@auto-ai/agent 2.1.98 → 2.1.101

package/tools-runtime/git-tool/src/workspace.test.ts

@@ -0,0 +1,143 @@
+import { afterEach, describe, expect, it } from 'bun:test'
+import { mkdtemp, mkdir } from 'node:fs/promises'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { resetConfigure } from './hooks.js'
+import {
+  buildGitCredentialEnv,
+  prepareForAgent,
+  readGitCredentials,
+  redactUrlCredentials,
+  resolveGitWorkDir,
+  withHttpsCredentials,
+} from './workspace.js'
+
+const ENV_KEYS = [
+  'WS_GIT_REPO_URL',
+  'WS_GIT_WORK_DIR',
+  'WS_GIT_USERNAME',
+  'WS_GIT_PASSWORD',
+] as const
+
+function clearGitEnv(): void {
+  for (const key of ENV_KEYS) {
+    delete process.env[key]
+  }
+}
+
+function saveGitEnv(): Record<string, string | undefined> {
+  const saved: Record<string, string | undefined> = {}
+  for (const key of ENV_KEYS) {
+    saved[key] = process.env[key]
+  }
+  return saved
+}
+
+function restoreGitEnv(saved: Record<string, string | undefined>): void {
+  for (const key of ENV_KEYS) {
+    const value = saved[key]
+    if (value === undefined) {
+      delete process.env[key]
+    } else {
+      process.env[key] = value
+    }
+  }
+}
+
+describe('git-tool workspace helpers', () => {
+  let savedEnv: Record<string, string | undefined> = {}
+
+  afterEach(() => {
+    restoreGitEnv(savedEnv)
+    resetConfigure()
+  })
+
+  it('resolveGitWorkDir 未设置时默认 operWorkspaceDir/repo', () => {
+    savedEnv = saveGitEnv()
+    clearGitEnv()
+    expect(resolveGitWorkDir('/tmp/agent/workspace')).toBe(
+      '/tmp/agent/workspace/repo',
+    )
+  })
+
+  it('resolveGitWorkDir 支持相对与绝对路径', () => {
+    savedEnv = saveGitEnv()
+    clearGitEnv()
+    process.env.WS_GIT_WORK_DIR = 'checkout'
+    expect(resolveGitWorkDir('/tmp/agent/workspace')).toBe(
+      '/tmp/agent/workspace/checkout',
+    )
+    process.env.WS_GIT_WORK_DIR = '/data/repo'
+    expect(resolveGitWorkDir('/tmp/agent/workspace')).toBe('/data/repo')
+  })
+
+  it('readGitCredentials 均未设置返回 null', () => {
+    savedEnv = saveGitEnv()
+    clearGitEnv()
+    expect(readGitCredentials()).toBe(null)
+  })
+
+  it('readGitCredentials 仅设置其一抛错', () => {
+    savedEnv = saveGitEnv()
+    clearGitEnv()
+    process.env.WS_GIT_USERNAME = 'user'
+    expect(() => readGitCredentials()).toThrow(
+      'WS_GIT_USERNAME 与 WS_GIT_PASSWORD 必须成对设置',
+    )
+  })
+
+  it('withHttpsCredentials 注入 HTTPS 凭据', () => {
+    const url = withHttpsCredentials('https://git.example.com/a/b.git', {
+      username: 'bot',
+      password: 'secret',
+    })
+    expect(url).toContain('bot')
+    expect(url).toContain('secret')
+    expect(
+      withHttpsCredentials('git@github.com:org/repo.git', {
+        username: 'bot',
+        password: 'secret',
+      }),
+    ).toBe('git@github.com:org/repo.git')
+  })
+
+  it('buildGitCredentialEnv 含 inline credential.helper', () => {
+    const env = buildGitCredentialEnv({ username: 'u', password: 'p' })
+    expect(env.GIT_TERMINAL_PROMPT).toBe('0')
+    expect(env.GIT_CONFIG_COUNT).toBe('1')
+    expect(env.GIT_CONFIG_VALUE_0).toContain('username=u')
+    expect(env.GIT_CONFIG_VALUE_0).toContain('password=p')
+  })
+
+  it('redactUrlCredentials 脱敏 http(s) 凭据', () => {
+    expect(
+      redactUrlCredentials('https://user:token@git.example.com/r.git'),
+    ).toBe('https://***:***@git.example.com/r.git')
+  })
+})
+
+describe('prepareForAgent', () => {
+  let savedEnv: Record<string, string | undefined> = {}
+
+  afterEach(() => {
+    restoreGitEnv(savedEnv)
+    resetConfigure()
+  })
+
+  it('无 URL 且默认 repo/ 非 git 目录时返回 skipped', async () => {
+    savedEnv = saveGitEnv()
+    clearGitEnv()
+    const operWorkspaceDir = await mkdtemp(join(tmpdir(), 'ws-git-missing-'))
+    await expect(prepareForAgent({ operWorkspaceDir })).resolves.toBe('skipped')
+  })
+
+  it('WS_GIT_WORK_DIR 非 git 目录且无 URL 时返回 skipped', async () => {
+    savedEnv = saveGitEnv()
+    clearGitEnv()
+    const operWorkspaceDir = await mkdtemp(join(tmpdir(), 'ws-git-notrepo-'))
+    const notRepo = join(operWorkspaceDir, 'not-git')
+    await mkdir(notRepo, { recursive: true })
+    process.env.WS_GIT_WORK_DIR = notRepo
+    await expect(prepareForAgent({ operWorkspaceDir })).resolves.toBe('skipped')
+  })
+})

package/tools-runtime/git-tool/src/workspace.ts

@@ -0,0 +1,277 @@
+/**
+ * Git 工作区准备：读 WS_GIT_* 环境变量、clone/pull、探测工作区。
+ * WS init 由 prepareForAgent 调用；与 CodeTool 仅通过环境变量约定解耦。
+ */
+
+import { spawn } from 'node:child_process'
+import { access } from 'node:fs/promises'
+import { isAbsolute, join } from 'node:path'
+import { configure, getCachedConfigure, resetConfigure } from './hooks.js'
+
+const GIT_REPO_SUBDIR = 'repo'
+const DEFAULT_GIT_TIMEOUT_MS = 120 * 1000
+
+const GIT_NO_PROMPT_ENV: Record<string, string> = {
+  GIT_TERMINAL_PROMPT: '0',
+  GIT_ASKPASS: '',
+}
+
+export type GitCredentials = {
+  username: string
+  password: string
+}
+
+export type PrepareForAgentResult = 'ready' | 'skipped'
+
+function getGitTimeoutMs(): number {
+  const envValue = process.env.CLAUDE_CODE_PLUGIN_GIT_TIMEOUT_MS
+  if (envValue) {
+    const parsed = parseInt(envValue, 10)
+    if (!Number.isNaN(parsed) && parsed > 0) {
+      return parsed
+    }
+  }
+  return DEFAULT_GIT_TIMEOUT_MS
+}
+
+/** 日志脱敏：隐藏 http(s) URL 中的 user:pass */
+export function redactUrlCredentials(urlString: string): string {
+  try {
+    const parsed = new URL(urlString)
+    const isHttp = parsed.protocol === 'http:' || parsed.protocol === 'https:'
+    if (isHttp && (parsed.username || parsed.password)) {
+      if (parsed.username) parsed.username = '***'
+      if (parsed.password) parsed.password = '***'
+      return parsed.toString()
+    }
+  } catch {
+    // 非 URL 原样返回
+  }
+  return urlString
+}
+
+/**
+ * 读取 WS_GIT_USERNAME / WS_GIT_PASSWORD。
+ * 业务语义：两者均设置才生效；仅设置其一则 fail-fast。
+ */
+export function readGitCredentials(): GitCredentials | null {
+  const username = process.env.WS_GIT_USERNAME?.trim() ?? ''
+  const password = process.env.WS_GIT_PASSWORD?.trim() ?? ''
+  if (!username && !password) {
+    return null
+  }
+  if (!username || !password) {
+    throw new Error(
+      'WS_GIT_USERNAME 与 WS_GIT_PASSWORD 必须成对设置',
+    )
+  }
+  return { username, password }
+}
+
+/** HTTPS URL 注入 user:pass；SSH URL（git@）原样返回 */
+export function withHttpsCredentials(
+  url: string,
+  creds: GitCredentials | null,
+): string {
+  if (!creds) {
+    return url
+  }
+  try {
+    const parsed = new URL(url)
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+      return url
+    }
+    parsed.username = encodeURIComponent(creds.username)
+    parsed.password = encodeURIComponent(creds.password)
+    return parsed.toString()
+  } catch {
+    return url
+  }
+}
+
+/** 构造 git 命令额外 env：防交互 + 可选 inline credential.helper */
+export function buildGitCredentialEnv(
+  creds: GitCredentials | null,
+): Record<string, string> {
+  const env: Record<string, string> = { ...GIT_NO_PROMPT_ENV }
+  if (!creds) {
+    return env
+  }
+  env.GIT_CONFIG_COUNT = '1'
+  env.GIT_CONFIG_KEY_0 = 'credential.helper'
+  env.GIT_CONFIG_VALUE_0 =
+    `!f() { echo username=${creds.username}; echo password=${creds.password}; }; f`
+  return env
+}
+
+/**
+ * 解析 Git 工作目录：WS_GIT_WORK_DIR 优先，否则默认 operWorkspaceDir/repo。
+ * 与 CodeTool 共用同一 env 约定，两包互不 import。
+ */
+export function resolveGitWorkDir(operWorkspaceDir: string): string {
+  const workDir = process.env.WS_GIT_WORK_DIR?.trim() ?? ''
+  if (!workDir) {
+    return join(operWorkspaceDir, GIT_REPO_SUBDIR)
+  }
+  return isAbsolute(workDir) ? workDir : join(operWorkspaceDir, workDir)
+}
+
+async function pathExists(path: string): Promise<boolean> {
+  try {
+    await access(path)
+    return true
+  } catch {
+    return false
+  }
+}
+
+type GitExecResult = {
+  code: number
+  stdout: string
+  stderr: string
+}
+
+/** 在指定 cwd 执行 git 子进程 */
+function execGit(
+  args: string[],
+  options: { cwd?: string; env?: Record<string, string> },
+): Promise<GitExecResult> {
+  return new Promise((resolve, reject) => {
+    const proc = spawn('git', args, {
+      cwd: options.cwd,
+      stdio: ['ignore', 'pipe', 'pipe'],
+      env: { ...process.env, ...options.env },
+    })
+    let stdout = ''
+    let stderr = ''
+    const timer = setTimeout(() => {
+      proc.kill('SIGKILL')
+      reject(new Error(`git ${args.join(' ')} timed out`))
+    }, getGitTimeoutMs())
+    proc.stdout.on('data', c => (stdout += String(c)))
+    proc.stderr.on('data', c => (stderr += String(c)))
+    proc.on('error', err => {
+      clearTimeout(timer)
+      reject(err)
+    })
+    proc.on('close', code => {
+      clearTimeout(timer)
+      resolve({
+        code: typeof code === 'number' ? code : 1,
+        stdout,
+        stderr,
+      })
+    })
+  })
+}
+
+/** 探测目录是否为 git 工作区 */
+async function isGitWorkTree(
+  dir: string,
+  gitEnv: Record<string, string>,
+): Promise<boolean> {
+  const result = await execGit(['rev-parse', '--is-inside-work-tree'], {
+    cwd: dir,
+    env: gitEnv,
+  })
+  return result.code === 0 && result.stdout.trim() === 'true'
+}
+
+/** git clone 到目标目录（浅克隆） */
+async function wsGitClone(params: {
+  url: string
+  targetPath: string
+  gitEnv: Record<string, string>
+}): Promise<void> {
+  const args = [
+    '-c',
+    'core.sshCommand=ssh -o BatchMode=yes -o StrictHostKeyChecking=yes',
+    'clone',
+    '--depth',
+    '1',
+    '--recurse-submodules',
+    '--shallow-submodules',
+  ]
+  args.push(params.url, params.targetPath)
+
+  console.warn(
+    `[git-tool] clone url=${redactUrlCredentials(params.url)} target=${params.targetPath}`,
+  )
+
+  const result = await execGit(args, { env: params.gitEnv })
+  if (result.code !== 0) {
+    const stderr = redactUrlCredentials(result.stderr)
+    throw new Error(
+      `git clone 失败: url=${redactUrlCredentials(params.url)} exit=${result.code}\n${stderr}`.trim(),
+    )
+  }
+}
+
+/** 在已有仓库目录执行 git pull */
+async function wsGitPull(params: {
+  cwd: string
+  gitEnv: Record<string, string>
+}): Promise<void> {
+  console.warn(`[git-tool] pull cwd=${params.cwd}`)
+  const result = await execGit(['pull', 'origin', 'HEAD'], {
+    cwd: params.cwd,
+    env: params.gitEnv,
+  })
+  if (result.code !== 0) {
+    throw new Error(
+      `git pull 失败: cwd=${params.cwd} exit=${result.code}\n${result.stderr}`.trim(),
+    )
+  }
+}
+
+/**
+ * WS init：按环境变量准备 git 工作区并 configure GitTool。
+ * 未配置 WS_GIT_REPO_URL 且本地无 git 工作区时返回 skipped，不抛错。
+ */
+export async function prepareForAgent(params: {
+  operWorkspaceDir: string
+}): Promise<PrepareForAgentResult> {
+  const repoUrl = process.env.WS_GIT_REPO_URL?.trim() ?? ''
+  const creds = readGitCredentials()
+  const gitWorkDir = resolveGitWorkDir(params.operWorkspaceDir)
+  const gitEnv = buildGitCredentialEnv(creds)
+
+  if (repoUrl) {
+    const cloneUrl = withHttpsCredentials(repoUrl, creds)
+    const repoExists = await pathExists(gitWorkDir)
+    if (!repoExists) {
+      await wsGitClone({
+        url: cloneUrl,
+        targetPath: gitWorkDir,
+        gitEnv,
+      })
+    } else {
+      await wsGitPull({ cwd: gitWorkDir, gitEnv })
+    }
+  } else {
+    const repoReady =
+      (await pathExists(gitWorkDir)) &&
+      (await isGitWorkTree(gitWorkDir, gitEnv))
+    if (!repoReady) {
+      console.warn(
+        `[git-tool] WS_GIT_REPO_URL 未配置且 ${gitWorkDir} 不是有效 git 工作区，跳过 GitTool 运行时配置`,
+      )
+      resetConfigure()
+      return 'skipped'
+    }
+  }
+
+  configure({
+    getGitWorkDir: () => gitWorkDir,
+    getGitCommandEnv: () => gitEnv,
+  })
+  return 'ready'
+}
+
+/** runtime 重载 git-tool 模块时恢复已 prepare 的 hooks */
+export function ensureConfigured(): void {
+  const cached = getCachedConfigure()
+  if (cached) {
+    configure(cached)
+  }
+}

package/tools-runtime/git-tool/src/wsInit.ts

@@ -0,0 +1,25 @@
+/**
+ * WS 子进程 init：由 runtimeToolLoader 通用入口调用，不经过主工程 git 胶水层。
+ */
+
+import { isEnabledInAgentConfig } from './agentConfig.js'
+import { resetConfigure } from './hooks.js'
+import { prepareForAgent } from './workspace.js'
+
+export type GitToolWsInitContext = {
+  agentHomeDir: string
+  operWorkspaceDir: string
+  agent: {
+    tools: string[]
+    disallowedTools?: string[]
+  }
+}
+
+/** WS init：按 agent 白名单与环境变量准备 git 工作区 */
+export async function initWsSession(ctx: GitToolWsInitContext): Promise<void> {
+  if (!isEnabledInAgentConfig(ctx.agent)) {
+    resetConfigure()
+    return
+  }
+  await prepareForAgent({ operWorkspaceDir: ctx.operWorkspaceDir })
+}

package/tools-runtime/schedule-tool/build.ts

@@ -0,0 +1,10 @@
+/**
+ * 构建 Runtime Tool 单文件入口；宿主仅加载 index.cjs。
+ */
+await Bun.build({
+  entrypoints: ['src/index.ts'],
+  outdir: '.',
+  naming: 'index.cjs',
+  format: 'cjs',
+  target: 'node',
+})