@capyclaw/ppt-workbench 0.0.0-stage → 2.4.1

package/server/routes/import.mjs

@@ -0,0 +1,258 @@
+/**
+ * PPTX 导入中转路由。
+ *
+ * 浏览器端导入需要 File 对象，而 MCP 工具在 Node 进程里拿到的是路径/字节。
+ * 这里负责：
+ *   POST <base>/import-file       原始字节上传 → 临时文件 + 同源下载地址
+ *   GET  <base>/import-file/:id   编辑器页面取回原始字节
+ *   POST <base>/import-result     编辑器回传导入结果
+ *   GET  <base>/import-result?req= MCP 工具轮询结果
+ *
+ * 文件与结果都是短生命周期：结果回传后删除临时文件，结果按 TTL 清理。
+ */
+import crypto from 'node:crypto'
+import fs from 'node:fs'
+import path from 'node:path'
+import { readBody, send } from '../infra/http.mjs'
+import { renderDeckToPptx } from '../tools/domains/pptx-export.mjs'
+
+const PPTX_MIME = 'application/vnd.openxmlformats-officedocument.presentationml.presentation'
+const MAX_UPLOAD_BYTES = 128 * 1024 * 1024
+const MAX_RESULT_BYTES = 2 * 1024 * 1024
+const RESULT_TTL_MS = 10 * 60 * 1000
+const FILE_TTL_MS = 60 * 60 * 1000
+const ID_RE = /^[a-f0-9]{16,64}$/
+
+function readRawBody(req, limit) {
+  return new Promise((resolve, reject) => {
+    let size = 0
+    let settled = false
+    const chunks = []
+    const fail = (error) => {
+      if (settled) return
+      settled = true
+      reject(error)
+    }
+    req.on('data', (chunk) => {
+      if (settled) return
+      size += chunk.length
+      if (size > limit) {
+        const error = new Error('pptx 文件超过大小上限')
+        error.code = 'BODY_TOO_LARGE'
+        fail(error)
+        req.resume()
+        return
+      }
+      chunks.push(chunk)
+    })
+    req.on('end', () => {
+      if (settled) return
+      settled = true
+      resolve(Buffer.concat(chunks))
+    })
+    req.on('error', fail)
+    req.on('close', () => {
+      if (!req.readableEnded) fail(new Error('客户端在上传完成前断开'))
+    })
+  })
+}
+
+function safeName(value) {
+  let name = String(value || 'import.pptx')
+  try { name = decodeURIComponent(name) } catch { /* 保留原值 */ }
+  name = path.basename(name).replace(/[\\/:*?"<>|]/g, '_').slice(0, 120)
+  return name.toLowerCase().endsWith('.pptx') ? name : `${name || 'import'}.pptx`
+}
+
+function jsonResult(body) {
+  return {
+    done: true,
+    ok: !!body.ok,
+    error: body.error ? String(body.error).slice(0, 2000) : '',
+    summary: body.summary && typeof body.summary === 'object' ? body.summary : null,
+    ts: Date.now(),
+  }
+}
+
+export function createImportRoutes({ basePath, importDir, store }) {
+  const prefix = String(basePath || '').replace(/\/+$/, '')
+  if (!importDir) throw new Error('createImportRoutes 需要 importDir')
+  fs.mkdirSync(importDir, { recursive: true })
+  const sourceRecord = path.join(importDir, 'last-open.json')
+
+  /* 启动时清掉上一个进程遗留的临时文件（失败不影响服务启动）。 */
+  try {
+    const now = Date.now()
+    for (const entry of fs.readdirSync(importDir)) {
+      if (!entry.endsWith('.pptx')) continue
+      const file = path.join(importDir, entry)
+      try {
+        if (now - fs.statSync(file).mtimeMs > FILE_TTL_MS) fs.rmSync(file, { force: true })
+      } catch { /* 单个文件清理失败忽略 */ }
+    }
+  } catch { /* 目录不可读忽略 */ }
+
+  const results = new Map()
+  let saving = false
+  const timer = setInterval(() => {
+    const now = Date.now()
+    for (const [key, value] of results) {
+      if (now - value.ts > RESULT_TTL_MS) results.delete(key)
+    }
+  }, 60_000)
+  timer.unref?.()
+
+  return async function importRoutes(req, res, u) {
+    const pathname = u.pathname
+    if (prefix && pathname !== prefix && !pathname.startsWith(prefix + '/')) return false
+    const sub = prefix ? pathname.slice(prefix.length) : pathname
+
+    /* 原始字节上传 */
+    if (sub === '/import-file' && req.method === 'POST') {
+      let body
+      try {
+        body = await readRawBody(req, MAX_UPLOAD_BYTES)
+      } catch (error) {
+        const status = error?.code === 'BODY_TOO_LARGE' ? 413 : 400
+        send(req, res, status, { error: String(error.message || error) })
+        return true
+      }
+      if (!body.length) {
+        send(req, res, 400, { error: '上传内容为空' })
+        return true
+      }
+      /* ZIP 魔数：pptx 必须是 OOXML 包，提前拦住误传的图片/JSON。 */
+      if (body[0] !== 0x50 || body[1] !== 0x4b) {
+        send(req, res, 400, { error: '不是有效的 PPTX 文件（缺少 ZIP/OOXML 头）' })
+        return true
+      }
+      const id = crypto.randomBytes(12).toString('hex')
+      const name = safeName(req.headers['x-file-name'])
+      const file = path.join(importDir, `${id}.pptx`)
+      try {
+        await fs.promises.writeFile(file, body)
+      } catch (error) {
+        send(req, res, 500, { error: '写入临时文件失败：' + String(error.message || error) })
+        return true
+      }
+      /* 记录源文件路径：编辑器“保存回原文件”按钮据此写回。 */
+      const sourceHeader = req.headers['x-source-path']
+      if (sourceHeader) {
+        try {
+          const sourcePath = decodeURIComponent(String(sourceHeader))
+          if (sourcePath) {
+            fs.writeFileSync(sourceRecord, JSON.stringify({ path: sourcePath, name, ts: Date.now() }))
+          }
+        } catch { /* 源路径只影响保存按钮，不阻塞导入 */ }
+      }
+      send(req, res, 200, {
+        ok: true,
+        id,
+        name,
+        bytes: body.length,
+        url: `${prefix}/import-file/${id}`,
+      })
+      return true
+    }
+
+    /* 编辑器取回原始字节 */
+    if (sub.startsWith('/import-file/') && (req.method === 'GET' || req.method === 'HEAD')) {
+      const id = sub.slice('/import-file/'.length)
+      if (!ID_RE.test(id)) {
+        send(req, res, 404, { error: '导入文件不存在' })
+        return true
+      }
+      const file = path.join(importDir, `${id}.pptx`)
+      let data
+      try {
+        data = fs.readFileSync(file)
+      } catch {
+        send(req, res, 404, { error: '导入文件不存在或已清理' })
+        return true
+      }
+      res.writeHead(200, {
+        'content-type': PPTX_MIME,
+        'content-length': data.length,
+        'cache-control': 'no-store',
+        'x-content-type-options': 'nosniff',
+        'referrer-policy': 'no-referrer',
+      })
+      res.end(req.method === 'HEAD' ? undefined : data)
+      return true
+    }
+
+    /* 编辑器回传导入结果 */
+    if (sub === '/import-result' && req.method === 'POST') {
+      let body
+      try {
+        body = await readBody(req, MAX_RESULT_BYTES)
+      } catch (error) {
+        send(req, res, error?.code === 'BODY_TOO_LARGE' ? 413 : 400, { error: String(error.message || error) })
+        return true
+      }
+      if (!body || typeof body.req !== 'string' || !body.req) {
+        send(req, res, 400, { error: '缺少 import req' })
+        return true
+      }
+      results.set(body.req, jsonResult(body))
+      if (body.id && ID_RE.test(String(body.id))) {
+        try { fs.rmSync(path.join(importDir, `${body.id}.pptx`), { force: true }) } catch { /* 忽略 */ }
+      }
+      send(req, res, 200, { ok: true })
+      return true
+    }
+
+    /* MCP 工具轮询结果 */
+    if (sub === '/import-result' && (req.method === 'GET' || req.method === 'HEAD')) {
+      const reqId = u.searchParams.get('req') || ''
+      const result = reqId ? results.get(reqId) : null
+      send(req, res, 200, result || { done: false })
+      return true
+    }
+
+    /* 编辑器“保存回原文件”：把当前 deck 导出到导入时记录的源路径，先备份。 */
+    if (sub === '/save-pptx' && req.method === 'POST') {
+      if (!store) {
+        send(req, res, 503, { error: 'store 未就绪' })
+        return true
+      }
+      if (saving) {
+        send(req, res, 409, { error: '已有保存任务在进行中' })
+        return true
+      }
+      let record = null
+      try { record = JSON.parse(fs.readFileSync(sourceRecord, 'utf8')) } catch { /* 没有记录 */ }
+      const target = String(record?.path || '')
+      if (!target || !/\.pptx$/i.test(target)) {
+        send(req, res, 409, { error: '当前 deck 不是从本机 .pptx 打开的；请让 agent 用 ppt_export_pptx 另存' })
+        return true
+      }
+      const deck = store.get().deck
+      if (!deck || !Array.isArray(deck.slides) || !deck.slides.length) {
+        send(req, res, 409, { error: '当前 deck 没有幻灯片' })
+        return true
+      }
+
+      saving = true
+      try {
+        const host = req.headers.host || `127.0.0.1:39311`
+        const { buffer, stats } = await renderDeckToPptx(deck, {
+          assetBase: `http://${host}${prefix}`,
+          includeNotes: true,
+        })
+        const stamp = new Date().toISOString().replace(/[-:]/g, '').replace(/\..+$/, '')
+        const backup = target.replace(/\.pptx$/i, `.bak-${stamp}.pptx`)
+        if (fs.existsSync(target)) fs.copyFileSync(target, backup)
+        fs.writeFileSync(target, buffer)
+        send(req, res, 200, { ok: true, path: target, backup, bytes: buffer.length, stats })
+      } catch (error) {
+        send(req, res, 500, { error: '保存回原文件失败（可能被 PowerPoint 占用）：' + String(error.message || error) })
+      } finally {
+        saving = false
+      }
+      return true
+    }
+
+    return false
+  }
+}

package/server/routes/mcp.mjs

@@ -0,0 +1,17 @@
+/** MCP 端点路由：协议细节由 server/mcp/handler 处理。 */
+import { send } from '../http-utils.mjs'
+
+export function createMcpRoutes({ mcpHandler, getMcpHandler } = {}) {
+  return [
+    async (req, res, u) => {
+      if (u.pathname !== '/mcp') return false
+      const handler = typeof getMcpHandler === 'function' ? getMcpHandler() : mcpHandler
+      if (!handler) {
+        send(req, res, 503, { ok: false, error: 'MCP tools not ready' })
+        return true
+      }
+      await handler(req, res)
+      return true
+    },
+  ]
+}

package/server/runtime/recovery.mjs

@@ -0,0 +1,9 @@
+/** 崩溃恢复：通用 replay 由 DocumentSession.recover 提供，本文件只注入 PPT 的 VIEW_OPS。 */
+import { VIEW_OPS } from '../constants.mjs'
+
+export async function replayPending({ store, jsonP, applyOp }) {
+  return store.recover({
+    apply: (cmd) => applyOp(jsonP, cmd),
+    isViewOp: (cmd) => VIEW_OPS.has(cmd.op),
+  })
+}

package/server/runtime/watch.mjs

@@ -0,0 +1,17 @@
+/** 兼容层：长轮询的通用实现位于 @capyclaw/document-workbench/session。 */
+import { watchSession } from '@capyclaw/document-workbench/session'
+import { getTuning } from '../tuning.mjs'
+
+export function watchDoc(store, seq0, shot0, ui0, timeoutS, aborted) {
+  const tuning = getTuning()
+  return watchSession(store, {
+    seq: seq0,
+    shot: shot0,
+    ui: ui0,
+    timeoutS,
+    isAborted: aborted,
+    pollMs: tuning.watchPollMs,
+    timeoutSec: tuning.watchTimeoutSec,
+    maxTimeoutSec: tuning.watchTimeoutMaxSec,
+  })
+}

package/server/shared/SHARED_MANIFEST.json

@@ -0,0 +1,47 @@
+{
+  "version": "0.1.0",
+  "packages": {
+    "service-host": {
+      "package": "dsh-service-host",
+      "version": "0.1.0",
+      "apiVersion": "1.0.0",
+      "sha256": "232b9140d1ba60435999df02a743d944b2b9c81bc5d16dafd3ebc7d24437d7bf"
+    },
+    "tool-host": {
+      "package": "dsh-tool-host",
+      "version": "0.1.0",
+      "apiVersion": "1.0.0",
+      "sha256": "4c8b34977fba79facb498807b844d65993b56267db945e8d157c11e93dd78a48"
+    },
+    "state-service": {
+      "package": "dsh-state-service",
+      "version": "0.1.0",
+      "apiVersion": "1.0.0",
+      "sha256": "725607c3ede320e4fb8cedc3068bfe1bdb0eb68ce65f8d071e95259195161bc4"
+    },
+    "asset-service": {
+      "package": "dsh-asset-service",
+      "version": "0.1.0",
+      "apiVersion": "1.0.0",
+      "sha256": "2bb1dd432188e518adedd0faf8caa1f611aa7c3830fc030cf4733541762a8bf5"
+    },
+    "editor-host": {
+      "package": "dsh-editor-host",
+      "version": "0.1.0",
+      "apiVersion": "1.0.0",
+      "sha256": "a2cdda07cdb61ee258dd20fffd489d93fbf88e891cd2c5f5d9f434544ca8cfea"
+    }
+  },
+  "kit": {
+    "tuning.mjs": "c7f3feaf2da1e8ab9e2e47ca1f12a6796cc01e0be46c431031fcedfa2336e870",
+    "service/api.mjs": "94fa4ced06ec0abe56071abe7cde0316765508995376b323b2734214e2520762",
+    "service/http.mjs": "a80346c6fabf893cecff89507a3575b6f342a4db77a375013f1f03f1f1439af3",
+    "service/mcp-http.mjs": "a45fa4ab71e5ee385203fe33893c76e1bc34807d9b1f251bb8df4bd6ee86f444",
+    "tools/validate.mjs": "ed7bc55d4fcbab406f883d54f587e44cf24f06be6e75456bdcbdd1b2cf9739be",
+    "editor/lease.mjs": "5c4e9cb37079b6fd8541deb208a780e144f394befafdb027fb589dc715ef3374",
+    "util/fs-lock.mjs": "0eb754f067466ccf90505242e80e4a4de248db5aaa7040e825efa66da386105a"
+  },
+  "pkgRoot": {
+    "dsh-service-host/tuning.mjs": "51d4145d8a94b0adea989924fd65042fc372e343a47fdceeac97d418e9766347"
+  }
+}

package/server/shared/asset-service.mjs

@@ -0,0 +1,217 @@
+/**
+ * dsh-asset-service —— 通用对象资产仓库。
+ *
+ * 功能插件不再各自实现 `/assets/<sha256>`、base64 上传、content-type 与缓存头。
+ * 资产按 sha256 去重，url 为 `/assets/<id>`。
+ *
+ * 两种后端：
+ *   - workspace：storeClient（ctx.workspace 的 scoped client），资产归当前 work；
+ *   - file：本地目录，适合无 workspace 的独立运行/测试。
+ */
+import crypto from 'node:crypto'
+import fs from 'node:fs'
+import path from 'node:path'
+import { send, readBody } from './kit/service/http.mjs'
+import { createServiceApi } from './kit/service/api.mjs'
+
+function sha256(buffer) {
+  return crypto.createHash('sha256').update(buffer).digest('hex')
+}
+
+const ASSET_ID_RE = /^[a-f0-9]{64}$/
+
+function validId(id) {
+  return ASSET_ID_RE.test(String(id || ''))
+}
+
+function normalizeBuffer(value) {
+  if (Buffer.isBuffer(value)) return value
+  if (value instanceof Uint8Array) return Buffer.from(value)
+  throw new Error('asset: 数据必须是 Buffer/Uint8Array')
+}
+
+/** 基于 ctx.workspace 的 scoped WorkspaceClient。 */
+export function createWorkspaceAssetStore({ storeClient, workId = 'main' } = {}) {
+  if (!storeClient || typeof storeClient.put !== 'function') throw new Error('createWorkspaceAssetStore 需要 storeClient')
+  return {
+    kind: 'workspace',
+    async put(value, contentType = 'application/octet-stream') {
+      const buffer = normalizeBuffer(value)
+      const id = sha256(buffer)
+      const key = `assets/${id}`
+      storeClient.put(workId, key, buffer, { contentType })
+      return { id, key, url: `/assets/${id}`, size: buffer.length, contentType }
+    },
+    get(id) {
+      if (!validId(id)) return null
+      const key = `assets/${id}`
+      try {
+        const data = storeClient.get(workId, key)
+        if (!data) return null
+        const meta = storeClient.list(workId).find((item) => item.key === key)
+        return { data, contentType: meta?.contentType || 'application/octet-stream' }
+      } catch {
+        /* 缺失/权限错误按 404 处理，不能把 500 泄漏给资产路由。 */
+        return null
+      }
+    },
+    has(id) {
+      if (!validId(id)) return false
+      try { return !!storeClient.get(workId, `assets/${id}`) } catch { return false }
+    },
+  }
+}
+
+/** 本地目录后端：<dir>/<sha256> + <dir>/<sha256>.meta.json。 */
+export function createFileAssetStore({ dir } = {}) {
+  if (!dir) throw new Error('createFileAssetStore 需要 dir')
+  fs.mkdirSync(dir, { recursive: true })
+  return {
+    kind: 'file',
+    async put(value, contentType = 'application/octet-stream') {
+      const buffer = normalizeBuffer(value)
+      const id = sha256(buffer)
+      const file = path.join(dir, id)
+      const metaFile = file + '.meta.json'
+      const existingOk = (() => {
+        try { return fs.statSync(file).size === buffer.length } catch { return false }
+      })()
+      if (!existingOk) {
+        const tmp = `${file}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`
+        fs.writeFileSync(tmp, buffer)
+        fs.renameSync(tmp, file)
+      }
+      const metaTmp = `${metaFile}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`
+      fs.writeFileSync(metaTmp, JSON.stringify({ contentType, size: buffer.length }))
+      fs.renameSync(metaTmp, metaFile)
+      return { id, key: id, url: `/assets/${id}`, size: buffer.length, contentType }
+    },
+    get(id) {
+      if (!validId(id)) return null
+      const file = path.join(dir, path.basename(String(id)))
+      try {
+        const data = fs.readFileSync(file)
+        /* 内容寻址仓库必须复核 hash：截断/篡改的对象不能静默返回。 */
+        if (sha256(data) !== id) {
+          console.error(`[asset-service] 对象校验失败，拒绝返回: ${id}`)
+          return null
+        }
+        let contentType = 'application/octet-stream'
+        try { contentType = JSON.parse(fs.readFileSync(file + '.meta.json', 'utf8')).contentType || contentType } catch { /* 默认 */ }
+        return { data, contentType }
+      } catch {
+        return null
+      }
+    },
+    has(id) {
+      if (!validId(id)) return false
+      try { return fs.existsSync(path.join(dir, path.basename(String(id)))) } catch { return false }
+    },
+  }
+}
+
+/** 防止 text/html / svg 在 loopback 同源执行脚本；图片仍按原 MIME 内联。 */
+function safeContentType(type) {
+  const base = String(type || '').split(';')[0].trim().toLowerCase() || 'application/octet-stream'
+  if (base === 'text/html' || base === 'application/xhtml+xml' || base === 'image/svg+xml') {
+    return 'text/plain; charset=utf-8'
+  }
+  return base
+}
+
+/**
+ * service-host 兼容的资产路由。
+ * GET/HEAD `/assets/<id>`（同时兼容 `<basePath>/assets/<id>`）；
+ * POST `/assets` 或 `<basePath>/assets`（JSON: { data: base64, contentType }）。
+ */
+export function createAssetRoutes({ assetStore, basePath = '', maxUploadBytes = 10 * 1024 * 1024 } = {}) {
+  const prefix = basePath === '/' ? '' : String(basePath || '').replace(/\/+$/, '')
+  const getPrefixes = ['/assets/', prefix ? `${prefix}/assets/` : null].filter(Boolean)
+  const postPaths = new Set(['/assets', prefix ? `${prefix}/assets` : null].filter(Boolean))
+  return async function assetRoutes(req, res, u) {
+    const p = u.pathname
+    if (req.method === 'GET' || req.method === 'HEAD') {
+      const getPrefix = getPrefixes.find((candidate) => p.startsWith(candidate))
+      if (getPrefix) {
+        if (!assetStore) { send(req, res, 404, { error: 'asset store unavailable' }); return true }
+        const id = decodeURIComponent(p.slice(getPrefix.length))
+        if (!validId(id)) { send(req, res, 404, { error: 'asset not found' }); return true }
+        const asset = assetStore.get(id)
+        if (!asset) { send(req, res, 404, { error: 'asset not found' }); return true }
+        res.writeHead(200, {
+          'content-type': safeContentType(asset.contentType),
+          'content-length': asset.data.length,
+          'cache-control': 'public, max-age=31536000, immutable',
+          'x-content-type-options': 'nosniff',
+          'referrer-policy': 'no-referrer',
+        })
+        res.end(req.method === 'HEAD' ? undefined : asset.data)
+        return true
+      }
+    }
+    if (postPaths.has(p) && req.method === 'POST') {
+      if (!assetStore) { send(req, res, 503, { error: 'asset store unavailable' }); return true }
+      let body
+      try { body = await readBody(req, maxUploadBytes) } catch (error) {
+        const status = error?.code === 'BODY_TOO_LARGE' ? 413 : 400
+        send(req, res, status, { error: String(error.message || error) })
+        return true
+      }
+      if (!body || typeof body.data !== 'string' || !body.data) {
+        send(req, res, 400, { error: '缺少图片数据' })
+        return true
+      }
+      const buffer = Buffer.from(body.data, 'base64')
+      if (!buffer.length) { send(req, res, 400, { error: '图片数据为空' }); return true }
+      const asset = await assetStore.put(buffer, body.contentType || 'application/octet-stream')
+      send(req, res, 200, { ok: true, ...asset })
+      return true
+    }
+    return false
+  }
+}
+
+export function createAssetHost(config = {}) {
+  const defaultStore = config.storeClient
+    ? createWorkspaceAssetStore({ storeClient: config.storeClient, workId: config.workId })
+    : config.dir
+      ? createFileAssetStore({ dir: config.dir })
+      : null
+
+  return {
+    api: createServiceApi('assets', '1.0.0', ['workspace-store', 'file-store', 'routes', 'sha256', 'mount']),
+    version: '0.1.0',
+    createStore: createWorkspaceAssetStore,
+    createFileStore: createFileAssetStore,
+    routes: createAssetRoutes,
+    store: defaultStore,
+    /**
+     * 每个 service-host app 只挂一次资产路由，避免多个插件重复争抢 /assets。
+     * @param {object} hostApp createServiceApp() 返回值
+     * @param {{ store?: object, basePath?: string }} options
+     */
+    mount(hostApp, { store = defaultStore, basePath = '' } = {}) {
+      if (!hostApp || typeof hostApp.use !== 'function') throw new Error('assets.mount 需要 service-host app')
+      if (!store) throw new Error('assets.mount: 没有可用 store')
+      if (hostApp.__dshAssetsMounted) return () => {}
+      hostApp.__dshAssetsMounted = true
+      const unuse = hostApp.use(createAssetRoutes({ assetStore: store, basePath }))
+      let disposed = false
+      return () => {
+        if (disposed) return
+        disposed = true
+        /* 真正卸载路由；否则热重载后旧 store 仍会抢答 /assets。 */
+        if (typeof unuse === 'function') unuse()
+        hostApp.__dshAssetsMounted = false
+      }
+    },
+    async put(value, contentType) {
+      if (!defaultStore) throw new Error('asset-service: 未配置 storeClient/dir')
+      return defaultStore.put(value, contentType)
+    },
+    get(id) {
+      if (!defaultStore) throw new Error('asset-service: 未配置 storeClient/dir')
+      return defaultStore.get(id)
+    },
+  }
+}