@cuebot/skill 1.0.5

package/src/notifier/index.js

@@ -0,0 +1,319 @@
+/**
+ * 通知推送模块
+ * 复用 OpenClaw 的消息发送能力 + 可靠队列
+ */
+
+import { execSync } from 'child_process';
+import { createLogger } from '../core/logger.js';
+import { enqueueNotification, startNotificationProcessor } from '../utils/notificationQueue.js';
+
+const logger = createLogger('Notifier');
+
+// 启动后台通知处理器
+let processorStarted = false;
+
+/**
+ * 启动可靠通知系统
+ * @param {string} chatId
+ */
+export function startReliableNotifier(chatId) {
+  if (processorStarted) return;
+  
+  startNotificationProcessor(chatId, async (notif) => {
+    try {
+      const success = await sendMessageDirect(notif.chat_id, formatNotification(notif));
+      return success;
+    } catch (error) {
+      await logger.error('Failed to send notification', error);
+      return false;
+    }
+  });
+  
+  processorStarted = true;
+  logger.info('Reliable notification processor started');
+}
+
+/**
+ * 格式化通知内容
+ * @param {Object} notif
+ * @returns {string}
+ */
+function formatNotification(notif) {
+  switch (notif.type) {
+    case 'research_complete':
+      return formatResearchComplete(notif.data);
+    case 'progress':
+      return formatProgress(notif.data);
+    case 'monitor_trigger':
+      return formatMonitorTrigger(notif.data);
+    default:
+      return JSON.stringify(notif.data);
+  }
+}
+
+/**
+ * 直接发送消息（不经过队列）
+ * @param {string} chatId
+ * @param {string} text
+ * @param {string} channel
+ * @returns {Promise<boolean>}
+ */
+async function sendMessageDirect(chatId, text, channel = 'feishu') {
+  try {
+    // 方法1: 使用 OpenClaw CLI
+    const result = execSync(
+      `openclaw message send --channel ${channel} --target "${chatId}" --text "${text}"`,
+      { encoding: 'utf-8', timeout: 10000 }
+    );
+    await logger.info(`Message sent to ${chatId}`);
+    return true;
+  } catch (error) {
+    await logger.error(`Failed to send message via OpenClaw`, error);
+    return false;
+  }
+}
+
+/**
+ * 发送消息（经过可靠队列）
+ * @param {string} chatId - 目标聊天 ID
+ * @param {string} text - 消息内容
+ * @param {string} channel - 渠道（默认 feishu）
+ * @returns {Promise<boolean>}
+ */
+export async function sendMessage(chatId, text, channel = 'feishu') {
+  // 先尝试直接发送
+  const directSuccess = await sendMessageDirect(chatId, text, channel);
+  
+  if (directSuccess) {
+    return true;
+  }
+  
+  // 如果失败，加入队列重试
+  await logger.info(`Direct send failed, enqueueing for retry: ${chatId}`);
+  
+  await enqueueNotification({
+    chatId,
+    type: 'generic',
+    data: { text, channel }
+  });
+  
+  return false;
+}
+
+/**
+ * 格式化研究完成通知
+ * @param {Object} data
+ * @returns {string}
+ */
+function formatResearchComplete(data) {
+  const { topic, taskId, reportUrl, duration, monitorSuggestions = [] } = data;
+  
+  const monitorText = monitorSuggestions.length > 0 
+    ? `\n🔔 建议监控：${monitorSuggestions.join('、')} 等 ${monitorSuggestions.length} 项\n💡 回复 Y 创建，N 跳过`
+    : '';
+  
+  return `✅ 研究完成：${topic}
+
+⏱️ 耗时：${duration} 分钟
+📝 任务ID：${taskId}
+
+🔗 ${reportUrl}
+${monitorText}`;
+}
+
+/**
+ * 发送研究完成通知
+ * @param {Object} options
+ * @param {string} options.chatId - 聊天 ID
+ * @param {string} options.taskId - 任务 ID
+ * @param {string} options.topic - 研究主题
+ * @param {string} options.reportUrl - 报告链接
+ * @param {number} options.duration - 耗时（分钟）
+ * @param {Array} options.monitorSuggestions - 监控建议
+ */
+export async function sendResearchCompleteNotification({
+  chatId,
+  taskId,
+  topic,
+  reportUrl,
+  duration,
+  monitorSuggestions = []
+}) {
+  // 启动可靠通知系统
+  startReliableNotifier(chatId);
+  
+  // 直接发送
+  const message = formatResearchComplete({ topic, taskId, reportUrl, duration, monitorSuggestions });
+  const success = await sendMessage(chatId, message);
+  
+  if (!success) {
+    // 如果直接发送失败，加入队列
+    await enqueueNotification({
+      chatId,
+      type: 'research_complete',
+      data: { topic, taskId, reportUrl, duration, monitorSuggestions }
+    });
+  }
+}
+
+/**
+ * 格式化进度通知
+ * @param {Object} data
+ * @returns {string}
+ */
+function formatProgress(data) {
+  const { topic, elapsedMinutes } = data;
+  
+  const stageDescriptions = {
+    0: '初始化研究任务',
+    10: '全网信息搜集与初步筛选',
+    30: '多源交叉验证与事实核查',
+    50: '深度分析与逻辑推理',
+    60: '报告生成与质量检查'
+  };
+  
+  const stage = Object.keys(stageDescriptions)
+    .map(Number)
+    .filter(t => elapsedMinutes >= t)
+    .pop() || 0;
+  
+  return `🔄 研究进度更新
+
+📋 主题：${topic}
+⏱️ 已用时：${elapsedMinutes} 分钟
+📊 当前阶段：${stageDescriptions[stage]}
+
+预计剩余时间：${60 - elapsedMinutes} 分钟`;
+}
+
+/**
+ * 发送进度更新通知
+ * @param {Object} options
+ * @param {string} options.chatId - 聊天 ID
+ * @param {string} options.taskId - 任务 ID
+ * @param {string} options.topic - 研究主题
+ * @param {string} options.progress - 进度描述
+ * @param {number} options.elapsedMinutes - 已耗时（分钟）
+ */
+export async function sendProgressNotification({
+  chatId,
+  taskId,
+  topic,
+  progress,
+  elapsedMinutes
+}) {
+  // 进度通知重要性较低，直接发送即可
+  const message = formatProgress({ topic, elapsedMinutes });
+  await sendMessage(chatId, message);
+}
+
+/**
+ * 格式化监控触发通知
+ * @param {Object} data
+ * @returns {string}
+ */
+function formatMonitorTrigger(data) {
+  const { monitorTitle, message, category = 'Data' } = data;
+  const timestamp = new Date().toLocaleString('zh-CN');
+  
+  return `🔔 监控触发提醒
+
+📊 监控：${monitorTitle}
+📂 分类：${category}
+⏰ 时间：${timestamp}
+
+${message}
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+💡 使用 /cn 查看最近通知`;
+}
+
+/**
+ * 发送监控触发通知
+ * @param {Object} options
+ * @param {string} options.chatId - 聊天 ID
+ * @param {string} options.monitorId - 监控 ID
+ * @param {string} options.monitorTitle - 监控标题
+ * @param {string} options.message - 触发消息
+ * @param {string} options.category - 分类
+ */
+export async function sendMonitorTriggerNotification({
+  chatId,
+  monitorId,
+  monitorTitle,
+  message,
+  category = 'Data'
+}) {
+  // 启动可靠通知系统
+  startReliableNotifier(chatId);
+  
+  // 直接发送
+  const notification = formatMonitorTrigger({ monitorTitle, message, category });
+  const success = await sendMessage(chatId, notification);
+  
+  if (!success) {
+    // 如果失败，加入队列（监控触发很重要）
+    await enqueueNotification({
+      chatId,
+      type: 'monitor_trigger',
+      data: { monitorId, monitorTitle, message, category }
+    });
+  }
+}
+
+/**
+ * 格式化监控建议通知
+ * @param {Object} data
+ * @returns {string}
+ */
+function formatMonitorSuggestion(data) {
+  const { topic, suggestions } = data;
+  
+  const suggestionsText = suggestions
+    .map((s, i) => `${i + 1}. ${s.title} - ${s.description}`)
+    .join('\n');
+  
+  return `💡 监控建议
+
+研究主题：${topic}
+
+基于研究报告，建议关注以下监控项：
+${suggestionsText}
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+回复 Y 确认创建这些监控项
+回复 N 跳过`;
+}
+
+/**
+ * 发送监控建议通知
+ * @param {Object} options
+ * @param {string} options.chatId - 聊天 ID
+ * @param {string} options.taskId - 任务 ID
+ * @param {string} options.topic - 研究主题
+ * @param {Array} options.suggestions - 监控建议列表
+ */
+export async function sendMonitorSuggestionNotification({
+  chatId,
+  taskId,
+  topic,
+  suggestions
+}) {
+  if (!suggestions || suggestions.length === 0) return;
+  
+  // 启动可靠通知系统
+  startReliableNotifier(chatId);
+  
+  // 直接发送
+  const message = formatMonitorSuggestion({ topic, suggestions });
+  const success = await sendMessage(chatId, message);
+  
+  if (!success) {
+    // 如果失败，加入队列
+    await enqueueNotification({
+      chatId,
+      type: 'monitor_suggestion',
+      data: { taskId, topic, suggestions }
+    });
+  }
+}

package/src/utils/dataSource.js

@@ -0,0 +1,140 @@
+/**
+ * 数据源管理器
+ * 支持多种搜索/数据获取方式
+ */
+
+import { createLogger } from '../core/logger.js';
+
+const logger = createLogger('DataSource');
+
+/**
+ * 数据源配置
+ */
+export const DATA_SOURCES = {
+  // 付费搜索 API
+  tavily: {
+    name: 'Tavily',
+    envKey: 'TAVILY_API_KEY',
+    priority: 1,
+    type: 'search'
+  },
+  qveris: {
+    name: 'QVeris',
+    envKey: 'QVERIS_API_KEY',
+    priority: 2,
+    type: 'search'
+  },
+  
+  // 免费股票数据 API
+  yahoo: {
+    name: 'Yahoo Finance',
+    envKey: null,  // 免费
+    priority: 10,
+    type: 'stock',
+    endpoints: {
+      quote: 'https://query1.finance.yahoo.com/v8/finance/chart/{symbol}',
+      search: 'https://finance.yahoo.com/quote/{symbol}'
+    }
+  },
+  google: {
+    name: 'Google Finance',
+    envKey: null,
+    priority: 11,
+    type: 'stock',
+    endpoints: {
+      quote: 'https://www.google.com/finance/quote/{symbol}:EX'
+    }
+  },
+  tencent: {
+    name: '腾讯财经',
+    envKey: null,
+    priority: 12,
+    type: 'stock',
+    endpoints: {
+      quote: 'https://qt.gtimg.cn/q={symbol}'
+    }
+  }
+};
+
+/**
+ * 获取可用的数据源
+ * @param {string} type - 数据类型 (search/stock)
+ * @returns {Array} 可用数据源列表
+ */
+export function getAvailableSources(type) {
+  const sources = [];
+  
+  for (const [key, config] of Object.entries(DATA_SOURCES)) {
+    if (config.type !== type) continue;
+    
+    // 检查是否有 API Key（如果是需要 key 的源）
+    if (config.envKey && !process.env[config.envKey]) {
+      continue;
+    }
+    
+    sources.push({ key, ...config });
+  }
+  
+  // 按优先级排序
+  sources.sort((a, b) => a.priority - b.priority);
+  
+  return sources;
+}
+
+/**
+ * 获取股票数据
+ * @param {string} symbol - 股票代码
+ * @returns {Promise<Object>}
+ */
+export async function fetchStockData(symbol) {
+  const sources = getAvailableSources('stock');
+  
+  for (const source of sources) {
+    try {
+      logger.info(`Trying ${source.name} for ${symbol}`);
+      const data = await fetchFromSource(source, symbol);
+      if (data) return data;
+    } catch (e) {
+      logger.warn(`${source.name} failed: ${e.message}`);
+    }
+  }
+  
+  return null;
+}
+
+async function fetchFromSource(source, symbol) {
+  const endpoint = source.endpoints?.quote;
+  if (!endpoint) return null;
+  
+  const url = endpoint.replace('{symbol}', symbol);
+  
+  const response = await fetch(url, {
+    headers: {
+      'User-Agent': 'Mozilla/5.0'
+    }
+  });
+  
+  if (!response.ok) return null;
+  
+  return await response.json();
+}
+
+/**
+ * 搜索新闻/信息
+ * @param {string} query - 查询
+ * @returns {Promise<Object>}
+ */
+export async function searchNews(query) {
+  const sources = getAvailableSources('search');
+  
+  for (const source of sources) {
+    try {
+      logger.info(`Searching with ${source.name}`);
+      // 实现各源搜索
+    } catch (e) {
+      logger.warn(`${source.name} failed`);
+    }
+  }
+  
+  return null;
+}

package/src/utils/envUtils.js

@@ -0,0 +1,243 @@
+/**
+ * 环境变量工具 - 安全版本 v1.0.4
+ * 仅使用 ~/.cuecue 目录，不写入共享配置文件
+ */
+
+import fs from 'fs-extra';
+import path from 'path';
+import { homedir } from 'os';
+import { createLogger } from '../core/logger.js';
+
+const logger = createLogger('EnvUtils');
+
+// ✅ 安全修复：仅使用技能自己的目录
+const CUECUE_DIR = path.join(homedir(), '.cuecue');
+const SECURE_ENV_FILE = path.join(CUECUE_DIR, '.env.secure');
+
+/**
+ * 确保目录存在并设置权限
+ * @param {string} dir - 目录路径
+ * @param {number} mode - 权限模式 (默认 0o700)
+ */
+async function ensureSecureDir(dir, mode = 0o700) {
+  await fs.ensureDir(dir);
+  
+  // 设置权限：仅所有者可读写执行
+  try {
+    await fs.chmod(dir, mode);
+  } catch (error) {
+    await logger.warn(`Failed to set directory permissions for ${dir}`, error);
+  }
+}
+
+/**
+ * 加载环境变量文件
+ * @returns {Promise<Map<string, string>>}
+ */
+export async function loadEnvFile() {
+  const env = new Map();
+  
+  try {
+    const content = await fs.readFile(SECURE_ENV_FILE, 'utf-8');
+    const lines = content.split('\n');
+    
+    for (const line of lines) {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith('#')) continue;
+      
+      const match = trimmed.match(/^export\s+(\w+)="([^"]*)"$/);
+      if (match) {
+        env.set(match[1], match[2]);
+      }
+    }
+  } catch (error) {
+    // 文件不存在，返回空 Map
+  }
+  
+  return env;
+}
+
+/**
+ * 保存环境变量到文件
+ * @param {Map<string, string>} env - 环境变量 Map
+ */
+export async function saveEnvFile(env) {
+  // ✅ 安全修复：确保目录存在并设置权限
+  await ensureSecureDir(CUECUE_DIR, 0o700);
+  
+  const lines = ['# Cue v1.0.4 - Secure Environment Variables', '# DO NOT SHARE THIS FILE'];
+  for (const [key, value] of env) {
+    lines.push(`export ${key}="${value}"`);
+  }
+  
+  await fs.writeFile(SECURE_ENV_FILE, lines.join('\n') + '\n');
+  
+  // ✅ 安全修复：设置文件权限 600 (仅所有者可读写)
+  try {
+    await fs.chmod(SECURE_ENV_FILE, 0o600);
+    await logger.info('Secure env file created with permissions 600');
+  } catch (error) {
+    await logger.warn('Failed to set secure file permissions', error);
+  }
+}
+
+/**
+ * 获取 API Key
+ * 优先从环境变量读取，其次从安全文件读取
+ * @param {string} keyName - Key 名称
+ * @returns {Promise<string|null>}
+ */
+export async function getApiKey(keyName) {
+  // 1. 首先检查 process.env (由 OpenClaw 注入)
+  if (process.env[keyName]) {
+    return process.env[keyName];
+  }
+  
+  // 2. 然后检查技能自己的安全文件
+  const env = await loadEnvFile();
+  return env.get(keyName) || null;
+}
+
+/**
+ * 设置 API Key
+ * 仅保存到技能自己的目录，不写入共享配置文件
+ * @param {string} keyName - Key 名称
+ * @param {string} value - Key 值
+ */
+export async function setApiKey(keyName, value) {
+  // 更新当前进程环境变量
+  process.env[keyName] = value;
+  
+  // ✅ 安全修复：仅保存到 ~/.cuecue/.env.secure
+  const env = await loadEnvFile();
+  env.set(keyName, value);
+  await saveEnvFile(env);
+  
+  await logger.info("API Key saved to secure storage");
+}
+
+/**
+ * 检测 API Key 对应的服务
+ * @param {string} apiKey - API Key
+ * @returns {{service: string, name: string, url: string}|null}
+ */
+export function detectServiceFromKey(apiKey) {
+  if (!apiKey || apiKey.length < 10) {
+    return null;
+  }
+  
+  // Tavily: tvly-xxxxx
+  if (apiKey.startsWith('tvly-')) {
+    return {
+      service: 'tavily',
+      name: 'Tavily',
+      url: 'https://tavily.com'
+    };
+  }
+  
+  // CueCue: skb... 开头
+  if (apiKey.startsWith('skb')) {
+    return {
+      service: 'cuecue',
+      name: 'CueCue',
+      url: 'https://cuecue.cn'
+    };
+  }
+  
+  // 根据长度区分 CueCue 和 QVeris
+  if (apiKey.startsWith('sk-')) {
+    if (apiKey.length > 40) {
+      return {
+        service: 'qveris',
+        name: 'QVeris',
+        url: 'https://qveris.ai'
+      };
+    } else {
+      return {
+        service: 'cuecue',
+        name: 'CueCue',
+        url: 'https://cuecue.cn'
+      };
+    }
+  }
+  
+  return null;
+}
+
+/**
+ * 获取所有 API Key 状态
+ * @returns {Promise<Array<{name: string, key: string, configured: boolean, masked: string}>>}
+ */
+export async function getApiKeyStatus() {
+  const keys = [
+    { name: 'CueCue', key: 'CUECUE_API_KEY' },
+    { name: 'Tavily', key: 'TAVILY_API_KEY' },
+    { name: 'QVeris', key: 'QVERIS_API_KEY' }
+  ];
+  
+  const results = [];
+  for (const { name, key } of keys) {
+    const value = await getApiKey(key);
+    const masked = value 
+      ? (value.length > 16 
+        ? `${value.slice(0, 4)}****${value.slice(-4)}`
+        : `${value.slice(0, 2)}****`)
+      : null;
+    
+    results.push({
+      name,
+      key,
+      configured: !!value,
+      masked
+    });
+  }
+  
+  return results;
+}
+
+/**
+ * 获取当前渠道配置
+ * @returns {{channel: string, chatId: string}}
+ */
+export function getChannelConfig() {
+  return {
+    channel: process.env.OPENCLAW_CHANNEL || 'feishu',
+    chatId: process.env.CHAT_ID || process.env.FEISHU_CHAT_ID || 'default'
+  };
+}
+
+/**
+ * 验证安全设置
+ * 检查目录和文件权限
+ * @returns {Promise<{secure: boolean, issues: string[]}>}
+ */
+export async function validateSecurity() {
+  const issues = [];
+  
+  // 检查目录权限
+  try {
+    const stats = await fs.stat(CUECUE_DIR);
+    const mode = stats.mode & 0o777;
+    if (mode !== 0o700) {
+      issues.push(`Directory permissions should be 700, got ${mode.toString(8)}`);
+    }
+  } catch (error) {
+    issues.push('CueCue directory does not exist');
+  }
+  
+  // 检查文件权限
+  try {
+    const stats = await fs.stat(SECURE_ENV_FILE);
+    const mode = stats.mode & 0o777;
+    if (mode !== 0o600) {
+      issues.push(`Env file permissions should be 600, got ${mode.toString(8)}`);
+    }
+  } catch (error) {
+    // 文件不存在不算错误
+  }
+  
+  return {
+    secure: issues.length === 0,
+    issues
+  };
+}