dsh-skill-hub 0.3.21 → 0.3.23

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (22) hide show
  1. package/CONTRIBUTING.md +2 -2
  2. package/README.md +2 -2
  3. package/README.zh.md +2 -2
  4. package/lib/client.js +2 -2
  5. package/lib/client.js.map +1 -1
  6. package/lib/index.js +59 -5
  7. package/lib/types/client/locales/settings.d.ts +1 -1
  8. package/lib/types/client/locales.d.ts +1 -1
  9. package/lib/types/protocol/config.d.ts +1 -1
  10. package/lib/types/routes/deps.d.ts +8 -1
  11. package/lib/types/routes/helpers.d.ts +11 -6
  12. package/lib/types/routes/http.d.ts +27 -2
  13. package/lib/types/routes.d.ts +29 -4
  14. package/package.json +21 -20
  15. package/src/client/locales/settings.ts +2 -2
  16. package/src/index.ts +15 -3
  17. package/src/protocol/config.ts +1 -1
  18. package/src/routes/deps.ts +8 -2
  19. package/src/routes/helpers.ts +18 -7
  20. package/src/routes/http.ts +31 -2
  21. package/src/routes.test.ts +70 -4
  22. package/src/routes.ts +49 -5
package/CONTRIBUTING.md CHANGED
@@ -39,7 +39,7 @@ src/client/locales/ dictionaries by view (common/skills/market/sources/detai
39
39
  ```bash
40
40
  npm install
41
41
  npm run typecheck # tsc --noEmit
42
- npm test # vitest (285 tests across 14 suites)
42
+ npm test # vitest (288 tests across 14 suites)
43
43
  npm run build # tsc declarations + tsdown bundles (lib/index.js + lib/client.js)
44
44
  ```
45
45
 
@@ -59,7 +59,7 @@ npm run build # tsc declarations + tsdown bundles (lib/index.js + lib/clie
59
59
  ## Code style
60
60
 
61
61
  - TypeScript, strict mode. ESM (`"type": "module"`).
62
- - Host routes are loopback-only by construction — keep the trust fence intact.
62
+ - Host routes reuse dsh's own `/api` trust fence (loopback ∪ the listener's bind address ∪ `--trusted-host` authorities ∪ the browser session) — never add a second, stricter check. Issue #17 (every route 403s behind a reverse proxy) came from exactly such a duplicate.
63
63
  - The browser half uses CSS Modules; keep the settings-card chrome family-bucket-compatible.
64
64
  - Comments explain *why* (routing decisions, dsh host behaviors) more than *what*.
65
65
 
package/README.md CHANGED
@@ -77,7 +77,7 @@ GitHub repo ──scan/import──▶ ~/.dsh/skills
77
77
  /api/skill-hub/* ──▶ Panel (Settings → 技能)
78
78
  ```
79
79
 
80
- Host uses only `ctx.skills.snapshot/get`, `ctx.webServer.register`, `ctx.systemPrompt.section`. Loopback-only routes (`127.0.0.1`/`localhost`), JSON.
80
+ Host uses only `ctx.skills.snapshot/get`, `ctx.webServer.register`, `ctx.systemPrompt.section`. Routes sit behind dsh's own `/api` trust fence (loopback / the listener's bind address / `--trusted-host`), JSON.
81
81
 
82
82
  ## HTTP API
83
83
 
@@ -108,7 +108,7 @@ Host uses only `ctx.skills.snapshot/get`, `ctx.webServer.register`, `ctx.systemP
108
108
 
109
109
  ```bash
110
110
  npm run typecheck # tsc --noEmit
111
- npm test # 285 tests, 14 suites
111
+ npm test # 288 tests, 14 suites
112
112
  npm run build # tsc + tsdown → lib/index.js + lib/client.js
113
113
  ```
114
114
 
package/README.zh.md CHANGED
@@ -77,7 +77,7 @@ GitHub 仓库 ──扫描/导入──▶ ~/.dsh/skills
77
77
  /api/skill-hub/* ──▶ 面板（设置 → 技能）
78
78
  ```
79
79
 
80
- 宿主仅用 `ctx.skills.snapshot/get`、`ctx.webServer.register`、`ctx.systemPrompt.section`。路由仅回环（`127.0.0.1`/`localhost`），JSON。
80
+ 宿主仅用 `ctx.skills.snapshot/get`、`ctx.webServer.register`、`ctx.systemPrompt.section`。路由走 dsh 自身的 `/api` 信任栅栏（回环 / 监听器绑定地址 / `--trusted-host`），JSON。
81
81
 
82
82
  ## HTTP API
83
83
 
@@ -108,7 +108,7 @@ GitHub 仓库 ──扫描/导入──▶ ~/.dsh/skills
108
108
 
109
109
  ```bash
110
110
  npm run typecheck # tsc --noEmit
111
- npm test # 285 tests, 14 suites
111
+ npm test # 288 tests, 14 suites
112
112
  npm run build # tsc + tsdown → lib/index.js + lib/client.js
113
113
  ```
114
114
 
package/lib/client.js CHANGED
@@ -612,7 +612,7 @@ window.__ModuleLoader__.load({
612
612
  "settings.statsScanMinutes": "自动统计间隔（分钟）",
613
613
  "settings.statsScanMinutesHint": "后台扫描会话日志的间隔，最小 1 分钟；扫描耗时会自动拉长间隔。",
614
614
  "settings.githubToken": "GitHub Token",
615
- "settings.githubTokenHint": "市场/来源走 GitHub API，匿名每小时 60 次，填 token 后 5000 次。细粒度 token 无需任何权限。明文存本地设置，仅回环可读；留空即匿名（或跟随 GITHUB_TOKEN 环境变量）。",
615
+ "settings.githubTokenHint": "市场/来源走 GitHub API，匿名每小时 60 次，填 token 后 5000 次。细粒度 token 无需任何权限。明文存本地设置，仅经 dsh 的 /api 信任栅栏可读（回环 / 绑定地址 / --trusted-host）；留空即匿名（或跟随 GITHUB_TOKEN 环境变量）。",
616
616
  "settings.githubTokenPlaceholder": "ghp_… / github_pat_…（留空为匿名）",
617
617
  "settings.inherit": "继承",
618
618
  "settings.overridden": "已覆盖",
@@ -649,7 +649,7 @@ window.__ModuleLoader__.load({
649
649
  "settings.statsScanMinutes": "Auto stats interval (minutes)",
650
650
  "settings.statsScanMinutesHint": "How often the background session-log scan runs (min 1); heavy scans automatically stretch it.",
651
651
  "settings.githubToken": "GitHub token",
652
- "settings.githubTokenHint": "Market/sources use the GitHub API: 60 req/h anonymous, 5000/hr with a token. A fine-grained token needs no permissions. Stored plaintext in local settings, loopback-only; empty means anonymous (or GITHUB_TOKEN env).",
652
+ "settings.githubTokenHint": "Market/sources use the GitHub API: 60 req/h anonymous, 5000/hr with a token. A fine-grained token needs no permissions. Stored plaintext in local settings, reachable only through dsh's /api trust fence (loopback / bind address / --trusted-host); empty means anonymous (or GITHUB_TOKEN env).",
653
653
  "settings.githubTokenPlaceholder": "ghp_… / github_pat_… (empty = anonymous)",
654
654
  "settings.inherit": "Inherit",
655
655
  "settings.overridden": "Overridden",