@ducking-mind/proxy-app-cli 0.1.1 → 0.2.0

package/runtime-sources.mjs

@@ -0,0 +1,83 @@
+import { lstat, readdir, readFile } from 'node:fs/promises'
+import { extname, join, resolve } from 'node:path'
+import { assertSafeArtifactFile } from './artifact-security.mjs'
+
+const MAX_FUNCTION_SOURCE_BYTES = 4 * 1024 * 1024
+const MAX_FUNCTION_SOURCE_FILES = 2000
+
+function functionEntries(manifest) {
+  const functions = manifest?.functions
+  if (!functions || typeof functions !== 'object' || Array.isArray(functions)) return []
+  return ['request', 'task']
+    .map(kind => functions[kind]?.entry)
+    .filter(entry => typeof entry === 'string' && entry.length > 0)
+}
+
+// Read the same runtime module files that proxy-app pack uploads. Development
+// sends these sources to Admin so Gateway can execute the versioned draft; the
+// browser continues to call Gateway and never receives function source.
+export async function readLocalFunctionSources(appDir, manifest) {
+  const requiredEntries = functionEntries(manifest)
+  if (requiredEntries.length === 0) return []
+
+  const root = resolve(appDir)
+  const runtimeRoot = join(root, 'runtime')
+  const files = []
+  let totalBytes = 0
+
+  try {
+    const runtimeMetadata = await lstat(runtimeRoot)
+    if (runtimeMetadata.isSymbolicLink() || !runtimeMetadata.isDirectory()) {
+      throw new Error('runtime function sources must be inside a real runtime/ directory')
+    }
+  } catch (error) {
+    if (error?.code !== 'ENOENT') throw error
+  }
+
+  const visit = async (directory, prefix) => {
+    let entries
+    try {
+      entries = await readdir(directory, { withFileTypes: true })
+    } catch (error) {
+      if (error?.code === 'ENOENT' && directory === runtimeRoot) return
+      throw error
+    }
+    entries.sort((left, right) => left.name.localeCompare(right.name))
+    for (const entry of entries) {
+      if (entry.name.includes('\\') || entry.name === '.' || entry.name === '..') {
+        throw new Error(`invalid runtime source path: ${entry.name}`)
+      }
+      const relativePath = `${prefix}/${entry.name}`
+      const absolutePath = join(directory, entry.name)
+      if (entry.isSymbolicLink()) throw new Error(`runtime function sources cannot be symbolic links: ${relativePath}`)
+      if (entry.isDirectory()) {
+        await visit(absolutePath, relativePath)
+        continue
+      }
+      if (!entry.isFile() || !['.js', '.mjs'].includes(extname(entry.name).toLowerCase())) continue
+      if (Buffer.byteLength(relativePath, 'utf8') > 255) throw new Error(`runtime function path is too long: ${relativePath}`)
+      if (files.length >= MAX_FUNCTION_SOURCE_FILES) throw new Error('runtime function source contains too many files')
+      const metadata = await lstat(absolutePath)
+      if (!metadata.isFile() || metadata.isSymbolicLink()) throw new Error(`runtime function sources cannot be symbolic links: ${relativePath}`)
+      if (metadata.size === 0) throw new Error(`runtime function source is empty: ${relativePath}`)
+      totalBytes += metadata.size
+      if (totalBytes > MAX_FUNCTION_SOURCE_BYTES) throw new Error('runtime function source exceeds 4 MiB')
+      const sourceBytes = await readFile(absolutePath)
+      let source
+      try {
+        source = new TextDecoder('utf-8', { fatal: true }).decode(sourceBytes)
+      } catch {
+        throw new Error(`runtime function source is not valid UTF-8: ${relativePath}`)
+      }
+      assertSafeArtifactFile(relativePath, source)
+      files.push({ path: relativePath, source })
+    }
+  }
+
+  await visit(runtimeRoot, 'runtime')
+  const available = new Set(files.map(file => file.path))
+  for (const entry of requiredEntries) {
+    if (!available.has(entry)) throw new Error(`manifest function entry is missing from runtime/: ${entry}`)
+  }
+  return files
+}

package/agent-runtime/runtime-status.mjs

@@ -1,70 +0,0 @@
-/** Descriptive renderer state only; neither status nor recovery hints grant access. */
-const states = new Set(['ready', 'auth_required', 'loading', 'no_document', 'busy', 'error'])
-const actions = new Set(['wait', 'user_login', 'open_document', 'retry', 'inspect_state'])
-const record = value => value !== null && typeof value === 'object' && !Array.isArray(value)
-const check = (condition, message) => { if (!condition) throw new TypeError(message) }
-const keys = (value, allowed, field) => check(Object.keys(value).every(key => allowed.includes(key)), `Unexpected ${field} field`)
-
-export function normalizeNextAction(value) {
-  check(record(value), 'nextAction must be an object')
-  keys(value, ['type', 'capability'], 'nextAction')
-  check(actions.has(value.type), 'Invalid nextAction type')
-  if (value.capability !== undefined) check(typeof value.capability === 'string' && /^[a-z][a-z0-9_-]{0,127}$/.test(value.capability), 'Invalid nextAction capability')
-  return { type: value.type, ...(value.capability === undefined ? {} : { capability: value.capability }) }
-}
-
-export function normalizeRuntimeStatus(value) {
-  check(record(value), 'Runtime status must be an object')
-  keys(value, ['state', 'reason', 'retryable', 'nextAction', 'context'], 'runtime status')
-  check(states.has(value.state), 'Invalid runtime state')
-  const result = { state: value.state }
-  if (value.reason !== undefined) {
-    check(typeof value.reason === 'string' && value.reason.length <= 512, 'Invalid runtime reason')
-    result.reason = value.reason
-  }
-  if (value.retryable !== undefined) {
-    check(typeof value.retryable === 'boolean', 'Invalid runtime retryable value')
-    result.retryable = value.retryable
-  }
-  if (value.nextAction !== undefined) result.nextAction = normalizeNextAction(value.nextAction)
-  if (value.context !== undefined) {
-    check(record(value.context), 'Runtime context must be an object')
-    keys(value.context, ['activeDocumentId'], 'runtime context')
-    if (value.context.activeDocumentId !== undefined) check(typeof value.context.activeDocumentId === 'string' && value.context.activeDocumentId.length <= 128, 'Invalid activeDocumentId')
-    result.context = value.context.activeDocumentId === undefined ? {} : { activeDocumentId: value.context.activeDocumentId }
-  }
-  return result
-}
-
-/** Keep recovery metadata across process boundaries without forwarding arbitrary fields. */
-export function serializeAgentError(error) {
-  const result = {
-    code: typeof error?.code === 'string' ? error.code.slice(0, 128) : 'AGENT_HANDLER_ERROR',
-    message: typeof error?.message === 'string' ? error.message.slice(0, 2048) : 'Application handler failed',
-  }
-  // Preserve public platform diagnostics through the renderer/child/MCP
-  // boundaries, without forwarding credentials or arbitrary error fields.
-  if (Number.isInteger(error?.status) && error.status >= 100 && error.status <= 599) result.status = error.status
-  if (typeof error?.requestId === 'string') result.requestId = error.requestId.slice(0, 256)
-  if (typeof error?.authReason === 'string') result.authReason = error.authReason.slice(0, 128)
-  if (typeof error?.reason === 'string') result.reason = error.reason.slice(0, 512)
-  if (typeof error?.retryable === 'boolean') result.retryable = error.retryable
-  if (typeof error?.executionStarted === 'boolean') result.executionStarted = error.executionStarted
-  if (error?.nextAction !== undefined) {
-    try { result.nextAction = normalizeNextAction(error.nextAction) } catch { /* Invalid hints cannot obscure the actual error. */ }
-  }
-  const recovery = {
-    AGENT_OUTCOME_UNKNOWN: { reason: 'execution_outcome_unknown', retryable: false, nextAction: { type: 'inspect_state' } },
-    AGENT_WRITE_BUSY: { reason: 'write_pending_or_unknown', retryable: false, nextAction: { type: 'inspect_state' } },
-    AGENT_IDEMPOTENCY_CONFLICT: { reason: 'idempotency_conflict', retryable: false, nextAction: { type: 'inspect_state' } },
-    AGENT_APP_UNAVAILABLE: { reason: 'app_unavailable', retryable: true, nextAction: { type: 'wait' } },
-    AGENT_APP_NOT_READY: { reason: 'app_not_ready', retryable: true, nextAction: { type: 'wait' } },
-  }[result.code]
-  if (recovery) for (const [key, value] of Object.entries(recovery)) if (result[key] === undefined) result[key] = value
-  // An unknown execution outcome must never acquire an automatic retry hint.
-  if (result.code === 'AGENT_OUTCOME_UNKNOWN') {
-    result.retryable = false
-    result.nextAction = { type: 'inspect_state' }
-  }
-  return result
-}

package/release-runtime/release-config.mjs

@@ -1,154 +0,0 @@
-import { access, readFile } from 'node:fs/promises'
-import { dirname, join, resolve } from 'node:path'
-import { fileURLToPath } from 'node:url'
-
-// This file deliberately contains no credentials. A developer may copy
-// release.config.example.json to release.config.json (which is gitignored)
-// and put the publish key in that local file.
-export const DEFAULT_RELEASE_CONFIG = Object.freeze({
-  product: 'duckingmind',
-  updateURL: '',
-  updateChannel: 'latest',
-  apiURL: '',
-  apiKey: '',
-  releaseNotes: '',
-  artifactBaseURL: '',
-})
-
-export function parseConfigOption(args) {
-  const rest = []
-  let configPath
-  let envOverrides = false
-  for (let index = 0; index < args.length; index += 1) {
-    const value = args[index]
-    if (value === '--env-overrides') { envOverrides = true; continue }
-    if (value === '--config') {
-      const next = args[++index]
-      if (!next || next.startsWith('--')) throw new Error('Missing value for --config')
-      configPath = next
-      continue
-    }
-    if (value.startsWith('--config=')) {
-      configPath = value.slice('--config='.length)
-      if (!configPath) throw new Error('Missing value for --config')
-      continue
-    }
-    rest.push(value)
-  }
-  return { args: rest, configPath, envOverrides }
-}
-
-function stringValue(value, fallback = '') {
-  return value == null ? fallback : String(value).trim()
-}
-
-function flattenConfig(value) {
-  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error('发布配置必须是 JSON 对象')
-  const update = value.update && typeof value.update === 'object' ? value.update : {}
-  const release = value.release && typeof value.release === 'object' ? value.release : {}
-  const build = value.build && typeof value.build === 'object' ? value.build : {}
-  return {
-    product: stringValue(value.product ?? release.product, 'duckingmind'),
-    updateURL: stringValue(value.updateURL ?? value.updateUrl ?? value.update_url ?? update.url ?? update.updateURL ?? update.update_url),
-    updateChannel: stringValue(value.updateChannel ?? value.channel ?? update.channel, 'latest'),
-    apiURL: stringValue(value.apiURL ?? value.apiUrl ?? value.api_url ?? release.apiURL ?? release.apiUrl ?? release.api_url),
-    apiKey: stringValue(value.apiKey ?? value.api_key ?? release.apiKey ?? release.api_key),
-    releaseNotes: stringValue(value.releaseNotes ?? value.release_notes ?? value.notes ?? release.releaseNotes ?? release.release_notes ?? release.notes),
-    artifactBaseURL: stringValue(value.artifactBaseURL ?? value.artifactBaseUrl ?? value.artifact_base_url ?? release.artifactBaseURL ?? release.artifactBaseUrl ?? release.artifact_base_url),
-    buildTarget: { platform: stringValue(build.platform), arch: stringValue(build.arch) },
-    releaseDirs: release.directories ?? ['release'],
-    recordPaths: release.records ?? [],
-  }
-}
-
-function envOverrides(env = process.env) {
-  const keys = {
-    product: 'PROXY_DESKTOP_PRODUCT',
-    updateURL: 'PROXY_DESKTOP_UPDATE_URL',
-    updateChannel: 'PROXY_DESKTOP_UPDATE_CHANNEL',
-    apiURL: 'PROXY_DESKTOP_RELEASE_API_URL',
-    apiKey: 'PROXY_DESKTOP_RELEASE_API_KEY',
-    releaseNotes: 'PROXY_DESKTOP_RELEASE_NOTES',
-    artifactBaseURL: 'PROXY_DESKTOP_ARTIFACT_BASE_URL',
-  }
-  return Object.fromEntries(Object.entries(keys).filter(([, key]) => env[key] != null && String(env[key]).trim() !== '').map(([name, key]) => [name, String(env[key]).trim()]))
-}
-
-async function firstExisting(paths) {
-  for (const path of paths) {
-    try {
-      await access(path)
-      return path
-    } catch {}
-  }
-  return undefined
-}
-
-export function defaultConfigPaths({ root, cwd = process.cwd() }) {
-  const candidates = [join(root, 'release.config.json'), join(root, 'release.config.local.json')]
-  if (cwd && resolve(cwd) !== resolve(root)) {
-    candidates.push(join(cwd, 'desktop', 'release.config.json'), join(cwd, 'desktop', 'release.config.local.json'))
-  }
-  return [...new Set(candidates)]
-}
-
-export function isAllowedReleaseURL(value) {
-  let parsed
-  try { parsed = new URL(String(value || '').trim()) } catch { return false }
-  const loopbackHTTP = parsed.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(parsed.hostname)
-  return (parsed.protocol === 'https:' || loopbackHTTP) && !parsed.username && !parsed.password && !parsed.search && !parsed.hash
-}
-
-export async function loadReleaseConfig({ root = releaseConfigRoot(), cwd = process.env.INIT_CWD || process.cwd(), configPath, env = process.env, envOverrides: allowEnv = false } = {}) {
-  const explicit = configPath || (allowEnv ? env.PROXY_DESKTOP_RELEASE_CONFIG : '')
-  const selected = explicit
-    ? resolve(cwd, explicit)
-    : await firstExisting(defaultConfigPaths({ root, cwd }))
-  let fileConfig = {}
-  if (selected) {
-    try {
-      fileConfig = JSON.parse(await readFile(selected, 'utf8'))
-    } catch (error) {
-      // JSON parser errors may contain excerpts from the key. Never echo them.
-      throw new Error(`无法读取发布配置 ${selected}: ${error.code || 'invalid JSON'}`)
-    }
-  } else if (explicit) {
-    throw new Error(`发布配置不存在: ${selected}`)
-  }
-  const values = { ...DEFAULT_RELEASE_CONFIG, ...flattenConfig(fileConfig), ...(allowEnv ? envOverrides(env) : {}) }
-  const configDirectory = selected ? dirname(selected) : root
-  for (const field of ['releaseDirs', 'recordPaths']) {
-    if (!Array.isArray(values[field]) || values[field].some(path => typeof path !== 'string' || !path.trim())) throw new Error(`发布配置 release.${field === 'releaseDirs' ? 'directories' : 'records'} 必须是路径数组`)
-    values[field] = values[field].map(path => resolve(configDirectory, path))
-  }
-  if (allowEnv) {
-    if (env.PROXY_DESKTOP_PLATFORM) values.buildTarget.platform = env.PROXY_DESKTOP_PLATFORM
-    if (env.PROXY_DESKTOP_ARCH) values.buildTarget.arch = env.PROXY_DESKTOP_ARCH
-  }
-  return { ...values, path: selected }
-}
-
-export function validateReleaseConfig(config, { requireUpdateURL = false, requirePublish = false } = {}) {
-  const updateURL = stringValue(config?.updateURL)
-  const channel = stringValue(config?.updateChannel || 'latest')
-  if (requireUpdateURL && !updateURL) throw new Error('发布配置缺少 update.url')
-  if (updateURL) {
-    let parsed
-    const resolved = updateURL.replaceAll('{platform}', 'darwin').replaceAll('{arch}', 'arm64')
-    try { parsed = new URL(resolved) } catch { throw new Error('发布配置 update.url 必须是 HTTPS 或本机回环 HTTP 地址') }
-    if (!isAllowedReleaseURL(resolved)) throw new Error('发布配置 update.url 必须是无凭据、无查询参数的 HTTPS 或本机回环 HTTP 地址')
-  }
-  if (!['latest', 'beta'].includes(channel)) throw new Error('发布配置 update.channel 必须是 latest 或 beta')
-  if (requirePublish) {
-    let parsed
-    const apiURL = stringValue(config?.apiURL)
-    try { parsed = new URL(apiURL) } catch { throw new Error('发布配置 release.apiUrl 必须是 HTTPS 或本机回环 HTTP 地址') }
-    if (!isAllowedReleaseURL(apiURL)) throw new Error('发布配置 release.apiUrl 必须是无凭据、无查询参数的 HTTPS 或本机回环 HTTP 地址')
-    if (!stringValue(config?.apiKey)) throw new Error('发布配置 release.apiKey 不能为空')
-  }
-  return { ...config, updateURL, updateChannel: channel }
-}
-
-export function releaseConfigRoot() {
-  return join(dirname(fileURLToPath(import.meta.url)), '..')
-}

package/release-runtime/release-target.mjs

@@ -1,48 +0,0 @@
-import { isAllowedReleaseURL } from './release-config.mjs'
-
-const platforms = new Map([
-  ['--mac', 'darwin'], ['--macos', 'darwin'], ['-m', 'darwin'],
-  ['--win', 'win32'], ['--windows', 'win32'], ['-w', 'win32'],
-  ['--linux', 'linux'], ['-l', 'linux'],
-])
-const architectures = new Set(['x64', 'arm64', 'ia32'])
-
-// An update feed is specific to one OS/CPU. Build each target separately so
-// the packaged feed and the generated release record always describe its bytes.
-export function releaseTarget(args, host = process) {
-  const requestedPlatforms = new Set()
-  const requestedArchitectures = new Set()
-  for (let i = 0; i < args.length; i += 1) {
-    const value = args[i]
-    const platformFlag = value.split('=')[0]
-    if (platforms.has(platformFlag)) requestedPlatforms.add(platforms.get(platformFlag))
-    if (value === '--armv7l') throw new Error('Unsupported release architecture: armv7l')
-    if (value === '--universal') throw new Error('Release builds require a separate arm64 or x64 package; --universal is unsupported')
-    const arch = value === '--arch' ? args[++i] : value.replace(/^--(?:arch=)?/, '')
-    if (architectures.has(arch)) requestedArchitectures.add(arch)
-    else if (value === '--arch' || value.startsWith('--arch=')) throw new Error(`Unsupported release architecture: ${arch}`)
-  }
-  if (requestedPlatforms.size > 1 || requestedArchitectures.size > 1) {
-    throw new Error('Build one platform and architecture at a time; publish their release records together')
-  }
-  const platform = [...requestedPlatforms][0] || host.platform
-  const arch = [...requestedArchitectures][0] || host.arch
-  if (!['darwin', 'win32', 'linux'].includes(platform) || !architectures.has(arch) || (platform === 'darwin' && arch === 'ia32')) {
-    throw new Error(`Unsupported release target: ${platform}/${arch}`)
-  }
-  return { platform, arch }
-}
-
-export function releaseFeedURL(value, target) {
-  const resolved = String(value || '').trim().replaceAll('{platform}', target.platform).replaceAll('{arch}', target.arch).replace(/\/+$/, '')
-  let url
-  try { url = new URL(resolved) } catch { throw new Error('发布配置 update.url 必须是 HTTPS 或本机回环 HTTP 更新目录地址') }
-  if (!isAllowedReleaseURL(resolved)) {
-    throw new Error('发布配置 update.url 必须是无凭据、无查询参数或片段的 HTTPS 或本机回环 HTTP 更新目录地址')
-  }
-  const routeTarget = /\/(darwin|win32|linux)\/(arm64|x64|ia32)$/.exec(url.pathname)
-  if (routeTarget && (routeTarget[1] !== target.platform || routeTarget[2] !== target.arch)) {
-    throw new Error(`Update URL target does not match ${target.platform}/${target.arch}; use {platform}/{arch} placeholders`)
-  }
-  return resolved
-}