@chenguangyao/devflow-kit 0.1.43

package/src/providers/lifecycle.js

@@ -0,0 +1,135 @@
+'use strict';
+const fs = require('fs/promises');
+const fsSync = require('fs');
+const path = require('path');
+const log = require('../utils/log.js');
+const paths = require('../core/paths.js');
+const loader = require('./loader.js');
+const { AuthExpiredError } = require('./base.js');
+
+/**
+ * Provider lifecycle helpers used by callers (devflow ingest / deliver / sync / ...).
+ *
+ * Provides:
+ *   loadOrAuth({ name, type, interactive })  → provider, auto-running login if needed
+ *   withAutoRetry(provider, fn)              → run fn(); on AuthExpiredError, login + retry once
+ *   securityCheck(root)                      → audit credential files & config
+ *
+ * Notes:
+ *   - We never log token contents.
+ *   - We chmod 600 every providers.json after writing.
+ *   - We prefer ${env:NAME} substitution to plain-text values; securityCheck warns
+ *     when a string field contains anything that looks like a token literal.
+ */
+
+async function loadOrAuth(root, opts = {}) {
+  const { name, type, interactive = isTty() } = opts;
+  let provider;
+  try {
+    provider = await loader.load(root, { name, type });
+  } catch (e) {
+    if (e.code === 'PROVIDER_NOT_INSTALLED' && interactive) {
+      log.warn(e.message);
+      throw e; // caller decides whether to invoke `devflow provider add`
+    }
+    throw e;
+  }
+  const v = await provider.validate();
+  if (v.ok) return provider;
+
+  if (v.needsLogin && typeof provider.login === 'function') {
+    log.warn(`provider ${provider.name}: ${v.reason || 'auth required'} — running login`);
+    await provider.login({ force: false, interactive });
+    const v2 = await provider.validate();
+    if (!v2.ok) throw new Error(`${provider.name}: still not ok after login: ${v2.reason}`);
+    return provider;
+  }
+  throw new Error(`${provider.name}: not usable: ${v.reason || 'unknown'}`);
+}
+
+async function withAutoRetry(provider, fn, { interactive = isTty() } = {}) {
+  try {
+    return await fn(provider);
+  } catch (e) {
+    if (e instanceof AuthExpiredError && typeof provider.login === 'function') {
+      log.warn(`${provider.name}: ${e.message} — re-login + retry`);
+      await provider.login({ force: true, interactive });
+      return await fn(provider);
+    }
+    throw e;
+  }
+}
+
+/**
+ * Audit credential files + provider configs.
+ *
+ * Returns: [{ severity: 'info|warn|error', file, message }]
+ */
+async function securityCheck(root) {
+  const findings = [];
+  const files = [paths.projectProvidersFile(root), paths.userProvidersFile()];
+  for (const file of files) {
+    if (!fsSync.existsSync(file)) continue;
+    try {
+      const stat = await fs.stat(file);
+      const mode = stat.mode & 0o777;
+      if (mode & 0o077) {
+        findings.push({
+          severity: 'warn',
+          file,
+          message: `permissive mode 0${mode.toString(8)} — should be 0600`,
+          fix: 'chmod600',
+        });
+      }
+    } catch { /* ignore */ }
+    try {
+      const text = await fs.readFile(file, 'utf8');
+      const json = JSON.parse(text);
+      for (const name of Object.keys(json)) {
+        const cfg = json[name].config || {};
+        const issues = scanConfigForSecrets(cfg, []);
+        for (const issue of issues) {
+          findings.push({
+            severity: 'warn',
+            file,
+            message: `${name}.config.${issue.path} looks like a plaintext secret — use \${env:VAR}`,
+          });
+        }
+      }
+    } catch { /* invalid JSON handled elsewhere */ }
+  }
+  return findings;
+}
+
+const SECRET_KEYS = /(token|secret|password|pwd|key|auth|cookie|credential|passcode)/i;
+
+function scanConfigForSecrets(obj, parentPath) {
+  const out = [];
+  if (!obj || typeof obj !== 'object') return out;
+  for (const k of Object.keys(obj)) {
+    const v = obj[k];
+    const here = [...parentPath, k];
+    if (v && typeof v === 'object') {
+      out.push(...scanConfigForSecrets(v, here));
+      continue;
+    }
+    if (typeof v !== 'string' || v === '') continue;
+    if (!SECRET_KEYS.test(k)) continue;
+    if (v.startsWith('${env:')) continue;        // OK — env-substituted
+    if (v.length < 8) continue;                  // not really a secret
+    out.push({ path: here.join('.') });
+  }
+  return out;
+}
+
+async function applySecureMode(file) {
+  try { await fs.chmod(file, 0o600); } catch { /* ignore on win */ }
+}
+
+function isTty() {
+  return !!(process.stdout && process.stdout.isTTY);
+}
+
+module.exports = {
+  loadOrAuth, withAutoRetry, securityCheck, applySecureMode, scanConfigForSecrets,
+};

package/src/providers/loader.js

@@ -0,0 +1,132 @@
+'use strict';
+const fs = require('fs/promises');
+const fsSync = require('fs');
+const path = require('path');
+const paths = require('../core/paths.js');
+const local = require('./local.js');
+
+/**
+ * Provider registry & loader.
+ *
+ * Resolution order for a given type:
+ *   1. project-level providers.json
+ *   2. user-level providers.json (~/.devflow/providers.json)
+ *   3. built-in local fallback
+ *
+ * Each entry shape:
+ *   {
+ *     "intake.confluence": {
+ *       "type": "intake",
+ *       "driver": "confluence",
+ *       "config": { "baseUrl": "...", "token": "...", "user": "..." }
+ *     }
+ *   }
+ */
+
+const BUILTIN_LOCALS = {
+  intake: () => new local.LocalIntakeProvider(),
+  issue:  () => new local.LocalIssueProvider(),
+  kb:     () => new local.LocalKbProvider(),
+  notify: () => new local.LocalNotifyProvider(),
+  ci:     () => new local.LocalCiProvider(),
+  vcs:    () => new local.LocalVcsProvider(),
+};
+
+async function readJson(file) {
+  if (!fsSync.existsSync(file)) return {};
+  try {
+    return JSON.parse(await fs.readFile(file, 'utf8'));
+  } catch (e) {
+    return {};
+  }
+}
+
+async function readAllConfigs(root) {
+  const project = await readJson(paths.projectProvidersFile(root));
+  const legacyUser = paths.legacyUserProvidersFile ? await readJson(paths.legacyUserProvidersFile()) : {};
+  const user = { ...legacyUser, ...(await readJson(paths.userProvidersFile())) };
+  return { project, user };
+}
+
+function resolveValue(v) {
+  if (typeof v !== 'string') return v;
+  return v.replace(/\$\{env:([A-Z0-9_]+)\}/g, (_, k) => process.env[k] || '');
+}
+
+function resolveConfigEnvs(cfg) {
+  if (!cfg || typeof cfg !== 'object') return cfg;
+  const out = Array.isArray(cfg) ? [] : {};
+  for (const k of Object.keys(cfg)) {
+    const v = cfg[k];
+    if (v && typeof v === 'object') out[k] = resolveConfigEnvs(v);
+    else out[k] = resolveValue(v);
+  }
+  return out;
+}
+
+async function listConfigured(root) {
+  const { project, user } = await readAllConfigs(root);
+  const merged = { ...user, ...project };
+  return Object.keys(merged).map((name) => ({
+    name,
+    type: merged[name].type,
+    driver: merged[name].driver,
+    source: project[name] ? 'project' : 'user',
+  }));
+}
+
+/**
+ * Load a provider instance.
+ *  - if name given, load that specific provider config and instantiate via driver
+ *  - if only type given, return first configured matching one, else local fallback
+ */
+async function load(root, { name, type } = {}) {
+  const { project, user } = await readAllConfigs(root);
+  const merged = { ...user, ...project };
+
+  let entry;
+  let resolvedName;
+  if (name) {
+    entry = merged[name];
+    if (!entry) throw new Error(`provider not configured: ${name}`);
+    resolvedName = name;
+  } else if (type) {
+    const found = Object.keys(merged).find((k) => merged[k].type === type);
+    if (found) {
+      entry = merged[found];
+      resolvedName = found;
+    }
+  }
+
+  if (!entry) {
+    if (!type) throw new Error('load() requires { name } or { type }');
+    const builtin = BUILTIN_LOCALS[type];
+    if (!builtin) throw new Error(`no built-in local provider for type: ${type}`);
+    return builtin();
+  }
+
+  const driver = entry.driver;
+  const cfg = resolveConfigEnvs(entry.config || {});
+
+  if (driver === 'local') {
+    return BUILTIN_LOCALS[entry.type]();
+  }
+
+  // Try to require an external driver: ./drivers/<type>-<driver>.js
+  const driverPath = path.join(__dirname, 'drivers', `${entry.type}-${driver}.js`);
+  if (fsSync.existsSync(driverPath)) {
+    const mod = require(driverPath);
+    return new mod.default({ name: resolvedName, type: entry.type, driver, config: cfg });
+  }
+
+  // Stub: not yet installed. Fail soft.
+  const err = new Error(
+    `provider driver not installed: ${entry.type}/${driver}\n` +
+    `  expected at: ${driverPath}\n` +
+    `  install with: devflow provider install ${driver}`
+  );
+  err.code = 'PROVIDER_NOT_INSTALLED';
+  throw err;
+}
+
+module.exports = { load, listConfigured, BUILTIN_LOCALS };

package/src/providers/local.js

@@ -0,0 +1,190 @@
+'use strict';
+const fs = require('fs/promises');
+const fsSync = require('fs');
+const path = require('path');
+const { execSync, spawnSync } = require('child_process');
+const { Provider } = require('./base.js');
+
+/**
+ * Local providers — zero network, zero dep. Default fallback for every type.
+ */
+
+class LocalIntakeProvider extends Provider {
+  constructor(opts = {}) {
+    super({ name: 'intake.local', type: 'intake', driver: 'local', config: opts });
+  }
+  supports(input) {
+    return typeof input === 'string' && (
+      input.startsWith('file://') ||
+      input.startsWith('/') ||
+      input.startsWith('./') ||
+      input.startsWith('../') ||
+      /\.(md|markdown|txt)$/i.test(input)
+    );
+  }
+  async fetch(input) {
+    let p = input;
+    if (input.startsWith('file://')) p = input.slice(7);
+    p = path.resolve(p);
+    const body = await fs.readFile(p, 'utf8');
+    const title = (body.match(/^#\s+(.+)$/m) || [, path.basename(p, path.extname(p))])[1];
+    return {
+      title: title.trim(),
+      body_md: body,
+      attachments: [],
+      source: { type: 'url', ref: 'file://' + p },
+    };
+  }
+  async search() { return []; }
+}
+
+class LocalIssueProvider extends Provider {
+  constructor(opts = {}) {
+    super({ name: 'issue.local', type: 'issue', driver: 'local', config: opts });
+  }
+  supports(input) {
+    // Best-effort: if input looks like JIRA-style PROJ-NUM, return false (let real provider handle).
+    // Local issue store is just .devflow/issues/<id>.md
+    if (typeof input !== 'string') return false;
+    const file = path.join('.devflow', 'issues', `${input}.md`);
+    return fsSync.existsSync(file);
+  }
+  async fetch(id) {
+    const file = path.join('.devflow', 'issues', `${id}.md`);
+    const body = await fs.readFile(file, 'utf8');
+    const title = (body.match(/^#\s+(.+)$/m) || [, id])[1];
+    return {
+      title: title.trim(),
+      body_md: body,
+      status: 'open',
+      labels: [],
+      source: { type: 'issue', ref: id },
+    };
+  }
+}
+
+class LocalKbProvider extends Provider {
+  constructor(opts = {}) {
+    super({ name: 'kb.local', type: 'kb', driver: 'local', config: opts });
+  }
+  async upload(file) {
+    return { uuid: 'local-' + path.basename(file), url: 'file://' + path.resolve(file) };
+  }
+  async update() {}
+  async delete() {}
+  async search() { return []; }
+}
+
+class LocalNotifyProvider extends Provider {
+  constructor(opts = {}) {
+    super({ name: 'notify.local', type: 'notify', driver: 'local', config: opts });
+  }
+  async send({ subject, body_md, links = [] }) {
+    process.stdout.write(`\n--- devflow notify (local) ---\n`);
+    process.stdout.write(`subject: ${subject}\n`);
+    if (links.length) {
+      process.stdout.write(`links:\n`);
+      for (const l of links) process.stdout.write(`  - ${l}\n`);
+    }
+    process.stdout.write(`\n${body_md}\n`);
+    process.stdout.write(`--- end ---\n\n`);
+    return { id: 'stdout' };
+  }
+}
+
+class LocalCiProvider extends Provider {
+  constructor(opts = {}) {
+    super({ name: 'ci.local', type: 'ci', driver: 'local', config: opts });
+  }
+  async trigger(job, params = {}) {
+    process.stdout.write(`[ci.local] would trigger job=${job} params=${JSON.stringify(params)}\n`);
+    return { runId: 'noop', url: null };
+  }
+  async status() { return { status: 'unknown', url: null }; }
+}
+
+class LocalVcsProvider extends Provider {
+  constructor(opts = {}) {
+    super({ name: 'vcs.local', type: 'vcs', driver: 'local', config: opts });
+  }
+  async pr({ title, body_md, base, head, draft = false }) {
+    // Resolve base: caller-provided value wins; otherwise autodetect from the
+    // current repo so commands that forget to pass --base still target the
+    // right branch (master vs main vs custom).
+    if (!base) {
+      try {
+        const autodetect = require('../core/autodetect.js');
+        base = autodetect.detectDefaultBranch(process.cwd()) || 'main';
+      } catch { base = 'main'; }
+    }
+
+    // Detect remote platform to prefer the right CLI.
+    let platform = 'unknown';
+    try {
+      const ad = require('../core/autodetect.js');
+      const remote = ad.parseRemote(ad.gitRemote(process.cwd()));
+      if (remote) {
+        const h = (remote.host || '').toLowerCase();
+        if (h.includes('github')) platform = 'github';
+        else if (h.includes('gitlab') || h.includes('code.')) platform = 'gitlab';
+      }
+    } catch { /* ignore */ }
+
+    // Try gh (GitHub CLI) — works for GitHub or GitHub Enterprise.
+    if (platform !== 'gitlab' && which('gh')) {
+      const args = ['pr', 'create', '--title', title, '--body', body_md, '--base', base];
+      if (head) args.push('--head', head);
+      if (draft) args.push('--draft');
+      const r = spawnSync('gh', args, { encoding: 'utf8' });
+      if (r.status === 0) return { url: (r.stdout || '').trim(), number: null };
+      // If gh is configured but failed, surface the error rather than silently
+      // falling through to glab (which might create a duplicate on wrong platform).
+      if (platform === 'github') {
+        throw new Error('gh pr create failed: ' + (r.stderr || r.stdout || ''));
+      }
+    }
+
+    // Try glab (GitLab CLI) — works for gitlab.com and self-hosted GitLab.
+    if (platform !== 'github' && which('glab')) {
+      const args = ['mr', 'create', '--title', title, '--description', body_md, '--target-branch', base, '--yes'];
+      if (head) args.push('--source-branch', head);
+      if (draft) args.push('--draft');
+      const r = spawnSync('glab', args, { encoding: 'utf8' });
+      if (r.status === 0) {
+        // glab outputs the MR URL on the last non-empty line.
+        const url = (r.stdout || '').trim().split('\n').filter(Boolean).pop() || null;
+        return { url, number: null };
+      }
+      if (platform === 'gitlab') {
+        throw new Error('glab mr create failed: ' + (r.stderr || r.stdout || ''));
+      }
+    }
+
+    // Final fallback: print the PR/MR draft so the user can create it manually.
+    process.stdout.write('\n--- devflow knowledge PR/MR draft (no CLI available) ---\n');
+    process.stdout.write(`title:  ${title}\nbase:   ${base}\nbranch: ${head || '(current)'}\n\n`);
+    process.stdout.write(body_md);
+    process.stdout.write('\n--- end ---\n');
+    process.stdout.write('\nTip: install `gh` (GitHub) or `glab` (GitLab) to automate PR/MR creation.\n');
+    process.stdout.write('     or run: devflow provider setup  to configure a vcs provider.\n\n');
+    return { url: null, number: null };
+  }
+}
+
+function which(cmd) {
+  try {
+    execSync(process.platform === 'win32' ? `where ${cmd}` : `command -v ${cmd}`, { stdio: 'ignore' });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+module.exports = {
+  LocalIntakeProvider,
+  LocalIssueProvider,
+  LocalKbProvider,
+  LocalNotifyProvider,
+  LocalCiProvider,
+  LocalVcsProvider,
+};