@hadooppei/hwcode 0.2.1 → 1.0.0

package/.pi/lib/workflows/cloud/remote/host-key.ts

@@ -0,0 +1,35 @@
+import { createHash } from "node:crypto";
+
+export interface SshHostKey {
+  line: string;
+  algorithm: string;
+  fingerprint: string;
+}
+
+export function parseSshKeyscan(output: string): SshHostKey[] {
+  const keys: SshHostKey[] = [];
+  const seen = new Set<string>();
+  for (const rawLine of output.split(/\r?\n/u)) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#")) continue;
+    const fields = line.split(/\s+/u);
+    if (fields.length < 3 || !/^ssh-|^ecdsa-/u.test(fields[1]!)) continue;
+    let decoded: Buffer;
+    try { decoded = Buffer.from(fields[2]!, "base64"); } catch { continue; }
+    if (decoded.length === 0 || decoded.toString("base64").replace(/=+$/u, "") !== fields[2]!.replace(/=+$/u, "")) continue;
+    const fingerprint = `SHA256:${createHash("sha256").update(decoded).digest("base64").replace(/=+$/u, "")}`;
+    if (seen.has(fingerprint)) continue;
+    seen.add(fingerprint);
+    keys.push({ line, algorithm: fields[1]!, fingerprint });
+  }
+  return keys.sort((left, right) => {
+    const rank = (algorithm: string) => algorithm === "ssh-ed25519" ? 0 : algorithm.startsWith("ecdsa-") ? 1 : 2;
+    return rank(left.algorithm) - rank(right.algorithm);
+  });
+}
+
+export function mergeKnownHosts(existing: string, scanned: readonly SshHostKey[]): string {
+  const lines = new Set(existing.split(/\r?\n/u).map((line) => line.trim()).filter(Boolean));
+  for (const key of scanned) lines.add(key.line);
+  return `${[...lines].join("\n")}\n`;
+}

package/.pi/lib/workflows/cloud/remote/profiles.ts

@@ -0,0 +1,100 @@
+import { isAbsolute } from "node:path";
+
+import type { CloudVendorId } from "../providers.ts";
+
+export type RemoteIdentityType = "instance-role" | "agency" | "ssh-only";
+
+export interface RemoteTargetProfile {
+  id: string;
+  name: string;
+  vendor: CloudVendorId;
+  region: string;
+  host: string;
+  port: number;
+  user: string;
+  keyPath: string;
+  hostKeyFingerprint: string;
+  knownHostsPath: string;
+  remoteRoot: string;
+  identityType: RemoteIdentityType;
+  terraformPath?: string;
+  proxyJump?: {
+    host: string;
+    port: number;
+    user: string;
+  };
+}
+
+export interface RemoteTargetSummary {
+  id: string;
+  name: string;
+  vendor: CloudVendorId;
+  region: string;
+  host: string;
+  port: number;
+  user: string;
+  remoteRoot: string;
+  identityType: RemoteIdentityType;
+  hostKeyFingerprint: string;
+}
+
+function nonEmpty(value: unknown): value is string {
+  return typeof value === "string" && value.trim().length > 0;
+}
+
+function validHost(value: unknown): value is string {
+  return nonEmpty(value) && !/[\s\0]/u.test(value);
+}
+
+export function validateRemoteTargetProfile(value: unknown): RemoteTargetProfile {
+  if (!value || typeof value !== "object") throw new Error("invalid remote target profile");
+  const data = value as Record<string, unknown>;
+  if (!nonEmpty(data.id) || !nonEmpty(data.name) || !nonEmpty(data.vendor)
+    || !nonEmpty(data.region) || !validHost(data.host) || !nonEmpty(data.user)
+    || !nonEmpty(data.keyPath) || !nonEmpty(data.hostKeyFingerprint)
+    || !nonEmpty(data.knownHostsPath) || !nonEmpty(data.remoteRoot)
+    || !isAbsolute(data.keyPath as string) || !isAbsolute(data.knownHostsPath as string)
+    || !isAbsolute(data.remoteRoot as string)
+    || !Number.isInteger(data.port) || (data.port as number) < 1 || (data.port as number) > 65_535
+    || !(["aws", "azure", "gcp", "huawei", "alibaba", "tencent"] as unknown[]).includes(data.vendor)
+    || !(["instance-role", "agency", "ssh-only"] as unknown[]).includes(data.identityType)) {
+    throw new Error("invalid remote target profile");
+  }
+  if ((data.remoteRoot as string) === "/") throw new Error("remote root cannot be filesystem root");
+  if (data.terraformPath !== undefined && !nonEmpty(data.terraformPath)) {
+    throw new Error("invalid terraform path");
+  }
+  let proxyJump: RemoteTargetProfile["proxyJump"];
+  if (data.proxyJump !== undefined) {
+    if (!data.proxyJump || typeof data.proxyJump !== "object") throw new Error("invalid SSH ProxyJump");
+    const jump = data.proxyJump as Record<string, unknown>;
+    if (!validHost(jump.host) || !nonEmpty(jump.user) || !Number.isInteger(jump.port)
+      || (jump.port as number) < 1 || (jump.port as number) > 65_535) throw new Error("invalid SSH ProxyJump");
+    proxyJump = { host: jump.host, port: jump.port as number, user: jump.user };
+  }
+  return {
+    id: data.id as string,
+    name: data.name as string,
+    vendor: data.vendor as CloudVendorId,
+    region: data.region as string,
+    host: data.host as string,
+    port: data.port as number,
+    user: data.user as string,
+    keyPath: data.keyPath as string,
+    hostKeyFingerprint: data.hostKeyFingerprint as string,
+    knownHostsPath: data.knownHostsPath as string,
+    remoteRoot: data.remoteRoot as string,
+    identityType: data.identityType as RemoteIdentityType,
+    terraformPath: data.terraformPath as string | undefined,
+    proxyJump,
+  };
+}
+
+export function remoteTargetSummary(profile: RemoteTargetProfile): RemoteTargetSummary {
+  const { keyPath: _keyPath, knownHostsPath: _knownHostsPath, terraformPath: _terraformPath, proxyJump: _proxyJump, ...summary } = profile;
+  return summary;
+}
+
+export function remoteTargetLabel(profile: RemoteTargetProfile): string {
+  return `${profile.name} · ${profile.vendor}/${profile.region} · ${profile.user}@${profile.host}:${profile.port}`;
+}

package/.pi/lib/workflows/cloud/remote/ssh-transport.ts

@@ -0,0 +1,104 @@
+import { spawn } from "node:child_process";
+
+import { shellQuote } from "../../../working-directory.ts";
+import { isolatedCloudEnvironment } from "../process.ts";
+import { CLOUD_RUNTIME_DEFAULTS } from "../../../runtime/defaults.ts";
+import type { RemoteTargetProfile } from "./profiles.ts";
+
+export interface SshRunResult {
+  stdout: string;
+  stderr: string;
+  code: number;
+  killed: boolean;
+  timedOut: boolean;
+}
+
+export interface SshRunOptions {
+  cwd?: string;
+  remoteCwd?: string;
+  signal?: AbortSignal;
+  timeoutMs?: number;
+  input?: string | Uint8Array;
+  onOutput?: (chunk: string, stream: "stdout" | "stderr") => void;
+}
+
+function remoteTarget(profile: RemoteTargetProfile): string {
+  return `${profile.user}@${profile.host}`;
+}
+
+export function buildSshArgs(profile: RemoteTargetProfile, command: string, args: readonly string[] = [], remoteCwd = profile.remoteRoot): string[] {
+  const remoteCommand = [
+    ...(remoteCwd ? [`cd ${shellQuote(remoteCwd)}`] : []),
+    [command, ...args].map(shellQuote).join(" "),
+  ].join(" && ");
+  const connection = [
+    "-T",
+    "-o", "BatchMode=yes",
+    "-o", "StrictHostKeyChecking=yes",
+    "-o", `UserKnownHostsFile=${profile.knownHostsPath}`,
+    "-o", `ConnectTimeout=${CLOUD_RUNTIME_DEFAULTS.runner.connectTimeoutSeconds}`,
+    ...(profile.proxyJump ? ["-J", `${profile.proxyJump.user}@${profile.proxyJump.host}:${profile.proxyJump.port}`] : []),
+    "-p", String(profile.port),
+    "-i", profile.keyPath,
+    remoteTarget(profile),
+    remoteCommand,
+  ];
+  return connection;
+}
+
+export function runSsh(
+  profile: RemoteTargetProfile,
+  command: string,
+  args: readonly string[] = [],
+  options: SshRunOptions = {},
+): Promise<SshRunResult> {
+  return new Promise((resolve) => {
+    const child = spawn("ssh", buildSshArgs(profile, command, args, options.remoteCwd), {
+      cwd: options.cwd,
+      env: isolatedCloudEnvironment(),
+      stdio: ["pipe", "pipe", "pipe"],
+      shell: false,
+    });
+    let stdout = "";
+    let stderr = "";
+    let killed = false;
+    let timedOut = false;
+    let settled = false;
+    let forceKillTimer: ReturnType<typeof setTimeout> | undefined;
+    const timeout = setTimeout(() => {
+      timedOut = true;
+      killed = true;
+      child.kill("SIGTERM");
+      forceKillTimer ??= setTimeout(() => child.kill("SIGKILL"), CLOUD_RUNTIME_DEFAULTS.process.forceKillGraceMs);
+    }, options.timeoutMs ?? CLOUD_RUNTIME_DEFAULTS.runner.commandTimeoutMs);
+    const abort = () => {
+      killed = true;
+      child.kill("SIGTERM");
+      forceKillTimer ??= setTimeout(() => child.kill("SIGKILL"), CLOUD_RUNTIME_DEFAULTS.process.forceKillGraceMs);
+    };
+    const finish = (code: number) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timeout);
+      if (forceKillTimer) clearTimeout(forceKillTimer);
+      options.signal?.removeEventListener("abort", abort);
+      resolve({ stdout, stderr, code, killed, timedOut });
+    };
+    if (options.signal?.aborted) abort();
+    else options.signal?.addEventListener("abort", abort, { once: true });
+    child.stdout.on("data", (chunk: Buffer) => {
+      const text = chunk.toString("utf8");
+      stdout += text;
+      options.onOutput?.(text, "stdout");
+    });
+    child.stderr.on("data", (chunk: Buffer) => {
+      const text = chunk.toString("utf8");
+      stderr += text;
+      options.onOutput?.(text, "stderr");
+    });
+    child.on("error", (error) => { stderr += error.message; finish(127); });
+    child.on("close", (code) => finish(code ?? 1));
+    if (options.input !== undefined) child.stdin.end(options.input);
+    else child.stdin.end();
+  });
+}

package/.pi/lib/workflows/cloud/remote/workspace.ts

@@ -0,0 +1,109 @@
+import { createHash, randomUUID } from "node:crypto";
+import { spawn } from "node:child_process";
+import { readdirSync, readFileSync } from "node:fs";
+import { isAbsolute, join, relative, sep } from "node:path";
+import type { RemoteTargetProfile } from "./profiles.ts";
+import { runSsh, type SshRunResult } from "./ssh-transport.ts";
+
+const EXCLUDED_NAMES = new Set([".terraform", "terraform.tfstate", "terraform.tfstate.backup"]);
+const EXCLUDED_SUFFIXES = [".tfplan", ".tfstate", ".tfstate.backup", ".tfvars", ".tfvars.json"];
+
+export interface SyncFile {
+  relativePath: string;
+  bytes: number;
+  sha256: string;
+}
+
+export interface RemoteRunWorkspace {
+  runId: string;
+  remotePath: string;
+  sourceDigest: string;
+  files: SyncFile[];
+}
+
+function isExcluded(name: string): boolean {
+  return EXCLUDED_NAMES.has(name) || EXCLUDED_SUFFIXES.some((suffix) => name.endsWith(suffix));
+}
+
+function collectFiles(root: string, directory: string, output: SyncFile[]): void {
+  for (const entry of readdirSync(directory, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name))) {
+    if (isExcluded(entry.name)) continue;
+    const path = join(directory, entry.name);
+    if (entry.isDirectory()) collectFiles(root, path, output);
+    else if (entry.isSymbolicLink()) throw new Error(`Terraform source cannot contain symbolic links: ${relative(root, path)}`);
+    else if (entry.isFile()) {
+      const content = readFileSync(path);
+      const relativePath = relative(root, path).split(sep).join("/");
+      if (/[\r\n\0]/u.test(relativePath)) throw new Error(`Terraform source contains an unsupported file name: ${relativePath}`);
+      output.push({
+        relativePath,
+        bytes: content.byteLength,
+        sha256: createHash("sha256").update(content).digest("hex"),
+      });
+    }
+  }
+}
+
+export function createRemoteRunWorkspace(root: string, remoteRoot: string, runId = randomUUID()): RemoteRunWorkspace {
+  if (!isAbsolute(root) || !isAbsolute(remoteRoot) || remoteRoot === "/") throw new Error("absolute workspace roots are required");
+  const files: SyncFile[] = [];
+  collectFiles(root, root, files);
+  const sourceDigest = createHash("sha256")
+    .update(files.map((file) => `${file.relativePath}\0${file.sha256}`).join("\n"))
+    .digest("hex");
+  return { runId, remotePath: join(remoteRoot, "runs", runId), sourceDigest, files };
+}
+
+export function assertRemoteWorkspacePath(remoteRoot: string, remotePath: string): void {
+  const root = remoteRoot.endsWith(sep) ? remoteRoot : `${remoteRoot}${sep}`;
+  if (!isAbsolute(remotePath) || !(remotePath === remoteRoot || remotePath.startsWith(root))) {
+    throw new Error("remote workspace path is outside the configured runner root");
+  }
+}
+
+export function isTerraformSourceFile(path: string): boolean {
+  return path.endsWith(".tf") || path.endsWith(".tf.json") || path.endsWith(".hcl");
+}
+
+function createTarArchive(root: string, files: readonly SyncFile[], signal?: AbortSignal): Promise<Buffer> {
+  return new Promise((resolve, reject) => {
+    const child = spawn("tar", [
+      "-czf", "-",
+      "-C", root, "--",
+      ...files.map((file) => file.relativePath),
+    ], { stdio: ["ignore", "pipe", "pipe"], shell: false });
+    const chunks: Buffer[] = [];
+    const errors: Buffer[] = [];
+    const abort = () => child.kill("SIGTERM");
+    signal?.addEventListener("abort", abort, { once: true });
+    child.stdout.on("data", (chunk: Buffer) => chunks.push(chunk));
+    child.stderr.on("data", (chunk: Buffer) => errors.push(chunk));
+    child.on("error", reject);
+    child.on("close", (code) => {
+      signal?.removeEventListener("abort", abort);
+      if (signal?.aborted) reject(new Error("Terraform source sync aborted"));
+      else if (code !== 0) reject(new Error(`cannot archive Terraform source: ${Buffer.concat(errors).toString("utf8")}`));
+      else resolve(Buffer.concat(chunks));
+    });
+  });
+}
+
+export async function syncRemoteWorkspace(
+  profile: RemoteTargetProfile,
+  sourceRoot: string,
+  workspace: RemoteRunWorkspace,
+  signal?: AbortSignal,
+): Promise<SshRunResult> {
+  assertRemoteWorkspacePath(profile.remoteRoot, workspace.remotePath);
+  const mkdir = await runSsh(profile, "mkdir", ["-p", workspace.remotePath], { signal, remoteCwd: "" });
+  if (mkdir.code !== 0) throw new Error(`cannot create remote Terraform workspace: ${mkdir.stderr.trim() || mkdir.code}`);
+  const archive = await createTarArchive(sourceRoot, workspace.files, signal);
+  const unpack = await runSsh(profile, "tar", ["-xzf", "-"], { signal, remoteCwd: workspace.remotePath, input: archive });
+  if (unpack.code !== 0) throw new Error(`cannot sync Terraform source: ${unpack.stderr.trim() || unpack.code}`);
+  const verified = await runSsh(profile, "sha256sum", workspace.files.map((file) => file.relativePath), { signal, remoteCwd: workspace.remotePath });
+  if (verified.code !== 0) throw new Error(`cannot verify remote Terraform source: ${verified.stderr.trim() || verified.code}`);
+  const actual = new Map(verified.stdout.split(/\r?\n/u).map((line) => line.match(/^([a-f0-9]{64})\s+\*?(.+)$/u)).filter((match): match is RegExpMatchArray => Boolean(match)).map((match) => [match[2]!, match[1]!]));
+  const mismatch = workspace.files.find((file) => actual.get(file.relativePath) !== file.sha256);
+  if (mismatch) throw new Error(`remote Terraform source digest mismatch: ${mismatch.relativePath}`);
+  return unpack;
+}

package/.pi/lib/workflows/cloud/template-save.ts

@@ -0,0 +1,108 @@
+import type { CloudPromptTemplate } from "./templates.ts";
+import { cloudPromptTemplateSource } from "./templates.ts";
+import type { CloudWorkflowDetails, WorkflowState } from "../state.ts";
+import { CLOUD_RUNTIME_DEFAULTS } from "../../runtime/defaults.ts";
+
+export type CloudTemplateSourceAction = "update" | "create" | "cancel";
+export type CloudTemplateSaveStage = "source-action" | "name" | "notes";
+
+export interface CloudTemplateSaveInteraction {
+  chooseSourceAction(source: CloudPromptTemplate): Promise<CloudTemplateSourceAction | undefined>;
+  inputName(defaultName: string): Promise<string | undefined>;
+  editNotes(initialNotes: string): Promise<string | undefined>;
+  sourceMissing(sourceName: string): void | Promise<void>;
+}
+
+export interface CloudTemplateStore {
+  list(): CloudPromptTemplate[];
+  create(name: string, state: WorkflowState, notes: string): CloudPromptTemplate;
+  update(template: CloudPromptTemplate, state: WorkflowState, notes: string): CloudPromptTemplate;
+}
+
+export type CloudTemplateSaveResult =
+  | { status: "cancelled"; stage: CloudTemplateSaveStage }
+  | {
+    status: "saved";
+    action: "created" | "updated";
+    template: CloudPromptTemplate;
+    details: CloudWorkflowDetails;
+  };
+
+export interface SaveCloudWorkflowTemplateOptions {
+  state: WorkflowState;
+  requestedName?: string;
+  interaction: CloudTemplateSaveInteraction;
+  store: CloudTemplateStore;
+  redact?: (value: string) => string;
+}
+
+/**
+ * Coordinates the save/update decision without depending on Pi UI or filesystem APIs.
+ * Storage is invoked only after every interactive step succeeds, so cancellation and
+ * storage failures cannot partially change the workflow state.
+ */
+export async function saveCloudWorkflowTemplate(
+  options: SaveCloudWorkflowTemplateOptions,
+): Promise<CloudTemplateSaveResult> {
+  const { state, interaction, store } = options;
+  if (state.mode !== "cloud" || !state.details) throw new Error("Cloud workflow state is required");
+  if (state.details.successfulSteps.length === 0) {
+    throw new Error("No successful Cloud execution steps are available to summarize");
+  }
+
+  const details = state.details;
+  let target: CloudPromptTemplate | undefined;
+  if (details.sourceTemplate) {
+    target = store.list().find((template) => template.id === details.sourceTemplate?.id);
+    if (target) {
+      const sourceAction = await interaction.chooseSourceAction(target);
+      if (!sourceAction || sourceAction === "cancel") {
+        return { status: "cancelled", stage: "source-action" };
+      }
+      if (sourceAction === "create") target = undefined;
+    } else {
+      await interaction.sourceMissing(details.sourceTemplate.name);
+    }
+  }
+
+  let name = target?.name;
+  if (!name) {
+    const suppliedName = options.requestedName?.trim();
+    if (suppliedName) {
+      name = suppliedName;
+    } else {
+      const defaultName = details.sourceTemplate
+        ? `${details.sourceTemplate.name} 副本`
+        : details.request.slice(0, CLOUD_RUNTIME_DEFAULTS.templates.slugMaxLength);
+      name = (await interaction.inputName(defaultName))?.trim();
+    }
+    if (!name) return { status: "cancelled", stage: "name" };
+  }
+
+  const notes = await interaction.editNotes(target?.notes ?? "");
+  if (notes === undefined) return { status: "cancelled", stage: "notes" };
+
+  const redact = options.redact ?? ((value: string) => value);
+  const safeName = redact(name);
+  const safeNotes = redact(notes.trim());
+  const safeState: WorkflowState = {
+    ...state,
+    details: {
+      ...details,
+      request: redact(details.request),
+      templateGuidance: details.templateGuidance === undefined
+        ? undefined
+        : redact(details.templateGuidance),
+    },
+  };
+  const template = target
+    ? store.update(target, safeState, safeNotes)
+    : store.create(safeName, safeState, safeNotes);
+
+  return {
+    status: "saved",
+    action: target ? "updated" : "created",
+    template,
+    details: { ...details, sourceTemplate: cloudPromptTemplateSource(template) },
+  };
+}