@ljwei-stak/dsh-model-route-bot 0.66.4 → 0.67.0

package/packages/cli-runtime/src/native-process.mjs

@@ -1,12 +1,69 @@
 import { spawn } from 'node:child_process'
 import { EventEmitter } from 'node:events'
 import { StringDecoder } from 'node:string_decoder'
-import { access, realpath } from 'node:fs/promises'
-import { isAbsolute, join } from 'node:path'
+import { access, lstat, readFile, readdir, realpath, rmdir, unlink } from 'node:fs/promises'
+import { lstatSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, writeFileSync } from 'node:fs'
+import { randomBytes } from 'node:crypto'
+import { tmpdir } from 'node:os'
+import { basename, dirname, isAbsolute, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
+import { NativeCliOutput } from './native-cli-output.mjs'
 
 const HERE = fileURLToPath(new URL('.', import.meta.url))
 const MAX_FRAME = 262_144
+const COMPILER_ROOT = 'DSH_NATIVE_COMPILER_ROOT'
+const COMPILER_SCRATCH = 'DSH_NATIVE_COMPILER_SCRATCH'
+// Capture only the trusted Host launch environment, never a model's spec or an
+// env argument. A packaged bridge inherits this one non-secret root hint so its
+// compiler does not start a new root beneath an ever-deeper private TEMP.
+const inheritedCompilerRoot = process.platform === 'win32' ? process.env[COMPILER_ROOT] : undefined
+const hostTemp = process.platform === 'win32' ? tmpdir() : null
+let compilerRoot = null
+const compilerFailure = () => Object.assign(new Error('NATIVE_COMPILER_SCRATCH_UNAVAILABLE'), { code: 'NATIVE_COMPILER_SCRATCH_UNAVAILABLE' })
+const sameDirectory = (info, expected) => info.isDirectory() && !info.isSymbolicLink() && info.dev === expected.dev && info.ino === expected.ino
+const rootStamp = path => `dsh-native-compiler-v1:${basename(path)}\n`
+
+function compilerDirectory() {
+  try {
+    if (!compilerRoot) {
+      if (inheritedCompilerRoot !== undefined) {
+        if (!isAbsolute(inheritedCompilerRoot) || inheritedCompilerRoot.length > 140 || !/^dshc-[a-f0-9]{16}$/.test(basename(inheritedCompilerRoot))) throw compilerFailure()
+        const info = lstatSync(inheritedCompilerRoot, { bigint: true })
+        if (!info.isDirectory() || info.isSymbolicLink() || realpathSync(inheritedCompilerRoot) !== inheritedCompilerRoot || readFileSync(join(inheritedCompilerRoot, '.dsh-root'), 'utf8') !== rootStamp(inheritedCompilerRoot)) throw compilerFailure()
+        compilerRoot = { path: inheritedCompilerRoot, info }
+      } else {
+        const parent = realpathSync(hostTemp)
+        const path = join(parent, `dshc-${randomBytes(8).toString('hex')}`)
+        if (path.length > 140) throw compilerFailure()
+        mkdirSync(path)
+        writeFileSync(join(path, '.dsh-root'), rootStamp(path), { flag: 'wx' })
+        compilerRoot = { path, info: lstatSync(path, { bigint: true }) }
+      }
+    }
+    if (!sameDirectory(lstatSync(compilerRoot.path, { bigint: true }), compilerRoot.info) || realpathSync(compilerRoot.path) !== compilerRoot.path) throw compilerFailure()
+    const path = mkdtempSync(join(compilerRoot.path, 'c-'))
+    const info = lstatSync(path, { bigint: true }), owner = randomBytes(16).toString('hex')
+    writeFileSync(join(path, '.dsh-owner'), owner, { flag: 'wx' })
+    const root = compilerRoot
+    // Never recursively remove a path obtained from the environment. Only this
+    // allocated child, after confirmed helper exit, with unchanged filesystem
+    // identity and no links/subdirectories, is eligible for flat cleanup.
+    const cleanup = async () => {
+      try {
+        if (dirname(path) !== root.path || !/^c-[A-Za-z0-9]{6}$/.test(basename(path))) return false
+        if (!sameDirectory(await lstat(root.path, { bigint: true }), root.info) || await realpath(root.path) !== root.path) return false
+        if (!sameDirectory(await lstat(path, { bigint: true }), info) || await realpath(path) !== path || await readFile(join(path, '.dsh-owner'), 'utf8') !== owner) return false
+        const names = await readdir(path)
+        if (names.length > 128) return false
+        for (const name of names) { const entry = await lstat(join(path, name)); if (!entry.isFile() || entry.isSymbolicLink()) return false }
+        for (const name of names) await unlink(join(path, name))
+        await rmdir(path)
+        return true
+      } catch { return false } // Busy, replaced or unknown resources remain.
+    }
+    return { root: root.path, path, cleanup }
+  } catch { throw compilerFailure() }
+}
 
 /** Deliberately small environment: profiles, credentials and proxy secrets are never inherited. */
 export function privateEnvironment(home, source = process.env) {
@@ -17,6 +74,7 @@ export function privateEnvironment(home, source = process.env) {
   for (const key of ['SystemRoot', 'windir', 'ComSpec', 'LANG', 'LC_ALL']) if (source[key]) env[key] = source[key]
   // Fixed executable paths remove PATH lookup from both supervisor and bridge.
   env.PATH = process.platform === 'win32' ? join(source.SystemRoot ?? 'C:\\Windows', 'System32') : '/usr/bin:/bin'
+  if (process.platform === 'win32' && (compilerRoot?.path ?? inheritedCompilerRoot)) env[COMPILER_ROOT] = compilerRoot?.path ?? inheritedCompilerRoot
   return env
 }
 
@@ -35,30 +93,35 @@ export async function resolveNativeHelper({ python = '/usr/bin/python3' } = {})
 export function nativeProcess(helper, mode, spec, { home, env = privateEnvironment(home) } = {}) {
   const events = new EventEmitter()
   const args = helper.platform === 'win32' ? [...helper.prefix, '-Mode', mode] : [...helper.prefix, mode]
-  const child = spawn(helper.executable, args, { cwd: home, env, windowsHide: true, shell: false, stdio: ['pipe', 'pipe', 'pipe'] })
-  let tail = '', buffer = '', bytes = 0, closed = false
+  const compiler = helper.platform === 'win32' ? compilerDirectory() : null
+  const helperEnv = compiler ? Object.fromEntries(Object.entries(env).filter(([key]) => ![COMPILER_ROOT, COMPILER_SCRATCH].includes(key.toUpperCase()))) : env
+  if (compiler) { helperEnv[COMPILER_ROOT] = compiler.root; helperEnv[COMPILER_SCRATCH] = compiler.path }
+  const child = spawn(helper.executable, args, { cwd: home, env: helperEnv, windowsHide: true, shell: false, stdio: ['pipe', 'pipe', 'pipe'] })
+  let tail = '', buffer = '', bytes = 0, closed = false, treeStopped = false
   const decoder = new StringDecoder('utf8'), cliDecoder = new StringDecoder('utf8')
-  let cliBuffer = ''
+  const cliOutput = new NativeCliOutput()
   const frame = value => {
+    if (mode === 'supervise' && value.control === 'stopped' && value.treeStopped === true) treeStopped = true
     if (mode === 'supervise' && value.type === 'cli-output') {
       if (typeof value.data !== 'string' || value.data.length > MAX_FRAME * 2) throw new Error('INVALID_CLI_FRAME')
-      cliBuffer += cliDecoder.write(Buffer.from(value.data, 'base64'))
-      if (Buffer.byteLength(cliBuffer) > MAX_FRAME) throw new Error('CLI_FRAME_LIMIT')
-      let end
-      while ((end = cliBuffer.indexOf('\n')) >= 0) {
-        const line = cliBuffer.slice(0, end); cliBuffer = cliBuffer.slice(end + 1)
-        if (line.trim()) events.emit('message', JSON.parse(line))
-      }
+      for (const message of cliOutput.push(cliDecoder.write(Buffer.from(value.data, 'base64')))) events.emit('message', message)
     } else events.emit(value.control ? 'control' : 'message', value)
   }
-  const exit = new Promise(resolve => child.once('close', (code, signal) => { closed = true; events.emit('closed', { code, signal }); resolve({ code, signal }) }))
+  const exit = new Promise(resolve => child.once('close', async (code, signal) => {
+    closed = true
+    if (compiler && code === 0 && signal === null && (mode !== 'supervise' || treeStopped)) await compiler.cleanup()
+    events.emit('closed', { code, signal }); resolve({ code, signal })
+  }))
   child.on('error', error => events.emit('failure', error))
   child.stdin.on('error', () => {})
   child.stderr.on('data', data => { tail = (tail + data.toString('utf8')).slice(-4096) })
   child.stdout.on('data', chunk => {
     bytes += chunk.length
     buffer += decoder.write(chunk)
-    if (bytes > 8 * 1024 * 1024 || Buffer.byteLength(buffer) > MAX_FRAME) { events.emit('failure', new Error('OUTPUT_LIMIT')); child.stdin.end(); return }
+    // MCP responses and CLI image echoes have their own bounded readers. Their
+    // retained connections can carry several screenshots without a raw lifetime cap.
+    const boundedStream = mode === 'client' || mode === 'server' || mode === 'supervise'
+    if (!boundedStream && bytes > 8 * 1024 * 1024 || Buffer.byteLength(buffer) > MAX_FRAME) { events.emit('failure', new Error('OUTPUT_LIMIT')); child.stdin.end(); return }
     let end
     while ((end = buffer.indexOf('\n')) >= 0) {
       const line = buffer.slice(0, end); buffer = buffer.slice(end + 1)

package/packages/model-router-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ljwei-stak/dsh-model-router",
-  "version": "0.66.4",
+  "version": "0.67.0",
   "type": "module",
   "license": "MIT",
   "repository": {

package/packages/orchestration/src/binding-product.mjs

@@ -0,0 +1,19 @@
+const invalid = () => { throw Object.assign(new Error('请选择当前团队中的 Bot。'), { code: 'INVALID_BINDING_OWNER' }) }
+
+/** A bounded owner view for chat settings; it never reads task inputs or receipts. */
+export async function inspectProductBinding({ runtime, lifecycle, botSettings, fundingAccounts, signal }, payload) {
+  if (!payload || typeof payload !== 'object' || Array.isArray(payload) || Object.keys(payload).some(key => key !== 'botId') || typeof payload.botId !== 'string') invalid()
+  signal?.throwIfAborted()
+  await runtime.load()
+  signal?.throwIfAborted()
+  const bot = lifecycle.committedBot(payload.botId)
+  if (!bot) invalid()
+  const main = lifecycle.committedMainBotIds?.().includes(bot.id) === true
+  const record=botSettings.get(bot.id)
+  const grant=main?lifecycle.committedGrant?.(bot.id):null
+  return { schemaVersion: 1, bot: { id: bot.id, name: bot.name, role: bot.role ?? '', model: bot.model ?? null,
+    main, permissions: main ? 'full-control' : 'scoped',
+    appliedModel: typeof bot.appliedModel === 'string' ? bot.appliedModel : null },
+    record: grant?{...record,grant}:record, accounts: { status: 'available', items: fundingAccounts?.catalog() ?? [] },
+    availableActions: ['binding.save', 'funding.account.save'] }
+}

package/packages/orchestration/src/bot-data-actions.mjs

@@ -0,0 +1,45 @@
+/**
+ * The panel-facing data actions. The human signs in as owner and picks which
+ * Bot's data to view; the read-model's dispatch already requires an
+ * authenticated owner and an allow-listed action, so these handlers only map
+ * payloads onto the engine. A Bot id is still validated by the engine (never a
+ * path, another service or an endpoint), and every failure is a structured
+ * DataError the panel can render instead of a silent empty state.
+ *
+ * Wire these into product-composition's `actions` and add their names to the
+ * read-model ACTIONS allow-list — see data-wiring.patch.
+ *
+ * Interface notes for the panel:
+ *  - `data.show` takes `{ kind, table|sql, cardId? }`. With `cardId` it re-opens
+ *    a SAVED card: the chart is re-rendered from its saved spec and the table
+ *    from its saved result, so a chart card can be reopened (its id is a card
+ *    id, never a table name).
+ *  - `data.export` fails loudly: a library write that fails returns a structured
+ *    error (output_too_large for the library's single-file limit) and NO path,
+ *    so the panel must not report a completed export.
+ *  - `data.cancel` reaches the Host and SIGKILLs the Bot's worker; it is a stop
+ *    REQUEST, and the in-flight call fails with `cancelled`.
+ */
+
+import { DataFailure } from './bot-data-surface.mjs'
+
+const errorOf = error => (error instanceof DataFailure ? error.error : { code: 'engine_unavailable', message: String(error?.message ?? error) })
+
+/** @param {{ engine: object }} source */
+export function createDataActions({ engine } = {}) {
+  if (!engine || typeof engine.forBot !== 'function') throw new TypeError('DATA_ACTIONS_REQUIRE_ENGINE')
+  const wrap = run => async payload => { try { return await run(payload) } catch (error) { return { error: errorOf(error) } } }
+  const bot = payload => engine.forBot(payload?.botId)
+
+  return Object.freeze({
+    'data.catalog': wrap(payload => bot(payload).catalog()),
+    'data.load': wrap(payload => bot(payload).load(payload)),
+    'data.describe': wrap(payload => bot(payload).describe(payload?.target)),
+    'data.sql': wrap(payload => bot(payload).sql(payload)),
+    'data.show': wrap(payload => bot(payload).show(payload)),
+    'data.page': wrap(payload => bot(payload).page(payload)),
+    'data.export': wrap(payload => bot(payload).exportCsv(payload)),
+    'data.remove': wrap(payload => bot(payload).remove(payload)),
+    'data.cancel': wrap(payload => bot(payload).cancel()),
+  })
+}

package/packages/orchestration/src/bot-data-chart.mjs

@@ -0,0 +1,109 @@
+/**
+ * The chart compiler: a tiny, safe spec the model can ask for, compiled to a
+ * bounded SQL aggregation and then shaped into a declarative result the panel
+ * renders as inline SVG. The model never writes a chart grammar and never
+ * writes raw SQL for a chart — only {type,x,y,color,agg,…} with column names
+ * that must already exist. Identifiers are quoted; values are never
+ * concatenated into the SQL.
+ *
+ * Supported marks: bar, line, area (the required minimum). scatter, histogram,
+ * pie and heatmap are intentionally refused for now rather than faked — see
+ * data-report.md. Aggregations count/sum/avg/min/max are supported; median is
+ * refused (SQLite has no median aggregate) rather than approximated silently.
+ *
+ * Ported and narrowed from OpenMausBot server/data/chart-compiler.ts (1bc4749).
+ */
+
+import { DATA_LIMITS, DataFailure, dataError, quoteIdent } from './bot-data-surface.mjs'
+
+const fail = (code, message, extra = {}) => { throw new DataFailure(dataError(code, message, extra)) }
+
+const MARKS = new Set(['bar', 'line', 'area'])
+const AGGS = new Set(['count', 'sum', 'avg', 'min', 'max'])
+const SORTS = new Set(['x', '-x', 'y', '-y'])
+const TIME_FORMAT = { year: '%Y', quarter: null, month: '%Y-%m', week: '%Y-W%W', day: '%Y-%m-%d', hour: '%Y-%m-%d %H' }
+
+/** Validate the spec against the table's real columns; throw spec_invalid otherwise. */
+function validate(spec, columns) {
+  if (!spec || typeof spec !== 'object') fail('spec_invalid', 'A chart spec object is required.')
+  if (!MARKS.has(spec.type)) fail('spec_invalid', `Chart type ${JSON.stringify(spec.type)} is not supported yet. Supported: bar, line, area.`)
+  if (typeof spec.x !== 'string' || !columns.includes(spec.x)) fail('spec_invalid', `Unknown x column ${JSON.stringify(spec.x)}. Use data_describe to list columns.`)
+  if (spec.y !== undefined && (typeof spec.y !== 'string' || !columns.includes(spec.y))) fail('spec_invalid', `Unknown y column ${JSON.stringify(spec.y)}. Use data_describe to list columns.`)
+  if (spec.color !== undefined && (typeof spec.color !== 'string' || !columns.includes(spec.color))) fail('spec_invalid', `Unknown color column ${JSON.stringify(spec.color)}.`)
+  const agg = spec.agg ?? (spec.y ? 'sum' : 'count')
+  if (!AGGS.has(agg)) fail('spec_invalid', `Aggregation ${JSON.stringify(agg)} is not supported. Supported: ${[...AGGS].join(', ')}.`)
+  if (spec.sort !== undefined && !SORTS.has(spec.sort)) fail('spec_invalid', `Unknown sort ${JSON.stringify(spec.sort)}.`)
+  if (spec.timeUnit !== undefined && !(spec.timeUnit in TIME_FORMAT)) fail('spec_invalid', `Unknown timeUnit ${JSON.stringify(spec.timeUnit)}.`)
+  if (spec.timeUnit === 'quarter' && !spec.y) fail('spec_invalid', 'A quarter bucket needs an aggregation (set y and agg).')
+  return { agg }
+}
+
+/** Build the aggregation SQL and a reduction description. `from` is the final SQL relation (a quoted identifier or a parenthesised subquery); spec columns are quoted here, never concatenated raw. */
+export function compileChart(spec, columns, from) {
+  const { agg } = validate(spec, columns)
+  const limit = Math.min(Math.max(1, Math.trunc(spec.limit ?? 20)), 1000)
+  const hasColor = spec.color !== undefined
+  const groupParts = []
+  const selectParts = []
+
+  // x expression: raw column, or a time bucket when timeUnit is set.
+  let xExpr
+  if (spec.timeUnit) {
+    const format = TIME_FORMAT[spec.timeUnit]
+    xExpr = spec.timeUnit === 'quarter'
+      ? `(strftime('%Y', ${quoteIdent(spec.x)}) || '-Q' || ((CAST(strftime('%m', ${quoteIdent(spec.x)}) AS INTEGER) + 2) / 3))`
+      : `strftime(${`'${format}'`}, ${quoteIdent(spec.x)})`
+    groupParts.push(xExpr)
+    selectParts.push(`${xExpr} AS x`)
+  } else {
+    groupParts.push(quoteIdent(spec.x))
+    selectParts.push(`${quoteIdent(spec.x)} AS x`)
+  }
+
+  // y expression: COUNT(*) or AGG(y).
+  const yExpr = agg === 'count' || !spec.y ? 'COUNT(*)' : `${agg.toUpperCase()}(${quoteIdent(spec.y)})`
+  selectParts.push(`${yExpr} AS y`)
+
+  if (hasColor) { groupParts.push(quoteIdent(spec.color)); selectParts.push(`${quoteIdent(spec.color)} AS series`) }
+
+  let orderBy
+  switch (spec.sort) {
+    case '-x': orderBy = 'x DESC'; break
+    case 'y': orderBy = 'y ASC'; break
+    case '-y': orderBy = 'y DESC'; break
+    default: orderBy = 'x ASC'
+  }
+  const sql = `SELECT ${selectParts.join(', ')} FROM ${from} GROUP BY ${groupParts.join(', ')} ORDER BY ${orderBy} LIMIT ${limit}`
+  const reduction = {
+    method: spec.timeUnit ? 'timeBucket' : 'group',
+    inputRows: null,
+    outputRows: null,
+    note: spec.timeUnit ? `Bucketed by ${spec.timeUnit}.` : `Grouped by ${spec.x}${hasColor ? ` and ${spec.color}` : ''}, ${agg}${spec.y ? ` of ${spec.y}` : ''}. Top ${limit} by ${orderBy}.`,
+  }
+  return { sql, xLabel: spec.x, yLabel: spec.y ?? 'count', reduction, hasColor }
+}
+
+/** Shape a bounded result (columns + rows) into a declarative chart the panel renders. */
+export function shapeChart(result, spec) {
+  const hasColor = result.columns.some(column => column.name === 'series')
+  const seriesMap = new Map()
+  let maxMarks = DATA_LIMITS.chartMaxMarks
+  for (const row of result.rows) {
+    if (maxMarks-- <= 0) break
+    const x = row[0]
+    const y = row[1]
+    const key = hasColor ? String(row[2]) : 'series'
+    if (!seriesMap.has(key)) seriesMap.set(key, [])
+    seriesMap.get(key).push({ x: x === null ? null : String(x), y: typeof y === 'number' ? y : Number(y) || 0 })
+  }
+  const series = [...seriesMap.entries()].map(([key, points]) => ({ key, points }))
+  return {
+    kind: 'chart',
+    type: spec.type,
+    xLabel: spec.x,
+    yLabel: spec.y ?? 'count',
+    stacked: spec.stack === true,
+    series,
+    truncated: result.truncated || maxMarks < 0,
+  }
+}

package/packages/orchestration/src/bot-data-context.mjs

@@ -0,0 +1,44 @@
+/**
+ * The data context envelope (apps.data-context, P2): a metadata-only summary
+ * the Host can inject into a Bot's prompt so it knows what it can query,
+ * WITHOUT ever leaking row data. It lists table names, columns, types and row
+ * counts, plus saved card titles — never a single cell value.
+ *
+ * This is a pure function of the engine's catalog; the composition decides
+ * where to inject it (see data-wiring.patch). It is bounded so a Bot with many
+ * tables cannot bloat the prompt.
+ */
+
+import { DATA_LIMITS } from './bot-data-surface.mjs'
+
+const TABLES_MAX = 25
+const COLUMNS_MAX = 20
+
+/**
+ * @param {object} engine
+ * @param {string} botId
+ * @returns {Promise<{ tables: Array<{name:string,rowCount?:number,columns:string[]}>, cards: Array<{id:string,title:string,kind:string}> }>}
+ */
+export async function buildDataContext(engine, botId) {
+  const catalog = await engine.forBot(botId).catalog()
+  return {
+    tables: catalog.tables.slice(0, TABLES_MAX).map(table => ({
+      name: table.name,
+      columns: table.columns.slice(0, COLUMNS_MAX).map(column => `${column.name} ${column.type}`.trim()),
+      columnCount: table.columns.length,
+    })),
+    cards: catalog.cards.slice(0, DATA_LIMITS.sheetCardsMax).map(card => ({ id: card.id, title: card.title, kind: card.kind })),
+  }
+}
+
+/** Render the envelope as compact prompt text. Metadata only — no cell values. */
+export function renderDataContext(context) {
+  if (!context || !context.tables?.length) return ''
+  const lines = ['You have data tables you can query with data_describe, data_sql, data_show and data_export (metadata only; no rows are shown here):']
+  for (const table of context.tables) {
+    const columns = table.columns.length ? `: ${table.columns.join(', ')}` : ''
+    lines.push(`- ${table.name}${columns}`)
+  }
+  for (const card of context.cards ?? []) lines.push(`- saved ${card.kind} card "${card.title}" (${card.id})`)
+  return lines.join('\n')
+}