@ai-workbench/remote-agent 0.8.5 → 0.8.10

package/dist/employee-tools.js

@@ -0,0 +1,292 @@
+import { spawn } from 'node:child_process';
+import { randomUUID, createHash } from 'node:crypto';
+import { readFile, writeFile, mkdir, glob, lstat, access, realpath, stat } from 'node:fs/promises';
+import { constants } from 'node:fs';
+import { resolve, dirname, isAbsolute, basename, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { NeedError } from "./remote.js";
+export const EMPLOYEE_TOOL_NAMES = ['Read', 'Write', 'Edit', 'Glob', 'Grep', 'Bash'];
+const failure = (code) => new NeedError(code, '本机工具未完成（' + code + '），没有改到主机执行。', '本机实际执行能力；技术详情保留当前结果');
+function object(value) { if (!value || typeof value !== 'object' || Array.isArray(value))
+    throw failure('EMPLOYEE_ARGUMENT_INVALID'); return value; }
+function string(args, key, required = true) {
+    const v = args[key];
+    if (v === undefined && !required)
+        return;
+    if (typeof v !== 'string' || v.includes('\0') || (required && !v))
+        throw failure('EMPLOYEE_ARGUMENT_INVALID');
+    return v;
+}
+function integer(args, key, min) { const v = args[key]; if (v === undefined)
+    return; if (!Number.isSafeInteger(v) || v < min)
+    throw failure('EMPLOYEE_ARGUMENT_INVALID'); return v; }
+function boolean(args, key) { const v = args[key]; if (v === undefined)
+    return; if (typeof v !== 'boolean')
+    throw failure('EMPLOYEE_ARGUMENT_INVALID'); return v; }
+function fields(args, allowed) { if (Object.keys(args).some(k => !allowed.includes(k)))
+    throw failure('EMPLOYEE_ARGUMENT_UNSUPPORTED'); }
+function text(value) { return { content: [{ type: 'text', text: value }] }; }
+// Shared across this plugin's sessions: protect the entire read/modify/write, not just writeFile.
+const fileQueues = new Map();
+async function serialized(key, work) {
+    const previous = fileQueues.get(key) ?? Promise.resolve();
+    let release = () => { };
+    const next = new Promise(yes => { release = yes; });
+    fileQueues.set(key, next);
+    await previous;
+    try {
+        return await work();
+    }
+    finally {
+        release();
+        if (fileQueues.get(key) === next)
+            fileQueues.delete(key);
+    }
+}
+async function canonicalFile(path) {
+    try {
+        return await realpath(path);
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+        const parent = dirname(path);
+        if (parent === path)
+            throw error;
+        return join(await canonicalFile(parent), basename(path));
+    }
+}
+async function mutate(path, signal, work) {
+    return serialized('path:' + await canonicalFile(path), async () => {
+        signal.throwIfAborted();
+        let inode;
+        try {
+            const info = await stat(path);
+            inode = `inode:${info.dev}:${info.ino}`;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+        const perform = () => { signal.throwIfAborted(); return work(); };
+        return inode ? serialized(inode, perform) : perform();
+    });
+}
+async function bundledRipgrep() {
+    if (process.platform !== 'darwin' || !['arm64', 'x64'].includes(process.arch))
+        throw failure('EMPLOYEE_PLATFORM_UNSUPPORTED');
+    const root = new URL('./helpers/ripgrep/', import.meta.resolve('@ai-workbench/remote-agent/package.json'));
+    const manifest = JSON.parse(await readFile(new URL('manifest.json', root), 'utf8'));
+    const arch = 'darwin-' + process.arch, path = fileURLToPath(new URL(arch + '/rg', root)), entry = manifest.files[arch];
+    const info = await lstat(path);
+    if (!entry || !info.isFile() || info.isSymbolicLink() || info.size !== entry.bytes || createHash('sha256').update(await readFile(path)).digest('hex') !== entry.sha256)
+        throw failure('EMPLOYEE_SEARCH_COMPONENT_INVALID');
+    await access(path, constants.X_OK);
+    return path;
+}
+/** Executed only in the employee DSH process; never creates a host fallback. */
+export function createEmployeeTools(options) {
+    if (!isAbsolute(options.cwd) || !isAbsolute(options.shell) || !Number.isSafeInteger(options.uid) || options.uid !== process.getuid?.() || !Number.isSafeInteger(options.maxBytes) || options.maxBytes < 1 || !Number.isSafeInteger(options.killGraceMs) || options.killGraceMs < 0)
+        throw failure('EMPLOYEE_CONTEXT_INVALID');
+    const lifetime = new AbortController(), children = new Set(), calls = new Set();
+    const path = (value) => resolve(options.cwd, value);
+    const capacity = (value) => { if (Buffer.byteLength(value) > options.maxBytes)
+        throw failure('EMPLOYEE_OUTPUT_TOO_LARGE'); };
+    async function run(command, args, signal, detail, timeout) {
+        signal.throwIfAborted();
+        const operation = new Promise((yes, no) => {
+            const child = spawn(command, args, { cwd: options.cwd, env: process.env, stdio: ['pipe', 'pipe', 'pipe'] });
+            child.stdin.end();
+            let bytes = 0, stdout = [], stderr = [], failed, killTimer, timeoutTimer;
+            const kill = (which) => { if (child.exitCode === null && child.signalCode === null)
+                child.kill(which); };
+            const stop = (code) => { if (failed)
+                return; failed = failure(code); kill('SIGTERM'); killTimer = setTimeout(() => kill('SIGKILL'), options.killGraceMs); killTimer.unref(); };
+            const aborted = () => stop('EMPLOYEE_CANCELLED_UNKNOWN');
+            const collect = (dest, chunk) => { bytes += chunk.length; if (bytes > options.maxBytes) {
+                stop('EMPLOYEE_OUTPUT_TOO_LARGE_UNKNOWN');
+                return;
+            } dest.push(chunk); };
+            child.stdout.on('data', (b) => collect(stdout, b));
+            child.stderr.on('data', (b) => collect(stderr, b));
+            child.on('spawn', () => { try {
+                detail({ kind: 'session', severity: 'info', code: 'CLAUDE_EMPLOYEE_PROCESS', summary: '本机工具子进程', payload: { childPid: child.pid ?? null, uid: options.uid, cwd: options.cwd } });
+            }
+            catch {
+                stop('CONVERSATION_DETAILS_FAILED');
+            } if (signal.aborted)
+                aborted(); });
+            child.on('error', e => { failed ??= failure(e.code === 'ENOENT' ? 'EMPLOYEE_COMMAND_UNAVAILABLE' : 'EMPLOYEE_PROCESS_FAILED'); });
+            child.on('close', (exitCode, exitSignal) => { signal.removeEventListener('abort', aborted); if (killTimer)
+                clearTimeout(killTimer); if (timeoutTimer)
+                clearTimeout(timeoutTimer); failed ? no(failed) : yes({ stdout: Buffer.concat(stdout).toString('utf8'), stderr: Buffer.concat(stderr).toString('utf8'), exitCode, signal: exitSignal }); });
+            signal.addEventListener('abort', aborted, { once: true });
+            if (signal.aborted)
+                aborted();
+            if (timeout !== undefined) {
+                timeoutTimer = setTimeout(() => stop('EMPLOYEE_TIMEOUT_UNKNOWN'), timeout);
+                timeoutTimer.unref();
+            }
+        });
+        children.add(operation);
+        try {
+            return await operation;
+        }
+        finally {
+            children.delete(operation);
+        }
+    }
+    async function execute(name, args, signal, detail) {
+        const check = () => signal.throwIfAborted();
+        if (name === 'Read') {
+            fields(args, ['file_path', 'offset', 'limit', 'pages']);
+            if (args.pages !== undefined)
+                throw failure('EMPLOYEE_READ_PDF_UNSUPPORTED');
+            const target = path(string(args, 'file_path')), offset = integer(args, 'offset', 1) ?? 1, limit = integer(args, 'limit', 1);
+            const info = await lstat(target);
+            if (info.size > options.maxBytes)
+                throw failure('EMPLOYEE_OUTPUT_TOO_LARGE');
+            const bytes = await readFile(target, { signal });
+            check();
+            capacity(bytes);
+            const magic = bytes.subarray(0, 16), mime = magic[0] === 137 && magic.subarray(1, 4).toString() === 'PNG' ? 'image/png' : magic[0] === 255 && magic[1] === 216 ? 'image/jpeg' : magic.subarray(0, 4).toString() === 'RIFF' && magic.subarray(8, 12).toString() === 'WEBP' ? 'image/webp' : magic.subarray(0, 3).toString() === 'GIF' ? 'image/gif' : undefined;
+            if (mime) {
+                if (args.offset !== undefined || args.limit !== undefined)
+                    throw failure('EMPLOYEE_IMAGE_RANGE_UNSUPPORTED');
+                return { content: [{ type: 'image', mimeType: mime, data: bytes.toString('base64') }] };
+            }
+            let contents;
+            try {
+                contents = new TextDecoder('utf8', { fatal: true }).decode(bytes);
+            }
+            catch {
+                throw failure('EMPLOYEE_READ_BINARY_UNSUPPORTED');
+            }
+            if (contents.includes('\0') || contents.startsWith('%PDF-'))
+                throw failure('EMPLOYEE_READ_BINARY_UNSUPPORTED');
+            const lines = contents.split('\n'), selected = lines.slice(offset - 1, limit === undefined ? undefined : offset - 1 + limit);
+            return text(selected.map((line, i) => String(offset + i) + '\t' + line).join('\n'));
+        }
+        if (name === 'Write') {
+            fields(args, ['file_path', 'content']);
+            const target = path(string(args, 'file_path')), content = string(args, 'content', false);
+            if (content === undefined)
+                throw failure('EMPLOYEE_ARGUMENT_INVALID');
+            capacity(content);
+            await mutate(target, signal, async () => { check(); await mkdir(dirname(target), { recursive: true }); check(); await writeFile(target, content, { signal }); });
+            return text('文件已写入：' + target);
+        }
+        if (name === 'Edit') {
+            fields(args, ['file_path', 'old_string', 'new_string', 'replace_all']);
+            const target = path(string(args, 'file_path')), old = string(args, 'old_string', false), replacement = string(args, 'new_string', false), all = boolean(args, 'replace_all') ?? false;
+            if (old === undefined || replacement === undefined || !old)
+                throw failure('EMPLOYEE_EDIT_EMPTY_MATCH_UNSUPPORTED');
+            return mutate(target, signal, async () => {
+                const bytes = await readFile(target, { signal });
+                capacity(bytes);
+                let content;
+                try {
+                    content = new TextDecoder('utf8', { fatal: true, ignoreBOM: true }).decode(bytes);
+                }
+                catch {
+                    throw failure('EMPLOYEE_READ_BINARY_UNSUPPORTED');
+                }
+                const matches = content.split(old).length - 1;
+                if (!matches)
+                    throw failure('EMPLOYEE_EDIT_NOT_FOUND');
+                if (matches > 1 && !all)
+                    throw failure('EMPLOYEE_EDIT_AMBIGUOUS');
+                const next = all ? content.replaceAll(old, () => replacement) : content.replace(old, () => replacement);
+                capacity(next);
+                check();
+                await writeFile(target, next, { signal });
+                return text('文件已修改：' + target);
+            });
+        }
+        if (name === 'Glob') {
+            fields(args, ['pattern', 'path']);
+            const pattern = string(args, 'pattern'), cwd = path(string(args, 'path', false) ?? '.'), found = [];
+            for await (const item of glob(pattern, { cwd })) {
+                check();
+                found.push(resolve(cwd, item));
+                capacity(JSON.stringify(found));
+            }
+            return text(JSON.stringify(found));
+        }
+        if (name === 'Grep') {
+            fields(args, ['pattern', 'path', 'glob', 'output_mode', '-B', '-A', '-C', '-n', '-i', 'type', 'head_limit', 'offset', 'multiline']);
+            const pattern = string(args, 'pattern'), mode = string(args, 'output_mode', false) ?? 'files_with_matches', argv = ['--hidden', '--pcre2', '--color', 'never'];
+            if (mode === 'files_with_matches')
+                argv.push('--files-with-matches');
+            else if (mode === 'count')
+                argv.push('--count');
+            else if (mode !== 'content')
+                throw failure('EMPLOYEE_ARGUMENT_UNSUPPORTED');
+            for (const flag of ['-B', '-A', '-C']) {
+                const value = integer(args, flag, 0);
+                if (value !== undefined)
+                    argv.push(flag, String(value));
+            }
+            if (boolean(args, '-n'))
+                argv.push('--line-number');
+            if (boolean(args, '-i'))
+                argv.push('--ignore-case');
+            if (boolean(args, 'multiline'))
+                argv.push('--multiline', '--multiline-dotall');
+            for (const [key, flag] of [['glob', '--glob'], ['type', '--type']]) {
+                const v = string(args, key, false);
+                if (v !== undefined)
+                    argv.push(flag, v);
+            }
+            argv.push('--', pattern, path(string(args, 'path', false) ?? '.'));
+            const result = await run(options.rgPath ?? await bundledRipgrep(), argv, signal, detail);
+            if (result.exitCode !== 0 && result.exitCode !== 1)
+                return { isError: true, content: [{ type: 'text', text: JSON.stringify(result) }] };
+            const offset = integer(args, 'offset', 0) ?? 0, limit = integer(args, 'head_limit', 0), lines = result.stdout.split('\n');
+            return text(lines.slice(offset, limit === undefined || limit === 0 ? undefined : offset + limit).join('\n'));
+        }
+        fields(args, ['command', 'timeout', 'description', 'run_in_background', 'dangerouslyDisableSandbox']);
+        if (boolean(args, 'run_in_background'))
+            throw failure('EMPLOYEE_BACKGROUND_UNSUPPORTED');
+        boolean(args, 'dangerouslyDisableSandbox');
+        string(args, 'description', false);
+        const timeout = integer(args, 'timeout', 1);
+        if (timeout !== undefined && timeout > 2147483647)
+            throw failure('EMPLOYEE_ARGUMENT_INVALID');
+        const command = string(args, 'command');
+        if (!options.runShell)
+            throw failure('EMPLOYEE_SHELL_ENDPOINT_UNAVAILABLE');
+        const result = await options.runShell({ command, signal, ...timeout === undefined ? {} : { timeout } });
+        return { ...text(JSON.stringify(result)), ...(result.exitCode !== 0 || result.signal ? { isError: true } : {}) };
+    }
+    async function call(name, input, requestSignal, observer = options.detail) {
+        const signal = AbortSignal.any([lifetime.signal, ...requestSignal ? [requestSignal] : []]);
+        signal.throwIfAborted();
+        const executionId = randomUUID();
+        let submitted = false;
+        const detail = (status, code) => observer({ kind: 'session', severity: status === 'completed' ? 'info' : 'warning', code: 'CLAUDE_EMPLOYEE_OPERATION', summary: 'Claude本机工具执行位置与结果', payload: { executionId, operation: name, status, ...code ? { reason: code } : {}, cwd: options.cwd, uid: options.uid, pid: process.pid } });
+        try {
+            if (!EMPLOYEE_TOOL_NAMES.includes(name))
+                throw failure('EMPLOYEE_TOOL_UNSUPPORTED');
+            await options.validate(signal);
+            signal.throwIfAborted();
+            submitted = true;
+            detail('started');
+            const result = await execute(name, object(input), signal, observer);
+            detail(result.isError ? 'failed' : 'completed');
+            await options.validate(signal);
+            signal.throwIfAborted();
+            capacity(JSON.stringify(result));
+            return result;
+        }
+        catch (error) {
+            const code = error instanceof NeedError ? error.code : signal.aborted ? 'EMPLOYEE_CANCELLED_UNKNOWN' : typeof error?.code === 'string' ? 'EMPLOYEE_IO_' + error.code : 'EMPLOYEE_OPERATION_FAILED';
+            detail(submitted && signal.aborted ? 'unknown' : 'failed', code);
+            return { isError: true, content: [{ type: 'text', text: code + '：本机操作未完成；没有在主机代跑。' }] };
+        }
+    }
+    return {
+        call(name, input, requestSignal, observer) { const operation = call(name, input, requestSignal, observer); calls.add(operation); void operation.then(() => calls.delete(operation), () => calls.delete(operation)); return operation; },
+        async close() { lifetime.abort(); await Promise.allSettled([...calls, ...children]); },
+    };
+}

package/dist/employee-workspace.d.ts

@@ -0,0 +1,26 @@
+import type { EmployeeWorkspace } from './employee-endpoint.ts';
+import type { Context } from '@deepseek-ai/cordis';
+interface Services {
+    get(name: string): unknown;
+    inject: Context['inject'];
+}
+/** Session headers do not have workspaceId. Resolve only the official registry relationship. */
+export declare function readEmployeeWorkspace(ctx: Services, sessionId: string): Promise<EmployeeWorkspace>;
+interface RegisteredWorkspace {
+    id: string;
+    path: string;
+    sessionIds: readonly string[];
+}
+interface OfficialRegistry {
+    list(): readonly RegisteredWorkspace[];
+    get(id: string): RegisteredWorkspace | undefined;
+}
+/** Same official membership/header boundary as L. No basename or first-workspace inference. */
+export declare function officialEmployeeWorkspace(sessionId: string, registry: OfficialRegistry | undefined, header: {
+    id: string;
+    cwd?: string;
+} | undefined): {
+    id: string;
+    path: string;
+};
+export {};

package/dist/employee-workspace.js

@@ -0,0 +1,61 @@
+import { lstat, realpath } from 'node:fs/promises';
+import { isAbsolute } from 'node:path';
+import { NeedError } from "./remote.js";
+const invalid = () => new NeedError('EMPLOYEE_WORKSPACE_INVALID', '无法核对当前会话的本机文件夹，本轮未执行。', '官方工作区唯一会话关系与当前原生cwd');
+/** Session headers do not have workspaceId. Resolve only the official registry relationship. */
+export async function readEmployeeWorkspace(ctx, sessionId) {
+    if (typeof ctx.inject !== 'function')
+        throw invalid();
+    let active = false, seen = false, scoped;
+    const injection = ctx.inject(['workspaceRegistry', 'sessions'], current => { if (seen)
+        return; seen = true; active = true; scoped = current; return () => { active = false; }; });
+    try {
+        await injection;
+        if (!active || !scoped)
+            throw invalid();
+        return await readWorkspace(scoped, sessionId, () => { if (!active)
+            throw invalid(); });
+    }
+    finally {
+        await injection.dispose();
+    }
+}
+async function readWorkspace(ctx, sessionId, fence) {
+    fence();
+    const registry = ctx.get('workspaceRegistry'), sessions = ctx.get('sessions');
+    if (!registry || typeof registry.list !== 'function' || typeof registry.get !== 'function' || !sessions || typeof sessions.get !== 'function' || !sessionId)
+        throw invalid();
+    const live = sessions.get(sessionId);
+    const current = () => {
+        fence();
+        const currentRegistry = ctx.get('workspaceRegistry');
+        // Service proxies are caller-scoped; injection owns the lifecycle fence.
+        if (!currentRegistry || ctx.get('sessions')?.get(sessionId) !== live)
+            throw invalid();
+        const matches = currentRegistry.list().filter(row => Array.isArray(row.sessionIds) && row.sessionIds.includes(sessionId));
+        if (matches.length !== 1)
+            throw invalid();
+        const row = matches[0], entry = currentRegistry.get(row.id), header = sessions.get(sessionId)?.header;
+        if (!entry || row.id !== entry.id || row.path !== entry.path || !entry.sessionIds.includes(sessionId) || !isAbsolute(row.path) || !header || header.id !== sessionId || !isAbsolute(header.cwd))
+            throw invalid();
+        return { workspaceId: row.id, path: row.path, cwd: header.cwd };
+    };
+    const first = current(), path = await realpath(first.path), cwd = await realpath(first.cwd), info = await lstat(path);
+    const last = current();
+    if (JSON.stringify(last) !== JSON.stringify(first) || path !== cwd || !info.isDirectory() || info.isSymbolicLink())
+        throw invalid();
+    return { workspaceId: first.workspaceId, directory: { path, device: info.dev, inode: info.ino } };
+}
+/** Same official membership/header boundary as L. No basename or first-workspace inference. */
+export function officialEmployeeWorkspace(sessionId, registry, header) {
+    const fail = () => new NeedError('EMPLOYEE_WORKSPACE_UNAVAILABLE', '无法确认这次会话的本机工作区，本轮没有执行；请从原生工作区打开会话。', '官方workspaceRegistry成员关系与会话header.cwd');
+    if (!sessionId || !registry || !header || header.id !== sessionId || typeof header.cwd !== 'string')
+        throw fail();
+    const matches = registry.list().filter(w => Array.isArray(w.sessionIds) && w.sessionIds.includes(sessionId));
+    if (matches.length !== 1)
+        throw fail();
+    const item = matches[0], current = registry.get(item.id);
+    if (!current || current.id !== item.id || current.path !== item.path || !current.sessionIds.includes(sessionId) || !item.path.startsWith('/') || item.path.includes('\0') || header.cwd !== item.path)
+        throw fail();
+    return { id: item.id, path: item.path };
+}

package/dist/index.d.ts

@@ -18,6 +18,7 @@ export declare const DEFAULT_CONFIG: Readonly<{
     readonly brokerControlMaxBytes: 1048576;
     readonly oneShotSandbox: "workspace-write";
     readonly oneShotApproval: "never";
+    readonly employeeShellKillGraceMs: 1000;
 }>;
 export declare const Config: Schema<Schemastery.ObjectS<NoInfer<{
     mode: Schema<"session" | "one-shot", "session" | "one-shot", "volatile-defined">;
@@ -26,6 +27,7 @@ export declare const Config: Schema<Schemastery.ObjectS<NoInfer<{
     brokerControlMaxBytes: Schema<number, number, "volatile-defined">;
     oneShotSandbox: Schema<"read-only" | "workspace-write" | "danger-full-access", "read-only" | "workspace-write" | "danger-full-access", "volatile-defined">;
     oneShotApproval: Schema<"never", "never", "volatile-defined">;
+    employeeShellKillGraceMs: Schema<number, number, "volatile-defined">;
 }>>, Schemastery.ObjectT<NoInfer<{
     mode: Schema<"session" | "one-shot", "session" | "one-shot", "volatile-defined">;
     acpMaxMessageBytes: Schema<number, number, "volatile-defined">;
@@ -33,6 +35,7 @@ export declare const Config: Schema<Schemastery.ObjectS<NoInfer<{
     brokerControlMaxBytes: Schema<number, number, "volatile-defined">;
     oneShotSandbox: Schema<"read-only" | "workspace-write" | "danger-full-access", "read-only" | "workspace-write" | "danger-full-access", "volatile-defined">;
     oneShotApproval: Schema<"never", "never", "volatile-defined">;
+    employeeShellKillGraceMs: Schema<number, number, "volatile-defined">;
 }>>, "plain">;
 export interface PluginConfig {
     mode?: 'session' | 'one-shot';
@@ -41,6 +44,7 @@ export interface PluginConfig {
     brokerControlMaxBytes?: number;
     oneShotSandbox?: 'read-only' | 'workspace-write' | 'danger-full-access';
     oneShotApproval?: 'never';
+    employeeShellKillGraceMs?: number;
 }
 type LiveConfig = {
     [K in keyof PluginConfig]: PluginConfig[K] | {
@@ -81,6 +85,7 @@ export declare class CodexRemoteAdapter extends LlmAdapter {
         catalog: HostModel;
     }>;
     invalidateModelState(): Promise<void>;
+    invalidateEmployeeState(): Promise<void>;
     providerRetryPolicy(): {
         mode: "normal";
         maxRetries: number;
@@ -112,6 +117,7 @@ export declare class RemoteAgentsAdapter extends LlmAdapter {
         catalog: HostModel;
     }>;
     invalidateModelState(): Promise<void>;
+    invalidateEmployeeState(): Promise<void>;
     providerRetryPolicy(): {
         mode: "normal";
         maxRetries: number;