dsh-skill-hub 0.3.20 → 0.3.22

package/CONTRIBUTING.md

@@ -39,7 +39,7 @@ src/client/locales/     dictionaries by view (common/skills/market/sources/detai
 ```bash
 npm install
 npm run typecheck   # tsc --noEmit
-npm test            # vitest (266 tests across 14 suites)
+npm test            # vitest (285 tests across 14 suites)
 npm run build       # tsc declarations + tsdown bundles (lib/index.js + lib/client.js)
 ```
 
@@ -59,7 +59,7 @@ npm run build       # tsc declarations + tsdown bundles (lib/index.js + lib/clie
 ## Code style
 
 - TypeScript, strict mode. ESM (`"type": "module"`).
-- Host routes are loopback-only by construction — keep the trust fence intact.
+- Host routes reuse dsh's own `/api` trust fence (loopback ∪ the listener's bind address ∪ `--trusted-host` authorities ∪ the browser session) — never add a second, stricter check. Issue #17 (every route 403s behind a reverse proxy) came from exactly such a duplicate.
 - The browser half uses CSS Modules; keep the settings-card chrome family-bucket-compatible.
 - Comments explain *why* (routing decisions, dsh host behaviors) more than *what*.
 

package/README.md

@@ -77,7 +77,7 @@ GitHub repo ──scan/import──▶ ~/.dsh/skills
                     /api/skill-hub/* ──▶ Panel (Settings → 技能)
 ```
 
-Host uses only `ctx.skills.snapshot/get`, `ctx.webServer.register`, `ctx.systemPrompt.section`. Loopback-only routes (`127.0.0.1`/`localhost`), JSON.
+Host uses only `ctx.skills.snapshot/get`, `ctx.webServer.register`, `ctx.systemPrompt.section`. Routes sit behind dsh's own `/api` trust fence (loopback / the listener's bind address / `--trusted-host`), JSON.
 
 ## HTTP API
 
@@ -108,7 +108,7 @@ Host uses only `ctx.skills.snapshot/get`, `ctx.webServer.register`, `ctx.systemP
 
 ```bash
 npm run typecheck  # tsc --noEmit
-npm test           # 266 tests, 14 suites
+npm test           # 285 tests, 14 suites
 npm run build      # tsc + tsdown → lib/index.js + lib/client.js
 ```
 
@@ -117,8 +117,9 @@ npm run build      # tsc + tsdown → lib/index.js + lib/client.js
 ## Troubleshooting
 
 - `duplicate loader entry id: skill-hub` — remove the duplicate install (keep one `dsh plugin add` method).
-- Skill missing — check the diagnostics section (frontmatter / name mismatch / short description).
-- Empty source group — its skills were deleted, or their disabled records were lost (sidecar restored/hand-edited). Startup reconciles `.disabled` files on disk; source groups with no visible member are no longer rendered.
+- Skill missing — check the diagnostics section (frontmatter / name mismatch / short description / two discovery forms claiming the same name: a `<name>/SKILL.md` bundle and a `<name>.md` file can coexist on disk, and the registry keeps only one of them).
+- Empty source group — its skills were deleted, or their disabled records were lost (sidecar restored/hand-edited). Startup reconciles `.disabled` files on disk **and prunes records whose file is gone** (a record left behind by a hand-deleted directory used to be un-actionable: enable, create and delete all failed). Source groups with no visible member are no longer rendered.
+- A skill cannot be created / stays "disabled" — the disabled record pointed at a file that no longer exists. At startup (and on the next enable attempt) the record is repointed at the surviving `.disabled` file, or dropped so the name is free again.
 - Dots missing in `/` menu — dsh internals changed; catalog still works.
 - Settings card missing — open the plugin in the Plugins manager (sidebar → 插件 → dsh-skill-hub) and expand the 「技能中枢」 card at the top of the page (collapsed by default). On dsh older than `0.1.7-alpha.1` this plugin does not load at all (the settings API it targets does not exist there).
 

package/README.zh.md

@@ -77,7 +77,7 @@ GitHub 仓库 ──扫描/导入──▶ ~/.dsh/skills
                   /api/skill-hub/* ──▶ 面板（设置 → 技能）
 ```
 
-宿主仅用 `ctx.skills.snapshot/get`、`ctx.webServer.register`、`ctx.systemPrompt.section`。路由仅回环（`127.0.0.1`/`localhost`），JSON。
+宿主仅用 `ctx.skills.snapshot/get`、`ctx.webServer.register`、`ctx.systemPrompt.section`。路由走 dsh 自身的 `/api` 信任栅栏（回环 / 监听器绑定地址 / `--trusted-host`），JSON。
 
 ## HTTP API
 
@@ -108,7 +108,7 @@ GitHub 仓库 ──扫描/导入──▶ ~/.dsh/skills
 
 ```bash
 npm run typecheck  # tsc --noEmit
-npm test           # 266 tests, 14 suites
+npm test           # 285 tests, 14 suites
 npm run build      # tsc + tsdown → lib/index.js + lib/client.js
 ```
 
@@ -117,8 +117,9 @@ npm run build      # tsc + tsdown → lib/index.js + lib/client.js
 ## 故障排查
 
 - `duplicate loader entry id: skill-hub` — 删掉重复安装（只留一种 `dsh plugin add`）。
-- 技能不出现 — 看诊断区（缺 frontmatter / 名称不一致 / 描述过短）。
-- 来源组空壳 — 组内技能已被删除、或禁用记录丢失（状态文件被恢复/手改）。启动时自动对账磁盘上的 `.disabled` 文件补记录；无可见成员的来源组不再渲染。
+- 技能不出现 — 看诊断区（缺 frontmatter / 名称不一致 / 描述过短 / 两种发现形态抢同一个名字：`<name>/SKILL.md` 目录包与 `<name>.md` 扁平文件可以并存，注册表只会留一个）。
+- 来源组空壳 — 组内技能已被删除、或禁用记录丢失（状态文件被恢复/手改）。启动时自动对账磁盘上的 `.disabled` 文件补记录，**并清掉文件已不存在的死记录**（手工删掉目录后留下的记录以前谁也动不了：启用、新建、删除三条路全失败）；无可见成员的来源组不再渲染。
+- 技能建不出来 / 一直显示「已禁用」— 禁用记录指向的文件已经不在了。启动时（以及下一次点「启用」时）会把记录改指到现存的 `.disabled` 文件，找不到就直接删掉记录、把名字释放出来。
 - `/` 菜单圆点消失 — dsh 内部触发源变更，目录功能不受影响。
 - 找不到配置卡片 — 在插件管理页打开本插件（侧边栏「插件」→ dsh-skill-hub），展开页面顶部的「技能中枢」卡片（默认折叠）。dsh 低于 `0.1.7-alpha.1` 时本插件无法加载（它所用的 settings API 在旧版不存在）。
 

package/lib/client.js

@@ -612,7 +612,7 @@ window.__ModuleLoader__.load({
 			"settings.statsScanMinutes": "自动统计间隔（分钟）",
 			"settings.statsScanMinutesHint": "后台扫描会话日志的间隔，最小 1 分钟；扫描耗时会自动拉长间隔。",
 			"settings.githubToken": "GitHub Token",
-			"settings.githubTokenHint": "市场/来源走 GitHub API，匿名每小时 60 次，填 token 后 5000 次。细粒度 token 无需任何权限。明文存本地设置，仅回环可读；留空即匿名（或跟随 GITHUB_TOKEN 环境变量）。",
+			"settings.githubTokenHint": "市场/来源走 GitHub API，匿名每小时 60 次，填 token 后 5000 次。细粒度 token 无需任何权限。明文存本地设置，仅经 dsh 的 /api 信任栅栏可读（回环 / 绑定地址 / --trusted-host）；留空即匿名（或跟随 GITHUB_TOKEN 环境变量）。",
 			"settings.githubTokenPlaceholder": "ghp_… / github_pat_…（留空为匿名）",
 			"settings.inherit": "继承",
 			"settings.overridden": "已覆盖",
@@ -649,7 +649,7 @@ window.__ModuleLoader__.load({
 			"settings.statsScanMinutes": "Auto stats interval (minutes)",
 			"settings.statsScanMinutesHint": "How often the background session-log scan runs (min 1); heavy scans automatically stretch it.",
 			"settings.githubToken": "GitHub token",
-			"settings.githubTokenHint": "Market/sources use the GitHub API: 60 req/h anonymous, 5000/hr with a token. A fine-grained token needs no permissions. Stored plaintext in local settings, loopback-only; empty means anonymous (or GITHUB_TOKEN env).",
+			"settings.githubTokenHint": "Market/sources use the GitHub API: 60 req/h anonymous, 5000/hr with a token. A fine-grained token needs no permissions. Stored plaintext in local settings, reachable only through dsh's /api trust fence (loopback / bind address / --trusted-host); empty means anonymous (or GITHUB_TOKEN env).",
 			"settings.githubTokenPlaceholder": "ghp_… / github_pat_… (empty = anonymous)",
 			"settings.inherit": "Inherit",
 			"settings.overridden": "Overridden",