@dyyz1993/create-agent 2.0.0 → 2.0.1

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@dyyz1993/create-agent",
-	"version": "2.0.0",
+	"version": "2.0.1",
 	"description": "Create Agent project scaffolding CLI",
 	"repository": {
 		"type": "git",

package/src/lib/copy.ts

@@ -1,4 +1,4 @@
-import { readFileSync, writeFileSync, mkdirSync, existsSync, readdirSync } from "fs";
+import { readFileSync, writeFileSync, mkdirSync, existsSync, readdirSync, unlinkSync } from "fs";
 import { join, resolve } from "path";
 import { execSync } from "child_process";
 
@@ -73,6 +73,11 @@ function copySharedModules(monorepoRoot: string, targetDir: string, projectName:
 	const destSharedDir = join(targetDir, "shared");
 	copyAndReplace(sharedDir, destSharedDir, projectName);
 
+	for (const f of ["http-routes.ts", "logger.ts"]) {
+		const p = join(destSharedDir, f);
+		if (existsSync(p)) unlinkSync(p);
+	}
+
 	const tsconfigPath = join(targetDir, "tsconfig.json");
 	if (existsSync(tsconfigPath)) {
 		let tsconfig = readFileSync(tsconfigPath, "utf-8");
@@ -224,6 +229,23 @@ export async function copyTemplate(options: CopyOptions): Promise<void> {
 	if (isMonorepo) {
 		copyTraeRules(localRoot, targetDir, projectName);
 		copySharedModules(localRoot, targetDir, projectName);
+	} else {
+		const publishedShared = resolve(import.meta.dir, "..", "..", "templates", "shared");
+		if (existsSync(publishedShared)) {
+			copyAndReplace(publishedShared, join(targetDir, "shared"), projectName);
+			for (const f of ["http-routes.ts", "logger.ts"]) {
+				const p = join(targetDir, "shared", f);
+				if (existsSync(p)) unlinkSync(p);
+			}
+			const tsconfigPath = join(targetDir, "tsconfig.json");
+			if (existsSync(tsconfigPath)) {
+				let tsconfig = readFileSync(tsconfigPath, "utf-8");
+				tsconfig = tsconfig.replace(/"\.\.\/shared\/\*"/g, '"./shared/*"');
+				tsconfig = tsconfig.replace(/"\.\.\/shared"/g, '"./shared"');
+				writeFileSync(tsconfigPath, tsconfig);
+			}
+			cleanSharedViteConfig(join(targetDir, "shared"));
+		}
 	}
 	cleanViteConfig(targetDir);
 	updatePackageJson(targetDir, projectName);

package/templates/agent/eslint.config.mjs

@@ -1,6 +1,9 @@
 import js from '@eslint/js';
 import tseslint from 'typescript-eslint';
-import rpcPlugin from './eslint-plugin-rpc/index.js';
+import rpcPlugin from '@dyyz1993/eslint-plugin-rpc';
+import reactHooks from 'eslint-plugin-react-hooks';
+import reactRefresh from 'eslint-plugin-react-refresh';
+import jsxA11y from 'eslint-plugin-jsx-a11y';
 
 export default tseslint.config(
   js.configs.recommended,
@@ -10,7 +13,6 @@ export default tseslint.config(
       'node_modules/**',
       'build/**',
       'dist/**',
-      'eslint-plugin-rpc/**',
       'postcss.config.js',
       'tailwind.config.js',
     ],
@@ -19,8 +21,19 @@ export default tseslint.config(
     files: ['src/**/*.{ts,tsx}'],
     plugins: {
       rpc: rpcPlugin,
+      'react-hooks': reactHooks,
+      'react-refresh': reactRefresh,
+      'jsx-a11y': jsxA11y,
     },
     rules: {
+      ...reactHooks.configs.recommended.rules,
+      'react-hooks/rules-of-hooks': 'warn',
+      'react-hooks/exhaustive-deps': 'warn',
+      'react-refresh/only-export-components': ['warn', { allowConstantExport: true }],
+      ...jsxA11y.configs.recommended.rules,
+      'jsx-a11y/click-events-have-key-events': 'warn',
+      'jsx-a11y/no-static-element-interactions': 'warn',
+      'jsx-a11y/no-autofocus': 'warn',
       // TS 严格规则
       '@typescript-eslint/no-explicit-any': 'error',
       '@typescript-eslint/no-empty-object-type': ['error', { allowObjectTypes: 'always', allowInterfaces: 'with-single-extends' }],

package/templates/agent/package.json

@@ -9,6 +9,9 @@
 		"dev:server": "bun src/server.ts",
 		"build": "vite build",
 		"build:canary": "vite build && electrobun build --env=canary",
+		"build:mac": "vite build && electrobun build --env=canary",
+		"build:win": "vite build && electrobun build --env=canary",
+		"build:linux": "vite build && electrobun build --env=canary",
 		"lint": "eslint .",
 		"lint:fix": "eslint . --fix",
 		"test": "vitest run",
@@ -19,7 +22,7 @@
 	"dependencies": {
 		"@dyyz1993/rpc-core": "^1.2.0",
 		"@tanstack/react-virtual": "^3.13.24",
-		"electrobun": "1.13.1",
+		"electrobun": "1.18.1",
 		"lucide-react": "^1.9.0",
 		"prism-react-renderer": "^2.4.1",
 		"react": "^18.3.1",
@@ -33,7 +36,8 @@
 		"zustand": "^5.0.12"
 	},
 	"devDependencies": {
-			"@eslint/js": "^9.0.0",
+		"@dyyz1993/eslint-plugin-rpc": "workspace:*",
+		"@eslint/js": "^9.0.0",
 		"@testing-library/jest-dom": "^6.9.1",
 		"@testing-library/react": "^16.3.2",
 		"@testing-library/user-event": "^14.6.1",
@@ -41,10 +45,14 @@
 		"@types/react": "^18.3.12",
 		"@types/react-dom": "^18.3.1",
 		"@types/ws": "^8.18.1",
+		"ws": "^8.18.0",
 		"@vitejs/plugin-react": "^4.3.4",
 		"autoprefixer": "^10.4.20",
 		"concurrently": "^9.1.0",
 		"eslint": "^9.0.0",
+		"eslint-plugin-jsx-a11y": "^6.10.0",
+		"eslint-plugin-react-hooks": "^5.2.0",
+		"eslint-plugin-react-refresh": "^0.4.20",
 		"happy-dom": "^20.9.0",
 		"husky": "^9.1.0",
 		"jsdom": "^29.1.1",

package/templates/agent/src/__tests__/hybrid-mode.test.ts

@@ -0,0 +1,126 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+
+vi.mock("electrobun/bun", () => ({
+	BrowserWindow: {
+		defineRPC: vi.fn(() => ({})),
+	},
+	BrowserView: {
+		defineRPC: vi.fn(() => ({
+			requests: {},
+			messages: {},
+		})),
+	},
+	Updater: {
+		localInfo: vi.fn(() => ({ channel: vi.fn(() => "dev") })),
+	},
+	ApplicationMenu: {
+		setApplicationMenu: vi.fn(),
+	},
+}));
+
+vi.mock("electrobun", () => ({}));
+
+describe("混合模式", () => {
+	beforeEach(() => {
+		vi.resetModules();
+		delete process.env.ENABLE_WEB_SERVICE;
+		delete process.env.AUTH_TOKEN;
+		process.env.NODE_ENV = "test";
+	});
+
+	afterEach(() => {
+		vi.restoreAllMocks();
+	});
+
+	it("默认不启动 Web 服务（enableWebService 为 false）", async () => {
+		const { config } = await import("../server-config");
+		expect(config.enableWebService).toBe(false);
+	});
+
+	it("enableWebService=true 时启动 HTTP + WS 服务", async () => {
+		process.env.ENABLE_WEB_SERVICE = "true";
+		const { config } = await import("../server-config");
+		expect(config.enableWebService).toBe(true);
+	});
+
+	it("IPC 和 WS 服务同时工作，状态隔离", async () => {
+		const { ElectrobunTransport } = await import("../gateway/ipc-transport");
+		const ipcTransport = new ElectrobunTransport();
+		expect(ipcTransport.isConnected()).toBe(false);
+
+		ipcTransport.setBrowserView({ executeJavascript: vi.fn() });
+		expect(ipcTransport.isConnected()).toBe(true);
+
+		const { createWebServer } = await import("../shared/lib/web-server");
+		const webServer = await createWebServer({
+			port: 0,
+			authToken: "test-token",
+			maxUploadSize: 1024,
+			corsOrigin: "*",
+		});
+		expect(webServer.port).toBeGreaterThan(0);
+		expect(ipcTransport.isConnected()).toBe(true);
+		await webServer.close();
+	});
+
+	it("WS 客户端需要 token 才能连接", async () => {
+		const { createWebServer } = await import("../shared/lib/web-server");
+		const webServer = await createWebServer({
+			port: 0,
+			authToken: "test-token",
+			maxUploadSize: 1024,
+			corsOrigin: "*",
+		});
+		expect(webServer.authToken).toBeTruthy();
+		expect(webServer.authToken.length).toBeGreaterThan(0);
+		await webServer.close();
+	});
+
+	it("IPC 客户端不需要 token", async () => {
+		const { ElectrobunTransport } = await import("../gateway/ipc-transport");
+		const transport = new ElectrobunTransport();
+		transport.setBrowserView({ executeJavascript: vi.fn() });
+		expect(transport.isConnected()).toBe(true);
+	});
+
+	it("动态生成的 token 每次启动不同", async () => {
+		const { createWebServer } = await import("../shared/lib/web-server");
+		const ws1 = await createWebServer({
+			port: 0,
+			authToken: `token-${Date.now()}-1`,
+			maxUploadSize: 1024,
+			corsOrigin: "*",
+		});
+		const ws2 = await createWebServer({
+			port: 0,
+			authToken: `token-${Date.now()}-2`,
+			maxUploadSize: 1024,
+			corsOrigin: "*",
+		});
+		expect(ws1.authToken).not.toBe(ws2.authToken);
+		await ws1.close();
+		await ws2.close();
+	});
+
+	it("关闭桌面端时 Web 服务也关闭", async () => {
+		const { createWebServer } = await import("../shared/lib/web-server");
+		const webServer = await createWebServer({
+			port: 0,
+			authToken: "test-token",
+			maxUploadSize: 1024,
+			corsOrigin: "*",
+		});
+		expect(webServer.httpServer.listening).toBe(true);
+		await webServer.close();
+		await new Promise((r) => setTimeout(r, 50));
+		expect(webServer.httpServer.listening).toBe(false);
+	});
+
+	it("getLocalIP 返回有效 IP 地址", async () => {
+		const { getLocalIP } = await import("../shared/lib/web-server");
+		const ip = getLocalIP();
+		expect(ip).toBeTruthy();
+		// IPv4 pattern
+		expect(ip).toMatch(/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/);
+	});
+});

package/templates/agent/src/__tests__/server-config-security.test.ts

@@ -0,0 +1,55 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+
+describe("Server Config 安全策略", () => {
+	const originalEnv = process.env;
+
+	beforeEach(() => {
+		vi.resetModules();
+		process.env = { ...originalEnv };
+	});
+
+	afterEach(() => {
+		process.env = originalEnv;
+	});
+
+	it("生产环境未设 AUTH_TOKEN 应抛出致命错误", async () => {
+		process.env.NODE_ENV = "production";
+		delete process.env.AUTH_TOKEN;
+		await expect(import("../server-config")).rejects.toThrow(/AUTH_TOKEN/);
+	});
+
+	it("开发环境未设 AUTH_TOKEN 应自动生成随机 token", async () => {
+		process.env.NODE_ENV = "development";
+		delete process.env.AUTH_TOKEN;
+		const mod = await import("../server-config");
+		expect(mod.config.authToken).toBeTruthy();
+		expect(mod.config.authToken).not.toBe("pi-agent-template-token");
+		expect(mod.config.authToken.length).toBeGreaterThan(20);
+	});
+
+	it("显式设置 AUTH_TOKEN 应使用用户提供的值", async () => {
+		delete process.env.NODE_ENV;
+		process.env.AUTH_TOKEN = "my-custom-token-12345";
+		const mod = await import("../server-config");
+		expect(mod.config.authToken).toBe("my-custom-token-12345");
+	});
+
+	it("自动生成的 token 每次不同", async () => {
+		process.env.NODE_ENV = "development";
+		delete process.env.AUTH_TOKEN;
+		vi.resetModules();
+		const mod1 = await import("../server-config");
+		const token1 = mod1.config.authToken;
+		vi.resetModules();
+		const mod2 = await import("../server-config");
+		const token2 = mod2.config.authToken;
+		expect(token1).not.toBe(token2);
+	});
+
+	it("生产环境设了 AUTH_TOKEN 不应抛错", async () => {
+		process.env.NODE_ENV = "production";
+		process.env.AUTH_TOKEN = "production-secure-token";
+		const mod = await import("../server-config");
+		expect(mod.config.authToken).toBe("production-secure-token");
+	});
+});

package/templates/agent/src/bun/index.ts

@@ -9,18 +9,18 @@ configureLogDir("logs");
 const log = createLogger("server");
 
 async function getMainViewUrl(): Promise<string> {
-  const channel = await Updater.localInfo.channel();
-  const DEV_SERVER_URL = "http://localhost:5173";
-  if (channel === "dev") {
-    try {
-      await fetch(DEV_SERVER_URL, { method: "HEAD" });
-      log.info(`HMR enabled: Using Vite dev server at ${DEV_SERVER_URL}`);
-      return DEV_SERVER_URL;
-    } catch {
-      log.info("Vite dev server not running.");
-    }
-  }
-  return "views://mainview/index.html";
+	const channel = await Updater.localInfo.channel();
+	const DEV_SERVER_URL = "http://localhost:5173";
+	if (channel === "dev") {
+		try {
+			await fetch(DEV_SERVER_URL, { method: "HEAD" });
+			log.info(`HMR enabled: Using Vite dev server at ${DEV_SERVER_URL}`);
+			return DEV_SERVER_URL;
+		} catch {
+			log.info("Vite dev server not running.");
+		}
+	}
+	return "views://mainview/index.html";
 }
 
 const url = await getMainViewUrl();
@@ -34,40 +34,95 @@ registerAllHandlers(server, { platform: "desktop", enableBash: config.enableBash
 // --- 创建窗口 ---
 
 const mainWindow = new BrowserWindow({
-  title: "Pi Agent",
-  url,
-  frame: {
-    width: 1200,
-    height: 800,
-    x: 200,
-    y: 200,
-  },
-  rpc: BrowserView.defineRPC({
-    maxRequestTime: 60000,
-    handlers: {
-      requests: {},
-      messages: {
-        // @ts-expect-error Electrobun's messages schema doesn't support custom keys at compile time
-        "rpc-message": (data: unknown) => {
-          try {
-            const message = typeof data === "string" ? JSON.parse(data) : data;
-            transport.handleMessage(message);
-          } catch (error) {
-            log.error("Failed to parse RPC message", { error });
-          }
-        },
-      },
-    },
-  }),
+	title: "Pi Agent",
+	url,
+	frame: {
+		width: 1200,
+		height: 800,
+		x: 200,
+		y: 200,
+	},
+	rpc: BrowserView.defineRPC({
+		maxRequestTime: 60000,
+		handlers: {
+			requests: {},
+			messages: {
+				// @ts-expect-error Electrobun's messages schema doesn't support custom keys at compile time
+				"rpc-message": (data: unknown) => {
+					try {
+						const message = typeof data === "string" ? JSON.parse(data) : data;
+						transport.handleMessage(message);
+					} catch (error) {
+						log.error("Failed to parse RPC message", { error });
+					}
+				},
+			},
+		},
+	}),
 });
 
 transport.setBrowserView(mainWindow.webview);
 
 log.info("Pi Agent desktop app started!");
 
+// ==============================
+// Optional: Web service for LAN access (hybrid mode)
+// ==============================
+if (config.enableWebService) {
+	try {
+		const { createWebServer, getLocalIP } = await import("../shared/lib/web-server");
+
+		const webServer = await createWebServer({
+			port: config.port,
+			authToken: config.authToken,
+			maxUploadSize: config.maxUploadSize,
+			corsOrigin: "*",
+		});
+
+		const localIp = getLocalIP();
+		log.info(`[Hybrid] Web service started: http://${localIp}:${webServer.port}`);
+		log.info(`[Hybrid] WebSocket endpoint: ws://${localIp}:${webServer.port}/ws`);
+		log.info(
+			`[Hybrid] Share URL: http://${localIp}:${webServer.port}?token=${webServer.authToken}`
+		);
+
+		server.emitEvent("hybrid.ready", {
+			url: `http://${localIp}:${webServer.port}`,
+			wsUrl: `ws://${localIp}:${webServer.port}/ws`,
+			token: webServer.authToken,
+		});
+	} catch (err) {
+		log.error("[Hybrid] Failed to start web service", {
+			error: err instanceof Error ? err.message : String(err),
+		});
+	}
+}
+
 ApplicationMenu.setApplicationMenu([
-  { label: "Pi Agent", submenu: [{ role: "about" }, { type: "separator" }, { role: "hide" }, { role: "hideOthers" }, { role: "showAll" }, { type: "separator" }, { role: "quit" }] },
-  { label: "Edit", submenu: [{ role: "undo" }, { role: "redo" }, { type: "separator" }, { role: "cut" }, { role: "copy" }, { role: "paste" }, { role: "selectAll" }] },
-  { label: "View", submenu: [{ role: "toggleFullScreen" }] },
-  { label: "Window", submenu: [{ role: "minimize" }, { role: "zoom" }] },
+	{
+		label: "Pi Agent",
+		submenu: [
+			{ role: "about" },
+			{ type: "separator" },
+			{ role: "hide" },
+			{ role: "hideOthers" },
+			{ role: "showAll" },
+			{ type: "separator" },
+			{ role: "quit" },
+		],
+	},
+	{
+		label: "Edit",
+		submenu: [
+			{ role: "undo" },
+			{ role: "redo" },
+			{ type: "separator" },
+			{ role: "cut" },
+			{ role: "copy" },
+			{ role: "paste" },
+			{ role: "selectAll" },
+		],
+	},
+	{ label: "View", submenu: [{ role: "toggleFullScreen" }] },
+	{ label: "Window", submenu: [{ role: "minimize" }, { role: "zoom" }] },
 ]);

package/templates/agent/src/bun/three.d.ts

@@ -0,0 +1 @@
+declare module "three";

package/templates/agent/src/gateway/__tests__/ws-handler-token.test.ts

@@ -0,0 +1,118 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { EventEmitter } from "events";
+
+vi.mock("../../shared/register-all-handlers", () => ({
+	registerAllHandlers: vi.fn(),
+}));
+
+vi.mock("../../shared/lib/logger", () => ({
+	createLogger: () => ({
+		info: vi.fn(),
+		error: vi.fn(),
+		warn: vi.fn(),
+		debug: vi.fn(),
+	}),
+}));
+
+const MOCK_AUTH_TOKEN = "test-secure-token-123456";
+
+function createMockWs() {
+	const ws = new EventEmitter();
+	(ws as any).readyState = 1;
+	(ws as any).close = vi.fn();
+	(ws as any).send = vi.fn();
+	(ws as any).ping = vi.fn();
+	return ws;
+}
+
+function createMockReq(url: string, headers: Record<string, string> = {}) {
+	return { url, headers };
+}
+
+describe("WS Handler Token 安全", () => {
+	let _wssInstance: EventEmitter & { clients: Set<any> };
+
+	beforeEach(async () => {
+		vi.resetModules();
+
+		const { WebSocketServer } = await import("ws");
+		const _originalWSS = WebSocketServer;
+
+		vi.doMock("ws", () => {
+			class MockWSS extends EventEmitter {
+				clients = new Set();
+				constructor(_opts: any) {
+					super();
+					// eslint-disable-next-line @typescript-eslint/no-this-alias
+					_wssInstance = this;
+				}
+			}
+			return { WebSocketServer: MockWSS, WebSocket: { OPEN: 1 } };
+		});
+	});
+
+	async function setupTest() {
+		const { createWsHandler } = await import("../ws-handler");
+		const httpServer = new EventEmitter();
+		const wss = createWsHandler(httpServer as any, {
+			config: { port: 3100, authToken: MOCK_AUTH_TOKEN, maxUploadSize: 50 * 1024 * 1024 },
+		});
+		return wss;
+	}
+
+	function emitConnection(wss: any, ws: any, req: any) {
+		wss.emit("connection", ws, req);
+	}
+
+	it("无 token 应被拒绝 (4001)", async () => {
+		const wss = await setupTest();
+		const ws = createMockWs();
+		const req = createMockReq("/ws");
+		emitConnection(wss, ws, req);
+		expect((ws as any).close).toHaveBeenCalledWith(4001, "Unauthorized");
+	});
+
+	it("错误 token 应被拒绝 (4001)", async () => {
+		const wss = await setupTest();
+		const ws = createMockWs();
+		const req = createMockReq("/ws?token=wrong-token");
+		emitConnection(wss, ws, req);
+		expect((ws as any).close).toHaveBeenCalledWith(4001, "Unauthorized");
+	});
+
+	it("正确 token 通过 URL query 应被接受", async () => {
+		const wss = await setupTest();
+		const ws = createMockWs();
+		const req = createMockReq(`/ws?token=${MOCK_AUTH_TOKEN}`);
+		emitConnection(wss, ws, req);
+		expect((ws as any).close).not.toHaveBeenCalled();
+	});
+
+	it("正确 token 通过 Sec-WebSocket-Protocol header 应被接受", async () => {
+		const wss = await setupTest();
+		const ws = createMockWs();
+		const req = createMockReq("/ws", {
+			"sec-websocket-protocol": MOCK_AUTH_TOKEN,
+		});
+		emitConnection(wss, ws, req);
+		expect((ws as any).close).not.toHaveBeenCalled();
+	});
+
+	it("header 方式优先于 query 方式 (header 正确, query 错误)", async () => {
+		const wss = await setupTest();
+		const ws = createMockWs();
+		const req = createMockReq("/ws?token=wrong-token", {
+			"sec-websocket-protocol": MOCK_AUTH_TOKEN,
+		});
+		emitConnection(wss, ws, req);
+		expect((ws as any).close).not.toHaveBeenCalled();
+	});
+
+	it("token 验证使用 timingSafeEqual（长度不等返回 false）", async () => {
+		const wss = await setupTest();
+		const ws = createMockWs();
+		const req = createMockReq(`/ws?token=short`);
+		emitConnection(wss, ws, req);
+		expect((ws as any).close).toHaveBeenCalledWith(4001, "Unauthorized");
+	});
+});

package/templates/agent/src/gateway/http-routes.ts

@@ -1 +1 @@
-export { createHttpHandler, type HttpRouteDeps } from "@shared/http-routes";
+export { createHttpHandler, type HttpRouteDeps } from "../shared/http-routes";