dsh-skill-hub 0.3.21 → 0.3.22
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CONTRIBUTING.md +1 -1
- package/README.md +1 -1
- package/README.zh.md +1 -1
- package/lib/client.js +2 -2
- package/lib/client.js.map +1 -1
- package/lib/index.js +59 -5
- package/lib/types/client/locales/settings.d.ts +1 -1
- package/lib/types/client/locales.d.ts +1 -1
- package/lib/types/protocol/config.d.ts +1 -1
- package/lib/types/routes/deps.d.ts +8 -1
- package/lib/types/routes/helpers.d.ts +11 -6
- package/lib/types/routes/http.d.ts +27 -2
- package/lib/types/routes.d.ts +29 -4
- package/package.json +1 -1
- package/src/client/locales/settings.ts +2 -2
- package/src/index.ts +15 -3
- package/src/protocol/config.ts +1 -1
- package/src/routes/deps.ts +8 -2
- package/src/routes/helpers.ts +18 -7
- package/src/routes/http.ts +31 -2
- package/src/routes.test.ts +70 -4
- package/src/routes.ts +49 -5
package/CONTRIBUTING.md
CHANGED
|
@@ -59,7 +59,7 @@ npm run build # tsc declarations + tsdown bundles (lib/index.js + lib/clie
|
|
|
59
59
|
## Code style
|
|
60
60
|
|
|
61
61
|
- TypeScript, strict mode. ESM (`"type": "module"`).
|
|
62
|
-
- Host routes
|
|
62
|
+
- Host routes reuse dsh's own `/api` trust fence (loopback ∪ the listener's bind address ∪ `--trusted-host` authorities ∪ the browser session) — never add a second, stricter check. Issue #17 (every route 403s behind a reverse proxy) came from exactly such a duplicate.
|
|
63
63
|
- The browser half uses CSS Modules; keep the settings-card chrome family-bucket-compatible.
|
|
64
64
|
- Comments explain *why* (routing decisions, dsh host behaviors) more than *what*.
|
|
65
65
|
|
package/README.md
CHANGED
|
@@ -77,7 +77,7 @@ GitHub repo ──scan/import──▶ ~/.dsh/skills
|
|
|
77
77
|
/api/skill-hub/* ──▶ Panel (Settings → 技能)
|
|
78
78
|
```
|
|
79
79
|
|
|
80
|
-
Host uses only `ctx.skills.snapshot/get`, `ctx.webServer.register`, `ctx.systemPrompt.section`.
|
|
80
|
+
Host uses only `ctx.skills.snapshot/get`, `ctx.webServer.register`, `ctx.systemPrompt.section`. Routes sit behind dsh's own `/api` trust fence (loopback / the listener's bind address / `--trusted-host`), JSON.
|
|
81
81
|
|
|
82
82
|
## HTTP API
|
|
83
83
|
|
package/README.zh.md
CHANGED
|
@@ -77,7 +77,7 @@ GitHub 仓库 ──扫描/导入──▶ ~/.dsh/skills
|
|
|
77
77
|
/api/skill-hub/* ──▶ 面板（设置 → 技能）
|
|
78
78
|
```
|
|
79
79
|
|
|
80
|
-
宿主仅用 `ctx.skills.snapshot/get`、`ctx.webServer.register`、`ctx.systemPrompt.section
|
|
80
|
+
宿主仅用 `ctx.skills.snapshot/get`、`ctx.webServer.register`、`ctx.systemPrompt.section`。路由走 dsh 自身的 `/api` 信任栅栏（回环 / 监听器绑定地址 / `--trusted-host`），JSON。
|
|
81
81
|
|
|
82
82
|
## HTTP API
|
|
83
83
|
|
package/lib/client.js
CHANGED
|
@@ -612,7 +612,7 @@ window.__ModuleLoader__.load({
|
|
|
612
612
|
"settings.statsScanMinutes": "自动统计间隔（分钟）",
|
|
613
613
|
"settings.statsScanMinutesHint": "后台扫描会话日志的间隔，最小 1 分钟；扫描耗时会自动拉长间隔。",
|
|
614
614
|
"settings.githubToken": "GitHub Token",
|
|
615
|
-
"settings.githubTokenHint": "市场/来源走 GitHub API，匿名每小时 60 次，填 token 后 5000 次。细粒度 token
|
|
615
|
+
"settings.githubTokenHint": "市场/来源走 GitHub API，匿名每小时 60 次，填 token 后 5000 次。细粒度 token 无需任何权限。明文存本地设置，仅经 dsh 的 /api 信任栅栏可读（回环 / 绑定地址 / --trusted-host）；留空即匿名（或跟随 GITHUB_TOKEN 环境变量）。",
|
|
616
616
|
"settings.githubTokenPlaceholder": "ghp_… / github_pat_…（留空为匿名）",
|
|
617
617
|
"settings.inherit": "继承",
|
|
618
618
|
"settings.overridden": "已覆盖",
|
|
@@ -649,7 +649,7 @@ window.__ModuleLoader__.load({
|
|
|
649
649
|
"settings.statsScanMinutes": "Auto stats interval (minutes)",
|
|
650
650
|
"settings.statsScanMinutesHint": "How often the background session-log scan runs (min 1); heavy scans automatically stretch it.",
|
|
651
651
|
"settings.githubToken": "GitHub token",
|
|
652
|
-
"settings.githubTokenHint": "Market/sources use the GitHub API: 60 req/h anonymous, 5000/hr with a token. A fine-grained token needs no permissions. Stored plaintext in local settings, loopback-
|
|
652
|
+
"settings.githubTokenHint": "Market/sources use the GitHub API: 60 req/h anonymous, 5000/hr with a token. A fine-grained token needs no permissions. Stored plaintext in local settings, reachable only through dsh's /api trust fence (loopback / bind address / --trusted-host); empty means anonymous (or GITHUB_TOKEN env).",
|
|
653
653
|
"settings.githubTokenPlaceholder": "ghp_… / github_pat_… (empty = anonymous)",
|
|
654
654
|
"settings.inherit": "Inherit",
|
|
655
655
|
"settings.overridden": "Overridden",
|