sillyspec 3.26.6 → 3.26.8

package/.claude/skills/sillyspec-doctor/SKILL.md

@@ -63,6 +63,8 @@ sillyspec runtime list                                              # 枚举 .si
 > `--cleanup-remnant` 清理 init/平台切换残留的 0 字节空 db（占位但无数据）。默认 dry-run 只报告，`--confirm` 才删。绝不删有内容的 db。
 >
 > `runtime list` 是只读枚举：列出 `.sillyspec/.runtime/` 下的 db、doctor-diagnosis.json、workflow-runs/、user-inputs.md 等产物及用途。多会话/压缩后想知道「我手上有哪些证据文件」时用。加 `--json` 程序化读取。
+>
+> `doctor --json` 的 pointer_health 维度含 `pointer_missing_but_managed` 信号：项目根存在平台接管声明（`.sillyspec-platform-managed`）但恢复指针缺失——此状态下裸调命令会 fail-closed 拒绝静默落本地。恢复路径见信号文案：重跑平台 scan 重建指针 / `sillyspec platform disconnect` 彻底脱离 / 显式 `--spec-dir` 临时指定。
 
 ## 铁律
 

package/.claude/skills/sillyspec-execute/SKILL.md

@@ -129,8 +129,8 @@ execute 还有**第二道**独立的 stage 级审查：除逐 task review.json
 - **local.yaml `repos:` 段**：在 `.sillyspec/local.yaml` 注册跨仓仓路径（`main` 不用注册，隐式=当前项目）：
   ```yaml
   repos:
-    sillyspec: C:/Users/qinyi/IdeaProjects/sillyspec
     shared-lib: ../shared-lib
+    tool-repo: C:/path/to/your/tool-repo
   ```
   task 卡 `repo:` 引用的 key 必须在此注册，否则 execute 启动 fail-closed 阻断（跨仓 apply 走错仓=数据所有权事故，配置错误不降级）。
 - **跨仓 task 的 `allowed_paths`**：指**相对跨仓仓根**的路径（非主仓根）。

package/.claude/skills/sillyspec-knowledge/SKILL.md

@@ -80,7 +80,7 @@ sillyspec knowledge inspect --id "generated/worktree-baseline-conflict"
     "zone": "manual",
     "path": "knowledge/patterns.md",
     "meta": {
-      "author": "qinyi",
+      "author": "<git-user>",
       "created_at": "2026-06-19T12:40:00+08:00",
       "updated_at": "2026-06-24T10:00:00+08:00"
     },

package/.claude/skills/sillyspec-plan/SKILL.md

@@ -100,8 +100,8 @@ plan 完成校验会检查：design 提到入口文件（cli.ts/main.ts/server.t
 
 ```yaml
 repos:
-  sillyspec: C:/Users/qinyi/IdeaProjects/sillyspec
   shared-lib: ../shared-lib
+  tool-repo: C:/path/to/your/tool-repo
 ```
 
 key = task 卡 `repo:` 引用名，value = 跨仓仓绝对路径（或相对主仓根的路径）。`main` 不用注册。

package/.husky/pre-push

@@ -1,5 +1,5 @@
 #!/bin/sh
-echo "🔧 pre-push: running lint + test..."
+echo "🔧 pre-push: running lint + test + docs gate..."
 npm run lint --silent 2>&1
 if [ $? -ne 0 ]; then
   echo "❌ pre-push: lint failed, aborting push"
@@ -10,4 +10,11 @@ if [ $? -ne 0 ]; then
   echo "❌ pre-push: test failed, aborting push"
   exit 1
 fi
-echo "✅ pre-push: lint + test passed"
+# docs gate ratchet（doc-consistency-debt 第七节）：docs check 失效数 ≤ 基线放行。
+# 基线 .sillyspec/docs-check-baseline 缺失/损坏时 fail-closed exit 2 拦截。
+node bin/sillyspec.js docs gate 2>&1
+if [ $? -ne 0 ]; then
+  echo "❌ pre-push: docs gate failed, aborting push"
+  exit 1
+fi
+echo "✅ pre-push: lint + test + docs gate passed"

package/bin/sillyspec.js

@@ -1,2 +1,2 @@
-#!/usr/bin/env node
+#!/usr/bin/env node
 import '../src/index.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sillyspec",
-  "version": "3.26.6",
+  "version": "3.26.8",
   "description": "SillySpec CLI — 流程状态机，让 AI 严格按步骤来",
   "icon": "logo.jpg",
   "homepage": "https://sillyspec.ppdmq.top/",
@@ -31,9 +31,9 @@
     "@inquirer/prompts": "^7.10.1",
     "chalk": "^5.6.2",
     "chokidar": "^4.0",
-    "js-yaml": "^4.2.0",
+    "js-yaml": "^4.3.1",
     "open": "^10.1",
     "ora": "^9.3.0",
-    "ws": "^8.18"
+    "ws": "^8.21.3"
   }
 }

package/packages/dashboard/server/index.js

@@ -103,6 +103,13 @@ function isSillyspecPath(filePath) {
   return parts.includes('.sillyspec')
 }
 
+// 凭据/敏感运行时文件：local.yaml 含 SillyHub token（connect 明文写入），.plan.md.lock 等锁文件
+// 是并发原语非文档。/api/docs/content 无鉴权（仅 Origin 检查），这些文件绝不经 HTTP 暴露。
+function isCredentialPath(filePath) {
+  const base = basename(resolve(filePath)).toLowerCase()
+  return base === 'local.yaml' || base === 'local.yml' || base.endsWith('.lock') || base === 'sillyspec-platform.json'
+}
+
 function isViewableDocPath(filePath) {
   return /\.(md|markdown|mdx|html?|txt|log|json|ya?ml|toml|xml|csv)$/i.test(filePath)
 }
@@ -377,7 +384,7 @@ function startServer({ port = 3456, open: openBrowser = true } = {}) {
       }
       // Security: only allow reading viewable text documents under a .sillyspec tree.
       const normalizedPath = resolve(filePath)
-      if (!isSillyspecPath(normalizedPath) || !isViewableDocPath(normalizedPath)) {
+      if (!isSillyspecPath(normalizedPath) || !isViewableDocPath(normalizedPath) || isCredentialPath(normalizedPath)) {
         res.writeHead(403)
         res.end(JSON.stringify({ error: 'Access denied' }))
         return