@ai-workbench/connect 0.0.0-stage → 0.7.5

package/lib/login.d.ts

@@ -0,0 +1,35 @@
+import type { Provider, Result, SshTarget } from './api.ts';
+export interface ProxyLease {
+    url: string;
+    username: string;
+    password: string;
+    closed?: Promise<void>;
+    release(): Promise<void>;
+}
+export interface LoginBoot {
+    provider: Provider;
+    url: string;
+    proxy: Pick<ProxyLease, 'url' | 'username' | 'password'>;
+}
+export interface RemoteLogin {
+    ownership?: Promise<{
+        pid: number;
+        group: number;
+        provider: string;
+    }>;
+    url: Promise<Result<string>>;
+    completion: Promise<Result<void>>;
+    writeCode(code: string): Promise<void>;
+    close(): Promise<void>;
+}
+export interface LoginWindow {
+    closed: Promise<void>;
+    close(): Promise<void>;
+}
+export interface LoginPorts {
+    start(t: SshTarget, p: Provider, s: AbortSignal): Promise<RemoteLogin>;
+    acquireProxy(t: SshTarget, s: AbortSignal): Promise<ProxyLease>;
+    open(boot: LoginBoot, onCode: (code: string) => Promise<void>, s: AbortSignal): Promise<LoginWindow>;
+}
+export declare function extractLoginUrl(provider: Provider, text: string): string | undefined;
+export declare function runLogin(t: SshTarget, p: Provider, ports: LoginPorts, parentSignal: AbortSignal): Promise<Result<void>>;

package/lib/login.js

@@ -0,0 +1,81 @@
+import { createRequire } from 'node:module';
+const { isClaudeAuthorizeUrl, validateClaudePaste } = createRequire(import.meta.url)('../helper/claude-callback.cjs');
+import { fail, NeedError, need } from "./needs.js";
+export function extractLoginUrl(provider, text) {
+    for (const match of text.matchAll(/https:\/\/[^\s<>"']+/g)) {
+        try {
+            const u = new URL(match[0]);
+            if (!u.username && !u.password && u.protocol === 'https:' && ((provider === 'codex' && u.origin === 'https://auth.openai.com' && u.pathname === '/oauth/authorize') || (provider === 'claude' && isClaudeAuthorizeUrl(u))))
+                return u.href;
+        }
+        catch { /* not a complete URL yet */ }
+    }
+    return undefined;
+}
+export async function runLogin(t, p, ports, parentSignal) {
+    const controller = new AbortController(), signal = controller.signal;
+    const parentAbort = () => controller.abort();
+    parentSignal.addEventListener('abort', parentAbort, { once: true });
+    if (parentSignal.aborted)
+        controller.abort();
+    let remote, lease, window, remove = () => { };
+    let result = fail('LOGIN_FAILED'), leaseLost = false, releasing = false;
+    try {
+        if (signal.aborted)
+            return result;
+        const cancelled = new Promise(resolve => { const abort = () => resolve(fail('LOGIN_FAILED')); signal.addEventListener('abort', abort, { once: true }); remove = () => signal.removeEventListener('abort', abort); });
+        remote = await ports.start(t, p, signal);
+        const url = await Promise.race([remote.url, cancelled]);
+        if (!url.ok)
+            return url;
+        if (typeof url.value !== 'string' || extractLoginUrl(p, url.value) !== url.value)
+            return result;
+        lease = await ports.acquireProxy(t, signal);
+        const lost = () => { if (!releasing) {
+            leaseLost = true;
+            controller.abort();
+        } };
+        void lease.closed?.then(lost, lost);
+        if (signal.aborted)
+            throw new NeedError(need(leaseLost ? 'CONNECTION_LOST' : 'LOGIN_FAILED'));
+        let codeSent = false, codeError = () => { };
+        const failedCode = new Promise(r => codeError = r);
+        window = await ports.open({ provider: p, url: url.value, proxy: { url: lease.url, username: lease.username, password: lease.password } }, async (code) => {
+            if (p !== 'claude' || codeSent || signal.aborted || !validateClaudePaste(url.value, code)) {
+                codeError(fail('LOGIN_FAILED'));
+                return;
+            }
+            codeSent = true;
+            try {
+                await remote.writeCode(code);
+            }
+            catch {
+                codeError(fail('LOGIN_FAILED'));
+            }
+        }, signal);
+        result = await Promise.race([remote.completion, window.closed.then(() => fail('LOGIN_FAILED')), failedCode, cancelled]);
+    }
+    catch (error) {
+        result = error instanceof NeedError ? { ok: false, error: error.need } : fail('LOGIN_FAILED');
+    }
+    finally {
+        remove();
+        parentSignal.removeEventListener('abort', parentAbort);
+        // Attempt every cleanup even when one resource fails; surface failure instead of success.
+        const cleanup = await Promise.allSettled([window?.close(), remote?.close()]);
+        if (cleanup.some(r => r.status === 'rejected'))
+            result = fail('LOGIN_FAILED');
+        releasing = true;
+        if (lease) {
+            try {
+                await lease.release();
+            }
+            catch (error) {
+                result = error instanceof NeedError ? { ok: false, error: error.need } : fail('LOGIN_FAILED');
+            }
+        }
+        if (leaseLost)
+            result = fail('CONNECTION_LOST');
+    }
+    return result;
+}

package/lib/native-import-picker.d.ts

@@ -0,0 +1,11 @@
+export interface DirectoryPicker {
+    capability(): {
+        kind: string;
+        pick?: (signal: AbortSignal) => Promise<string | null>;
+    };
+}
+interface NativeExports {
+    pickNativeDirectory?: (signal: AbortSignal) => Promise<string | null>;
+}
+export declare function createNativeImportPicker(service: () => DirectoryPicker | undefined, loadNative?: () => Promise<NativeExports>): (signal: AbortSignal) => Promise<string | null>;
+export {};

package/lib/native-import-picker.js

@@ -0,0 +1,49 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import { NeedError, need } from "./needs.js";
+const officialModule = '@deepseek-ai/dsh-host-directory-picker-native';
+const loadOfficial = async () => import(__rewriteRelativeImportExtension(officialModule));
+const unavailable = (requires, officialReason) => new NeedError({
+    ...need('DEPENDENCY_REQUIRED'), requires, ...(officialReason ? { officialReason } : {}),
+});
+// L的导入入口固定使用系统目录窗口，不修改DSH自动选择器或工作区流程。
+// 本地原生能力直接消费；SSH启动等上下文选择browse时，调用同一官方
+// 原生后端的公开函数。该分支在调用前确定，失败后绝不换后端或重试。
+export function createNativeImportPicker(service, loadNative = loadOfficial) {
+    return async (signal) => {
+        const capability = service()?.capability();
+        let pick;
+        if (capability?.kind === 'native') {
+            if (typeof capability.pick !== 'function')
+                throw unavailable('官方原生目录选择服务的pick方法');
+            pick = signal => capability.pick(signal);
+        }
+        else {
+            let native;
+            try {
+                native = await loadNative();
+            }
+            catch {
+                throw unavailable('已安装官方原生目录选择组件 ' + officialModule);
+            }
+            if (typeof native.pickNativeDirectory !== 'function')
+                throw unavailable('官方原生目录选择组件的pickNativeDirectory公开导出');
+            pick = signal => native.pickNativeDirectory(signal);
+        }
+        try {
+            return await pick(signal);
+        }
+        catch (error) {
+            const code = error?.code;
+            const officialReason = typeof code === 'number' && Number.isSafeInteger(code) ? 'EXIT_' + code :
+                typeof code === 'string' && ['EACCES', 'EPERM', 'ENOENT', 'ENOTDIR', 'ECANCELED', 'ABORT_ERR'].includes(code) ? code : undefined;
+            throw unavailable('系统目录选择窗口成功返回结果；未取得结果时不会读取或提交开通资料', officialReason);
+        }
+    };
+}

package/lib/needs.d.ts

@@ -0,0 +1,9 @@
+import type { ConnectNeed, NeedCode, Result } from './api.ts';
+export declare const ok: <T>(value: T) => Result<T>;
+export declare const need: (code: NeedCode) => ConnectNeed;
+export declare const fail: <T = never>(code: NeedCode) => Result<T>;
+export declare function dependency(requires: string): Result<never>;
+export declare class NeedError extends Error {
+    readonly need: ConnectNeed;
+    constructor(value: ConnectNeed);
+}

package/lib/needs.js

@@ -0,0 +1,52 @@
+const entries = {
+    ACTIVATION_CONFLICT: { layer: 'network', message: '已有另一项开通正在进行，已停止重复开通，请联系管理员。', requires: '唯一的开通请求', actor: 'administrator', action: { id: 'inspect-network-enrollment', label: '联系管理员', available: false } },
+    ACTIVATION_CANCELLED: { layer: 'network', message: '本次网络开通已取消。', requires: '完成明确的开通操作', actor: 'plugin', action: { id: 'inspect-network-enrollment', label: '联系管理员', available: false } },
+    ENROLLMENT_CLEANUP_UNBOUND: { layer: 'network', message: '连接资料与已保存的入网身份不匹配，已停止清理，请联系管理员。', requires: '匹配的入网身份与原始连接资料', actor: 'administrator', action: { id: 'inspect-network-enrollment', label: '联系管理员', available: false } },
+    ENROLLMENT_CLEANUP_FAILED: { layer: 'network', message: '入网身份已保存；连接资料清理未完成，请联系管理员。', requires: '精确清理已消费的连接资料', actor: 'administrator', action: { id: 'inspect-network-enrollment', label: '联系管理员', available: false } },
+    ENROLLMENT_MISMATCH: { layer: 'network', message: '当前连接资料与已登记的入网身份不符，请联系管理员。', requires: '一致的连接资料与入网身份', actor: 'administrator', action: { id: 'inspect-network-enrollment', label: '联系管理员', available: false } },
+    LOCAL_STATE_INVALID: { layer: 'network', message: '本机网络身份记录无法核实，已停止开通，请联系管理员。', requires: '完整可信的本机网络身份记录', actor: 'administrator', action: { id: 'inspect-network-enrollment', label: '联系管理员', available: false } },
+    ALREADY_RUNNING: { layer: 'network', message: '网络组件已在运行，无法确认其归属，请联系管理员。', requires: '唯一且归属明确的网络组件', actor: 'administrator', action: { id: 'inspect-network-enrollment', label: '联系管理员', available: false } },
+    ENROLLMENT_RECEIPT_REQUIRED: { layer: 'network', message: '缺少可核验的入网回执，请联系管理员。', requires: '持久且匹配的入网回执', actor: 'administrator', action: { id: 'inspect-network-enrollment', label: '联系管理员', available: false } },
+    CONTROL_PROTOCOL_INVALID: { layer: 'network', message: '网络组件接口不匹配，已停止操作，请联系管理员。', requires: '匹配版本的网络组件接口', actor: 'administrator', action: { id: 'inspect-network-enrollment', label: '联系管理员', available: false } },
+    HELPER_HANDOFF_FAILED: { layer: 'network', message: '网络组件交接未完成，请联系管理员。', requires: '完成网络组件交接', actor: 'administrator', action: { id: 'inspect-network-enrollment', label: '联系管理员', available: false } },
+    HELPER_SHUTDOWN_FORCED: { layer: 'network', message: '网络组件未能正常退出，请联系管理员核实状态。', requires: '核实网络组件退出状态', actor: 'administrator', action: { id: 'inspect-network-enrollment', label: '联系管理员', available: false } },
+    ENROLLMENT_RESULT_UNKNOWN: { layer: 'enrollment', message: '上次开通结果无法确认，请联系管理员核实。已停止再次提交开通资料。', requires: '管理员核实上次开通结果', actor: 'administrator', action: { id: 'check-enrollment-result', label: '联系管理员', available: false } },
+    ENROLLMENT_REJECTED: { layer: 'enrollment', message: '开通资料已失效，请联系管理员处理。已停止再次提交。', requires: '管理员处理已失效的设备身份', actor: 'administrator', action: { id: 'check-enrollment-result', label: '联系管理员', available: false } },
+    ENROLLMENT_REQUIRED: { layer: 'enrollment', message: '我需要开通链接，请联系管理员发放。', requires: '开通文件', actor: 'administrator', action: { id: 'request-enrollment', label: '联系管理员开通', available: false } },
+    ENROLLMENT_INVALID: { layer: 'enrollment', message: '开通文件无效，我需要管理员重新发放。', requires: '有效开通文件', actor: 'administrator', action: { id: 'request-enrollment', label: '重新开通', available: false } },
+    NETWORK_KEY_INVALID: { layer: 'network', message: '员工开通已失效，请联系管理员重新发放开通链接。', requires: '新的开通链接', actor: 'administrator', action: { id: 'request-enrollment', label: '联系管理员', available: false } },
+    HOST_OFFLINE: { layer: 'network', message: '主机离线，请联系管理员；最后在线时间未提供时为未知。', requires: '在线的公司主机', actor: 'administrator', action: { id: 'contact-administrator', label: '联系管理员', available: false } },
+    EMPLOYEE_MISSING: { layer: 'ssh', message: '主机上没有你的员工账号，需要管理员运行开通。', requires: '员工主机账号', actor: 'administrator', action: { id: 'provision-employee', label: '管理员开通账号', available: false } },
+    SSH_FAILED: { layer: 'ssh', message: '远程主机连接暂时连不上，请联系管理员。', requires: '可用且身份匹配的员工 SSH 连接', actor: 'administrator', action: { id: 'inspect-ssh', label: '检查主机连接', available: false } },
+    LOGIN_PROMPT_INVALID: { layer: 'auth', message: '这个登录询问已经更新，请使用当前提示。', requires: '当前登录询问', actor: 'employee', action: { id: 'current-login-prompt', label: '查看当前提示', available: false } },
+    LOGIN_REQUIRED: { layer: 'auth', message: '需要登录，请到设置 → 远程主机连接 点登录', requires: 'AI 账号授权', actor: 'employee', action: { id: 'open-login', label: '前往远程主机连接设置', available: true } },
+    POLICY_DENIED: { layer: 'auth', message: '公司的 AI 席位设置不允许此操作，需要 AI 账号管理员开启。', requires: '允许此操作的 AI 席位设置', actor: 'ai-administrator', action: { id: 'contact-ai-administrator', label: '联系 AI 账号管理员', available: false } },
+    CONNECTION_LOST: { layer: 'network', message: '连接中断，正在等待网络恢复信号，恢复后将重新连接。', requires: '网络恢复', actor: 'plugin', action: { id: 'await-network', label: '等待网络恢复', available: false } },
+    DEPENDENCY_REQUIRED: { layer: 'integration', message: '远程主机连接的连接组件没有装好，请联系管理员。', requires: '提供方契约与适配器', actor: 'administrator', action: { id: 'supply-dependency', label: '提供集成前置条件', available: false } },
+    SETTINGS_REQUIRED: { layer: 'settings', message: '远程主机连接还没有设置好，请联系管理员。', requires: '已确认的连接设置', actor: 'administrator', action: { id: 'configure-settings', label: '确认具名设置', available: false } },
+    AUTH_STATUS_INVALID: { layer: 'auth', message: '暂时无法确认登录状态，请联系管理员。', requires: '有效的官方 CLI 登录状态', actor: 'administrator', action: { id: 'inspect-auth-status', label: '检查官方 CLI', available: false } },
+    LOGIN_FAILED: { layer: 'auth', message: '登录未完成，窗口已关闭或助手失败，可以重新授权。', requires: '完成 AI 授权', actor: 'employee', action: { id: 'open-login', label: '重新授权', available: true } },
+    HOST_TRUST_REQUIRED: { layer: 'ssh', message: '远程主机连接还缺少可信的连接信息，请联系管理员。', requires: 'host.knownHosts', actor: 'administrator', action: { id: 'supply-host-trust', label: '提供主机信任材料', available: false } },
+    HOST_KEY_MISMATCH: { layer: 'ssh', message: '主机身份与已开通的信任材料不符，需要管理员检查。', requires: '匹配的主机公钥', actor: 'administrator', action: { id: 'verify-host-trust', label: '检查主机身份', available: false } },
+    PROJECT_NAME_INVALID: { layer: 'projects', message: '工作区名必须是单个目录名称，不能是路径、点目录或控制字符。', requires: '有效工作区名', actor: 'employee', action: { id: 'rename-project', label: '修改工作区名', available: true } },
+    PROJECT_ROOT_INVALID: { layer: 'projects', message: '工作区暂时无法打开，请联系管理员。', requires: 'S 开通的 700 工作区根目录', actor: 'administrator', action: { id: 'check-project-root', label: '检查开通目录', available: false } },
+    PROJECT_EXISTS: { layer: 'projects', message: '同名工作区或文件已经存在，请换一个工作区名。', requires: '未被占用的工作区名', actor: 'employee', action: { id: 'rename-project', label: '修改工作区名', available: true } },
+    PROJECT_INIT_FAILED: { layer: 'projects', message: '工作区创建没有完成，已保留现有文件，请联系管理员。', requires: '可用的主机 Git 与目录检查', actor: 'administrator', action: { id: 'inspect-project-init', label: '检查 Git 初始化', available: false } },
+    PROJECT_CREATE_FAILED: { layer: 'projects', message: '工作区创建没有完成，请联系管理员。', requires: '可用的工作区目录与 Git', actor: 'administrator', action: { id: 'inspect-project-create', label: '检查新建工作区', available: false } },
+    PROJECT_LIST_FAILED: { layer: 'projects', message: '工作区列表暂时打不开，请联系管理员。', requires: '可读的工作区目录与 Git', actor: 'administrator', action: { id: 'inspect-project-list', label: '检查工作区目录', available: false } },
+    PROJECT_PROTOCOL_INVALID: { layer: 'projects', message: '工作区暂时无法打开，已停止操作，请联系管理员。', requires: '匹配版本的工作区服务', actor: 'administrator', action: { id: 'inspect-project-protocol', label: '检查工作区接口', available: false } },
+    PROJECT_BINDING_INVALID: { layer: 'projects', message: '工作区关联与当前目录或主机身份不符，已停止操作，请联系管理员。', requires: '原工作区与可信主机身份', actor: 'administrator', action: { id: 'check-workspace-binding', label: '联系管理员', available: false } },
+    PROJECT_BINDING_BUSY: { layer: 'projects', message: '此工作区正在关联或说明正在投递，请联系管理员核实。', requires: '完成当前关联或投递', actor: 'administrator', action: { id: 'check-workspace-binding', label: '联系管理员', available: false } },
+    PROJECT_CREATE_UNKNOWN: { layer: 'projects', message: '远程工作区创建结果无法确认，已保留现场，请联系管理员。', requires: '核实上次远程工作区创建结果', actor: 'administrator', action: { id: 'check-workspace-create', label: '联系管理员', available: false } },
+    PROJECT_NOTICE_DELIVERY_UNKNOWN: { layer: 'projects', message: '工作区说明的投递结果无法确认，已停止远程派发，请联系管理员核实。', requires: '官方会话回复的持久投递证据', actor: 'administrator', action: { id: 'check-workspace-notice', label: '联系管理员', available: false } },
+    PROJECT_BINDING_REQUIRED: { layer: 'projects', message: '请在会话中选择已关联的远程工作区。', requires: '当前会话的可信远程工作区关联', actor: 'employee', action: { id: 'select-workspace', label: '选择工作区', available: true } },
+    DISPOSED: { layer: 'integration', message: '连接插件已卸载，需要重新启用插件。', requires: '已启用的连接插件', actor: 'employee', action: { id: 'enable-plugin', label: '启用插件', available: false } },
+};
+export const ok = (value) => ({ ok: true, value });
+export const need = (code) => structuredClone({ code, ...entries[code] });
+export const fail = (code) => ({ ok: false, error: need(code) });
+export function dependency(requires) { const error = need('DEPENDENCY_REQUIRED'); error.requires = requires; error.message = '远程主机连接的连接组件没有装好，请联系管理员。'; return { ok: false, error }; }
+export class NeedError extends Error {
+    need;
+    constructor(value) { super(value.code); this.need = value; }
+}

package/lib/network.d.ts

@@ -0,0 +1,26 @@
+import type { Enrollment, NetworkEvent } from './ports.ts';
+import type { Result } from './api.ts';
+import type { ProxyLease } from './login.ts';
+export interface NetworkSettings {
+    executable?: string;
+    runtimeDir?: string;
+    stateDir?: string;
+    proxyListen?: string;
+    logUpload?: boolean;
+    statusRefreshIntervalSeconds?: number;
+    dialTimeoutSeconds?: number;
+    headerTimeoutSeconds?: number;
+    enrollmentObservationSeconds?: number;
+    httpMaxHeaderBytes?: number;
+    httpMaxResponseHeaderBytes?: number;
+    controlMaxBytes?: number;
+}
+export declare function writeNetworkConfig(file: string, e: Enrollment, s: NetworkSettings): Promise<Result<void>>;
+export declare function createNetworkClient(s: NetworkSettings): {
+    connect(e: Enrollment, signal: AbortSignal): Promise<Result<{
+        proxyCommand: string;
+    }>>;
+    onState(listener: (event: NetworkEvent) => void): () => void;
+    acquireProxy(signal: AbortSignal): Promise<ProxyLease>;
+    dispose(): void;
+};

package/lib/network.js

@@ -0,0 +1,226 @@
+import { request } from 'node:http';
+import { lstat, writeFile, rename, rm } from 'node:fs/promises';
+import { join, dirname, isAbsolute } from 'node:path';
+import { hostname } from 'node:os';
+import { StringDecoder } from 'node:string_decoder';
+import { randomUUID } from 'node:crypto';
+import { need, dependency, ok, fail, NeedError } from "./needs.js";
+import { privateDirectory } from "./private-files.js";
+import { proxyCommand } from "./ssh.js";
+function valid(s) { return [s.executable, s.runtimeDir, s.stateDir].every(p => typeof p === 'string' && isAbsolute(p) && !/[\x00-\x1f\x7f]/.test(p)) && typeof s.proxyListen === 'string' && /^127\.0\.0\.1:(?:0|[1-9][0-9]*)$/.test(s.proxyListen) && Number(s.proxyListen.split(':')[1]) <= 65535 && s.logUpload === false && [s.statusRefreshIntervalSeconds, s.dialTimeoutSeconds, s.headerTimeoutSeconds, s.enrollmentObservationSeconds].every(n => typeof n === 'number' && Number.isFinite(n) && n >= 1e-9 && n <= 9223372036) && [s.statusRefreshIntervalSeconds, s.headerTimeoutSeconds].every(n => Number.isInteger(n * 1000) && n * 1000 >= 1 && n * 1000 <= 2147483647) && [s.httpMaxHeaderBytes, s.httpMaxResponseHeaderBytes].every(n => Number.isSafeInteger(n) && n > 0) && Number.isSafeInteger(s.controlMaxBytes) && s.controlMaxBytes > 0 && s.controlMaxBytes <= 2147483647; }
+function mapped(code) { return { NEED_ENROLLMENT: 'ENROLLMENT_REQUIRED', ENROLLMENT_REJECTED: 'NETWORK_KEY_INVALID', ENROLLMENT_RESULT_UNKNOWN: 'ENROLLMENT_INVALID', LOCAL_STATE_INVALID: 'ENROLLMENT_INVALID', HOST_OFFLINE: 'HOST_OFFLINE', HOST_NOT_VISIBLE: 'DEPENDENCY_REQUIRED', CONFIG_INVALID: 'SETTINGS_REQUIRED', CAPABILITY_NOT_IMPLEMENTED: 'DEPENDENCY_REQUIRED', NEED_HOST_CONTRACT: 'DEPENDENCY_REQUIRED', NETWORK_INTERRUPTED: 'CONNECTION_LOST', CONTROL_UNAVAILABLE: 'DEPENDENCY_REQUIRED' }[String(code)] ?? 'DEPENDENCY_REQUIRED'; }
+export async function writeNetworkConfig(file, e, s) {
+    if (!valid(s) || !isAbsolute(file))
+        return fail('SETTINGS_REQUIRED');
+    let temp;
+    try {
+        await privateDirectory(dirname(file));
+        const config = { apiVersion: 1, stateDir: s.stateDir, runtimeDir: s.runtimeDir, nodeName: `aw-${e.username}-${hostname()}-${process.getuid()}`, ...(e.authKeyFile ? { authKeyFile: e.authKeyFile } : {}), host: { name: e.host, sshPort: e.port, employee: e.username, knownHostsFile: e.knownHostsFile }, proxyListen: s.proxyListen, statusRefreshIntervalSeconds: s.statusRefreshIntervalSeconds, dialTimeoutSeconds: s.dialTimeoutSeconds, headerTimeoutSeconds: s.headerTimeoutSeconds, enrollmentObservationSeconds: s.enrollmentObservationSeconds, logUpload: s.logUpload, httpMaxHeaderBytes: s.httpMaxHeaderBytes, httpMaxResponseHeaderBytes: s.httpMaxResponseHeaderBytes };
+        temp = join(dirname(file), '.network-' + randomUUID());
+        await writeFile(temp, JSON.stringify(config), { flag: 'wx', mode: 0o600 });
+        await rename(temp, file);
+        temp = undefined;
+        return ok(undefined);
+    }
+    catch {
+        return dependency('可写的私有 N 配置目录');
+    }
+    finally {
+        if (temp)
+            await rm(temp, { force: true });
+    }
+}
+export function createNetworkClient(s) {
+    const listeners = new Set();
+    let timer, previous, refreshing = false, disposed = false;
+    const pending = new Set();
+    let expected;
+    const bad = (code) => { throw new NeedError(need(code)); };
+    async function socket() {
+        if (!valid(s))
+            bad('SETTINGS_REQUIRED');
+        const dir = await lstat(s.runtimeDir), sock = await lstat(join(s.runtimeDir, 'control.sock'));
+        if (!dir.isDirectory() || dir.isSymbolicLink() || dir.uid !== process.getuid() || (dir.mode & 0o077) || !sock.isSocket() || sock.isSymbolicLink() || sock.uid !== process.getuid() || (sock.mode & 0o177))
+            bad('DEPENDENCY_REQUIRED');
+    }
+    async function send(method, path, signal) {
+        try {
+            await socket();
+        }
+        catch (e) {
+            if (e instanceof NeedError)
+                throw e;
+            bad('DEPENDENCY_REQUIRED');
+        }
+        if (disposed || signal.aborted)
+            bad('CONNECTION_LOST');
+        return new Promise((resolve, reject) => { const req = request({ socketPath: join(s.runtimeDir, 'control.sock'), path, method, signal, agent: false }, response => { clearTimeout(deadline); resolve(response); }); const deadline = setTimeout(() => req.destroy(new Error('CONTROL_HEADER_TIMEOUT')), s.headerTimeoutSeconds * 1000); req.on('error', () => { clearTimeout(deadline); reject(new NeedError(need('DEPENDENCY_REQUIRED'))); }); req.end(); });
+    }
+    async function json(res) { let size = 0; const chunks = []; try {
+        for await (const chunk of res) {
+            size += chunk.length;
+            if (size > s.controlMaxBytes)
+                bad('DEPENDENCY_REQUIRED');
+            chunks.push(chunk);
+        }
+        return JSON.parse(Buffer.concat(chunks).toString('utf8'));
+    }
+    catch {
+        res.destroy();
+        bad('DEPENDENCY_REQUIRED');
+    } }
+    async function status(signal) {
+        try {
+            const res = await send('GET', '/v1/status', signal), v = await json(res);
+            if (v?.apiVersion !== 1)
+                return dependency('N v1 状态协议');
+            if (res.statusCode !== 200 || v.error) {
+                const result = fail(mapped(v.error?.code));
+                if (!result.ok && result.error.code === 'HOST_OFFLINE' && v.host?.name === expected?.host && typeof v.host.lastSeenAt === 'string' && !Number.isNaN(Date.parse(v.host.lastSeenAt)))
+                    result.error.lastSeen = v.host.lastSeenAt;
+                return result;
+            }
+            if (v.enrollment !== 'online')
+                return fail(v.enrollment === 'needs_enrollment' ? 'ENROLLMENT_REQUIRED' : v.enrollment === 'rejected' ? 'NETWORK_KEY_INVALID' : 'CONNECTION_LOST');
+            if (v.host?.name !== expected?.host)
+                return dependency('与开通主机匹配的 N 状态');
+            if (v.host.online === false) {
+                const result = fail('HOST_OFFLINE');
+                if (!result.ok && typeof v.host.lastSeenAt === 'string' && !Number.isNaN(Date.parse(v.host.lastSeenAt)))
+                    result.error.lastSeen = v.host.lastSeenAt;
+                return result;
+            }
+            if (v.host.online !== true)
+                return dependency('N 已核实的主机在线状态');
+            return ok(undefined);
+        }
+        catch (e) {
+            return e instanceof NeedError ? { ok: false, error: e.need } : dependency('N 私有控制 socket；未使用直连网络');
+        }
+    }
+    async function refresh() { if (refreshing || !expected || disposed)
+        return; refreshing = true; const c = new AbortController(); pending.add(c); try {
+        const r = await status(c.signal), online = r.ok;
+        if (previous !== undefined && previous !== online)
+            for (const listener of listeners)
+                listener({ kind: online ? 'restored' : 'lost' });
+        previous = online;
+    }
+    finally {
+        pending.delete(c);
+        refreshing = false;
+    } }
+    return {
+        async connect(e, signal) {
+            expected = e;
+            const result = await status(signal);
+            previous = result.ok;
+            if (!result.ok)
+                return result;
+            try {
+                const exe = await lstat(s.executable);
+                if (!exe.isFile() || exe.isSymbolicLink() || !(exe.mode & 0o111))
+                    return dependency('N 真实 helper 可执行程序');
+                return ok({ proxyCommand: proxyCommand(s.executable, s.runtimeDir) });
+            }
+            catch {
+                return dependency('N 真实 helper 可执行程序');
+            }
+        },
+        onState(listener) { listeners.add(listener); if (valid(s) && !timer) {
+            timer = setInterval(() => { void refresh(); }, s.statusRefreshIntervalSeconds * 1000);
+            timer.unref();
+        } return () => { listeners.delete(listener); if (!listeners.size && timer) {
+            clearInterval(timer);
+            timer = undefined;
+            for (const c of pending)
+                c.abort();
+        } }; },
+        async acquireProxy(signal) {
+            const res = await send('POST', '/v1/login-proxy', signal);
+            if (res.statusCode !== 201) {
+                const v = await json(res);
+                if (v?.apiVersion !== 1)
+                    bad('DEPENDENCY_REQUIRED');
+                bad(mapped(v.error?.code));
+            }
+            if (!String(res.headers['content-type']).startsWith('application/x-ndjson')) {
+                res.destroy();
+                bad('DEPENDENCY_REQUIRED');
+            }
+            let resolveLine = () => { }, rejectLine = () => { }, rejectClosed = () => { }, resolveClosed = () => { };
+            let text = '', size = 0, received = false, released = false;
+            const decoder = new StringDecoder('utf8');
+            const first = new Promise((yes, no) => { resolveLine = yes; rejectLine = no; });
+            const closed = new Promise((yes, no) => { resolveClosed = yes; rejectClosed = no; });
+            void closed.catch(() => { });
+            const lost = () => { if (!released) {
+                const e = new NeedError(need('CONNECTION_LOST'));
+                rejectLine(e);
+                rejectClosed(e);
+            } };
+            res.on('error', lost);
+            res.on('end', lost);
+            res.on('close', lost);
+            res.on('data', (chunk) => {
+                size += chunk.length;
+                if (size > s.controlMaxBytes) {
+                    lost();
+                    res.destroy();
+                    return;
+                }
+                if (received) {
+                    if (chunk.toString().trim()) {
+                        lost();
+                        res.destroy();
+                    }
+                    return;
+                }
+                text += decoder.write(chunk);
+                const end = text.indexOf('\n');
+                if (end < 0)
+                    return;
+                received = true;
+                try {
+                    const v = JSON.parse(text.slice(0, end)), url = new URL(v.url);
+                    if (v.apiVersion !== 1 || typeof v.id !== 'string' || !/^[a-zA-Z0-9_-]+$/.test(v.id) || url.protocol !== 'http:' || url.hostname !== '127.0.0.1' || !url.port || url.username || url.password || url.pathname !== '/' || url.search || url.hash || !['username', 'password'].every(k => typeof v[k] === 'string' && v[k].length && !/[\x00-\x1f\x7f]/.test(v[k])) || text.slice(end + 1).trim())
+                        throw Error();
+                    resolveLine(v);
+                }
+                catch {
+                    rejectLine(new NeedError(need('DEPENDENCY_REQUIRED')));
+                    res.destroy();
+                }
+                finally {
+                    text = '';
+                }
+            });
+            let v;
+            try {
+                v = await first;
+            }
+            catch (e) {
+                res.destroy();
+                throw e;
+            }
+            let release;
+            const lease = { url: v.url, username: v.username, password: v.password, closed, release: () => release ??= (async () => { released = true; res.destroy(); try {
+                    const c = new AbortController();
+                    const response = await send('DELETE', '/v1/login-proxy/' + encodeURIComponent(v.id), c.signal);
+                    response.resume();
+                    if (![204, 404].includes(response.statusCode))
+                        bad('DEPENDENCY_REQUIRED');
+                }
+                finally {
+                    lease.username = '';
+                    lease.password = '';
+                    v = null;
+                    resolveClosed();
+                } })() };
+            return lease;
+        },
+        dispose() { disposed = true; if (timer)
+            clearInterval(timer); for (const c of pending)
+            c.abort(); listeners.clear(); },
+    };
+}

package/lib/physical-fs.d.ts

@@ -0,0 +1,3 @@
+import * as nodeFs from 'node:fs';
+export declare const createWriteStream: typeof nodeFs.createWriteStream;
+export declare const open: typeof nodeFs.promises.open, lstat: typeof nodeFs.promises.lstat, readFile: typeof nodeFs.promises.readFile, writeFile: typeof nodeFs.promises.writeFile, readdir: typeof nodeFs.promises.readdir, readlink: typeof nodeFs.promises.readlink, realpath: typeof nodeFs.promises.realpath, rename: typeof nodeFs.promises.rename, rm: typeof nodeFs.promises.rm, mkdir: typeof nodeFs.promises.mkdir, symlink: typeof nodeFs.promises.symlink;

package/lib/physical-fs.js

@@ -0,0 +1,7 @@
+import * as nodeFs from 'node:fs';
+import { createRequire } from 'node:module';
+// 组件归档内的.asar是待校验的物理文件，不能消费Electron的虚拟目录视图。
+// 仅缓存/解压边界使用；不设置全局process.noAsar，不影响宿主模块加载。
+const physical = process.versions.electron ? createRequire(import.meta.url)('original-fs') : nodeFs;
+export const { createWriteStream } = physical;
+export const { open, lstat, readFile, writeFile, readdir, readlink, realpath, rename, rm, mkdir, symlink } = physical.promises;

package/lib/ports.d.ts

@@ -0,0 +1,43 @@
+import type { Provider, Result, SshTarget, SessionTarget, HostContext, Project, ProjectList } from './api.ts';
+export interface Enrollment {
+    authKeyFile?: string;
+    hostContext?: HostContext;
+    host: string;
+    username: string;
+    port: number;
+    projectRoot: string;
+    knownHostsFile: string;
+    session: SessionTarget;
+}
+export interface CommandResult {
+    exitCode: number | null;
+    stdout: string;
+    stderr: string;
+}
+export type NetworkEvent = {
+    kind: 'lost';
+} | {
+    kind: 'restored';
+};
+export interface Ports {
+    enrollment?: {
+        read(signal: AbortSignal): Promise<Result<Enrollment>>;
+    };
+    network?: {
+        connect(enrollment: Enrollment, signal: AbortSignal): Promise<Result<{
+            proxyCommand: string;
+        }>>;
+        onState(listener: (event: NetworkEvent) => void): () => void;
+    };
+    ssh?: {
+        verify(target: SshTarget, signal: AbortSignal): Promise<Result<void>>;
+        status(target: SshTarget, provider: Provider, signal: AbortSignal): Promise<Result<CommandResult>>;
+    };
+    projects?: {
+        list(t: SshTarget, s: AbortSignal): Promise<Result<ProjectList>>;
+        create(t: SshTarget, name: string, s: AbortSignal): Promise<Result<Project>>;
+    };
+    login?: {
+        run(target: SshTarget, provider: Provider, signal: AbortSignal): Promise<Result<void>>;
+    };
+}

package/lib/ports.js

@@ -0,0 +1 @@
+export {};

package/lib/private-files.d.ts

@@ -0,0 +1,3 @@
+export declare function privateDirectory(path: string): Promise<void>;
+export declare function privateFile(path: string): Promise<void>;
+export declare function readPrivate(path: string, maxBytes?: number): Promise<string>;

package/lib/private-files.js

@@ -0,0 +1,41 @@
+import { lstat, mkdir, open } from 'node:fs/promises';
+import { constants } from 'node:fs';
+export async function privateDirectory(path) {
+    await mkdir(path, { recursive: true, mode: 0o700 });
+    const s = await lstat(path);
+    if (!s.isDirectory() || s.isSymbolicLink() || s.uid !== process.getuid() || (s.mode & 0o077) !== 0)
+        throw new Error('PRIVATE_DIRECTORY_REQUIRED');
+}
+export async function privateFile(path) {
+    const s = await lstat(path);
+    if (!s.isFile() || s.isSymbolicLink() || s.uid !== process.getuid() || (s.mode & 0o177) !== 0)
+        throw new Error('PRIVATE_FILE_REQUIRED');
+}
+export async function readPrivate(path, maxBytes) {
+    const h = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+        const s = await h.stat();
+        if (!s.isFile() || s.uid !== process.getuid() || (s.mode & 0o177) !== 0)
+            throw new Error('PRIVATE_FILE_REQUIRED');
+        if (maxBytes === undefined)
+            return await h.readFile('utf8');
+        if (!Number.isSafeInteger(maxBytes) || maxBytes < 1 || maxBytes > 2147483647 || s.size > maxBytes)
+            throw new Error('PRIVATE_FILE_LIMIT');
+        const chunks = [];
+        let size = 0;
+        for (;;) {
+            const buffer = Buffer.alloc(Math.min(65536, maxBytes + 1 - size));
+            const { bytesRead } = await h.read(buffer, 0, buffer.length, null);
+            if (!bytesRead)
+                break;
+            size += bytesRead;
+            if (size > maxBytes)
+                throw new Error('PRIVATE_FILE_LIMIT');
+            chunks.push(buffer.subarray(0, bytesRead));
+        }
+        return Buffer.concat(chunks).toString('utf8');
+    }
+    finally {
+        await h.close();
+    }
+}

package/lib/processes.d.ts

@@ -0,0 +1,5 @@
+import type { Provider } from './api.ts';
+import type { Runner } from './ssh.ts';
+import type { RemoteLogin } from './login.ts';
+export declare function createRunner(maxBytes: number): Runner;
+export declare function createRemoteLogin(command: string, args: string[], provider: Provider, maxBytes: number, signal: AbortSignal, protocol?: 'remote-control'): Promise<RemoteLogin>;