From 8e5b231df05328ae2da06ccf11717cc1bbb8d710 Mon Sep 17 00:00:00 2001 From: graphlemon Date: Wed, 5 Aug 2026 13:21:21 +0800 Subject: [PATCH] graphlemon: prd artifact for task 7fc3a7a3-ebe3-48ae-97de-a98f7f3c9d35 --- .graphlemon/runs/7fc3a7a3-ebe3-48ae-97de-a98f7f3c9d35/prd.md | 12 ++++++++++++ 1 file changed, 12 insertions(+), 0 deletions(-) create mode 100644 .graphlemon/runs/7fc3a7a3-ebe3-48ae-97de-a98f7f3c9d35/prd.md diff --git a/.graphlemon/runs/7fc3a7a3-ebe3-48ae-97de-a98f7f3c9d35/prd.md b/.graphlemon/runs/7fc3a7a3-ebe3-48ae-97de-a98f7f3c9d35/prd.md new file mode 100644 index 0000000..5ff1aa0 --- /dev/null +++ b/.graphlemon/runs/7fc3a7a3-ebe3-48ae-97de-a98f7f3c9d35/prd.md @@ -0,0 +1,12 @@ +The "graphlemon-node-3ec92f23d2eb41568f74a8f39c4676f8" workflow (planner) completed successfully (1 agent, 1 retry due to a transient stall, 107,744 tokens, 43 tool calls, ~8 min). + +Output: a PRD titled "Skill 详情页补齐「Skill 真实内容」展示", building on the approved BRD for the bug where `#/skills/:skill_id/audit` doesn't show a skill's real `SKILL.md` content. Key points: + +- New `skill_query.py` function to read `SKILL.md` plus list `references/`, `templates/`, `scripts/` support files, reusing `skill_update._skill_file_path`'s existing path-resolution logic rather than duplicating it. +- New read-only `GET /api/skills/:skill_id/content` endpoint matching the existing `/api/skills/:skill_id/audit` route conventions, returning 404 `NOT_FOUND` for both missing skills and path-traversal attempts (to avoid leaking probe information). +- New "Skill 内容" panel on the `v_skill_audit_log` page, shown alongside (not replacing) the existing audit-log panel; rendered as plain `
` text per the established `v_artifact_browser` convention — no Markdown/highlighting dependencies added.
+- Explicit path-traversal defense, since this is the repo's first case of a URL path segment feeding directly into filesystem path construction.
+- Required unit test coverage: normal read, skill not found, missing `SKILL.md` file on disk, and traversal rejection — full `python3 -m unittest discover -s src` must still pass (441 existing tests).
+- Scope explicitly excludes: touching `skill_update.py`'s migration/write/rollback logic, per-file preview of support files, and any Markdown rendering.
+
+Working tree is clean — no files were committed by this run; the PRD text is the planner node's output artifact for the next stage of the graphlemon Org Graph pipeline to consume.
\ No newline at end of file
--
libgit2 0.21.4