@morehao/dsh-skills-console 0.4.0 → 0.5.1

package/lib/core/remote.js

@@ -190,7 +190,14 @@ export async function snapshotFromTarball({
       } catch (error) {
         throw new RemoteError('scan-failed', `计算 ${skill.name} tree 失败: ${error.message}`, { cause: error });
       }
-      entries.push({ name: skill.name, skillPath: skill.skillPath, treeSha });
+      entries.push({
+        name: skill.name,
+        skillPath: skill.skillPath,
+        treeSha,
+        // 订阅条目在界面上还要用一行原文描述帮用户决定装不装：只是 frontmatter 里作者自己的话，
+        // 不调模型、也不进提示词；截断避免 state.json 被超长描述撑大。
+        description: typeof skill.description === 'string' ? skill.description.slice(0, 600) : '',
+      });
       const dir = skillDirOf(skill.skillPath);
       if (dir && !seenDirs.has(dir)) {
         seenDirs.add(dir);
@@ -332,3 +339,98 @@ export async function downloadTarball({
     if (timer) clearTimeout(timer);
   }
 }
+
+// ---- 订阅候选的 SKILL.md（AI 介绍用） -------------------------------------
+// 只读单个文件、只允许 raw.githubusercontent.com；按 commit 读取，避免分支移动导致内容漂移。
+
+export const REMOTE_SKILL_MD_MAX_BYTES = 512 * 1024;
+export const REMOTE_SKILL_MD_TIMEOUT_MS = 20_000;
+const COMMIT_SHA = /^[0-9a-f]{40}$/i;
+
+/** 技能文件路径校验：快照里的 skillPath 也不盲信，逐段拒绝越界与特殊字符。 */
+function assertSkillFilePath(skillPath) {
+  if (typeof skillPath !== 'string' || skillPath.length === 0 || skillPath.length > 400) {
+    throw new RemoteError('intro-source-failed', '技能路径非法');
+  }
+  if (skillPath.startsWith('/') || skillPath.includes('\\') || /^[A-Za-z]:/.test(skillPath)) {
+    throw new RemoteError('intro-source-failed', `技能路径不是仓库内相对路径: ${skillPath}`);
+  }
+  // eslint-disable-next-line no-control-regex
+  if (/[\u0000-\u001f]/.test(skillPath)) {
+    throw new RemoteError('intro-source-failed', '技能路径含控制字符');
+  }
+  const segments = skillPath.split('/');
+  if (segments.some((segment) => segment === '' || segment === '.' || segment === '..')) {
+    throw new RemoteError('intro-source-failed', `技能路径含非法段: ${skillPath}`);
+  }
+  return segments.map(encodeURIComponent).join('/');
+}
+
+/**
+ * 读订阅快照里某个技能的 `SKILL.md`（用于按需生成能力介绍）。
+ *
+ * - `ref` 必须是快照里的 40 位 commit：订阅页的「介绍」要可复现，不能读会移动的分支；
+ * - 只允许 GitHub 的 raw host，路径由服务端从快照反查后传入，不接受客户端拼路径；
+ * - 大小 / 超时都有上限，超限抛 RemoteError，由 Service 转成 4xx/5xx。
+ *
+ * @returns {Promise<{ text: string, bytes: number, source: string, ref: string, skillPath: string }>}
+ */
+export async function fetchRemoteSkillMd({
+  source,
+  ref,
+  skillPath,
+  token = null,
+  fetchImpl = fetch,
+  maxBytes = REMOTE_SKILL_MD_MAX_BYTES,
+  timeoutMs = REMOTE_SKILL_MD_TIMEOUT_MS,
+}) {
+  const parsed = parseSource(source);
+  if (!parsed) throw new RemoteError('invalid-source', `不是 GitHub 来源: ${source}`);
+  if (typeof ref !== 'string' || !COMMIT_SHA.test(ref)) {
+    throw new RemoteError('invalid-ref', '订阅介绍必须按 40 位 commit 读取');
+  }
+  const repo = `${parsed.owner}/${parsed.repo}`;
+  const relPath = assertSkillFilePath(skillPath);
+  const url = `https://raw.githubusercontent.com/${parsed.owner}/${parsed.repo}/${ref.toLowerCase()}/${relPath}`;
+
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const response = await fetchImpl(url, {
+      headers: {
+        'user-agent': 'dsh-skills-console',
+        accept: 'text/plain, text/markdown;q=0.9, */*;q=0.1',
+        ...(token ? { authorization: `Bearer ${token}` } : {}),
+      },
+      signal: controller.signal,
+    });
+    if (!response?.ok) {
+      throw new RemoteError(
+        'intro-source-failed',
+        `读不到 ${repo}@${ref.slice(0, 7)} 的 ${skillPath}（HTTP ${response?.status ?? '?'}）`,
+        { status: response?.status ?? null },
+      );
+    }
+    const text = await response.text();
+    const bytes = Buffer.byteLength(text, 'utf8');
+    if (bytes > maxBytes) {
+      throw new RemoteError(
+        'intro-source-too-large',
+        `${repo}@${ref.slice(0, 7)} 的 ${skillPath} 太大（${bytes} 字节），无法作为介绍素材`,
+        { bytes, maxBytes },
+      );
+    }
+    if (!text.trim()) throw new RemoteError('intro-source-failed', `${repo} 的 ${skillPath} 是空文件`);
+    return { text, bytes, source: repo, ref: ref.toLowerCase(), skillPath };
+  } catch (error) {
+    if (error instanceof RemoteError) throw error;
+    if (controller.signal.aborted) {
+      throw new RemoteError('intro-source-timeout', `读取 ${repo} 的 SKILL.md 超时（${timeoutMs}ms）`, { cause: error });
+    }
+    throw new RemoteError('intro-source-failed', `读取 ${repo} 的 SKILL.md 失败：${error?.message || '网络错误'}`, {
+      cause: error,
+    });
+  } finally {
+    clearTimeout(timer);
+  }
+}