@atlisp/mcp 1.8.11 → 1.8.13

package/dist/cad-worker.js

@@ -4,6 +4,7 @@ import process from 'process';
 import fs from 'fs';
 import path from 'path';
 import crypto from 'crypto';
+import { validateLispCodeWorker, checkParens } from './lisp-security.js';
 
 const BUSY_RETRIES = parseInt(process.env.BUSY_RETRIES || '10', 10);
 const BUSY_DELAY = parseInt(process.env.BUSY_DELAY || '500', 10);
@@ -110,8 +111,8 @@ const cadLaunch = edge.func(function() {/*
                   }
               }
           } catch (Exception ex) {
-              System.Diagnostics.Debug.WriteLine("Create COM " + platforms[i] + " error: " + ex.Message);
-          }
+               System.Diagnostics.Debug.WriteLine("cadLaunch create " + progIds[i] + " error: " + ex.Message);
+           }
       }
 
       return new { success = false, error = "No CAD found" };
@@ -470,68 +471,7 @@ async function waitForIdle(platform) {
   return false;
 }
 
-const DANGEROUS_PATTERNS = [
-  { re: /\beval\s*[(\s]/i, msg: '禁止使用 eval 函数' },
-  { re: /\bload\s*[(\s"]/i, msg: '禁止使用 load 函数' },
-  { re: /\bstartapp\s*[(\s]/i, msg: '禁止使用 startapp 函数' },
-  { re: /\bvl-bt\b/i, msg: '禁止使用 vl-bt 函数' },
-  { re: /\bvl-exit-with-value\b/i, msg: '禁止使用 vl-exit-with-value' },
-  { re: /\bvl-exit-with-error\b/i, msg: '禁止使用 vl-exit-with-error' },
-  { re: /\bvlax-import-type-library\b/i, msg: '禁止导入类型库' },
-  { re: /\bvlax-add-cmd\b/i, msg: '禁止注册新命令' },
-  { re: /\bvla-Delete\b/i, msg: '禁止直接删除 vla 对象' },
-  { re: /\bvla-Save\b/i, msg: '禁止直接保存文档' },
-  { re: /\bcommand\s*["\s]*[_(]?\s*["']?\.?\s*_?(?:quit|exit|close|open|new|recover|audit|purge|wblock|export)/i, msg: '禁止使用危险 CAD 命令' },
-  { re: /\bdirectory\s*[(\s]/i, msg: '禁止使用 directory 函数' },
-  { re: /\b(?:read-line|read-char|write-line|write-char)\s*[(\s]/i, msg: '禁止直接文件 I/O' },
-  { re: /\bvla-deletefile\b/i, msg: '禁止删除文件' },
-  { re: /\bvla-copyfile\b/i, msg: '禁止复制文件' },
-  { re: /\bvla-movefile\b/i, msg: '禁止移动文件' },
-  { re: /\bdos_command_string\s*[(\s]/i, msg: '禁止使用 dos_command_string' },
-];
-
-function validateLispCode(code) {
-  const withoutStrings = code.replace(/"([^"\\]*(?:\\.[^"\\]*)*)"/g, '');
-  const withoutComments = withoutStrings.replace(/;.*$/gm, '');
-  for (const { re, msg } of DANGEROUS_PATTERNS) {
-    if (re.test(withoutComments)) {
-      return { valid: false, error: msg };
-    }
-  }
-  return { valid: true };
-}
-
-export function checkParens(code) {
-  let depth = 0;
-  let inString = false;
-  for (let i = 0; i < code.length; i++) {
-    const ch = code[i];
-    if (inString) {
-      if (ch === '\\' && i + 1 < code.length) {
-        i++;
-        continue;
-      }
-      if (ch === '"') {
-        inString = false;
-      }
-      continue;
-    }
-    if (ch === '"') {
-      inString = true;
-      continue;
-    }
-    if (ch === ';') {
-      while (i < code.length && code[i] !== '\n') i++;
-      continue;
-    }
-    if (ch === '(') depth++;
-    if (ch === ')') depth--;
-    if (depth < 0) return { valid: false, error: '多余右括号 )', pos: i };
-  }
-  if (depth > 0) return { valid: false, error: `缺少 ${depth} 个右括号 )`, pos: code.length - 1 };
-  if (depth < 0) return { valid: false, error: `多余 ${-depth} 个左括号 (` };
-  return { valid: true };
-}
+export { checkParens } from './lisp-security.js';
 
 async function connectToPlatform(targetPlatform) {
   return new Promise((resolve, reject) => {
@@ -609,7 +549,7 @@ async function handleMessage(msg) {
     if (!parenCheck.valid) {
       return { success: false, error: `括号错误: ${parenCheck.error} (位置 ${parenCheck.pos})` };
     }
-    const injectionCheck = validateLispCode(msg.code);
+    const injectionCheck = validateLispCodeWorker(msg.code);
     if (!injectionCheck.valid) {
       return { success: false, error: `安全限制: ${injectionCheck.error}` };
     }
@@ -662,7 +602,7 @@ async function handleMessage(msg) {
     if (!parenCheck.valid) {
       return { success: false, error: `括号错误: ${parenCheck.error} (位置 ${parenCheck.pos})` };
     }
-    const injectionCheck = validateLispCode(msg.code);
+    const injectionCheck = validateLispCodeWorker(msg.code);
     if (!injectionCheck.valid) {
       return { success: false, error: `安全限制: ${injectionCheck.error}` };
     }

package/dist/config.js

@@ -0,0 +1,241 @@
+import { z } from 'zod';
+import fs from 'fs';
+import path from 'path';
+import os from 'os';
+
+const envSchema = z.object({
+    PORT: z.string().optional().default('8110'),
+    HOST: z.string().optional().default('0.0.0.0'),
+    TRANSPORT: z.enum(['http', 'stdio', 'ws']).optional().default('http'),
+    MCP_API_KEY: z.string().optional().default(''),
+    ENABLE_SSE: z.string().optional().default('true'),
+    MESSAGE_TIMEOUT: z.string().optional().default('60000'),
+    HEARTBEAT_INTERVAL: z.string().optional().default('30000'),
+    BUSY_RETRIES: z.string().optional().default('10'),
+    BUSY_DELAY: z.string().optional().default('500'),
+    ENABLE_CORS: z.string().optional().default('true'),
+    CORS_ORIGIN: z.string().optional().default('*'),
+    RATE_LIMIT_WINDOW: z.string().optional().default('60000'),
+    RATE_LIMIT_MAX: z.string().optional().default('100'),
+    RESOURCE_CACHE_TTL: z.string().optional().default('5000'),
+    FUNCTION_LIB_CACHE_TTL: z.string().optional().default('300000'),
+    DEBUG: z.string().optional().default('false'),
+    DEBUG_FILE: z.string().optional().default(''),
+    FUNCTION_LIB_URL: z.string().optional().default('http://s3.atlisp.cn/json/functions.json'),
+    CONFIG_FILE: z.string().optional().default(''),
+    API_KEY_RATE_LIMIT: z.string().optional().default('1000'),
+    METRICS_ENABLED: z.string().optional().default('true'),
+    REQUEST_LOG_ENABLED: z.string().optional().default('true'),
+    SSL_KEY_PATH: z.string().optional().default(''),
+    SSL_CERT_PATH: z.string().optional().default(''),
+    LLM_API_KEY: z.string().optional().default(''),
+    LLM_API_URL: z.string().optional().default('https://api.openai.com/v1/chat/completions'),
+    LLM_MODEL: z.string().optional().default('gpt-4o-mini'),
+    LLM_MAX_TOKENS: z.string().optional().default('4096'),
+    LLM_TEMPERATURE: z.string().optional().default('0.7'),
+});
+
+const configSchema = z.object({
+    port: z.number().optional(),
+    host: z.string().optional(),
+    transport: z.enum(['http', 'stdio', 'ws']).optional(),
+    apiKey: z.string().optional(),
+    enableSse: z.boolean().optional(),
+    messageTimeout: z.number().optional(),
+    heartbeatInterval: z.number().optional(),
+    busyRetries: z.number().optional(),
+    busyDelay: z.number().optional(),
+    enableCors: z.boolean().optional(),
+    corsOrigin: z.string().optional(),
+    rateLimitWindow: z.number().optional(),
+    rateLimitMax: z.number().optional(),
+    resourceCacheTtl: z.number().optional(),
+    functionLibCacheTtl: z.number().optional(),
+    debug: z.boolean().optional(),
+    debugFile: z.string().optional(),
+    functionLibUrl: z.string().optional(),
+    configFile: z.string().optional(),
+    apiKeyRateLimit: z.number().optional(),
+    metricsEnabled: z.boolean().optional(),
+    apiKeys: z.array(z.object({
+        key: z.string(),
+        limit: z.number(),
+        name: z.string().optional(),
+        role: z.string().optional()
+    })).optional(),
+    sslKey: z.string().optional(),
+    sslCert: z.string().optional(),
+    llmApiKey: z.string().optional(),
+    llmApiUrl: z.string().optional(),
+    llmModel: z.string().optional(),
+    llmMaxTokens: z.number().optional(),
+    llmTemperature: z.number().optional(),
+    maxPoolSize: z.number().optional(),
+});
+
+function parseArgs() {
+    const args = process.argv.slice(2);
+    const result = {};
+    for (let i = 0; i < args.length; i++) {
+        if (args[i] === '--transport' && args[i + 1]) {
+            result.transport = args[i + 1];
+            i++;
+        } else if (args[i] === '--stdio') {
+            result.transport = 'stdio';
+        } else if (args[i] === '--ws') {
+            result.transport = 'ws';
+        } else if (args[i] === '--port' && args[i + 1]) {
+            result.port = args[i + 1];
+            i++;
+        } else if (args[i] === '--host' && args[i + 1]) {
+            result.host = args[i + 1];
+            i++;
+        } else if (args[i] === '--config' && args[i + 1]) {
+            result.configFile = args[i + 1];
+            i++;
+        } else if (args[i] === '--ssl-key' && args[i + 1]) {
+            result.sslKey = args[i + 1];
+            i++;
+        } else if (args[i] === '--ssl-cert' && args[i + 1]) {
+            result.sslCert = args[i + 1];
+            i++;
+        } else if (args[i] === '--debug') {
+            result.debug = true;
+        }
+    }
+    return result;
+}
+
+export { parseArgs };
+
+function loadConfigFile(filePath) {
+    if (!filePath || !fs.existsSync(filePath)) return null;
+    try {
+        const raw = fs.readFileSync(filePath, 'utf-8');
+        const parsed = JSON.parse(raw);
+        const result = configSchema.safeParse(parsed);
+        if (result.success) {
+            return result.data;
+        }
+        console.error('配置文件格式错误:', result.error);
+    } catch (e) {
+        console.error('加载配置文件失败:', e.message);
+    }
+    return null;
+}
+
+const cliArgs = parseArgs();
+const envResult = envSchema.safeParse(process.env);
+
+if (!envResult.success) {
+    console.error('环境变量配置错误:', envResult.error.flatten().fieldErrors);
+    process.exit(1);
+}
+
+const env = envResult.data;
+
+const configFilePath = env.CONFIG_FILE || cliArgs.configFile ||
+    path.join(os.homedir(), '.atlisp', 'atlisp.config.json');
+
+const fileConfig = loadConfigFile(configFilePath);
+
+const config = {
+    port: fileConfig?.port || parseInt(cliArgs.port || env.PORT, 10),
+    host: fileConfig?.host || cliArgs.host || env.HOST,
+    transport: fileConfig?.transport ?? cliArgs.transport ?? env.TRANSPORT,
+    apiKey: fileConfig?.apiKey || env.MCP_API_KEY,
+    enableSse: fileConfig?.enableSse ?? (env.ENABLE_SSE === 'true'),
+    messageTimeout: fileConfig?.messageTimeout || parseInt(env.MESSAGE_TIMEOUT, 10),
+    heartbeatInterval: fileConfig?.heartbeatInterval || parseInt(env.HEARTBEAT_INTERVAL, 10),
+    busyRetries: fileConfig?.busyRetries || parseInt(env.BUSY_RETRIES, 10),
+    busyDelay: fileConfig?.busyDelay || parseInt(env.BUSY_DELAY, 10),
+    enableCors: fileConfig?.enableCors ?? (env.ENABLE_CORS === 'true'),
+    corsOrigin: fileConfig?.corsOrigin || env.CORS_ORIGIN,
+    rateLimitWindow: fileConfig?.rateLimitWindow || parseInt(env.RATE_LIMIT_WINDOW, 10),
+    rateLimitMax: fileConfig?.rateLimitMax || parseInt(env.RATE_LIMIT_MAX, 10),
+    resourceCacheTtl: fileConfig?.resourceCacheTtl || parseInt(env.RESOURCE_CACHE_TTL, 10),
+    functionLibCacheTtl: fileConfig?.functionLibCacheTtl || parseInt(env.FUNCTION_LIB_CACHE_TTL, 10),
+    debug: fileConfig?.debug ?? (env.DEBUG === 'true'),
+    debugFile: fileConfig?.debugFile || env.DEBUG_FILE,
+    functionLibUrl: fileConfig?.functionLibUrl || env.FUNCTION_LIB_URL,
+    configFile: configFilePath,
+    apiKeyRateLimit: fileConfig?.apiKeyRateLimit || parseInt(env.API_KEY_RATE_LIMIT, 10),
+    apiKeys: fileConfig?.apiKeys || [],
+    metricsEnabled: fileConfig?.metricsEnabled ?? (env.METRICS_ENABLED === 'true'),
+    requestLogEnabled: fileConfig?.requestLogEnabled ?? (env.REQUEST_LOG_ENABLED !== 'false'),
+    sslKey: fileConfig?.sslKey || env.SSL_KEY_PATH || cliArgs.sslKey,
+    sslCert: fileConfig?.sslCert || env.SSL_CERT_PATH || cliArgs.sslCert,
+    llmApiKey: fileConfig?.llmApiKey || env.LLM_API_KEY,
+    llmApiUrl: fileConfig?.llmApiUrl || env.LLM_API_URL,
+    llmModel: fileConfig?.llmModel || env.LLM_MODEL,
+    llmMaxTokens: fileConfig?.llmMaxTokens || parseInt(env.LLM_MAX_TOKENS, 10),
+    llmTemperature: fileConfig?.llmTemperature || parseFloat(env.LLM_TEMPERATURE),
+    maxPoolSize: fileConfig?.maxPoolSize || 3,
+};
+
+export function validateConfig() {
+    const errors = [];
+    if (config.transport === 'http' || config.transport === 'ws') {
+        if (config.port < 1 || config.port > 65535) {
+            errors.push(`端口号无效: ${config.port}`);
+        }
+    }
+    if (config.sslKey && !fs.existsSync(config.sslKey)) {
+        errors.push(`SSL 密钥文件不存在: ${config.sslKey}`);
+    }
+    if (config.sslCert && !fs.existsSync(config.sslCert)) {
+        errors.push(`SSL 证书文件不存在: ${config.sslCert}`);
+    }
+    if (config.messageTimeout < 1000) {
+        errors.push(`消息超时过短: ${config.messageTimeout}ms (最小 1000ms)`);
+    }
+    if (config.rateLimitMax < 1) {
+        errors.push(`速率限制无效: ${config.rateLimitMax}`);
+    }
+    if (errors.length > 0) {
+        console.error('配置验证错误:');
+        errors.forEach(e => console.error(`  - ${e}`));
+        return false;
+    }
+    return true;
+}
+
+let configWatchers = [];
+
+if (configFilePath && fs.existsSync(configFilePath)) {
+    try {
+        fs.watch(configFilePath, (eventType) => {
+            if (eventType === 'change') {
+                const newFileConfig = loadConfigFile(configFilePath);
+                if (newFileConfig) {
+                    Object.assign(config, newFileConfig);
+                    configWatchers.forEach(fn => fn(config));
+                }
+            }
+        });
+    } catch (e) { console.error(`Config file watch error: ${e.message}`); }
+}
+
+export function getConfig(key) {
+    return config[key];
+}
+
+export function getAllConfig() {
+    return { ...config };
+}
+
+export function reloadConfig() {
+    const newFileConfig = loadConfigFile(config.configFile);
+    if (newFileConfig) {
+        Object.assign(config, newFileConfig);
+        configWatchers.forEach(fn => fn(config));
+        return true;
+    }
+    return false;
+}
+
+export function onConfigChange(callback) {
+    configWatchers.push(callback);
+}
+
+export default config;

package/dist/html/api-docs.html

@@ -0,0 +1,66 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <title>@lisp MCP Server API Docs</title>
+    <style>
+        body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; max-width: 900px; margin: 0 auto; padding: 20px; }
+        h1 { color: #333; }
+        h2 { color: #666; margin-top: 30px; }
+        .endpoint { background: #f5f5f5; padding: 15px; margin: 10px 0; border-radius: 5px; }
+        .method { display: inline-block; padding: 3px 8px; border-radius: 3px; font-weight: bold; font-size: 12px; }
+        .get { background: #61affe; color: white; }
+        .post { background: #49cc90; color: white; }
+        code { background: #eee; padding: 2px 5px; border-radius: 3px; }
+        .info { background: #f0f0f0; padding: 10px; margin: 10px 0; }
+    </style>
+</head>
+<body>
+    <h1>@lisp MCP Server API</h1>
+    <div class="info">
+        <strong>Version:</strong> __VERSION__ | 
+        <strong>Tools:</strong> __TOOLS_COUNT__ |
+        <strong>Resources:</strong> 11
+    </div>
+    
+    <h2>Endpoints</h2>
+    
+    <div class="endpoint">
+        <span class="method get">GET</span> <code>/health</code> - Health check
+    </div>
+    <div class="endpoint">
+        <span class="method get">GET</span> <code>/metrics</code> - Prometheus metrics
+    </div>
+    <div class="endpoint">
+        <span class="method post">POST</span> <code>/mcp</code> - MCP JSON-RPC endpoint
+    </div>
+    <div class="endpoint">
+        <span class="method get">GET</span> <code>/sse</code> - Server-Sent Events
+    </div>
+    <div class="endpoint">
+        <span class="method post">POST</span> <code>/message</code> - SSE message
+    </div>
+    <div class="endpoint">
+        <span class="method get">GET</span> <code>/debug</code> - Debug panel
+    </div>
+    <div class="endpoint">
+        <span class="method post">POST</span> <code>/config/reload</code> - Reload configuration
+    </div>
+    <div class="endpoint">
+        <span class="method get">GET</span> <code>/rate-limit/status</code> - Rate limit status
+    </div>
+    <div class="endpoint">
+        <span class="method post">POST</span> <code>/rate-limit/reset</code> - Reset rate limit
+    </div>
+
+    <h2>Quick Start</h2>
+    <pre>
+# Health check
+curl http://localhost:8110/health
+
+# Call MCP tool
+curl -X POST http://localhost:8110/mcp \
+  -H "Content-Type: application/json" \
+  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_cad_info","arguments":{}}}'
+    </pre>
+</body>
+</html>

package/dist/html/debug.html

@@ -0,0 +1,75 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <title>@lisp MCP Debug Panel</title>
+    <style>
+        body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; max-width: 1200px; margin: 0 auto; padding: 20px; background: #1a1a2e; color: #eee; }
+        h1 { color: #00d4ff; }
+        h2 { color: #00d4ff; border-bottom: 1px solid #333; padding-bottom: 10px; }
+        .card { background: #16213e; padding: 20px; margin: 10px 0; border-radius: 8px; }
+        .stat { display: inline-block; margin: 10px 20px; }
+        .stat-label { color: #888; font-size: 12px; }
+        .stat-value { font-size: 24px; color: #00d4ff; }
+        .status-ok { color: #49cc90; }
+        .status-error { color: #f93e3e; }
+        table { width: 100%; border-collapse: collapse; }
+        th, td { padding: 10px; text-align: left; border-bottom: 1px solid #333; }
+        th { color: #888; }
+        code { background: #0f0f23; padding: 3px 8px; border-radius: 3px; color: #00d4ff; }
+        .refresh { background: #00d4ff; color: #1a1a2e; padding: 10px 20px; border: none; border-radius: 5px; cursor: pointer; margin: 10px 0; }
+    </style>
+</head>
+<body>
+    <h1>🛠️ @lisp MCP Debug Panel</h1>
+    <button class="refresh" onclick="location.reload()">🔄 Refresh</button>
+    
+    <h2>System</h2>
+    <div class="card">
+        <div class="stat">
+            <div class="stat-label">Uptime</div>
+            <div class="stat-value">__UPTIME_MIN__m</div>
+        </div>
+        <div class="stat">
+            <div class="stat-label">Memory RSS</div>
+            <div class="stat-value">__MEMORY_RSS_MB__ MB</div>
+        </div>
+        <div class="stat">
+            <div class="stat-label">Heap Used</div>
+            <div class="stat-value">__HEAP_USED_MB__ MB</div>
+        </div>
+        <div class="stat">
+            <div class="stat-label">MCP Sessions</div>
+            <div class="stat-value">__SESSIONS_COUNT__</div>
+        </div>
+    </div>
+
+    <h2>CAD Status</h2>
+    <div class="card">
+        <span class="__CAD_STATUS_CLASS__">
+            __CAD_STATUS_TEXT__
+        </span>
+    </div>
+
+    <h2>Endpoints</h2>
+    <div class="card">
+        <table>
+            <tr><th>Endpoint</th><th>Method</th><th>Description</th></tr>
+            <tr><td><code>/health</code></td><td>GET</td><td>Health check</td></tr>
+            <tr><td><code>/metrics</code></td><td>GET</td><td>Prometheus metrics</td></tr>
+            <tr><td><code>/mcp</code></td><td>POST</td><td>MCP JSON-RPC</td></tr>
+            <tr><td><code>/sse</code></td><td>GET</td><td>Server-Sent Events</td></tr>
+            <tr><td><code>/debug</code></td><td>GET</td><td>This panel</td></tr>
+            <tr><td><code>/api/docs</code></td><td>GET</td><td>API Documentation</td></tr>
+        </table>
+    </div>
+
+    <h2>Tools (__TOOLS_COUNT__)</h2>
+    <div class="card">
+        <p>Use <code>tools/list</code> MCP method to get full tool list.</p>
+    </div>
+
+    <script>
+        setTimeout(() => location.reload(), 30000);
+    </script>
+</body>
+</html>