@dyyz1993/create-agent 2.0.0 → 2.1.0

package/templates/agent/src/shared/handlers/todo.ts

@@ -4,42 +4,42 @@ import type { RPCMethods, HandlerOptions } from "../rpc-schema";
 import type { TodoItem, TodoStatus } from "../modules/todo";
 
 type RegisterFn = <K extends keyof RPCMethods & string>(
-  method: K,
-  handler: (params: MethodParams<RPCMethods, K>) => Promise<MethodResult<RPCMethods, K>>,
+	method: K,
+	handler: (params: MethodParams<RPCMethods, K>) => Promise<MethodResult<RPCMethods, K>>
 ) => void;
 
-const items: TodoItem[] = [];
-let todoIdCounter = 1;
-
 export function register(server: RPCServer, _options: HandlerOptions): void {
-  const r: RegisterFn = (method, handler) => {
-    server.register(method, handler as (params: unknown) => Promise<unknown>);
-  };
+	const items: TodoItem[] = [];
+	let todoIdCounter = 1;
+
+	const r: RegisterFn = (method, handler) => {
+		server.register(method, handler as (params: unknown) => Promise<unknown>);
+	};
 
-  r("todo.list", async () => ({ items }));
+	r("todo.list", async () => ({ items }));
 
-  r("todo.add", async (params) => {
-    const item: TodoItem = {
-      id: `todo-${todoIdCounter++}`,
-      content: params.content,
-      status: "pending",
-      createdAt: Date.now(),
-    };
-    items.push(item);
-    return { item };
-  });
+	r("todo.add", async (params) => {
+		const item: TodoItem = {
+			id: `todo-${todoIdCounter++}`,
+			content: params.content,
+			status: "pending",
+			createdAt: Date.now(),
+		};
+		items.push(item);
+		return { item };
+	});
 
-  r("todo.update", async (params) => {
-    const item = items.find((i) => i.id === params.id);
-    if (!item) throw new Error(`Todo ${params.id} not found`);
-    item.status = params.status as TodoStatus;
-    return { item };
-  });
+	r("todo.update", async (params) => {
+		const item = items.find((i) => i.id === params.id);
+		if (!item) throw new Error(`Todo ${params.id} not found`);
+		item.status = params.status as TodoStatus;
+		return { item };
+	});
 
-  r("todo.remove", async (params) => {
-    const idx = items.findIndex((i) => i.id === params.id);
-    if (idx === -1) return { success: false };
-    items.splice(idx, 1);
-    return { success: true };
-  });
+	r("todo.remove", async (params) => {
+		const idx = items.findIndex((i) => i.id === params.id);
+		if (idx === -1) return { success: false };
+		items.splice(idx, 1);
+		return { success: true };
+	});
 }

package/templates/agent/src/shared/http-routes.ts

@@ -0,0 +1,250 @@
+/**
+ * HTTP route handlers for the web gateway.
+ * Handles: /health, /info/{path}, /file/{path}, /file/upload
+ */
+
+import type { IncomingMessage, ServerResponse } from "http";
+import { stat, readFile, writeFile, mkdir } from "fs/promises";
+import { existsSync } from "fs";
+import { extname, basename, dirname, resolve } from "path";
+import { timingSafeEqual } from "crypto";
+import { createLogger } from "./lib/logger";
+
+const log = createLogger("gateway");
+
+function safeEqual(a: string, b: string): boolean {
+	const bufA = Buffer.from(a);
+	const bufB = Buffer.from(b);
+	if (bufA.length !== bufB.length) return false;
+	return timingSafeEqual(bufA, bufB);
+}
+
+const MIME_TYPES: Record<string, string> = {
+	".html": "text/html",
+	".css": "text/css",
+	".js": "application/javascript",
+	".json": "application/json",
+	".png": "image/png",
+	".jpg": "image/jpeg",
+	".jpeg": "image/jpeg",
+	".gif": "image/gif",
+	".svg": "image/svg+xml",
+	".ico": "image/x-icon",
+	".txt": "text/plain",
+	".md": "text/markdown",
+	".ts": "text/plain",
+	".tsx": "text/plain",
+	".py": "text/plain",
+	".pdf": "application/pdf",
+	".zip": "application/zip",
+	".mp4": "video/mp4",
+	".mp3": "audio/mpeg",
+	".wav": "audio/wav",
+};
+
+const ALLOWED_ROOTS = [resolve(process.cwd())];
+function isPathAllowed(requestedPath: string): boolean {
+	const resolved = resolve(requestedPath);
+	return ALLOWED_ROOTS.some((root) => resolved === root || resolved.startsWith(root + "/"));
+}
+
+function verifyToken(req: IncomingMessage, authToken: string): boolean {
+	const auth = req.headers["authorization"];
+	if (auth && safeEqual(auth, `Bearer ${authToken}`)) return true;
+
+	if (req.url) {
+		try {
+			const url = new URL(req.url, "http://localhost");
+			const token = url.searchParams.get("token");
+			if (token && safeEqual(token, authToken)) return true;
+		} catch {
+			/* invalid URL */
+		}
+	}
+	return false;
+}
+
+export interface HttpRouteDeps {
+	config: {
+		readonly port: number;
+		readonly authToken: string;
+		readonly maxUploadSize: number;
+		readonly corsOrigin: string;
+	};
+	getWebSocketClientCount: () => number;
+}
+
+export function createHttpHandler(
+	deps: HttpRouteDeps
+): (req: IncomingMessage, res: ServerResponse) => void {
+	const { config: cfg, getWebSocketClientCount } = deps;
+
+	return async (req, res) => {
+		res.setHeader("Access-Control-Allow-Origin", cfg.corsOrigin);
+		res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
+		res.setHeader("Access-Control-Allow-Headers", "Authorization, Range, Content-Type");
+		if (req.method === "OPTIONS") {
+			res.writeHead(204).end();
+			return;
+		}
+
+		if (!req.url) {
+			res.writeHead(400).end();
+			return;
+		}
+
+		const url = new URL(req.url, "http://localhost");
+
+		if (url.pathname === "/health") {
+			res.writeHead(200, { "Content-Type": "application/json" });
+			res.end(JSON.stringify({ status: "ok", clients: getWebSocketClientCount() }));
+			return;
+		}
+
+		if (!verifyToken(req, cfg.authToken)) {
+			log.warn("Auth failed", { path: url.pathname });
+			res.writeHead(401, { "Content-Type": "application/json" });
+			res.end(JSON.stringify({ error: "Unauthorized" }));
+			return;
+		}
+
+		if (url.pathname.startsWith("/info/")) {
+			await handleFileInfo(url.pathname.slice(6), res);
+			return;
+		}
+
+		if (url.pathname.startsWith("/file/")) {
+			if (url.pathname === "/file/upload" && req.method === "POST") {
+				await handleFileUpload(req, url.searchParams.get("path"), res, cfg.maxUploadSize);
+				return;
+			}
+			await handleFileContent(url.pathname.slice(6), req, res);
+			return;
+		}
+
+		res.writeHead(404);
+		res.end();
+	};
+}
+
+async function handleFileInfo(encodedPath: string, res: ServerResponse): Promise<void> {
+	const filePath = decodeURIComponent(encodedPath);
+	if (!isPathAllowed(filePath)) {
+		res.writeHead(403, { "Content-Type": "application/json" });
+		res.end(JSON.stringify({ error: "Path not allowed" }));
+		return;
+	}
+	try {
+		const s = await stat(filePath);
+		res.writeHead(200, { "Content-Type": "application/json" });
+		res.end(
+			JSON.stringify({
+				name: basename(filePath),
+				path: filePath,
+				size: s.size,
+				isDirectory: s.isDirectory(),
+				modified: s.mtime.toISOString(),
+				mimeType: s.isFile()
+					? MIME_TYPES[extname(filePath)] || "application/octet-stream"
+					: undefined,
+			})
+		);
+	} catch {
+		res.writeHead(404, { "Content-Type": "application/json" });
+		res.end(JSON.stringify({ error: "File not found" }));
+	}
+}
+
+async function handleFileContent(
+	encodedPath: string,
+	req: IncomingMessage,
+	res: ServerResponse
+): Promise<void> {
+	const filePath = decodeURIComponent(encodedPath);
+	if (!isPathAllowed(filePath)) {
+		res.writeHead(403, { "Content-Type": "application/json" });
+		res.end(JSON.stringify({ error: "Path not allowed" }));
+		return;
+	}
+	try {
+		if (!existsSync(filePath)) {
+			res.writeHead(404, { "Content-Type": "application/json" });
+			res.end(JSON.stringify({ error: "File not found" }));
+			return;
+		}
+		const s = await stat(filePath);
+		const mimeType = MIME_TYPES[extname(filePath)] || "application/octet-stream";
+
+		const range = req.headers["range"];
+		if (range) {
+			const parts = range.replace(/bytes=/, "").split("-");
+			const start = parseInt(parts[0]!, 10);
+			const end = parts[1] ? parseInt(parts[1], 10) : s.size - 1;
+			const chunkSize = end - start + 1;
+
+			res.writeHead(206, {
+				"Content-Range": `bytes ${start}-${end}/${s.size}`,
+				"Accept-Ranges": "bytes",
+				"Content-Length": chunkSize,
+				"Content-Type": mimeType,
+			});
+			const buffer = await readFile(filePath);
+			res.end(buffer.subarray(start, end + 1));
+		} else {
+			res.writeHead(200, {
+				"Content-Length": s.size,
+				"Content-Type": mimeType,
+				"Accept-Ranges": "bytes",
+			});
+			const buffer = await readFile(filePath);
+			res.end(buffer);
+		}
+		log.info("File served", { path: filePath });
+	} catch {
+		res.writeHead(500, { "Content-Type": "application/json" });
+		res.end(JSON.stringify({ error: "Failed to read file" }));
+	}
+}
+
+async function handleFileUpload(
+	req: IncomingMessage,
+	destPath: string | null,
+	res: ServerResponse,
+	maxUploadSize: number
+): Promise<void> {
+	if (!destPath) {
+		res.writeHead(400, { "Content-Type": "application/json" });
+		res.end(JSON.stringify({ error: "Missing path parameter" }));
+		return;
+	}
+	if (!isPathAllowed(destPath)) {
+		res.writeHead(403, { "Content-Type": "application/json" });
+		res.end(JSON.stringify({ error: "Path not allowed" }));
+		return;
+	}
+	const contentLength = parseInt(req.headers["content-length"] || "0", 10);
+	if (contentLength > maxUploadSize) {
+		res.writeHead(413, { "Content-Type": "application/json" });
+		res.end(JSON.stringify({ error: `File too large, max ${maxUploadSize / 1024 / 1024}MB` }));
+		return;
+	}
+	try {
+		const chunks: Uint8Array[] = [];
+		for await (const chunk of req) {
+			const bytes =
+				typeof chunk === "string"
+					? new TextEncoder().encode(chunk)
+					: new Uint8Array(chunk as ArrayBuffer);
+			chunks.push(bytes);
+		}
+		const body = Buffer.concat(chunks);
+		await mkdir(dirname(destPath), { recursive: true });
+		await writeFile(destPath, body);
+		log.info("File uploaded", { path: destPath, size: body.length });
+		res.writeHead(200, { "Content-Type": "application/json" });
+		res.end(JSON.stringify({ ok: true, path: destPath, size: body.length }));
+	} catch (err) {
+		res.writeHead(500, { "Content-Type": "application/json" });
+		res.end(JSON.stringify({ error: err instanceof Error ? err.message : "Upload failed" }));
+	}
+}

package/templates/agent/src/shared/lib/__tests__/web-server.test.ts

@@ -0,0 +1,190 @@
+import { describe, it, expect, afterEach } from "vitest";
+import http from "http";
+import { WebSocket } from "ws";
+import {
+	createWebServer,
+	getLocalIP,
+	findAvailablePort,
+	type WebServerResult,
+} from "../web-server";
+
+function httpGet(url: string): Promise<{ status: number; body: string }> {
+	return new Promise((resolve, reject) => {
+		http
+			.get(url, (res) => {
+				let data = "";
+				res.on("data", (chunk) => {
+					data += chunk;
+				});
+				res.on("end", () => resolve({ status: res.statusCode ?? 0, body: data }));
+			})
+			.on("error", reject);
+	});
+}
+
+describe("createWebServer 工厂函数", () => {
+	let webServer: WebServerResult | null = null;
+
+	afterEach(async () => {
+		if (webServer) {
+			await webServer.close();
+			webServer = null;
+		}
+	});
+
+	it("应返回 httpServer + wss + port + authToken", async () => {
+		webServer = await createWebServer({
+			port: 0,
+			authToken: "test-token-001",
+			maxUploadSize: 1024,
+			corsOrigin: "*",
+		});
+
+		expect(webServer.httpServer).toBeDefined();
+		expect(webServer.wss).toBeDefined();
+		expect(webServer.port).toBeGreaterThan(0);
+		expect(webServer.authToken).toBe("test-token-001");
+		expect(typeof webServer.close).toBe("function");
+	});
+
+	it("应启动 HTTP 服务并监听指定端口", async () => {
+		const testServer = http.createServer();
+		const port = await new Promise<number>((resolve) => {
+			testServer.listen(0, () => {
+				const addr = testServer.address();
+				resolve(typeof addr === "object" && addr ? addr.port : 3100);
+			});
+		});
+		await new Promise<void>((resolve) => testServer.close(() => resolve()));
+
+		webServer = await createWebServer({
+			port,
+			authToken: "test-token-002",
+			maxUploadSize: 1024,
+			corsOrigin: "*",
+		});
+
+		expect(webServer.port).toBe(port);
+
+		const { status, body } = await httpGet(`http://localhost:${webServer.port}/health`);
+		expect(status).toBe(200);
+		const json = JSON.parse(body);
+		expect(json.status).toBe("ok");
+	});
+
+	it("端口冲突时应自动递增到可用端口", async () => {
+		const blocker = http.createServer();
+		const blockerPort = await new Promise<number>((resolve) => {
+			blocker.listen(0, () => {
+				const addr = blocker.address();
+				resolve(typeof addr === "object" && addr ? addr.port : 3100);
+			});
+		});
+
+		webServer = await createWebServer({
+			port: blockerPort,
+			authToken: "test-token-003",
+			maxUploadSize: 1024,
+			corsOrigin: "*",
+		});
+
+		expect(webServer.port).not.toBe(blockerPort);
+		expect(webServer.port).toBeGreaterThan(blockerPort);
+
+		await new Promise<void>((resolve) => blocker.close(() => resolve()));
+	});
+
+	it("WS 客户端应能通过 token 连接", async () => {
+		webServer = await createWebServer({
+			port: 0,
+			authToken: "test-token-004",
+			maxUploadSize: 1024,
+			corsOrigin: "*",
+		});
+
+		const ws = new WebSocket(`ws://localhost:${webServer.port}/ws?token=${webServer.authToken}`);
+
+		await new Promise<void>((resolve, reject) => {
+			ws.on("open", () => {
+				ws.close();
+				resolve();
+			});
+			ws.on("error", reject);
+		});
+	});
+
+	it("无 token 的 WS 连接应被拒绝", async () => {
+		webServer = await createWebServer({
+			port: 0,
+			authToken: "test-token-005",
+			maxUploadSize: 1024,
+			corsOrigin: "*",
+		});
+
+		const ws = new WebSocket(`ws://localhost:${webServer.port}/ws`);
+
+		const closeCode = await new Promise<number>((resolve) => {
+			ws.on("close", (code) => resolve(code));
+			ws.on("error", () => {});
+		});
+		expect(closeCode).toBe(4001);
+	});
+
+	it("HTTP 请求需要 token 才能访问文件路由", async () => {
+		webServer = await createWebServer({
+			port: 0,
+			authToken: "test-token-006",
+			maxUploadSize: 1024,
+			corsOrigin: "*",
+		});
+
+		const { status } = await httpGet(`http://localhost:${webServer.port}/info/some/path`);
+		expect(status).toBe(401);
+	});
+
+	it("health 端点不需要 token", async () => {
+		webServer = await createWebServer({
+			port: 0,
+			authToken: "test-token-007",
+			maxUploadSize: 1024,
+			corsOrigin: "*",
+		});
+
+		const { status, body } = await httpGet(`http://localhost:${webServer.port}/health`);
+		expect(status).toBe(200);
+		const json = JSON.parse(body);
+		expect(json).toHaveProperty("status", "ok");
+		expect(json).toHaveProperty("clients");
+	});
+
+	it("关闭 webServer 应停止 HTTP 和 WS 服务", async () => {
+		webServer = await createWebServer({
+			port: 0,
+			authToken: "test-token-008",
+			maxUploadSize: 1024,
+			corsOrigin: "*",
+		});
+
+		const port = webServer.port;
+		await webServer.close();
+		webServer = null;
+
+		await expect(httpGet(`http://localhost:${port}/health`)).rejects.toThrow();
+	});
+});
+
+describe("getLocalIP", () => {
+	it("应返回非空字符串", () => {
+		const ip = getLocalIP();
+		expect(typeof ip).toBe("string");
+		expect(ip.length).toBeGreaterThan(0);
+		expect(ip).toMatch(/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/);
+	});
+});
+
+describe("findAvailablePort", () => {
+	it("应返回一个可用端口", async () => {
+		const port = await findAvailablePort(40000);
+		expect(port).toBeGreaterThanOrEqual(40000);
+	});
+});

package/templates/agent/src/shared/lib/bash-security.ts

@@ -1,64 +1,64 @@
 export interface CommandPolicy {
-  enabled: boolean;
-  blockedPatterns: RegExp[];
-  allowedCommands: string[] | null;
+	enabled: boolean;
+	blockedPatterns: RegExp[];
+	allowedCommands: string[] | null;
 }
 
 let policy: CommandPolicy = {
-  enabled: true,
-  blockedPatterns: [
-    /rm\s+-rf\s+(.*\s)?\/($|\s)/,
-    /rm\s+-rf\s+--no-preserve-root/,
-    /mkfs/,
-    /dd\s+if=/,
-    />\s*\/dev\//,
-    /:()\s*\{.*\|.*&\s*\}/,
-    /shutdown/,
-    /reboot/,
-  ],
-  allowedCommands: null,
+	enabled: true,
+	blockedPatterns: [
+		/rm\s+-rf\s+(.*\s)?\/($|\s)/,
+		/rm\s+-rf\s+--no-preserve-root/,
+		/mkfs/,
+		/dd\s+if=/,
+		/>\s*\/dev\//,
+		/:()\s*\{.*\|.*&\s*\}/,
+		/shutdown/,
+		/reboot/,
+	],
+	allowedCommands: null,
 };
 
 export function setCommandPolicy(p: CommandPolicy): void {
-  policy = p;
+	policy = p;
 }
 
 export function isCommandAllowed(command: string): boolean {
-  if (!policy.enabled) return false;
+	if (!policy.enabled) return false;
 
-  const trimmed = command.trim();
-  if (!trimmed) return false;
+	const trimmed = command.trim();
+	if (!trimmed) return false;
 
-  for (const pattern of policy.blockedPatterns) {
-    if (pattern.test(trimmed)) return false;
-  }
+	for (const pattern of policy.blockedPatterns) {
+		if (pattern.test(trimmed)) return false;
+	}
 
-  if (policy.allowedCommands) {
-    const baseCommand = trimmed.split(/\s+/)[0];
-    return policy.allowedCommands.some(
-      (allowed) => baseCommand === allowed || baseCommand.startsWith(allowed),
-    );
-  }
+	if (policy.allowedCommands) {
+		const baseCommand = trimmed.split(/\s+/)[0]!;
+		return policy.allowedCommands.some(
+			(allowed) => baseCommand === allowed || baseCommand.startsWith(allowed)
+		);
+	}
 
-  return true;
+	return true;
 }
 
 export function validateCommand(command: string): string {
-  if (!policy.enabled) {
-    throw new Error("Bash execution is disabled");
-  }
+	if (!policy.enabled) {
+		throw new Error("Bash execution is disabled");
+	}
 
-  const trimmed = command.trim();
-  if (!trimmed) {
-    throw new Error("Command cannot be empty");
-  }
+	const trimmed = command.trim();
+	if (!trimmed) {
+		throw new Error("Command cannot be empty");
+	}
 
-  if (!isCommandAllowed(trimmed)) {
-    if (policy.allowedCommands) {
-      throw new Error(`Command not in whitelist: "${trimmed}"`);
-    }
-    throw new Error(`Command blocked for safety: "${trimmed}"`);
-  }
+	if (!isCommandAllowed(trimmed)) {
+		if (policy.allowedCommands) {
+			throw new Error(`Command not in whitelist: "${trimmed}"`);
+		}
+		throw new Error(`Command blocked for safety: "${trimmed}"`);
+	}
 
-  return trimmed;
+	return trimmed;
 }