prd.md 1.75 KB

Edit Raw Blame History


The "graphlemon-node-3ec92f23d2eb41568f74a8f39c4676f8" workflow (planner) completed successfully (1 agent, 1 retry due to a transient stall, 107,744 tokens, 43 tool calls, ~8 min).

Output: a PRD titled "Skill 详情页补齐「Skill 真实内容」展示", building on the approved BRD for the bug where #/skills/:skill_id/audit doesn't show a skill's real SKILL.md content. Key points:


New skill_query.py function to read SKILL.md plus list references/, templates/, scripts/ support files, reusing skill_update._skill_file_path's existing path-resolution logic rather than duplicating it.
New read-only GET /api/skills/:skill_id/content endpoint matching the existing /api/skills/:skill_id/audit route conventions, returning 404 NOT_FOUND for both missing skills and path-traversal attempts (to avoid leaking probe information).
New "Skill 内容" panel on the v_skill_audit_log page, shown alongside (not replacing) the existing audit-log panel; rendered as plain <pre> text per the established v_artifact_browser convention — no Markdown/highlighting dependencies added.
Explicit path-traversal defense, since this is the repo's first case of a URL path segment feeding directly into filesystem path construction.
Required unit test coverage: normal read, skill not found, missing SKILL.md file on disk, and traversal rejection — full python3 -m unittest discover -s src must still pass (441 existing tests).
Scope explicitly excludes: touching skill_update.py's migration/write/rollback logic, per-file preview of support files, and any Markdown rendering.


Working tree is clean — no files were committed by this run; the PRD text is the planner node's output artifact for the next stage of the graphlemon Org Graph pipeline to consume.