@dnalec/dsh-auto-approve 0.1.0

package/src/preset-patch.mjs

@@ -0,0 +1,164 @@
+/**
+ * 把 auto-approve 预设写入 profile 的 cordis.patch.yml。
+ * 权限表冻结，不能运行时扩展 presets。改 sandbox 后必须重启并重新选预设。
+ * patch 若是 `[]`，整段替换，不要拼成 `[]\n- id: permission`。
+ */
+import { readFileSync, writeFileSync } from 'node:fs'
+import { autoApprovePresetYaml, FULL_PERMISSION_BLOCK, normalizePresetSandbox } from './rules.mjs'
+
+export function getSetupState(patchPath) {
+  try {
+    const text = readFileSync(patchPath, 'utf8')
+    return {
+      configured: text.includes('auto-approve:'),
+      patchPath,
+      sandbox: readAutoApproveSandboxFromText(text),
+    }
+  } catch (e) {
+    return { configured: false, patchPath, sandbox: '', error: String((e && e.message) || e) }
+  }
+}
+
+export function readAutoApproveSandbox(patchPath) {
+  try {
+    return readAutoApproveSandboxFromText(readFileSync(patchPath, 'utf8'))
+  } catch {
+    return ''
+  }
+}
+
+export function readAutoApproveSandboxFromText(text) {
+  const lines = String(text || '').split('\n')
+  let inAuto = false
+  let autoIndent = 0
+  for (const line of lines) {
+    const start = line.match(/^([ \t]*)auto-approve:\s*$/)
+    if (start) {
+      inAuto = true
+      autoIndent = start[1].length
+      continue
+    }
+    if (!inAuto) continue
+    const indent = (line.match(/^[ \t]*/) || [''])[0].length
+    if (line.trim() !== '' && indent <= autoIndent) {
+      inAuto = false
+      continue
+    }
+    const sandbox = line.match(/^[ \t]+sandbox:\s*(workspace-write|read-only)\s*$/)
+    if (sandbox) return sandbox[1]
+  }
+  return ''
+}
+
+export function replaceAutoApproveSandbox(text, sandbox) {
+  const mode = normalizePresetSandbox(sandbox)
+  const lines = String(text || '').split('\n')
+  let inAuto = false
+  let autoIndent = 0
+  let changed = false
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i]
+    const start = line.match(/^([ \t]*)auto-approve:\s*$/)
+    if (start) {
+      inAuto = true
+      autoIndent = start[1].length
+      continue
+    }
+    if (!inAuto) continue
+    const indent = (line.match(/^[ \t]*/) || [''])[0].length
+    if (line.trim() !== '' && indent <= autoIndent) {
+      inAuto = false
+      continue
+    }
+    if (/^[ \t]+sandbox:\s*(workspace-write|read-only)\s*$/.test(line)) {
+      const next = line.replace(/workspace-write|read-only/, mode)
+      if (next !== line) {
+        lines[i] = next
+        changed = true
+      }
+      inAuto = false
+    }
+  }
+  return { text: lines.join('\n'), changed }
+}
+
+export function ensureAutoApprovePreset(patchPath, sandbox = 'workspace-write') {
+  const yaml = autoApprovePresetYaml(sandbox)
+  try {
+    const text = readFileSync(patchPath, 'utf8')
+    if (text.includes('auto-approve:')) return { ok: true, status: 'already', needRestart: false }
+
+    const lines = text.split('\n')
+    let permIdx = -1
+    for (let i = 0; i < lines.length; i++) {
+      if (/^- id:\s*permission\s*$/.test(lines[i])) { permIdx = i; break }
+    }
+
+    if (permIdx === -1) {
+      const trimmed = String(text || '').replace(/^\s+|\s+$/g, '')
+      const block = (FULL_PERMISSION_BLOCK + yaml).replace(/^\n/, '')
+      const next = (trimmed === '' || trimmed === '[]')
+        ? block
+        : (text.replace(/\s*$/, '') + '\n' + block)
+      writeFileSync(patchPath, next.endsWith('\n') ? next : next + '\n', 'utf8')
+      return { ok: true, status: 'added-entry', needRestart: true }
+    }
+
+    let presetsIdx = -1
+    for (let i = permIdx; i < lines.length; i++) {
+      if (/^ {4}presets:\s*$/.test(lines[i])) { presetsIdx = i; break }
+      if (i > permIdx && /^- /.test(lines[i]) && !/^ {2,}- /.test(lines[i])) break
+    }
+    if (presetsIdx === -1) {
+      return { ok: false, status: 'no-presets-key', needRestart: false, error: 'permission 条目缺少 presets 键，请手动添加' }
+    }
+    let insertAt = presetsIdx
+    for (let i = presetsIdx + 1; i < lines.length; i++) {
+      const line = lines[i]
+      if (/^ {6}\S/.test(line) || /^ {8}\S/.test(line)) { insertAt = i; continue }
+      if (/^ {0,4}\S/.test(line) && !/^ {6,}\S/.test(line)) break
+      if (/^\s*$/.test(line)) continue
+    }
+    lines.splice(insertAt + 1, 0, yaml.replace(/\n$/, ''))
+    writeFileSync(patchPath, lines.join('\n'), 'utf8')
+    return { ok: true, status: 'added-preset', needRestart: true }
+  } catch (e) {
+    return { ok: false, status: 'error', needRestart: false, error: String((e && e.message) || e) }
+  }
+}
+
+/** 把配置里的 presetSandbox 写进 auto-approve.sandbox。已有预设则只改这一行。 */
+export function setAutoApproveSandbox(patchPath, sandbox) {
+  const mode = normalizePresetSandbox(sandbox)
+  const ensured = ensureAutoApprovePreset(patchPath, mode)
+  if (!ensured.ok) return { ...ensured, sandbox: mode }
+  try {
+    const text = readFileSync(patchPath, 'utf8')
+    const replaced = replaceAutoApproveSandbox(text, mode)
+    if (!replaced.changed) {
+      return { ok: true, status: ensured.status === 'already' ? 'unchanged' : ensured.status, needRestart: Boolean(ensured.needRestart), sandbox: mode }
+    }
+    writeFileSync(patchPath, replaced.text, 'utf8')
+    return { ok: true, status: 'updated', needRestart: true, sandbox: mode }
+  } catch (e) {
+    return { ok: false, status: 'error', needRestart: false, sandbox: mode, error: String((e && e.message) || e) }
+  }
+}
+
+/** 把旧预设显示名「自动审批（Flash）」改成「自动审批」。 */
+export function migratePresetCopy(patchPath) {
+  try {
+    const text = readFileSync(patchPath, 'utf8')
+    const next = text
+      .replace(/name:\s*自动审批（Flash）/g, 'name: 自动审批')
+      .replace(
+        /description:\s*Flash 预判写入\/命令是否不可回补：安全自动批准，有风险转人工审批。/g,
+        'description: 审核模型预判写入/命令是否不可回补：安全自动批准，有风险转人工审批。',
+      )
+      .replace(
+        /description:\s*判定模型预判写入\/命令是否不可回补：安全自动批准，有风险转人工审批。/g,
+        'description: 审核模型预判写入/命令是否不可回补：安全自动批准，有风险转人工审批。',
+      )
+    if (next !== text) writeFileSync(patchPath, next, 'utf8')
+  } catch { /* ignore */ }
+}

package/src/provisioning.mjs

@@ -0,0 +1,131 @@
+/**
+ * QQ 官方扫码创建机器人：生成本机二维码，等待平台返回 AppID / AppSecret。
+ * 长连接仍由 qqbot.mjs 负责。扫码成功可预填扫码者 openid 为 chatId。
+ */
+
+export function cleanString(value) {
+  return typeof value === 'string' && value.trim() ? value.trim() : ''
+}
+
+/**
+ * @param {unknown} credentials
+ * @returns {{ appId: string, appSecret: string, userOpenid: string } | null}
+ */
+export function pickQqCredentials(credentials) {
+  const list = Array.isArray(credentials) ? credentials : (credentials ? [credentials] : [])
+  for (const item of list) {
+    if (!item || typeof item !== 'object') continue
+    const appId = cleanString(item.appId)
+    const appSecret = cleanString(item.appSecret)
+    if (appId && appSecret) {
+      return { appId, appSecret, userOpenid: cleanString(item.userOpenid) }
+    }
+  }
+  return null
+}
+
+export async function qrDataUrl(value) {
+  const url = String(value || '')
+  if (!url) throw new Error('扫码服务未返回二维码 URL')
+  let mod
+  try {
+    mod = await import('qrcode')
+  } catch (error) {
+    const msg = error instanceof Error ? error.message : String(error)
+    if (/Cannot find|ERR_MODULE_NOT_FOUND|MODULE_NOT_FOUND/i.test(msg)) {
+      throw new Error('未安装 qrcode，请在插件目录执行 npm install')
+    }
+    throw error
+  }
+  const toDataURL = typeof mod.toDataURL === 'function'
+    ? mod.toDataURL
+    : (mod.default && typeof mod.default.toDataURL === 'function' ? mod.default.toDataURL : null)
+  if (!toDataURL) throw new Error('qrcode.toDataURL 不可用')
+  return toDataURL.call(mod.default || mod, url, {
+    type: 'image/png',
+    margin: 2,
+    width: 320,
+    errorCorrectionLevel: 'M',
+  })
+}
+
+async function defaultImportConnector() {
+  try {
+    return await import('@tencent-connect/qqbot-connector')
+  } catch (error) {
+    const msg = error instanceof Error ? error.message : String(error)
+    if (/Cannot find|ERR_MODULE_NOT_FOUND|MODULE_NOT_FOUND/i.test(msg)) {
+      throw new Error('未安装 @tencent-connect/qqbot-connector，请在插件目录执行 npm install')
+    }
+    throw error
+  }
+}
+
+/**
+ * @param {{
+ *   onQr: (qr: { dataUrl: string, expiresAt: number }) => void,
+ *   onStatus: (status: string) => void,
+ *   onCredentials: (creds: { appId: string, appSecret: string, ownerUserOpenid: string }) => void | Promise<void>,
+ *   onFailure: (error: unknown) => void,
+ * }} callbacks
+ * @param {AbortSignal} [signal]
+ * @param {{ importConnector?: () => Promise<any>, qrDataUrl?: (url: string) => Promise<string> }} [deps]
+ * @returns {Promise<{ cancel: () => void }>}
+ */
+export async function startQqProvisioning(callbacks, signal, deps) {
+  const loadConnector = (deps && deps.importConnector) || defaultImportConnector
+  const toQr = (deps && deps.qrDataUrl) || qrDataUrl
+  const mod = await loadConnector()
+  const startQrConnect = typeof mod.startQrConnect === 'function'
+    ? mod.startQrConnect
+    : (mod.default && typeof mod.default.startQrConnect === 'function' ? mod.default.startQrConnect : null)
+  if (typeof startQrConnect !== 'function') {
+    throw new Error('@tencent-connect/qqbot-connector 缺少 startQrConnect')
+  }
+
+  let disposed = false
+  const started = startQrConnect({
+    onQrDisplayed(url) {
+      if (disposed) return
+      void Promise.resolve(toQr(String(url || ''))).then((dataUrl) => {
+        if (disposed) return
+        callbacks.onQr({ dataUrl, expiresAt: Date.now() + 5 * 60_000 })
+        callbacks.onStatus('等待扫码')
+      }).catch((error) => {
+        if (!disposed) callbacks.onFailure(error)
+      })
+    },
+    onQrExpired() {
+      if (!disposed) callbacks.onStatus('二维码已过期')
+    },
+    onSuccess(credentials) {
+      if (disposed) return
+      const first = pickQqCredentials(credentials)
+      if (!first) {
+        callbacks.onFailure(new Error('QQ 扫码未返回完整机器人凭据'))
+        return
+      }
+      void Promise.resolve(callbacks.onCredentials({
+        appId: first.appId,
+        appSecret: first.appSecret,
+        ownerUserOpenid: first.userOpenid,
+      })).catch((error) => {
+        if (!disposed) callbacks.onFailure(error)
+      })
+    },
+    onFailure(error) {
+      if (!disposed) callbacks.onFailure(error)
+    },
+  }, {
+    displayQrCodeToConsole: false,
+    source: 'deepseek-harness',
+    signal,
+  })
+  const dispose = (started && typeof started.then === 'function') ? await started : started
+  return {
+    cancel() {
+      disposed = true
+      if (typeof dispose === 'function') dispose()
+    },
+  }
+}

package/src/qqbot.mjs

@@ -0,0 +1,313 @@
+/**
+ * QQ 开放平台官方 Bot：token / WS / 收发。
+ *
+ * 意图：C2C + 群 @ + INTERACTION_CREATE（按钮回调）。
+ * 发消息优先 markdown+keyboard；纯文本会成功但按钮没了。
+ * op=7 必须关 socket 走重连，只改状态会卡死。
+ */
+
+const TOKEN_URL = 'https://bots.qq.com/app/getAppAccessToken'
+const API = 'https://api.sgroup.qq.com'
+const GATEWAY_PATH = '/gateway'
+const GROUP_AND_C2C_INTENT = 1 << 25
+const INTERACTION_INTENT = 1 << 26
+
+export function isGatewayForceReconnect(op) {
+  return op === 7 || op === 9
+}
+
+/**
+ * @param {{ appId: string, appSecret: string }} creds
+ * @param {(line: string) => void} log
+ */
+export function createQQBot(creds, log = () => {}) {
+  const appId = String(creds.appId || '')
+  const appSecret = String(creds.appSecret || '')
+  if (!appId || !appSecret) {
+    return {
+      start() {},
+      stop() {},
+      async send() { throw new Error('qqbot: missing credentials') },
+      setMessageHandler() {},
+      status() { return '未配置凭据' },
+      connected() { return false },
+    }
+  }
+
+  let handler
+  let ws
+  let heartbeat
+  let reconnectTimer
+  let stableTimer
+  let reconnectAttempts = 0
+  let stopped = true
+  let seq = null
+  let accessToken = ''
+  let tokenExpiresAt = 0
+  let statusText = '未连接'
+
+  function clearTimers() {
+    if (heartbeat) { clearInterval(heartbeat); heartbeat = undefined }
+    if (reconnectTimer) { clearTimeout(reconnectTimer); reconnectTimer = undefined }
+    if (stableTimer) { clearTimeout(stableTimer); stableTimer = undefined }
+  }
+
+  function scheduleReconnect() {
+    if (stopped || reconnectTimer) return
+    const delay = Math.min(3000 * (2 ** reconnectAttempts), 60_000)
+    reconnectAttempts += 1
+    log(`[qqbot] ${Math.ceil(delay / 1000)}s 后重连`)
+    reconnectTimer = setTimeout(() => {
+      reconnectTimer = undefined
+      void connect().catch((err) => {
+        statusText = '重连失败'
+        log(`[qqbot] 重连失败: ${err instanceof Error ? err.message : String(err)}`)
+        scheduleReconnect()
+      })
+    }, delay)
+  }
+
+  async function getToken() {
+    const res = await fetch(TOKEN_URL, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ appId, clientSecret: appSecret }),
+    })
+    const body = await res.text()
+    let data
+    try { data = JSON.parse(body) } catch {
+      throw new Error(`qq getAppAccessToken: HTTP ${res.status} ${body.slice(0, 200)}`)
+    }
+    if (!res.ok || !data.access_token) {
+      throw new Error(`qq getAppAccessToken: HTTP ${res.status} ${data.message ?? 'no token'}`)
+    }
+    const expiresIn = Number(data.expires_in) > 0 ? Number(data.expires_in) : 7200
+    tokenExpiresAt = Date.now() + Math.max(30, expiresIn - 60) * 1000
+    accessToken = data.access_token
+    return accessToken
+  }
+
+  async function ensureToken() {
+    if (!accessToken || Date.now() >= tokenExpiresAt) await getToken()
+  }
+
+  async function qqFetch(path, init, retried = false) {
+    await ensureToken()
+    const res = await fetch(`${API}${path}`, {
+      ...init,
+      headers: {
+        Authorization: `QQBot ${accessToken}`,
+        'content-type': 'application/json',
+        ...(init && init.headers ? init.headers : {}),
+      },
+    })
+    if (res.status === 401 && !retried) {
+      await res.text().catch(() => '')
+      accessToken = ''
+      tokenExpiresAt = 0
+      return qqFetch(path, init, true)
+    }
+    if (!res.ok) {
+      const body = await res.text().catch(() => '')
+      throw new Error(`qq ${path}: HTTP ${res.status} ${body.slice(0, 200)}`)
+    }
+    if (res.status === 204) return null
+    const text = await res.text()
+    if (!text) return null
+    try { return JSON.parse(text) } catch { return text }
+  }
+
+  async function connect() {
+    if (stopped) return
+    if (typeof WebSocket === 'undefined') {
+      statusText = '环境无 WebSocket'
+      throw new Error('qqbot: WebSocket is not available')
+    }
+    await getToken()
+    if (stopped) return
+    const gw = await qqFetch(GATEWAY_PATH)
+    const url = gw && gw.url
+    if (!url) throw new Error('qq gateway: missing websocket url')
+    if (stopped) return
+
+    const socket = new WebSocket(url)
+    ws = socket
+    statusText = '连接中'
+    socket.onopen = () => {
+      if (ws === socket) statusText = '等待网关握手'
+    }
+    socket.onmessage = (ev) => {
+      let payload
+      try { payload = JSON.parse(String(ev.data)) } catch {
+        log('[qqbot] 收到无法解析的网关消息')
+        return
+      }
+      if (payload.s !== undefined) seq = payload.s
+      switch (payload.op) {
+        case 10: {
+          const hello = payload.d || {}
+          socket.send(JSON.stringify({
+            op: 2,
+            d: {
+              token: `QQBot ${accessToken}`,
+              intents: GROUP_AND_C2C_INTENT | INTERACTION_INTENT,
+              shard: [0, 1],
+            },
+          }))
+          if (heartbeat) clearInterval(heartbeat)
+          heartbeat = setInterval(() => {
+            if (ws === socket) socket.send(JSON.stringify({ op: 1, d: seq }))
+          }, hello.heartbeat_interval || 41250)
+          statusText = '鉴权中'
+          log('[qqbot] 已收到 Hello，正在鉴权')
+          break
+        }
+        case 0: {
+          const t = payload.t
+          if (t === 'READY') {
+            if (stableTimer) clearTimeout(stableTimer)
+            stableTimer = setTimeout(() => { reconnectAttempts = 0 }, 60_000)
+            statusText = '已连接'
+            log('[qqbot] 网关就绪')
+            break
+          }
+          if (t === 'INTERACTION_CREATE') {
+            const d = payload.d || {}
+            if (d.id && (d.type === 11 || d.type === 12)) {
+              void qqFetch(`/interactions/${encodeURIComponent(d.id)}`, {
+                method: 'PUT',
+                body: JSON.stringify({ code: 0 }),
+              }).catch((err) => {
+                log(`[qqbot] 互动回应失败: ${err instanceof Error ? err.message : String(err)}`)
+              })
+            }
+            if (d.type !== 11) break
+            const resolved = (d.data && d.data.resolved) || {}
+            const text = String(resolved.button_data || '').trim()
+            const isGroup = d.scene === 'group' || d.chat_type === 1
+            const userId = isGroup
+              ? (d.group_member_openid || '')
+              : (d.user_openid || '')
+            const chatId = isGroup
+              ? (d.group_openid ? `g:${d.group_openid}` : '')
+              : (d.user_openid || '')
+            if (!chatId || !userId || !text) break
+            void handler?.({ chatId, userId, text, isGroup, username: '' })
+            break
+          }
+          if (t === 'C2C_MESSAGE_CREATE' || t === 'GROUP_AT_MESSAGE_CREATE') {
+            const msg = payload.d || {}
+            if (!msg.content || !msg.author) return
+            const isGroup = t === 'GROUP_AT_MESSAGE_CREATE'
+            const userId = isGroup
+              ? (msg.author.member_openid || msg.author.id)
+              : (msg.author.user_openid || msg.author.id)
+            const chatId = isGroup
+              ? (msg.group_openid ? `g:${msg.group_openid}` : '')
+              : (msg.author.user_openid || msg.author.id || '')
+            if (!chatId || !userId) return
+            void handler?.({
+              chatId,
+              userId,
+              username: msg.author.username,
+              text: String(msg.content || '').replace(/^<@!\d+>\s*/, '').trim(),
+              isGroup,
+            })
+          }
+          break
+        }
+        case 7:
+        case 9:
+          statusText = '重连中'
+          log(`[qqbot] 网关要求重连 (op=${payload.op})`)
+          if (payload.op === 9) seq = null
+          try { socket.close() } catch { /* onclose 会 scheduleReconnect */ }
+          break
+      }
+    }
+    socket.onclose = (ev) => {
+      if (ws !== socket) return
+      if (heartbeat) { clearInterval(heartbeat); heartbeat = undefined }
+      if (stableTimer) { clearTimeout(stableTimer); stableTimer = undefined }
+      ws = undefined
+      statusText = `已断开（code ${ev.code}）`
+      if (!stopped) {
+        const detail = ev.code === 4004 ? '：鉴权失败，将刷新 AccessToken' : ''
+        log(`[qqbot] 连接断开（${ev.code}${detail}）`)
+        scheduleReconnect()
+      }
+    }
+    socket.onerror = () => {
+      if (ws === socket) statusText = '连接错误'
+    }
+  }
+
+  return {
+    async start() {
+      if (!stopped && (ws || reconnectTimer)) return
+      stopped = false
+      reconnectAttempts = 0
+      try {
+        await connect()
+      } catch (err) {
+        statusText = '连接失败'
+        log(`[qqbot] 连接失败: ${err instanceof Error ? err.message : String(err)}`)
+        scheduleReconnect()
+      }
+    },
+    async stop() {
+      stopped = true
+      clearTimers()
+      try { ws?.close(1000, 'shutdown') } catch { /* ignore */ }
+      ws = undefined
+      statusText = '已停止'
+    },
+    async send(chatId, text, extra = {}) {
+      const content = String(text || '')
+      const path = String(chatId).startsWith('g:')
+        ? `/v2/groups/${String(chatId).slice(2)}/messages`
+        : `/v2/users/${chatId}/messages`
+      const keyboard = extra && extra.keyboard
+      const kb = keyboard ? { content: keyboard } : null
+      const payloads = []
+      if (kb) {
+        // 按钮挂在 markdown 上；纯文本会 200 但丢掉 keyboard。
+        payloads.push({
+          msg_type: 2,
+          markdown: { content },
+          keyboard: kb,
+        })
+        payloads.push({
+          content,
+          msg_type: 2,
+          markdown: { content },
+          keyboard: kb,
+        })
+        payloads.push({
+          content,
+          msg_type: 0,
+          keyboard: kb,
+        })
+      }
+      payloads.push({ content, msg_type: 0 })
+      let lastErr
+      for (const body of payloads) {
+        try {
+          await qqFetch(path, {
+            method: 'POST',
+            body: JSON.stringify(body),
+          })
+          log(`[qqbot] 已发送 msg_type=${body.msg_type}${body.keyboard ? ' keyboard' : ''}`)
+          return
+        } catch (err) {
+          lastErr = err
+          log(`[qqbot] 发送失败 msg_type=${body.msg_type}${body.keyboard ? ' keyboard' : ''}: ${err instanceof Error ? err.message : String(err)}`)
+        }
+      }
+      throw lastErr || new Error('qqbot: send failed')
+    },
+    setMessageHandler(h) { handler = h },
+    status() { return statusText },
+    connected() { return statusText === '已连接' },
+  }
+}