程序员阿江(Relakkes) b305e798e7 feat: wire skill market install api ...

Route marketplace install requests through server-side detail lookup, eligibility checks, trusted package URL validation, bounded zip downloads, and the local user skill installer.

Reject client-supplied targets and arbitrary package URLs so the desktop cannot direct writes outside the computed user skill directory.

Tested: bun test src/server/__tests__/skill-market.test.ts src/server/__tests__/skill-market-install.test.ts

Tested: cd desktop && bun run test -- SkillCenter.test.tsx skillMarketStore.test.ts

Tested: cd desktop && bun run lint

Tested: cd desktop && bun run build

Not-tested: bun run check:server is blocked by missing @whiskeysockets/baileys in adapters/whatsapp/session.ts in this checkout.

Scope-risk: moderate

Confidence: high

2026-07-03 23:34:19 +08:00

..

__tests__

feat: wire skill market install api

2026-07-03 23:34:19 +08:00

api

feat: wire skill market install api

2026-07-03 23:34:19 +08:00

backends

experiment(desktop): static-import sidecars + drop src/ + node_modules/ from bundle

2026-04-12 00:05:39 +08:00

config

fix(runtime): update domestic provider model presets

2026-06-27 16:51:43 +08:00

middleware

fix(desktop): trust loopback web dev access

2026-06-12 12:29:15 +08:00

proxy

fix(provider): default provider requests to direct proxy mode (#953)

2026-07-02 21:29:31 +08:00

services

fix: harden skill marketplace details

2026-07-03 23:34:19 +08:00

types

fix(provider): add experimental beta kill switch (#929)

2026-07-02 21:01:14 +08:00

ws

fix: resolve post-release semantic conflicts

2026-07-02 22:11:43 +08:00

connectHeadless.ts

experiment(desktop): static-import sidecars + drop src/ + node_modules/ from bundle

2026-04-12 00:05:39 +08:00

createDirectConnectSession.ts

init: add source code from src.zip

2026-03-31 01:55:58 -07:00

directConnectManager.ts

init: add source code from src.zip

2026-03-31 01:55:58 -07:00

h5AccessPolicy.ts

fix(desktop): trust loopback web dev access

2026-06-12 12:29:15 +08:00

index.ts

feat(desktop): stabilize H5 access tokens, ports, and background sessions (#767, #764)

2026-06-12 16:37:00 +08:00

lockfile.ts

experiment(desktop): static-import sidecars + drop src/ + node_modules/ from bundle

2026-04-12 00:05:39 +08:00

parseConnectUrl.ts

experiment(desktop): static-import sidecars + drop src/ + node_modules/ from bundle

2026-04-12 00:05:39 +08:00

router.ts

feat: add skill market api route

2026-07-03 23:32:00 +08:00

server.ts

experiment(desktop): static-import sidecars + drop src/ + node_modules/ from bundle

2026-04-12 00:05:39 +08:00

serverBanner.ts

experiment(desktop): static-import sidecars + drop src/ + node_modules/ from bundle

2026-04-12 00:05:39 +08:00

serverLog.ts

experiment(desktop): static-import sidecars + drop src/ + node_modules/ from bundle

2026-04-12 00:05:39 +08:00

sessionManager.ts

experiment(desktop): static-import sidecars + drop src/ + node_modules/ from bundle

2026-04-12 00:05:39 +08:00

staticH5.ts

fix(desktop): serve packaged H5 shell from Electron builds

2026-06-01 23:32:56 +08:00

types.ts

init: add source code from src.zip

2026-03-31 01:55:58 -07:00