scrum-skills 0.3.2 → 0.3.4

package/tools/projects.mjs

@@ -1,5 +1,5 @@
-import { readFileSync, writeFileSync, mkdirSync, realpathSync } from 'node:fs';
-import { join, dirname } from 'node:path';
+import { readFileSync, writeFileSync, mkdirSync, realpathSync, existsSync } from 'node:fs';
+import { join, dirname, resolve, sep } from 'node:path';
 import { homedir } from 'node:os';
 import { execFile, execFileSync } from 'node:child_process';
 import { promisify } from 'node:util';
@@ -93,10 +93,15 @@ function snapshot(root) {
   try {
     tests = read('tests');
   } catch {}
+  // diagrams.json 同样可选：没登记图例的项目就是空数组，/diagrams 页给空状态
+  let diagrams = null;
+  try {
+    diagrams = read('diagrams');
+  } catch {}
   // 页面开头要说明「已提交才覆盖、未提交要合并」，所以状态跟着快照一起给出去
   const { state, advice, hash, date, subject } = checkLastChange(root);
   return {
-    backlog: read('backlog'), sprints: read('sprints'), journal: read('journal'), lastChange, tests,
+    backlog: read('backlog'), sprints: read('sprints'), journal: read('journal'), lastChange, tests, diagrams,
     meta: { root, servedAt: new Date().toISOString(), lastChangeGit: { state, advice, hash, date, subject } },
   };
 }
@@ -171,7 +176,27 @@ export function createProjects({ root, store = defaultStore, pick = pickDirector
    * 不会出现「复制的和提交的不一样」。tools/ 不 import 看板源码，发布包里也就不用带 apps/。
    */
   const commit = ({ message } = {}) => commitAll(current, message);
-  return { list, read, open, select, setStoryStatus, commit };
+  /**
+   * 图例产物（自包含 HTML / SVG）。**只认 id，不认路径**：
+   * 路径一律从索引里取，客户端传什么都不会穿越目录；即便索引被手改成 `../../etc/passwd`，
+   * 这里还会再核一次「必须在 agile/ 下」。
+   */
+  const readDiagram = (id, format = 'html') => {
+    if (!id) throw new Error('缺少图例 id');
+    const d = (snapshot(current).diagrams?.diagrams ?? []).find(x => x.id === id);
+    if (!d) throw new Error(`没有图例 ${id}（先用 node tools/diagram.mjs add 登记）`);
+    const rel = format === 'svg' && d.svg ? d.svg : d.file;
+    if (!rel) throw new Error(`图例 ${id} 没有产物路径`);
+    const abs = resolve(current, rel);
+    const base = join(current, 'agile');
+    if (abs !== base && !abs.startsWith(base + sep)) throw new Error(`图例 ${id} 的产物必须在 agile/ 下：${rel}`);
+    if (!existsSync(abs)) throw new Error(`图例 ${id} 的产物不存在：${rel}`);
+    return {
+      contentType: /\.svg$/i.test(abs) ? 'image/svg+xml; charset=utf-8' : 'text/html; charset=utf-8',
+      text: readFileSync(abs, 'utf8'),
+    };
+  };
+  return { list, read, open, select, setStoryStatus, commit, readDiagram };
 }
 
 export async function handleProjectApi(projects, { method, path, headers, body }) {

package/tools/serve.mjs

@@ -30,7 +30,7 @@ const BOARD_DIR = [
 ].find(d => existsSync(join(d, 'index.html')));
 
 if (!BOARD_DIR) {
-  console.error('✘ 找不到看板静态产物（assets/board/index.html）。请在仓库里先跑 pnpm --dir apps/board run generate');
+  console.error('✘ 找不到看板静态产物（assets/board/index.html）。请在仓库里先跑 pnpm build');
   process.exit(1);
 }
 
@@ -112,6 +112,32 @@ const server = createServer(async (req, res) => {
     return;
   }
 
+  // 图例产物：唯一一个不返回 JSON 的接口。按 id 取文件，路径由索引决定（不接受客户端路径）。
+  // 下发的 CSP 是兜底：即便产物里带脚本，也只能在这个 sandbox 里跑，碰不到看板本身。
+  if (pathname === '/api/agile/diagram') {
+    const host = req.headers.host || '';
+    const sameOrigin = /^(localhost|127\.0\.0\.1|\[::1\])(:\d+)?$/.test(host)
+      && (!req.headers.origin || req.headers.origin === `http://${host}`)
+      && req.headers['sec-fetch-site'] !== 'cross-site';
+    if (!sameOrigin) {
+      res.writeHead(403, { 'content-type': 'text/plain; charset=utf-8' }).end('forbidden');
+      return;
+    }
+    try {
+      const { contentType, text } = projects.readDiagram(url.searchParams.get('id'), url.searchParams.get('format') ?? 'html');
+      res.writeHead(200, {
+        'content-type': contentType,
+        'content-security-policy': "sandbox allow-scripts",
+        'x-content-type-options': 'nosniff',
+        'cache-control': 'no-store',
+      });
+      res.end(text);
+    } catch (e) {
+      res.writeHead(404, { 'content-type': 'application/json; charset=utf-8' }).end(JSON.stringify({ error: String(e.message) }));
+    }
+    return;
+  }
+
   if (pathname.startsWith('/api/agile') || pathname.startsWith('/api/projects')) {
     try {
       let text = '';