnly) logger('state.readonly', { problem: store.problem });
 
   const registry = createRegistry({ paths, getState: () => store.state });
-  const cli = createCli({ env, logger });
+  const installer = createInstaller({ paths, env, logger });
 
   const visibleProvider = async (cwd) => {
     const skills = ctx.get('skills');
@@ -64,7 +64,7 @@ export function apply(ctx, config = {}) {
     paths,
     store,
     registry,
-    cli,
+    installer,
     logger,
     env,
     visibleProvider,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@morehao/dsh-skills-console",
-  "version": "0.2.4",
+  "version": "0.3.1",
   "description": "统一管理本地技能的安装、更新、删除与接入，让同一份技能在多个 Agent 间复用。A skill manager for DeepSeek Harness: install, update, remove, link and toggle agent skills.",
   "license": "MIT",
   "author": "morehao <morehao@qq.com>",
@@ -69,7 +69,7 @@
     "skills"
   ],
   "dependencies": {
-    "skills": "1.7.4"
+    "tar": "7.5.22"
   },
   "devDependencies": {
     "esbuild": "0.28.2"

package/lib/core/cli.js

@@ -1,256 +0,0 @@
-import { spawn } from 'node:child_process';
-import fs from 'node:fs';
-import path from 'node:path';
-import { createRequire } from 'node:module';
-
-const require = createRequire(import.meta.url);
-
-export class CliUnavailableError extends Error {
-  constructor(reason) {
-    super(reason || 'skills CLI not found');
-    this.code = 'error.skills.cli-missing';
-    this.reason = reason;
-  }
-}
-
-export class CliFailedError extends Error {
-  constructor(message, detail) {
-    super(message);
-    this.code = detail?.timedOut ? 'error.skills.cli-timeout' : 'error.skills.cli-failed';
-    this.detail = detail;
-  }
-}
-
-function isExecutable(file) {
-  try {
-    fs.accessSync(file, fs.constants.X_OK);
-    return fs.statSync(file).isFile();
-  } catch {
-    return false;
-  }
-}
-
-function findInPath(command, envPath) {
-  for (const dir of String(envPath || '').split(path.delimiter)) {
-    if (!dir) continue;
-    const candidate = path.join(dir, command);
-    if (isExecutable(candidate)) return candidate;
-  }
-  return null;
-}
-
-/**
- * CLI 定位顺序：显式覆盖 → 本插件依赖 → 宿主 profile → PATH → npx（legacy）。
- * 插件依赖排在 profile 前面：版本随插件锁死，不被 PATH 或别的插件带的旧版抢占。
- * 每一层都记来源，诊断页要展示"这次到底跑的哪一个"。
- */
-export function locateCli({
-  env = process.env,
-  logger = () => {},
-  resolvePackage = () => require.resolve('skills/package.json'),
-} = {}) {
-  const override = env.DSH_SKILLS_CONSOLE_CLI;
-  if (override && override.trim()) {
-    const parts = override.trim().split(/\s+/);
-    // 覆盖值可能是测试桩：仍然让 `add --help` 自己回答能力位，别替它猜
-    return { command: parts[0], prefixArgs: parts.slice(1), source: 'env-override', jsonCapable: true };
-  }
-
-  // 插件自己的 runtime 依赖：装插件时由宿主 pnpm 一起装好，用户不需要 Node/npm/npx。
-  try {
-    const pkg = resolvePackage();
-    const bin = path.join(path.dirname(pkg), 'bin', 'cli.mjs');
-    if (fs.existsSync(bin)) {
-      return { command: process.execPath, prefixArgs: [bin], source: 'dependency', jsonCapable: true };
-    }
-    // 包在但入口丢了，说明安装不完整；交给后面的层兜底，但要留痕
-    logger('cli.dependency.bin-missing', { pkg, bin });
-  } catch {
-    // 没装在本插件可见范围内（例如 link: 开发仓库还没 npm install），继续往下走
-  }
-
-  // 宿主 profile 里的 skills 依赖（兼容旧插件 / 其他插件已经带进来的版本）。
-  // 注意：GUI 启动的宿主进程常常拿不到 DSH_PROFILE_DIR，所以再按 DSH_HOME/profiles/* 兜一层探测。
-  const profileDir = env.DSH_PROFILE_DIR;
-  if (profileDir) {
-    const bin = path.join(profileDir, 'node_modules', 'skills', 'bin', 'cli.mjs');
-    if (fs.existsSync(bin)) {
-      return { command: process.execPath, prefixArgs: [bin], source: 'profile-dependency', jsonCapable: true };
-    }
-  }
-  const dshHome = env.DSH_HOME || path.join(env.HOME || '', '.dsh');
-  try {
-    const profiles = fs.readdirSync(path.join(dshHome, 'profiles'), { withFileTypes: true });
-    for (const entry of profiles) {
-      if (!entry.isDirectory()) continue;
-      const bin = path.join(dshHome, 'profiles', entry.name, 'node_modules', 'skills', 'bin', 'cli.mjs');
-      if (fs.existsSync(bin)) {
-        return { command: process.execPath, prefixArgs: [bin], source: `profile:${entry.name}`, jsonCapable: true };
-      }
-    }
-  } catch {
-    // 没有 profiles 目录就继续往下走
-  }
-
-  const onPath = findInPath('skills', env.PATH);
-  if (onPath) return { command: onPath, prefixArgs: [], source: 'path', jsonCapable: true };
-
-  const npx = findInPath('npx', env.PATH);
-  if (npx) {
-    const spec = env.DSH_SKILLS_CONSOLE_NPX_SPEC || 'skills';
-    return { command: npx, prefixArgs: ['-y', spec], source: 'npx', jsonCapable: true };
-  }
-
-  logger('cli.missing');
-  throw new CliUnavailableError('neither `skills` nor `npx` is on PATH');
-}
-
-/** 子进程封装：无 shell、argv 直传、硬超时、输出上限、非交互环境注入。 */
-export function runCli(location, args, { timeoutMs = 120000, signal, env = process.env, maxBytes = 4 * 1024 * 1024 } = {}) {
-  return new Promise((resolve, reject) => {
-    const child = spawn(location.command, [...location.prefixArgs, ...args], {
-      shell: false,
-      stdio: ['ignore', 'pipe', 'pipe'],
-      env: {
-        ...env,
-        // 桌面宿主本身就是 Electron 的 Node 模式；显式补上，避免调用方传了裁剪过的 env
-        ...(process.versions.electron && location.command === process.execPath ? { ELECTRON_RUN_AS_NODE: '1' } : {}),
-        CI: '1',
-        NO_COLOR: '1',
-        // CLI 的遥测只看这两个变量；CI=1 不会关闭，只会在上报里打 ci=1 标记
-        DO_NOT_TRACK: '1',
-        DISABLE_TELEMETRY: '1',
-        TERM: 'dumb',
-        GIT_TERMINAL_PROMPT: '0',
-        GIT_HTTP_LOW_SPEED_LIMIT: '1',
-        GIT_HTTP_LOW_SPEED_TIME: '30',
-      },
-    });
-
-    let stdout = '';
-    let stderr = '';
-    let timedOut = false;
-    let truncated = false;
-    const timer = setTimeout(() => {
-      timedOut = true;
-      child.kill('SIGKILL');
-    }, timeoutMs);
-    const onAbort = () => child.kill('SIGKILL');
-    if (signal) signal.addEventListener('abort', onAbort, { once: true });
-
-    child.stdout.on('data', (chunk) => {
-      if (stdout.length + chunk.length > maxBytes) {
-        truncated = true;
-        stdout += chunk.subarray(0, Math.max(0, maxBytes - stdout.length)).toString('utf8');
-        return;
-      }
-      stdout += chunk.toString('utf8');
-    });
-    child.stderr.on('data', (chunk) => {
-      if (stderr.length < 65536) stderr += chunk.toString('utf8');
-    });
-
-    child.on('error', (error) => {
-      clearTimeout(timer);
-      if (signal) signal.removeEventListener('abort', onAbort);
-      reject(new CliFailedError(error.message, { error }));
-    });
-
-    child.on('close', (code) => {
-      clearTimeout(timer);
-      if (signal) signal.removeEventListener('abort', onAbort);
-      resolve({ code, stdout, stderr, timedOut, truncated, args });
-    });
-  });
-}
-
-export function createCli({ env = process.env, logger = () => {}, resolvePackage } = {}) {
-  let cached = null;
-  let capabilities = null;
-
-  function location() {
-    if (!cached) cached = locateCli({ env, logger, resolvePackage });
-    return cached;
-  }
-
-  function call(args, options = {}) {
-    return runCli(location(), args, { env, ...options });
-  }
-
-  const api = {
-    location,
-    call,
-
-    async version() {
-      const result = await call(['--version']);
-      if (result.code !== 0) return null;
-      const match = result.stdout.trim().match(/\d+\.\d+\.\d+[\w.-]*/);
-      return match ? match[0] : null;
-    },
-
-    /** 能力位：`--json` 与 `--full-depth` 任一不支持都要在 UI 上禁用写操作（漏装比不可用更危险）。 */
-    async capabilities({ force = false } = {}) {
-      if (capabilities && !force) return capabilities;
-      let loc;
-      try {
-        loc = location();
-      } catch (error) {
-        if (!(error instanceof CliUnavailableError)) throw error;
-        // 不缓存：用户补好依赖 / PATH 后，下一次 /state 就能恢复，不必重启宿主；
-        // 同时清掉旧的成功缓存，避免 force 探测到 missing 后又回落到上一轮的 usable。
-        capabilities = null;
-        return { version: null, json: false, fullDepth: false, source: 'missing', usable: false };
-      }
-      if (!loc.jsonCapable) {
-        capabilities = { version: null, json: false, fullDepth: false, source: loc.source, usable: false };
-        return capabilities;
-      }
-      const version = await api.version();
-      const help = await call(['add', '--help']);
-      const text = `${help.stdout}\n${help.stderr}`;
-      capabilities = {
-        version,
-        json: text.includes('--json'),
-        fullDepth: text.includes('--full-depth'),
-        source: loc.source,
-        usable: Boolean(version) && text.includes('--json') && text.includes('--full-depth'),
-      };
-      logger('cli.capabilities', capabilities);
-      return capabilities;
-    },
-
-    /** 列已装技能（全局）。字段只有 F20 那几项，ref/skillPath/hash 必须另读 lock。 */
-    async listGlobal() {
-      const result = await call(['list', '--json', '-g']);
-      if (result.code !== 0) {
-        throw new CliFailedError(`skills list failed`, { stderr: result.stderr, code: result.code });
-      }
-      try {
-        const parsed = JSON.parse(result.stdout);
-        return Array.isArray(parsed) ? parsed : [];
-      } catch (error) {
-        throw new CliFailedError(`skills list returned non-JSON output`, { error: error.message });
-      }
-    },
-
-    /**
-     * 安装：`-a universal` 必带（F17），`--json` 配 `-y`（F11），`--full-depth` 必带（F24）。
-     * 技能名留空 = `--skill '*'`（整仓全部）；不能留空值的 `--skill`，那会把后面的 `-a` 当成它的参数。
-     * 永不带 `--all` / `-a '*'`。
-     */
-    async add({ source, skills = [], timeoutMs = env.DSH_SKILLS_CONSOLE_TIMEOUT_MS ? Number(env.DSH_SKILLS_CONSOLE_TIMEOUT_MS) : 120000 }) {
-      const names = skills.length > 0 ? skills : ['*'];
-      const args = ['add', source, '--skill', ...names, '-a', 'universal', '-g', '-y', '--json', '--full-depth'];
-      const result = await call(args, { timeoutMs });
-      return result;
-    },
-
-    /** 卸载：绝不带 `-a`（带上反而删不掉真身），没有 `--json`，结论以磁盘核对为准。 */
-    async remove({ names = [], timeoutMs = 120000 }) {
-      const args = ['remove', '-s', ...names, '-g', '-y'];
-      return call(args, { timeoutMs });
-    },
-  };
-
-  return api;
-}

package/lib/core/git.js

@@ -1,282 +0,0 @@
-import { spawn } from 'node:child_process';
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-
-/**
- * 只读 git 通道：`ls-remote` 拿默认分支与 HEAD，`clone --filter=blob:none --no-checkout` +
- * `ls-tree` 拿整树。**不占 GitHub REST 配额**，也不需要 token / gh —— 这是「出口 IP 被
- * 匿名配额打死」时唯一还通的路。
- *
- * 硬约束（见 AGENTS.md「数据边界」）：
- * - 只读：只在 `os.tmpdir()` 里建临时仓库，`finally` 必删；不碰 canonical、不碰 lock；
- * - 不接受任意 URL：只认 `https://github.com/<owner>/<repo>.git`（由 `repoUrl` 从
- *   `parseSource` 的产物重建），拒绝以 `-` 开头的 ref（防 argv 注入成选项）；
- * - 零依赖：只用 node:child_process / node:fs / node:os / node:path。
- */
-
-const DEFAULT_TIMEOUT_MS = 60_000;
-const VERSION_TIMEOUT_MS = 10_000;
-const MAX_STDOUT = 8 * 1024 * 1024;
-const MAX_STDERR = 64 * 1024;
-const TMP_PREFIX = 'dsh-skills-git-';
-const REPO_URL_RE = /^https:\/\/github\.com\/[\w.-]+\/[\w.-]+\.git$/;
-const COMMIT_RE = /^[0-9a-f]{40}$/;
-// 分支/tag 名：足够覆盖真实用法，同时排除以 `-` 开头（会被 git 当成选项）
-const REF_RE = /^[\w][\w./-]{0,254}$/;
-
-/** `kind` 供上层决定是否回退 REST：`git-missing` / `git-timeout` / `auth` / `clone-failed` / `invalid-url`。 */
-export class GitError extends Error {
-  constructor(kind, message, detail) {
-    super(message);
-    this.name = 'GitError';
-    this.kind = kind;
-    this.detail = detail || null;
-  }
-}
-
-/** 从 `owner/repo`（`parseSource` 的产物）重建 URL，再做一次白名单断言。 */
-export function repoUrl(source) {
-  const match = /^([\w.-]+)\/([\w.-]+)$/.exec(String(source || '').trim());
-  if (!match) throw new GitError('invalid-url', `不是 owner/repo 形态：${source}`);
-  const repo = match[2].replace(/\.git$/, '');
-  const url = `https://github.com/${match[1]}/${repo}.git`;
-  if (!REPO_URL_RE.test(url)) throw new GitError('invalid-url', `拒绝不安全的仓库地址：${url}`);
-  return url;
-}
-
-function assertUrl(url) {
-  if (typeof url !== 'string' || !REPO_URL_RE.test(url)) {
-    throw new GitError('invalid-url', `拒绝不安全的仓库地址：${url}`);
-  }
-}
-
-function assertRef(ref) {
-  if (typeof ref !== 'string' || !(REF_RE.test(ref) || COMMIT_RE.test(ref))) {
-    throw new GitError('invalid-url', `拒绝不安全的 ref：${ref}`);
-  }
-}
-
-function withDefaults(env) {
-  return {
-    ...env,
-    // 私有仓库 / 需要凭据时立刻失败，绝不卡在交互提示上
-    GIT_TERMINAL_PROMPT: '0',
-    GIT_HTTP_LOW_SPEED_LIMIT: '1',
-    GIT_HTTP_LOW_SPEED_TIME: '30',
-    LC_ALL: 'C',
-  };
-}
-
-/** 子进程封装：无 shell、argv 直传、硬超时 SIGKILL、stdout 上限。永不 reject。 */
-function runGit(args, { cwd, timeoutMs = DEFAULT_TIMEOUT_MS, env = process.env } = {}) {
-  return new Promise((resolve) => {
-    let settled = false;
-    const finish = (result) => {
-      if (settled) return;
-      settled = true;
-      resolve(result);
-    };
-    let child;
-    try {
-      child = spawn('git', args, {
-        cwd,
-        shell: false,
-        stdio: ['ignore', 'pipe', 'pipe'],
-        env: withDefaults(env),
-      });
-    } catch (error) {
-      finish({ spawnError: error, code: null, stdout: '', stderr: '', timedOut: false, args });
-      return;
-    }
-    let stdout = '';
-    let stderr = '';
-    let timedOut = false;
-    const timer = setTimeout(() => {
-      timedOut = true;
-      child.kill('SIGKILL');
-      // 孙进程（git-remote-https 之类）可能还握着管道：不等它们退出，直接判超时
-      child.stdout?.destroy();
-      child.stderr?.destroy();
-      finish({ code: null, stdout, stderr, timedOut: true, args });
-    }, timeoutMs);
-    child.stdout.on('data', (chunk) => {
-      if (stdout.length >= MAX_STDOUT) return;
-      stdout += chunk.toString('utf8').slice(0, MAX_STDOUT - stdout.length);
-    });
-    child.stderr.on('data', (chunk) => {
-      if (stderr.length < MAX_STDERR) stderr += chunk.toString('utf8');
-    });
-    child.on('error', (error) => {
-      clearTimeout(timer);
-      finish({ spawnError: error, code: null, stdout, stderr, timedOut, args });
-    });
-    child.on('close', (code) => {
-      clearTimeout(timer);
-      finish({ code, stdout, stderr, timedOut, args });
-    });
-  });
-}
-
-/** 退出码非 0 → 分类。`auth` 涵盖「私有仓库 / 凭据不对 / 仓库不存在」这几种 git 都只说一句话的情况。 */
-function toGitError(result, fallbackMessage = 'git 失败') {
-  if (result.spawnError) {
-    return new GitError('git-missing', result.spawnError.message, { code: result.spawnError.code || null });
-  }
-  if (result.timedOut) {
-    return new GitError('git-timeout', `git ${result.args?.[0] || ''} 超时`, { args: result.args || [] });
-  }
-  const stderr = String(result.stderr || '').trim();
-  if (
-    /authentication failed|could not read username|terminal prompts disabled|permission denied|repository[^\n]*not found|invalid username or password|access denied/i.test(
-      stderr,
-    )
-  ) {
-    return new GitError('auth', stderr.slice(-400) || '认证失败', { code: result.code ?? null });
-  }
-  return new GitError('clone-failed', (stderr || fallbackMessage).slice(-400), { code: result.code ?? null });
-}
-
-/** `git --version` 探测。没有 git 的环境本来也装不了技能，回退 REST 即可。 */
-export async function gitAvailable({ env = process.env, timeoutMs = VERSION_TIMEOUT_MS } = {}) {
-  const result = await runGit(['--version'], { env, timeoutMs });
-  if (result.spawnError || result.timedOut || result.code !== 0) return false;
-  return /git version \d+/.test(result.stdout);
-}
-
-/** `git ls-remote --symref <url> HEAD` → `{ branch, commit }`。零配额拿默认分支 + HEAD。 */
-export async function lsRemote({ url, env = process.env, timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
-  assertUrl(url);
-  const result = await runGit(['ls-remote', '--symref', url, 'HEAD'], { env, timeoutMs });
-  if (result.spawnError || result.timedOut || result.code !== 0) throw toGitError(result, 'ls-remote 失败');
-  let branch = null;
-  let commit = null;
-  for (const raw of result.stdout.split('\n')) {
-    const line = raw.trim();
-    if (!line) continue;
-    if (line.startsWith('ref:')) {
-      const symref = /^ref:\s+refs\/heads\/(\S+)\s+HEAD$/.exec(line);
-      if (symref) branch = symref[1];
-      continue;
-    }
-    const head = /^([0-9a-f]{40})\s+HEAD$/.exec(line);
-    if (head) commit = head[1];
-  }
-  if (!commit) throw new GitError('clone-failed', 'ls-remote 没有返回 HEAD 指向的 commit');
-  return { branch, commit };
-}
-
-/** `git ls-tree -r -t -z` 的输出 → `[{ type, path, sha }]`，与 Trees API 同形。 */
-export function parseTreeEntries(stdout) {
-  const entries = [];
-  for (const record of String(stdout || '').split('\0')) {
-    if (!record) continue;
-    // 默认格式：`<mode> <type> <sha>\t<path>`；路径里的空格/中文都靠 tab 定位，不会被切错
-    const tab = record.indexOf('\t');
-    if (tab < 0) continue;
-    const meta = record.slice(0, tab).split(' ');
-    const type = meta[1];
-    if (type !== 'blob' && type !== 'tree') continue;
-    entries.push({ type, path: record.slice(tab + 1), sha: meta[2] });
-  }
-  return entries;
-}
-
-/**
- * `git clone --depth 1 --filter=blob:none --no-checkout` + `ls-tree` → `{ entries, rootSha, commit }`。
- * 临时目录用完必删；容器型 `<ref>`（commit SHA）走 fetch，分支/tag 走 `--branch`。
- * `tmpRoot` 只是给测试一个隔离的临时目录根，生产走 `os.tmpdir()`。
- */
-export async function lsTree({ url, ref = 'HEAD', env = process.env, timeoutMs = DEFAULT_TIMEOUT_MS, tmpRoot = os.tmpdir() } = {}) {
-  assertUrl(url);
-  assertRef(ref);
-  const isCommit = COMMIT_RE.test(ref);
-  fs.mkdirSync(tmpRoot, { recursive: true });
-  const dir = fs.mkdtempSync(path.join(tmpRoot, TMP_PREFIX));
-  const base = ['clone', '--depth', '1', '--no-checkout', '--quiet'];
-  const cloneArgs = [...base, '--filter=blob:none'];
-  if (!isCommit) cloneArgs.push('--branch', ref);
-  cloneArgs.push(url, dir);
-
-  try {
-    let cloned = await runGit(cloneArgs, { env, timeoutMs });
-    // 老 git（< 2.19）不认 --filter：去掉再试一次（慢一点，但能用）
-    if ((cloned.spawnError || cloned.timedOut || cloned.code !== 0) && /filter/i.test(cloned.stderr || '')) {
-      const retry = [...base];
-      if (!isCommit) retry.push('--branch', ref);
-      retry.push(url, dir);
-      cloned = await runGit(retry, { env, timeoutMs });
-    }
-    if (cloned.spawnError || cloned.timedOut || cloned.code !== 0) throw toGitError(cloned, 'clone 失败');
-
-    // HEAD 对应的 commit：分支/tag 克隆时是 HEAD，commit 形态直接用它自己
-    const revTarget = isCommit ? `${ref}^{commit}` : 'HEAD^{commit}';
-    let rev = await runGit(['-C', dir, 'rev-parse', '--verify', revTarget], { env, timeoutMs });
-    if (rev.code !== 0 && isCommit) {
-      // 默认分支的浅克隆里可能没有这个 commit：单独取一次
-      await runGit(['-C', dir, 'fetch', '--depth', '1', '--quiet', url, ref], { env, timeoutMs });
-      rev = await runGit(['-C', dir, 'rev-parse', '--verify', revTarget], { env, timeoutMs });
-    }
-    const commit = rev.code === 0 ? rev.stdout.trim() : '';
-    if (!COMMIT_RE.test(commit)) throw toGitError(rev, 'rev-parse 拿不到 commit');
-
-    const treeRev = await runGit(['-C', dir, 'rev-parse', '--verify', `${commit}^{tree}`], { env, timeoutMs });
-    const rootSha = treeRev.code === 0 ? treeRev.stdout.trim() : '';
-    if (!COMMIT_RE.test(rootSha)) throw toGitError(treeRev, 'rev-parse 拿不到根 tree');
-
-    const listed = await runGit(['-C', dir, 'ls-tree', '-r', '-t', '-z', commit], { env, timeoutMs });
-    if (listed.code !== 0) throw toGitError(listed, 'ls-tree 失败');
-    return { entries: parseTreeEntries(listed.stdout), rootSha, commit };
-  } finally {
-    if (dir.includes(TMP_PREFIX)) fs.rmSync(dir, { recursive: true, force: true });
-  }
-}
-
-/**
- * 服务实例用的封装：进程内缓存 `git --version` 结论与 `(url, ref)` 的整树
- * （一个仓库装多个技能时只 clone 一次），并统一读 `DSH_SKILLS_CONSOLE_GIT*`。
- */
-export function createGit({ env = process.env, logger = () => {} } = {}) {
-  const TREE_TTL_MS = 60_000;
-  const TREE_MAX = 20;
-  const trees = new Map();
-  let available = null;
-
-  const enabled = () => String(env.DSH_SKILLS_CONSOLE_GIT || '').trim().toLowerCase() !== 'off';
-  const timeoutMs = () => {
-    const value = Number(env.DSH_SKILLS_CONSOLE_GIT_TIMEOUT_MS);
-    return Number.isFinite(value) && value > 0 ? value : DEFAULT_TIMEOUT_MS;
-  };
-
-  async function isAvailable() {
-    if (!enabled()) return false;
-    if (available === null) available = await gitAvailable({ env, timeoutMs: Math.min(timeoutMs(), VERSION_TIMEOUT_MS) });
-    if (!available) logger('git.missing');
-    return available;
-  }
-
-  async function tree({ url, ref }) {
-    const key = `${url}@${ref}`;
-    const cached = trees.get(key);
-    if (cached && Date.now() - cached.at < TREE_TTL_MS) return cached.value;
-    const value = await lsTree({ url, ref, env, timeoutMs: timeoutMs() });
-    trees.set(key, { value, at: Date.now() });
-    for (const oldest of trees.keys()) {
-      if (trees.size <= TREE_MAX) break;
-      trees.delete(oldest);
-    }
-    return value;
-  }
-
-  return {
-    enabled,
-    isAvailable,
-    timeoutMs,
-    url: repoUrl,
-    lsRemote: (options = {}) => lsRemote({ ...options, env, timeoutMs: options.timeoutMs || timeoutMs() }),
-    tree,
-    clearCache() {
-      trees.clear();
-    },
-  };
-}