@graychennpm/codebridge 0.0.0-stage → 0.1.0

package/node_modules/@codebridge/core/dist/mentions.js

@@ -0,0 +1,138 @@
+import { JsonMapStore } from "./json-file-store.js";
+function scopeKey(scope) {
+    return `${scope.chatId}\0${scope.topicId ?? ""}`;
+}
+function targetKey(target) {
+    return `${target.channel}\0${target.kind}\0${target.id}`;
+}
+export class MentionRegistry {
+    targetByKey = new Map();
+    targetByRef = new Map();
+    refsByScope = new Map();
+    nextUserRef = 1;
+    nextBotRef = 1;
+    store;
+    constructor(filePath) {
+        if (!filePath)
+            return;
+        this.store = new JsonMapStore(filePath);
+        const saved = this.store.read();
+        if (!saved || typeof saved !== "object" || Array.isArray(saved)) {
+            throw new Error("Invalid persisted mention registry");
+        }
+        for (const [ref, entry] of Object.entries(saved)) {
+            const target = entry?.target;
+            const ordinal = Number(ref.slice(1));
+            if (!/^[ub][1-9]\d*$/.test(ref) || !Number.isSafeInteger(ordinal + 1)
+                || !target || target.ref !== ref
+                || target.kind !== (ref[0] === "u" ? "user" : "bot")
+                || typeof target.id !== "string" || !target.id
+                || typeof target.channel !== "string" || !target.channel
+                || !Array.isArray(entry.scopes)
+                || entry.scopes.some((scope) => typeof scope !== "string" || !scope.includes("\0"))
+                || this.targetByKey.has(targetKey(target))) {
+                throw new Error("Invalid persisted mention registry");
+            }
+            this.targetByKey.set(targetKey(target), target);
+            this.targetByRef.set(ref, target);
+            for (const scope of entry.scopes) {
+                const refs = this.refsByScope.get(scope) ?? new Set();
+                refs.add(ref);
+                this.refsByScope.set(scope, refs);
+            }
+            if (target.kind === "user")
+                this.nextUserRef = Math.max(this.nextUserRef, ordinal + 1);
+            else
+                this.nextBotRef = Math.max(this.nextBotRef, ordinal + 1);
+        }
+    }
+    register(scope, target) {
+        const key = targetKey(target);
+        const previous = this.targetByKey.get(key);
+        const registered = previous
+            ? {
+                ...previous,
+                ...target,
+                name: target.name ?? previous.name,
+                username: target.username ?? previous.username,
+            }
+            : {
+                ...target,
+                ref: target.kind === "bot"
+                    ? `b${this.nextBotRef++}`
+                    : `u${this.nextUserRef++}`,
+            };
+        this.targetByKey.set(key, registered);
+        this.targetByRef.set(registered.ref, registered);
+        const scoped = this.refsByScope.get(scopeKey(scope)) ?? new Set();
+        scoped.add(registered.ref);
+        this.refsByScope.set(scopeKey(scope), scoped);
+        this.save();
+        return registered;
+    }
+    /** Drop stored names that are really labels (e.g. a role written by an older version). Returns how many were cleared. */
+    forgetNames(names) {
+        let cleared = 0;
+        for (const [ref, target] of this.targetByRef) {
+            if (target.name === undefined || !names.includes(target.name))
+                continue;
+            const { name: _dropped, ...rest } = target;
+            this.targetByRef.set(ref, rest);
+            this.targetByKey.set(targetKey(rest), rest);
+            cleared += 1;
+        }
+        if (cleared)
+            this.save();
+        return cleared;
+    }
+    save() {
+        if (!this.store)
+            return;
+        const saved = {};
+        for (const [ref, target] of this.targetByRef)
+            saved[ref] = { target, scopes: [] };
+        for (const [key, refs] of this.refsByScope) {
+            for (const ref of refs)
+                saved[ref].scopes.push(key);
+        }
+        this.store.write(saved);
+    }
+    resolve(scope, ref) {
+        if (!this.refsByScope.get(scopeKey(scope))?.has(ref))
+            return undefined;
+        return this.targetByRef.get(ref);
+    }
+    list(scope) {
+        return [...(this.refsByScope.get(scopeKey(scope)) ?? [])]
+            .map((ref) => this.targetByRef.get(ref))
+            .filter((target) => Boolean(target));
+    }
+}
+/**
+ * `roles` labels a target for this prompt only (e.g. an alert approver).
+ * Roles are never stored as the target's name: the registry is shared across chats.
+ */
+export function formatMentionGuidance(targets, requesterRef, roles = {}) {
+    if (targets.length === 0)
+        return "";
+    const lines = targets.map((target) => {
+        const label = target.name ??
+            target.username ??
+            (target.ref === requesterRef ? "当前发送者" : target.id);
+        const role = roles[target.ref] !== undefined
+            ? `（${roles[target.ref]}）`
+            : target.ref === requesterRef
+                ? "（当前发送者）"
+                : target.kind === "bot"
+                    ? "（机器人）"
+                    : "";
+        return `- ${target.ref}：${label}${role}`;
+    });
+    return [
+        "【可主动通知对象】",
+        ...lines,
+        '需要主动提醒其中某个对象时，执行 `fcb mention <对象引用> "<消息>"`。',
+        "仅在确实需要主动通知时使用；普通回复不要调用，也不要自行猜测对象引用。",
+    ].join("\n");
+}
+//# sourceMappingURL=mentions.js.map

package/node_modules/@codebridge/core/dist/secret-migration.d.ts

@@ -0,0 +1,14 @@
+import { type SecretOptions } from "./secret-refs.js";
+export interface SecretMigration {
+    migrated: string[];
+    /** Field name -> why it was left as is (already a ref, missing, placeholder). */
+    skipped: Record<string, string>;
+}
+/**
+ * Move plaintext secrets from config.yaml into the OS keychain and replace them with
+ * keychain: refs. Nothing is written if any target item already holds a different value;
+ * each secret is read back before the file changes, and the file is rewritten once,
+ * atomically, keeping comments. A symlinked config.yaml is updated at its real target.
+ */
+export declare function migrateConfigSecrets(configPath: string, options?: SecretOptions): SecretMigration;
+//# sourceMappingURL=secret-migration.d.ts.map

package/node_modules/@codebridge/core/dist/secret-migration.js

@@ -0,0 +1,55 @@
+import fs from "node:fs";
+import path from "node:path";
+import { parseDocument } from "yaml";
+import { SECRET_PATHS, isPlaintextSecret, keychainServiceFor, resolveSecretRef, secretPathName, secretSourceOf, storeKeychainSecret, } from "./secret-refs.js";
+function readKeychain(service, options) {
+    try {
+        return resolveSecretRef(`keychain:${service}`, options);
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Move plaintext secrets from config.yaml into the OS keychain and replace them with
+ * keychain: refs. Nothing is written if any target item already holds a different value;
+ * each secret is read back before the file changes, and the file is rewritten once,
+ * atomically, keeping comments. A symlinked config.yaml is updated at its real target.
+ */
+export function migrateConfigSecrets(configPath, options = {}) {
+    const target = fs.realpathSync(configPath);
+    const dataDir = path.dirname(configPath);
+    const doc = parseDocument(fs.readFileSync(target, "utf8"));
+    const result = { migrated: [], skipped: {} };
+    const plan = [];
+    for (const secretPath of SECRET_PATHS) {
+        const name = secretPathName(secretPath);
+        const value = doc.getIn(secretPath);
+        if (!isPlaintextSecret(value)) {
+            result.skipped[name] = secretSourceOf(value);
+            continue;
+        }
+        const service = keychainServiceFor(secretPath, dataDir);
+        const existing = readKeychain(service, options);
+        if (existing !== undefined && existing !== value) {
+            throw new Error(`钥匙串条目 ${service} 已存在且值不同，未做任何修改（可能属于另一套 CodeBridge 配置）`);
+        }
+        plan.push({ secretPath, service, value, stored: existing === value });
+    }
+    for (const item of plan) {
+        if (!item.stored)
+            storeKeychainSecret(item.service, item.value, options);
+        if (readKeychain(item.service, options) !== item.value) {
+            throw new Error(`${secretPathName(item.secretPath)} 写入钥匙串后读回不一致，config.yaml 未修改`);
+        }
+        doc.setIn(item.secretPath, `keychain:${item.service}`);
+        result.migrated.push(secretPathName(item.secretPath));
+    }
+    if (result.migrated.length) {
+        const temporary = `${target}.${process.pid}.tmp`;
+        fs.writeFileSync(temporary, doc.toString(), { mode: 0o600, flag: "wx" });
+        fs.renameSync(temporary, target);
+    }
+    return result;
+}
+//# sourceMappingURL=secret-migration.js.map

package/node_modules/@codebridge/core/dist/secret-refs.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Config fields that may hold a secret reference instead of a plaintext value:
+ *   env:NAME          read from the environment variable NAME
+ *   keychain:SERVICE  macOS Keychain (security) or Linux Secret Service (secret-tool)
+ */
+export declare const SECRET_PATHS: readonly [readonly ["feishu", "appSecret"], readonly ["runner", "token"], readonly ["telegram", "botToken"]];
+export type SecretPath = (typeof SECRET_PATHS)[number];
+export type SecretSource = "keychain" | "env" | "plaintext" | "placeholder" | "missing";
+/** Env overrides read by ConfigStore for each secret field. */
+export declare const SECRET_ENV_VARS: Record<string, string>;
+export declare const KEYCHAIN_ACCOUNT = "codebridge";
+/** Runs a helper binary; `input` is written to stdin so secrets never appear in argv. */
+export type SecretCommand = (file: string, args: string[], input?: string) => string;
+export interface SecretOptions {
+    platform?: NodeJS.Platform;
+    env?: NodeJS.ProcessEnv;
+    run?: SecretCommand;
+}
+export declare function secretPathName(path: SecretPath): string;
+/**
+ * Keychain service for a field. Items are per data dir so a second install (e.g. a dev
+ * data dir) can never overwrite the production secrets; the default dir keeps short names.
+ */
+export declare function keychainServiceFor(secretPath: SecretPath, dataDir?: string): string;
+export declare function isSecretRef(value: unknown): value is string;
+export declare function secretSourceOf(value: unknown): SecretSource;
+/** A real plaintext secret worth migrating (not a default placeholder). */
+export declare function isPlaintextSecret(value: unknown): value is string;
+export declare function resolveSecretRef(ref: string, options?: SecretOptions): string;
+export declare function storeKeychainSecret(service: string, value: string, options?: SecretOptions): void;
+export declare function getPath(root: unknown, path: readonly string[]): unknown;
+/** Sets (or, for `undefined`, deletes) a nested value; never creates missing parents for a delete. */
+export declare function setPath(root: Record<string, unknown>, path: readonly string[], value: unknown): void;
+//# sourceMappingURL=secret-refs.d.ts.map

package/node_modules/@codebridge/core/dist/secret-refs.js

@@ -0,0 +1,142 @@
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+/**
+ * Config fields that may hold a secret reference instead of a plaintext value:
+ *   env:NAME          read from the environment variable NAME
+ *   keychain:SERVICE  macOS Keychain (security) or Linux Secret Service (secret-tool)
+ */
+export const SECRET_PATHS = [
+    ["feishu", "appSecret"],
+    ["runner", "token"],
+    ["telegram", "botToken"],
+];
+/** Env overrides read by ConfigStore for each secret field. */
+export const SECRET_ENV_VARS = {
+    "feishu.appSecret": "FEISHU_APP_SECRET",
+    "runner.token": "RUNNER_TOKEN",
+    "telegram.botToken": "TELEGRAM_BOT_TOKEN",
+};
+export const KEYCHAIN_ACCOUNT = "codebridge";
+const PLACEHOLDERS = new Set(["secret_placeholder", "change-me-runner-token"]);
+const defaultRun = (file, args, input) => execFileSync(file, args, { encoding: "utf8", input, timeout: 10_000, stdio: ["pipe", "pipe", "pipe"] });
+export function secretPathName(path) {
+    return path.join(".");
+}
+/**
+ * Keychain service for a field. Items are per data dir so a second install (e.g. a dev
+ * data dir) can never overwrite the production secrets; the default dir keeps short names.
+ */
+export function keychainServiceFor(secretPath, dataDir) {
+    const name = secretPathName(secretPath);
+    if (!dataDir)
+        return `codebridge.${name}`;
+    const real = fs.existsSync(dataDir) ? fs.realpathSync(dataDir) : path.resolve(dataDir);
+    const defaultDir = path.join(os.homedir(), ".codebridge");
+    const defaultReal = fs.existsSync(defaultDir) ? fs.realpathSync(defaultDir) : defaultDir;
+    if (real === defaultReal)
+        return `codebridge.${name}`;
+    return `codebridge.${createHash("sha256").update(real).digest("hex").slice(0, 8)}.${name}`;
+}
+export function isSecretRef(value) {
+    return typeof value === "string" && /^(env|keychain):\S+$/.test(value);
+}
+export function secretSourceOf(value) {
+    if (isSecretRef(value))
+        return value.startsWith("env:") ? "env" : "keychain";
+    if (typeof value !== "string" || value === "")
+        return "missing";
+    return PLACEHOLDERS.has(value) ? "placeholder" : "plaintext";
+}
+/** A real plaintext secret worth migrating (not a default placeholder). */
+export function isPlaintextSecret(value) {
+    return secretSourceOf(value) === "plaintext";
+}
+export function resolveSecretRef(ref, options = {}) {
+    const env = options.env ?? process.env;
+    const run = options.run ?? defaultRun;
+    const platform = options.platform ?? process.platform;
+    const [kind, name] = [ref.slice(0, ref.indexOf(":")), ref.slice(ref.indexOf(":") + 1)];
+    let value;
+    try {
+        if (kind === "env") {
+            value = env[name];
+        }
+        else if (platform === "darwin") {
+            value = run("/usr/bin/security", ["find-generic-password", "-s", name, "-a", KEYCHAIN_ACCOUNT, "-w"]);
+        }
+        else if (platform === "linux") {
+            value = run("secret-tool", ["lookup", "service", name, "account", KEYCHAIN_ACCOUNT]);
+        }
+        else {
+            throw new Error(`当前平台 ${platform} 不支持 keychain 引用`);
+        }
+    }
+    catch (error) {
+        throw new Error(`读取密钥 ${ref} 失败：${helperFailure(error)}${RECOVERY_HINT}`);
+    }
+    const resolved = value?.replace(/\r?\n$/, "");
+    if (!resolved)
+        throw new Error(`读取密钥 ${ref} 失败：${kind === "env" ? "环境变量未设置" : "钥匙串中没有该条目"}${RECOVERY_HINT}`);
+    return resolved;
+}
+const RECOVERY_HINT = "（codebridge secrets status 可逐项查看；也可把该字段临时改回明文或 env: 引用）";
+/** The helper's own reason (stderr), not execFileSync's "Command failed: <argv>" line. */
+function helperFailure(error) {
+    const stderr = error?.stderr;
+    const text = typeof stderr === "string" ? stderr : Buffer.isBuffer(stderr) ? stderr.toString("utf8") : "";
+    if (text.trim())
+        return text.trim().split("\n").at(-1).trim();
+    const message = error instanceof Error ? error.message : String(error);
+    const lines = message.split("\n").map((line) => line.trim()).filter(Boolean);
+    return (lines.length > 1 ? lines.at(-1) : lines[0]) ?? "未知错误";
+}
+export function storeKeychainSecret(service, value, options = {}) {
+    const run = options.run ?? defaultRun;
+    const platform = options.platform ?? process.platform;
+    if (!/^[A-Za-z0-9._-]+$/.test(service))
+        throw new Error(`钥匙串服务名 ${service} 含非法字符`);
+    if (platform === "darwin") {
+        // `security -i` reads the command from stdin; its parser has no escaping, so refuse
+        // anything that could break out of the quoted argument instead of guessing.
+        if (!/^[\x21-\x7e]+$/.test(value) || /["\\]/.test(value)) {
+            throw new Error(`${service} 含引号、反斜杠或空白，无法安全写入钥匙串；请手动写入后改为 keychain:${service}`);
+        }
+        run("/usr/bin/security", ["-i"], `add-generic-password -U -s ${service} -a ${KEYCHAIN_ACCOUNT} -w "${value}"\n`);
+    }
+    else if (platform === "linux") {
+        run("secret-tool", ["store", "--label", `CodeBridge ${service}`, "service", service, "account", KEYCHAIN_ACCOUNT], value);
+    }
+    else {
+        throw new Error(`当前平台 ${platform} 不支持钥匙串`);
+    }
+}
+export function getPath(root, path) {
+    let node = root;
+    for (const key of path) {
+        if (!node || typeof node !== "object")
+            return undefined;
+        node = node[key];
+    }
+    return node;
+}
+/** Sets (or, for `undefined`, deletes) a nested value; never creates missing parents for a delete. */
+export function setPath(root, path, value) {
+    let node = root;
+    for (const key of path.slice(0, -1)) {
+        if (!node[key] || typeof node[key] !== "object") {
+            if (value === undefined)
+                return;
+            node[key] = {};
+        }
+        node = node[key];
+    }
+    const last = path[path.length - 1];
+    if (value === undefined)
+        delete node[last];
+    else
+        node[last] = value;
+}
+//# sourceMappingURL=secret-refs.js.map

package/node_modules/@codebridge/core/dist/session-event-wire.d.ts

@@ -0,0 +1,17 @@
+export interface SessionEventWire {
+    schema_version: 1;
+    event_id: string;
+    sequence: number;
+    work_item_id: string;
+    run_id: string | null;
+    execution_kind: "agent" | "flow" | null;
+    type: string;
+    occurred_at: string;
+    actor: string;
+    target: string | null;
+    input_hash: string | null;
+    result_ref: string | null;
+    payload: Record<string, unknown>;
+}
+export declare function parseSessionEventWire(input: unknown): SessionEventWire;
+//# sourceMappingURL=session-event-wire.d.ts.map

package/node_modules/@codebridge/core/dist/session-event-wire.js

@@ -0,0 +1,28 @@
+export function parseSessionEventWire(input) {
+    if (!input || typeof input !== "object" || Array.isArray(input)) {
+        throw new Error("session_event_schema_mismatch");
+    }
+    const event = input;
+    if (event.schema_version !== 1
+        || typeof event.event_id !== "string"
+        || !Number.isInteger(event.sequence)
+        || typeof event.work_item_id !== "string"
+        || !(typeof event.run_id === "string" || event.run_id === null)
+        || !(event.execution_kind === "agent"
+            || event.execution_kind === "flow"
+            || event.execution_kind === null)
+        || (event.run_id === null) !== (event.execution_kind === null)
+        || typeof event.type !== "string"
+        || typeof event.occurred_at !== "string"
+        || typeof event.actor !== "string"
+        || !(typeof event.target === "string" || event.target === null)
+        || !(typeof event.input_hash === "string" || event.input_hash === null)
+        || !(typeof event.result_ref === "string" || event.result_ref === null)
+        || !event.payload
+        || typeof event.payload !== "object"
+        || Array.isArray(event.payload)) {
+        throw new Error("session_event_schema_mismatch");
+    }
+    return event;
+}
+//# sourceMappingURL=session-event-wire.js.map