Files
obsidian-mcp/Services/VaultSearchService.cs
zhengchen.tao 28f9a54ba9
Build Docker Image / build (push) Failing after 9m21s
Build Docker Image / deploy (push) Has been skipped
obsidian-mcp: 初次落地 Obsidian Vault MCP Server (.NET 10, read+write)
把 Obsidian vault 通过 MCP 暴露给 Claude.ai,OAuth 走 nas-auth。
设计文档见 vault Coding/obsidian-mcp/obsidian-mcp 设计.md。
代码层落地参考 vault Coding/obsidian-mcp/MCP 实现指南.md。

V1+V2 同时实现(用户要求跳过分阶段直接全部):

读 Tools(需 scope=read:obsidian):
- list_vault_tree(一次性 vault 地图,限制深度)
- list_files / read_file(含 offset/limit 大文件分页)
- search(子串匹配 + glob 过滤,最多 50 hits)
- get_metadata(size / modified_at / has_frontmatter)

写 Tools(需 scope=write:obsidian):
- write_file / append_file
- 多重门禁:scope 校验 + 路径黑名单 + 写入白名单 + 永禁文件
  - 永禁写:任意目录的 AGENTS.md / PROFILE.md / README.md / CLAUDE.md / 01-Secret/**
  - 白名单:02-ShengquGames/logs/ + Coding/ + NAS/NAS 待办清单.md
- 写入审计日志按天 rotate(JSON line)

安全:
- VaultPathResolver chroot:path traversal + symlink 双拒绝
- JwtBearer (HS256, Current+Previous fallback, MapInboundClaims=false)
- aud=obsidian, iss=https://auth.zhengchentao.win
- 黑名单:01-Secret / .obsidian / .trash / .git

技术栈:
- .NET 10 + ModelContextProtocol SDK 1.0
- Streamable HTTP transport (POST /mcp)
- JwtBearer 10.0 + IdentityModel.Tokens 8.x

部署:
- Dockerfile multi-stage,runtime 装 ripgrep(V3 备用),non-root user
- .gitea/workflows/build-image.yml:build + deploy 双 job,buildkit v0.13.2
- 容器内 :8080,宿主端口 9090
- 子域名 obs.zhengchentao.win
- vault 挂载 /volume1/docker/webdav/data/Zhengchen:/vault:rw(V2 写入需要 rw)

测试:35/35 单测过(VaultPathResolver path traversal/blacklist/symlink + VaultWriteGuard whitelist/forbidden)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-06 01:32:11 +08:00

105 lines
3.3 KiB
C#

using Microsoft.Extensions.FileSystemGlobbing;
using Microsoft.Extensions.FileSystemGlobbing.Abstractions;
namespace ObsidianMcp.Services;
/// <summary>
/// Vault 全文搜索服务。
/// 纯 C# 实现,大小写不敏感子串匹配(不支持 regex)。
/// V3 可替换为 ripgrep 调用。
/// </summary>
public class VaultSearchService
{
private readonly VaultPathResolver _resolver;
public VaultSearchService(VaultPathResolver resolver)
{
_resolver = resolver;
}
/// <param name="query">大小写不敏感的子串</param>
/// <param name="glob">glob 过滤,例如 "NAS/**/*.md",为 null 时搜全 vault</param>
/// <param name="limit">最多返回条数</param>
/// <param name="ct">CancellationToken</param>
public async Task<List<SearchHit>> SearchAsync(
string query,
string? glob,
int limit,
CancellationToken ct = default)
{
var root = _resolver.VaultRoot;
var files = GetFilesToSearch(root, glob);
var hits = new List<SearchHit>();
foreach (var file in files)
{
if (ct.IsCancellationRequested) break;
if (hits.Count >= limit) break;
await SearchFileAsync(file, root, query, limit, hits, ct);
}
return hits;
}
private static IEnumerable<string> GetFilesToSearch(string root, string? glob)
{
if (string.IsNullOrWhiteSpace(glob))
{
// 全 vault 搜索,只搜 .md 文件(.json/.yaml 通常不需要全文检索)
return Directory.EnumerateFiles(root, "*.md", SearchOption.AllDirectories);
}
// 用 Microsoft.Extensions.FileSystemGlobbing 做 glob 过滤
var matcher = new Matcher(StringComparison.OrdinalIgnoreCase);
matcher.AddInclude(glob);
var dirInfo = new DirectoryInfoWrapper(new DirectoryInfo(root));
var result = matcher.Execute(dirInfo);
return result.Files.Select(f => Path.Combine(root, f.Path));
}
private static async Task SearchFileAsync(
string filePath,
string root,
string query,
int limit,
List<SearchHit> hits,
CancellationToken ct)
{
// 跳过过大的文件(>5MB),避免 OOM
var fi = new FileInfo(filePath);
if (!fi.Exists || fi.Length > 5 * 1024 * 1024) return;
try
{
int lineNumber = 0;
await foreach (var line in File.ReadLinesAsync(filePath, ct))
{
lineNumber++;
if (hits.Count >= limit) break;
if (line.Contains(query, StringComparison.OrdinalIgnoreCase))
{
hits.Add(new SearchHit
{
File = Path.GetRelativePath(root, filePath).Replace('\\', '/'),
Line = lineNumber,
Preview = line.Length > 200 ? line[..200] + "..." : line,
});
}
}
}
catch (IOException)
{
// 文件读取失败(权限、锁定等),跳过不影响其他结果
}
}
}
public class SearchHit
{
public string File { get; set; } = "";
public int Line { get; set; }
public string Preview { get; set; } = "";
}