@actiondock/core 2.7.0 → 2.9.0

package/dist/server/server.js

@@ -1,17 +1,15 @@
-import { createServer as createNodeHttpServer } from "node:http";
-import { readFileSync } from "node:fs";
-import { resolve } from "node:path";
-import { Readable } from "node:stream";
-import { pipeline } from "node:stream/promises";
-import { createActionDockHost } from "../host/host.js";
+import { posix, resolve } from "node:path";
+import { NodeHttpServer } from "./http-server.js";
+import { createActionDock } from "../service/factory.js";
 import { NOT_FOUND, UNAUTHORIZED } from "../errors.js";
+import { parseActionRef } from "../catalog/resolve-action.js";
 import { ensureDependencyClosure } from "../project/closure.js";
 import { findProjectRoot } from "../project/loader.js";
 import { listLinkedPackages, resolvePackageRoot } from "../registry/registry.js";
-import { LocalActionDockTarget } from "../target/local.js";
 import { handleActionsRoutes, handleConfigRoutes, handleDoctorRoute, handleHealthRoute, handleInfoRoute, handlePlaybooksRoutes, handleRunsRoutes, handleStateRoutes, jsonResponse, } from "./routes/index.js";
-import { DEFAULT_MAX_BODY_BYTES } from "./body.js";
 import { isLoopbackHost, resolveCorsHeaders, verifyBearerToken } from "./security.js";
+import { createMcpEndpointHandler } from "./mcp-endpoint.js";
+import { extractBearerToken, matchViewByToken, normalizeServerViews, } from "./policy.js";
 /**
  * 规范化主机地址用于拼接 URL。
  * 若 host 包含冒号 : 且不以 [ 开头，则添加中括号包裹（IPv6 标准格式）。
@@ -23,132 +21,28 @@ export function formatHostForUrl(host) {
  * 根据当前运行时环境启动标准 Web Request/Response 兼容的 HTTP 服务。
  */
 export async function launchHttpServer(port, host, fetchHandler, tls) {
-    const requestListener = async (req, res) => {
-        const ac = new AbortController();
-        const onReqClose = () => {
-            if (!req.complete) {
-                ac.abort(new Error("Request aborted by client"));
-            }
-        };
-        const onResClose = () => {
-            if (!res.writableFinished) {
-                ac.abort(new Error("Request aborted by client"));
-            }
-        };
-        req.on("close", onReqClose);
-        res.on("close", onResClose);
-        try {
-            const protocol = req.socket?.encrypted ? "https" : "http";
-            const hostHeader = req.headers.host || "127.0.0.1";
-            const url = new URL(req.url || "/", `${protocol}://${hostHeader}`).href;
-            const headers = new Headers();
-            for (const [k, v] of Object.entries(req.headers)) {
-                if (v === undefined)
-                    continue;
-                if (Array.isArray(v)) {
-                    for (const item of v)
-                        headers.append(k, item);
-                }
-                else {
-                    headers.set(k, v);
-                }
-            }
-            const method = (req.method || "GET").toUpperCase();
-            const hasBody = method !== "GET" && method !== "HEAD";
-            const init = { method, headers, signal: ac.signal };
-            if (hasBody) {
-                init.body = Readable.toWeb(req);
-                init.duplex = "half";
-            }
-            const webReq = new Request(url, init);
-            const webRes = await fetchHandler(webReq);
-            res.statusCode = webRes.status;
-            if (webRes.statusText)
-                res.statusMessage = webRes.statusText;
-            webRes.headers.forEach((v, k) => res.setHeader(k, v));
-            if (!webRes.body) {
-                res.end();
-                return;
-            }
-            await pipeline(Readable.fromWeb(webRes.body), res);
-        }
-        catch (err) {
-            if (!res.headersSent) {
-                res.statusCode = 500;
-                res.end(JSON.stringify({ error: err?.message || String(err) }));
-            }
-            else {
-                res.destroy(err);
-            }
-        }
-        finally {
-            req.removeListener("close", onReqClose);
-            res.removeListener("close", onResClose);
-        }
-    };
-    let srv;
-    if (tls) {
-        let cert = tls.cert;
-        if (!cert && tls.certPath) {
-            cert = readFileSync(tls.certPath);
-        }
-        let key = tls.key;
-        if (!key && tls.keyPath) {
-            key = readFileSync(tls.keyPath);
-        }
-        const httpsOptions = {
-            cert,
-            key,
-        };
-        if (tls.ca) {
-            httpsOptions.ca = tls.ca;
-        }
-        if (tls.passphrase) {
-            httpsOptions.passphrase = tls.passphrase;
-        }
-        const { createServer: createHttpsServer } = await import("node:https");
-        srv = createHttpsServer(httpsOptions, requestListener);
-    }
-    else {
-        srv = createNodeHttpServer(requestListener);
-    }
-    const instance = {
+    const server = new NodeHttpServer({
         port,
+        host,
+        fetch: fetchHandler,
+        tls,
+    });
+    await server.listen(port, host);
+    const instance = {
+        port: server.port,
         stop: async () => {
-            await new Promise((resolve) => {
-                srv.close(() => resolve());
-                srv.closeAllConnections?.();
-            });
+            await server.close();
         },
+        ready: Promise.resolve(),
     };
-    await new Promise((resolve, reject) => {
-        srv.once("error", (err) => {
-            reject(err);
-        });
-        srv.listen(port, host, () => {
-            const addr = srv.address();
-            if (typeof addr === "object" && addr) {
-                instance.port = addr.port;
-            }
-            resolve();
-        });
-    });
-    instance.ready = Promise.resolve();
     return instance;
 }
 /**
- * 启动 ActionDock 2.0 原生轻量级 HTTP 服务端。
- * 作为 ActionDockHost 与 ActionDockTarget 的薄适配层，负责中间件流转、认证拦截与路由分发。
+ * 启动 ActionDock 原生轻量级 HTTP 服务端。
+ * 面向 ActionDockService 服务端口，负责中间件流转、认证拦截与路由分发。
  */
 export async function startActionDockServer(options = {}) {
-    let hostInstance = options.hostInstance ??
-        (options.host && typeof options.host === "object" && "listActions" in options.host
-            ? options.host
-            : undefined);
-    let targetInstance = options.target;
-    const hostString = typeof options.host === "string"
-        ? options.host
-        : (options.hostname ?? "127.0.0.1");
+    const hostString = options.hostname ?? options.host ?? "127.0.0.1";
     const port = options.port ?? 5177;
     const host = hostString;
     const token = options.token;
@@ -156,38 +50,53 @@ export async function startActionDockServer(options = {}) {
     const projectRoot = options.projectRoot
         ? resolve(options.projectRoot)
         : findProjectRoot(process.cwd());
+    // 1. 归一化解析视图配置集合（含默认视图与自定义视图）
+    const { defaultView, views } = normalizeServerViews(options);
     // 非回环地址强制要求配置 Token 鉴权（防裸奔）
-    if (!isLoopbackHost(host) && !token && !options.allowInsecureNoAuth) {
+    const hasTokenConfigured = Boolean(token ||
+        defaultView.policy.token ||
+        Array.from(views.values()).some((v) => Boolean(v.policy.token)));
+    if (!isLoopbackHost(host) && !hasTokenConfigured && !options.allowInsecureNoAuth) {
         throw new Error("Authentication token is required when binding to a non-loopback address. Use --allow-insecure-no-auth to override.");
     }
-    // 若调用方未传入 host 或 target，通过 projectRoot、customHome、platform 等直接创建宿主
-    if (!targetInstance && !hostInstance) {
+    let serviceInstance = options.service;
+    // 若未传 service，服务端统一通过 createActionDock() 实例化，不再接受或处理外部传入的 Host 实体
+    if (!serviceInstance) {
         const scanLinkedPackages = options.scanLinkedPackages ?? !projectRoot;
-        hostInstance = await createActionDockHost({
+        serviceInstance = await createActionDock({
             projectRoot: projectRoot || undefined,
             customHome,
             platform: options.platform,
             dataDir: options.dataDir,
             inMemory: options.inMemory,
             scanLinkedPackages,
-            autoLoadCurrentProject: true,
+            enableManagement: options.enableManagement,
         });
     }
-    if (!targetInstance && hostInstance) {
-        targetInstance = new LocalActionDockTarget(hostInstance);
-    }
-    else if (targetInstance && !hostInstance) {
-        const inner = targetInstance?.unwrap?.();
-        if (inner && "listApps" in inner) {
-            hostInstance = inner;
-        }
+    if (!serviceInstance) {
+        throw new Error("Failed to initialize ActionDockService for server");
     }
+    // 2. 聚合所有 views 声明的依赖包与动作，确保依赖闭包满足
     const roots = [];
     if (projectRoot) {
         roots.push(projectRoot);
     }
-    if (options.packageAllowlist && options.packageAllowlist.length > 0) {
-        for (const pkgId of options.packageAllowlist) {
+    const aggregatedPackageAllowlist = new Set();
+    const aggregatedActionAllowlist = new Set();
+    for (const v of views.values()) {
+        if (v.policy.packageAllowlist) {
+            for (const pkg of v.policy.packageAllowlist) {
+                aggregatedPackageAllowlist.add(pkg);
+            }
+        }
+        if (v.policy.actionAllowlist) {
+            for (const act of v.policy.actionAllowlist) {
+                aggregatedActionAllowlist.add(act);
+            }
+        }
+    }
+    if (aggregatedPackageAllowlist.size > 0) {
+        for (const pkgId of aggregatedPackageAllowlist) {
             const r = resolvePackageRoot(pkgId, projectRoot || undefined, customHome);
             if (r && !roots.includes(r)) {
                 roots.push(r);
@@ -201,9 +110,85 @@ export async function startActionDockServer(options = {}) {
             }
         }
     }
+    if (aggregatedActionAllowlist.size > 0) {
+        for (const actRef of aggregatedActionAllowlist) {
+            try {
+                const parsed = parseActionRef(actRef);
+                if (parsed.packageId) {
+                    const r = resolvePackageRoot(parsed.packageId, projectRoot || undefined, customHome);
+                    if (r && !roots.includes(r)) {
+                        roots.push(r);
+                    }
+                }
+            }
+            catch { }
+        }
+    }
     if (roots.length > 0) {
         await ensureDependencyClosure(roots, { customHome });
     }
+    // 3. 为每个启用 MCP 的视图独立装配 MCP 处理器
+    if (options.enableMcp !== false) {
+        for (const v of views.values()) {
+            if (v.enableMcp !== false) {
+                let delegate;
+                if (v.rawOptions.mcpHandler) {
+                    if (v.rawOptions.mcpHandler.length >= 2) {
+                        delegate = (req) => v.rawOptions.mcpHandler(req, v.policy);
+                    }
+                    else {
+                        let factoryResult;
+                        try {
+                            factoryResult = v.rawOptions.mcpHandler(v.policy);
+                        }
+                        catch {
+                            factoryResult = null;
+                        }
+                        if (typeof factoryResult === "function") {
+                            delegate = factoryResult;
+                        }
+                        else {
+                            delegate = (req) => v.rawOptions.mcpHandler(req, v.policy);
+                        }
+                    }
+                }
+                else if (options.mcpHandlerFactory) {
+                    delegate = options.mcpHandlerFactory(v.policy);
+                }
+                else if (options.mcpHandler) {
+                    if (options.mcpHandler.length >= 2) {
+                        delegate = (req) => options.mcpHandler(req, v.policy);
+                    }
+                    else {
+                        let factoryResult;
+                        try {
+                            factoryResult = options.mcpHandler(v.policy);
+                        }
+                        catch {
+                            factoryResult = null;
+                        }
+                        if (typeof factoryResult === "function") {
+                            delegate = factoryResult;
+                        }
+                        else {
+                            if (factoryResult && typeof factoryResult.catch === "function") {
+                                factoryResult.catch(() => { });
+                            }
+                            delegate = (req) => options.mcpHandler(req, v.policy);
+                        }
+                    }
+                }
+                if (delegate) {
+                    v.mcpEndpointHandler = createMcpEndpointHandler(delegate, {
+                        token: v.policy.token,
+                        allowQueryToken: options.allowQueryToken,
+                        corsOrigins: options.corsOrigins,
+                        maxBodyBytes: options.maxBodyBytes,
+                    });
+                }
+            }
+        }
+    }
     const fetchHandler = async (req) => {
         const origin = req.headers.get("origin");
         const corsHeaders = resolveCorsHeaders(origin, options.corsOrigins);
@@ -214,104 +199,113 @@ export async function startActionDockServer(options = {}) {
             });
         }
         const url = new URL(req.url);
-        const pathname = url.pathname;
+        const rawPathname = url.pathname;
+        let activeView;
+        let effectivePathname;
+        let effectiveReq = req;
+        // 1. 检查是否为 /views/:viewName/... 命名空间路由
+        const viewMatch = rawPathname.match(/^\/views\/([^/]+)(\/.*)?$/);
+        if (viewMatch) {
+            let viewName;
+            try {
+                viewName = decodeURIComponent(viewMatch[1]);
+            }
+            catch {
+                return jsonResponse({
+                    ok: false,
+                    error: {
+                        code: NOT_FOUND,
+                        message: `Invalid view name encoding: '${viewMatch[1]}'`,
+                    },
+                }, 400, corsHeaders);
+            }
+            const matched = views.get(viewName);
+            if (!matched) {
+                return jsonResponse({
+                    ok: false,
+                    error: {
+                        code: NOT_FOUND,
+                        message: `View '${viewName}' not found`,
+                    },
+                }, 404, corsHeaders);
+            }
+            activeView = matched;
+            // 规范化子路径，防范路径穿透与多斜杠混淆
+            let rawEffective = viewMatch[2] || "/";
+            if (!rawEffective.startsWith("/")) {
+                rawEffective = "/" + rawEffective;
+            }
+            const normalizedPath = posix.normalize(rawEffective);
+            effectivePathname = normalizedPath.startsWith("/") ? normalizedPath : "/" + normalizedPath;
+            // 剥离 /views/:viewName 前缀后重构 URL 与 Request
+            const rewrittenUrl = new URL(req.url);
+            rewrittenUrl.pathname = effectivePathname;
+            try {
+                const init = {
+                    method: req.method,
+                    headers: req.headers,
+                    signal: req.signal,
+                };
+                if (req.body && req.method !== "GET" && req.method !== "HEAD") {
+                    init.body = req.body;
+                    init.duplex = "half";
+                }
+                effectiveReq = new Request(rewrittenUrl.toString(), init);
+            }
+            catch {
+                effectiveReq = req;
+            }
+        }
+        else {
+            // 根路径请求：智能根据 Bearer Token 匹配视图或回退默认视图（遍历全量视图以防范时序差异）
+            effectivePathname = rawPathname;
+            const clientToken = extractBearerToken(req, options.allowQueryToken);
+            if (clientToken) {
+                const matchedByToken = matchViewByToken(clientToken, views.values());
+                activeView = matchedByToken ?? defaultView;
+            }
+            else {
+                activeView = defaultView;
+            }
+        }
+        const effectivePolicy = activeView.policy;
+        const effectiveUrl = new URL(effectiveReq.url);
+        effectiveUrl.pathname = effectivePathname;
         const ctx = {
-            req,
-            url,
-            pathname,
+            req: effectiveReq,
+            url: effectiveUrl,
+            pathname: effectivePathname,
             corsHeaders,
             projectRoot,
             customHome,
-            host: hostInstance,
-            target: targetInstance,
+            service: serviceInstance,
             options,
+            activePolicy: effectivePolicy,
         };
-        // 1. 健康检查路由（内部处理独立鉴权逻辑）
+        // 2. 健康检查路由（内部处理独立鉴权逻辑，使用 activePolicy.token）
         const healthResponse = await handleHealthRoute(ctx);
         if (healthResponse) {
             return healthResponse;
         }
-        // 2. MCP 统一网关端点
-        if (options.enableMcp !== false &&
-            options.mcpHandler &&
-            (pathname === "/mcp" || pathname.startsWith("/mcp/"))) {
-            if (!verifyBearerToken(req, token, options)) {
+        // 3. MCP 统一网关端点（委托当前视图的端点处理器）
+        if (effectivePathname === "/mcp" || effectivePathname.startsWith("/mcp/")) {
+            if (activeView.enableMcp === false || options.enableMcp === false) {
                 return jsonResponse({
                     ok: false,
                     error: {
-                        code: UNAUTHORIZED,
-                        message: "Invalid or missing Bearer token",
+                        code: NOT_FOUND,
+                        message: `MCP endpoint is disabled for view '${activeView.name}'`,
                     },
-                }, 401, corsHeaders);
-            }
-            // 请求体体积限制保护
-            const maxBytes = options.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;
-            const contentLengthHeader = req.headers.get("content-length");
-            if (contentLengthHeader) {
-                const parsedLength = parseInt(contentLengthHeader, 10);
-                if (!isNaN(parsedLength) && parsedLength > maxBytes) {
-                    return jsonResponse({
-                        ok: false,
-                        error: {
-                            code: "REQUEST_TOO_LARGE",
-                            message: "Request body exceeds maximum allowed size",
-                        },
-                    }, 413, corsHeaders);
-                }
+                }, 404, corsHeaders);
             }
-            let mcpReq = req;
-            if (req.body && req.method !== "GET" && req.method !== "HEAD") {
-                const reader = req.body.getReader();
-                const chunks = [];
-                let totalBytes = 0;
-                let tooLarge = false;
-                try {
-                    while (true) {
-                        const { done, value } = await reader.read();
-                        if (done)
-                            break;
-                        if (value) {
-                            totalBytes += value.byteLength;
-                            if (totalBytes > maxBytes) {
-                                tooLarge = true;
-                                await reader.cancel();
-                                break;
-                            }
-                            chunks.push(value);
-                        }
-                    }
-                }
-                finally {
-                    reader.releaseLock();
-                }
-                if (tooLarge) {
-                    return jsonResponse({
-                        ok: false,
-                        error: {
-                            code: "REQUEST_TOO_LARGE",
-                            message: "Request body exceeds maximum allowed size",
-                        },
-                    }, 413, corsHeaders);
-                }
-                const merged = new Uint8Array(totalBytes);
-                let offset = 0;
-                for (const chunk of chunks) {
-                    merged.set(chunk, offset);
-                    offset += chunk.byteLength;
-                }
-                mcpReq = new Request(req.url, {
-                    method: req.method,
-                    headers: req.headers,
-                    body: merged,
-                    signal: req.signal,
-                });
+            if (activeView.mcpEndpointHandler) {
+                const mcpRes = await activeView.mcpEndpointHandler(effectiveReq);
+                if (mcpRes)
+                    return mcpRes;
             }
-            const mcpRes = await options.mcpHandler(mcpReq);
-            if (mcpRes)
-                return mcpRes;
         }
-        // 3. 全局 API 认证鉴权拦截
-        if (!verifyBearerToken(req, token, options)) {
+        // 4. API 认证鉴权拦截（基于当前生效策略中的 Token）
+        if (!verifyBearerToken(effectiveReq, effectivePolicy.token, options)) {
             return jsonResponse({
                 ok: false,
                 error: {
@@ -320,7 +314,7 @@ export async function startActionDockServer(options = {}) {
                 },
             }, 401, corsHeaders);
         }
-        // 4. 业务领域路由分发（完全委托 Target / Host）
+        // 5. 业务领域路由分发（完全委托 Service 与 RouteContext 中的 activePolicy）
         const routeResponse = (await handleInfoRoute(ctx)) ||
             (await handleDoctorRoute(ctx)) ||
             (await handleActionsRoutes(ctx)) ||
@@ -331,12 +325,12 @@ export async function startActionDockServer(options = {}) {
         if (routeResponse) {
             return routeResponse;
         }
-        // 5. 404 路由兜底
+        // 6. 404 路由兜底
         return jsonResponse({
             ok: false,
             error: {
                 code: NOT_FOUND,
-                message: `Route not found: ${req.method} ${pathname}`,
+                message: `Route not found: ${req.method} ${rawPathname}`,
             },
         }, 404, corsHeaders);
     };
@@ -353,28 +347,20 @@ export async function startActionDockServer(options = {}) {
         set port(val) {
             server.port = val;
         },
-        host: hostInstance,
-        target: targetInstance,
+        service: serviceInstance,
         get url() {
             return `${protocol}://${formatHostForUrl(actualHost)}:${this.port}`;
         },
         ready: Promise.resolve(),
         stop: async (stopOptions) => {
             await server.stop(true);
-            if (targetInstance) {
-                try {
-                    await targetInstance.close(stopOptions?.graceMs !== undefined ? { timeoutMs: stopOptions.graceMs } : undefined);
-                }
-                catch {
-                    // 忽略关闭异常
-                }
-            }
-            if (hostInstance && hostInstance !== targetInstance?.unwrap?.()) {
+            if (serviceInstance) {
                 try {
-                    await hostInstance.close(stopOptions);
+                    await serviceInstance.close(stopOptions);
                 }
-                catch {
-                    // 忽略宿主关闭异常
+                catch (err) {
+                    // 服务关闭失败不阻断停机流程，但保留可观测诊断
+                    console.warn(`[ActionDockServer] Service close failed during stop: ${err instanceof Error ? err.message : String(err)}`);
                 }
             }
         },