@gaoding/cli 0.0.0 → 1.0.0-alpha.25

package/dist/src/platform/json-input.js

@@ -0,0 +1,67 @@
+import { readFile } from "node:fs/promises";
+import { resolve } from "node:path";
+export class JsonInputError extends Error {
+    constructor() {
+        super("无法读取有效的 JSON。");
+        this.name = "JsonInputError";
+    }
+}
+export function createJsonInputReader(options) {
+    return {
+        async read(source, signal) {
+            signal.throwIfAborted();
+            let text;
+            try {
+                text = source === "-"
+                    ? await readStream(options.stdin, signal)
+                    : await readFile(resolve(options.cwd, source), { encoding: "utf8", signal });
+            }
+            catch {
+                if (signal.aborted)
+                    throw signal.reason;
+                throw new JsonInputError();
+            }
+            try {
+                return JSON.parse(text);
+            }
+            catch {
+                throw new JsonInputError();
+            }
+        }
+    };
+}
+function readStream(stream, signal) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        const onData = (chunk) => {
+            chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+        };
+        const cleanup = () => {
+            stream.removeListener("data", onData);
+            stream.removeListener("end", onEnd);
+            stream.removeListener("error", onError);
+            signal.removeEventListener("abort", onAbort);
+        };
+        const onEnd = () => {
+            cleanup();
+            resolve(Buffer.concat(chunks).toString("utf8"));
+        };
+        const onError = () => {
+            cleanup();
+            reject(new JsonInputError());
+        };
+        const onAbort = () => {
+            cleanup();
+            const destroy = stream.destroy;
+            if (typeof destroy === "function")
+                destroy.call(stream);
+            reject(signal.reason);
+        };
+        stream.on("data", onData);
+        stream.once("end", onEnd);
+        stream.once("error", onError);
+        signal.addEventListener("abort", onAbort, { once: true });
+        if (signal.aborted)
+            onAbort();
+    });
+}

package/dist/src/platform/local-json-file.js

@@ -0,0 +1,59 @@
+import { randomUUID } from "node:crypto";
+import * as nodeFileSystem from "node:fs/promises";
+import { join } from "node:path";
+export class LocalFileError extends Error {
+    constructor(cause) {
+        super("无法访问本地状态文件。", { cause });
+        this.name = "LocalFileError";
+    }
+}
+export function createLocalJsonFile(options) {
+    const fileSystem = options.fileSystem ?? nodeFileSystem;
+    const path = join(options.directory, options.filename);
+    return {
+        async readText() {
+            try {
+                await fileSystem.chmod(options.directory, 0o700);
+                await fileSystem.chmod(path, 0o600);
+                return await fileSystem.readFile(path, "utf8");
+            }
+            catch (cause) {
+                if (isMissing(cause))
+                    return null;
+                throw new LocalFileError(cause);
+            }
+        },
+        async writeTextAtomically(value) {
+            const temporaryPath = join(options.directory, `${options.filename}.tmp-${randomUUID()}`);
+            let handle;
+            try {
+                await fileSystem.mkdir(options.directory, { mode: 0o700, recursive: true });
+                await fileSystem.chmod(options.directory, 0o700);
+                handle = await fileSystem.open(temporaryPath, "wx", 0o600);
+                await handle.writeFile(value, "utf8");
+                await handle.sync();
+                await handle.close();
+                handle = undefined;
+                await fileSystem.chmod(temporaryPath, 0o600);
+                await fileSystem.rename(temporaryPath, path);
+            }
+            catch (cause) {
+                await handle?.close().catch(() => undefined);
+                await fileSystem.unlink(temporaryPath).catch(() => undefined);
+                throw new LocalFileError(cause);
+            }
+        },
+        async remove() {
+            try {
+                await fileSystem.unlink(path);
+            }
+            catch (cause) {
+                if (!isMissing(cause))
+                    throw new LocalFileError(cause);
+            }
+        }
+    };
+}
+function isMissing(error) {
+    return error instanceof Error && "code" in error && error.code === "ENOENT";
+}

package/dist/src/platform/open-browser.js

@@ -0,0 +1,8 @@
+import open from "open";
+export function createBrowserOpener(openUrl = open) {
+    return {
+        async open(url) {
+            await openUrl(url.href);
+        }
+    };
+}

package/dist/src/platform/redact.js

@@ -0,0 +1,80 @@
+const REDACTED = "[REDACTED]";
+const SENSITIVE_KEYS = new Set([
+    "ak",
+    "sk",
+    "accesskey",
+    "accesskeyid",
+    "accesskeysecret",
+    "authkey",
+    "authorization",
+    "authorizecode",
+    "authorizationcode",
+    "bearer",
+    "cookie",
+    "contentid",
+    "devicecode",
+    "difytaskid",
+    "orgid",
+    "password",
+    "secret",
+    "secretkey",
+    "signature",
+    "securitytoken",
+    "ststoken",
+    "taskid",
+    "token",
+    "accesstoken",
+    "refreshtoken"
+]);
+export function redact(value) {
+    return redactValue(value, new WeakSet());
+}
+export function redactSensitiveText(value) {
+    const url = redactUrl(value);
+    if (url)
+        return url;
+    return value
+        .replace(/(authorization\s*:\s*bearer\s+)[^\s,;]+/gi, `$1${REDACTED}`)
+        .replace(/(cookie\s*:\s*)[^\r\n]+/gi, `$1${REDACTED}`)
+        .replace(/\b(ak|sk|access[_-]?key(?:[_-]?(?:id|secret))?|secret[_-]?key|auth[_-]?key|token|access[_-]?token|refresh[_-]?token|security[_-]?token|sts[_-]?token|signature|authorize[_-]?code|authorization[_-]?code|device[_-]?code|org[_-]?id|content[_-]?id|dify[_-]?task[_-]?id|task[_-]?id)\s*[:=]\s*[^\s,;}&]+/gi, `$1=${REDACTED}`);
+}
+function redactValue(value, seen) {
+    if (typeof value === "string")
+        return redactSensitiveText(value);
+    if (value === null || typeof value !== "object")
+        return value;
+    if (seen.has(value))
+        return "[Circular]";
+    seen.add(value);
+    if (value instanceof Error) {
+        return {
+            name: value.name,
+            message: redactSensitiveText(value.message)
+        };
+    }
+    if (Array.isArray(value))
+        return value.map((item) => redactValue(item, seen));
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+        key,
+        isSensitiveKey(key) ? REDACTED : redactValue(item, seen)
+    ]));
+}
+function redactUrl(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return undefined;
+    }
+    if (url.protocol !== "http:" && url.protocol !== "https:")
+        return undefined;
+    for (const key of [...url.searchParams.keys()]) {
+        if (isSensitiveKey(key))
+            url.searchParams.set(key, REDACTED);
+    }
+    return url.href;
+}
+export function isSensitiveKey(key) {
+    return SENSITIVE_KEYS.has(key.toLowerCase().replaceAll(/[-_]/g, ""));
+}

package/dist/src/platform/remote-error-evidence.js

@@ -0,0 +1,80 @@
+import { redact, redactSensitiveText } from "./redact.js";
+const maximumLength = 8_192;
+const truncationMarker = "[TRUNCATED]";
+export function remoteErrorEvidence(value) {
+    const normalized = parseJson(value);
+    const remoteCode = topLevelCode(normalized) ?? jsonRpcErrorCode(normalized);
+    const sanitized = sanitize(normalized);
+    if (sanitized === undefined) {
+        return remoteCode === undefined ? {} : { remoteCode };
+    }
+    const remoteBody = sanitized.length <= maximumLength
+        ? sanitized
+        : `${sanitized.slice(0, maximumLength - truncationMarker.length)}${truncationMarker}`;
+    return {
+        ...(remoteCode === undefined ? {} : { remoteCode }),
+        remoteBody
+    };
+}
+function parseJson(value) {
+    if (typeof value !== "string")
+        return value;
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return value;
+    }
+}
+function topLevelCode(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    if (!Object.prototype.hasOwnProperty.call(value, "code"))
+        return undefined;
+    return normalizeCode(value.code);
+}
+function jsonRpcErrorCode(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    const record = value;
+    if (record.jsonrpc !== "2.0"
+        || record.error === null
+        || typeof record.error !== "object"
+        || Array.isArray(record.error)) {
+        return undefined;
+    }
+    return normalizeCode(record.error.code);
+}
+function normalizeCode(code) {
+    if (typeof code === "string")
+        return redactRemoteText(code);
+    return typeof code === "number" ? String(code) : undefined;
+}
+function sanitize(value) {
+    if (typeof value === "string")
+        return redactRemoteText(value);
+    try {
+        return JSON.stringify(redactCookieAssignments(redact(value)));
+    }
+    catch {
+        return undefined;
+    }
+}
+function redactRemoteText(value) {
+    return redactCookieAssignment(redactSensitiveText(value));
+}
+function redactCookieAssignments(value) {
+    if (typeof value === "string")
+        return redactCookieAssignment(value);
+    if (value === null || typeof value !== "object")
+        return value;
+    if (Array.isArray(value))
+        return value.map(redactCookieAssignments);
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+        key,
+        redactCookieAssignments(item)
+    ]));
+}
+function redactCookieAssignment(value) {
+    return value.replace(/\b(cookie)\s*=\s*[^\s,;}&]+/giu, "$1=[REDACTED]");
+}

package/dist/src/platform/remote-protocol.js

@@ -0,0 +1,10 @@
+export class RemoteProtocolError extends Error {
+    remoteCode;
+    remoteBody;
+    constructor(evidence = {}) {
+        super("稿定服务响应与当前 CLI 不兼容。");
+        this.name = "RemoteProtocolError";
+        this.remoteCode = evidence.remoteCode;
+        this.remoteBody = evidence.remoteBody;
+    }
+}

package/dist/src/platform/safe-upload-file.js

@@ -0,0 +1,146 @@
+import { open, realpath, stat } from "node:fs/promises";
+import { basename, extname, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+export class LocalFileInputError extends Error {
+    constructor() {
+        super("本地文件不可用于上传。");
+        this.name = "LocalFileInputError";
+    }
+}
+const protectedSegments = new Set([
+    ".aws",
+    ".azure",
+    ".config",
+    ".docker",
+    ".gd",
+    ".gd-cli-dev",
+    ".git",
+    ".gnupg",
+    ".kube",
+    ".npm",
+    ".ssh"
+]);
+const protectedFilenames = new Set([
+    ".env",
+    ".git-credentials",
+    ".gitconfig",
+    ".npmrc",
+    ".netrc",
+    ".pypirc",
+    "credentials.json",
+    "credential.json",
+    "id_ed25519",
+    "id_rsa",
+    "known_hosts"
+]);
+const mediaTypes = {
+    avif: "image/avif",
+    bmp: "image/bmp",
+    gif: "image/gif",
+    heic: "image/heic",
+    heif: "image/heif",
+    jpeg: "image/jpeg",
+    m4v: "video/x-m4v",
+    mkv: "video/x-matroska",
+    mov: "video/quicktime",
+    mp4: "video/mp4",
+    png: "image/png",
+    svg: "image/svg+xml",
+    webm: "video/webm",
+    webp: "image/webp"
+};
+function reject() {
+    throw new LocalFileInputError();
+}
+function assertSafePath(filePath) {
+    const segments = filePath.split(sep).filter(Boolean).map((segment) => segment.toLowerCase());
+    const filename = segments.at(-1) ?? "";
+    if (protectedFilenames.has(filename) || /^\.env(?:\.|$)/.test(filename))
+        reject();
+    if (segments.some((segment) => segment.startsWith(".") || protectedSegments.has(segment))) {
+        reject();
+    }
+}
+function detectedFormat(header) {
+    if (header.length >= 3
+        && header[0] === 0xff
+        && header[1] === 0xd8
+        && header[2] === 0xff)
+        return "jpeg";
+    if (header.length >= 8
+        && header.subarray(0, 8).equals(Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a])))
+        return "png";
+    if (header.length >= 6) {
+        const signature = header.subarray(0, 6).toString("ascii");
+        if (signature === "GIF87a" || signature === "GIF89a")
+            return "gif";
+    }
+    if (header.length >= 12
+        && header.subarray(0, 4).toString("ascii") === "RIFF"
+        && header.subarray(8, 12).toString("ascii") === "WEBP")
+        return "webp";
+    if (header.length >= 12 && header.subarray(4, 8).toString("ascii") === "ftyp") {
+        const brand = header.subarray(8, 12).toString("ascii");
+        if (brand === "avif" || brand === "avis")
+            return "avif";
+        if (["heic", "heix", "hevc", "hevx"].includes(brand))
+            return "heic";
+    }
+    return undefined;
+}
+async function readHeader(filePath, signal) {
+    signal.throwIfAborted();
+    const handle = await open(filePath, "r");
+    try {
+        const buffer = Buffer.alloc(32);
+        const { bytesRead } = await handle.read(buffer, 0, buffer.length, 0);
+        signal.throwIfAborted();
+        return buffer.subarray(0, bytesRead);
+    }
+    finally {
+        await handle.close();
+    }
+}
+export async function inspectUploadFile(input) {
+    input.signal.throwIfAborted();
+    try {
+        const requestedPath = fileURLToPath(input.url);
+        if (input.allowSensitivePath !== true)
+            assertSafePath(requestedPath);
+        const filePath = await realpath(requestedPath);
+        if (input.allowSensitivePath !== true)
+            assertSafePath(filePath);
+        const details = await stat(filePath);
+        if (!details.isFile())
+            return reject();
+        const header = await readHeader(filePath, input.signal);
+        const detected = detectedFormat(header);
+        const extension = extname(requestedPath).slice(1).toLowerCase();
+        const format = detected ?? (extension === "jpg" ? "jpeg" : extension);
+        if (format === "")
+            return reject();
+        const detectedMediaType = detected === undefined ? undefined : mediaTypes[detected];
+        if (detectedMediaType !== undefined
+            && input.claimedMediaType !== undefined
+            && input.claimedMediaType.trim().toLowerCase() !== detectedMediaType) {
+            return reject();
+        }
+        return {
+            filePath,
+            filename: basename(requestedPath),
+            format,
+            mediaType: detectedMediaType
+                ?? input.claimedMediaType
+                ?? mediaTypes[format]
+                ?? `application/${format}`,
+            size: details.size
+        };
+    }
+    catch (error) {
+        if (input.signal.aborted)
+            throw input.signal.reason;
+        if (error instanceof LocalFileInputError)
+            throw error;
+        throw new LocalFileInputError();
+    }
+}

package/dist/src/platform/signature.js

@@ -0,0 +1,20 @@
+import { createHmac } from "node:crypto";
+export function canonicalizeQuery(entries) {
+    const sorted = [...entries].sort(([left], [right]) => left.localeCompare(right));
+    return new URLSearchParams(sorted.map(([key, value]) => [key, value]))
+        .toString()
+        .replaceAll("%2C", ",")
+        .replaceAll("%3A", ":");
+}
+export function createSigningString(input) {
+    return `${input.method.toUpperCase()}@${input.pathname}@${input.canonicalQuery}@${input.timestamp}`;
+}
+export function signRequest(input) {
+    return hmac(input.secretKey, createSigningString(input));
+}
+export function signBindOrganization(input) {
+    return hmac(input.secretKey, `GET@/oauth/device/bind-org@ak=${input.accessKey}&orgId=${input.organizationId}@${input.timestamp}`);
+}
+function hmac(secret, value) {
+    return createHmac("sha256", secret).update(value).digest("hex");
+}

package/dist/src/platform/signed-http-transport.js

@@ -0,0 +1,143 @@
+import { remoteErrorEvidence } from "./remote-error-evidence.js";
+import { RemoteProtocolError } from "./remote-protocol.js";
+import { canonicalizeQuery, signRequest } from "./signature.js";
+export class RemoteRequestError extends Error {
+    status;
+    transient;
+    remoteCode;
+    remoteBody;
+    constructor(status, transient = false, evidence = {}) {
+        super(status === undefined ? "无法连接稿定服务。" : `稿定服务请求失败（HTTP ${status}）。`);
+        this.name = "RemoteRequestError";
+        this.status = status;
+        this.transient = transient;
+        this.remoteCode = evidence.remoteCode;
+        this.remoteBody = evidence.remoteBody;
+    }
+}
+const TRANSIENT_NETWORK_CODES = new Set([
+    "ECONNRESET",
+    "ECONNREFUSED",
+    "ETIMEDOUT",
+    "EPIPE",
+    "ENOTFOUND",
+    "EAI_AGAIN",
+    "UND_ERR_SOCKET",
+    "UND_ERR_CONNECT_TIMEOUT"
+]);
+function isTransientNetworkFailure(error, seen = new WeakSet()) {
+    if (error === null || typeof error !== "object" || seen.has(error))
+        return false;
+    seen.add(error);
+    if ("code" in error
+        && typeof error.code === "string"
+        && TRANSIENT_NETWORK_CODES.has(error.code)) {
+        return true;
+    }
+    if (error instanceof AggregateError
+        && error.errors.some((item) => isTransientNetworkFailure(item, seen))) {
+        return true;
+    }
+    return "cause" in error && isTransientNetworkFailure(error.cause, seen);
+}
+export function createSignedHttpTransport(options) {
+    const baseUrl = new URL(options.baseUrl);
+    if (!baseUrl.pathname.endsWith("/"))
+        baseUrl.pathname += "/";
+    async function send(method, request, accept, body, timeout) {
+        request.signal.throwIfAborted();
+        const url = new URL(request.path.replace(/^\//, ""), baseUrl);
+        const query = canonicalizeQuery(Object.entries(request.query ?? {}));
+        url.search = query;
+        const timestamp = Math.floor(options.now().getTime() / 1000);
+        const headers = {
+            Accept: accept,
+            "X-AccessKey": request.credential.accessKey,
+            "X-Signature": signRequest({
+                method,
+                pathname: url.pathname,
+                canonicalQuery: query,
+                timestamp,
+                secretKey: request.credential.secretKey
+            }),
+            "X-Timestamp": String(timestamp)
+        };
+        if (options.traceparent !== undefined)
+            headers.traceparent = options.traceparent();
+        if (options.channelId !== undefined)
+            headers["X-Channel-Id"] = options.channelId;
+        if (body !== undefined)
+            headers["Content-Type"] = "application/json";
+        if (request.organizationId !== undefined)
+            headers["X-Org-Id"] = request.organizationId;
+        const signal = timeout
+            ? AbortSignal.any([
+                request.signal,
+                AbortSignal.timeout(options.timeoutMs ?? 30_000)
+            ])
+            : request.signal;
+        try {
+            return await options.fetch(url, {
+                method,
+                headers,
+                ...(body === undefined ? {} : { body }),
+                signal
+            });
+        }
+        catch (error) {
+            if (request.signal.aborted)
+                throw request.signal.reason;
+            throw new RemoteRequestError(undefined, isTransientNetworkFailure(error));
+        }
+    }
+    async function json(response) {
+        let body;
+        try {
+            body = await response.text();
+        }
+        catch {
+            throw new RemoteRequestError(response.status);
+        }
+        const evidence = remoteErrorEvidence(body);
+        if (!response.ok)
+            throw new RemoteRequestError(response.status, false, evidence);
+        try {
+            return JSON.parse(body);
+        }
+        catch {
+            throw new RemoteProtocolError(evidence);
+        }
+    }
+    async function getJsonResponse(request) {
+        const response = await send("GET", request, "application/json", undefined, true);
+        return { body: await json(response), headers: response.headers };
+    }
+    return {
+        async getJson(request) {
+            return (await getJsonResponse(request)).body;
+        },
+        getJsonResponse,
+        async postJson(request) {
+            return json(await send("POST", request, "application/json", JSON.stringify(request.body), true));
+        },
+        async putJson(request) {
+            return json(await send("PUT", request, "application/json", JSON.stringify(request.body), true));
+        },
+        async postStream(request) {
+            const response = await send("POST", request, request.accept, JSON.stringify(request.body), false);
+            if (!response.ok) {
+                let body;
+                try {
+                    body = await response.text();
+                }
+                catch {
+                    throw new RemoteRequestError(response.status);
+                }
+                throw new RemoteRequestError(response.status, false, remoteErrorEvidence(body));
+            }
+            if (!response.body)
+                throw new RemoteRequestError(response.status);
+            return response.body;
+        }
+    };
+}