@dnalec/dsh-auto-approve 0.1.3 → 0.2.1

package/src/util.mjs

@@ -1,36 +1,76 @@
 /**
  * 路径、JSON、审计、事件日志。无副作用：调用方传入目录。
  *
- * 规则在 ~/.dsh/auto-approve/；凭据/插件配置在 ~/.dsh/approval-bridge/（旧目录名，不要挪）。
+ * 规则、审计、插件配置在 ~/.dsh/auto-approve/。
+ * 0.1.x 把插件配置放在 ~/.dsh/approval-bridge/config.json；缺失新文件时只迁移判定字段。
  * tryLoadJson 区分缺失与损坏：损坏时调用方不得用默认值覆写磁盘。
  */
 import { appendFileSync, chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
 
 export const NAME = '@dnalec/dsh-auto-approve'
 
+/** DSH 的用户 patch 层文件名（profile 目录下）。 */
+export const PROFILE_PATCH_FILENAME = 'cordis.patch.yml'
+
 export function dshHome() {
   return process.env.DSH_HOME || join(homedir(), '.dsh')
 }
 
-/** auto-approve = 规则/审计；approval-bridge = QQ 凭据与插件配置。 */
-export function pathsFor(home = dshHome()) {
+/**
+ * 从 cordis 的 `baseUrl` 推导当前 profile 的 patch 文件路径。
+ * app-boot 把 root include 的 baseUrl 锚在 profile 目录
+ * （`packages/boot/app-boot/src/index.ts`：`ctx.baseUrl = pathToFileURL(dirname(configPath)).href + '/'`），
+ * 所以这里能拿到真实 profile，而不是写死 `profiles/web`。
+ * 拿不到（测试、非 file: URL）时返回 ''，由调用方回落到 `pathsFor()` 的默认位置。
+ * @param {string} baseUrl - `ctx.baseUrl`
+ * @returns {string} 绝对路径或 ''
+ */
+export function profilePatchFromBaseUrl(baseUrl) {
+  const s = String(baseUrl || '')
+  if (!s.startsWith('file:')) return ''
+  try {
+    const url = new URL(s)
+    // 目录判定看 pathname：`file:///a/b/?x=1` 的字符串不以 / 结尾，但路径是目录。
+    let dir = fileURLToPath(url)
+    if (!url.pathname.endsWith('/')) dir = dirname(dir)
+    if (!dir || dir === '/' || dir === '\\') return ''
+    return join(dir, PROFILE_PATCH_FILENAME)
+  } catch {
+    return ''
+  }
+}
+
+/**
+ * patch 文件路径的优先级：显式配置 → 当前 profile 目录 → 默认 `profiles/web`。
+ * @param {object} ctx - 插件 ctx（只用 baseUrl）。
+ * @param {object} rawConfig - 插件行配置，可含 `profilePatch` 绝对路径。
+ * @param {string} fallback - `pathsFor()` 给出的默认位置。
+ * @returns {string}
+ */
+export function resolveProfilePatchPath(ctx, rawConfig, fallback) {
+  const explicit = rawConfig && typeof rawConfig.profilePatch === 'string' ? rawConfig.profilePatch.trim() : ''
+  if (explicit) return explicit
+  return profilePatchFromBaseUrl(ctx && ctx.baseUrl) || String(fallback || '')
+}
+
+/** auto-approve = 规则/审计/插件配置；legacyPluginConfig 仅作 0.1.x 迁移源。 */
+export function pathsFor(home = dshHome(), profileName = 'web') {
   const auto = join(home, 'auto-approve')
   const bridge = join(home, 'approval-bridge')
   return {
     home,
     auto,
-    bridge,
     allowlist: join(auto, 'allowlist.json'),
     audit: join(auto, 'audit.log'),
     events: join(auto, 'events.jsonl'),
-    pluginConfig: join(bridge, 'config.json'),
-    qqbot: join(bridge, 'qqbot.json'),
-    profilePatch: join(home, 'profiles', 'web', 'cordis.patch.yml'),
+    pluginConfig: join(auto, 'config.json'),
+    legacyPluginConfig: join(bridge, 'config.json'),
+    profilePatch: join(home, 'profiles', profileName, PROFILE_PATCH_FILENAME),
   }
 }
-
 export function ensureDir(dir) {
   try { mkdirSync(dir, { recursive: true }) } catch { /* ignore */ }
 }
@@ -83,16 +123,6 @@ export function saveJson(path, data) {
   }
 }
 
-/** 凭据文件：0600。目录也尽量收紧。 */
-export function saveSecretJson(path, data) {
-  try {
-    writeAtomic(path, JSON.stringify(data, null, 2) + '\n', 0o600)
-  } catch (error) {
-    console.error(`[${NAME}] 写入凭据 ${path} 失败`, error)
-    throw error
-  }
-}
-
 export function appendLine(path, line) {
   try {
     ensureDir(dirname(path))
@@ -187,56 +217,3 @@ export function maxEventId(eventsPath) {
   } catch { /* missing */ }
   return max
 }
-
-export function maskSecret(value) {
-  const s = String(value || '')
-  if (!s) return ''
-  if (s.length <= 4) return '****'
-  return s.slice(0, 2) + '****' + s.slice(-2)
-}
-
-/**
- * 网页审批框用的独立 signal：父 signal 中止时跟着中止；
- * 主动 abort() 只关网页，不碰父 signal（避免整单变成 cancelled）。
- * @param {AbortSignal | undefined} parent
- */
-export function forkAbortSignal(parent) {
-  const child = new AbortController()
-  const forward = () => {
-    if (child.signal.aborted) return
-    try { child.abort(parent && parent.reason) } catch { /* ignore */ }
-  }
-  if (parent) {
-    if (parent.aborted) forward()
-    else parent.addEventListener('abort', forward, { once: true })
-  }
-  return {
-    signal: child.signal,
-    abort() {
-      if (parent) {
-        try { parent.removeEventListener('abort', forward) } catch { /* ignore */ }
-      }
-      forward()
-    },
-  }
-}
-
-/** 把 req.signal 换成网页专用 signal；失败则 false（网页框可能关不掉）。 */
-export function replaceRequestSignal(req, signal) {
-  if (!req || typeof req !== 'object') return false
-  try {
-    req.signal = signal
-    if (req.signal === signal) return true
-  } catch { /* readonly */ }
-  try {
-    Object.defineProperty(req, 'signal', {
-      configurable: true,
-      enumerable: true,
-      writable: true,
-      value: signal,
-    })
-    return req.signal === signal
-  } catch {
-    return false
-  }
-}

package/src/provisioning.mjs

@@ -1,131 +0,0 @@
-/**
- * QQ 官方扫码创建机器人：生成本机二维码，等待平台返回 AppID / AppSecret。
- * 长连接仍由 qqbot.mjs 负责。扫码成功可预填扫码者 openid 为 chatId。
- */
-
-export function cleanString(value) {
-  return typeof value === 'string' && value.trim() ? value.trim() : ''
-}
-
-/**
- * @param {unknown} credentials
- * @returns {{ appId: string, appSecret: string, userOpenid: string } | null}
- */
-export function pickQqCredentials(credentials) {
-  const list = Array.isArray(credentials) ? credentials : (credentials ? [credentials] : [])
-  for (const item of list) {
-    if (!item || typeof item !== 'object') continue
-    const appId = cleanString(item.appId)
-    const appSecret = cleanString(item.appSecret)
-    if (appId && appSecret) {
-      return { appId, appSecret, userOpenid: cleanString(item.userOpenid) }
-    }
-  }
-  return null
-}
-
-export async function qrDataUrl(value) {
-  const url = String(value || '')
-  if (!url) throw new Error('扫码服务未返回二维码 URL')
-  let mod
-  try {
-    mod = await import('qrcode')
-  } catch (error) {
-    const msg = error instanceof Error ? error.message : String(error)
-    if (/Cannot find|ERR_MODULE_NOT_FOUND|MODULE_NOT_FOUND/i.test(msg)) {
-      throw new Error('未安装 qrcode，请在插件目录执行 npm install')
-    }
-    throw error
-  }
-  const toDataURL = typeof mod.toDataURL === 'function'
-    ? mod.toDataURL
-    : (mod.default && typeof mod.default.toDataURL === 'function' ? mod.default.toDataURL : null)
-  if (!toDataURL) throw new Error('qrcode.toDataURL 不可用')
-  return toDataURL.call(mod.default || mod, url, {
-    type: 'image/png',
-    margin: 2,
-    width: 320,
-    errorCorrectionLevel: 'M',
-  })
-}
-
-async function defaultImportConnector() {
-  try {
-    return await import('@tencent-connect/qqbot-connector')
-  } catch (error) {
-    const msg = error instanceof Error ? error.message : String(error)
-    if (/Cannot find|ERR_MODULE_NOT_FOUND|MODULE_NOT_FOUND/i.test(msg)) {
-      throw new Error('未安装 @tencent-connect/qqbot-connector，请在插件目录执行 npm install')
-    }
-    throw error
-  }
-}
-
-/**
- * @param {{
- *   onQr: (qr: { dataUrl: string, expiresAt: number }) => void,
- *   onStatus: (status: string) => void,
- *   onCredentials: (creds: { appId: string, appSecret: string, ownerUserOpenid: string }) => void | Promise<void>,
- *   onFailure: (error: unknown) => void,
- * }} callbacks
- * @param {AbortSignal} [signal]
- * @param {{ importConnector?: () => Promise<any>, qrDataUrl?: (url: string) => Promise<string> }} [deps]
- * @returns {Promise<{ cancel: () => void }>}
- */
-export async function startQqProvisioning(callbacks, signal, deps) {
-  const loadConnector = (deps && deps.importConnector) || defaultImportConnector
-  const toQr = (deps && deps.qrDataUrl) || qrDataUrl
-  const mod = await loadConnector()
-  const startQrConnect = typeof mod.startQrConnect === 'function'
-    ? mod.startQrConnect
-    : (mod.default && typeof mod.default.startQrConnect === 'function' ? mod.default.startQrConnect : null)
-  if (typeof startQrConnect !== 'function') {
-    throw new Error('@tencent-connect/qqbot-connector 缺少 startQrConnect')
-  }
-
-  let disposed = false
-  const started = startQrConnect({
-    onQrDisplayed(url) {
-      if (disposed) return
-      void Promise.resolve(toQr(String(url || ''))).then((dataUrl) => {
-        if (disposed) return
-        callbacks.onQr({ dataUrl, expiresAt: Date.now() + 5 * 60_000 })
-        callbacks.onStatus('等待扫码')
-      }).catch((error) => {
-        if (!disposed) callbacks.onFailure(error)
-      })
-    },
-    onQrExpired() {
-      if (!disposed) callbacks.onStatus('二维码已过期')
-    },
-    onSuccess(credentials) {
-      if (disposed) return
-      const first = pickQqCredentials(credentials)
-      if (!first) {
-        callbacks.onFailure(new Error('QQ 扫码未返回完整机器人凭据'))
-        return
-      }
-      void Promise.resolve(callbacks.onCredentials({
-        appId: first.appId,
-        appSecret: first.appSecret,
-        ownerUserOpenid: first.userOpenid,
-      })).catch((error) => {
-        if (!disposed) callbacks.onFailure(error)
-      })
-    },
-    onFailure(error) {
-      if (!disposed) callbacks.onFailure(error)
-    },
-  }, {
-    displayQrCodeToConsole: false,
-    source: 'deepseek-harness',
-    signal,
-  })
-  const dispose = (started && typeof started.then === 'function') ? await started : started
-  return {
-    cancel() {
-      disposed = true
-      if (typeof dispose === 'function') dispose()
-    },
-  }
-}

package/src/qqbot.mjs

@@ -1,313 +0,0 @@
-/**
- * QQ 开放平台官方 Bot：token / WS / 收发。
- *
- * 意图：C2C + 群 @ + INTERACTION_CREATE（按钮回调）。
- * 发消息优先 markdown+keyboard；纯文本会成功但按钮没了。
- * op=7 必须关 socket 走重连，只改状态会卡死。
- */
-
-const TOKEN_URL = 'https://bots.qq.com/app/getAppAccessToken'
-const API = 'https://api.sgroup.qq.com'
-const GATEWAY_PATH = '/gateway'
-const GROUP_AND_C2C_INTENT = 1 << 25
-const INTERACTION_INTENT = 1 << 26
-
-export function isGatewayForceReconnect(op) {
-  return op === 7 || op === 9
-}
-
-/**
- * @param {{ appId: string, appSecret: string }} creds
- * @param {(line: string) => void} log
- */
-export function createQQBot(creds, log = () => {}) {
-  const appId = String(creds.appId || '')
-  const appSecret = String(creds.appSecret || '')
-  if (!appId || !appSecret) {
-    return {
-      start() {},
-      stop() {},
-      async send() { throw new Error('qqbot: missing credentials') },
-      setMessageHandler() {},
-      status() { return '未配置凭据' },
-      connected() { return false },
-    }
-  }
-
-  let handler
-  let ws
-  let heartbeat
-  let reconnectTimer
-  let stableTimer
-  let reconnectAttempts = 0
-  let stopped = true
-  let seq = null
-  let accessToken = ''
-  let tokenExpiresAt = 0
-  let statusText = '未连接'
-
-  function clearTimers() {
-    if (heartbeat) { clearInterval(heartbeat); heartbeat = undefined }
-    if (reconnectTimer) { clearTimeout(reconnectTimer); reconnectTimer = undefined }
-    if (stableTimer) { clearTimeout(stableTimer); stableTimer = undefined }
-  }
-
-  function scheduleReconnect() {
-    if (stopped || reconnectTimer) return
-    const delay = Math.min(3000 * (2 ** reconnectAttempts), 60_000)
-    reconnectAttempts += 1
-    log(`[qqbot] ${Math.ceil(delay / 1000)}s 后重连`)
-    reconnectTimer = setTimeout(() => {
-      reconnectTimer = undefined
-      void connect().catch((err) => {
-        statusText = '重连失败'
-        log(`[qqbot] 重连失败: ${err instanceof Error ? err.message : String(err)}`)
-        scheduleReconnect()
-      })
-    }, delay)
-  }
-
-  async function getToken() {
-    const res = await fetch(TOKEN_URL, {
-      method: 'POST',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ appId, clientSecret: appSecret }),
-    })
-    const body = await res.text()
-    let data
-    try { data = JSON.parse(body) } catch {
-      throw new Error(`qq getAppAccessToken: HTTP ${res.status} ${body.slice(0, 200)}`)
-    }
-    if (!res.ok || !data.access_token) {
-      throw new Error(`qq getAppAccessToken: HTTP ${res.status} ${data.message ?? 'no token'}`)
-    }
-    const expiresIn = Number(data.expires_in) > 0 ? Number(data.expires_in) : 7200
-    tokenExpiresAt = Date.now() + Math.max(30, expiresIn - 60) * 1000
-    accessToken = data.access_token
-    return accessToken
-  }
-
-  async function ensureToken() {
-    if (!accessToken || Date.now() >= tokenExpiresAt) await getToken()
-  }
-
-  async function qqFetch(path, init, retried = false) {
-    await ensureToken()
-    const res = await fetch(`${API}${path}`, {
-      ...init,
-      headers: {
-        Authorization: `QQBot ${accessToken}`,
-        'content-type': 'application/json',
-        ...(init && init.headers ? init.headers : {}),
-      },
-    })
-    if (res.status === 401 && !retried) {
-      await res.text().catch(() => '')
-      accessToken = ''
-      tokenExpiresAt = 0
-      return qqFetch(path, init, true)
-    }
-    if (!res.ok) {
-      const body = await res.text().catch(() => '')
-      throw new Error(`qq ${path}: HTTP ${res.status} ${body.slice(0, 200)}`)
-    }
-    if (res.status === 204) return null
-    const text = await res.text()
-    if (!text) return null
-    try { return JSON.parse(text) } catch { return text }
-  }
-
-  async function connect() {
-    if (stopped) return
-    if (typeof WebSocket === 'undefined') {
-      statusText = '环境无 WebSocket'
-      throw new Error('qqbot: WebSocket is not available')
-    }
-    await getToken()
-    if (stopped) return
-    const gw = await qqFetch(GATEWAY_PATH)
-    const url = gw && gw.url
-    if (!url) throw new Error('qq gateway: missing websocket url')
-    if (stopped) return
-
-    const socket = new WebSocket(url)
-    ws = socket
-    statusText = '连接中'
-    socket.onopen = () => {
-      if (ws === socket) statusText = '等待网关握手'
-    }
-    socket.onmessage = (ev) => {
-      let payload
-      try { payload = JSON.parse(String(ev.data)) } catch {
-        log('[qqbot] 收到无法解析的网关消息')
-        return
-      }
-      if (payload.s !== undefined) seq = payload.s
-      switch (payload.op) {
-        case 10: {
-          const hello = payload.d || {}
-          socket.send(JSON.stringify({
-            op: 2,
-            d: {
-              token: `QQBot ${accessToken}`,
-              intents: GROUP_AND_C2C_INTENT | INTERACTION_INTENT,
-              shard: [0, 1],
-            },
-          }))
-          if (heartbeat) clearInterval(heartbeat)
-          heartbeat = setInterval(() => {
-            if (ws === socket) socket.send(JSON.stringify({ op: 1, d: seq }))
-          }, hello.heartbeat_interval || 41250)
-          statusText = '鉴权中'
-          log('[qqbot] 已收到 Hello，正在鉴权')
-          break
-        }
-        case 0: {
-          const t = payload.t
-          if (t === 'READY') {
-            if (stableTimer) clearTimeout(stableTimer)
-            stableTimer = setTimeout(() => { reconnectAttempts = 0 }, 60_000)
-            statusText = '已连接'
-            log('[qqbot] 网关就绪')
-            break
-          }
-          if (t === 'INTERACTION_CREATE') {
-            const d = payload.d || {}
-            if (d.id && (d.type === 11 || d.type === 12)) {
-              void qqFetch(`/interactions/${encodeURIComponent(d.id)}`, {
-                method: 'PUT',
-                body: JSON.stringify({ code: 0 }),
-              }).catch((err) => {
-                log(`[qqbot] 互动回应失败: ${err instanceof Error ? err.message : String(err)}`)
-              })
-            }
-            if (d.type !== 11) break
-            const resolved = (d.data && d.data.resolved) || {}
-            const text = String(resolved.button_data || '').trim()
-            const isGroup = d.scene === 'group' || d.chat_type === 1
-            const userId = isGroup
-              ? (d.group_member_openid || '')
-              : (d.user_openid || '')
-            const chatId = isGroup
-              ? (d.group_openid ? `g:${d.group_openid}` : '')
-              : (d.user_openid || '')
-            if (!chatId || !userId || !text) break
-            void handler?.({ chatId, userId, text, isGroup, username: '' })
-            break
-          }
-          if (t === 'C2C_MESSAGE_CREATE' || t === 'GROUP_AT_MESSAGE_CREATE') {
-            const msg = payload.d || {}
-            if (!msg.content || !msg.author) return
-            const isGroup = t === 'GROUP_AT_MESSAGE_CREATE'
-            const userId = isGroup
-              ? (msg.author.member_openid || msg.author.id)
-              : (msg.author.user_openid || msg.author.id)
-            const chatId = isGroup
-              ? (msg.group_openid ? `g:${msg.group_openid}` : '')
-              : (msg.author.user_openid || msg.author.id || '')
-            if (!chatId || !userId) return
-            void handler?.({
-              chatId,
-              userId,
-              username: msg.author.username,
-              text: String(msg.content || '').replace(/^<@!\d+>\s*/, '').trim(),
-              isGroup,
-            })
-          }
-          break
-        }
-        case 7:
-        case 9:
-          statusText = '重连中'
-          log(`[qqbot] 网关要求重连 (op=${payload.op})`)
-          if (payload.op === 9) seq = null
-          try { socket.close() } catch { /* onclose 会 scheduleReconnect */ }
-          break
-      }
-    }
-    socket.onclose = (ev) => {
-      if (ws !== socket) return
-      if (heartbeat) { clearInterval(heartbeat); heartbeat = undefined }
-      if (stableTimer) { clearTimeout(stableTimer); stableTimer = undefined }
-      ws = undefined
-      statusText = `已断开（code ${ev.code}）`
-      if (!stopped) {
-        const detail = ev.code === 4004 ? '：鉴权失败，将刷新 AccessToken' : ''
-        log(`[qqbot] 连接断开（${ev.code}${detail}）`)
-        scheduleReconnect()
-      }
-    }
-    socket.onerror = () => {
-      if (ws === socket) statusText = '连接错误'
-    }
-  }
-
-  return {
-    async start() {
-      if (!stopped && (ws || reconnectTimer)) return
-      stopped = false
-      reconnectAttempts = 0
-      try {
-        await connect()
-      } catch (err) {
-        statusText = '连接失败'
-        log(`[qqbot] 连接失败: ${err instanceof Error ? err.message : String(err)}`)
-        scheduleReconnect()
-      }
-    },
-    async stop() {
-      stopped = true
-      clearTimers()
-      try { ws?.close(1000, 'shutdown') } catch { /* ignore */ }
-      ws = undefined
-      statusText = '已停止'
-    },
-    async send(chatId, text, extra = {}) {
-      const content = String(text || '')
-      const path = String(chatId).startsWith('g:')
-        ? `/v2/groups/${String(chatId).slice(2)}/messages`
-        : `/v2/users/${chatId}/messages`
-      const keyboard = extra && extra.keyboard
-      const kb = keyboard ? { content: keyboard } : null
-      const payloads = []
-      if (kb) {
-        // 按钮挂在 markdown 上；纯文本会 200 但丢掉 keyboard。
-        payloads.push({
-          msg_type: 2,
-          markdown: { content },
-          keyboard: kb,
-        })
-        payloads.push({
-          content,
-          msg_type: 2,
-          markdown: { content },
-          keyboard: kb,
-        })
-        payloads.push({
-          content,
-          msg_type: 0,
-          keyboard: kb,
-        })
-      }
-      payloads.push({ content, msg_type: 0 })
-      let lastErr
-      for (const body of payloads) {
-        try {
-          await qqFetch(path, {
-            method: 'POST',
-            body: JSON.stringify(body),
-          })
-          log(`[qqbot] 已发送 msg_type=${body.msg_type}${body.keyboard ? ' keyboard' : ''}`)
-          return
-        } catch (err) {
-          lastErr = err
-          log(`[qqbot] 发送失败 msg_type=${body.msg_type}${body.keyboard ? ' keyboard' : ''}: ${err instanceof Error ? err.message : String(err)}`)
-        }
-      }
-      throw lastErr || new Error('qqbot: send failed')
-    },
-    setMessageHandler(h) { handler = h },
-    status() { return statusText },
-    connected() { return statusText === '已连接' },
-  }
-}