diff --git a/.graphlemon/runs/7fc3a7a3-ebe3-48ae-97de-a98f7f3c9d35/test_report.md b/.graphlemon/runs/7fc3a7a3-ebe3-48ae-97de-a98f7f3c9d35/test_report.md new file mode 100644 index 0000000..73ff9ad --- /dev/null +++ b/.graphlemon/runs/7fc3a7a3-ebe3-48ae-97de-a98f7f3c9d35/test_report.md @@ -0,0 +1,11 @@ +The graphlemon Work Node (coder) workflow (task wa4wewx1g) completed successfully. + +Task: Fix the /#/skills detail page not showing real skill content — it previously only read DB rows, never the actual skills//SKILL.md files on disk. + +Changes made (uncommitted, left for Validator review): +- src/skill_query.py — added get_skill_content() with path-traversal protection (realpath + commonpath containment check) and a new SkillContentMissingError; lists sibling references/templates/scripts as support file names. +- src/backend_server.py — new route GET /api/skills/:skill_id/content. +- frontend/app.js — new "Skill 内容" panel on the skill audit log view, alongside the existing iteration history panel. +- Tests: src/test_skill_query.py (+7 cases incl. traversal attempts) and src/test_backend_server.py (+3 cases). + +Verification: full src (530 tests) and supervisor (125 tests) suites pass except two pre-existing failures confirmed unrelated via git stash comparison. A manual live HTTP smoke test against a real skill file succeeded, including a rejected path-traversal attempt. Nothing was committed — next step is the normal Validator review. \ No newline at end of file