@jingyi0605/codingns4dsh 0.1.2 → 0.1.7-rc.3

package/data/build/dist/host/modules/peer-host/peer-host-store.js

@@ -0,0 +1,323 @@
+import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';
+import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { PEER_HOST_ERROR_CODES } from '../../../shared/contracts/peer-host.js';
+export class PeerHostStoreError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'PeerHostStoreError';
+        this.code = code;
+    }
+}
+/** 当前 Host 的 PeerHost 配置服务；所有 mutation 都在 Host 内完成校验。 */
+export class PeerHostStore {
+    ownerUserId;
+    recordStore;
+    credentials;
+    now;
+    createId;
+    records = null;
+    operation = Promise.resolve();
+    constructor(ownerUserId, recordStore, credentials, now = Date.now, createId = () => `peer-${randomBytes(12).toString('hex')}`) {
+        this.ownerUserId = ownerUserId;
+        this.recordStore = recordStore;
+        this.credentials = credentials;
+        this.now = now;
+        this.createId = createId;
+        if (!ownerUserId.trim())
+            throw new TypeError('PeerHost ownerUserId 不能为空');
+    }
+    async list() {
+        await this.load();
+        return this.records.map(cloneRecord);
+    }
+    async get(peerHostId) {
+        const record = (await this.list()).find((item) => item.id === peerHostId);
+        return record ?? null;
+    }
+    async create(input) {
+        return this.enqueue(async () => {
+            await this.load();
+            const displayName = requireDisplayName(input.displayName);
+            const route = normalizePeerHostRoute(input.route);
+            this.assertUnique(route);
+            const timestamp = this.now();
+            const record = {
+                id: this.createId(),
+                ownerUserId: this.ownerUserId,
+                displayName,
+                route,
+                status: 'configured',
+                pluginId: null,
+                pluginVersion: null,
+                dshVersion: null,
+                apiCompatibility: null,
+                fingerprint: null,
+                lastCheckedAt: null,
+                lastErrorCode: null,
+                createdAt: timestamp,
+                updatedAt: timestamp,
+            };
+            this.records.push(record);
+            await this.persist();
+            return cloneRecord(record);
+        });
+    }
+    async update(peerHostId, input) {
+        return this.enqueue(async () => {
+            await this.load();
+            const index = this.findIndex(peerHostId);
+            const previous = this.records[index];
+            const displayName = input.displayName === undefined ? previous.displayName : requireDisplayName(input.displayName);
+            const route = input.route === undefined ? previous.route : normalizePeerHostRoute(input.route);
+            const routeChanged = routeKey(previous.route) !== routeKey(route);
+            if (routeChanged)
+                this.assertUnique(route, peerHostId);
+            const next = {
+                ...previous,
+                displayName,
+                route,
+                ...(routeChanged ? resetHandshake(previous) : {}),
+                updatedAt: this.now(),
+            };
+            this.records[index] = next;
+            if (routeChanged)
+                await this.credentials.clear(peerHostId);
+            await this.persist();
+            return cloneRecord(next);
+        });
+    }
+    async remove(peerHostId) {
+        return this.enqueue(async () => {
+            await this.load();
+            const index = this.findIndex(peerHostId);
+            this.records.splice(index, 1);
+            await this.credentials.clear(peerHostId);
+            await this.persist();
+        });
+    }
+    async updateHandshake(peerHostId, input) {
+        return this.enqueue(async () => {
+            await this.load();
+            const index = this.findIndex(peerHostId);
+            const next = { ...this.records[index], ...input, updatedAt: this.now() };
+            this.records[index] = next;
+            await this.persist();
+            return cloneRecord(next);
+        });
+    }
+    async updateStatus(peerHostId, status, lastErrorCode) {
+        return this.enqueue(async () => {
+            await this.load();
+            const index = this.findIndex(peerHostId);
+            const next = { ...this.records[index], status, lastErrorCode, updatedAt: this.now() };
+            this.records[index] = next;
+            await this.persist();
+            return cloneRecord(next);
+        });
+    }
+    async load() {
+        if (this.records !== null)
+            return;
+        const records = await this.recordStore.read();
+        this.records = records
+            .filter((record) => record.ownerUserId === this.ownerUserId)
+            .map((record) => ({ ...record, route: normalizePeerHostRoute(record.route) }));
+    }
+    async persist() {
+        await this.recordStore.write(this.records.map(cloneRecord));
+    }
+    findIndex(peerHostId) {
+        const index = this.records.findIndex((record) => record.id === peerHostId);
+        if (index < 0)
+            throw new PeerHostStoreError(PEER_HOST_ERROR_CODES.NOT_FOUND, 'PeerHost 不存在');
+        return index;
+    }
+    assertUnique(route, exceptId) {
+        if (this.records.some((record) => record.id !== exceptId && routeKey(record.route) === routeKey(route))) {
+            throw new PeerHostStoreError(PEER_HOST_ERROR_CODES.DUPLICATE, 'PeerHost 路由已存在');
+        }
+    }
+    enqueue(operation) {
+        const next = this.operation.then(operation, operation);
+        this.operation = next.then(() => undefined, () => undefined);
+        return next;
+    }
+}
+export class InMemoryPeerHostRecordStore {
+    records;
+    constructor(records = []) {
+        this.records = records;
+    }
+    async read() {
+        return this.records.map(cloneRecord);
+    }
+    async write(records) {
+        this.records = records.map(cloneRecord);
+    }
+}
+export class InMemoryPeerHostCredentialStore {
+    records = new Map();
+    async read(peerHostId) {
+        const value = this.records.get(peerHostId);
+        return value === undefined ? null : { ...value };
+    }
+    async write(peerHostId, credential) {
+        this.records.set(peerHostId, { ...credential });
+    }
+    async clear(peerHostId) {
+        this.records.delete(peerHostId);
+    }
+}
+/** 非敏感记录的原子文件存储；token 不允许进入此文件。 */
+export class FilePeerHostRecordStore {
+    filePath;
+    constructor(filePath) {
+        this.filePath = filePath;
+        if (!filePath.trim())
+            throw new TypeError('PeerHost record 文件路径不能为空');
+    }
+    async read() {
+        try {
+            const value = JSON.parse(await readFile(this.filePath, 'utf8'));
+            if (!Array.isArray(value))
+                throw new Error('PeerHost record 文件格式无效');
+            return value;
+        }
+        catch (error) {
+            if (isNodeError(error, 'ENOENT'))
+                return [];
+            throw error;
+        }
+    }
+    async write(records) {
+        await mkdir(dirname(this.filePath), { recursive: true, mode: 0o700 });
+        const temporary = `${this.filePath}.${process.pid}.tmp`;
+        await writeFile(temporary, `${JSON.stringify(records)}\n`, { encoding: 'utf8', mode: 0o600 });
+        await rename(temporary, this.filePath);
+    }
+}
+/** AES-256-GCM 文件存储，密钥必须由 Host 启动边界注入。 */
+export class EncryptedFilePeerHostCredentialStore {
+    filePath;
+    constructor(filePath, key) {
+        this.filePath = filePath;
+        if (!filePath.trim())
+            throw new TypeError('PeerHost credential 文件路径不能为空');
+        if (key.byteLength !== 32)
+            throw new TypeError('PeerHost credential 密钥必须为 32 字节');
+        this.key = Buffer.from(key);
+    }
+    key;
+    async read(peerHostId) {
+        const records = await this.readAll();
+        const record = records[peerHostId];
+        return record === undefined ? null : { ...record };
+    }
+    async write(peerHostId, credential) {
+        const records = await this.readAll();
+        records[peerHostId] = { ...credential };
+        await this.writeAll(records);
+    }
+    async clear(peerHostId) {
+        const records = await this.readAll();
+        delete records[peerHostId];
+        await this.writeAll(records);
+    }
+    async readAll() {
+        try {
+            const envelope = JSON.parse(await readFile(this.filePath, 'utf8'));
+            if (!envelope.iv || !envelope.tag || !envelope.data)
+                throw new Error('PeerHost credential 文件格式无效');
+            const decipher = createDecipheriv('aes-256-gcm', this.key, Buffer.from(envelope.iv, 'base64'));
+            decipher.setAuthTag(Buffer.from(envelope.tag, 'base64'));
+            const plaintext = Buffer.concat([decipher.update(Buffer.from(envelope.data, 'base64')), decipher.final()]).toString('utf8');
+            const value = JSON.parse(plaintext);
+            if (!isCredentialMap(value))
+                throw new Error('PeerHost credential 内容无效');
+            return value;
+        }
+        catch (error) {
+            if (isNodeError(error, 'ENOENT'))
+                return {};
+            throw error;
+        }
+    }
+    async writeAll(records) {
+        const iv = randomBytes(12);
+        const cipher = createCipheriv('aes-256-gcm', this.key, iv);
+        const encrypted = Buffer.concat([cipher.update(JSON.stringify(records), 'utf8'), cipher.final()]);
+        const envelope = {
+            iv: iv.toString('base64'),
+            tag: cipher.getAuthTag().toString('base64'),
+            data: encrypted.toString('base64'),
+        };
+        await mkdir(dirname(this.filePath), { recursive: true, mode: 0o700 });
+        const temporary = `${this.filePath}.${process.pid}.tmp`;
+        await writeFile(temporary, `${JSON.stringify(envelope)}\n`, { encoding: 'utf8', mode: 0o600 });
+        await rename(temporary, this.filePath);
+    }
+}
+export function normalizePeerHostRoute(route) {
+    if (route.kind === 'relay') {
+        const deviceId = requireText(route.deviceId, 'deviceId');
+        const relayEntryId = requireText(route.relayEntryId, 'relayEntryId');
+        return { kind: 'relay', deviceId, relayEntryId, transportVersion: requireText(route.transportVersion, 'transportVersion') };
+    }
+    if (route.kind !== 'lan')
+        throw new PeerHostStoreError(PEER_HOST_ERROR_CODES.INVALID_ROUTE, 'PeerHost 路由类型无效');
+    const raw = requireText(route.baseUrl, 'baseUrl');
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        throw new PeerHostStoreError(PEER_HOST_ERROR_CODES.INVALID_ROUTE, 'PeerHost 局域网地址无效');
+    }
+    if ((parsed.protocol !== 'http:' && parsed.protocol !== 'https:') || parsed.username || parsed.password || parsed.search || parsed.hash || (parsed.pathname !== '/' && parsed.pathname !== '')) {
+        throw new PeerHostStoreError(PEER_HOST_ERROR_CODES.INVALID_ROUTE, 'PeerHost 局域网地址必须是无凭据的 HTTP(S) Origin');
+    }
+    const normalizedOrigin = parsed.origin.toLowerCase();
+    return { kind: 'lan', baseUrl: normalizedOrigin, normalizedOrigin };
+}
+function routeKey(route) {
+    return route.kind === 'lan'
+        ? `lan:${route.normalizedOrigin}`
+        : `relay:${route.deviceId}:${route.relayEntryId}`;
+}
+function resetHandshake(record) {
+    return {
+        status: 'configured',
+        pluginId: null,
+        pluginVersion: null,
+        dshVersion: null,
+        apiCompatibility: null,
+        fingerprint: null,
+        lastCheckedAt: null,
+        lastErrorCode: null,
+    };
+}
+function requireDisplayName(value) {
+    const name = requireText(value, 'displayName');
+    if (name.length > 128)
+        throw new TypeError('PeerHost 名称不能超过 128 个字符');
+    return name;
+}
+function requireText(value, field) {
+    if (typeof value !== 'string' || value.trim() === '')
+        throw new PeerHostStoreError(PEER_HOST_ERROR_CODES.INVALID_ROUTE, `PeerHost ${field} 不能为空`);
+    return value.trim();
+}
+function cloneRecord(record) {
+    return { ...record, route: record.route.kind === 'lan' ? { ...record.route } : { ...record.route } };
+}
+function isCredentialMap(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return false;
+    return Object.values(value).every((item) => typeof item === 'object' && item !== null && typeof item.accessToken === 'string' && typeof item.refreshToken === 'string' && typeof item.expiresAt === 'number');
+}
+function isNodeError(error, code) {
+    return error instanceof Error && 'code' in error && error.code === code;
+}
+//# sourceMappingURL=peer-host-store.js.map

package/data/build/dist/host/modules/peer-host/peer-host-ws-gateway.d.ts

@@ -0,0 +1,34 @@
+import { type IncomingMessage } from 'node:http';
+import WebSocket from 'ws';
+export declare const PEER_HOST_WS_PATH = "/api/codingns/peer-host/ws";
+export interface PeerHostWsGatewayEndpoint {
+    readonly host: string;
+    readonly port: number;
+    readonly path: string;
+}
+export interface PeerHostWsGatewayOptions {
+    readonly listenHost?: string;
+    readonly listenPort?: number;
+    readonly path?: string;
+    readonly authorizeUpgrade?: (request: IncomingMessage) => boolean | Promise<boolean>;
+    readonly onConnection: (socket: WebSocket, request: IncomingMessage) => void | Promise<void | (() => void)>;
+}
+/** 插件自有的 WebSocket upgrade 入口，不修改 DSH WebServer。 */
+export declare class PeerHostWebSocketGateway {
+    private readonly options;
+    private readonly server;
+    private readonly websocketServer;
+    private readonly path;
+    private readonly listenHost;
+    private readonly listenPort;
+    private readonly cleanups;
+    private endpointValue;
+    private closed;
+    constructor(options: PeerHostWsGatewayOptions);
+    start(): Promise<PeerHostWsGatewayEndpoint>;
+    endpoint(): PeerHostWsGatewayEndpoint | null;
+    close(): Promise<void>;
+    private handleUpgrade;
+    private attach;
+}
+//# sourceMappingURL=peer-host-ws-gateway.d.ts.map

package/data/build/dist/host/modules/peer-host/peer-host-ws-gateway.js

@@ -0,0 +1,156 @@
+import { createServer } from 'node:http';
+import WebSocket, { WebSocketServer } from 'ws';
+export const PEER_HOST_WS_PATH = '/api/codingns/peer-host/ws';
+/** 插件自有的 WebSocket upgrade 入口，不修改 DSH WebServer。 */
+export class PeerHostWebSocketGateway {
+    options;
+    server;
+    websocketServer;
+    path;
+    listenHost;
+    listenPort;
+    cleanups = new Map();
+    endpointValue = null;
+    closed = false;
+    constructor(options) {
+        this.options = options;
+        this.path = normalizePath(options.path ?? PEER_HOST_WS_PATH);
+        this.listenHost = normalizeHost(options.listenHost ?? '127.0.0.1');
+        this.listenPort = normalizePort(options.listenPort ?? 0);
+        this.server = createServer((_request, response) => {
+            response.statusCode = 404;
+            response.setHeader('content-type', 'application/json; charset=utf-8');
+            response.end(JSON.stringify({ error: 'PeerHost WebSocket 入口只接受 upgrade 请求' }));
+        });
+        this.websocketServer = new WebSocketServer({ noServer: true, clientTracking: false, maxPayload: 256 * 1024 });
+        this.server.on('upgrade', (request, socket, head) => { void this.handleUpgrade(request, socket, head); });
+    }
+    async start() {
+        if (this.endpointValue !== null)
+            return this.endpointValue;
+        await new Promise((resolve, reject) => {
+            const onError = (error) => { this.server.removeListener('listening', onListening); reject(error); };
+            const onListening = () => { this.server.removeListener('error', onError); resolve(); };
+            this.server.once('error', onError);
+            this.server.once('listening', onListening);
+            this.server.listen({ host: this.listenHost, port: this.listenPort });
+        });
+        const address = this.server.address();
+        if (address === null || typeof address === 'string')
+            throw new Error('PeerHost WebSocket 监听器未返回有效端口');
+        this.endpointValue = { host: this.listenHost, port: address.port, path: this.path };
+        return this.endpointValue;
+    }
+    endpoint() { return this.endpointValue; }
+    async close() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        const closing = [];
+        for (const [socket, cleanup] of this.cleanups) {
+            cleanup();
+            if (socket.readyState === WebSocket.CLOSED)
+                continue;
+            closing.push(new Promise((resolve) => {
+                const timeout = setTimeout(() => socket.terminate(), 1000);
+                socket.once('close', () => {
+                    clearTimeout(timeout);
+                    resolve();
+                });
+                socket.close(1001, 'PeerHost WebSocket 网关已关闭');
+            }));
+        }
+        this.cleanups.clear();
+        this.websocketServer.close();
+        await Promise.all(closing);
+        // 让远端 ws 客户端先处理 TCP FIN，再向调用方返回已关闭状态。
+        await new Promise((resolve) => setTimeout(resolve, 10));
+        await new Promise((resolve) => {
+            if (!this.server.listening) {
+                resolve();
+                return;
+            }
+            this.server.close(() => resolve());
+        });
+        this.endpointValue = null;
+    }
+    async handleUpgrade(request, socket, head) {
+        if (this.closed || request.method !== 'GET' || readPath(request.url) !== this.path) {
+            rejectUpgrade(socket, 404, 'PeerHost WebSocket 路径不存在');
+            return;
+        }
+        try {
+            if (this.options.authorizeUpgrade !== undefined && !(await this.options.authorizeUpgrade(request))) {
+                rejectUpgrade(socket, 401, 'PeerHost WebSocket 未授权');
+                return;
+            }
+        }
+        catch {
+            rejectUpgrade(socket, 401, 'PeerHost WebSocket 未授权');
+            return;
+        }
+        this.websocketServer.handleUpgrade(request, socket, head, (websocket) => {
+            this.websocketServer.emit('connection', websocket, request);
+            void this.attach(websocket, request);
+        });
+    }
+    async attach(socket, request) {
+        let cleanup;
+        try {
+            const result = this.options.onConnection(socket, request);
+            if (result instanceof Promise) {
+                const resolved = await result;
+                cleanup = typeof resolved === 'function' ? resolved : undefined;
+            }
+            else if (typeof result === 'function') {
+                cleanup = result;
+            }
+            this.cleanups.set(socket, cleanup ?? (() => undefined));
+        }
+        catch {
+            socket.close(1011, 'PeerHost WebSocket 连接失败');
+            cleanup?.();
+            return;
+        }
+        socket.once('close', () => {
+            const current = this.cleanups.get(socket);
+            if (current !== undefined)
+                current();
+            this.cleanups.delete(socket);
+        });
+    }
+}
+function normalizePath(value) {
+    const path = value.trim();
+    if (!/^\/api\/[A-Za-z0-9_./-]+$/u.test(path) || path.includes('..'))
+        throw new TypeError('PeerHost WebSocket 路径无效');
+    return path;
+}
+function normalizeHost(value) {
+    const host = value.trim();
+    if (host === '')
+        throw new TypeError('PeerHost WebSocket 监听地址不能为空');
+    return host;
+}
+function normalizePort(value) {
+    if (!Number.isSafeInteger(value) || value < 0 || value > 65_535)
+        throw new TypeError('PeerHost WebSocket 监听端口无效');
+    return value;
+}
+function readPath(rawUrl) {
+    if (rawUrl === undefined)
+        return null;
+    try {
+        return new URL(rawUrl, 'http://peer-host.invalid').pathname;
+    }
+    catch {
+        return null;
+    }
+}
+function rejectUpgrade(socket, status, message) {
+    if (socket.destroyed)
+        return;
+    const statusText = status === 401 ? 'Unauthorized' : 'Not Found';
+    socket.end(`HTTP/1.1 ${status} ${statusText}\r\nConnection: close\r\nContent-Length: ${Buffer.byteLength(message)}\r\n\r\n${message}`);
+}
+//# sourceMappingURL=peer-host-ws-gateway.js.map

package/data/build/dist/host/native-session-bridge.d.ts

@@ -1,5 +1,5 @@
 import type { Context } from '@deepseek-ai/cordis';
-import type { CodingNsAgentQuestion, CodingNsAgentQuestionResponse } from '../shared/contracts/cli-adapter.js';
+import type { CodingNsAgentEvent, CodingNsAgentQuestion, CodingNsAgentQuestionResponse } from '../shared/contracts/cli-adapter.js';
 /**
  * DSH Host 原生会话服务的最小运行时面。
  *
@@ -66,13 +66,23 @@ export interface CodingNsNativeRequestContext {
     readonly provider: string;
     readonly model: string;
     readonly contextWindow?: number;
+    /** Provider usage 明确确认的容量；路由占位上下文不应覆盖它。 */
+    readonly confirmed?: boolean;
+    /** 容量来源；catalog 只用于首个 usage 前的已知模型提示，不锁定后续 Provider usage。 */
+    readonly source?: 'provider' | 'catalog';
 }
-/** 外部 Provider 已报告的用量采样；写入 assistant/attempt，不加入模型可见 surface。 */
+/**
+ * 外部 Provider 已报告的用量采样；写入 assistant/attempt，不加入模型可见 surface。
+ *
+ * 记录进 DSH 会话后必须使用 DSH 的互斥桶口径：`inputTokens` 只含未缓存输入，
+ * 计费输入 = inputTokens + 缓存读写。调用方（公共投影层）负责从 Provider 口径折算。
+ */
 export interface CodingNsNativeUsageSample {
     readonly inputTokens: number;
     readonly outputTokens: number;
     readonly cacheReadTokens?: number;
     readonly cacheWriteTokens?: number;
+    /** 未缓存输入的显式副本；与互斥桶口径的 inputTokens 取值相同，仅作兼容保留。 */
     readonly uncachedInputTokens?: number;
     readonly totalTokens?: number;
     readonly cacheHitRate?: number;
@@ -80,6 +90,10 @@ export interface CodingNsNativeUsageSample {
     readonly contextTokens?: number;
     readonly contextUsageRatio?: number;
 }
+/** 公共消息投影层传递的 Provider 上下文压缩活动。 */
+export type CodingNsNativeCompactionEvent = Extract<CodingNsAgentEvent, {
+    type: 'context-compaction';
+}>;
 export interface CodingNsNativeSessionController {
     create?(request: {
         readonly sessionId?: string;
@@ -130,6 +144,8 @@ export interface CodingNsNativeSessionBridge {
     appendRequestContext?(sessionId: string, context: CodingNsNativeRequestContext): boolean;
     /** 在当前步骤即时记录外部 Provider 用量；该事件不进入模型可见 surface。 */
     appendUsageSample?(sessionId: string, usage: CodingNsNativeUsageSample): boolean;
+    /** 将 Provider 压缩生命周期写入 DSH 原生 compaction 事件；不可用时安静降级。 */
+    appendCompactionEvent?(sessionId: string, event: CodingNsNativeCompactionEvent): boolean;
     /** 判断指定会话是否真的具备下一步注入能力。 */
     canInjectNextStep?(sessionId: string): boolean;
     /** 在当前 Agent turn 的下一个合法 step 注入插件上下文，不唤醒空闲 Agent。 */