ygl-trees 0.76.1 → 0.77.1

package/dist/bundle/text-Bce0wNAD.cjs

@@ -0,0 +1,172 @@
+const require_rolldown_runtime = require("./rolldown-runtime-C96Ew50Q.cjs");
+//#region packages/core/text/src/text.ts
+var text_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
+	clip: () => clip,
+	contentHash: () => contentHash,
+	ngram: () => ngram,
+	nowIso: () => nowIso,
+	parseFrontmatter: () => parseFrontmatter,
+	sha1: () => sha1,
+	shortId: () => shortId,
+	slug: () => slug,
+	splitTags: () => splitTags,
+	stampId: () => stampId
+});
+function nowIso() {
+	const d = /* @__PURE__ */ new Date();
+	const p = (n) => String(n).padStart(2, "0");
+	return `${d.getFullYear()}-${p(d.getMonth() + 1)}-${p(d.getDate())} ${p(d.getHours())}:${p(d.getMinutes())}:${p(d.getSeconds())}`;
+}
+function stampId() {
+	const d = /* @__PURE__ */ new Date();
+	const p = (n) => String(n).padStart(2, "0");
+	return `${d.getFullYear()}${p(d.getMonth() + 1)}${p(d.getDate())}-${p(d.getHours())}${p(d.getMinutes())}${p(d.getSeconds())}`;
+}
+function slug(text, limit = 40) {
+	const s = (text || "").trim().toLowerCase().replace(new RegExp(`[^\\w${CJK}]+`, "gu"), "-").replace(/^-+|-+$/g, "");
+	if (s.length <= limit) return s || "item";
+	return s.slice(0, limit).replace(/-+$/, "") || "item";
+}
+/**
+* Tokenize mixed Chinese/English text for SQLite FTS5.
+*
+* FTS5's default unicode61 tokenizer treats a whole CJK sentence as one token,
+* which makes Chinese search degrade to exact match. We expand CJK runs into
+* character bigrams and keep latin words intact.
+*/
+function ngram(text) {
+	const src = (text || "").normalize("NFKC").toLowerCase();
+	const out = [];
+	const segs = src.match(CJK_RUN_RE) || [];
+	for (const seg of segs) if (CJK_ONLY_RE.test(seg)) {
+		if (seg.length === 1) out.push(seg);
+		else for (let i = 0; i < seg.length - 1; i++) out.push(seg.slice(i, i + 2));
+	} else {
+		const w = seg.replace(/^[^\w]+|[^\w]+$/gu, "");
+		if (w) out.push(w);
+	}
+	return out.join(" ");
+}
+function sha1(text) {
+	return require("node:crypto").createHash("sha1").update(text || "").digest("hex");
+}
+/** Content hash for idempotent writes (single source: store writes and the
+*  TypeORM write service must produce identical hashes); --force salts it
+*  so a duplicate row is explicitly distinct (queryable via `db dups`). */
+function contentHash(content, force) {
+	return sha1(content) + (force ? `#f${Date.now()}${Math.random()}` : "");
+}
+function shortId(parts, n = 8) {
+	return sha1(parts.join("|") + Date.now() + Math.random()).slice(0, n);
+}
+/** Truncate for table display, collapsing newlines. */
+function clip(text, n = 40) {
+	const one = (text || "").replace(/\s+/g, " ").trim();
+	return one.length <= n ? one : one.slice(0, Math.max(1, n - 1)) + "…";
+}
+/**
+* Minimal SKILL.md frontmatter parser: supports `key: value`, quoted scalars,
+* folded blocks (`>-` / `>`) and inline `a,b` lists.
+*/
+function parseFrontmatter(raw) {
+	const text = raw.replace(/^/, "");
+	const m = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?/.exec(text);
+	if (!m) return {
+		meta: {},
+		body: text
+	};
+	const meta = {};
+	const lines = m[1].split(/\r?\n/);
+	let key = null;
+	let folded = null;
+	const flush = () => {
+		if (key && folded) meta[key] = folded.join(" ").replace(/\s+/g, " ").trim();
+		key = null;
+		folded = null;
+	};
+	for (const line of lines) {
+		const kv = /^([A-Za-z_][\w-]*)\s*:\s*(.*)$/.exec(line);
+		if (kv && !/^\s/.test(line)) {
+			flush();
+			key = kv[1];
+			const v = kv[2].trim();
+			if (v === ">-" || v === ">" || v === "|" || v === "|-") folded = [];
+			else {
+				meta[key] = v.replace(/^["']|["']$/g, "");
+				key = null;
+			}
+			continue;
+		}
+		if (key && folded) folded.push(line.trim());
+	}
+	flush();
+	return {
+		meta,
+		body: text.slice(m[0].length)
+	};
+}
+function splitTags(v) {
+	return (v || "").split(/[,，;；\s]+/).map((s) => s.trim()).filter(Boolean);
+}
+var CJK, CJK_RUN_RE, CJK_ONLY_RE;
+var init_text = require_rolldown_runtime.__esmMin((() => {
+	CJK = "\\u4e00-\\u9fff\\u3400-\\u4dbf\\uf900-\\ufaff";
+	new RegExp(`[${CJK}]`, "u");
+	CJK_RUN_RE = new RegExp(`[${CJK}]+|[^\\s${CJK}]+`, "gu");
+	CJK_ONLY_RE = new RegExp(`^[${CJK}]+$`, "u");
+}));
+//#endregion
+Object.defineProperty(exports, "clip", {
+	enumerable: true,
+	get: function() {
+		return clip;
+	}
+});
+Object.defineProperty(exports, "contentHash", {
+	enumerable: true,
+	get: function() {
+		return contentHash;
+	}
+});
+Object.defineProperty(exports, "init_text", {
+	enumerable: true,
+	get: function() {
+		return init_text;
+	}
+});
+Object.defineProperty(exports, "ngram", {
+	enumerable: true,
+	get: function() {
+		return ngram;
+	}
+});
+Object.defineProperty(exports, "nowIso", {
+	enumerable: true,
+	get: function() {
+		return nowIso;
+	}
+});
+Object.defineProperty(exports, "parseFrontmatter", {
+	enumerable: true,
+	get: function() {
+		return parseFrontmatter;
+	}
+});
+Object.defineProperty(exports, "sha1", {
+	enumerable: true,
+	get: function() {
+		return sha1;
+	}
+});
+Object.defineProperty(exports, "shortId", {
+	enumerable: true,
+	get: function() {
+		return shortId;
+	}
+});
+Object.defineProperty(exports, "text_exports", {
+	enumerable: true,
+	get: function() {
+		return text_exports;
+	}
+});

package/dist/packages/ops/tools/src/plugins.js

@@ -162,9 +162,16 @@ function pnpm(home, args) {
     // there. Requires pnpm >= 9.4.
     const pm = process.env.YGL_PACKAGE_MANAGER || "pnpm";
     if (process.platform === "win32") {
-        const q = (s) => `"${String(s).replace(/["&|<>^]/g, "")}"`;
         const exe = resolvePm(pm);
-        (0, node_child_process_1.execFileSync)([q(exe), ...args.map(q), "--dir", q(profileDir(home)), "--ignore-workspace"].join(" "), { stdio: "pipe", shell: true });
+        // DEP0190 fix (a2a 7aa5c871 cosmetic): avoid shell:true with args —
+        // invoke cmd explicitly instead, args are properly escaped by spawnSync.
+        const { spawnSync } = require("node:child_process");
+        const r = spawnSync("cmd", ["/c", exe, ...args, "--dir", profileDir(home), "--ignore-workspace"], { stdio: "pipe" });
+        if (r.status !== 0) {
+            const err = new Error(String(r.stderr || r.stdout || `pnpm exited ${r.status}`));
+            err.status = r.status;
+            throw err;
+        }
         return;
     }
     (0, node_child_process_1.execFileSync)(pm, [...args, "--dir", profileDir(home), "--ignore-workspace"], { stdio: "pipe" });
@@ -175,10 +182,10 @@ function resolvePm(pm) {
         return cachedPm || pm;
     cachedPm = null;
     try {
-        const where = (0, node_child_process_1.execFileSync)("where", [pm], { stdio: "pipe", shell: true }).toString().split(/\r?\n/).filter(Boolean);
+        const where = (0, node_child_process_1.execFileSync)("where", [pm], { stdio: "pipe", shell: false }).toString().split(/\r?\n/).filter(Boolean);
         for (const candidate of where) {
             try {
-                (0, node_child_process_1.execFileSync)([q2(candidate), "--version"].join(" "), { stdio: "pipe", shell: true });
+                (0, node_child_process_1.execFileSync)("cmd", ["/c", candidate, "--version"], { stdio: "pipe" });
                 cachedPm = candidate;
                 return candidate;
             }
@@ -194,6 +201,28 @@ const q2 = (s) => `"${String(s).replace(/["&|<>^]/g, "")}"`;
 async function installPlugin(home, spec) {
     initProfile(home);
     const abs = path.resolve(spec);
+    // P0 fix (a2a 7aa5c871): validate local paths BEFORE recording anything —
+    // a bad path previously degraded to basename "plugin" and bricked the home.
+    if (fs.existsSync(abs) && fs.statSync(abs).isDirectory()) {
+        // P2 fix: read the real package name, never trust basename
+        const pkgPath = path.join(abs, "package.json");
+        if (!fs.existsSync(pkgPath)) {
+            throw new Error(`local plugin directory has no package.json: ${abs}`);
+        }
+        try {
+            const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf8"));
+            if (!pkg.name || typeof pkg.name !== "string") {
+                throw new Error(`package.json missing "name" field: ${abs}`);
+            }
+        }
+        catch (e) {
+            throw new Error(`invalid package.json in ${abs}: ${e?.message || e}`);
+        }
+    }
+    else if (spec.startsWith(".") || spec.startsWith("/") || spec.startsWith("\\") || /^[A-Z]:/.test(spec)) {
+        // Looks like a path but doesn't exist — reject before recording
+        throw new Error(`plugin path not found: ${abs}`);
+    }
     const installSpec = fs.existsSync(abs) && fs.statSync(abs).isDirectory() ? `link:${abs}` : spec;
     const existing = readUserBundle(home).find((p) => p.spec === installSpec || p.spec === spec);
     if (existing)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ygl-trees",
-  "version": "0.76.1",
+  "version": "0.77.1",
   "description": "猿光 · 科技树 — database-centric CLI for research → production → knowledge reuse, built for AI agents.",
   "type": "commonjs",
   "main": "dist/apps/cli/index.js",
@@ -25,9 +25,9 @@
     "node-sqlite3-wasm": "^0.8.61",
     "reflect-metadata": "^0.2.2",
     "typeorm": "^1.1.2",
+    "@deepseek-ai/cordis": "~4.0.5-alpha.2",
     "@deepseek-ai/cordis-plugin-timer": "~1.1.7-alpha.2",
     "@deepseek-ai/cosmokit": "~1.8.6-alpha.2",
-    "@deepseek-ai/cordis": "~4.0.5-alpha.2",
     "@deepseek-ai/schemastery": "~3.18.5-alpha.2"
   },
   "devDependencies": {