@jingyi0605/codingns 0.8.1 → 0.9.0

package/dist/server/modules/plugins/plugin-permission-service.d.ts

@@ -0,0 +1,49 @@
+import type { PluginAuditEventRepository } from "../../storage/repositories/plugin-audit-event-repository.js";
+import type { PluginPermissionGrantRepository } from "../../storage/repositories/plugin-permission-grant-repository.js";
+import type { PluginDesktopPermission, PluginManifest, PluginPermissionGrant, PluginPermissionGrantMode, PluginPermissionKey } from "../../types/domain.js";
+export interface PluginRuntimeContext {
+    pluginId: string;
+    workspaceId: string;
+}
+export interface PluginGrantRequestInput {
+    manifest: PluginManifest;
+    pluginId: string;
+    workspaceId: string;
+    permissionKey: PluginPermissionKey;
+    scopeType: "workspace" | "directory" | "file";
+    scopePath: string | null;
+    grantMode: PluginPermissionGrantMode;
+    runtimeSessionId: string | null;
+    grantedByUserId: string;
+}
+export declare class PluginPermissionService {
+    private readonly pluginPermissionGrantRepository?;
+    private readonly pluginAuditEventRepository?;
+    constructor(pluginPermissionGrantRepository?: PluginPermissionGrantRepository | undefined, pluginAuditEventRepository?: PluginAuditEventRepository | undefined);
+    assertWorkspaceScopedContext(workspaceId: string | null | undefined): string;
+    assertManifestPermissionDeclared(manifest: PluginManifest, permissionKey: PluginPermissionKey): void;
+    requirePermissionGrant(input: {
+        manifest: PluginManifest;
+        pluginId: string;
+        workspaceId: string;
+        permissionKey: PluginPermissionKey;
+        scopePath?: string | null;
+        runtimeSessionId?: string | null;
+    }): PluginPermissionGrant;
+    assertWorkspaceRead(manifest: PluginManifest, context: PluginRuntimeContext): PluginPermissionGrant;
+    assertWorkspaceWrite(manifest: PluginManifest, context: PluginRuntimeContext, scopePath?: string | null): PluginPermissionGrant;
+    assertDesktopPermission(manifest: PluginManifest, context: PluginRuntimeContext, permission: PluginDesktopPermission, scopePath?: string | null, runtimeSessionId?: string | null): PluginPermissionGrant;
+    listWorkspaceGrants(pluginId: string, workspaceId: string): PluginPermissionGrant[];
+    createGrant(input: PluginGrantRequestInput): PluginPermissionGrant;
+    revokeGrant(pluginId: string, workspaceId: string, grantId: string, actorUserId: string): PluginPermissionGrant;
+    recordPermissionDenied(input: {
+        pluginId: string;
+        workspaceId: string;
+        actorUserId: string | null;
+        permissionKey: PluginPermissionKey;
+        scopePath: string | null;
+        runtimeSessionId?: string | null;
+        reason: "declaration_missing" | "grant_required";
+    }): void;
+    private recordAuditEvent;
+}

package/dist/server/modules/plugins/plugin-permission-service.js

@@ -0,0 +1,267 @@
+import { AppError } from "../../shared/errors/app-error.js";
+import { createId } from "../../shared/utils/id.js";
+import { nowIso } from "../../shared/utils/time.js";
+const DESKTOP_PERMISSION_KEY_MAP = {
+    open_file: "desktop.open_file",
+    reveal_in_file_manager: "desktop.reveal_in_file_manager"
+};
+export class PluginPermissionService {
+    pluginPermissionGrantRepository;
+    pluginAuditEventRepository;
+    constructor(pluginPermissionGrantRepository, pluginAuditEventRepository) {
+        this.pluginPermissionGrantRepository = pluginPermissionGrantRepository;
+        this.pluginAuditEventRepository = pluginAuditEventRepository;
+    }
+    assertWorkspaceScopedContext(workspaceId) {
+        const normalized = workspaceId?.trim() ?? "";
+        if (!normalized) {
+            throw new AppError({
+                statusCode: 400,
+                errorCode: "PLUGIN_WORKSPACE_CONTEXT_REQUIRED",
+                detail: "插件运行必须绑定当前工作区"
+            });
+        }
+        return normalized;
+    }
+    assertManifestPermissionDeclared(manifest, permissionKey) {
+        if (isPermissionDeclared(manifest, permissionKey)) {
+            return;
+        }
+        throw new AppError({
+            statusCode: 403,
+            errorCode: "PLUGIN_PERMISSION_DECLARATION_MISSING",
+            detail: `插件未声明权限：${permissionKey}`,
+            data: {
+                permissionKey
+            }
+        });
+    }
+    requirePermissionGrant(input) {
+        this.assertManifestPermissionDeclared(input.manifest, input.permissionKey);
+        if (!this.pluginPermissionGrantRepository) {
+            throwGrantRequired(input.permissionKey, input.scopePath ?? null);
+        }
+        const grants = this.pluginPermissionGrantRepository.listActiveByPluginWorkspaceAndPermission(input.pluginId, input.workspaceId, input.permissionKey, nowIso());
+        const matched = grants.find((grant) => isGrantMatchingScope(grant, input.scopePath ?? null, input.runtimeSessionId ?? null));
+        if (!matched) {
+            throwGrantRequired(input.permissionKey, input.scopePath ?? null);
+        }
+        return matched;
+    }
+    assertWorkspaceRead(manifest, context) {
+        return this.requirePermissionGrant({
+            manifest,
+            pluginId: context.pluginId,
+            workspaceId: context.workspaceId,
+            permissionKey: "workspace.read_file"
+        });
+    }
+    assertWorkspaceWrite(manifest, context, scopePath) {
+        return this.requirePermissionGrant({
+            manifest,
+            pluginId: context.pluginId,
+            workspaceId: context.workspaceId,
+            permissionKey: "workspace.write_file",
+            scopePath
+        });
+    }
+    assertDesktopPermission(manifest, context, permission, scopePath, runtimeSessionId) {
+        return this.requirePermissionGrant({
+            manifest,
+            pluginId: context.pluginId,
+            workspaceId: context.workspaceId,
+            permissionKey: DESKTOP_PERMISSION_KEY_MAP[permission],
+            scopePath,
+            runtimeSessionId
+        });
+    }
+    listWorkspaceGrants(pluginId, workspaceId) {
+        if (!this.pluginPermissionGrantRepository) {
+            return [];
+        }
+        return this.pluginPermissionGrantRepository.listActiveByPluginAndWorkspace(pluginId, workspaceId, nowIso());
+    }
+    createGrant(input) {
+        if (!this.pluginPermissionGrantRepository) {
+            throw new AppError({
+                statusCode: 500,
+                errorCode: "PLUGIN_PERMISSION_STORE_UNAVAILABLE",
+                detail: "插件授权存储当前不可用"
+            });
+        }
+        this.assertManifestPermissionDeclared(input.manifest, input.permissionKey);
+        const normalizedScope = normalizeGrantScope(input.scopeType, input.scopePath);
+        assertGrantModeAllowed(input.grantMode, input.runtimeSessionId);
+        const grantedAt = nowIso();
+        const record = {
+            id: createId(),
+            pluginId: input.pluginId,
+            workspaceId: input.workspaceId,
+            permissionKey: input.permissionKey,
+            scopeType: normalizedScope.scopeType,
+            scopePath: normalizedScope.scopePath,
+            grantMode: input.grantMode,
+            grantedByUserId: input.grantedByUserId,
+            runtimeSessionId: input.grantMode === "session" ? input.runtimeSessionId : null,
+            createdAt: grantedAt,
+            expiresAt: null,
+            revokedAt: null
+        };
+        const created = this.pluginPermissionGrantRepository.create(record);
+        this.recordAuditEvent("plugin.permission_granted", created.pluginId, created.workspaceId, created.grantedByUserId, {
+            grantId: created.id,
+            permissionKey: created.permissionKey,
+            scopeType: created.scopeType,
+            scopePath: created.scopePath,
+            grantMode: created.grantMode,
+            runtimeSessionId: created.runtimeSessionId
+        });
+        return created;
+    }
+    revokeGrant(pluginId, workspaceId, grantId, actorUserId) {
+        if (!this.pluginPermissionGrantRepository) {
+            throw new AppError({
+                statusCode: 500,
+                errorCode: "PLUGIN_PERMISSION_STORE_UNAVAILABLE",
+                detail: "插件授权存储当前不可用"
+            });
+        }
+        const existing = this.pluginPermissionGrantRepository.findById(grantId);
+        if (!existing || existing.pluginId !== pluginId || existing.workspaceId !== workspaceId) {
+            throw new AppError({
+                statusCode: 404,
+                errorCode: "PLUGIN_PERMISSION_GRANT_NOT_FOUND",
+                detail: "未找到当前工作区下的插件授权记录"
+            });
+        }
+        const revoked = this.pluginPermissionGrantRepository.revokeById(grantId, nowIso());
+        if (!revoked) {
+            throw new AppError({
+                statusCode: 404,
+                errorCode: "PLUGIN_PERMISSION_GRANT_NOT_FOUND",
+                detail: "未找到当前工作区下的插件授权记录"
+            });
+        }
+        this.recordAuditEvent("plugin.permission_revoked", revoked.pluginId, revoked.workspaceId, actorUserId, {
+            grantId: revoked.id,
+            permissionKey: revoked.permissionKey,
+            scopeType: revoked.scopeType,
+            scopePath: revoked.scopePath,
+            grantMode: revoked.grantMode,
+            runtimeSessionId: revoked.runtimeSessionId
+        });
+        return revoked;
+    }
+    recordPermissionDenied(input) {
+        this.recordAuditEvent("plugin.permission_denied", input.pluginId, input.workspaceId, input.actorUserId, {
+            permissionKey: input.permissionKey,
+            scopeType: input.scopePath ? "file" : "workspace",
+            scopePath: input.scopePath,
+            runtimeSessionId: input.runtimeSessionId ?? null,
+            reason: input.reason
+        });
+    }
+    recordAuditEvent(eventType, pluginId, workspaceId, actorUserId, payload) {
+        if (!this.pluginAuditEventRepository) {
+            return;
+        }
+        this.pluginAuditEventRepository.create({
+            id: createId(),
+            pluginId,
+            workspaceId,
+            eventType,
+            actorUserId,
+            payloadJson: JSON.stringify(payload),
+            createdAt: nowIso()
+        });
+    }
+}
+function isPermissionDeclared(manifest, permissionKey) {
+    switch (permissionKey) {
+        case "workspace.read_file":
+        case "workspace.list_dir":
+            return manifest.permissions.workspaceRead === true;
+        case "workspace.write_file":
+            return manifest.permissions.workspaceWrite === true;
+        case "desktop.open_file":
+            return manifest.permissions.desktop?.includes("open_file") === true;
+        case "desktop.reveal_in_file_manager":
+            return manifest.permissions.desktop?.includes("reveal_in_file_manager") === true;
+        default:
+            return false;
+    }
+}
+function isGrantMatchingScope(grant, requestedScopePath, runtimeSessionId) {
+    if (grant.grantMode === "session" && grant.runtimeSessionId && runtimeSessionId && grant.runtimeSessionId !== runtimeSessionId) {
+        return false;
+    }
+    if (grant.scopeType === "workspace") {
+        return true;
+    }
+    const normalizedRequestedPath = normalizeScopePath(requestedScopePath);
+    const normalizedGrantPath = normalizeScopePath(grant.scopePath);
+    if (!normalizedRequestedPath || !normalizedGrantPath) {
+        return false;
+    }
+    if (grant.scopeType === "file") {
+        return normalizedRequestedPath === normalizedGrantPath;
+    }
+    return normalizedRequestedPath === normalizedGrantPath
+        || normalizedRequestedPath.startsWith(`${normalizedGrantPath}/`);
+}
+function normalizeScopePath(pathValue) {
+    const normalized = (pathValue?.trim() ?? "")
+        .replace(/\\/g, "/")
+        .replace(/^\/+|\/+$/g, "");
+    return normalized || null;
+}
+function normalizeGrantScope(scopeType, scopePath) {
+    const normalizedScopePath = normalizeScopePath(scopePath);
+    if (scopeType === "workspace") {
+        if (normalizedScopePath) {
+            throw new AppError({
+                statusCode: 400,
+                errorCode: "PLUGIN_PERMISSION_SCOPE_INVALID",
+                detail: "全工作区授权不能再附带路径范围"
+            });
+        }
+        return {
+            scopeType,
+            scopePath: null
+        };
+    }
+    if (!normalizedScopePath) {
+        throw new AppError({
+            statusCode: 400,
+            errorCode: "PLUGIN_PERMISSION_SCOPE_INVALID",
+            detail: "目录或文件授权必须提供相对路径"
+        });
+    }
+    return {
+        scopeType,
+        scopePath: normalizedScopePath
+    };
+}
+function assertGrantModeAllowed(grantMode, runtimeSessionId) {
+    if (grantMode === "session" && !runtimeSessionId) {
+        throw new AppError({
+            statusCode: 400,
+            errorCode: "PLUGIN_PERMISSION_SCOPE_INVALID",
+            detail: "会话授权必须绑定当前 runtimeSessionId"
+        });
+    }
+}
+function throwGrantRequired(permissionKey, scopePath) {
+    throw new AppError({
+        statusCode: 403,
+        errorCode: "PLUGIN_PERMISSION_GRANT_REQUIRED",
+        detail: `插件权限尚未授权：${permissionKey}`,
+        data: {
+            permissionKey,
+            scopeType: scopePath ? "file" : "workspace",
+            scopePath,
+            grantOptions: ["once", "session", "persistent"]
+        }
+    });
+}
+//# sourceMappingURL=plugin-permission-service.js.map

package/dist/server/modules/plugins/plugin-permission-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-permission-service.js","sourceRoot":"","sources":["../../../../src/modules/plugins/plugin-permission-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AA6BpD,MAAM,0BAA0B,GAAyD;IACvF,SAAS,EAAE,mBAAmB;IAC9B,sBAAsB,EAAE,gCAAgC;CACzD,CAAC;AAEF,MAAM,OAAO,uBAAuB;IAEf;IACA;IAFnB,YACmB,+BAAiE,EACjE,0BAAuD;QADvD,oCAA+B,GAA/B,+BAA+B,CAAkC;QACjE,+BAA0B,GAA1B,0BAA0B,CAA6B;IACvE,CAAC;IAEJ,4BAA4B,CAAC,WAAsC;QACjE,MAAM,UAAU,GAAG,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,QAAQ,CAAC;gBACjB,UAAU,EAAE,GAAG;gBACf,SAAS,EAAE,mCAAmC;gBAC9C,MAAM,EAAE,eAAe;aACxB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,gCAAgC,CAC9B,QAAwB,EACxB,aAAkC;QAElC,IAAI,oBAAoB,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,CAAC;YAClD,OAAO;QACT,CAAC;QAED,MAAM,IAAI,QAAQ,CAAC;YACjB,UAAU,EAAE,GAAG;YACf,SAAS,EAAE,uCAAuC;YAClD,MAAM,EAAE,WAAW,aAAa,EAAE;YAClC,IAAI,EAAE;gBACJ,aAAa;aACd;SACF,CAAC,CAAC;IACL,CAAC;IAED,sBAAsB,CAAC,KAOtB;QACC,IAAI,CAAC,gCAAgC,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QAE3E,IAAI,CAAC,IAAI,CAAC,+BAA+B,EAAE,CAAC;YAC1C,kBAAkB,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,+BAA+B,CAAC,wCAAwC,CAC1F,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,aAAa,EACnB,MAAM,EAAE,CACT,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CACpC,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI,EAAE,KAAK,CAAC,gBAAgB,IAAI,IAAI,CAAC,CACrF,CAAC;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,kBAAkB,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC;QACnE,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,mBAAmB,CAAC,QAAwB,EAAE,OAA6B;QACzE,OAAO,IAAI,CAAC,sBAAsB,CAAC;YACjC,QAAQ;YACR,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,aAAa,EAAE,qBAAqB;SACrC,CAAC,CAAC;IACL,CAAC;IAED,oBAAoB,CAAC,QAAwB,EAAE,OAA6B,EAAE,SAAyB;QACrG,OAAO,IAAI,CAAC,sBAAsB,CAAC;YACjC,QAAQ;YACR,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,aAAa,EAAE,sBAAsB;YACrC,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IAED,uBAAuB,CACrB,QAAwB,EACxB,OAA6B,EAC7B,UAAmC,EACnC,SAAyB,EACzB,gBAAgC;QAEhC,OAAO,IAAI,CAAC,sBAAsB,CAAC;YACjC,QAAQ;YACR,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,aAAa,EAAE,0BAA0B,CAAC,UAAU,CAAC;YACrD,SAAS;YACT,gBAAgB;SACjB,CAAC,CAAC;IACL,CAAC;IAED,mBAAmB,CAAC,QAAgB,EAAE,WAAmB;QACvD,IAAI,CAAC,IAAI,CAAC,+BAA+B,EAAE,CAAC;YAC1C,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,IAAI,CAAC,+BAA+B,CAAC,8BAA8B,CACxE,QAAQ,EACR,WAAW,EACX,MAAM,EAAE,CACT,CAAC;IACJ,CAAC;IAED,WAAW,CAAC,KAA8B;QACxC,IAAI,CAAC,IAAI,CAAC,+BAA+B,EAAE,CAAC;YAC1C,MAAM,IAAI,QAAQ,CAAC;gBACjB,UAAU,EAAE,GAAG;gBACf,SAAS,EAAE,qCAAqC;gBAChD,MAAM,EAAE,aAAa;aACtB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,gCAAgC,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QAC3E,MAAM,eAAe,GAAG,mBAAmB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9E,sBAAsB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAEhE,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC;QAC3B,MAAM,MAAM,GAA0B;YACpC,EAAE,EAAE,QAAQ,EAAE;YACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,SAAS,EAAE,eAAe,CAAC,SAAS;YACpC,SAAS,EAAE,eAAe,CAAC,SAAS;YACpC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,gBAAgB,EAAE,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI;YAC/E,SAAS,EAAE,SAAS;YACpB,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,IAAI;SAChB,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,CAAC,+BAA+B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACpE,IAAI,CAAC,gBAAgB,CAAC,2BAA2B,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,eAAe,EAAE;YACjH,OAAO,EAAE,OAAO,CAAC,EAAE;YACnB,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;SAC3C,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,WAAW,CAAC,QAAgB,EAAE,WAAmB,EAAE,OAAe,EAAE,WAAmB;QACrF,IAAI,CAAC,IAAI,CAAC,+BAA+B,EAAE,CAAC;YAC1C,MAAM,IAAI,QAAQ,CAAC;gBACjB,UAAU,EAAE,GAAG;gBACf,SAAS,EAAE,qCAAqC;gBAChD,MAAM,EAAE,aAAa;aACtB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,+BAA+B,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACxE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;YACxF,MAAM,IAAI,QAAQ,CAAC;gBACjB,UAAU,EAAE,GAAG;gBACf,SAAS,EAAE,mCAAmC;gBAC9C,MAAM,EAAE,kBAAkB;aAC3B,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,+BAA+B,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACnF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,QAAQ,CAAC;gBACjB,UAAU,EAAE,GAAG;gBACf,SAAS,EAAE,mCAAmC;gBAC9C,MAAM,EAAE,kBAAkB;aAC3B,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,gBAAgB,CAAC,2BAA2B,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,WAAW,EAAE,WAAW,EAAE;YACrG,OAAO,EAAE,OAAO,CAAC,EAAE;YACnB,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;SAC3C,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,sBAAsB,CAAC,KAQtB;QACC,IAAI,CAAC,gBAAgB,CAAC,0BAA0B,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE;YACtG,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW;YACjD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,IAAI;YAChD,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;IACL,CAAC;IAEO,gBAAgB,CACtB,SAA+B,EAC/B,QAAgB,EAChB,WAAmB,EACnB,WAA0B,EAC1B,OAAgC;QAEhC,IAAI,CAAC,IAAI,CAAC,0BAA0B,EAAE,CAAC;YACrC,OAAO;QACT,CAAC;QAED,IAAI,CAAC,0BAA0B,CAAC,MAAM,CAAC;YACrC,EAAE,EAAE,QAAQ,EAAE;YACd,QAAQ;YACR,WAAW;YACX,SAAS;YACT,WAAW;YACX,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YACpC,SAAS,EAAE,MAAM,EAAE;SACpB,CAAC,CAAC;IACL,CAAC;CACF;AAED,SAAS,oBAAoB,CAAC,QAAwB,EAAE,aAAkC;IACxF,QAAQ,aAAa,EAAE,CAAC;QACtB,KAAK,qBAAqB,CAAC;QAC3B,KAAK,oBAAoB;YACvB,OAAO,QAAQ,CAAC,WAAW,CAAC,aAAa,KAAK,IAAI,CAAC;QACrD,KAAK,sBAAsB;YACzB,OAAO,QAAQ,CAAC,WAAW,CAAC,cAAc,KAAK,IAAI,CAAC;QACtD,KAAK,mBAAmB;YACtB,OAAO,QAAQ,CAAC,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC;QACtE,KAAK,gCAAgC;YACnC,OAAO,QAAQ,CAAC,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,wBAAwB,CAAC,KAAK,IAAI,CAAC;QACnF;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAA4B,EAC5B,kBAAiC,EACjC,gBAA+B;IAE/B,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,gBAAgB,IAAI,gBAAgB,IAAI,KAAK,CAAC,gBAAgB,KAAK,gBAAgB,EAAE,CAAC;QAC/H,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,KAAK,CAAC,SAAS,KAAK,WAAW,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,uBAAuB,GAAG,kBAAkB,CAAC,kBAAkB,CAAC,CAAC;IACvE,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAEhE,IAAI,CAAC,uBAAuB,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACrD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAC/B,OAAO,uBAAuB,KAAK,mBAAmB,CAAC;IACzD,CAAC;IAED,OAAO,uBAAuB,KAAK,mBAAmB;WACjD,uBAAuB,CAAC,UAAU,CAAC,GAAG,mBAAmB,GAAG,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,kBAAkB,CAAC,SAAoC;IAC9D,MAAM,UAAU,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;SACzC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC7B,OAAO,UAAU,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED,SAAS,mBAAmB,CAC1B,SAA6C,EAC7C,SAAwB;IAKxB,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAE1D,IAAI,SAAS,KAAK,WAAW,EAAE,CAAC;QAC9B,IAAI,mBAAmB,EAAE,CAAC;YACxB,MAAM,IAAI,QAAQ,CAAC;gBACjB,UAAU,EAAE,GAAG;gBACf,SAAS,EAAE,iCAAiC;gBAC5C,MAAM,EAAE,iBAAiB;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,SAAS;YACT,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,IAAI,QAAQ,CAAC;YACjB,UAAU,EAAE,GAAG;YACf,SAAS,EAAE,iCAAiC;YAC5C,MAAM,EAAE,iBAAiB;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,SAAS;QACT,SAAS,EAAE,mBAAmB;KAC/B,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,SAAoC,EACpC,gBAA+B;IAE/B,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACjD,MAAM,IAAI,QAAQ,CAAC;YACjB,UAAU,EAAE,GAAG;YACf,SAAS,EAAE,iCAAiC;YAC5C,MAAM,EAAE,6BAA6B;SACtC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,aAAkC,EAAE,SAAwB;IACtF,MAAM,IAAI,QAAQ,CAAC;QACjB,UAAU,EAAE,GAAG;QACf,SAAS,EAAE,kCAAkC;QAC7C,MAAM,EAAE,YAAY,aAAa,EAAE;QACnC,IAAI,EAAE;YACJ,aAAa;YACb,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW;YAC3C,SAAS;YACT,YAAY,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,YAAY,CAAC;SAChD;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/server/modules/plugins/plugin-process-runner.d.ts

@@ -0,0 +1,21 @@
+export interface PluginProcessRunResult {
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+}
+export interface RunPluginNodeScriptInput {
+    entryAbsolutePath: string;
+    installRoot: string;
+    payload: {
+        pluginId: string;
+        actionId: string;
+        workspaceId: string;
+        runtimeSessionId: string | null;
+        input: unknown;
+    };
+    timeoutMs: number;
+    signal?: AbortSignal;
+}
+export declare class PluginProcessRunner {
+    runNodeScript(input: RunPluginNodeScriptInput): Promise<PluginProcessRunResult>;
+}

package/dist/server/modules/plugins/plugin-process-runner.js

@@ -0,0 +1,127 @@
+import { spawn } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { AppError } from "../../shared/errors/app-error.js";
+const RUNNER_FILENAME = ".codingns-plugin-runner.mjs";
+export class PluginProcessRunner {
+    async runNodeScript(input) {
+        if (!fs.existsSync(input.entryAbsolutePath) || !fs.statSync(input.entryAbsolutePath).isFile()) {
+            throw new AppError({
+                statusCode: 404,
+                errorCode: "PLUGIN_ACTION_ENTRY_NOT_FOUND",
+                detail: "插件动作入口脚本不存在"
+            });
+        }
+        const bootstrapScript = path.join(input.installRoot, RUNNER_FILENAME);
+        if (!fs.existsSync(bootstrapScript) || fs.readFileSync(bootstrapScript, "utf8") !== buildRunnerScript()) {
+            fs.writeFileSync(bootstrapScript, buildRunnerScript(), "utf8");
+        }
+        return await new Promise((resolve, reject) => {
+            const child = spawn(process.execPath, [bootstrapScript, input.entryAbsolutePath, JSON.stringify(input.payload)], {
+                cwd: input.installRoot,
+                env: buildWhitelistedEnv(),
+                stdio: ["ignore", "pipe", "pipe"]
+            });
+            let stdout = "";
+            let stderr = "";
+            let settled = false;
+            const cleanupAbortListener = bindAbortSignal(input.signal, () => {
+                child.kill("SIGKILL");
+                if (!settled) {
+                    settled = true;
+                    reject(new AppError({
+                        statusCode: 499,
+                        errorCode: "PLUGIN_ACTION_CANCELLED",
+                        detail: "插件动作执行已取消"
+                    }));
+                }
+            });
+            const timer = setTimeout(() => {
+                child.kill("SIGKILL");
+                if (!settled) {
+                    settled = true;
+                    reject(new AppError({
+                        statusCode: 504,
+                        errorCode: "PLUGIN_ACTION_TIMEOUT",
+                        detail: "插件动作执行超时"
+                    }));
+                }
+            }, input.timeoutMs);
+            child.stdout.on("data", (chunk) => {
+                stdout += chunk.toString();
+            });
+            child.stderr.on("data", (chunk) => {
+                stderr += chunk.toString();
+            });
+            child.on("error", (error) => {
+                clearTimeout(timer);
+                cleanupAbortListener();
+                if (!settled) {
+                    settled = true;
+                    reject(error);
+                }
+            });
+            child.on("exit", (code) => {
+                clearTimeout(timer);
+                cleanupAbortListener();
+                if (settled) {
+                    return;
+                }
+                settled = true;
+                resolve({
+                    exitCode: code ?? 1,
+                    stdout,
+                    stderr
+                });
+            });
+        });
+    }
+}
+function buildWhitelistedEnv() {
+    const env = {
+        PATH: process.env.PATH,
+        HOME: process.env.HOME,
+        TMPDIR: process.env.TMPDIR,
+        TEMP: process.env.TEMP,
+        TMP: process.env.TMP,
+        LANG: process.env.LANG,
+        LC_ALL: process.env.LC_ALL,
+        NODE_ENV: "production"
+    };
+    Object.keys(env).forEach((key) => {
+        if (env[key] === undefined) {
+            delete env[key];
+        }
+    });
+    return env;
+}
+function bindAbortSignal(signal, onAbort) {
+    if (!signal) {
+        return () => undefined;
+    }
+    if (signal.aborted) {
+        onAbort();
+        return () => undefined;
+    }
+    const listener = () => onAbort();
+    signal.addEventListener("abort", listener, { once: true });
+    return () => signal.removeEventListener("abort", listener);
+}
+function buildRunnerScript() {
+    return `
+import { pathToFileURL } from "node:url";
+
+const [, , entryPath, payloadText] = process.argv;
+const mod = await import(pathToFileURL(entryPath).href);
+const handler = typeof mod.default === "function" ? mod.default : mod.run;
+
+if (typeof handler !== "function") {
+  throw new Error("PLUGIN_ACTION_HANDLER_MISSING: 插件动作入口必须导出 default 或 run 函数");
+}
+
+const payload = JSON.parse(payloadText);
+const result = await handler(payload);
+process.stdout.write(JSON.stringify(result ?? null));
+`;
+}
+//# sourceMappingURL=plugin-process-runner.js.map

package/dist/server/modules/plugins/plugin-process-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-process-runner.js","sourceRoot":"","sources":["../../../../src/modules/plugins/plugin-process-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAsB5D,MAAM,eAAe,GAAG,6BAA6B,CAAC;AAEtD,MAAM,OAAO,mBAAmB;IAC9B,KAAK,CAAC,aAAa,CAAC,KAA+B;QACjD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YAC9F,MAAM,IAAI,QAAQ,CAAC;gBACjB,UAAU,EAAE,GAAG;gBACf,SAAS,EAAE,+BAA+B;gBAC1C,MAAM,EAAE,aAAa;aACtB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;QACtE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,KAAK,iBAAiB,EAAE,EAAE,CAAC;YACxG,EAAE,CAAC,aAAa,CAAC,eAAe,EAAE,iBAAiB,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,CAAC;QAED,OAAO,MAAM,IAAI,OAAO,CAAyB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACnE,MAAM,KAAK,GAAG,KAAK,CACjB,OAAO,CAAC,QAAQ,EAChB,CAAC,eAAe,EAAE,KAAK,CAAC,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EACzE;gBACE,GAAG,EAAE,KAAK,CAAC,WAAW;gBACtB,GAAG,EAAE,mBAAmB,EAAE;gBAC1B,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;aAClC,CACF,CAAC;YAEF,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,OAAO,GAAG,KAAK,CAAC;YAEpB,MAAM,oBAAoB,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE;gBAC9D,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACtB,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO,GAAG,IAAI,CAAC;oBACf,MAAM,CAAC,IAAI,QAAQ,CAAC;wBAClB,UAAU,EAAE,GAAG;wBACf,SAAS,EAAE,yBAAyB;wBACpC,MAAM,EAAE,WAAW;qBACpB,CAAC,CAAC,CAAC;gBACN,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACtB,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO,GAAG,IAAI,CAAC;oBACf,MAAM,CAAC,IAAI,QAAQ,CAAC;wBAClB,UAAU,EAAE,GAAG;wBACf,SAAS,EAAE,uBAAuB;wBAClC,MAAM,EAAE,UAAU;qBACnB,CAAC,CAAC,CAAC;gBACN,CAAC;YACH,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YAEpB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;gBAChC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC7B,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;gBAChC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC7B,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC1B,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,oBAAoB,EAAE,CAAC;gBACvB,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO,GAAG,IAAI,CAAC;oBACf,MAAM,CAAC,KAAK,CAAC,CAAC;gBAChB,CAAC;YACH,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBACxB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,oBAAoB,EAAE,CAAC;gBACvB,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO;gBACT,CAAC;gBACD,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,CAAC;oBACN,QAAQ,EAAE,IAAI,IAAI,CAAC;oBACnB,MAAM;oBACN,MAAM;iBACP,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,SAAS,mBAAmB;IAC1B,MAAM,GAAG,GAAsB;QAC7B,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI;QACtB,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI;QACtB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM;QAC1B,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI;QACtB,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG;QACpB,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI;QACtB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM;QAC1B,QAAQ,EAAE,YAAY;KACvB,CAAC;IAEF,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QAC/B,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,MAA+B,EAAE,OAAmB;IAC3E,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC;IACzB,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,EAAE,CAAC;QACV,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC;IACzB,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IACjC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO;;;;;;;;;;;;;;CAcR,CAAC;AACF,CAAC"}

package/dist/server/modules/plugins/plugin-registry-service.d.ts

@@ -0,0 +1,41 @@
+import type { PluginAuditEventRepository } from "../../storage/repositories/plugin-audit-event-repository.js";
+import type { PluginDefinitionRepository } from "../../storage/repositories/plugin-definition-repository.js";
+import type { PluginEnablementRepository } from "../../storage/repositories/plugin-enablement-repository.js";
+import type { PluginAuditEvent, PluginDefinition, PluginEnablement, PluginManifest } from "../../types/domain.js";
+interface PluginRegistryLogger {
+    warn(bindings: Record<string, unknown>, message: string): void;
+    info?(bindings: Record<string, unknown>, message: string): void;
+}
+export interface PluginSummary {
+    id: string;
+    name: string;
+    version: string;
+    enabled: boolean;
+    installRoot: string;
+    hasFrontend: boolean;
+    hasBackend: boolean;
+    updatedAt: string;
+}
+export interface PluginDetail {
+    definition: PluginDefinition;
+    manifest: PluginManifest;
+    enablement: PluginEnablement;
+    auditEvents: PluginAuditEvent[];
+}
+export declare class PluginRegistryService {
+    private readonly pluginDefinitionRepository;
+    private readonly pluginEnablementRepository;
+    private readonly pluginAuditEventRepository;
+    private readonly pluginRootDir;
+    private readonly logger;
+    constructor(pluginDefinitionRepository: PluginDefinitionRepository, pluginEnablementRepository: PluginEnablementRepository, pluginAuditEventRepository: PluginAuditEventRepository, pluginRootDir: string, logger: PluginRegistryLogger);
+    listPlugins(): PluginSummary[];
+    getPlugin(pluginId: string): PluginDetail;
+    enablePlugin(pluginId: string, userId: string): PluginEnablement;
+    disablePlugin(pluginId: string, userId: string, reason?: string | null): PluginEnablement;
+    syncPluginsFromDisk(): void;
+    private requireDefinition;
+    private getOrCreateEnablement;
+    private recordAuditEvent;
+}
+export {};