skill-base - npm Package Compare versions

Comparing version 2.0.28 to 2.0.29

docs/README.zh.md

@@ -77,4 +77,2 @@ # Skill Base
 ├── skills.db
-├── skills.db-shm
-├── skills.db-wal
 └── skills/
@@ -93,4 +91,14 @@ └── <skill-id>/
 要求 Node.js >= 18。
-服务端现在使用 `node-sqlite3-wasm` 访问 SQLite，因此执行 `npx skill-base` 时不再依赖本地编译 `better-sqlite3`。
+服务端现在使用 `node-sqlite3-wasm` 访问 SQLite，因此日常启动时不再依赖本地编译 `better-sqlite3`。
+如果你是从旧版本升级，而旧版本曾把数据库运行在 WAL 模式，Skill Base 会在首次启动时自动调用随包分发的 `sqlite3` helper 完成迁移，再切换到新的 WASM 驱动继续运行，不需要手工执行迁移命令，也不会丢数据。
 
+当前随包提供的自动迁移 helper 平台：
+
+- macOS `arm64`
+- macOS `x64`
+- Linux `x64`
+- Windows `x64`
+
+如果你的部署平台不在上述列表中，但要升级旧的 WAL 数据库，可在首次启动前设置 `SKILL_BASE_SQLITE3_PATH` 指向本机可执行的 `sqlite3`。
+
 ```bash
@@ -97,0 +105,0 @@ npx skill-base -d ./skill-data -p 8000

package.json

 {
   "name": "skill-base",
-  "version": "2.0.28",
+  "version": "2.0.29",
   "description": "Skill Base - A lightweight, privately deployable agent skills distribution hub",
@@ -16,3 +16,2 @@ "main": "src/index.js",
   "homepage": "https://skillbase.reaidea.com",
-  "packageManager": "pnpm@10.28.0",
   "files": [
@@ -22,2 +21,3 @@ "bin",
     "static",
+    "vendor/sqlite3",
     "README.md",
@@ -24,0 +24,0 @@ "data/.gitkeep",

README.md

@@ -77,4 +77,2 @@ # Skill Base
 ├── skills.db
-├── skills.db-shm
-├── skills.db-wal
 └── skills/
@@ -93,4 +91,14 @@ └── <skill-id>/
 Requires Node.js >= 18.
-The server now uses `node-sqlite3-wasm` for SQLite access, so `npx skill-base` no longer depends on local `better-sqlite3` native compilation.
+The server now uses `node-sqlite3-wasm` for SQLite access, so normal startup no longer depends on local `better-sqlite3` native compilation.
+If you are upgrading from an older release that previously wrote SQLite in WAL mode, Skill Base will automatically migrate the existing database on first start using a bundled `sqlite3` helper, then continue running on the new WASM driver without manual steps or data loss.
 
+Bundled migration helpers are included for:
+
+- macOS `arm64`
+- macOS `x64`
+- Linux `x64`
+- Windows `x64`
+
+If you deploy on another platform and are upgrading an old WAL database, set `SKILL_BASE_SQLITE3_PATH` to a local `sqlite3` executable for the first startup.
+
 ```bash
@@ -97,0 +105,0 @@ npx skill-base -d ./skill-data -p 8000

src/database.js

@@ -0,3 +1,5 @@
+const { execFileSync } = require('child_process');
 const { Database } = require('node-sqlite3-wasm');
 const bcrypt = require('bcryptjs');
+const fs = require('fs');
 const path = require('path');
@@ -8,4 +10,81 @@
 
+const dbDir = path.dirname(dbPath);
+if (!fs.existsSync(dbDir)) {
+  fs.mkdirSync(dbDir, { recursive: true });
+}
+
 const DB_CLOSE_KEY = Symbol.for('skill-base.database.close');
 
+function closeSilently(database) {
+  try {
+    if (database?.isOpen) {
+      database.close();
+    }
+  } catch {
+    // Ignore close errors during reload/shutdown.
+  }
+}
+
+function resolveBundledSqlite3Path() {
+  if (process.env.SKILL_BASE_SQLITE3_PATH) {
+    return process.env.SKILL_BASE_SQLITE3_PATH;
+  }
+
+  const platformMap = {
+    darwin: 'darwin',
+    linux: 'linux',
+    win32: 'win32'
+  };
+  const archMap = {
+    arm64: 'arm64',
+    x64: 'x64'
+  };
+
+  const platform = platformMap[process.platform];
+  const arch = archMap[process.arch];
+  if (!platform || !arch) return null;
+
+  const bundledPath = path.join(__dirname, '../vendor/sqlite3', platform, arch, process.platform === 'win32' ? 'sqlite3.exe' : 'sqlite3');
+  return fs.existsSync(bundledPath) ? bundledPath : null;
+}
+
+function resolveMigrationHelperPath() {
+  const bundledPath = resolveBundledSqlite3Path();
+  if (bundledPath) return bundledPath;
+  return 'sqlite3';
+}
+
+/**
+ * better-sqlite3 / 系统 SQLite 默认常用 WAL；node-sqlite3-wasm 的 Node VFS 无法正常打开带 WAL 侧车的库。
+ * 启动前用 sqlite3 helper 自动 checkpoint 并改为 DELETE journal，保证旧库可无缝升级。
+ */
+function tryNormalizeSqliteJournalForWasm(dbFilePath) {
+  if (!fs.existsSync(dbFilePath)) return;
+  const walSidecar = `${dbFilePath}-wal`;
+  const shmSidecar = `${dbFilePath}-shm`;
+  const hasWalSidecar = fs.existsSync(walSidecar) || fs.existsSync(shmSidecar);
+  const helperPath = resolveMigrationHelperPath();
+  try {
+    execFileSync(
+      helperPath,
+      [dbFilePath, 'PRAGMA wal_checkpoint(TRUNCATE); PRAGMA journal_mode=DELETE;'],
+      { stdio: 'ignore', timeout: 120_000 }
+    );
+  } catch (err) {
+    if (!hasWalSidecar && !process.env.SKILL_BASE_SQLITE3_PATH && helperPath === 'sqlite3') {
+      return;
+    }
+    throw new Error(
+      'Skill Base 无法自动迁移旧版 SQLite WAL 数据库。' +
+        `\n数据库: ${dbFilePath}` +
+        `\nhelper: ${helperPath}` +
+        '\n请确保当前平台的内置 sqlite3 helper 已随包发布，或手动设置 SKILL_BASE_SQLITE3_PATH 指向可执行 sqlite3。' +
+        `\nUnderlying error: ${err && err.message ? err.message : String(err)}`
+    );
+  }
+}
+
+// In tests we reload this module with different DATABASE_PATH values.
+closeSilently(global[DB_CLOSE_KEY]?.database);
+
 function normalizeValue(value) {
@@ -47,15 +126,4 @@ if (typeof value === 'bigint' && value <= BigInt(Number.MAX_SAFE_INTEGER) && value >= BigInt(Number.MIN_SAFE_INTEGER)) {
 
-function closeSilently(database) {
-  try {
-    if (database?.isOpen) {
-      database.close();
-    }
-  } catch {
-    // Ignore close errors during reload/shutdown.
-  }
-}
+tryNormalizeSqliteJournalForWasm(dbPath);
 
-// In tests we reload this module with different DATABASE_PATH values.
-closeSilently(global[DB_CLOSE_KEY]?.database);
-
 const rawDb = new Database(dbPath);
@@ -115,4 +183,3 @@ global[DB_CLOSE_KEY] = { database: rawDb };
 
-// Enable WAL mode for better concurrency performance
-db.pragma('journal_mode = WAL');
+// node-sqlite3-wasm: keep default DELETE journal (WAL + this VFS breaks on many existing DBs).
 
@@ -119,0 +186,0 @@ // Enable foreign key constraints

New alerts

Native code

Supply chain risk

Contains native code (e.g., compiled binaries or shared libraries). Including native code can obscure malicious behavior.

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Improved metrics

Total package byte prevSize

14297205

361.04%

Number of package files

128

3.23%

Lines of code

8988

0.66%

Number of lines in readme file

335

2.45%

Worsened metrics

Number of low supply chain risk alerts

42

10.53%

Number of medium supply chain risk alerts

6

500%

No dependency changes