28f9a54ba9
把 Obsidian vault 通过 MCP 暴露给 Claude.ai,OAuth 走 nas-auth。 设计文档见 vault Coding/obsidian-mcp/obsidian-mcp 设计.md。 代码层落地参考 vault Coding/obsidian-mcp/MCP 实现指南.md。 V1+V2 同时实现(用户要求跳过分阶段直接全部): 读 Tools(需 scope=read:obsidian): - list_vault_tree(一次性 vault 地图,限制深度) - list_files / read_file(含 offset/limit 大文件分页) - search(子串匹配 + glob 过滤,最多 50 hits) - get_metadata(size / modified_at / has_frontmatter) 写 Tools(需 scope=write:obsidian): - write_file / append_file - 多重门禁:scope 校验 + 路径黑名单 + 写入白名单 + 永禁文件 - 永禁写:任意目录的 AGENTS.md / PROFILE.md / README.md / CLAUDE.md / 01-Secret/** - 白名单:02-ShengquGames/logs/ + Coding/ + NAS/NAS 待办清单.md - 写入审计日志按天 rotate(JSON line) 安全: - VaultPathResolver chroot:path traversal + symlink 双拒绝 - JwtBearer (HS256, Current+Previous fallback, MapInboundClaims=false) - aud=obsidian, iss=https://auth.zhengchentao.win - 黑名单:01-Secret / .obsidian / .trash / .git 技术栈: - .NET 10 + ModelContextProtocol SDK 1.0 - Streamable HTTP transport (POST /mcp) - JwtBearer 10.0 + IdentityModel.Tokens 8.x 部署: - Dockerfile multi-stage,runtime 装 ripgrep(V3 备用),non-root user - .gitea/workflows/build-image.yml:build + deploy 双 job,buildkit v0.13.2 - 容器内 :8080,宿主端口 9090 - 子域名 obs.zhengchentao.win - vault 挂载 /volume1/docker/webdav/data/Zhengchen:/vault:rw(V2 写入需要 rw) 测试:35/35 单测过(VaultPathResolver path traversal/blacklist/symlink + VaultWriteGuard whitelist/forbidden) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
105 lines
3.3 KiB
C#
105 lines
3.3 KiB
C#
using Microsoft.Extensions.FileSystemGlobbing;
|
|
using Microsoft.Extensions.FileSystemGlobbing.Abstractions;
|
|
|
|
namespace ObsidianMcp.Services;
|
|
|
|
/// <summary>
|
|
/// Vault 全文搜索服务。
|
|
/// 纯 C# 实现,大小写不敏感子串匹配(不支持 regex)。
|
|
/// V3 可替换为 ripgrep 调用。
|
|
/// </summary>
|
|
public class VaultSearchService
|
|
{
|
|
private readonly VaultPathResolver _resolver;
|
|
|
|
public VaultSearchService(VaultPathResolver resolver)
|
|
{
|
|
_resolver = resolver;
|
|
}
|
|
|
|
/// <param name="query">大小写不敏感的子串</param>
|
|
/// <param name="glob">glob 过滤,例如 "NAS/**/*.md",为 null 时搜全 vault</param>
|
|
/// <param name="limit">最多返回条数</param>
|
|
/// <param name="ct">CancellationToken</param>
|
|
public async Task<List<SearchHit>> SearchAsync(
|
|
string query,
|
|
string? glob,
|
|
int limit,
|
|
CancellationToken ct = default)
|
|
{
|
|
var root = _resolver.VaultRoot;
|
|
var files = GetFilesToSearch(root, glob);
|
|
|
|
var hits = new List<SearchHit>();
|
|
foreach (var file in files)
|
|
{
|
|
if (ct.IsCancellationRequested) break;
|
|
if (hits.Count >= limit) break;
|
|
|
|
await SearchFileAsync(file, root, query, limit, hits, ct);
|
|
}
|
|
|
|
return hits;
|
|
}
|
|
|
|
private static IEnumerable<string> GetFilesToSearch(string root, string? glob)
|
|
{
|
|
if (string.IsNullOrWhiteSpace(glob))
|
|
{
|
|
// 全 vault 搜索,只搜 .md 文件(.json/.yaml 通常不需要全文检索)
|
|
return Directory.EnumerateFiles(root, "*.md", SearchOption.AllDirectories);
|
|
}
|
|
|
|
// 用 Microsoft.Extensions.FileSystemGlobbing 做 glob 过滤
|
|
var matcher = new Matcher(StringComparison.OrdinalIgnoreCase);
|
|
matcher.AddInclude(glob);
|
|
var dirInfo = new DirectoryInfoWrapper(new DirectoryInfo(root));
|
|
var result = matcher.Execute(dirInfo);
|
|
return result.Files.Select(f => Path.Combine(root, f.Path));
|
|
}
|
|
|
|
private static async Task SearchFileAsync(
|
|
string filePath,
|
|
string root,
|
|
string query,
|
|
int limit,
|
|
List<SearchHit> hits,
|
|
CancellationToken ct)
|
|
{
|
|
// 跳过过大的文件(>5MB),避免 OOM
|
|
var fi = new FileInfo(filePath);
|
|
if (!fi.Exists || fi.Length > 5 * 1024 * 1024) return;
|
|
|
|
try
|
|
{
|
|
int lineNumber = 0;
|
|
await foreach (var line in File.ReadLinesAsync(filePath, ct))
|
|
{
|
|
lineNumber++;
|
|
if (hits.Count >= limit) break;
|
|
|
|
if (line.Contains(query, StringComparison.OrdinalIgnoreCase))
|
|
{
|
|
hits.Add(new SearchHit
|
|
{
|
|
File = Path.GetRelativePath(root, filePath).Replace('\\', '/'),
|
|
Line = lineNumber,
|
|
Preview = line.Length > 200 ? line[..200] + "..." : line,
|
|
});
|
|
}
|
|
}
|
|
}
|
|
catch (IOException)
|
|
{
|
|
// 文件读取失败(权限、锁定等),跳过不影响其他结果
|
|
}
|
|
}
|
|
}
|
|
|
|
public class SearchHit
|
|
{
|
|
public string File { get; set; } = "";
|
|
public int Line { get; set; }
|
|
public string Preview { get; set; } = "";
|
|
}
|