@dyyz1993/create-agent 2.1.0 → 2.1.2

package/templates/cowork/src/shared/http-routes.ts

@@ -0,0 +1,444 @@
+/**
+ * HTTP route handlers for the web gateway.
+ * Handles: /health, /info/{path}, /file/{path}, /file/upload
+ */
+
+import type { IncomingMessage, ServerResponse } from 'http';
+import { stat, readFile, writeFile, mkdir } from 'fs/promises';
+import { existsSync } from 'fs';
+import { extname, basename, dirname, resolve, join } from 'path';
+import { tmpdir } from 'os';
+import { createLogger } from './lib/logger';
+import { verifyToken as verifySseToken } from '../gateway/sse-transport';
+import type { SseHandler } from '../gateway/sse-transport';
+
+const log = createLogger('gateway');
+
+const MIME_TYPES: Record<string, string> = {
+	'.html': 'text/html',
+	'.css': 'text/css',
+	'.js': 'application/javascript',
+	'.json': 'application/json',
+	'.png': 'image/png',
+	'.jpg': 'image/jpeg',
+	'.jpeg': 'image/jpeg',
+	'.gif': 'image/gif',
+	'.svg': 'image/svg+xml',
+	'.ico': 'image/x-icon',
+	'.txt': 'text/plain',
+	'.md': 'text/markdown',
+	'.ts': 'text/plain',
+	'.tsx': 'text/plain',
+	'.py': 'text/plain',
+	'.pdf': 'application/pdf',
+	'.zip': 'application/zip',
+	'.mp4': 'video/mp4',
+	'.mp3': 'audio/mpeg',
+	'.wav': 'audio/wav',
+};
+
+const ALLOWED_ROOTS = [resolve(process.cwd())];
+function isPathAllowed(requestedPath: string): boolean {
+	const resolved = resolve(requestedPath);
+	return ALLOWED_ROOTS.some((root) => resolved === root || resolved.startsWith(root + '/'));
+}
+
+function verifyToken(req: IncomingMessage, authToken: string): boolean {
+	return verifySseToken(req, authToken);
+}
+
+export interface HttpRouteDeps {
+	config: {
+		readonly port: number;
+		readonly authToken: string;
+		readonly maxUploadSize: number;
+		readonly corsOrigin: string;
+	};
+	getSseClientCount: () => number;
+	sse: SseHandler;
+}
+
+export function createHttpHandler(
+	deps: HttpRouteDeps,
+): (req: IncomingMessage, res: ServerResponse) => void {
+	const { config: cfg, getSseClientCount, sse } = deps;
+
+	return async (req, res) => {
+		res.setHeader('Access-Control-Allow-Origin', cfg.corsOrigin);
+		res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
+		res.setHeader('Access-Control-Allow-Headers', 'Authorization, Range, Content-Type');
+		if (req.method === 'OPTIONS') {
+			res.writeHead(204).end();
+			return;
+		}
+
+		if (!req.url) {
+			res.writeHead(400).end();
+			return;
+		}
+
+		const url = new URL(req.url, 'http://localhost');
+
+		// ── SSE + RPC routes (require auth) ──
+		if (url.pathname === '/api/events' && req.method === 'GET') {
+			if (!verifyToken(req, cfg.authToken)) {
+				res.writeHead(401, { 'Content-Type': 'application/json' });
+				res.end(JSON.stringify({ error: 'Unauthorized' }));
+				return;
+			}
+			sse.handleSseConnect(req, res);
+			return;
+		}
+
+		if (url.pathname === '/api/rpc' && req.method === 'POST') {
+			if (!verifyToken(req, cfg.authToken)) {
+				res.writeHead(401, { 'Content-Type': 'application/json' });
+				res.end(JSON.stringify({ error: 'Unauthorized' }));
+				return;
+			}
+			await sse.handleRpcPost(req, res);
+			return;
+		}
+
+		// ── 扩展安装引导端点（用户视角，不暴露 CDP/tunnel 概念）──
+		if (url.pathname === '/api/create-browser' && req.method === 'POST') {
+			if (!verifyToken(req, cfg.authToken)) {
+				res.writeHead(401, { 'Content-Type': 'application/json' });
+				res.end(JSON.stringify({ error: 'Unauthorized' }));
+				return;
+			}
+			await handleCreateBrowser(req, res);
+			return;
+		}
+
+		if (url.pathname === '/api/pack-extension' && req.method === 'POST') {
+			if (!verifyToken(req, cfg.authToken)) {
+				res.writeHead(401, { 'Content-Type': 'application/json' });
+				res.end(JSON.stringify({ error: 'Unauthorized' }));
+				return;
+			}
+			await handlePackExtension(req, res);
+			return;
+		}
+
+		// Browser Agent: resolve asset path from ID (stored as JSON index)
+		const assetMatch = url.pathname.match(/^\/api\/assets\/([\w]+)\/download$/);
+		if (assetMatch) {
+			await handleAssetDownload(assetMatch[1] || '', res);
+			return;
+		}
+		const assetMetaMatch = url.pathname.match(/^\/api\/assets\/([\w]+)$/);
+		if (assetMetaMatch) {
+			res.writeHead(200, { 'Content-Type': 'application/json' });
+			res.end(JSON.stringify({ id: assetMetaMatch[1], note: 'Use download endpoint for file' }));
+			return;
+		}
+
+		if (url.pathname === '/health') {
+			res.writeHead(200, { 'Content-Type': 'application/json' });
+			res.end(JSON.stringify({ status: 'ok', clients: getSseClientCount() }));
+			return;
+		}
+
+		if (!verifyToken(req, cfg.authToken)) {
+			log.warn('Auth failed', { path: url.pathname });
+			res.writeHead(401, { 'Content-Type': 'application/json' });
+			res.end(JSON.stringify({ error: 'Unauthorized' }));
+			return;
+		}
+
+		if (url.pathname.startsWith('/info/')) {
+			await handleFileInfo(url.pathname.slice(6), res);
+			return;
+		}
+
+		if (url.pathname.startsWith('/file/')) {
+			if (url.pathname === '/file/upload' && req.method === 'POST') {
+				await handleFileUpload(req, url.searchParams.get('path'), res, cfg.maxUploadSize);
+				return;
+			}
+			await handleFileContent(url.pathname.slice(6), req, res);
+			return;
+		}
+
+		res.writeHead(404);
+		res.end();
+	};
+}
+
+async function handleFileInfo(encodedPath: string, res: ServerResponse): Promise<void> {
+	const filePath = decodeURIComponent(encodedPath);
+	if (!isPathAllowed(filePath)) {
+		res.writeHead(403, { 'Content-Type': 'application/json' });
+		res.end(JSON.stringify({ error: 'Path not allowed' }));
+		return;
+	}
+	try {
+		const s = await stat(filePath);
+		res.writeHead(200, { 'Content-Type': 'application/json' });
+		res.end(
+			JSON.stringify({
+				name: basename(filePath),
+				path: filePath,
+				size: s.size,
+				isDirectory: s.isDirectory(),
+				modified: s.mtime.toISOString(),
+				mimeType: s.isFile()
+					? MIME_TYPES[extname(filePath)] || 'application/octet-stream'
+					: undefined,
+			}),
+		);
+	} catch {
+		res.writeHead(404, { 'Content-Type': 'application/json' });
+		res.end(JSON.stringify({ error: 'File not found' }));
+	}
+}
+
+async function handleFileContent(
+	encodedPath: string,
+	req: IncomingMessage,
+	res: ServerResponse,
+): Promise<void> {
+	const filePath = decodeURIComponent(encodedPath);
+	if (!isPathAllowed(filePath)) {
+		res.writeHead(403, { 'Content-Type': 'application/json' });
+		res.end(JSON.stringify({ error: 'Path not allowed' }));
+		return;
+	}
+	try {
+		if (!existsSync(filePath)) {
+			res.writeHead(404, { 'Content-Type': 'application/json' });
+			res.end(JSON.stringify({ error: 'File not found' }));
+			return;
+		}
+		const s = await stat(filePath);
+		const mimeType = MIME_TYPES[extname(filePath)] || 'application/octet-stream';
+
+		const range = req.headers['range'];
+		if (range) {
+			const parts = range.replace(/bytes=/, '').split('-');
+			const start = parseInt(parts[0]!, 10);
+			const end = parts[1] ? parseInt(parts[1], 10) : s.size - 1;
+			const chunkSize = end - start + 1;
+
+			res.writeHead(206, {
+				'Content-Range': `bytes ${start}-${end}/${s.size}`,
+				'Accept-Ranges': 'bytes',
+				'Content-Length': chunkSize,
+				'Content-Type': mimeType,
+			});
+			const buffer = await readFile(filePath);
+			res.end(buffer.subarray(start, end + 1));
+		} else {
+			res.writeHead(200, {
+				'Content-Length': s.size,
+				'Content-Type': mimeType,
+				'Accept-Ranges': 'bytes',
+			});
+			const buffer = await readFile(filePath);
+			res.end(buffer);
+		}
+		log.info('File served', { path: filePath });
+	} catch {
+		res.writeHead(500, { 'Content-Type': 'application/json' });
+		res.end(JSON.stringify({ error: 'Failed to read file' }));
+	}
+}
+
+async function handleFileUpload(
+	req: IncomingMessage,
+	destPath: string | null,
+	res: ServerResponse,
+	maxUploadSize: number,
+): Promise<void> {
+	if (!destPath) {
+		res.writeHead(400, { 'Content-Type': 'application/json' });
+		res.end(JSON.stringify({ error: 'Missing path parameter' }));
+		return;
+	}
+	if (!isPathAllowed(destPath)) {
+		res.writeHead(403, { 'Content-Type': 'application/json' });
+		res.end(JSON.stringify({ error: 'Path not allowed' }));
+		return;
+	}
+	const contentLength = parseInt(req.headers['content-length'] || '0', 10);
+	if (contentLength > maxUploadSize) {
+		res.writeHead(413, { 'Content-Type': 'application/json' });
+		res.end(JSON.stringify({ error: `File too large, max ${maxUploadSize / 1024 / 1024}MB` }));
+		return;
+	}
+	try {
+		const chunks: Uint8Array[] = [];
+		for await (const chunk of req) {
+			const bytes =
+				typeof chunk === 'string'
+					? new TextEncoder().encode(chunk)
+					: new Uint8Array(chunk as ArrayBuffer);
+			chunks.push(bytes);
+		}
+		const body = Buffer.concat(chunks as Uint8Array[]);
+		await mkdir(dirname(destPath), { recursive: true });
+		await writeFile(destPath, body as Uint8Array);
+		log.info('File uploaded', { path: destPath, size: body.length });
+		res.writeHead(200, { 'Content-Type': 'application/json' });
+		res.end(JSON.stringify({ ok: true, path: destPath, size: body.length }));
+	} catch (err) {
+		res.writeHead(500, { 'Content-Type': 'application/json' });
+		res.end(JSON.stringify({ error: err instanceof Error ? err.message : 'Upload failed' }));
+	}
+}
+
+/**
+ * 查找并下载资源文件（搜索 os.tmpdir/browser-agent-assets/）
+ */
+async function handleAssetDownload(assetId: string, res: ServerResponse): Promise<void> {
+	try {
+		const assetsDir = join(tmpdir(), 'browser-agent-assets');
+		if (!existsSync(assetsDir)) {
+			res.writeHead(404).end();
+			return;
+		}
+		const { readdir, readFile: readFileP } = await import('fs/promises');
+		const sessionDirs = await readdir(assetsDir);
+		for (const sessionDir of sessionDirs) {
+			const sessionPath = join(assetsDir, sessionDir);
+			const entries = await readdir(sessionPath);
+			for (const entry of entries) {
+				if (entry.includes(assetId)) {
+					const filePath = join(sessionPath, entry);
+					const s = await stat(filePath);
+					const mimeType = MIME_TYPES[extname(filePath)] || 'application/octet-stream';
+					const buffer = await readFileP(filePath);
+					res.writeHead(200, {
+						'Content-Type': mimeType,
+						'Content-Length': s.size,
+						'Content-Disposition': `attachment; filename="${encodeURIComponent(entry)}"`,
+					});
+					res.end(buffer);
+					return;
+				}
+			}
+		}
+		res.writeHead(404).end();
+	} catch {
+		res.writeHead(500).end();
+	}
+}
+
+// ===== 扩展安装引导（用户视角）=====
+
+const CDP_TUNNEL_API =
+	process.env.CLOUD_PROXY_URL || process.env.CDP_ENDPOINT || 'http://localhost:9221';
+const CDP_TUNNEL_EXT = process.env.CDP_TUNNEL_EXT || '';
+
+/**
+ * 创建连接 Key — 调用 cdp-tunnel admin API
+ * 用户视角："创建连接"，实际是生成一个 cdp-tunnel 的 plugin key
+ */
+async function handleCreateBrowser(req: IncomingMessage, res: ServerResponse): Promise<void> {
+	try {
+		let body = '';
+		for await (const chunk of req) {
+			body += typeof chunk === 'string' ? chunk : Buffer.from(chunk).toString('utf8');
+		}
+		const parsed = body ? JSON.parse(body) : {};
+		const name = parsed.name || `用户-${Date.now().toString(36)}`;
+
+		const apiRes = await fetch(`${CDP_TUNNEL_API}/admin/api/keys`, {
+			method: 'POST',
+			headers: { 'Content-Type': 'application/json' },
+			body: JSON.stringify({ name }),
+		});
+
+		if (!apiRes.ok) {
+			const errText = await apiRes.text();
+			log.error('create-browser failed', { status: apiRes.status, body: errText });
+			res.writeHead(502, { 'Content-Type': 'application/json' });
+			res.end(JSON.stringify({ error: '无法创建连接，请确认 cdp-tunnel 服务正在运行' }));
+			return;
+		}
+
+		const data = (await apiRes.json()) as { key: string; pluginUrl?: string };
+		const wsUrl = CDP_TUNNEL_API.replace(/^https/, 'wss').replace(/^http/, 'ws');
+		const pluginUrl = `${wsUrl}/plugin?key=${data.key}`;
+
+		res.writeHead(200, { 'Content-Type': 'application/json' });
+		res.end(JSON.stringify({ key: data.key, pluginUrl }));
+	} catch (err) {
+		log.error('create-browser error', { error: err instanceof Error ? err.message : String(err) });
+		res.writeHead(500, { 'Content-Type': 'application/json' });
+		res.end(JSON.stringify({ error: '创建连接失败，cdp-tunnel 服务可能未运行' }));
+	}
+}
+
+/**
+ * 打包 Chrome 扩展 ZIP — 将 Key 注入扩展配置后打包
+ * 用户视角："下载扩展"，实际是生成一个配置好连接地址的 ZIP
+ */
+async function handlePackExtension(req: IncomingMessage, res: ServerResponse): Promise<void> {
+	try {
+		let body = '';
+		for await (const chunk of req) {
+			body += typeof chunk === 'string' ? chunk : Buffer.from(chunk).toString('utf8');
+		}
+		const { key } = JSON.parse(body);
+		if (!key) {
+			res.writeHead(400, { 'Content-Type': 'application/json' });
+			res.end(JSON.stringify({ error: '缺少 key 参数' }));
+			return;
+		}
+
+		if (!CDP_TUNNEL_EXT || !existsSync(CDP_TUNNEL_EXT)) {
+			res.writeHead(500, { 'Content-Type': 'application/json' });
+			res.end(
+				JSON.stringify({
+					error: '扩展源码未找到，请设置 CDP_TUNNEL_EXT 环境变量指向 cdp-tunnel 扩展目录',
+				}),
+			);
+			return;
+		}
+
+		const { execSync } = await import('child_process');
+		const tmpDir = join(tmpdir(), `cdp-ext-${Date.now()}`);
+		const wsUrl = CDP_TUNNEL_API.replace(/^https/, 'wss').replace(/^http/, 'ws');
+		const pluginUrl = `${wsUrl}/plugin?key=${key}`;
+
+		// 复制扩展源码到临时目录
+		execSync(`cp -r "${CDP_TUNNEL_EXT}" "${tmpDir}"`);
+
+		// 注入连接地址到 config.js
+		const configPath = join(tmpDir, 'utils', 'config.js');
+		if (existsSync(configPath)) {
+			const { readFile, writeFile } = await import('fs/promises');
+			let config = await readFile(configPath, 'utf8');
+			config = config.replace(/WS_URL:\s*'[^']*'/, `WS_URL: '${pluginUrl}'`);
+			await writeFile(configPath, config);
+		}
+
+		// 打包 ZIP
+		const zipPath = `${tmpDir}.zip`;
+		execSync(`cd "${tmpdir()}" && zip -rq "${basename(zipPath)}" "${basename(tmpDir)}/"`);
+
+		// 读取并返回 ZIP
+		const { readFile: readZip } = await import('fs/promises');
+		const zipBuffer = await readZip(zipPath);
+
+		res.writeHead(200, {
+			'Content-Type': 'application/zip',
+			'Content-Disposition': `attachment; filename="browser-agent-extension.zip"`,
+			'Content-Length': zipBuffer.length,
+		});
+		res.end(zipBuffer);
+
+		// 清理临时文件
+		execSync(`rm -rf "${tmpDir}" "${zipPath}"`);
+	} catch (err) {
+		log.error('pack-extension error', { error: err instanceof Error ? err.message : String(err) });
+		res.writeHead(500, { 'Content-Type': 'application/json' });
+		res.end(
+			JSON.stringify({
+				error: '打包扩展失败: ' + (err instanceof Error ? err.message : String(err)),
+			}),
+		);
+	}
+}

package/templates/cowork/src/shared/lib/__tests__/logger.test.ts

@@ -0,0 +1,92 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { mkdirSync, existsSync, readdirSync, readFileSync, writeFileSync, rmSync, utimesSync } from "fs";
+import { join } from "path";
+
+const TEST_LOG_DIR = join(process.cwd(), "test-logs");
+
+describe("Logger", () => {
+  beforeEach(async () => {
+    if (existsSync(TEST_LOG_DIR)) {
+      rmSync(TEST_LOG_DIR, { recursive: true, force: true });
+    }
+    mkdirSync(TEST_LOG_DIR, { recursive: true });
+  });
+
+  afterEach(() => {
+    if (existsSync(TEST_LOG_DIR)) {
+      rmSync(TEST_LOG_DIR, { recursive: true, force: true });
+    }
+  });
+
+  it("should write logs asynchronously", async () => {
+    const { createLogger, configureLogDir, flushLogs } = await import("../logger");
+    await configureLogDir(TEST_LOG_DIR);
+
+    const logger = createLogger("test");
+    logger.info("test message");
+
+    await flushLogs();
+    await new Promise((r) => setTimeout(r, 100));
+
+    const files = readdirSync(TEST_LOG_DIR);
+    expect(files.length).toBeGreaterThan(0);
+
+    const content = readFileSync(join(TEST_LOG_DIR, files[0]), "utf-8");
+    expect(content).toContain("test message");
+  });
+
+  it("should support multiple log levels", async () => {
+    const { createLogger, configureLogDir, flushLogs } = await import("../logger");
+    await configureLogDir(TEST_LOG_DIR);
+
+    const logger = createLogger("test");
+    logger.debug("debug msg");
+    logger.info("info msg");
+    logger.warn("warn msg");
+    logger.error("error msg");
+
+    await flushLogs();
+
+    const files = readdirSync(TEST_LOG_DIR);
+    const content = readFileSync(join(TEST_LOG_DIR, files[0]), "utf-8");
+    expect(content).toContain("info msg");
+    expect(content).toContain("warn msg");
+    expect(content).toContain("error msg");
+  });
+
+  it("should clean up old log files based on maxAgeDays", async () => {
+    const { configureLogDir } = await import("../logger");
+
+    const oldDate = new Date(Date.now() - 10 * 86400000).toISOString().slice(0, 10);
+    const oldPath = join(TEST_LOG_DIR, `${oldDate}.log`);
+    writeFileSync(oldPath, "old log");
+    const oldTime = new Date(Date.now() - 10 * 86400000);
+    utimesSync(oldPath, oldTime, oldTime);
+
+    const todayFile = new Date().toISOString().slice(0, 10);
+    writeFileSync(join(TEST_LOG_DIR, `${todayFile}.log`), "today log");
+
+    await configureLogDir(TEST_LOG_DIR, { maxAgeDays: 5 });
+
+    const files = readdirSync(TEST_LOG_DIR);
+    expect(files.find((f) => f.includes(oldDate))).toBeUndefined();
+    expect(files.find((f) => f.includes(todayFile))).toBeDefined();
+  });
+
+  it("should flush all pending writes", async () => {
+    const { createLogger, configureLogDir, flushLogs } = await import("../logger");
+    await configureLogDir(TEST_LOG_DIR);
+
+    const logger = createLogger("test");
+    for (let i = 0; i < 100; i++) {
+      logger.info(`msg ${i}`);
+    }
+
+    await flushLogs();
+
+    const files = readdirSync(TEST_LOG_DIR);
+    const content = readFileSync(join(TEST_LOG_DIR, files[0]), "utf-8");
+    expect(content).toContain("msg 0");
+    expect(content).toContain("msg 99");
+  });
+});

package/templates/cowork/src/shared/lib/__tests__/path-security.test.ts

@@ -0,0 +1,77 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { validatePath, isRpcPathAllowed, setAllowedRoots } from "../path-security";
+
+describe("path-security", () => {
+  const originalCwd = process.cwd();
+  const originalEnv = process.env.NODE_ENV;
+
+  beforeEach(() => {
+    setAllowedRoots([process.cwd()]);
+  });
+
+  afterEach(() => {
+    process.env.NODE_ENV = originalEnv;
+  });
+
+  describe("isRpcPathAllowed", () => {
+    it("should allow paths within project root", () => {
+      expect(isRpcPathAllowed(`${originalCwd}/src/main.ts`)).toBe(true);
+    });
+
+    it("should allow project root itself", () => {
+      expect(isRpcPathAllowed(originalCwd)).toBe(true);
+    });
+
+    it("should reject paths outside project root", () => {
+      expect(isRpcPathAllowed("/etc/passwd")).toBe(false);
+      expect(isRpcPathAllowed("/etc/shadow")).toBe(false);
+    });
+
+    it("should reject path traversal attempts", () => {
+      expect(isRpcPathAllowed(`${originalCwd}/../../../etc/passwd`)).toBe(false);
+    });
+
+    it("should reject paths with encoded traversal", () => {
+      expect(isRpcPathAllowed(`${originalCwd}/%2e%2e/etc/passwd`)).toBe(false);
+    });
+
+    it("should handle relative paths", () => {
+      expect(isRpcPathAllowed("./src/main.ts")).toBe(true);
+      expect(isRpcPathAllowed("../../etc/passwd")).toBe(false);
+    });
+
+    it("should handle null bytes", () => {
+      expect(isRpcPathAllowed(`${originalCwd}/file.txt\0/etc/passwd`)).toBe(false);
+    });
+
+    it("should work with multiple allowed roots", () => {
+      setAllowedRoots([originalCwd, "/tmp/test"]);
+      expect(isRpcPathAllowed("/tmp/test/file.txt")).toBe(true);
+      expect(isRpcPathAllowed("/tmp/other/file.txt")).toBe(false);
+    });
+  });
+
+  describe("validatePath", () => {
+    it("should return resolved path for allowed paths", () => {
+      const result = validatePath("./src/main.ts");
+      expect(result).toContain("src/main.ts");
+    });
+
+    it("should throw for paths outside allowed roots", () => {
+      expect(() => validatePath("/etc/passwd")).toThrow("Access denied");
+    });
+
+    it("should throw for path traversal attempts", () => {
+      expect(() => validatePath("../../../etc/passwd")).toThrow("Access denied");
+    });
+
+    it("should throw for null byte injection", () => {
+      expect(() => validatePath("file.txt\0/evil")).toThrow("Access denied");
+    });
+
+    it("should normalize the returned path", () => {
+      const result = validatePath("./src/../src/./main.ts");
+      expect(result).toBe(`${originalCwd}/src/main.ts`);
+    });
+  });
+});