@koalaauto/agentchannel 0.0.0-stage → 3.0.0-rc.1

package/dist/src/avatars.js

@@ -0,0 +1,90 @@
+/**
+ * Feishu avatars are fetched on the admin's machine (lark-cli is logged in
+ * there, the hub is not) and uploaded to the hub, which caches them; the panel
+ * only ever loads avatars from the hub. GitHub and Gravatar are fetched by the
+ * hub itself (POST /api/ach/admin/avatars/refresh, and weekly).
+ */
+export const AVATAR_MAX_BYTES = 200 * 1024;
+export const AVATAR_SOURCES = ['upload', 'feishu', 'github', 'gravatar'];
+/** png | jpeg | gif | webp from the first bytes, else '' (never SVG). */
+export function imageKind(b) {
+    if (b.length < 12)
+        return '';
+    if (b[0] === 0x89 && b[1] === 0x50 && b[2] === 0x4e && b[3] === 0x47)
+        return 'png';
+    if (b[0] === 0xff && b[1] === 0xd8 && b[2] === 0xff)
+        return 'jpeg';
+    if (b[0] === 0x47 && b[1] === 0x49 && b[2] === 0x46 && b[3] === 0x38)
+        return 'gif';
+    if (b[0] === 0x52 && b[1] === 0x49 && b[2] === 0x46 && b[3] === 0x46 && b[8] === 0x57 && b[9] === 0x45 && b[10] === 0x42 && b[11] === 0x50)
+        return 'webp';
+    return '';
+}
+const EXT = { png: 'png', jpeg: 'jpg', gif: 'gif', webp: 'webp' };
+/** The best avatar URL in a Feishu user object (search or contact result). */
+export function feishuAvatarUrl(u) {
+    const a = u?.avatar ?? {};
+    const url = a.avatar_240 || a.avatar_640 || a.avatar_72 || a.avatar_origin || u?.avatar_url || '';
+    return typeof url === 'string' && /^https:\/\//.test(url) ? url : '';
+}
+/** Look a person up in Feishu by email (or open_id) with lark-cli; returns the avatar URL or ''. */
+export async function feishuAvatarFor(exec, p) {
+    const q = String(p.email || p.name || '').trim();
+    if (!q)
+        return '';
+    const r = await exec('lark-cli', ['contact', '+search-user', '--query', q, '--as', 'user', '--exclude-external-users', '--format', 'json']);
+    if (r.code !== 0)
+        return '';
+    try {
+        const j = JSON.parse(r.stdout);
+        const users = j?.data?.users ?? j?.users ?? [];
+        const hit = users.find((u) => p.feishu_open_id && u.open_id === p.feishu_open_id) ??
+            users.find((u) => p.email && [u.email, u.enterprise_email].some((e) => String(e ?? '').toLowerCase() === String(p.email).toLowerCase()));
+        return hit ? feishuAvatarUrl(hit) : '';
+    }
+    catch {
+        return '';
+    }
+}
+/** Download an image (<= 200 KB, PNG/JPEG/GIF/WebP). */
+export async function downloadImage(url, fetchFn) {
+    const res = await fetchFn(url, { method: 'GET', headers: { accept: 'image/*' } });
+    if (!res.ok)
+        throw new Error(`HTTP ${res.status}`);
+    const bytes = new Uint8Array(await res.arrayBuffer());
+    if (bytes.length > AVATAR_MAX_BYTES)
+        throw new Error('larger than 200 KB');
+    const kind = imageKind(bytes);
+    if (!kind)
+        throw new Error('not a PNG/JPEG/GIF/WebP image');
+    return { bytes, ext: EXT[kind] };
+}
+/**
+ * Upload Feishu avatars for these people (hub ids). Returns how many were
+ * uploaded; problems are logged, never fatal (an avatar is cosmetic).
+ */
+export async function syncFeishuAvatars(admin, people, o) {
+    const fetchFn = o.fetch ?? ((u, i) => fetch(u, i));
+    let n = 0;
+    for (const p of people) {
+        try {
+            const url = await feishuAvatarFor(o.exec, p);
+            if (!url)
+                continue;
+            const img = await downloadImage(url, fetchFn);
+            await admin.sendImage('POST', `/api/ach/admin/avatars/users/${encodeURIComponent(p.id)}`, img.bytes, `feishu.${img.ext}`, { source: 'feishu' });
+            n++;
+        }
+        catch (e) {
+            o.log(`avatar for ${p.name || p.id}: ${e?.message ?? e}`);
+        }
+    }
+    return n;
+}
+export function parsePriority(s) {
+    const list = s.split(',').map((x) => x.trim().toLowerCase()).filter(Boolean);
+    for (const x of list)
+        if (!AVATAR_SOURCES.includes(x))
+            throw new Error(`unknown avatar source "${x}" (use ${AVATAR_SOURCES.join(', ')})`);
+    return list;
+}

package/dist/src/cli.d.ts

@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+import { type FetchLike } from './client.js';
+export { VERSION } from './version.js';
+export interface Io {
+    env: NodeJS.ProcessEnv;
+    /** Working directory for relative file arguments (default process.cwd()). */
+    cwd?: string;
+    out: (s: string) => void;
+    err: (s: string) => void;
+    fetch?: FetchLike;
+    readPassword?: (prompt: string) => Promise<string>;
+    /** `ach open`: opens a URL in the browser (tests inject a fake). */
+    openUrl?: (url: string) => Promise<void>;
+    /** `ach doctor` status commands (tests inject a fake). */
+    exec?: import('./doctor.js').ExecLike;
+    /** Asks a yes/no question (`ach join`); undefined = no terminal to ask in. */
+    ask?: (question: string) => Promise<string>;
+}
+/** Runs the opener and waits for it: a non-zero exit (no browser, no display) is a failure, not "opened". */
+export declare function runOpener(cmd: string, args: string[], spawn?: typeof import('node:child_process').spawn): Promise<void>;
+/** A login link may be pasted as the full URL or as the bare token. */
+export declare function loginTokenOf(s: string): string;
+/** The channel named in a .ach-channel file in `dir` or a parent directory (for `ach memory hook`). */
+export declare function channelFile(dir: string): string | undefined;
+export declare const RUN_TOKEN_FORBIDDEN: string[];
+/** Commands refused when the env looks like a spawned agent whose ACH_RUN_TOKEN was unset (advisory). */
+export declare const SPAWNED_FORBIDDEN: string[];
+export declare function spawnedAgentEnv(env: NodeJS.ProcessEnv): boolean;
+export declare function forbiddenUnderRunToken(cmd: string): boolean;
+/**
+ * Read a file argument. Inside a spawned agent the file must resolve (through
+ * realpath, so symlinks cannot escape) inside the current directory (S2):
+ * `ach complete --result-file ~/.agentchannel/config.json` must not leak secrets.
+ */
+export declare function readArgFile(file: string, io: Pick<Io, 'env' | 'cwd'>): string;
+export declare function main(argv: string[], io?: Io): Promise<number>;
+/**
+ * Write <home>/bin/ach, a shim that runs this exact CLI with this node, so spawned
+ * agents always find a matching `ach` on PATH (even when the runner was started
+ * with npx or `node dist/src/cli.js`). Returns the dir to prepend to PATH.
+ */
+export declare function writeAchShim(home: string): string | undefined;
+/** B7: `ach run` exit code when the hub answers 401 (systemd: RestartPreventExitStatus=78). */
+export declare const AUTH_EXIT_CODE = 78;
+export declare const AUTH_EXIT_MESSAGE = "ach run: key rotated or agent deactivated \u2014 run ach join";