@yottameta/yotta-skills-plugin 0.25.1 → 0.26.0

package/skills/yotta-skills/lib/hub.js

@@ -300,11 +300,30 @@ function classifyTarget(target, hubDir) {
     return { kind: 'missing' };
   }
   if (stat.isSymbolicLink()) {
-    const real = safeRealpath(target);
+    let real = null;
+    let targetExists = false;
+    try {
+      real = fs.realpathSync.native ? fs.realpathSync.native(target) : fs.realpathSync(target);
+      targetExists = true;
+    } catch (_) {
+      try {
+        real = fs.realpathSync(target);
+        targetExists = true;
+      } catch (_) { /* broken link: fall back to the recorded link value */ }
+    }
+    if (!real) {
+      // A broken junction / symlink no longer resolves. Read the link value so
+      // an unlink can still tell whether it points into the hub (fail-closed
+      // cleanup path) without treating it as an arbitrary directory.
+      let linkValue = null;
+      try { linkValue = fs.readlinkSync(target); } catch (_) { linkValue = null; }
+      real = linkValue ? path.resolve(path.dirname(path.resolve(target)), linkValue) : path.resolve(target);
+    }
     return {
       kind: 'link',
       target: real,
       inHub: isInside(hubDir, real),
+      targetExists,
     };
   }
   if (stat.isDirectory()) return { kind: 'directory' };
@@ -333,7 +352,7 @@ function linkSkills(options) {
     const target = path.join(targetDir, slug);
     const current = classifyTarget(target, hubDir);
     let backup = null;
-    if (current.kind === 'link' && current.inHub && samePath(current.target, skill.dir)) {
+    if (current.kind === 'link' && current.inHub && current.targetExists !== false && samePath(current.target, skill.dir)) {
       results.push({ slug, status: 'linked', target, note: '已链接到 hub' });
       continue;
     }
@@ -462,9 +481,9 @@ function linkStatus(hubDir) {
     const current = classifyTarget(item.target, hubDir);
     return {
       ...item,
-      status: current.kind === 'link' && current.inHub ? 'ok'
-        : current.kind === 'missing' ? 'broken'
-          : 'drift',
+      status: current.kind === 'link'
+        ? (!current.inHub ? 'drift' : (current.targetExists === false ? 'broken' : 'ok'))
+        : current.kind === 'missing' ? 'broken' : 'drift',
       actual: current,
     };
   });

package/skills/yotta-skills/lib/install-snapshot.js

@@ -80,10 +80,10 @@ function readVersion(root) {
 function validateSnapshot(snapshot) {
   const root = path.resolve(snapshot || '');
   if (!snapshot || !fs.existsSync(root)) {
-    return { ok: false, version: null, digest: null, legacy: false, reason: '快照目录不存在' };
+    return { ok: false, version: null, digest: null, legacy: false, reason: '快照目录不存在', source: null, createdAt: null };
   }
   if (!fs.statSync(root).isDirectory()) {
-    return { ok: false, version: null, digest: null, legacy: false, reason: '快照不是目录' };
+    return { ok: false, version: null, digest: null, legacy: false, reason: '快照不是目录', source: null, createdAt: null };
   }
   const metaFile = root + '.meta.json';
   if (fs.existsSync(metaFile)) {
@@ -91,13 +91,21 @@ function validateSnapshot(snapshot) {
     try {
       metadata = JSON.parse(fs.readFileSync(metaFile, 'utf8'));
     } catch (error) {
-      return { ok: false, version: null, digest: null, legacy: false, reason: '快照元数据无法解析: ' + error.message };
+      return { ok: false, version: null, digest: null, legacy: false, reason: '快照元数据无法解析: ' + error.message, source: null, createdAt: null };
     }
     let current;
     try {
       current = computeTreeDigest(root);
     } catch (error) {
-      return { ok: false, version: metadata.version || null, digest: metadata.digest || null, legacy: false, reason: '快照不可读: ' + error.message };
+      return {
+        ok: false,
+        version: metadata.version || null,
+        digest: metadata.digest || null,
+        legacy: false,
+        reason: '快照不可读: ' + error.message,
+        source: metadata.source || null,
+        createdAt: metadata.created_at || null,
+      };
     }
     if (!metadata.digest || current.digest !== metadata.digest) {
       return {
@@ -106,6 +114,8 @@ function validateSnapshot(snapshot) {
         digest: metadata.digest || null,
         legacy: false,
         reason: '快照摘要不一致，可能已被修改',
+        source: metadata.source || null,
+        createdAt: metadata.created_at || null,
       };
     }
     return {
@@ -114,14 +124,16 @@ function validateSnapshot(snapshot) {
       digest: metadata.digest,
       legacy: false,
       reason: null,
+      source: metadata.source || null,
+      createdAt: metadata.created_at || null,
     };
   }
 
   const version = readVersion(root);
   if (!fs.existsSync(path.join(root, 'SKILL.md'))) {
-    return { ok: false, version, digest: null, legacy: true, reason: '旧快照缺少 SKILL.md' };
+    return { ok: false, version, digest: null, legacy: true, reason: '旧快照缺少 SKILL.md', source: null, createdAt: null };
   }
-  return { ok: true, version, digest: null, legacy: true, reason: null };
+  return { ok: true, version, digest: null, legacy: true, reason: null, source: null, createdAt: null };
 }
 
 function createSnapshot(target, options) {
@@ -191,6 +203,8 @@ function listSnapshots(homeDir, slug) {
         version: validation.version,
         legacy: validation.legacy,
         reason: validation.reason,
+        source: validation.source || null,
+        createdAt: validation.createdAt || null,
         mtime_ms: mtimeMs,
       });
     }

package/skills/yotta-skills/lib/skills-scan.js

@@ -170,7 +170,7 @@ function opencodeUserDir() {
   return agentDirs.resolveUserDir('.config/opencode/skills', { homeDir: os.homedir(), env: process.env });
 }
 
-/** OpenClaw / QClaw 用户级技能目录：$OPENCLAW_STATE_DIR/skills（默认 ~/.openclaw/skills）。 */
+/** OpenClaw 用户级技能目录：$OPENCLAW_STATE_DIR/skills（默认 ~/.openclaw/skills）。 */
 function openclawUserDir() {
   return agentDirs.resolveUserDir('.openclaw/skills', { homeDir: os.homedir(), env: process.env });
 }

package/skills/yotta-skills/references/hub.md

@@ -59,6 +59,22 @@ npx -y @yottameta/yotta-skills hub doctor
 - 官方锁文件：只读兼容 Vercel Labs `skills` CLI 的 `.skill-lock.json` v3
   （`$XDG_STATE_HOME/skills/` 或 `~/.agents/`）。
 
+## 本地面板（yotta-skills view）
+
+```bash
+npx -y @yottameta/yotta-skills view
+npx -y @yottameta/yotta-skills view --port 8790
+```
+
+面板只在 `127.0.0.1`（默认 8789）监听，零远程资源、零遥测，只读写 Hub
+目录与台账 / 证据文件，不读元忆、不改宿主全局配置。六个视图：概览、宿主矩阵、
+收编向导、链接与体检、记录与回滚、路由与编排，另附高级 CLI 页。
+
+动作边界：收编 / 链接 / 解除 / 回滚可执行（预览 → 确认 → 执行 → 证据）；
+install / update / refresh 只在高级 CLI 页给出可复制命令，不在网页执行。
+写操作需要页面会话令牌，解除与回滚需要破坏性确认串；收编始终逐项运行元信
+扫描，high / critical 阻断。
+
 ## 安全边界
 
 - `unlink` 只删除 lstat 确认为链接、且 readlink 目标位于 Hub 内的路径。

package/skills/yotta-skills/scripts/yotta-skills-mcp.py

@@ -27,7 +27,7 @@ import subprocess
 import sys
 from pathlib import Path
 
-VERSION = "0.25.1"
+VERSION = "0.26.0"
 TOOL_NAME = "yotta-skills"
 CN_NAME = "元阁"
 MCP_PROTOCOL_MODERN = "2026-07-28"