@agentunion/kite 1.4.0 → 1.6.0

package/extensions/services/kite_console/evol_api.py

@@ -0,0 +1,179 @@
+"""
+Evol API 调用封装
+"""
+
+import asyncio
+import json
+import httpx
+from typing import Optional
+
+
+class EvolAPI:
+    """Evol API 客户端"""
+
+    def __init__(self, base_url: str = "https://api.evolai.cn:8550"):
+        self.base_url = base_url
+        self.timeout = 30.0
+
+    def _log_request(self, method: str, url: str, **kwargs):
+        """记录请求日志"""
+        log_data = {
+            "method": method,
+            "url": url,
+        }
+        if "json" in kwargs:
+            # 隐藏敏感信息
+            data = kwargs["json"].copy()
+            if "code" in data:
+                data["code"] = "***"
+            log_data["body"] = data
+        if "headers" in kwargs:
+            headers = kwargs["headers"].copy()
+            if "Authorization" in headers:
+                headers["Authorization"] = "Bearer ***"
+            log_data["headers"] = headers
+
+        print(f"[evol-api] → {method} {url}")
+        print(f"[evol-api]   Request: {json.dumps(log_data, ensure_ascii=False)}")
+
+    def _log_response(self, url: str, status_code: int, response_data: dict):
+        """记录响应日志"""
+        if isinstance(response_data, dict):
+            msg = response_data.get("msg", "")
+
+            # 如果是用户信息接口，提取关键字段
+            if "userInfo" in url or "data" in response_data:
+                data = response_data.get("data", {})
+                user_info = data.get("userInfo", {})
+                gateway_info = data.get("gatewayInfo", {})
+
+                if user_info or gateway_info:
+                    nick_name = user_info.get("nickName", "")
+                    api_url = gateway_info.get("modelBaseUrl", "")
+                    api_key_enabled = "已启用" if gateway_info.get("apiKeyEnabled") else "未启用"
+                    print(f"[evol-api] {msg} - {nick_name} 登录成功，网关: {api_url}，API Key: {api_key_enabled}")
+                    return
+
+            # 其他接口只显示 msg
+            print(f"[evol-api] {msg}")
+
+    def _log_error(self, url: str, error: Exception):
+        """记录错误日志"""
+        print(f"[evol-api] ✗ Error {url}: {type(error).__name__}: {str(error)}")
+
+    async def send_sms(self, phone: str) -> dict:
+        """发送短信验证码"""
+        url = f"{self.base_url}/api/auth/sms/send"
+        data = {
+            "phone": phone,
+            "codeType": "LOGIN"
+        }
+
+        self._log_request("POST", url, json=data)
+
+        try:
+            async with httpx.AsyncClient(timeout=self.timeout) as client:
+                response = await client.post(url, json=data)
+                result = response.json()
+
+                self._log_response(url, response.status_code, result)
+
+                if result.get("code") == 200:
+                    return {"success": True, "msg": result.get("msg", "验证码发送成功")}
+                else:
+                    return {"success": False, "msg": result.get("msg", "发送失败")}
+
+        except Exception as e:
+            self._log_error(url, e)
+            return {"success": False, "msg": f"网络错误: {str(e)}"}
+
+    async def verify_sms(self, phone: str, code: str) -> dict:
+        """验证短信并登录"""
+        url = f"{self.base_url}/api/auth/sms/login"
+        data = {
+            "phone": phone,
+            "code": code,
+            "source": "WEB"
+        }
+
+        self._log_request("POST", url, json=data)
+
+        try:
+            async with httpx.AsyncClient(timeout=self.timeout) as client:
+                response = await client.post(url, json=data)
+                result = response.json()
+
+                self._log_response(url, response.status_code, result)
+
+                if result.get("code") == 200:
+                    return {
+                        "success": True,
+                        "data": result.get("data", {})
+                    }
+                else:
+                    return {"success": False, "msg": result.get("msg", "验证失败")}
+
+        except Exception as e:
+            self._log_error(url, e)
+            return {"success": False, "msg": f"网络错误: {str(e)}"}
+
+    async def get_user_info(self, token: str) -> dict:
+        """获取用户信息（带指数退避重试）"""
+        url = f"{self.base_url}/api/auth/sms/userInfo"
+        headers = {
+            "Authorization": f"Bearer {token}"
+        }
+
+        max_retries = 6
+        base_delay = 0.5  # 第一次重试间隔 0.5 秒
+
+        for attempt in range(max_retries):
+            self._log_request("GET", url, headers=headers)
+
+            try:
+                async with httpx.AsyncClient(timeout=self.timeout) as client:
+                    response = await client.get(url, headers=headers)
+                    result = response.json()
+
+                    self._log_response(url, response.status_code, result)
+
+                    if result.get("code") == 200:
+                        data = result.get("data", {})
+                        # API Key 在 gatewayInfo 中
+                        gateway_info = data.get("gatewayInfo", {})
+                        api_key = gateway_info.get("apiKey", "")
+
+                        if api_key:
+                            # 有 API Key，直接返回
+                            return {
+                                "success": True,
+                                "data": data
+                            }
+                        else:
+                            # 没有 API Key，重试几次后也返回（不阻塞登录）
+                            if attempt < 3:  # 只重试 3 次
+                                delay = base_delay * (2 ** attempt)
+                                print(f"[evol-api] API Key not ready, retry {attempt + 1}/3 after {delay}s")
+                                await asyncio.sleep(delay)
+                                continue
+                            else:
+                                # 3 次后放弃等待，返回没有 API Key 的数据
+                                print(f"[evol-api] API Key not available after 3 retries, proceeding without it")
+                                return {
+                                    "success": True,
+                                    "data": data
+                                }
+                    else:
+                        return {"success": False, "msg": result.get("msg", "获取失败")}
+
+            except Exception as e:
+                self._log_error(url, e)
+                if attempt < max_retries - 1:
+                    delay = base_delay * (2 ** attempt)
+                    print(f"[evol-api] Network error, retry {attempt + 1}/{max_retries} after {delay}s: {e}")
+                    await asyncio.sleep(delay)
+                    continue
+                else:
+                    return {"success": False, "msg": f"网络错误: {str(e)}"}
+
+        return {"success": False, "msg": "获取用户信息失败，已达最大重试次数"}

package/extensions/services/kite_console/evol_config.json5

@@ -0,0 +1,29 @@
+{
+  // Web 服务配置
+  server: {
+    host: "0.0.0.0",
+    port: 18766,
+    ssl: false,
+    // SSL 证书路径（如果启用 SSL）
+    ssl_cert: null,
+    ssl_key: null
+  },
+
+  // 静态文件配置
+  static: {
+    directory: "static",
+    cache_max_age: 3600  // 秒
+  },
+
+  // CORS 配置
+  cors: {
+    enabled: false,
+    origins: ["*"]
+  },
+
+  // 日志配置
+  logging: {
+    level: "INFO",
+    format: "%(asctime)s [%(name)s] %(levelname)s: %(message)s"
+  }
+}

package/extensions/services/kite_console/mfa_totp.py

@@ -0,0 +1,77 @@
+"""
+MFA/TOTP 验证模块
+
+功能：
+- TOTP (Time-based One-Time Password) 验证
+- 密钥生成与管理
+- 支持 30 秒时间窗口 + 前后各 1 个窗口容忍
+
+零共享代码依赖 - 此文件可以独立拷贝到其他模块使用。
+"""
+
+import hashlib
+import hmac
+import struct
+import time
+import secrets
+import base64
+from typing import Optional
+
+
+class TOTPVerifier:
+    """TOTP 验证器"""
+
+    def __init__(self, window: int = 1, step: int = 30):
+        """
+        Args:
+            window: 容忍窗口数（前后各 N 个窗口）
+            step: 时间步长（秒，默认 30）
+        """
+        self.window = window
+        self.step = step
+
+    @staticmethod
+    def generate_secret() -> str:
+        """生成 Base32 编码的 TOTP 密钥"""
+        raw = secrets.token_bytes(20)
+        return base64.b32encode(raw).decode("ascii")
+
+    def generate_code(self, secret: str, timestamp: Optional[float] = None) -> str:
+        """生成当前 TOTP 码（6 位数字）"""
+        if timestamp is None:
+            timestamp = time.time()
+        counter = int(timestamp) // self.step
+        return self._hotp(secret, counter)
+
+    def verify(self, secret: str, code: str, timestamp: Optional[float] = None) -> bool:
+        """
+        验证 TOTP 码（含时间窗口容忍）。
+
+        Args:
+            secret: Base32 密钥
+            code: 用户输入的 6 位码
+            timestamp: 验证时间（默认当前时间）
+        """
+        if timestamp is None:
+            timestamp = time.time()
+        counter = int(timestamp) // self.step
+
+        for offset in range(-self.window, self.window + 1):
+            expected = self._hotp(secret, counter + offset)
+            if hmac.compare_digest(code, expected):
+                return True
+        return False
+
+    def _hotp(self, secret: str, counter: int) -> str:
+        """HOTP 算法（RFC 4226）"""
+        # 解码 Base32 密钥
+        key = base64.b32decode(secret, casefold=True)
+        # 计数器转 8 字节大端
+        msg = struct.pack(">Q", counter)
+        # HMAC-SHA1
+        digest = hmac.new(key, msg, hashlib.sha1).digest()
+        # 动态截断
+        offset = digest[-1] & 0x0F
+        code_int = struct.unpack(">I", digest[offset:offset + 4])[0] & 0x7FFFFFFF
+        # 取 6 位
+        return str(code_int % 1000000).zfill(6)

package/extensions/services/kite_console/migrate_tokens.py

@@ -0,0 +1,122 @@
+"""
+迁移工具：将旧的 token 文件转换为 JSONL 格式
+
+使用方法：
+    python migrate_tokens.py
+"""
+
+import json
+import os
+import sys
+
+
+def migrate_kite_tokens(data_dir: str):
+    """迁移 Kite Token 文件格式"""
+    auth_dir = os.path.join(data_dir, "auth")
+    old_file = os.path.join(auth_dir, "kite_tokens.json")
+    new_file = os.path.join(auth_dir, "kite_tokens.jsonl")
+    backup_file = os.path.join(auth_dir, "kite_tokens.json.backup")
+
+    if not os.path.exists(old_file):
+        print(f"Kite tokens 旧文件不存在: {old_file}")
+        return False
+
+    if os.path.exists(new_file):
+        print(f"Kite tokens 新文件已存在: {new_file}")
+        return False
+
+    try:
+        with open(old_file, "r", encoding="utf-8") as f:
+            data = json.load(f)
+            tokens = data.get("tokens", [])
+    except Exception as e:
+        print(f"读取 Kite tokens 旧文件失败: {e}")
+        return False
+
+    if not tokens:
+        print("Kite tokens 旧文件中没有记录")
+        return False
+
+    print(f"找到 {len(tokens)} 个 Kite Token 记录")
+
+    try:
+        with open(new_file, "w", encoding="utf-8") as f:
+            for token in tokens:
+                token["action"] = "migrated"
+                token["timestamp"] = token.get("createdAt", 0)
+                f.write(json.dumps(token, ensure_ascii=False) + "\n")
+        print(f"成功写入 Kite tokens 新文件: {new_file}")
+    except Exception as e:
+        print(f"写入 Kite tokens 新文件失败: {e}")
+        return False
+
+    try:
+        os.rename(old_file, backup_file)
+        print(f"Kite tokens 旧文件已备份到: {backup_file}")
+    except Exception as e:
+        print(f"备份 Kite tokens 旧文件失败: {e}")
+
+    return True
+
+
+def migrate_evol_token(data_dir: str):
+    """迁移 Evol Token 文件格式"""
+    auth_dir = os.path.join(data_dir, "auth")
+    old_file = os.path.join(auth_dir, "evol_token.json")
+    new_file = os.path.join(auth_dir, "evol_tokens.jsonl")
+    backup_file = os.path.join(auth_dir, "evol_token.json.backup")
+
+    if not os.path.exists(old_file):
+        print(f"Evol token 旧文件不存在: {old_file}")
+        return False
+
+    if os.path.exists(new_file):
+        print(f"Evol token 新文件已存在: {new_file}")
+        return False
+
+    try:
+        with open(old_file, "r", encoding="utf-8") as f:
+            record = json.load(f)
+    except Exception as e:
+        print(f"读取 Evol token 旧文件失败: {e}")
+        return False
+
+    print(f"找到 Evol Token 记录: {record.get('phone', 'unknown')}")
+
+    try:
+        record["action"] = "migrated"
+        record["timestamp"] = record.get("obtainedAt", 0)
+        record["lastUsedAt"] = record.get("obtainedAt", 0)
+
+        with open(new_file, "w", encoding="utf-8") as f:
+            f.write(json.dumps(record, ensure_ascii=False) + "\n")
+        print(f"成功写入 Evol token 新文件: {new_file}")
+    except Exception as e:
+        print(f"写入 Evol token 新文件失败: {e}")
+        return False
+
+    try:
+        os.rename(old_file, backup_file)
+        print(f"Evol token 旧文件已备份到: {backup_file}")
+    except Exception as e:
+        print(f"备份 Evol token 旧文件失败: {e}")
+
+    return True
+
+
+if __name__ == "__main__":
+    data_dir = os.environ.get("KITE_DATA", os.path.expanduser("~/.kite/data"))
+    evol_data_dir = os.path.join(data_dir, "evol")
+
+    print(f"数据目录: {evol_data_dir}")
+    print()
+
+    kite_ok = migrate_kite_tokens(evol_data_dir)
+    print()
+    evol_ok = migrate_evol_token(evol_data_dir)
+    print()
+
+    if kite_ok or evol_ok:
+        print("迁移完成！")
+    else:
+        print("没有需要迁移的文件")

package/extensions/services/kite_console/module.md

@@ -0,0 +1,37 @@
+---
+name: kite_console
+display_name: Kite控制台
+version: '1.0'
+type: service
+state: enabled
+max_connections: 3
+runtime: python
+entry: entry.py
+preferred_port: 20000
+advertise_ip: 0.0.0.0
+display_order: 90
+manual_control: false
+businesses:
+- name: console_main
+  type: main_config
+  description: Kite 控制台主配置
+  config_file: config.json5
+- name: relay_service
+  type: relay
+  description: Kernel WebSocket relay service for web clients
+  config_file: relay_config.json5
+monitor: true
+---
+# Kite控制台
+模块
+
+## 功能
+
+- 手机号短信登录
+- 用户信息查看
+- 积分监控与统计
+- 设备管理
+
+## 端口
+
+默认端口：20000

package/extensions/services/kite_console/nonce_pool.py

@@ -0,0 +1,113 @@
+"""
+Nonce 池管理模块
+
+功能：
+- Challenge-nonce 生成与验证（防重放攻击）
+- TTL 自动过期（默认 600 秒）
+- 容量上限保护（默认 10000）
+
+零共享代码依赖 - 此文件可以独立拷贝到其他模块使用。
+"""
+
+import secrets
+import time
+import threading
+from typing import Optional
+
+
+class NoncePool:
+    """Nonce 池（TTL 字典实现）"""
+
+    def __init__(self, max_size: int = 10000, ttl: int = 600):
+        """
+        初始化 Nonce 池。
+
+        Args:
+            max_size: 最大容量（超出时清理最旧的条目）
+            ttl: Nonce 有效期（秒，默认 600）
+        """
+        self.max_size = max_size
+        self.ttl = ttl
+        self._lock = threading.Lock()
+        # nonce -> (created_at, metadata)
+        self._pool: dict[str, tuple[float, dict]] = {}
+
+    def generate(self, metadata: Optional[dict] = None) -> str:
+        """
+        生成新的 nonce。
+
+        Args:
+            metadata: 附加元数据（如 client_ip, module_id 等）
+
+        Returns:
+            nonce 字符串
+        """
+        nonce = secrets.token_urlsafe(32)
+        now = time.time()
+
+        with self._lock:
+            # 容量保护：先清理过期的
+            self._cleanup_expired_locked(now)
+
+            # 如果仍然超出容量，移除最旧的
+            if len(self._pool) >= self.max_size:
+                self._evict_oldest_locked()
+
+            self._pool[nonce] = (now, metadata or {})
+
+        return nonce
+
+    def verify(self, nonce: str) -> Optional[dict]:
+        """
+        验证并消费 nonce（一次性使用）。
+
+        Args:
+            nonce: 待验证的 nonce
+
+        Returns:
+            如果有效，返回 metadata；否则返回 None
+        """
+        now = time.time()
+
+        with self._lock:
+            entry = self._pool.get(nonce)
+            if entry is None:
+                return None
+
+            created_at, metadata = entry
+
+            # 检查是否过期
+            if now - created_at > self.ttl:
+                del self._pool[nonce]
+                return None
+
+            # 一次性消费
+            del self._pool[nonce]
+            return metadata
+
+    def cleanup(self):
+        """手动触发过期清理"""
+        now = time.time()
+        with self._lock:
+            self._cleanup_expired_locked(now)
+
+    @property
+    def size(self) -> int:
+        """当前池大小"""
+        return len(self._pool)
+
+    def _cleanup_expired_locked(self, now: float):
+        """清理过期条目（需持有锁）"""
+        expired = [
+            n for n, (ts, _) in self._pool.items()
+            if now - ts > self.ttl
+        ]
+        for n in expired:
+            del self._pool[n]
+
+    def _evict_oldest_locked(self):
+        """移除最旧的条目（需持有锁）"""
+        if not self._pool:
+            return
+        oldest_nonce = min(self._pool, key=lambda n: self._pool[n][0])
+        del self._pool[oldest_nonce]