@v587d/capital-generation 2.7.0 → 2.7.1

package/capital-config/index.js

@@ -1,5 +1,5 @@
 import z from '@deepseek-ai/schemastery'
-import { SELECTED_SKILL_CATALOG } from '../selected-skills/catalog.js'
+import { SELECTED_SKILL_CATALOG, SELECTED_SKILL_SKILL_DIRS } from '../selected-skills/catalog.js'
 
 export const name = 'capital-config'
 
@@ -114,10 +114,173 @@ export const Config = z.object({
 })
 
 /**
- * 本行**不消费**自己的配置，也不需要注册任何服务：可编辑性全部是 schema 事实
- * （`.volatile()`），`dsh-settings` 从条目 Config 投影出表单，主插件再经
- * `settings.describe()` 读回解析值。所以这里只留一行日志，证明这颗行激活了。
+ * 「精选 Skills」那一格的**原文旁路**：卡片上的「详情」悬浮要显示 `SKILL.md` 原文，
+ * 而原文是随包携带的快照文件（35 份共 ~750 KB）。
+ *
+ * 为什么走一条本机路由，而不是把原文打进客户端 bundle：客户端 bundle 在页面加载那一刻
+ * 整体送达浏览器（`window.__ModuleLoader__.load` 是单文件 IIFE，没有按需分片），750 KB 会
+ * 让每一次打开插件页都付一遍——包括从不点「详情」的那次。旁路只在悬停时取一份，且取的是
+ * **磁盘上当前那份**，不是构建期抄的副本：抄来的原文会随快照更新而变旧，而这块 UI 说的
+ * 是"这就是原文"（控件对自己的状态说谎 = 事故）。
+ *
+ * 闭集：路径按 `SELECTED_SKILL_CATALOG` × `SELECTED_SKILL_SKILL_DIRS` 在模块加载时现算成
+ * `Map<skill 名, file: URL>`，请求里的名字**只做这张表的键**，不参与任何路径拼接——
+ * `%2F..%2F` 之类一律落在"表里没有这个名字"那一侧（404）。路径用 `URL` 表示：`fs` 直接收
+ * `file:` URL，省掉一次 `fileURLToPath`（也就省掉在 import 期依赖 node 内置模块）。
+ *
+ * ⛔ 认证围栏与 `/capital-charts`、`/capital-watchlist` 同一写法（`connection.requestRejection`，
+ * docs/dev/chart-presentation.md §6.1）：`webServer.register({ kind: 'prefix' })` 本身不做任何认证。
+ */
+export const SKILL_DOC_ROUTE = '/capital-skills'
+/** 单份原文的字节上限：超限**整份拒绝、绝不截断**（"原文"被切一半比没有原文更误导人）。 */
+export const MAX_SKILL_DOC_BYTES = 128 * 1024
+
+const SKILL_DOC_SUFFIX = 'SKILL.md'
+
+/** catalog 里的顺序 = 卡片上的顺序，所以这里只多算一份"名字 → 快照文件"的索引。 */
+export const SKILL_DOCS = new Map(SELECTED_SKILL_CATALOG.map((entry) => [
+  entry.name,
+  new URL(`../selected-skills/${entry.repository}/${SELECTED_SKILL_SKILL_DIRS[entry.repository]}/${entry.name}/${SKILL_DOC_SUFFIX}`, import.meta.url),
+]))
+
+function fsModule() {
+  const processLike = globalThis.process
+  const fs = processLike?.getBuiltinModule?.('node:fs')
+  if (!fs || typeof fs.readFileSync !== 'function') throw new Error('capital-config: Node fs is unavailable')
+  return fs
+}
+
+function sendJson(res, status, payload) {
+  res.statusCode = status
+  res.setHeader('content-type', 'application/json; charset=utf-8')
+  res.setHeader('cache-control', 'no-store')
+  res.setHeader('x-content-type-options', 'nosniff')
+  res.end(JSON.stringify(payload))
+}
+
+/**
+ * @param options.readFile - `(url) => string | Buffer`，用例注入假读盘。
+ * @param options.authorize - `(req) => 401 | 403 | undefined`；非空即拒，**且一次都不碰文件系统**。
+ */
+export function createSkillDocHandler(options = {}) {
+  const readFile = options.readFile ?? ((target) => fsModule().readFileSync(target, 'utf8'))
+  const statSize = options.statSize ?? ((target) => fsModule().statSync(target).size)
+  const authorize = options.authorize
+  return async function handler(req, res) {
+    if (typeof authorize === 'function') {
+      let rejection
+      try {
+        rejection = authorize(req)
+      } catch {
+        // 围栏自己答不上来时必须 fail closed：放行就等于"认证失败 = 不认证"。
+        rejection = 401
+      }
+      if (rejection !== undefined && rejection !== null) {
+        res.statusCode = rejection
+        res.setHeader('content-type', 'text/plain; charset=utf-8')
+        res.setHeader('cache-control', 'no-store')
+        res.end(rejection === 401 ? 'unauthorized' : 'forbidden')
+        return
+      }
+    }
+    if (req?.method !== 'GET') {
+      sendJson(res, 405, { error: 'method_not_allowed' })
+      return
+    }
+    let pathname
+    try {
+      pathname = new URL(req.url ?? '/', 'http://localhost').pathname
+    } catch {
+      sendJson(res, 400, { error: 'bad_request' })
+      return
+    }
+    if (!pathname.startsWith(`${SKILL_DOC_ROUTE}/`)) {
+      sendJson(res, 404, { error: 'not_found' })
+      return
+    }
+    const match = /^([^/]+)\.md$/.exec(pathname.slice(`${SKILL_DOC_ROUTE}/`.length))
+    if (!match) {
+      sendJson(res, 404, { error: 'not_found' })
+      return
+    }
+    let name
+    try {
+      name = decodeURIComponent(match[1])
+    } catch {
+      sendJson(res, 400, { error: 'bad_request' })
+      return
+    }
+    const target = SKILL_DOCS.get(name)
+    if (target === undefined) {
+      sendJson(res, 404, { error: 'skill_not_catalogued', name })
+      return
+    }
+    let bytes
+    try {
+      bytes = statSize(target)
+    } catch {
+      // 快照没随包落地（装到一半 / files 清单漏了）：说清楚"读不到"，别回一份空原文当好结果。
+      sendJson(res, 404, { error: 'skill_doc_unreadable', name })
+      return
+    }
+    if (bytes > MAX_SKILL_DOC_BYTES) {
+      sendJson(res, 413, { error: 'skill_doc_too_large', name, limit: MAX_SKILL_DOC_BYTES })
+      return
+    }
+    let body
+    try {
+      body = readFile(target)
+    } catch {
+      sendJson(res, 404, { error: 'skill_doc_unreadable', name })
+      return
+    }
+    res.statusCode = 200
+    res.setHeader('content-type', 'text/plain; charset=utf-8')
+    res.setHeader('cache-control', 'no-store')
+    res.setHeader('x-content-type-options', 'nosniff')
+    res.end(typeof body === 'string' ? body : Buffer.from(body))
+  }
+}
+
+/**
+ * 卡片那侧拼 URL 的唯一口径（文件名里带 `.` 的 slug 也要能拼，所以走 encodeURIComponent）。
+ * 客户端 bundle 与这里是**同一条字符串**的两端：漂移的表现为"详情永远读不到"，由
+ * `test/capital-config.test.mjs` 的同字断言钉住（客户端不能 import 本模块 ⇒ 只能对着产物量）。
+ */
+export function skillDocUrl(name) {
+  return `${SKILL_DOC_ROUTE}/${encodeURIComponent(name)}.md`
+}
+
+/**
+ * 本行消费两件事：自己的配置（schema 事实，见上）与快照原文的读盘旁路。
+ *
+ * `webServer` 只走 `inject`——`ctx.get('webServer')` 解析得到值**不代表**属性访问合法
+ * （cordis 的属性代理只认"本层声明过 inject"），探测式写法会把正确性押在装配顺序上，
+ * 这条踩过两次（见 `chart-ui/index.js` 的同一段注释）。认证面 `connection` 反之要**惰性**
+ * 解析：它缺席（Electron / file:// 这类没有浏览器认证面的载体）就退化成"没有认证面"的旧行为，
+ * 但解析抛错一律 401。
  */
 export function apply(ctx) {
-  ctx.logger?.info?.('capital-config: settings entry active (volatile config surface)')
+  const authorize = (req) => {
+    let connection
+    try {
+      connection = ctx.get('connection')
+    } catch {
+      return 401
+    }
+    if (connection === undefined || connection === null) return undefined
+    if (typeof connection.requestRejection !== 'function') return undefined
+    return connection.requestRejection(req)
+  }
+  ctx.inject(['webServer'], (webCtx) => {
+    webCtx.effect(
+      () => webCtx.webServer.register({
+        kind: 'prefix',
+        path: SKILL_DOC_ROUTE,
+        handler: createSkillDocHandler({ authorize }),
+      }),
+      'capital-config: skill 原文旁路',
+    )
+  })
+  ctx.logger?.info?.('capital-config: settings entry active (volatile config surface + skill 原文旁路)')
 }

package/capital-config/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@v587d/capital-config",
-  "version": "2.7.0",
+  "version": "2.7.1",
   "description": "Capital 模式的取数凭据与偏好配置行：卡片坐在 @v587d/capital-generation 插件主页的「配置」段，点这一行本身没有表单。",
   "license": "MIT",
   "type": "module",

package/capital-watchlist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@v587d/capital-watchlist",
-  "version": "2.7.0",
+  "version": "2.7.1",
   "description": "Capital 模式的用户自选股（宿主级清单 + Fuyao 报价快照 + /capital-watchlist 路由 + 输入框菜单弹窗）：由 @v587d/capital-generation 随包携带并作为 host 平面行挂载。",
   "license": "MIT",
   "type": "module",

package/chart-ui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@v587d/capital-charts",
-  "version": "2.7.0",
+  "version": "2.7.1",
   "description": "Capital 模式的图表前端组件（浏览器半边 + 序列旁路路由）：由 @v587d/capital-generation 随包携带并作为 host 平面行挂载。",
   "license": "MIT",
   "type": "module",

package/lib/agents/selected-skills-provider.js

@@ -4,13 +4,13 @@ import { agentSessionId, isRootAgent } from './root-tool-policy.js';
 // The catalog is a shipped data file outside the TypeScript root; runtime keeps this
 // import so the published lib resolves the same metadata beside the pinned snapshots.
 // @ts-expect-error catalog.js is intentionally maintained as package data.
-import { SELECTED_SKILL_CATALOG as CATALOG } from '../../selected-skills/catalog.js';
+import { SELECTED_SKILL_CATALOG as CATALOG, SELECTED_SKILL_SKILL_DIRS } from '../../selected-skills/catalog.js';
 export const SELECTED_SKILL_CATALOG = CATALOG;
 const PROVIDER_NAME = 'capital-selected-skills';
-const SKILL_ROOTS = [
-    fileURLToPath(new URL('../../selected-skills/investment-skills/skills', import.meta.url)),
-    fileURLToPath(new URL('../../selected-skills/china-stock-research-skills/skills', import.meta.url)),
-];
+// skills 根按 catalog 的「仓库 → 上游 SKILL.md 相对路径」现算：第三颗快照的上游把 skill 放在
+// plugins/us-stock-analysis/skills，不在 <repo>/skills 底下。写死目录列表的表现不是报错，
+// 而是"用户在卡片上勾了那一格、技能永远不出现"（AGENTS.md §9.7）。
+const SKILL_ROOTS = Object.entries(SELECTED_SKILL_SKILL_DIRS).map(([repository, skillsDir]) => fileURLToPath(new URL(`../../selected-skills/${repository}/${skillsDir}`, import.meta.url)));
 function createFilesystemSkillProvider(ctx, control, config) {
     return new FileSystemSkillProvider(ctx, control, config);
 }

package/lib/index.d.ts

@@ -93,21 +93,9 @@ export interface Config {
 export declare const Config: z<Schemastery.ObjectS<NoInfer<{
     customPersona: z<string, string, "defined">;
     selectedSkills: z<Schemastery.ObjectS<NoInfer<{
-        buffettFramework: z<boolean, boolean, "defined">;
-        financialHealth: z<boolean, boolean, "defined">;
-        riskWarningCatalysts: z<boolean, boolean, "defined">;
-        valuationInvestmentStrategy: z<boolean, boolean, "defined">;
-        strategyBusinessTransition: z<boolean, boolean, "defined">;
-        industryCompetitionMoat: z<boolean, boolean, "defined">;
-        businessDecompositionOrderQuality: z<boolean, boolean, "defined">;
+        [k: string]: z<boolean, boolean, "defined">;
     }>>, Schemastery.ObjectT<NoInfer<{
-        buffettFramework: z<boolean, boolean, "defined">;
-        financialHealth: z<boolean, boolean, "defined">;
-        riskWarningCatalysts: z<boolean, boolean, "defined">;
-        valuationInvestmentStrategy: z<boolean, boolean, "defined">;
-        strategyBusinessTransition: z<boolean, boolean, "defined">;
-        industryCompetitionMoat: z<boolean, boolean, "defined">;
-        businessDecompositionOrderQuality: z<boolean, boolean, "defined">;
+        [k: string]: z<boolean, boolean, "defined">;
     }>>, "defined">;
     fuyaoCredentialRef: z<string, string, "defined">;
     retriever: z<Schemastery.ObjectS<NoInfer<{
@@ -190,21 +178,9 @@ export declare const Config: z<Schemastery.ObjectS<NoInfer<{
 }>>, Schemastery.ObjectT<NoInfer<{
     customPersona: z<string, string, "defined">;
     selectedSkills: z<Schemastery.ObjectS<NoInfer<{
-        buffettFramework: z<boolean, boolean, "defined">;
-        financialHealth: z<boolean, boolean, "defined">;
-        riskWarningCatalysts: z<boolean, boolean, "defined">;
-        valuationInvestmentStrategy: z<boolean, boolean, "defined">;
-        strategyBusinessTransition: z<boolean, boolean, "defined">;
-        industryCompetitionMoat: z<boolean, boolean, "defined">;
-        businessDecompositionOrderQuality: z<boolean, boolean, "defined">;
+        [k: string]: z<boolean, boolean, "defined">;
     }>>, Schemastery.ObjectT<NoInfer<{
-        buffettFramework: z<boolean, boolean, "defined">;
-        financialHealth: z<boolean, boolean, "defined">;
-        riskWarningCatalysts: z<boolean, boolean, "defined">;
-        valuationInvestmentStrategy: z<boolean, boolean, "defined">;
-        strategyBusinessTransition: z<boolean, boolean, "defined">;
-        industryCompetitionMoat: z<boolean, boolean, "defined">;
-        businessDecompositionOrderQuality: z<boolean, boolean, "defined">;
+        [k: string]: z<boolean, boolean, "defined">;
     }>>, "defined">;
     fuyaoCredentialRef: z<string, string, "defined">;
     retriever: z<Schemastery.ObjectS<NoInfer<{

package/lib/index.js

@@ -13,7 +13,7 @@ import { registerChartTool } from './chart/tool.js';
 import { createChartEventPublisher } from './chart/events.js';
 import { registerRootToolPolicy, rootPolicyProbes } from './agents/root-tool-policy.js';
 import { registerBashGuard } from './agents/bash-guard.js';
-import { registerRootSelectedSkills } from './agents/selected-skills-provider.js';
+import { registerRootSelectedSkills, SELECTED_SKILL_CATALOG } from './agents/selected-skills-provider.js';
 import { ChartSourceTokenStore, registerChartSourceTool } from './chart/source-token.js';
 import { ChartArtifactRegistry } from './chart/artifact-ref.js';
 import { WebRetriever } from './web-retriever/retriever.js';
@@ -131,23 +131,13 @@ const RetrieverSchema = z.object({
     paddleOcr: PaddleOcrSchema.default({ ...PADDLE_OCR_DEFAULTS })
         .description('PaddleOCR 文档解析（ocr 工具）配置；Token 走 credentials 引用 PADDLE_OCR_TOKEN'),
 });
-const SelectedSkillsSchema = z.object({
-    buffettFramework: z.boolean().default(false).description('Enable the Finterm Buffett framework experiment for the Capital root Agent'),
-    financialHealth: z.boolean().default(false).description('Enable the China-stock financial health experiment for the Capital root Agent'),
-    riskWarningCatalysts: z.boolean().default(false).description('Enable the China-stock risk and catalyst monitoring experiment for the Capital root Agent'),
-    valuationInvestmentStrategy: z.boolean().default(false).description('Enable the China-stock valuation experiment for the Capital root Agent'),
-    strategyBusinessTransition: z.boolean().default(false).description('Enable the China-stock business transition experiment for the Capital root Agent'),
-    industryCompetitionMoat: z.boolean().default(false).description('Enable the China-stock industry and competition experiment for the Capital root Agent'),
-    businessDecompositionOrderQuality: z.boolean().default(false).description('Enable the China-stock order quality experiment for the Capital root Agent'),
-}).default({
-    buffettFramework: false,
-    financialHealth: false,
-    riskWarningCatalysts: false,
-    valuationInvestmentStrategy: false,
-    strategyBusinessTransition: false,
-    industryCompetitionMoat: false,
-    businessDecompositionOrderQuality: false,
-});
+// 开关清单只有一处来源：selected-skills 的 catalog。卡片那侧（capital-config/index.js）一直按
+// catalog 现算，主插件 Config 却手抄过一份 key 列表——接第三颗快照时这两处就漂了（默认值在
+// 条目→主插件 边界被静默丢弃，表现是卡片能拨、运行期读不到）。新增快照因此不必再动 src/。
+const SelectedSkillsSchema = z.object(Object.fromEntries(SELECTED_SKILL_CATALOG.map(({ key, name }) => [
+    key,
+    z.boolean().default(false).description(`Enable the community experiment "${name}" for the Capital root Agent`),
+]))).default(Object.fromEntries(SELECTED_SKILL_CATALOG.map(({ key }) => [key, false])));
 /** DSH 0.1.2-rc.1 configuration schema. */
 export const Config = z.object({
     customPersona: z.string()

package/lib/web-retriever/local-fetch.d.ts

@@ -6,7 +6,7 @@
  * between validation and connect. Closing that window would require a custom
  * dispatcher; this module keeps the same explicit trade-off as dsh-search-first.
  */
-export declare const LOCAL_FETCH_CLIENT_VERSION = "2.7.0";
+export declare const LOCAL_FETCH_CLIENT_VERSION = "2.7.1";
 export declare const LOCAL_FETCH_MAX_URL_LENGTH = 2048;
 export type LocalFetchErrorCode = 'ABORTED' | 'TIMEOUT' | 'INVALID_URL' | 'BLOCKED_URL' | 'DNS' | 'REDIRECT' | 'HTTP' | 'TOO_LARGE' | 'UNSUPPORTED_CONTENT_TYPE';
 export declare class LocalFetchError extends Error {

package/lib/web-retriever/local-fetch.js

@@ -7,7 +7,7 @@
  * dispatcher; this module keeps the same explicit trade-off as dsh-search-first.
  */
 import { htmlToMarkdown, stripInvisibleText } from './html-markdown.js';
-export const LOCAL_FETCH_CLIENT_VERSION = '2.7.0';
+export const LOCAL_FETCH_CLIENT_VERSION = '2.7.1';
 export const LOCAL_FETCH_MAX_URL_LENGTH = 2048;
 export class LocalFetchError extends Error {
     code;

package/lib/web-retriever/wind-client.d.ts

@@ -52,7 +52,7 @@ export interface WindCallResult {
  * `test/chart-composition.test.mjs` 守着（会因漂移而失败），这里原本是写死的第二处，
  * 一次发版就得记得改两遍。所以本常量由测试一并核对（见 `test/wind-client.test.mjs`）。
  */
-export declare const WIND_CLIENT_VERSION = "2.7.0";
+export declare const WIND_CLIENT_VERSION = "2.7.1";
 export interface WindClient {
     callTool(toolName: string, args: Record<string, unknown>, signal?: AbortSignal): Promise<WindCallResult>;
 }

package/lib/web-retriever/wind-client.js

@@ -35,7 +35,7 @@ export const WIND_SERVER_ENDPOINTS = {
  * `test/chart-composition.test.mjs` 守着（会因漂移而失败），这里原本是写死的第二处，
  * 一次发版就得记得改两遍。所以本常量由测试一并核对（见 `test/wind-client.test.mjs`）。
  */
-export const WIND_CLIENT_VERSION = '2.7.0';
+export const WIND_CLIENT_VERSION = '2.7.1';
 function errorText(error) {
     return error instanceof Error ? error.message : String(error);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@v587d/capital-generation",
-  "version": "2.7.0",
+  "version": "2.7.1",
   "description": "Capital Generation：面向中国散户的 AI 投资助手插件(Capital mode Agent Preset）",
   "icon": "assets/cg-icon.png",
   "author": "v587d",
@@ -36,6 +36,7 @@
     "selected-skills/README.md",
     "selected-skills/investment-skills",
     "selected-skills/china-stock-research-skills",
+    "selected-skills/InvestSkill",
     "cordis.patch.yml",
     "assets/cg-icon.png",
     "README.md",