@my-life-buddies/cli 0.3.0 → 0.4.0

package/dist/bin/preview.js

@@ -175,6 +175,22 @@ var PreviewController = class {
     }
     return this.simulatorSnapshot();
   }
+  /** Never allow an old conversation's delayed widget response to enter the new one. */
+  async simulatorWidgets(action, id = "", mediaId = "") {
+    if (this.#resetting) throw Object.assign(new Error("\u4F1A\u8BDD\u6B63\u5728\u91CD\u7F6E"), { status: 409 });
+    const client = this.#requiredSimulator();
+    const revision = this.#conversationRevision;
+    let result;
+    if (action === "list" && client.widgets) result = { widgets: await client.widgets(), conversationRevision: revision };
+    else if (action === "html" && client.widgetHtml) result = await client.widgetHtml(id);
+    else if (action === "image" && client.widgetImage) result = await client.widgetImage(id, mediaId);
+    else if ((action === "pin" || action === "unpin") && client.pinWidget) {
+      await client.pinWidget(id, action === "pin");
+      result = { ok: true };
+    } else throw Object.assign(new Error("\u5F53\u524D\u6A21\u62DF\u5668\u4E0D\u652F\u6301\u5C0F\u6302\u4EF6"), { status: 501 });
+    if (this.#resetting || revision !== this.#conversationRevision || client !== this.#simulator) throw Object.assign(new Error("\u4F1A\u8BDD\u5DF2\u5207\u6362\uFF0C\u8BF7\u91CD\u65B0\u6253\u5F00\u5C0F\u6302\u4EF6"), { status: 409 });
+    return result;
+  }
   async resetSimulator() {
     if (this.#resetting || this.#sendingMessage || this.#simulatorState.activeRun) {
       throw Object.assign(new Error("\u8BF7\u7B49\u5F85\u5F53\u524D\u56DE\u590D\u6216\u64CD\u4F5C\u5B8C\u6210\u540E\u518D\u6E05\u7A7A"), { status: 409, code: "SIMULATOR_BUSY" });
@@ -578,13 +594,14 @@ var PreviewController = class {
 };
 
 // apps/preview/src/server.ts
+import { checkWidgetDelivery } from "./core.js";
 import { randomBytes, timingSafeEqual } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { createServer } from "node:http";
 import { createRequire } from "node:module";
 import QRCode from "qrcode";
 var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["127.0.0.1", "::1", "localhost"]);
-var SESSION_COOKIE = "buddy_preview_session";
+var SESSION_COOKIE_PREFIX = "buddy_preview_session";
 var require2 = createRequire(import.meta.url);
 var BRAND_ICON = Buffer.from(
   readFileSync(new URL("../web/assets/developer-platform-icon.png.base64", import.meta.url), "utf8").trim(),
@@ -607,6 +624,9 @@ var WEB_ASSETS = Object.freeze(/* @__PURE__ */ new Map([
     contentType: "text/css; charset=utf-8",
     body: readFileSync(new URL("../web/brand.css", import.meta.url))
   }],
+  ["/assets/widget-delivery.js", { contentType: "text/javascript; charset=utf-8", body: readFileSync(new URL("../web/widget-delivery.js", import.meta.url)) }],
+  ["/assets/widgets.js", { contentType: "text/javascript; charset=utf-8", body: readFileSync(new URL("../web/widgets.js", import.meta.url)) }],
+  ["/assets/widgets.css", { contentType: "text/css; charset=utf-8", body: readFileSync(new URL("../web/widgets.css", import.meta.url)) }],
   ["/assets/app.js", {
     contentType: "text/javascript; charset=utf-8",
     body: readFileSync(new URL("../web/app.js", import.meta.url))
@@ -771,6 +791,7 @@ data: ${JSON.stringify(value)}
     if (!allowedHost(request, Number(origin.port)) || !allowedOrigin(request, origin)) {
       return apiError(response, 403, "PREVIEW_ORIGIN_FORBIDDEN", "\u8BF7\u6C42\u6765\u6E90\u4E0D\u53D7\u4FE1\u4EFB");
     }
+    const sessionCookie = `${SESSION_COOKIE_PREFIX}_${origin.port}`;
     const url = requestUrl(request, origin);
     if (!url) return apiError(response, 400, "INVALID_URL", "\u8BF7\u6C42\u5730\u5740\u65E0\u6548");
     if (request.method === "GET" && bootstrapAvailable && url.pathname === `/bootstrap/${sessionToken}`) {
@@ -779,13 +800,13 @@ data: ${JSON.stringify(value)}
       writeHeaders(response);
       response.setHeader(
         "Set-Cookie",
-        `${SESSION_COOKIE}=${sessionToken}; HttpOnly; SameSite=Strict; Path=/; Max-Age=43200`
+        `${sessionCookie}=${sessionToken}; HttpOnly; SameSite=Strict; Path=/; Max-Age=43200`
       );
       response.setHeader("Location", "/");
       response.end();
       return;
     }
-    const suppliedToken = cookieValue(request, SESSION_COOKIE);
+    const suppliedToken = cookieValue(request, sessionCookie);
     if (!suppliedToken || !safeEqual(suppliedToken, sessionToken)) {
       return apiError(response, 401, "PREVIEW_UNAUTHORIZED", "\u9700\u8981\u4ECE CLI \u63D0\u4F9B\u7684\u4E00\u6B21\u6027\u5165\u53E3\u6253\u5F00 Preview");
     }
@@ -793,6 +814,9 @@ data: ${JSON.stringify(value)}
       const asset = WEB_ASSETS.get(url.pathname);
       if (asset) return staticAsset(response, asset);
     }
+    if (request.method === "GET" && url.pathname === "/api/widgets/delivery") {
+      return json(response, 200, await checkWidgetDelivery(options.controller.projectRoot));
+    }
     if (request.method === "GET" && url.pathname === "/api/project") {
       try {
         return json(response, 200, { project: publicProject(await options.controller.project()) });
@@ -833,6 +857,35 @@ data: ${JSON.stringify(value)}
         return apiError(response, failure.status, failure.code, failure.message);
       }
     }
+    const widgetRoute = /^\/api\/simulator\/widgets(?:\/([^/]+)(?:\/(image|pin))?)?$/u.exec(url.pathname);
+    if (widgetRoute) {
+      try {
+        const id = widgetRoute[1] ? decodeURIComponent(widgetRoute[1]) : "";
+        const suffix = widgetRoute[2];
+        if (request.method === "GET" && !id) return json(response, 200, await options.controller.simulatorWidgets("list"));
+        if (id && suffix === "pin" && (request.method === "PUT" || request.method === "DELETE")) return json(response, 200, await options.controller.simulatorWidgets(request.method === "PUT" ? "pin" : "unpin", id));
+        if (id && request.method === "GET" && suffix === "image") {
+          const image = await options.controller.simulatorWidgets("image", id, url.searchParams.get("mediaId") ?? "");
+          if (!/^image\/(png|jpeg|webp|gif)(;|$)/u.test(image.contentType)) throw new Error("\u56FE\u7247\u683C\u5F0F\u4E0D\u652F\u6301");
+          writeHeaders(response);
+          response.setHeader("Content-Type", image.contentType);
+          response.end(image.body);
+          return;
+        }
+        if (id && request.method === "GET" && !suffix) {
+          const html = await options.controller.simulatorWidgets("html", id);
+          writeHeaders(response);
+          response.setHeader("Content-Security-Policy", "sandbox allow-scripts; default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; img-src data:; connect-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'self'");
+          response.setHeader("Content-Type", "text/html; charset=utf-8");
+          response.end(html);
+          return;
+        }
+        return apiError(response, 405, "METHOD_NOT_ALLOWED", "\u4E0D\u652F\u6301\u8FD9\u4E2A\u5C0F\u6302\u4EF6\u64CD\u4F5C");
+      } catch (cause) {
+        const failure = requestFailure(cause);
+        return apiError(response, failure.status, failure.code, failure.message);
+      }
+    }
     if (request.method === "GET" && url.pathname === "/api/events") {
       response.statusCode = 200;
       writeHeaders(response);
@@ -1229,18 +1282,51 @@ function message(value, index) {
   const role = input.author === "buddy" ? "assistant" : input.author === "user" || input.author === "owner" ? "user" : void 0;
   if (!role) return null;
   const messageId = safeText(input.id, `messages[${index}].id`, 256);
-  if (typeof input.text !== "string" || Buffer.byteLength(input.text, "utf8") > 48 * 1024) {
+  let text2 = input.type === "widget" && input.text === void 0 ? "" : input.text;
+  if (typeof text2 !== "string" || Buffer.byteLength(text2, "utf8") > 48 * 1024) {
     throw new Error(`messages[${index}].text is invalid`);
   }
-  if (input.type === "tool" && !input.text.trim()) return null;
+  if (input.type === "tool" && !text2.trim()) return null;
   if (typeof input.timestamp !== "number" || !Number.isFinite(input.timestamp)) {
     throw new Error(`messages[${index}].timestamp is invalid`);
   }
+  if (role === "assistant" && input.type === "question") {
+    const options = object(input.question)?.options;
+    if (!Array.isArray(options) || options.length < 2 || options.length > 4 || options.some((option) => typeof option !== "string" || !option.trim() || option.length > 30)) {
+      throw new Error(`messages[${index}].question is invalid`);
+    }
+    text2 += `
+
+${options.map((option, i) => `${i + 1}. ${option}`).join("\n")}
+
+\u8BF7\u76F4\u63A5\u56DE\u590D\u4F60\u7684\u9009\u62E9\uFF0C\u4E5F\u53EF\u4EE5\u8865\u5145\u8BF4\u660E\u3002`;
+  }
+  if (role === "assistant" && input.type === "permissionRequest") {
+    const request = object(input.permissionRequest);
+    text2 += request?.status === "pending" ? "\n\n\u8BF7\u5728\u642D\u642D App \u4E2D\u5904\u7406\u8FD9\u5F20\u6388\u6743\u5361\uFF1B\u6D4F\u89C8\u5668\u9884\u89C8\u4E0D\u4EE3\u66FF\u7CFB\u7EDF\u6388\u6743\u3002" : "\n\n\u6388\u6743\u5361\u7684\u5904\u7406\u7ED3\u679C\u8BF7\u4EE5\u642D\u642D App \u4E2D\u7684\u72B6\u6001\u4E3A\u51C6\u3002";
+  }
   return Object.freeze({
     messageId,
     role,
-    text: input.text,
-    createdAt: new Date(input.timestamp).toISOString()
+    text: text2,
+    createdAt: new Date(input.timestamp).toISOString(),
+    ...input.type === "widget" && object(input.widget) ? { widget: parseWidget(input.widget) } : {}
+  });
+}
+function widgetId(value) {
+  const id = safeText(value, "widgetId", 64);
+  if (/[\s/\\]/u.test(id) || id === "." || id === "..") throw new TypeError("widgetId is invalid");
+  return id;
+}
+function parseWidget(value) {
+  const item = object(value);
+  return Object.freeze({
+    id: widgetId(item?.id),
+    title: typeof item?.title === "string" && item.title.trim() ? item.title : "\u5C0F\u6302\u4EF6",
+    ...typeof item?.type === "string" ? { type: item.type } : {},
+    ...typeof item?.summary === "string" ? { summary: item.summary } : {},
+    ...typeof item?.imageMediaId === "string" && /^media_[a-zA-Z0-9_-]+$/u.test(item.imageMediaId) ? { imageMediaId: item.imageMediaId } : {},
+    ...typeof item?.isPinned === "boolean" ? { isPinned: item.isPinned } : {}
   });
 }
 function localReceipt(prefix, value) {
@@ -1292,6 +1378,52 @@ var MlbSimulatorClient = class {
     this.#privateId = details.privateId ?? void 0;
     return details;
   }
+  async widgets() {
+    this.#assertResetComplete();
+    const id = await this.#ensurePrivate();
+    const body = object(await this.#request("GET", `/app/privates/${encodeURIComponent(id)}/widgets`, {}));
+    if (!Array.isArray(body?.widgets)) throw httpError(502, { error: "\u65E0\u6CD5\u8BFB\u53D6\u4F1A\u8BDD\u5C0F\u6302\u4EF6" });
+    return body.widgets.map(parseWidget).filter((item) => item.type !== void 0);
+  }
+  async widgetHtml(id) {
+    this.#assertResetComplete();
+    const privateId = await this.#ensurePrivate();
+    const result = await this.#widgetResource(`/app/widgets/${encodeURIComponent(widgetId(id))}?conversationId=${encodeURIComponent(privateId)}`);
+    return new TextDecoder("utf-8", { fatal: true }).decode(result.body);
+  }
+  async pinWidget(id, pinned) {
+    this.#assertResetComplete();
+    const privateId = await this.#ensurePrivate();
+    await this.#request(pinned ? "PUT" : "DELETE", `/app/widgets/${encodeURIComponent(widgetId(id))}/pin`, { ...pinned ? { body: { sourceConversationId: privateId } } : {} });
+  }
+  async widgetImage(id, mediaId) {
+    this.#assertResetComplete();
+    if (!/^media_[a-zA-Z0-9_-]+$/u.test(mediaId)) throw new TypeError("Invalid media ID");
+    const access = object(await this.#request("GET", `/app/media/${encodeURIComponent(mediaId)}?widgetId=${encodeURIComponent(widgetId(id))}`, {}));
+    const url = new URL(String(access?.url));
+    if (url.protocol !== "https:" || url.username || url.password || access?.mediaId !== mediaId || typeof access.expiresAt !== "number" || access.expiresAt <= Date.now()) throw new Error("\u56FE\u7247\u94FE\u63A5\u5DF2\u8FC7\u671F\uFF0C\u8BF7\u91CD\u8BD5");
+    return this.#widgetResource(url.href, false);
+  }
+  async #widgetResource(path, authenticated = true) {
+    const response = await this.#fetch(authenticated ? endpoint(this.#baseUrl, path) : new URL(path), { headers: authenticated ? { Authorization: `Bearer ${this.#accessToken}` } : {}, credentials: "omit", redirect: "error", signal: AbortSignal.timeout(15e3) });
+    if (!response.ok) throw httpError(response.status, { error: response.status === 403 || response.status === 404 ? "\u5C0F\u6302\u4EF6\u5DF2\u5220\u9664\u3001\u9875\u9762\u672A\u4E0A\u4F20\uFF0C\u6216\u4F60\u5DF2\u4E0D\u5728\u8FD9\u4E2A\u4F1A\u8BDD\u4E2D\u3002" : "\u5C0F\u6302\u4EF6\u6682\u65F6\u65E0\u6CD5\u6253\u5F00\uFF0C\u8BF7\u91CD\u65B0\u52A0\u8F7D\u3002" });
+    const reader = response.body?.getReader();
+    if (!reader) throw new Error("\u5C0F\u6302\u4EF6\u5185\u5BB9\u4E3A\u7A7A");
+    const chunks = [];
+    let size = 0;
+    try {
+      while (true) {
+        const part = await reader.read();
+        if (part.done) break;
+        size += part.value.byteLength;
+        if (size > 4 * 1024 * 1024) throw new Error("\u5C0F\u6302\u4EF6\u5185\u5BB9\u8FC7\u5927\uFF0C\u6682\u65F6\u65E0\u6CD5\u6253\u5F00");
+        chunks.push(part.value);
+      }
+    } finally {
+      await reader.cancel();
+    }
+    return { body: Buffer.concat(chunks), contentType: response.headers.get("content-type") ?? "text/html" };
+  }
   async state(options = {}) {
     this.#assertResetComplete();
     const privateId = await this.#ensurePrivate(options.signal);
@@ -1359,14 +1491,16 @@ var MlbSimulatorClient = class {
         value = await mlbAppCommand(url, this.#accessToken, "message.send", {
           kind: "private",
           id: privateId,
-          message: input.text,
+          messages: [{ type: "text", text: input.text }],
           clientMessageId
         }, { signal: options.signal });
         const receipt2 = object(value);
-        if (receipt2?.ok !== true || receipt2.clientMessageId !== clientMessageId || typeof receipt2.messageId !== "string" || !receipt2.messageId.trim() || !Number.isSafeInteger(receipt2.timestamp) || receipt2.timestamp < 0 || typeof receipt2.shouldReply !== "boolean") {
+        const items = Array.isArray(receipt2?.items) ? receipt2.items : [];
+        const item2 = object(items[0]);
+        if (receipt2?.ok !== true || receipt2.clientMessageId !== clientMessageId || items.length !== 1 || item2?.index !== 0 || typeof item2.messageId !== "string" || !item2.messageId.trim() || !Number.isSafeInteger(item2.timestamp) || item2.timestamp < 0 || typeof receipt2.shouldReply !== "boolean") {
           throw httpError(502, { error: "MLB \u6D88\u606F\u56DE\u6267\u65E0\u6548" });
         }
-        safeText(receipt2.messageId, "receipt.messageId", 256);
+        safeText(item2.messageId, "receipt.items[0].messageId", 256);
       } catch (cause) {
         if (cause && typeof cause === "object" && "status" in cause && typeof cause.status === "number" && cause.status >= 400 && cause.status < 500) throw cause;
         throw Object.assign(new Error("\u53D1\u9001\u7ED3\u679C\u5C1A\u672A\u786E\u8BA4\uFF0C\u8BF7\u5237\u65B0\u804A\u5929\u8BB0\u5F55\u540E\u518D\u91CD\u8BD5"), {
@@ -1376,11 +1510,12 @@ var MlbSimulatorClient = class {
         });
       }
       const receipt = object(value);
+      const item = object(receipt.items[0]);
       const runId = localReceipt("turn", idempotencyKey);
-      const messageId = safeText(receipt.messageId, "receipt.messageId", 256);
+      const messageId = safeText(item.messageId, "receipt.items[0].messageId", 256);
       this.#active = receipt.shouldReply ? Object.freeze({
         runId,
-        messageTimestamp: receipt.timestamp,
+        messageTimestamp: item.timestamp,
         observedReplying: false
       }) : void 0;
       this.#latest = Object.freeze({ runId, status: receipt.shouldReply ? "pending" : "completed" });