@nextclaw/server 0.15.6 → 0.15.7

package/dist/index.js

@@ -2987,6 +2987,7 @@ const MARKETPLACE_ZH_COPY_BY_SLUG = {
 const MARKETPLACE_FETCH_TIMEOUT_MS = 12e3;
 const DOMESTIC_MARKETPLACE_FETCH_TIMEOUT_MS = 2e3;
 const DOMESTIC_MARKETPLACE_RETRY_ATTEMPTS = 2;
+const DOMESTIC_MARKETPLACE_MAX_SNAPSHOT_AGE_MS = 1200 * 1e3;
 function resolveMarketplaceBaseUrls(options) {
 	const configured = options.marketplace?.apiBaseUrl?.trim();
 	if (configured) return [configured.replace(/\/$/, "")];
@@ -3009,6 +3010,11 @@ function getMarketplaceFetchOptions(baseUrl) {
 function shouldFallbackMarketplaceResult(status) {
 	return status === 408 || status === 429 || status >= 500;
 }
+function isStaleDomesticMarketplaceSnapshot(baseUrl, cachedAt, now = Date.now()) {
+	if (baseUrl.replace(/\/$/, "") !== "https://api.nextclaw.net" || cachedAt === null) return false;
+	const cachedAtMs = Date.parse(cachedAt);
+	return !Number.isFinite(cachedAtMs) || now - cachedAtMs > DOMESTIC_MARKETPLACE_MAX_SNAPSHOT_AGE_MS;
+}
 //#endregion
 //#region src/features/marketplace/utils/marketplace-network-retry.utils.ts
 const MARKETPLACE_NETWORK_RETRY_ATTEMPTS = 5;
@@ -3086,6 +3092,11 @@ async function fetchMarketplaceDataFromBase(params) {
 			message: error instanceof Error ? error.message : String(error)
 		};
 	}
+	if (isStaleDomesticMarketplaceSnapshot(baseUrl, response.headers.get("x-nextclaw-mirror-cached-at"))) return {
+		ok: false,
+		status: 503,
+		message: "domestic marketplace mirror snapshot is stale"
+	};
 	let payload = null;
 	try {
 		payload = await response.json();
@@ -3454,15 +3465,6 @@ function collectSkillMarketplaceInstalledView(options) {
 		records: installed.records
 	};
 }
-function collectKnownSkillNames(options) {
-	const loader = createSkillsLoader(getWorkspacePathFromConfig(loadConfigOrDefault(options.configPath)));
-	return new Set((loader?.listSkills(false) ?? []).map((skill) => skill.name));
-}
-function isSupportedMarketplaceSkillItem(item, knownSkillNames) {
-	if (item.type !== "skill") return false;
-	if (item.install.kind === "marketplace") return true;
-	return item.install.kind === "builtin" && knownSkillNames.has(item.install.spec);
-}
 function findUnsupportedSkillInstallKind(items) {
 	for (const item of items) {
 		if (item.type !== "skill") continue;
@@ -3545,12 +3547,11 @@ var SkillMarketplaceController = class {
 			status: 502,
 			message: `unsupported skill install kind from marketplace api: ${unsupportedKind}`
 		};
-		const knownSkillNames = collectKnownSkillNames(this.options);
 		return {
 			ok: true,
 			data: {
 				...data,
-				items: normalizedItems.filter((item) => isSupportedMarketplaceSkillItem(item, knownSkillNames))
+				items: normalizedItems
 			}
 		};
 	};
@@ -3594,11 +3595,9 @@ var SkillMarketplaceController = class {
 			path: `/api/v1/skills/items/${slug}`
 		});
 		if (!result.ok) return c.json(err("MARKETPLACE_UNAVAILABLE", result.message), result.status);
-		const knownSkillNames = collectKnownSkillNames(this.options);
 		const sanitized = normalizeMarketplaceItemForUi(sanitizeMarketplaceItemView(result.data));
 		const unsupportedKind = findUnsupportedSkillInstallKind([sanitized]);
 		if (unsupportedKind) return c.json(err("MARKETPLACE_CONTRACT_MISMATCH", `unsupported skill install kind from marketplace api: ${unsupportedKind}`), 502);
-		if (!isSupportedMarketplaceSkillItem(sanitized, knownSkillNames)) return c.json(err("NOT_FOUND", "marketplace item not supported by nextclaw"), 404);
 		return c.json(ok(sanitized));
 	};
 	getItemContent = async (c) => {
@@ -3608,11 +3607,8 @@ var SkillMarketplaceController = class {
 			path: `/api/v1/skills/items/${slug}`
 		});
 		if (!result.ok) return c.json(err("MARKETPLACE_UNAVAILABLE", result.message), result.status);
-		const knownSkillNames = collectKnownSkillNames(this.options);
-		const sanitized = normalizeMarketplaceItemForUi(sanitizeMarketplaceItemView(result.data));
-		const unsupportedKind = findUnsupportedSkillInstallKind([sanitized]);
+		const unsupportedKind = findUnsupportedSkillInstallKind([normalizeMarketplaceItemForUi(sanitizeMarketplaceItemView(result.data))]);
 		if (unsupportedKind) return c.json(err("MARKETPLACE_CONTRACT_MISMATCH", `unsupported skill install kind from marketplace api: ${unsupportedKind}`), 502);
-		if (!isSupportedMarketplaceSkillItem(sanitized, knownSkillNames)) return c.json(err("NOT_FOUND", "marketplace item not supported by nextclaw"), 404);
 		const contentResult = await fetchMarketplaceData({
 			baseUrls: this.marketplaceBaseUrls,
 			path: `/api/v1/skills/items/${slug}/content`
@@ -3665,12 +3661,13 @@ var SkillMarketplaceController = class {
 			}
 		});
 		if (!result.ok) return c.json(err("MARKETPLACE_UNAVAILABLE", result.message), result.status);
-		const knownSkillNames = collectKnownSkillNames(this.options);
-		const filteredItems = sanitizeMarketplaceListItems(result.data.items).map((item) => normalizeMarketplaceItemForUi(item)).filter((item) => isSupportedMarketplaceSkillItem(item, knownSkillNames));
+		const items = sanitizeMarketplaceListItems(result.data.items).map((item) => normalizeMarketplaceItemForUi(item));
+		const unsupportedKind = findUnsupportedSkillInstallKind(items);
+		if (unsupportedKind) return c.json(err("MARKETPLACE_CONTRACT_MISMATCH", `unsupported skill install kind from marketplace api: ${unsupportedKind}`), 502);
 		return c.json(ok({
 			...result.data,
-			total: filteredItems.length,
-			items: filteredItems
+			total: items.length,
+			items
 		}));
 	};
 };
@@ -6255,6 +6252,14 @@ async function startUiServer(gateway) {
 		const resolvedAllowOrigin = allowOrigin ?? (isPanelAppRuntimeCors ? NULL_ORIGIN : null);
 		if (resolvedAllowOrigin) for (const [name, value] of createCorsHeaders(resolvedAllowOrigin, allowHeaders, c.res.headers.get("Vary"))) c.res.headers.set(name, value);
 	});
+	const uiInjectionPath = join(dirname(gateway.configPath), "ui-inject.js");
+	app.get("/api/ui-inject.js", async (c) => c.body(await readFile(uiInjectionPath, "utf-8").catch((error) => {
+		if (error.code === "ENOENT") return "";
+		throw error;
+	}), 200, {
+		"content-type": "application/javascript; charset=utf-8",
+		"cache-control": "no-store"
+	}));
 	const eventStreamAuth = new EventStreamAuthService({
 		uiAuth: authService,
 		extensionAuth: gateway.extensions,