Add TKMind platform extensions, H5/MindSpace stack, and deployment tooling.

Fork goose with custom MCP widgets, platform extensions (aider, git, web, search),
MindSpace H5 backend/frontend, Plaza/Ops UIs, and deploy scripts for tkmind.cn.

Co-authored-by: Cursor <cursoragent@cursor.com>

ui/h5/user-publish.test.mjs

@@ -0,0 +1,77 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import {
+  buildPublicUrl,
+  buildPublishConstraints,
+  buildSandboxSessionConstraints,
+  ensureUserPublishLayout,
+  isPathInsidePublishDir,
+  PUBLISH_ROOT_DIR,
+} from './user-publish.mjs';
+import { syncSkillsToWorkspace } from './skills-registry.mjs';
+import { listPlatformSkillCatalog } from './skills-registry.mjs';
+
+test('publish dir and public url use username slug', () => {
+  const platformRoot = path.dirname(fileURLToPath(import.meta.url));
+  const h5Root = fs.mkdtempSync(path.join(os.tmpdir(), 'h5-'));
+  const layout = ensureUserPublishLayout({
+    h5Root,
+    publicBaseUrl: 'https://goo.tkmind.cn',
+    user: { username: 'john' },
+  });
+  assert.equal(layout.slug, 'john');
+  assert.ok(layout.publishDir.endsWith(`${path.sep}${PUBLISH_ROOT_DIR}${path.sep}john`));
+  assert.equal(layout.publicUrl, `https://goo.tkmind.cn/${PUBLISH_ROOT_DIR}/john/`);
+  assert.equal(
+    buildPublicUrl('https://goo.tkmind.cn', 'john', 'report.html'),
+    `https://goo.tkmind.cn/${PUBLISH_ROOT_DIR}/john/report.html`,
+  );
+  const catalog = listPlatformSkillCatalog(platformRoot);
+  syncSkillsToWorkspace({
+    h5Root: platformRoot,
+    publishDir: layout.publishDir,
+    skillMap: { 'static-page-publish': true },
+    catalog,
+    user: { username: 'john' },
+    publicBaseUrl: 'https://goo.tkmind.cn',
+  });
+  const skillPath = path.join(layout.publishDir, '.agents', 'skills', 'static-page-publish', 'SKILL.md');
+  assert.ok(fs.existsSync(skillPath));
+  const skillText = fs.readFileSync(skillPath, 'utf8');
+  assert.match(skillText, new RegExp(`goo\\.tkmind\\.cn/${PUBLISH_ROOT_DIR}/john`));
+  assert.match(skillText, /\[.*\]\(.*\)/);
+  assert.match(skillText, /mindspace-cover/);
+  assert.match(skillText, /\.thumbnail\.svg/);
+});
+
+test('buildPublishConstraints scopes default search to user workspace', () => {
+  const publishDir = `/var/h5/${PUBLISH_ROOT_DIR}/john`;
+  const constraints = buildPublishConstraints({
+    slug: 'john',
+    publicBaseUrl: 'https://goo.tkmind.cn',
+    publishDir,
+  });
+  assert.match(constraints, /唯一文件根目录/);
+  assert.match(constraints, /禁止用公网 URL 列目录/);
+  assert.match(constraints, /oa\//);
+});
+
+test('buildSandboxSessionConstraints documents shell and forbids public url browsing', () => {
+  const text = buildSandboxSessionConstraints({
+    baseConstraints: 'base',
+    developerTools: ['write', 'edit', 'shell', 'tree'],
+  });
+  assert.match(text, /shell 已开启/);
+  assert.match(text, /禁止.*curl/);
+  assert.match(text, /tree 已开启/);
+});
+
+test('isPathInsidePublishDir blocks escape', () => {
+  const publishDir = `/var/h5/${PUBLISH_ROOT_DIR}/john`;
+  assert.equal(isPathInsidePublishDir(publishDir, `/var/h5/${PUBLISH_ROOT_DIR}/john/report.html`), true);
+  assert.equal(isPathInsidePublishDir(publishDir, `/var/h5/${PUBLISH_ROOT_DIR}/other/x.html`), false);
+});